Checking the agent prerequisites on Red Hat OpenShift

Before you install the agent, make sure that all the necessary prerequisite conditions are met. See the following necessary prerequisite conditions:

  1. Check whether you have a supported Red Hat OpenShift version.

  2. Check whether the network requirements for agents are met as described in Outbound network access requirements for Instana SaaS deployments.

Note:
You must configure the network as described in both Configuring firewall settings and Instana agent and sensor repositories sections.

Supported Red Hat OpenShift versions

Instana supports Red Hat OpenShift versions that are described in the Life Cycle Phases documentation.

The Instana agent supports the following managed Red Hat OpenShift offerings:

If your OpenShift offering uses Hosted Control Planes (HCP), additional monitoring limitations apply. For more information, see the HCP limitations section.

Current versions of installation methods

New versions of the operator and Helm chart are released frequently. To keep up with the updates for fixes, improvements, and new features, make sure that you are running the latest version of the operator or Helm chart.

To find the version information of the installation methods, see the following pages:

Setting up project and service accounts

If you install the agent by using the Instana agent operator, you must first set up a project for the Instana agent and configure its permissions.

Create the instana-agent project, and set the policy permissions to ensure that the instana-agent service account is in the privileged security context. See the following example commands:

oc login -u system:admin
oc new-project instana-agent
oc adm policy add-scc-to-user privileged -z instana-agent -n instana-agent
oc adm policy add-scc-to-user anyuid -z instana-agent-remote -n instana-agent

Hosted Control Planes (HCP) monitoring limitations

When you run workloads on an OpenShift cluster that uses Hosted Control Planes (HCP), the Kubernetes control plane components, such as the API server, controller manager, scheduler, and etcd, run in a separate management cluster or account outside the customer data-plane cluster. Because these components do not run in the customer data-plane cluster, the Instana agent cannot access or monitor them.

  • The following namespaces are examples of control plane resources that are typically not accessible from the customer cluster:
    • openshift-kube-apiserver
    • openshift-kube-controller-manager
    • openshift-kube-scheduler
    • openshift-etcd
  • The exact set of inaccessible namespaces might vary depending on your cloud provider and cluster configuration.

Impact on monitoring

The following capabilities remain fully functional:

  • Workload monitoring (pods, deployments, services, namespaces, CRDs, and related resources)
  • Worker-node monitoring
  • Worker-node kubelet metrics (CPU, memory, and PVC usage)
  • Kubernetes API access to user namespaces and resources.

However, the following limitations apply:

  • Control-plane components that do not run in the customer cluster are not visible for monitoring.
  • Metrics endpoints for control-plane components, such as the API server, controller manager, scheduler, and etcd, cannot be scraped.
  • Performance and health metrics for control-plane nodes are not available to agents that run in the customer data-plane cluster.

These limitations are a consequence of the HCP architecture, in which the control plane is fully managed and isolated from the customer data plane.