Kyverno

Kyverno监控

2023-01-08  本文已影响0人  王勇1024

使用 Prometheus 监控 Kyverno 策略指标

介绍

作为集群管理员，拥有监控集群应用的 Kyverno 策略的状态和执行的能力可能会让您受益。这包括监控对策略的任何应用更改、与传入请求相关的任何活动以及作为结果产生的任何结果。如果启用，监控将允许您对应用的策略进行可视化和警报，这对于整个集群的可观察性和合规性至关重要。

此外，您可以将监控目标的范围指定为规则、策略或集群级别，这使您能够从收集的指标中提取更精细的信息。

安装和配置

当你使用 Helm 安装 Kyverno时，在 kyverno 命名空间中会创建一个名为 kyverno-svc-metrics 的 service，该 service 会暴露 8000 端口。

$ values.yaml

...
metricsService:
  create: true
  type: ClusterIP
  ## Kyverno's metrics server will be exposed at this port
  port: 8000
  ## The Node's port which will allow access Kyverno's metrics at the host level. Only used if service.type is NodePort.
  nodePort:
  ## Provide any additional annotations which may be required. This can be used to
  ## set the LoadBalancer service type to internal only.
  ## ref: https://kubernetes.io/docs/concepts/services-networking/service/#internal-load-balancer
  ##
  annotations: {}
...

默认情况下，该 service 的类型是 ClusterIP，意味着它的指标只能被集群内的 Prometheus 服务抓取。

在某些情况下，Prometheus 服务器可能作为共享服务位于您的工作负载集群之外。在这些场景中，您将希望 kyverno-svc-metrics 服务公开，以便将指标（在端口 8000 上可用）公开给您集群外的 Prometheus 服务。

服务可以通过 Ingress 或使用 LoadBalancer 或 NodePort service 类型向外部客户端公开。

要将您的 kyverno-svc-metrics 服务公开为主机/节点的端口号 8000 的 NodePort，您可以在安装 Helm 之前配置您的 values.yaml，如下所示：

...
metricsService:
  create: true
  type: NodePort
  ## Kyverno's metrics server will be exposed at this port
  port: 8000
  ## The Node's port which will allow access Kyverno's metrics at the host level. Only used if service.type is NodePort.
  nodePort: 8000
  ## Provide any additional annotations which may be required. This can be used to
  ## set the LoadBalancer service type to internal only.
  ## ref: https://kubernetes.io/docs/concepts/services-networking/service/#internal-load-balancer
  ##
  annotations: {}
...

要使用 LoadBalancer 类型公开 kyverno-svc-metrics service，您可以在安装 Helm 之前配置您的 values.yaml，如下所示：

...
metricsService:
  create: true
  type: LoadBalancer
  ## Kyverno's metrics server will be exposed at this port
  port: 8000
  ## The Node's port which will allow access Kyverno's metrics at the host level. Only used if service.type is NodePort.
  nodePort: 
  ## Provide any additional annotations which may be required. This can be used to
  ## set the LoadBalancer service type to internal only.
  ## ref: https://kubernetes.io/docs/concepts/services-networking/service/#internal-load-balancer
  ##
  annotations: {}
...

配置指标

通过 Helm 安装 Kyverno 时，您还可以配置要公开的指标。

...
config:
  metricsConfig:
    namespaces: {
      "include": [],
      "exclude": []
    }
  # 'namespaces.include': list of namespaces to capture metrics for. Default: all namespaces included.
  # 'namespaces.exclude': list of namespaces to NOT capture metrics for. Default: [], none of the namespaces excluded.
...

注意：如果在 include 和 exclude 下都提供了命名空间，则 exclude 优先于“include”。

...
config:
  # rate at which metrics should reset so as to clean up the memory footprint of kyverno metrics, if you might be expecting high memory footprint of Kyverno's metrics.
  metricsRefreshInterval: 24h 
  #Default: 0, no refresh of metrics
...

注意：您仍然不会丢失以前的指标，因为您的指标会保留在 Prometheus 后端。

指标和仪表板

策略和规则计数

此指标可用于跟踪集群中当前处于活跃状态的策略和规则的数量，甚至是过去创建的、当前不活跃规则数量。

指标名称

kyverno_policy_rule_info_total

指标值

使用示例

过滤标签

标签 允许值 描述
policy_validation_mode “enforce”, “audit” PolicyValidationFailure action of the rule’s parent policy
policy_type “cluster”, “namespaced” Kind of the rule’s parent policy. Kind: ClusterPolicy or Kind: Policy
policy_background_mode “true”, “false” Policy’s set background mode
policy_name Name of the policy to which the rule belongs
policy_namespace Namespace in which this Policy resides (only for policies with kind: Policy), For ClusterPolicies, this field will be “-”
rule_name Name of the rule, in the above policy, which is evaluating in this situation
rule_type “validate”, “mutate”, “generate” Rule’s behavior type.
For rule_execution_cause=“background_scan”, it will always be “validate” as background scans only run validate rules
status_ready “true”, “false” Readiness of the policy. When ready, the policy is able to serve admission requests

