Understanding the Node Observability Operator

The Node Observability Operator collects and stores the CRI-O and Kubelet profiling data of worker nodes. You can use the profiling data to analyze the CRI-O and Kubelet performance trends and debug the performance related issues.

High level workflow of the Node Observability Operator

After you install the Node Observability Operator in the OKD cluster, you have to create a NodeObservability custom resource, which creates a DaemonSet to deploy a Node Observability agent on each worker node.

To request a profiling query, you have to create a NodeObservabilityRun resource that requests the deployed Node Observability agent to trigger the CRI-O and Kubelet profiling. After the profiling is completed, the Node Observability agent stores the profiling data inside the container file system /run/node-observability directory, which is available for query.

Installing the Node Observability Operator

The Node Observability Operator is not installed in OKD by default. You can install the Node Observability Operator by using the OKD CLI or the web console.

Installing the Node Observability Operator using the CLI

You can install the Node Observability Operator by using the OpenShift CLI (oc).

Prerequisites

• You have installed the OpenShift CLI (oc).

• You have access to the cluster with cluster-admin privileges.

Procedure

1. Confirm that the Node Observability Operator is available by running the following command:

   $ oc get packagemanifests -n openshift-marketplace node-observability-operator

   Example output

   NAME                            CATALOG                AGE
   node-observability-operator     Red Hat Operators      9h

2. Create the node-observability-operator namespace by running the following command::

   $ oc new-project node-observability-operator

3. Create an OperatorGroup object YAML file:

   cat <<EOF | oc apply -f -
   apiVersion: operators.coreos.com/v1
   kind: OperatorGroup
   metadata:
     name: node-observability-operator
     namespace: node-observability-operator
   spec:
     targetNamespaces:
     - node-observability-operator
   EOF

4. Create a Subscription object YAML file to subscribe a namespace to an Operator:

   cat <<EOF | oc apply -f -
   apiVersion: operators.coreos.com/v1alpha1
   kind: Subscription
   metadata:
     name: node-observability-operator
     namespace: node-observability-operator
   spec:
     channel: alpha
     name: node-observability-operator
     source: redhat-operators
     sourceNamespace: openshift-marketplace
   EOF

Verification

1. View the install plan name by running the following command:

   $ oc -n node-observability-operator get sub node-observability-operator -o yaml | yq '.status.installplan.name'

   Example output

   install-dt54w

2. Verify the install plan status by running the following command:

   $ oc -n node-observability-operator get ip <install_plan_name> -o yaml | yq '.status.phase'

   <install_plan_name> is the install plan name that you obtained from the output of the previous command.

   Example output

   COMPLETE

3. Verify that the Node Observability Operator is up and running:

   $ oc get deploy -n node-observability-operator

   Example output

   NAME                                            READY   UP-TO-DATE  AVAILABLE   AGE
   node-observability-operator-controller-manager  1/1     1           1           40h

Installing the Node Observability Operator using the web console

You can install the Node Observability Operator from the OKD web console.

Prerequisites

• You have access to the cluster with cluster-admin privileges.

• You have access to the OKD web console.

Procedure

1. Log in to the OKD web console.

2. In the Administrator’s navigation panel, expand Operators → OperatorHub.

3. In the All items field, enter Node Observability Operator and select the Node Observability Operator tile.

4. Click Install.

5. On the Install Operator page, configure the following settings:

   1. In the Update channel area, click alpha.

   2. In the Installation mode area, click A specific namespace on the cluster.

   3. From the Installed Namespace list, select node-observability-operator from the list.

   4. In the Update approval area, select Automatic.

   5. Click Install.

Verification

1. In the Administrator’s navigation panel, expand Operators → Installed Operators.

2. Verify that the Node Observability Operator is listed in the Operators list.

Creating the Node Observability custom resource

Before you run profiling queries, you must create a NodeObservability custom resource (CR).

