Kubernetes

Monitor Container Orchestration and Scaling

Data Collection Setup

Metrics are collected via the Kubernetes Host API and Kubelet API.

Blue Medora has created a LPU file for secure data collection. See the Least Privileged User Section below for detailed instructions

In-depth information around Kuberenetes Authentication mechanisms can be found here: https://kubernetes.io/docs/reference/access-authn-authz/authentication/

Network Requirements

Ports for Kubernetes Host:

  • Non-SSL: 8080 (TCP) Default
  • SSL: 443 (TCP) Default

Ports for Kubelet API:

  • Non-SSL: 10255 (TCP) Default
  • SSL: 10250 (TCP) Default

🚧

Configurable Ports

The network ports for the Kubernetes servers may differ depending on your deployment.

Least Privileged User

Credentials are supported when using a Bearer token.

Install the bindplane-monitoring role

  1. Verify you are pointed to the correct cluster and your kubectl environment is setup properly
kubectl cluster-info
  1. Next, run the following commands to install the bindplane-monitoring role
kubectl apply -f https://raw.githubusercontent.com/BlueMedoraPublic/bm-kube-lpu/master/bluemedora-lpu/bm-clusterrole.yaml
kubectl apply -f https://raw.githubusercontent.com/BlueMedoraPublic/bm-kube-lpu/master/bluemedora-lpu/bm-clusterrolebinding.yaml
kubectl apply -f https://raw.githubusercontent.com/BlueMedoraPublic/bm-kube-lpu/master/bluemedora-lpu/bm-role.yaml
kubectl apply -f https://raw.githubusercontent.com/BlueMedoraPublic/bm-kube-lpu/master/bluemedora-lpu/bm-rolebinding.yaml
kubectl apply -f https://raw.githubusercontent.com/BlueMedoraPublic/bm-kube-lpu/master/bluemedora-lpu/bm-serviceaccount.yaml

Obtain the Bearer Token

  1. Finally, after the bindplane-monitoring role has been installed, you can get the Bearer Token needed when configuring the source in BindPlane.

You can get the bearer token by running:

kubectl -n kube-system describe secret $(kubectl -n kube-system get secret | grep bluemedora | awk '{print $1}')

Use this Bearer Token In the Source configuration.

🚧

Enable Role-Based Access Control (RBAC) authorization mode for Custom Installations

For manually installed Kubernetes clusters, ensure that you RBAC enabled. Most Kubernetes deployments will have this enabled by default.

Before you can install the bluemedora-k8s-lpu.tar.gz file, your cluster must have RBAC authorization enabled.

1.Make sure the apiserver has been started with --authorization-mode=RBAC

2.If you have to change your configuration in order to enable this you will also need to pass --authorization-rbac-super-user=admin replacing 'admin' with whatever your admin account is.

3.Most Kubernetes deploy tools have RBAC enabled by default. If yours was not, you will need to do some additional setup in order to get everything running smoothly. This blog post has a step by step walkthrough: http://blog.screwdriver.cd/post/150999692902/how-we-got-rbac-working-in-kubernetes

4.You will need to restart the apiserver if you had to update the configuration to enable this.

Supported Versions

Kubernetes: 1.16 - 1.20

How to Leverage BindPlane Metrics for Kubernetes HPA Setup

📘

Pre-Requisites

  1. Must be using the BindPlane for Stackdriver offering

  2. The Stackdriver Project being used for the BindPlane Destination must contain the GKE cluster.

  3. The Stackdriver Destination in BindPlane must have the bindplane_id label enabled. For more information please read Enabling the bindplane_id in Google Stackdriver

Setup Kubernetes for GKE Metrics

1. Make sure you are a user that has admin privilege to the GKE cluster.
You can add yourself with:

kubectl create clusterrolebinding cluster-admin-binding --clusterrole cluster-admin --user $(gcloud config get-value account)

2. Verify the cluster has the correct access
For GKE cluster <my_cluster>, use following command:

gcloud container clusters describe <my_cluster>
For each node pool check the section oauthScopes - there should be https://www.googleapis.com/auth/monitoring scope listed there.

