https://github.com/cryostatio/cryostat-operator
A Kubernetes Operator to facilitate the setup and management of Cryostat.
https://github.com/cryostatio/cryostat-operator
cryostat go golang hacktoberfest hacktoberfest2021 kubernetes metrics monitoring observability openshift operator
Last synced: 10 months ago
JSON representation
A Kubernetes Operator to facilitate the setup and management of Cryostat.
- Host: GitHub
- URL: https://github.com/cryostatio/cryostat-operator
- Owner: cryostatio
- License: apache-2.0
- Created: 2019-09-19T20:02:38.000Z (over 6 years ago)
- Default Branch: main
- Last Pushed: 2025-07-29T20:26:48.000Z (11 months ago)
- Last Synced: 2025-08-12T19:44:30.369Z (10 months ago)
- Topics: cryostat, go, golang, hacktoberfest, hacktoberfest2021, kubernetes, metrics, monitoring, observability, openshift, operator
- Language: Go
- Homepage: https://cryostat.io
- Size: 2.49 MB
- Stars: 34
- Watchers: 6
- Forks: 19
- Open Issues: 63
-
Metadata Files:
- Readme: README.md
- License: LICENSE
- Codeowners: .github/CODEOWNERS
Awesome Lists containing this project
README
# cryostat-operator
[](https://github.com/cryostatio/cryostat-operator/actions/workflows/build-ci.yml)
[](https://github.com/cryostatio/cryostat-operator/actions/workflows/test-ci-push.yml)
[](https://groups.google.com/g/cryostat-development)
A Kubernetes Operator to automate deployment of
[Cryostat](https://github.com/cryostatio/cryostat).
## SEE ALSO
* [cryostat-core](https://github.com/cryostatio/cryostat-core) for
the core library providing a convenience wrapper and headless stubs for use of
JFR using JDK Mission Control internals.
* [cryostat](https://github.com/cryostatio/cryostat) for the main API
backend to detect JVMs and manage JFR.
* [cryostat-web](https://github.com/cryostatio/cryostat-web) for the React
graphical frontend included as a submodule in Cryostat and built into
Cryostat's OCI images.
* [jfr-datasource](https://github.com/cryostatio/jfr-datasource) for
the JFR datasource for Grafana.
* [cryostat-grafana-dashboard](https://github.com/cryostatio/cryostat-grafana-dashboard)
for the Grafana dashboard.
## USING
### Requirements
- `kubernetes` v1.25+ with [`Operator Lifecycle Manager`](https://olm.operatorframework.io/)
- [`cert-manager`](https://github.com/cert-manager/cert-manager) v1.11.5+ (Recommended)
### Instructions
Once deployed, the `cryostat` instance can be accessed via web browser
at the URL provided by:
```
kubectl get cryostat -o jsonpath='{$.items[0].status.applicationUrl}'
```
To use Cryostat to monitor or profile Cryostat itself - since it is also an available JVM target -
you may use the Cryostat web UI to define a Custom Target with the connection URL `localhost:0`.
This is a special value which tells Cryostat's JVM that it should connect to itself directly, without
the need to expose a JMX port over the network.
## INSTALLATION
### OperatorHub
The operator's primary installation method is via [OperatorHub](https://operatorhub.io/).
A more detailed installation guide is available [here](https://cryostat.io/get-started/#install-via-operatorhub).
Installation of the Operator without OLM/OperatorHub is intended for development purposes and is
not a supported release configuration.
### Bundle Deployment
The operator can be deployed using OLM using `make deploy_bundle`. This will
deploy `quay.io/cryostat/cryostat-operator-bundle:$IMAGE_VERSION` to
your configured cluster using `oc` or `kubectl` (`kubeconfig`). You can set the
variables `IMAGE_NAMESPACE` or `IMAGE_VERSION` to deploy different builds of
the bundle. Once this is complete, the Cryostat Operator will be deployed
and running in your cluster.
### Manual Deployment
`make install` will create CustomResourceDefinitions and do other setup
required to prepare the cluster for deploying the operator, using `oc` or
`kubectl` on whichever OpenShift/Kubernetes cluster is configured with the local client.
`make uninstall` destroys the CRDs and undoes the setup.