When you apply the NodeObservability CR, it creates the necessary machine config and machine config pool CRs to enable the CRI-O profiling on the worker nodes.

The CRI-O unix socket of the node is mounted on the agent pod, which allows the agent to communicate with CRIO to run the pprof request. Similiarly, the kubelet-serving-ca certificate chain is mounted on the agent pod, which allows secure communication between the agent and node’s kubelet endpoint.

Prerequisites

• You have installed the Node Observability Operator.

• You have installed the OpenShift CLI (oc).

• You have access to the cluster with cluster-admin privileges.

Procedure

1. Log in to the OKD CLI as a user with the cluster-admin role by running the following command:

   $ oc login -u kubeadmin https://<HOSTNAME>:6443

2. Switch back to the node-observability-operator namespace by running the following command:

   $ oc project node-observability-operator

3. Create a CR file named nodeobservability.yaml that contains the following text:

       apiVersion: nodeobservability.olm.openshift.io/v1alpha1
       kind: NodeObservability
       metadata:
         name: cluster (1)
       spec:
         labels:
           node-role.kubernetes.io/worker: ""
         type: crio-kubelet

   1	You must specify the name as cluster because there should be only one NodeObservability CR per cluster.

4. Run the NodeObservability CR:

   oc apply -f nodeobservability.yaml

   Example output

   nodeobservability.olm.openshift.io/cluster created

5. Review the status of the NodeObservability CR by running the following command:

   $ oc get nob/cluster -o yaml | yq '.status.conditions'

   Example output

   conditions:
     conditions:
     - lastTransitionTime: "2022-07-05T07:33:54Z"
       message: 'DaemonSet node-observability-ds ready: true NodeObservabilityMachineConfig
         ready: true'
       reason: Ready
       status: "True"
       type: Ready

   NodeObservability CR run is completed when the reason is Ready and the status is True.

Running profiling query

Profiling query is a blocking operation that fetches CRI-O and Kubelet profiling data for a duration of 30 seconds. The Node Observability Operator stores the profiling data inside the container file system /run/node-observability directory. To request profiling data query, you have to create a NodeObservabilityRun resource.

Prerequisites

• You have installed the Node Observability Operator.

• You have created the NodeObservability custom resource (CR).

• You have access to the cluster with cluster-admin privileges.

Procedure

1. Create a NodeObservabilityRun resource file named nodeobservabilityrun.yaml that contains the following text:

   apiVersion: nodeobservability.olm.openshift.io/v1alpha1
   kind: NodeObservabilityRun
   metadata:
     name: nodeobservabilityrun
   spec:
     nodeObservabilityRef:
       name: cluster

2. Run the NodeObservabilityRun to trigger the profiling:

   $ oc apply -f nodeobservabilityrun.yaml

3. Review the status of the NodeObservabilityRun by running the following command:

   $ oc get nodeobservabilityrun -o yaml  | yq '.status.conditions'

   Example output

   conditions:
   - lastTransitionTime: "2022-07-07T14:57:34Z"
     message: Ready to start profiling
     reason: Ready
     status: "True"
     type: Ready
   - lastTransitionTime: "2022-07-07T14:58:10Z"
     message: Profiling query done
     reason: Finished
     status: "True"
     type: Finished

   Profiling query is complete when the status is True and type is Finished.

4. Run the following bash script to retrieve the profiling data from container’s /run/node-observability path:

   for a in $(oc get nodeobservabilityrun nodeobservabilityrun -o yaml | yq .status.agents[].name); do
     echo "agent ${a}"
     mkdir -p "/tmp/${a}"
     for p in $(oc exec "${a}" -c node-observability-agent -- bash -c "ls /run/node-observability/*.pprof"); do
       f="$(basename ${p})"
       echo "copying ${f} to /tmp/${a}/${f}"
       oc exec "${a}" -c node-observability-agent -- cat "${p}" > "/tmp/${a}/${f}"
     done
   done