3. Deploy the Stackdriver Collector
###Using the legacy resource model (Under your GKE settings, titled "Legacy Stackdriver Monitoring"), run the following:

kubectl apply -f https://raw.githubusercontent.com/GoogleCloudPlatform/k8s-stackdriver/master/custom-metrics-stackdriver-adapter/deploy/production/adapter.yaml

Using the new resource model, run the following:

kubectl apply -f https://raw.githubusercontent.com/GoogleCloudPlatform/k8s-stackdriver/master/custom-metrics-stackdriver-adapter/deploy/production/adapter_new_resource_model.yaml

4. Once deployed, you can view all metrics by running:

kubectl get --raw "/apis/custom.metrics.k8s.io/v1beta1" | jq

5. Record the path given by this API to build the HPA configuration.
You can verify an individual metric by running the following, and gather the data that comes back

kubectl get --raw "/apis/external.metrics.k8s.io/v1beta1/namespaces/*/external.googleapis.com|bluemedora|generic_node|aerospike_server|namespace|memory|usage" | jq

6. Create a HPA resource.
Make sure you create a HPA using the v2beta1 API, so that external metrics can be leveraged. An example configuration is below, but will be heavily dependent on the specific metric and resource

Example Configuration

apiVersion: autoscaling/v2beta1
kind: HorizontalPodAutoscaler
metadata:
  name: myservice
  namespace: mynamespace
spec:
  minReplicas: 1
  maxReplicas: 5
  metrics:
  - external:
  	metricName: external.googleapis.com|bluemedora|generic_node|aerospike_server|namespace|memory|usage
  	metricSelector:
    	matchLabels:
      	metric.labels.bindplane_id: 35691764da932e9cabd24ae124de5577
  	targetAverageValue: 300M
	type: External
  scaleTargetRef:
	apiVersion: apps/v1
	kind: Deployment
	name: myservice

Connection Parameters

NameRequired?Description
HostRequiredThe Kubernetes host to connect to.
PortThe port for communication to the Kubernetes host.
Kubelet PortThe port for communication to the Kubernetes kubelet.
Bearer TokenRequired
SSL ConfigurationThe SSL mode to use when connecting to the target. Can be configured to not use SSL (No SSL), use SSL but do not verify the target's certificate (No Verify), and use SSL and verify the target's certificate (Verify).
Cluster Name
Event Cutoff TimeOnly events with a 'last updated' timestamp that is after this timestamp will be collected.
Connection TimeoutThe number of seconds to allow for connecting to the target.
Max Simultaneous Kubelet RequestsSets the maximum simultaneous requests to Kubelets. Set to 0 to disable throttling.
Collect ContainersToggles the collection of containers.
Collect VolumesToggles the collection of volumes.
Collect from Kubelet APIToggles the collection from the cAdvisor API used by the Kubelets.

Metrics

Cluster

NameDescription
Average CPU Usage (Nanocores)The current average CPU usage per node in this Kubernetes Cluster.
Average Filesystem Space (Bytes)The average filesystem space per node in this Kubernetes Cluster.
Average Filesystem Used (Bytes)The average used filesystem space per node in this Kubernetes Cluster.
Average Memory Usage (Bytes)The current average memory usage per node in this Kubernetes Cluster.
Failed Pod CountThe current number of pods in this Kubernetes Cluster in a Failed phase.
Node CountThe current number of nodes in this Kubernetes Cluster.
Not Ready Node CountThe current number of nodes in this Kubernetes Cluster in a Not Ready condition.
Not Ready Pod CountThe current number of pods in this Kubernetes Cluster in a Not Ready condition.
Pending Pod CountThe current number of pods in this Kubernetes Cluster in a Pending phase.
Pod CapacityThe total pod capacity of this Kubernetes Cluster.
Pod CountThe current number of pods in this Kubernetes Cluster.
Ready Node CountThe current number of nodes in this Kubernetes Cluster in a Ready condition.
Ready Pod CountThe current number of pods in this Kubernetes Cluster in a Ready condition.
Running Not Ready Pod CountThe current number of pods in this Kubernetes Cluster in a Running phase, but not a Ready condition.
Running Pod CountThe current number of pods in this Kubernetes Cluster in a Running phase.
Succeeded Pod CountThe current number of pods in this Kubernetes Cluster in a Succeeded phase.
Total CPU Capacity (Nanocores)The total CPU capacity over all nodes in this Kubernetes Cluster.
Total CPU Usage (Nanocores)The current CPU usage over all nodes in this Kubernetes Cluster.
Total CPU Usage Ratio (%)The current CPU usage over all nodes in this Kubernetes Cluster.
Total Filesystem Space (Bytes)The total filesystem space over all nodes in this Kubernetes Cluster.
Total Filesystem Usage (%)The current filesystem usage over all nodes in this Kubernetes Cluster.
Total Filesystem Used (Bytes)The total used filesystem space over all nodes in this Kubernetes Cluster.
Total Memory (Bytes)The total memory capacity over all nodes in this Kubernetes Cluster.
Total Memory Usage (Bytes)The current memory usage over all nodes in this Kubernetes Cluster.
Total Memory Usage Ratio (%)The current memory usage over all nodes in this Kubernetes Cluster.
Total Received Data (Bytes)The total received data over all nodes in this Kubernetes Cluster.
Total Transmitted Data (Bytes)The total transmitted data over all nodes in this Kubernetes Cluster.
Unknown Node CountThe current number of nodes in this Kubernetes Cluster in an Unknown condition.
Unknown Pod CountThe current number of pods in this Kubernetes Cluster in an Unknown condition.

