How to use Application Real-time Monitoring Service (ARMS)-Container Service for Kubernetes(ACK)-阿里云帮助中心

For Java applications deployed in Container Service for Kubernetes (ACK) clusters, you can install the ack-onepilot component of Application Real-Time Monitoring Service (ARMS). This feature automatically discovers application topology, generates 3D topology maps, monitors interfaces, and captures exceptions and slow transactions, significantly improving the efficiency of diagnosing production issues.

Background

Application Real-Time Monitoring Service (ARMS) is an application performance management (APM) product from Alibaba Cloud. For Java applications deployed in Container Service for Kubernetes (ACK), you can install and authorize the ack-onepilot application monitoring component to enable comprehensive monitoring without modifying any application code. This helps you quickly identify faulty and slow interfaces, reproduce call parameters, detect memory leaks, and discover system bottlenecks, greatly improving the efficiency of diagnosing production issues. For more information about application monitoring, see What is application monitoring?.

Prerequisites

A namespace is available. For more information, see Manage namespaces and resource quotas. This topic uses the arms-demo namespace as an example.
The version of the JDK is supported by Application Monitoring. ARMS supports the following JDK versions:
- JDK 1.7.0+
  
  Important
  The ARMS agent V3.0.X and later will no longer support Java 7. If you are still using Java 7, we recommend that you upgrade your Java version. For more information, see Application Monitoring no longer supports Java 7.
- JDK 1.8.0_25+
  Note
  - If you deploy applications in Kubernetes clusters, we recommend that you use JDK V1.8.0_191 or later.
  - Make sure that the JDK version is not 1.8.0_25 or 1.8.0_31. Otherwise, the ARMS agent may fail to be installed. In this case, we recommend that you upgrade JDK to the latest 1.8.X.
- JDK 11.0.8+
- JDK 17
ARMS is activated.

Step 1: Install the ARMS application monitoring component

Important

The legacy arms-pilot component is no longer maintained. You can install its successor, ack-onepilot, to monitor your applications. ack-onepilot is fully compatible with arms-pilot, ensuring a seamless transition without any changes to your application configuration. For more information, see How do I uninstall arms-pilot and install ack-onepilot?.

Log on to the ACK console. In the left navigation pane, click Clusters.
On the Clusters page, click the name of your cluster. In the left navigation pane, click Components and Add-ons.
In the Logs and Monitoring section, find the ack-onepilot component and click Install on its card. In the dialog box, configure the parameters. We recommend that you use the default values. Click OK to complete the installation.

Note
By default, the ack-onepilot component supports up to 1,000 pods. For every additional 1,000 pods in the cluster, increase the CPU resources for ack-onepilot by 0.5 cores and the memory by 512 MB.

After the installation is complete, you can upgrade, configure, or uninstall the ack-onepilot component on the Add-ons page.

Step 2: Grant permissions to access ARMS resources

If you need to monitor ACK cluster applications but the addon.arms.token does not exist in the ACK cluster, perform the following operations to manually grant the cluster access to ARMS resources. If the addon.arms.token already exists, this authorization is not required.

Note
When an ACK cluster contains the addon.arms.token, ARMS can automatically complete the password-free authorization process. Typically, ACK managed clusters include the addon.arms.token by default. However, some older ACK managed clusters might be missing the addon.arms.token.
1. Check whether the addon.arms.token Secret exists.
  Check whether the addon.arms.token Secret exists in the cluster
  Log on to the ACK console. In the left navigation pane, click Clusters.
  
  On the Clusters page, click the name of your cluster. In the left navigation pane, click Configurations > Secrets.
  
  On the Secrets page, select kube-system from the Namespace drop-down list and check whether addon.arms.token is listed.
2. If the addon.arms.token Secret exists, no further action is required. Otherwise, follow these steps to manually grant the cluster permissions to access ARMS resources.
  1. Log on to the ACK console. In the left navigation pane, click Clusters.
  2. On the Clusters page, click the name of your cluster. In the left navigation pane, click Cluster Information.
  3. On the Basic Information tab, find the Cluster Resources section and click the link next to Worker RAM Role.
  4. On the Role page, click the Permissions tab and then click Add Permissions.
  5. Select the AliyunARMSFullAccess policy and click OK.
To monitor applications in an ACK managed cluster that is integrated with Elastic Container Instance (ECI), go to the RAM Quick Authorization page to complete the authorization, and then restart all pods of the ack-onepilot component.

Step 3: Enable ARMS for a Java application

To enable ARMS application monitoring for a new application, follow these steps.

Log on to the ACK console. In the left navigation pane, click Clusters.
On the Clusters page, click the name of your cluster. In the left navigation pane, click Workloads > Deployments.
On the Deployments page, click Create from YAML.

Select Sample Template, and in the Template (YAML format), add the following labels to the spec.template.metadata section.

labels:
  armsPilotAutoEnable: "on"
  armsPilotCreateAppName: "<your-deployment-name>"    # Replace <your-deployment-name> with the actual application name. 
  armsSecAutoEnable: "on"    # If you want to connect the application to Application Security, you must configure this parameter.

