Red Hat OpenShift Datasets
Red Hat OpenShift datasets define what a Red Hat OpenShift device reads from an OpenShift cluster's API server (dataset type openshift). They attach to devices of type openshift, and in
Collector Types
There are eleven datasets, one per data model, each with its own definition id, event.dataset (openshift.<dataset>), interval, and pipeline, so it can be searched, routed, and processed on its own. Ten are inventories of what the cluster holds, read hourly; the eleventh is the cluster's events, read every minute.
| Dataset (console title) | Dataset | Definition | Definition id | Kind | Default interval | Minimum |
|---|---|---|---|---|---|---|
| OpenShift CSI Drivers | csi_driver | openshift_csi_driver_collector | 11100 | inventory | 3,600 s | 60 s |
| OpenShift Projects | project | openshift_project_collector | 11101 | inventory | 3,600 s | 60 s |
| OpenShift Cluster Network | cluster_network | openshift_cluster_network_collector | 11102 | inventory | 3,600 s | 60 s |
| OpenShift Nodes | node | openshift_node_collector | 11103 | inventory | 3,600 s | 60 s |
| OpenShift Persistent Volume Claims | persistent_volume_claim | openshift_persistent_volume_claim_collector | 11104 | inventory | 3,600 s | 60 s |
| OpenShift Pods | pod | openshift_pod_collector | 11105 | inventory | 3,600 s | 60 s |
| OpenShift Replication Controllers | replication_controller | openshift_replication_controller_collector | 11106 | inventory | 3,600 s | 60 s |
| OpenShift Service Accounts | service_account | openshift_service_account_collector | 11107 | inventory | 3,600 s | 60 s |
| OpenShift Services | service | openshift_service_collector | 11108 | inventory | 3,600 s | 60 s |
| OpenShift Users | user | openshift_user_collector | 11109 | inventory | 3,600 s | 60 s |
| OpenShift Events | event | openshift_event_collector | 45 | log | 60 s | 10 s |
There is no metric dataset. The nodes', pods', and containers' usage and status are read on every node by the Linux agent's Kubernetes Metrics dataset, and the pods' logs by its Kubernetes Pod Logs dataset. Assign those to the Linux devices on the cluster's nodes for usage and logs.
Every dataset takes these properties:
| Field | Required | Type | Default | Description |
|---|---|---|---|---|
interval | N | int | per dataset | Seconds between readings. At least the dataset's minimum above. |
pipeline_name | N | string | the device's | The preprocessing pipeline the dataset's records enter. |
initial_lookback | N | int | the device's | event only. Seconds before its first reading where the dataset starts when it has no checkpoint. 0 starts at the first reading. |
Wizard fields
Every Red Hat OpenShift dataset's
Rules
- Intervals. An interval under the dataset's minimum is left out with a warning in the device's log, and the rest of the device runs. The inventories are read hourly by default, the events every minute.
- One of each. A dataset type is read once per device, however many datasets of it are assigned. The first decides its settings; the others are left out with a warning.
- Pipelines. A dataset's records enter the pipeline the dataset selects, otherwise the device's. Two datasets on one device can reach two pipelines.
- Large clusters. An inventory writes every object of its kind at every reading, changed or not. On a cluster of thousands of pods, give the pod dataset the interval its changes need, not a shorter one.
Inventories
Inventory datasets write every object at every reading. From a dataset's second reading on, each record carries event.action:
event.action | event.type | Meaning |
|---|---|---|
added | creation | Not in the last delivered reading |
changed | change | Its fields differ from the last delivered reading's |
unchanged | info | As it was |
removed | deletion | Gone: written once, as it was last seen, dated at the reading |
- Objects are matched by their uid. An object deleted and made again under the same name is a new one.
- The baseline is the last delivered reading. A reading that fails, or whose records could not all be written, never becomes the one the next compares with. A list is read whole or not at all, so nothing is marked removed because a request failed.
- What moves while an object stays the same is written but not compared, such as a node's readiness, a pod's phase and restarts, or a replication controller's replicas. Each table below says which fields these are. A new image, a cordoned node, a scaled replication controller, a claim bound to its volume, and a pod bound to a node are changes.
- Where an object sits is compared by the names its own record gives, such as its project and its node, never by what the discovery found. A project given another display name, or a failed discovery, marks nothing.
- The first reading after a start marks nothing: the baseline is kept in memory.
Every object's own record has its id (its uid), name, and created under openshift.<dataset>.