有用的查询

策略和规则执行

该指标可用于跟踪与作为传入资源请求及后台扫描的执行的规则相关联的结果。该指标还可以进一步聚合以跟踪策略级别的结果。

指标名称

kyverno_policy_results_total

指标值

Counter - 一个仅递增的整数，表示与对应于度量样本的规则相关联的结果/执行的数量。

使用示例

过滤标签

标签 允许值 描述
policy_validation_mode “enforce”, “audit” PolicyValidationFailure action of the rule’s parent policy
policy_type “cluster”, “namespaced” Kind of the rule’s parent policy. Kind: ClusterPolicy or Kind: Policy
policy_background_mode “true”, “false” Policy’s set background mode
policy_name Name of the policy to which the rule belongs
policy_namespace Namespace in which this Policy resides (only for policies with kind: Policy), For ClusterPolicies, this field will be “-”
resource_kind “Pod”, “Deployment”, “StatefulSet”, “ReplicaSet”, etc. Kind of this resource
resource_namespace Namespace in which this resource lies
resource_request_operation “create”, “update”, “delete” If the requested resource is being created, updated, or deleted.
rule_name Name of the rule, in the above policy, which is evaluating in this situation
rule_result “PASS”, “FAIL” Result of the rule’s execution
rule_type “validate”, “mutate”, “generate” Rule’s behavior type.
For rule_execution_cause=“background_scan”, it will always be “validate” as background scans only run validate rules
rule_execution_cause “admission_request”, “background_scan” Identifies whether the rule is executing in response to an admission request or a periodic background scan.
In background scans, only validate rules whereas in the case of admission requests, all validate/mutate/generate rules run

有用的查询

策略规则执行延迟

该指标用于跟踪单个规则执行/处理（无论是传入的资源请求或执行后台扫描）耗时情况。该指标可以进一步聚合以在策略级别显示延迟。

指标名称

kyverno_policy_execution_duration_seconds

指标值

Histogram - 一个浮点值，表示规则执行的延迟（以秒为单位）。

使用示例

过滤标签

标签 允许值 描述
policy_validation_mode “enforce”, “audit” PolicyValidationFailure action of the rule’s parent policy
policy_type “cluster”, “namespaced” Kind of the rule’s parent policy. Kind: ClusterPolicy or Kind: Policy
policy_background_mode “true”, “false” Policy’s set background mode
policy_name Name of the policy to which the rule belongs
policy_namespace Namespace in which this Policy resides (only for policies with kind: Policy), For ClusterPolicies, this field will be “-”
resource_kind “Pod”, “Deployment”, “StatefulSet”, “ReplicaSet”, etc. Kind of this resource
resource_namespace Namspace in which this resource lies
resource_request_operation “create”, “update”, “delete” If the requested resource is being created, updated, or deleted.
rule_name Name of the rule, in the above policy, which is evaluating in this situation
rule_result “PASS”, “FAIL” Result of the rule’s execution
rule_type “validate”, “mutate”, “generate” Rule’s behavior type.
For rule_execution_cause=“background_scan”, it will always be “validate” as background scans only run validate rules
rule_execution_cause “admission_request”, “background_scan” Identifies whether the rule is executing in response to an admission request or a periodic background scan.
In background scans, only validate rules whereas in the case of admission requests, all validate/mutate/generate rules run

有用的查询

Admission Review延迟

该指标可用于跟踪与整个个人准入审查相关的端到端延迟，对应于触发一堆策略和规则的传入资源请求。

指标名称

kyverno_admission_review_duration_seconds

指标值

Counter - 一个浮点值，表示 admission review 的延迟（以秒为单位）。

使用示例

过滤标签

标签 允许值 描述
resource_kind “Pod”, “Deployment”, “StatefulSet”, “ReplicaSet”, etc. Kind of this resource
resource_namespace Namespace in which this resource lies
resource_request_operation “create”, “update”, “delete” If the requested resource is being created, updated, or deleted.

有用的查询

Admission Requests计数

该指标可用于跟踪 Kyverno 接收到的准入请求的数量。

指标名称

kyverno_admission_requests_total

指标值

Counter - 一个仅递增的整数，表示与样本相关联的准入请求的计数

使用示例

过滤标签

标签 允许值 描述
resource_kind “Pod”, “Deployment”, “StatefulSet”, “ReplicaSet”, etc. Kind of this resource
resource_namespace Namspace in which this resource lies
resource_request_operation “create”, “update”, “delete” If the requested resource is being created, updated, or deleted.

有用的查询

策略修改计数

该指标可用于跟踪所有 Kyverno 策略相关更改的历史记录，例如策略创建、更新和删除。

指标名称

kyverno_policy_changes_total

指标值

Counter - 一个仅递增的整数，表示与度量样本关联的策略级别更改的总数。

使用示例

过滤标签

标签 允许值 描述
policy_validation_mode “enforce”, “audit” PolicyValidationFailure action of the rule’s parent policy
policy_type “cluster”, “namespaced” Kind of the rule’s parent policy. Kind: ClusterPolicy or Kind: Policy
policy_background_mode “true”, “false” Policy’s set background mode
policy_name Name of the policy to which the rule belongs
policy_namespace Namespace in which this Policy resides (only for policies with kind: Policy), For ClusterPolicies, this field will be “-”
policy_change_type “create”, “update”, “delete” Action which happened with the policy behind this policy change.

有用的查询

Grafana仪表盘

Kyverno 指标的即用型仪表板。

安装

curl https://raw.githubusercontent.com/kyverno/grafana-dashboard/master/grafana/dashboard.json -o kyverno-dashboard.json
上一篇 下一篇

猜你喜欢

热点阅读