Container

NameDescription
Available Space (Bytes)The storage space available for the filesystem.
CPU Limit (Nanocores)The maximum CPU usage this container is allowed to consume.
CPU Limit Usage (%)The total CPU Usage in proportion to the CPU Limit.
CPU Request (Nanocores)The minimum CPU usage this container requires for it to be scheduled.
CPU Request Usage (%)The total CPU Usage in proportion to the CPU Request.
CPU Time (Nanoseconds)Cumulative CPU time (sum of all cores) since object creation.
CPU Usage (Nanocores)Total CPU usage (sum of all cores) averaged over the sample window.
Free inodesThe number of free inodes in the filesystem.
ImageThe Image name of this container.
Major Page FaultsCumulative number of major page faults.
Memory Limit (Bytes)The maximum Memory usage this container is allowed to consume.
Memory Limit Usage (%)The total Memory Usage in proportion to the Memory Limit.
Memory Request (Bytes)The minimum memory this container requires for it to be scheduled.
Memory Request Usage (%)The total Memory Usage in proportion to the Memory Request.
Memory Usage (Bytes)Total memory in use. This includes all memory regardless of when it was accessed.
Minor Page FaultsCumulative number of minor page faults.
NameName of the Container.
Pod NameName of the Pod the Container is running on.
Pod NamespaceNamespace of the Pod the Container is running on.
ReadyThe Container is Ready when it is ready to start accepting traffic.
Restart CountThe number of times this container has restarted.
RSS Usage (Bytes)The amount of anonymous and swap cache memory (includes transparent hugepages).
Start TimeThe time that this container started running.
Total inodesThe total number of inodes in the filesystem.
Total Space (Bytes)The total capacity of the filesystems underlying storage.
Used inodesThe number of inodes used by the filesystem.
Used Space (Bytes)The storage space used on the filesystem.
Used Space Ratio (%)The storage space used on the filesystem.
Working Set Usage (Bytes)The amount of working set memory. This includes recently accessed memory, dirty memory, and kernel memory.

Namespace

NameDescription
Average CPU Usage (Nanocores)The current average CPU usage per pod in this Namespace.
Average Memory Usage (Bytes)The current average memory usage per pod in this Namespace.
Failed Pod CountThe current number of pods hosted by this Namespace in a Failed phase.
NameName of the Namespace.
Not Ready Pod CountThe current number of pods hosted by this Namespace in a Not Ready condition.
Pending Pod CountThe current number of pods hosted by this Namespace in a Pending phase.
PhaseCurrent condition of the Namespace.
Pod CountThe current number of pods hosted by this Namespace.
Ready Pod CountThe current number of pods hosted by this Namespace in a Ready condition.
Running Not Ready Pod CountThe current number of pods hosted by this Namespace in a Running phase, but not a Ready condition.
Running Pod CountThe current number of pods hosted by this Namespace in a Running phase.
Succeeded Pod CountThe current number of pods hosted by this Namespace in a Succeeded phase.
Total CPU Usage (Nanocores)The current CPU usage over all pods in this Namespace.
Total Memory Usage (Bytes)The current memory usage over all pods in this Namespace.
Unknown Pod CountThe current number of pods hosted by this Namespace in an Unknown condition.