Nodes and Pods
| Dataset | One record per | Fields |
|---|---|---|
node | Node | host.name, host.hostname, host.id (its system UUID), host.ip (its internal and external addresses), host.architecture, host.os.full/kernel/type, cloud.availability_zone/region/machine.type; openshift.node.roles (master, worker, infra, from its node-role.kubernetes.io/* labels), unschedulable, provider_id, pod_cidrs, taints (key, value, effect), os.image/kernel/type/id (rhcos), architecture, kubelet_version, kube_proxy_version, container_runtime, machine_id, system_uuid, boot_id, kubelet_port, zone, region, instance_type, capacity and allocatable (cpu, memory, pods, ephemeral_storage, hugepages.<size>), addresses (type, address), conditions (each condition's status by its type), ready, machine (its Machine), machine_config.current/desired/state. Not compared: ready, conditions, boot_id, machine_config.state. |
pod | Pod of every project | openshift.pod.generate_name, node, owner.kind/name/id, service_account, restart_policy, priority, priority_class, scheduler, host_network, qos_class, containers (name, image, init, requests and limits in cores and bytes), phase, reason, ready, start_time, host_ip, ip, restart_count (its containers' restarts added up), container_statuses (name, ready, started, restart_count, state: running, waiting, or terminated, reason, exit_code, image_id, init); related.ip. Not compared: phase, reason, ready, start_time, host_ip, ip, restart_count, container_statuses. |
Projects and Workloads
| Dataset | One record per | Fields |
|---|---|---|
project | Project | openshift.project.display_name, description, requester, node_selector, scc.mcs/supplemental_groups/uid_range (the ranges its pods' security context constraints take), phase (Active, Terminating). Not compared: phase. |
replication_controller | Replication controller of every project (a DeploymentConfig's deployment) | openshift.replication_controller.generation, replicas (the pods it asks for), min_ready_seconds, owner.kind/name/id, status.replicas/fully_labeled_replicas/ready_replicas/available_replicas/observed_generation, deployment_config.name/version, deployment.phase (New, Pending, Running, Complete, Failed)/reason. Not compared: status, generation, deployment.phase/reason. |
The API leaves out a replication controller's status count when it is zero. Once the controller has reported its status, a count it left out is written as 0; before that, the status is left out whole.
Services, Accounts, and Users
| Dataset | One record per | Fields |
|---|---|---|
service | Service of every project | openshift.service.type (ClusterIP, NodePort, LoadBalancer, ExternalName), cluster_ip, headless (a cluster address of None), external_ip, external_name, load_balancer_ip, session_affinity, ip_families, ip_family_policy, internal_traffic_policy, external_traffic_policy, ports (name, protocol, app_protocol, port, target_port, a number or a name, node_port), load_balancer.ip/hostname; related.ip, related.hosts |
service_account | Service account of every project | user.id, user.name (the user its token authenticates as, system:serviceaccount:<project>:<name>); openshift.service_account.image_pull_secrets (by name), secrets (how many), automount_token. No secret's content is read. |
user | User OpenShift keeps of its identity providers | user.id, user.name, user.full_name; openshift.user.full_name, identities (<provider>:<name>), groups |
Storage and Network
| Dataset | One record per | Fields |
|---|---|---|
persistent_volume_claim | Persistent volume claim of every project | openshift.persistent_volume_claim.storage_class, volume_mode, volume_name (the volume it is bound to), access_modes, requested (the storage it asks for), capacity (the storage it has, once bound), phase (Pending, Bound, Lost). Not compared: phase. |
csi_driver | CSI driver | openshift.csi_driver.managed (OpenShift manages it), attach_required, pod_info_on_mount, fs_group_policy, volume_lifecycle_modes, storage_capacity, requires_republish, selinux_mount |
cluster_network | The cluster's network configuration | openshift.cluster_network.network_type (OVNKubernetes, OpenShiftSDN), cluster_networks (cidr, host_prefix), service_networks, mtu, external_ip.auto_assign_cidrs/allowed_cidrs/rejected_cidrs: as the cluster runs them, or else as they are asked for |
Events
event reads every event of every project. An event that recurs is one object whose count and last time move on, and each count is an occurrence of its own. A reading writes each event's latest occurrence when its checkpoint does not hold it, in the order they happened, dated at the event's last time (its lastTimestamp, else its series' last observed time, else its eventTime, else its first time, else when the API made it). An event with none of these is left out.
- Recurrences between readings. When an event recurred more than once since the last reading, one record is written for its newest count, and its
openshift.event.countsays how many times it has happened. The occurrences in between are not written as records of their own. - Identifying an occurrence.
event.id(<uid>/<count>) names the occurrence. An occurrence can be written again after a crash (see below), andevent.idis the key to recognize it by.
The cluster keeps an event three hours after it last happened by default.
| Dataset | One record per | Fields |
|---|---|---|
event | Occurrence of an event | message, event.id (<uid>/<count>: the occurrence), event.reason, event.action, event.provider (the component that reported it: kubelet, default-scheduler), log.level (its type, normal or warning); openshift.event.id, name, count, type, reason, action, first_seen, last_seen, event_time, created, reporting_component, reporting_instance, source.component/host, involved_object and related (kind, name, namespace, uid, api_version, field_path) |
The dataset resumes from where the last delivered reading stopped:
- Across a restart or a failover. The checkpoint is kept in the Director cluster's replicated store, per device, so a restart, or another node after a failover, resumes from it.
- Written after delivery. A reading's checkpoint is stored only once its events are delivered. A crash before then writes those events again at the next start: at least once, never lost.
- Late events. A component dates an event by its own clock, and can list it after one dated later. An occurrence listed within ten minutes of the newest the readings met is written, once; one older than that when it is first listed is taken as written.
- The first reading of a dataset with no checkpoint goes back as far as the initial lookback, a day unless the dataset or the device says otherwise, so it reads every event the cluster still holds. An outage longer than the cluster keeps its events loses the ones it expired.
Examples
Reading the pods every 15 minutes into their own pipeline, and the events from an hour back... | |