Monitoring openshift: is it possible to monitor one project or namespace?

[antonio_villarr]

Hi,

Customer is about to install Dynatrace to monitor Openshift 4.2. They are concerned about selective monitoring. I mean, is it possible to install it on a cluster, and only monitor processes/containers for an openshift project or namespace?

By default in Dynatrace you can disable a server that is the host for some layer (application servers of an specific application, for example). But in openshift, disabling a cluster node could mean disabling lots of entities for several projects, even the ones you want to monitor. How is this done? is an all or nothing thing?

Thanks in advance.

Antonio V.

[Radoslaw_Szulgo · Accepted solution]

Of course it is possible now! It's done in container monitoring rules settings (Settings -> Process and containers -> Container monitoring):

And you can filter events based on namespace as well:.

https://www.dynatrace.com/support/help/shortlink/monitor-events-kubernetes#which-kubernetes-events-c...

[antonio_villarr]

Thank you very much.

[fobid39412]

Hi @Radoslaw S. sorry to bother. Quick question, is this possible to do via API? or via yaml at the moment of oneagent deployment? Or do it with a tag?

[Radoslaw_Szulgo]

Not yet. Planned for CQ1/2021

[Geoffke]

Hi @Radoslaw_Szulgo , the option via the yaml file, is this currently already available? 

[Radoslaw_Szulgo]

Yes, I believe this is in Environments v2 API : Settings -> look for the schema:

"schemaId": "builtin:container.built-in-monitoring-rule",
      "displayName": "Built-in container monitoring rules",

looks like this at the moment:

{
  "dynatrace": "1",
  "schemaId": "builtin:container.built-in-monitoring-rule",
  "displayName": "Built-in container monitoring rules",
  "description": "Dynatrace disables monitoring of containers that do not run any applications.",
  "documentation": "",
  "version": "0",
  "multiObject": false,
  "maxObjects": 1,
  "allowedScopes": [
    "environment"
  ],
  "enums": {},
  "types": {},
  "properties": {
    "ignoreKubernetesPauseContainer": {
      "displayName": "Do not monitor containers where Kubernetes container name equals 'POD'",
      "description": "Disable monitoring of platform internal pause containers in Kubernetes and OpenShift.",
      "documentation": "",
      "type": "boolean",
      "nullable": false,
      "maxObjects": 1,
      "default": true
    },
    "ignoreDockerPauseContainer": {
      "displayName": "Do not monitor containers where Docker stripped image name contains 'pause-amd64'",
      "description": "Disable monitoring of platform internal pause containers in Kubernetes and OpenShift.",
      "documentation": "",
      "type": "boolean",
      "nullable": false,
      "maxObjects": 1,
      "default": true
    },
    "ignoreOpenShiftSdnNamespace": {
      "displayName": "Do not monitor containers where Kubernetes namespace equals 'openshift-sdn'",
      "description": "Disable monitoring of platform internal containers in the openshift-sdn namespace.",
      "documentation": "",
      "type": "boolean",
      "nullable": false,
      "maxObjects": 1,
      "default": true
    }
  },
  "metadata": {
    "minAgentVersion": "1.171"
  }
}

[Geoffke]

Hi @Radoslaw_Szulgo , this seems to be the API-way. Isn't it possible to configure this in the cr.yaml? Indicating the namespaces you want to monitor, so you don't need to create exclusion rules in the UI or via the API.

[Radoslaw_Szulgo]

I don't think this is support currently. Take a look at our Dynatrace operator (it's open-source):

https://github.com/Dynatrace/dynatrace-operator

Also I think that's a good idea for the Product to support this in the operator CR. Feel free to post it separately!

[Radoslaw_Szulgo]

You can open a product idea safely to keep the track of this.

[sia_h · Accepted solution]

Hi Antonio,

It is possible to select which namespace you do and do not want to monitor in Dynatrace. You can find this in the Settings. Select Processes and containers and select Container monitoring.

There you will have the ability to modify the container monitoring rules to address the namespace you would or would not like to monitor.

Best,
Sia

[antonio_villarr]

Thank you very much.

[francois_jouber]

Thank you for the information. Really helpful. But one question... Will this configuration (to limit the namespaces to monitor containers for) prevent the OneAgent from being injected in certain pods in Kubernetes?
My customer can't integrate Dynatrace to their K8s cluster currently, since its a share cluster so pods for two or three business units are run in the cluster. If they integrate to it (using the Dynatrace Operator) the OneAgent is spun up with their pods and that of the other business units, which depleats their HU license.
So if limiting the Namespaces for which Dynatrace should monitor containers, would this prevent the OneAgent from being deployed to containers for the other business units/systems?

Please advise

Francois

[sia_h · Accepted solution]

Hi Francois,

Yes, this will address your use-case. Make sure that you create the exclusion rules before deploying the OneAgent operator. Create a 'do not monitor' rule for the other namespace/BUs.

Sia