oneks_monitor_intro - OpenNebula/cluster-api-provider-opennebula GitHub Wiki

OneKS Monitor Overview

The OneKS Monitor connects a Kubernetes workload cluster managed by CAPONE with its corresponding cluster in OneKS.

The monitor runs inside the workload cluster and sends operational information back to OneKS. It is an optional OneKS component: CAPONE clusters that are not managed through OneKS do not need it.

flowchart LR
    K[Kubernetes workload cluster] --> M[OneKS Monitor]
    M -->|Node and Pod status| O[OneKS API]
    M -->|Application lifecycle| O
    M -->|Resource observations| O
    M -->|Resolve VM placement| X[OpenNebula XML-RPC API]

What the monitor reports

Node readiness

The monitor watches Kubernetes Nodes and reports readiness changes to the corresponding OneKS Node Group.

It uses the Kubernetes Node providerID to identify the OpenNebula VM. The OneKS cluster and Node Group are then resolved from the VM metadata stored in OpenNebula.

Pod status

The monitor periodically reports the Pods assigned to each cluster Node. The report contains:

  • Pod name.
  • Namespace.
  • Current state.
  • A waiting or failure reason, when available.

Pods are grouped by OneKS Node Group and OpenNebula VM. Pending Pods are reported separately as observations because they may not yet be assigned to a Node.

Application lifecycle

The monitor watches applications installed by OneKS through the RKE2 HelmChart controller and reports lifecycle changes such as:

  • installing
  • ready
  • deleting
  • failed
  • done

Only resources explicitly marked as managed by OneKS are reported.

Resource observations

Users can select scalar fields from Kubernetes resources and expose their current values to OneKS. For example, OneKS can observe the number of ready replicas in a Deployment or a status field in a custom resource.

See Resource Observations for configuration and examples.

How it is deployed

When the feature is enabled, OneKS adds the monitor to every new workload cluster. The monitor is installed as a Helm release in the kube-system namespace.

OneKS supplies the cluster-specific configuration, including:

  • OneKS callback endpoint.
  • OneKS cluster identifier.
  • OpenNebula XML-RPC endpoint.
  • Authentication Secret.
  • Per-cluster encryption key.

Manual installation is not normally required because these values must match the corresponding OneKS cluster.

Security

The monitor follows a read-only model inside Kubernetes:

  • It runs as a non-root user.
  • Privilege escalation is disabled.
  • Linux capabilities are dropped.
  • The container root filesystem is read-only.
  • Kubernetes access is read-only.
  • Secret contents are not included in resource observations.

Reports sent to OneKS use HTTP Basic authentication and an encrypted AES-256-GCM payload. HTTPS should still be used whenever the OneKS endpoint is directly reachable over a network.

Next steps