`make run` can be used to run the operator controller manager as a process on
your local development machine and observing/interacting with your cluster.
This may be useful in some development scenarios, however in this case the
operator process will not have access to certain in-cluster resources such as
environment variables or service account token files.
`make deploy` will deploy the operator using static manifests to an arbitrary namespace (default to `cryostat-operator-system`).
- `make DEPLOY_NAMESPACE=foo-namespace deploy`
can be used to deploy to a namespace named `foo-namespace`. For
a convenient shorthand, use
`make DEPLOY_NAMESPACE=$(kubectl config view --minify -o 'jsonpath={.contexts[0].context.namespace}') deploy`
to deploy to the currently active OpenShift/Kubernetes namespace.
- `make undeploy` will likewise remove the operator, and also uses the
`DEPLOY_NAMESPACE` variable.
This also respects the `IMAGE_TAG` environment variable, so that different
versions of the operator can be easily deployed.
- To obtain such static manifests remotely without further customizations, use:
```bash
# Replace ref with any version tag or branch
kubectl kustomize "https://github.com/cryostatio/cryostat-operator.git/config/default?ref=v2.4.0"
```
### Configuration
Once deployed, the operator deployment will be active in the cluster, but no
Cryostat instance will be created. To trigger its creation, add a
Cryostat CR using the UI for operator "provided APIs". Full details on the
configuration options in the Cryostat CRD can be found in
[Configuring Cryostat](docs/config.md). When running on Kubernetes, see
[Network Options](docs/config.md#network-options) for additional
mandatory configuration in order to access Cryostat outside of the cluster.
For convenience, a full deployment can be created using
`kubectl create -f config/samples/operator_v1beta2_cryostat.yaml`, or more
simply, `make create_cryostat_cr`.
The container images used by the operator for the core application,
jfr-datasource, and the Grafana dashboard can be overridden by setting the
`RELATED_IMAGE_CORE`, `RELATED_IMAGE_DATASOURCE`, and `RELATED_IMAGE_GRAFANA`
environment variables, respectively, in the operator deployment.
## SECURITY
By default, the operator expects cert-manager to be available in the cluster.
This allows the operator to deploy Cryostat with all communication
between its internal services done over HTTPS. If you wish to disable this
feature and not use cert-manager, you can set the environment variable
`DISABLE_SERVICE_TLS=true` when you deploy the operator. We provide
`make cert_manager` and `make remove_cert_manager` targets to easily
install/remove cert-manager from your cluster.
### User Authentication
Users can use `oc whoami --show-token` to retrieve their OpenShift OAuth token
for the currently logged in user account. This token can be used when directly
interacting with the deployed Cryostat instance(s).
When using the web-client, users can login with their username and password associated with their OpenShift account. User credentials will be remembered for the duration of the session.
If the current user account does not have sufficient permissions to list
routes, list endpointslices, or perform other actions that Cryostat requires,
then the user may also try to authenticate using the Operator's service
account. This, of course, assumes that the user has permission to view this
service account's secrets.