Node

NameDescription
Allocatable CPU (Nanocores)The amount of memory on the Node available for scheduling.
Allocatable Memory (Bytes)The amount of memory on the Node available for scheduling.
Allocatable PodsThe number of pods available for scheduling.
ArchitectureThe Architecture reported by the Node.
Available Memory (Bytes)Available memory for use. This is defined as (Total Memory - Working Set Usage).
Available Space (Bytes)The storage space available for the filesystem.
Container Runtime VersionContainerRuntime Version reported by the Node through runtime remote API.
Containers CPU Limit (Nanocores)The maximum CPU usage the containers on this node are allowed to consume.
Containers CPU Request (Nanocores)The minimum CPU usage required by the containers on this node.
Containers Memory Limit (Bytes)The maximum Memory usage the containers on this node are allowed to consume.
Containers Memory Request (Bytes)The minimum memory required by the containers on this node.
CPU Capacity (Nanocores)Total CPU capacity of the Node.
CPU Time (Nanoseconds)Cumulative CPU time (sum of all cores) since object creation.
CPU Usage (Nanocores)Total CPU usage (sum of all cores) averaged over the sample window.
CPU Usage Ratio (%)Total CPU usage (sum of all cores) averaged over the sample window.
Creation TimestampA timestamp representing the server time when Node object was created. It is not guaranteed to be set in happens-before order across separate operations. Clients may not set this value.
External IDExternal ID of the Node assigned by some machine database (e.g. a cloud provider).
External IPThe external IP address of the Node.
Failed Pod CountThe current number of pods hosted by this Node in a Failed phase.
Five Minute EvictionsThe number of Pods evicted from this node in the last five minutes.
Free inodesThe number of free inodes in the filesystem.
HostnameThe hostname of the Node.
Internal IPThe internal IP address of the Node.
Is MasterIndicates if the Node is hosting master components (kube-apiserver, kube-controller-manager, kube-scheduler).
Kernel VersionKernel Version reported by the Node from 'uname -r'.
Kubelet VersionKubelet Version reported by the Node.
KubeProxy VersionKubeProxy Version reported by the Node.
Machine IDMachineID reported by the Node. For unique machine identification in the cluster this field is preferred.
Major Page FaultsCumulative number of major page faults.
Memory Usage (Bytes)Total memory in use. This includes all memory regardless of when it was accessed.
Memory Usage Ratio (%)Total memory in use. This includes all memory regardless of when it was accessed.
Minor Page FaultsCumulative number of minor page faults.
Not Ready Pod CountThe current number of pods hosted by this Node in a Not Ready condition.
Operating SystemThe Operating System reported by the Node.
OS ImageOS Image reported by the Node from /etc/os-release.
Pending Pod CountThe current number of pods hosted by this Node in a Pending phase.
Pod CapacityTotal pod capacity of the Node.
Pod CountThe current number of pods hosted by this Node.
Provider IDID of the Node assigned by the cloud provider in the format: ://.
ReadyTrue if the node is healthy and ready to accept pods, False if the node is not healthy and is not accepting pods, and Unknown if the node controller has not heard from the node in the last 40 seconds
Ready Pod CountThe current number of pods hosted by this Node in a Ready condition.
Receive Errors (Errors)Cumulative count of receive errors encountered.
Received Data (Bytes)Cumulative amount of data received.
RSS Usage (Bytes)The amount of anonymous and swap cache memory (includes transparent hugepages).
Running Not Ready Pod CountThe current number of pods hosted by this Node in a Running phase, but not a Ready condition.
Running Pod CountThe current number of pods hosted by this Node in a Running phase.
Succeeded Pod CountThe current number of pods hosted by this Node in a Succeeded phase.
Total inodesThe total number of inodes in the filesystem.
Total Memory (Bytes)Total memory capacity of the Node.
Total Space (Bytes)The total capacity of the filesystems underlying storage.
Transmit Errors (Errors)Cumulative count of transmit errors encountered.
Transmitted Data (Bytes)Cumulative amount of data transmitted.
UIDUID of the Node.
Unknown Pod CountThe current number of pods hosted by this Node in an Unknown condition.
Used inodesThe number of inodes used by the filesystem.
Used Space (Bytes)The storage space used on the filesystem.
Used Space Ratio (%)The storage space used on the filesystem.
Working Set Usage (Bytes)The amount of working set memory. This includes recently accessed memory, dirty memory, and kernel memory.

