How to install and use Cryostat on OCP 4?

Environment

• OpenJDK 8u262 / OpenJDK 11+
• Red hat OpenShift Container Platform (OCP)
  • 4.10+

Issue

How to install and use Cryostat on OCP 4?

Resolution

OpenShift web console

• Installing Cryostat on Red Hat OpenShift by using a Red Hat build of Cryostat Operator
• Creating a JFR recording with Cryostat

Command line

1. Install the Cryostat Operator - via Subscription yaml

apiVersion: operators.coreos.com/v1alpha1
kind: Subscription
metadata:
  name: ${SUBSCRIPTION_NAME}
  namespace: ${OPERATOR_NAMESPACE}
spec:
  channel: stable
  installPlanApproval: Automatic
  name: cryostat-operator
  source: redhat-operators
  sourceNamespace: openshift-marketplace

2. Create Cryostat Custom Resource

apiVersion: operator.cryostat.io/v1beta2
kind: Cryostat
metadata:
  name: ${CRYOSTAT_NAME}
  namespace: ${OPERATOR_NAMESPACE}
spec:
  enableCertManager: true

Note that this requires cert-manager to be installed.

Access the Cryostat web console

$ oc get cryostat -o jsonpath='{$.items[0].status.applicationUrl}' -n ${OPERATOR_NAMESPACE}

Use the Red Hat build of Cryostat to create JFRs to monitor the performance of Java Virtual Machines (JVMs)
The process is described on the product documentation: Creating a JFR recording with Cryostat.

Optional - OperatorGroup

Optional. Create an OperatorGroup if there is none in the namespace that the Cryostat Operator will be installed:

apiVersion: operators.coreos.com/v1
kind: OperatorGroup
metadata:
  name: ${GROUP_NAME}
  namespace: ${OPERATOR_NAMESPACE}

Example with EAP 8 instrumentation

To instrument EAP 7/8, add the labels cryostat.io/java-options-var, cryostat.io/name: cryostat-sample, cryostat.io/namespace with respectively MODULE_OPTS, the name of the Cryostat CR created and the namespace where Cryostat is located. Example:

$ oc get deployment helloworld3 -o yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  annotations:
    app.openshift.io/vcs-ref: 8.0.x
  labels:
    app.kubernetes.io/instance: helloworld3
    app.kubernetes.io/managed-by: Helm
  name: helloworld3
  namespace: eap8
  resourceVersion: "73967640"
  uid: c69de84c-97d3-47dc-9d1d-6c4382d1c2f7
spec:
  ...
  strategy:
    type: Recreate
  template:
    metadata:
      creationTimestamp: null
      labels:
        app.kubernetes.io/name: helloworld3
        app.openshift.io/runtime: eap
        cryostat.io/java-options-var: MODULE_OPTS <----- need this
        cryostat.io/name: cryostat-sample         <----- needs this
        cryostat.io/namespace: openjdk            <----- needs this
        helm.sh/chart: eap8-1.1.3
      name: helloworld3

Root Cause

The installation requires an Operator Group object in the same namespace as the Subscription. The InstallPlan takes into account the OperatorGroup when creating an Operator's ClusterServiceVersion. An OperatorGroup defined in the same namespace as a Subscription is what's applied to that Subscription.

Diagnostic Steps

• To confirm the operator installation, check if the csv is available:

oc get csv -n ${OPERATOR_NAMESPACE} | grep cryostat-operator

• To get the subscription:

 oc get sub ${SUBSCRIPTION_NAME} -n ${OPERATOR_NAMESPACE}

• To confirm the Cryostat CR (or list):

oc get cryostat -n ${OPERATOR_NAMESPACE}

• To get the application url (to access the web console):

$ oc get cryostat -o jsonpath='{$.items[0].status.applicationUrl}' -n ${OPERATOR_NAMESPACE}

This solution is part of Red Hat’s fast-track publication program, providing a huge library of solutions that Red Hat engineers have created while supporting our customers. To give you the knowledge you need the instant it becomes available, these articles may be presented in a raw and unedited form.