Red Hat OpenShift Container Platform

Using metrics

The openshift-security-profiles namespace provides metrics endpoints, which are secured by the kube-rbac-proxy container. All metrics are exposed by the metrics service within the openshift-security-profiles namespace.

The Security Profiles Operator includes a cluster role and corresponding binding spo-metrics-client to retrieve the metrics from within the cluster. There are two metrics paths available:

metrics.openshift-security-profiles/metrics: for controller runtime metrics
metrics.openshift-security-profiles/metrics-spod: for the Operator daemon metrics

Procedure

To view the status of the metrics service, run the following command:

$ oc get svc/metrics -n openshift-security-profiles

Example output

NAME      TYPE        CLUSTER-IP   EXTERNAL-IP   PORT(S)   AGE
metrics   ClusterIP   10.0.0.228   <none>        443/TCP   43s

To retrieve the metrics, query the service endpoint using the default ServiceAccount token in the openshift-security-profiles namespace by running the following command:

$ oc run --rm -i --restart=Never --image=registry.fedoraproject.org/fedora-minimal:latest \
    -n openshift-security-profiles metrics-test -- bash -c \
    'curl -ks -H "Authorization: Bearer $(cat /var/run/secrets/kubernetes.io/serviceaccount/token)" https://metrics.openshift-security-profiles/metrics-spod'

Example output

# HELP security_profiles_operator_seccomp_profile_total Counter about seccomp profile operations.
# TYPE security_profiles_operator_seccomp_profile_total counter
security_profiles_operator_seccomp_profile_total{operation="delete"} 1
security_profiles_operator_seccomp_profile_total{operation="update"} 2

To retrieve metrics from a different namespace, link the ServiceAccount to the spo-metrics-client ClusterRoleBinding by running the following command:

$ oc get clusterrolebinding spo-metrics-client -o wide

Example output

NAME                 ROLE                             AGE   USERS   GROUPS   SERVICEACCOUNTS
spo-metrics-client   ClusterRole/spo-metrics-client   35m                    openshift-security-profiles/default

controller-runtime metrics

The controller-runtime metrics and the DaemonSet endpoint metrics-spod provide a set of default metrics. Additional metrics are provided by the daemon, which are always prefixed with security_profiles_operator_.

Table 45. Available controller-runtime metrics
Metric key	Possible labels	Type	Purpose
`seccomp_profile_total`	`operation={delete,update}`	Counter	Amount of seccomp profile operations.
`seccomp_profile_audit_total`	`node`, `namespace`, `pod`, `container`, `executable`, `syscall`	Counter	Amount of seccomp profile audit operations. Requires the log enricher to be enabled.
`seccomp_profile_bpf_total`	`node`, `mount_namespace`, `profile`	Counter	Amount of seccomp profile bpf operations. Requires the bpf recorder to be enabled.
`seccomp_profile_error_total`	`reason={` `SeccompNotSupportedOnNode,` `InvalidSeccompProfile,` `CannotSaveSeccompProfile,` `CannotRemoveSeccompProfile,` `CannotUpdateSeccompProfile,` `CannotUpdateNodeStatus` `}`	Counter	Amount of seccomp profile errors.
`selinux_profile_total`	`operation={delete,update}`	Counter	Amount of SELinux profile operations.
`selinux_profile_audit_total`	`node`, `namespace`, `pod`, `container`, `executable`, `scontext`,`tcontext`	Counter	Amount of SELinux profile audit operations. Requires the log enricher to be enabled.
`selinux_profile_error_total`	`reason={` `CannotSaveSelinuxPolicy,` `CannotUpdatePolicyStatus,` `CannotRemoveSelinuxPolicy,` `CannotContactSelinuxd,` `CannotWritePolicyFile,` `CannotGetPolicyStatus` `}`	Counter	Amount of SELinux profile errors.