Pod

NameDescription
Available Ephemeral Space (Bytes)The ephemeral storage space available.
Available Memory (Bytes)Available memory for use. This is defined as (Memory Limit - Working Set Usage). If Memory Limit is undefined, this metric is not returned.
ComponentThe component label of the Pod.
CPU Limit (Nanocores)The maximum CPU usage the containers on this pod are allowed to consume.
CPU Limit Usage (%)The total CPU Usage in proportion to the CPU Limit.
CPU Request (Nanocores)The minimum CPU usage required by the containers on this pod.
CPU Request Usage (%)The total CPU Usage in proportion to the CPU Request.
CPU Time (Nanoseconds)Cumulative CPU time (sum of all cores) since object creation.
CPU Usage (Nanocores)Total CPU usage (sum of all cores) averaged over the sample window.
DNS PolicyThe DNS policy for the Pod. Defaults to "ClusterFirst". Valid values are 'ClusterFirstWithHostNet', 'ClusterFirst', 'Default' or 'None'. DNS parameters given in DNSConfig will be merged with the policy selected with DNSPolicy. To have DNS options set along with hostNetwork, you have to specify DNS policy explicitly to 'ClusterFirstWithHostNet'. Note that 'None' policy is an alpha feature introduced in v1.9 and CustomPodDNS feature gate must be enabled to use it.
Free Ephemeral inodesThe number of free ephemeral inodes.
Host IP AddressIP address of the host to which the pod is assigned. Empty if not yet scheduled.
Major Page FaultsCumulative number of major page faults.
Memory Limit (Bytes)The maximum memory usage the containers on this pod are allowed to consume.
Memory Limit Usage (%)The total Memory Usage in proportion to the Memory Limit.
Memory Request (Bytes)The minimum memory required by the containers on this pod.
Memory Request Usage (%)The total Memory Usage in proportion to the Memory Request.
Memory Usage (Bytes)Total memory in use. This includes all memory regardless of when it was accessed.
Minor Page FaultsCumulative number of minor page faults.
NameName of the Pod.
NamespaceNamespace defines the space within which each name must be unique. An empty namespace is equivalent to the "default" namespace, but "default" is the canonical representation. Not all objects are required to be scoped to a namespace - the value of this field for those objects will be empty. Must be a DNS_LABEL. Cannot be updated.
PhaseCurrent condition of the Pod.
Pod IP AddressIP address allocated to the pod. Routable at least within the cluster. Empty if not yet allocated.
QoS ClassThe Quality of Service (QoS) classification assigned to the Pod based on resource requirements.
ReadyTrue if all containers on this Pod are in a ready state.
Restart CountThe number of times Containers running on this Pod have restarted.
Restart PolicyRestart policy for all containers within the Pod. One of Always, OnFailure, Never. Default to Always.
RSS Usage (Bytes)The amount of anonymous and swap cache memory (includes transparent hugepages).
Total Ephemeral inodesThe total number of ephemeral inodes.
Total Ephemeral Space (Bytes)The total ephemeral storage capacity.
Used Ephemeral inodesThe number of ephemeral inodes used.
Used Ephemeral Space (Bytes)The ephemeral storage space used.
Used Ephemeral Space Ratio (%)The ephemeral storage space used.
Working Set Usage (Bytes)The amount of working set memory. This includes recently accessed memory, dirty memory, and kernel memory.

Volume

NameDescription
Available Space (Bytes)The storage space available of this volume.
Free inodesThe number of free inodes in this volume.
NameName of the Volume.
Total inodesThe total number of inodes in this volume.
Total Space (Bytes)The total storage capacity of this volume.
TypeThe type of the volume.
Used inodesThe number of inodes used in this volume.
Used Space (Bytes)The storage space used of this volume.