`oc get secrets | grep cryostat-operator-service-account-token` will provide at least one
such operator service account token secret name which can be used - for
example, `cryostat-operator-service-account-token-7tt7l`. The token can then be retrieved
for use in authenticating as the operator service account:
```
$ oc describe secret cryostat-operator-service-account-token-7tt7l
Name: cryostat-operator-service-account-token-7tt7l
Namespace: default
Labels:
Annotations: kubernetes.io/created-by: openshift.io/create-dockercfg-secrets
kubernetes.io/service-account.name: cryostat-operator-service-account
kubernetes.io/service-account.uid: 692aa8c7-081e-4a51-9355-be3eaa8f9fa6
Type: kubernetes.io/service-account-token
Data
====
ca.crt: 7209 bytes
namespace: 7 bytes
service-ca.crt: 8422 bytes
token: eyJhbGciOiJSUzI1NiIsImtpZCI6IkhYZC13eDdGVGwyQzdGNVpZVndScEZ2VmRxWTlzbnBUUG9HRkJpejJkV3cifQ.eyJpc3MiOiJrdWJlcm5ldGVzL3NlcnZpY2VhY2NvdW50Iiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9uYW1lc3BhY2UiOiJkZWZhdWx0Iiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9zZWNyZXQubmFtZSI6ImNyeW9zdGF0LW9wZXJhdG9yLXNlcnZpY2UtYWNjb3VudC10b2tlbi03dHQ3bCIsImt1YmVybmV0ZXMuaW8vc2VydmljZWFjY291bnQvc2VydmljZS1hY2NvdW50Lm5hbWUiOiJjcnlvc3RhdC1vcGVyYXRvci1zZXJ2aWNlLWFjY291bnQiLCJrdWJlcm5ldGVzLmlvL3NlcnZpY2VhY2NvdW50L3NlcnZpY2UtYWNjb3VudC51aWQiOiI2OTJhYThjNy0wODFlLTRhNTEtOTM1NS1iZTNlYWE4ZjlmYTYiLCJzdWIiOiJzeXN0ZW06c2VydmljZWFjY291bnQ6ZGVmYXVsdDpjcnlvc3RhdC1vcGVyYXRvci1zZXJ2aWNlLWFjY291bnQifQ.M7C1V0bN3aILBflO7TTOTikw7wLGRJ79-OkCDQIZbu71QLdX05jyCxxtlH32lr8jz6HwxfXXweh3ifG_2lbe7_TbM8jxmBoMdLuc4Q_akpmA-GQuDPrRxfHGJApYGQ6CVug3KHSrQwj2M4QrSUz7FoeQGaOH9BnWj1TrHGmOZUPJ6u7JSu2OwoLBda6rF-M4Bl72DmkyMAzikreRgPEk4D7gTCY0yNvsQDuUAwpFwmEukRC2WyTAVTpKPgThZUk-UJ-dXufbhAcqIRt6jeCQ19_Bo0zXc_ELgQydxuTack1ndT3HwRmwwNuZDFv-G3Y0YdjfRh00DqEvSn9ynZzwueDCJUxlHdznytfUWk9PA712JENpFC7b-zSHnjymIcFeUd8s_Zq_-JKrDIPnH0oZDRO_MUpKEC7Jz_8SeFJHLLGfBZt_aP4VwQHEUThiFQPwrfbd8tppUG2TKcekPScKcauy-BCI52odBzapP6meilMQVrmRtu7i30L05vgQiST_OsmSP8CuKW13a-leCCtN_aNQGqlWvLhP81H95ui-PvMzwMIDlfDZ03ycuYg4R4eUG3nUq7-42wrSdFLo8gm9wsl7y1ZRMQwHR1DCVBbHYS0iFOcmwto2Ejlrgvn3Cs0pDS7pDVoFkH2FsTopEw3jXtnkMs15mSmBnHz-UjF-l08
```
or more briefly:
```
$ oc get -o jsonpath='{.data.token}' secret cryostat-operator-service-account-token-7tt7l | base64 -d
eyJhbGciOiJSUzI1NiIsImtpZCI6IkhYZC13eDdGVGwyQzdGNVpZVndScEZ2VmRxWTlzbnBUUG9HRkJpejJkV3cifQ.eyJpc3MiOiJrdWJlcm5ldGVzL3NlcnZpY2VhY2NvdW50Iiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9uYW1lc3BhY2UiOiJkZWZhdWx0Iiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9zZWNyZXQubmFtZSI6ImNyeW9zdGF0LW9wZXJhdG9yLXNlcnZpY2UtYWNjb3VudC10b2tlbi03dHQ3bCIsImt1YmVybmV0ZXMuaW8vc2VydmljZWFjY291bnQvc2VydmljZS1hY2NvdW50Lm5hbWUiOiJjcnlvc3RhdC1vcGVyYXRvci1zZXJ2aWNlLWFjY291bnQiLCJrdWJlcm5ldGVzLmlvL3NlcnZpY2VhY2NvdW50L3NlcnZpY2UtYWNjb3VudC51aWQiOiI2OTJhYThjNy0wODFlLTRhNTEtOTM1NS1iZTNlYWE4ZjlmYTYiLCJzdWIiOiJzeXN0ZW06c2VydmljZWFjY291bnQ6ZGVmYXVsdDpjcnlvc3RhdC1vcGVyYXRvci1zZXJ2aWNlLWFjY291bnQifQ.M7C1V0bN3aILBflO7TTOTikw7wLGRJ79-OkCDQIZbu71QLdX05jyCxxtlH32lr8jz6HwxfXXweh3ifG_2lbe7_TbM8jxmBoMdLuc4Q_akpmA-GQuDPrRxfHGJApYGQ6CVug3KHSrQwj2M4QrSUz7FoeQGaOH9BnWj1TrHGmOZUPJ6u7JSu2OwoLBda6rF-M4Bl72DmkyMAzikreRgPEk4D7gTCY0yNvsQDuUAwpFwmEukRC2WyTAVTpKPgThZUk-UJ-dXufbhAcqIRt6jeCQ19_Bo0zXc_ELgQydxuTack1ndT3HwRmwwNuZDFv-G3Y0YdjfRh00DqEvSn9ynZzwueDCJUxlHdznytfUWk9PA712JENpFC7b-zSHnjymIcFeUd8s_Zq_-JKrDIPnH0oZDRO_MUpKEC7Jz_8SeFJHLLGfBZt_aP4VwQHEUThiFQPwrfbd8tppUG2TKcekPScKcauy-BCI52odBzapP6meilMQVrmRtu7i30L05vgQiST_OsmSP8CuKW13a-leCCtN_aNQGqlWvLhP81H95ui-PvMzwMIDlfDZ03ycuYg4R4eUG3nUq7-42wrSdFLo8gm9wsl7y1ZRMQwHR1DCVBbHYS0iFOcmwto2Ejlrgvn3Cs0pDS7pDVoFkH2FsTopEw3jXtnkMs15mSmBnHz-UjF-l08
```
## BUILDING
### Requirements
- `go` v1.23+
- [`operator-sdk`](https://github.com/operator-framework/operator-sdk) v1.31.0
- `podman` or `docker`
- [`jq`](https://stedolan.github.io/jq/) v1.6+
- [`yq`](https://github.com/mikefarah/yq/) v4.35+
- `ginkgo` (Optional)
### Instructions
`make generate manifests manager` will trigger code/YAML generation and compile
the operator controller manager, along with running some code quality checks.
`make oci-build` will build an OCI image from the generated YAML and compiled
binary to the local registry, tagged as
`quay.io/crystatio/cryostat-operator`. This tag can be overridden by
setting the environment variables `IMAGE_NAMESPACE` and `OPERATOR_NAME`.
`IMAGE_VERSION` can also be set to override the tagged version.
`make bundle` will create an OLM bundle. This will generate a CSV, CRDs and
other manifests, and other required configurations for an OLM bundle versioned
with version `$IMAGE_VERSION` in the `bundle/` directory. `make bundle-build`
will create an OCI image of this bundle, which can then be pushed to an image
repository such as `quay.io`.
`make catalog-build` will build an OCI image of the operator catalog (i.e. index)
with version `$IMAGE_VERSION` that includes the bundle image of the same version.
## DEVELOPMENT
An invocation like
`export IMAGE_NAMESPACE=quay.io/some-user` `export IMAGE_VERSION=test-version`
`make generate manifests manager oci-build bundle bundle-build`
`podman image prune -f && podman push $IMAGE_NAMESPACE/cryostat-operator:$IMAGE_VERSION && podman push $IMAGE_NAMESPACE/cryostat-operator-bundle:$IMAGE_VERSION`
`make deploy_bundle`
is handy for local development testing using ex. CodeReady Containers. This
exercises a similar build and deployment path as what end users using OLM and
OperatorHub will eventually receive.
## TESTING
### Requirements
- (optional) [oc](https://www.okd.io/download.html)
- (optional) [crc](https://github.com/code-ready/crc)
### Instructions
`make test-envtest` will run controller tests using ginkgo if installed, or go test if
not, requiring no cluster connection.
`make test-scorecard` will run the Operator SDK's scorecard test suite. This requires a
Kubernetes or OpenShift cluster to be available and logged in with your `kubectl` or `oc`
client. The recommended setup for development testing is CodeReady Containers (`crc`).
Before the scorecard tests are run, all cryostat and cryostat-operator
resources will be deleted to ensure a clean slate.
`make test` will run all tests.