Chapter 6. Monitoring the Dev Workspace operator

Procedure

1. Create a ClusterRoleBinding to bind the ServiceAccount associated with Prometheus to the devworkspace-controller-metrics-reader ClusterRole. Without the ClusterRoleBinding, you cannot access Dev Workspace metrics because they are protected with role-based access control (RBAC).

   Example 6.1. ClusterRole example

   apiVersion: rbac.authorization.k8s.io/v1
   kind: ClusterRole
   metadata:
     name: devworkspace-controller-metrics-reader
   rules:
   - nonResourceURLs:
     - /metrics
     verbs:
     - get

   Example 6.2. ClusterRoleBinding example

   apiVersion: rbac.authorization.k8s.io/v1
   kind: ClusterRoleBinding
   metadata:
     name: devworkspace-controller-metrics-binding
   subjects:
     - kind: ServiceAccount
       name: <ServiceAccount name associated with the Prometheus Pod>
       namespace: <Prometheus namespace>
   roleRef:
     apiGroup: rbac.authorization.k8s.io
     kind: ClusterRole
     name: devworkspace-controller-metrics-reader

2. Configure Prometheus to scrape metrics from the 8443 port exposed by the devworkspace-controller-metrics service, and 9443 port exposed by the devworkspace-webhookserver service.

   Example 6.3. Prometheus configuration example

   apiVersion: v1
   kind: ConfigMap
   metadata:
     name: prometheus-config
   data:
     prometheus.yml: |-
         global:
           scrape_interval:     5s             1
           evaluation_interval: 5s             2
         scrape_configs:                       3
           - job_name: 'DevWorkspace'
             authorization:
               type: Bearer
               credentials_file: '/var/run/secrets/kubernetes.io/serviceaccount/token'
             tls_config:
               insecure_skip_verify: true
             static_configs:
               - targets: ['devworkspace-controller-metrics:8443']  4
           - job_name: 'DevWorkspace webhooks'
             authorization:
               type: Bearer
               credentials_file: '/var/run/secrets/kubernetes.io/serviceaccount/token'
             tls_config:
               insecure_skip_verify: true
             static_configs:
               - targets: ['devworkspace-webhookserver:9443']  5