Cryostat - monitor all namespaces

[grzesuav]

In helm chart params - https://github.com/cryostatio/cryostat-helm?tab=readme-ov-file#parameters I see setting to enable cryostat on certain namespaces, but I lack option of global mode - monitor all namespaces. How it can be achieved ?

[andrewazores]

"All Kubernetes Namespaces discovery" is not currently implemented, but we've had plans to do so for a while. Mentions of it are here:

cryostatio/cryostat-operator#502
cryostatio/cryostat-legacy#1290

Currently, if you require the Kubernetes Endpoints discovery mechanism, then you must have a fixed list of namespaces for discovery and configure the Cryostat instance for that at installation time.

If you're able to use the Cryostat Agent then your target applications can be located in any namespace and register themselves with a Cryostat instance in any namespace.

[grzesuav]

@andrewazores so switching from helm chart to an operator should allow me to do that, is there somewhere some guideline how to switch? Or just try to replicate the setting I have in helm via the operator approach ?

[andrewazores]

No, the feature is not currently implemented, so switching to the Operator won't help.

We don't have any guidelines on how to switch between the Operator and Helm Chart, but most features work the same between both - the Operator just has more features.

What I was saying is that the Cryostat Agent could help you in a way. It would allow you to have all your applications from any namespace discovered by your Cryostat instance, but you would also lose the Kubernetes-specific discovery features (grouping by Deployment, and namespace). This can be used with any Cryostat, whether you use the Operator or Helm Chart to install it.

[grzesuav]

got it, so it is not exactly what I am looking for. I want to use this in combine with Automated Rule to start recording when label is present on pod, and I guess kubernetes discovery is needed for that ?

[andrewazores]

That's true, Kubernetes discovery is needed if you need your Automated Rules to trigger based on Kubernetes labels. The Agent doesn't know about Kubernetes features like that.

In that case please watch the #716 issue, I expect this to be done in time and included in the next release of 4.0 early next year, for both the Helm chart and the Operator.

[andrewazores]

But please do also remember about #622 . After #716 is done it will be possible to create a Cryostat which has global cluster-wide visibility of all namespaces, can do discovery of applications in all namespaces, and therefore which can collect data from applications in any namespace. Therefore, any user who has access to such a Cryostat has unrestricted access to all of that data, even if they don't normally have access to all of those namespaces themselves. In a sense by creating a Cryostat this way you are offering a privilege escalation to your users.