Note

For more information about application security, see What is application security?.
For more information about billing for application security, see Billing.

In the pod template of the Deployment, enable ARMS application monitoring by adding the armsPilotAutoEnable: "on" and armsPilotCreateAppName: "arms-k8s-demo" labels. The following code is a sample YAML file:

apiVersion: v1
kind: Namespace
metadata:
  name: arms-demo
---
apiVersion: apps/v1 # for versions before 1.8.0 use apps/v1beta1
kind: Deployment
metadata:
  name: arms-springboot-demo
  namespace: arms-demo
  labels:
    app: arms-springboot-demo
spec:
  replicas: 2
  selector:
    matchLabels:
      app: arms-springboot-demo
  template:
    metadata:
      labels:
        app: arms-springboot-demo
        armsPilotAutoEnable: "on"
        armsPilotCreateAppName: "arms-k8s-demo"
    spec:
      containers:
        - resources:
            limits:
              # ...

The following sample YAML file creates a Deployment and enables ARMS application monitoring.

Expand to view the full sample YAML file

apiVersion: v1
kind: Namespace
metadata:
  name: arms-demo
---
apiVersion: apps/v1 # for versions before 1.8.0 use apps/v1beta1
kind: Deployment
metadata:
  name: arms-springboot-demo
  namespace: arms-demo
  labels:
    app: arms-springboot-demo
spec:
  replicas: 2
  selector:
    matchLabels:
      app: arms-springboot-demo
  template:
    metadata:
      labels:
        app: arms-springboot-demo
        armsPilotAutoEnable: "on"
        armsPilotCreateAppName: "arms-k8s-demo"
        one-agent.jdk.version: "OpenJDK11"
    spec:
      containers:
        - resources:
            limits:
              cpu: 0.5
          image: registry.cn-hangzhou.aliyuncs.com/arms-docker-repo/arms-springboot-demo:v0.1
          imagePullPolicy: Always
          name: arms-springboot-demo
          env:
            - name: SELF_INVOKE_SWITCH
              value: "true"
            - name: COMPONENT_HOST
              value: "arms-demo-component"
            - name: COMPONENT_PORT
              value: "6666"
            - name: MYSQL_SERVICE_HOST
              value: "arms-demo-mysql"
            - name: MYSQL_SERVICE_PORT
              value: "3306"
---
apiVersion: apps/v1 # for versions before 1.8.0 use apps/v1beta1
kind: Deployment
metadata:
  name: arms-springboot-demo-subcomponent
  namespace: arms-demo
  labels:
    app: arms-springboot-demo-subcomponent
spec:
  replicas: 2
  selector:
    matchLabels:
      app: arms-springboot-demo-subcomponent
  template:
    metadata:
      labels:
        app: arms-springboot-demo-subcomponent
        armsPilotAutoEnable: "on"
        armsPilotCreateAppName: "arms-k8s-demo-subcomponent"
        one-agent.jdk.version: "OpenJDK11"
    spec:
      containers:
        - resources:
            limits:
              cpu: 0.5
          image: registry.cn-hangzhou.aliyuncs.com/arms-docker-repo/arms-springboot-demo:v0.1
          imagePullPolicy: Always
          name: arms-springboot-demo-subcomponent
          env:
            - name: SELF_INVOKE_SWITCH
              value: "false"
            - name: MYSQL_SERVICE_HOST
              value: "arms-demo-mysql"
            - name: MYSQL_SERVICE_PORT
              value: "3306"
---
apiVersion: v1
kind: Service
metadata:
  labels:
    name: arms-demo-component
  name: arms-demo-component
  namespace: arms-demo
spec:
  ports:
    # the port that this service should serve on
    - name: arms-demo-component-svc
      port: 6666
      targetPort: 8888
  # label keys and values that must match in order to receive traffic for this service
  selector:
    app: arms-springboot-demo-subcomponent
---
apiVersion: apps/v1 # for versions before 1.8.0 use apps/v1beta1
kind: Deployment
metadata:
  name: arms-demo-mysql
  namespace: arms-demo
  labels:
    app: mysql
spec:
  replicas: 1
  selector:
    matchLabels:
      app: mysql
  template:
    metadata:
      labels:
        app: mysql
    spec:
      containers:
        - resources:
            limits:
              cpu: 0.5
          image: registry.cn-hangzhou.aliyuncs.com/arms-docker-repo/arms-demo-mysql:v0.1
          name: mysql
          ports:
            - containerPort: 3306
              name: mysql
---
apiVersion: v1
kind: Service
metadata:
  labels:
    name: mysql
  name: arms-demo-mysql
  namespace: arms-demo
spec:
  ports:
    # the port that this service should serve on
    - name: arms-mysql-svc
      port: 3306
      targetPort: 3306
  # label keys and values that must match in order to receive traffic for this service
  selector:
    app: mysql
---

Next steps

After you complete these steps, you have enabled ARMS application monitoring for the application in the ACK cluster. On the Deployments page, find the target application. In the Actions column, click the > ARMS Console to view application monitoring details. For more information, see application overview.

Java application monitoring