From 90ac2e08b4fc00f3785334f613ffdfb2d5985f33 Mon Sep 17 00:00:00 2001 From: Paul Needle Date: Fri, 27 Nov 2020 10:25:01 +0000 Subject: [PATCH] Updates to the Remote Health section. --- ...lmetry-and-insights-operator-data-flow.svg | 1 + modules/insights-operator-about.adoc | 6 +- ...perator-what-information-is-collected.adoc | 9 ++- modules/telemetry-about-telemetry.adoc | 12 +-- ...y-consequences-of-disabling-telemetry.adoc | 4 +- ...lemetry-what-information-is-collected.adoc | 33 ++++---- ...metry-and-insights-operator-data-flow.adoc | 17 ++++ .../about-remote-health-monitoring.adoc | 79 ++++++++++++++++++- ...opting-out-of-remote-health-reporting.adoc | 2 +- 9 files changed, 124 insertions(+), 39 deletions(-) create mode 100644 images/telmetry-and-insights-operator-data-flow.svg create mode 100644 modules/understanding-telemetry-and-insights-operator-data-flow.adoc diff --git a/images/telmetry-and-insights-operator-data-flow.svg b/images/telmetry-and-insights-operator-data-flow.svg new file mode 100644 index 0000000000..4d0820cdd7 --- /dev/null +++ b/images/telmetry-and-insights-operator-data-flow.svg @@ -0,0 +1 @@ +132_OpenShift_1220KubernetesAPIPrometheusAPIHTTPS (443)HTTPS (443)TelemeterClientOpenShiftContainer PlatformRed HatSupportSubscriptionmanagementOpenShiftCluster ManagerInsightsanalysis enginecloud.redhat.comapi.openshift.comRed HatWebconsoleInsightsOperator \ No newline at end of file diff --git a/modules/insights-operator-about.adoc b/modules/insights-operator-about.adoc index ef6d30ea9e..fec7920e54 100644 --- a/modules/insights-operator-about.adoc +++ b/modules/insights-operator-about.adoc @@ -9,12 +9,10 @@ The Insights Operator periodically gathers configuration and component failure s Users of {product-title} can display the report of each cluster in {cloud-redhat-com}. If any issues have been identified, Insights provides further details and, if available, steps on how to solve a problem. -The Insights Operator does not collect identifying information, such as user names, passwords, or certificates. However, to provide specific remediation steps, the Insights Operator does not anonymize certain information internal to the cluster, such as IP addresses and host names of nodes. +The Insights Operator does not collect identifying information, such as user names, passwords, or certificates. See link:https://cloud.redhat.com/security/insights[Red Hat Insights Data & Application Security] for information about Red Hat Insights data collection and controls. Red Hat uses all connected cluster information to: * Proactively identify potential cluster issues and provide a solution and preventive actions in {cloud-redhat-com} -* Improve {product-title} +* Improve {product-title} by providing aggregated and critical information to product and support teams * Make {product-title} more intuitive - -The information the Insights Operator sends is available only to Red Hat Support and engineering teams with the same restrictions as accessing data reported in support cases. Red Hat does not share this information with third parties. diff --git a/modules/insights-operator-what-information-is-collected.adoc b/modules/insights-operator-what-information-is-collected.adoc index dbccf6e4b4..f9c29b8a7d 100644 --- a/modules/insights-operator-what-information-is-collected.adoc +++ b/modules/insights-operator-what-information-is-collected.adoc @@ -5,11 +5,12 @@ [id="insights-operator-what-information-is-collected_{context}"] = Information collected by the Insights Operator -The Insights Operator collects: +The following information is collected by the Insights Operator: * General information about your cluster and its components to identify issues that are specific to your {product-title} version and environment * Configuration files, such as the image registry configuration, of your cluster to determine incorrect settings and issues that are specific to parameters you set -* Error that occurred in the cluster components -* Progress and health information of running updates, and the status of any component upgrades +* Errors that occur in the cluster components +* Progress information of running updates, and the status of any component upgrades * Details of the platform that {product-title} is deployed on, such as Amazon Web Services, and the region that the cluster is located in -* Information about infrastructure pods +* If an Operator reports an issue, information is collected about core {product-title} pods in the `openshift-*` and `kube-*` projects. This includes state, resource, security context, volume information, and more. + diff --git a/modules/telemetry-about-telemetry.adoc b/modules/telemetry-about-telemetry.adoc index 06c1b28a0a..71228ca02e 100644 --- a/modules/telemetry-about-telemetry.adoc +++ b/modules/telemetry-about-telemetry.adoc @@ -6,14 +6,8 @@ [id="telemetry-about-telemetry_{context}"] = About Telemetry -Telemetry sends a carefully chosen subset of the cluster monitoring metrics to Red Hat. These metrics are sent continuously and describe: +Telemetry sends a carefully chosen subset of the cluster monitoring metrics to Red Hat. The Telemeter Client fetches the metrics values every four minutes and thirty seconds and uploads the data to Red Hat. These metrics are described in this document. -* The size of an {product-title} cluster -* The health and status of {product-title} components -* The health and status of any upgrade being performed -* Limited usage information about {product-title} components and features -* Summary info about alerts reported by the cluster monitoring component +This stream of data is used by Red Hat to monitor the clusters in real-time and to react as necessary to problems that impact our customers. It also allows Red Hat to roll out {product-title} upgrades to customers to minimize service impact and continuously improve the upgrade experience. -This continuous stream of data is used by Red Hat to monitor the health of clusters in real time and to react as necessary to problems that impact our customers. It also allows Red Hat to roll out {product-title} upgrades to customers so as to minimize service impact and continuously improve the upgrade experience. - -This debugging information is available to Red Hat Support and engineering teams with the same restrictions as accessing data reported via support cases. All connected cluster information is used by Red Hat to help make {product-title} better and more intuitive to use. None of the information is shared with third parties. +This debugging information is available to Red Hat Support and Engineering teams with the same restrictions as accessing data reported through support cases. All connected cluster information is used by Red Hat to help make {product-title} better and more intuitive to use. diff --git a/modules/telemetry-consequences-of-disabling-telemetry.adoc b/modules/telemetry-consequences-of-disabling-telemetry.adoc index 2e78df6872..44ca200ca1 100644 --- a/modules/telemetry-consequences-of-disabling-telemetry.adoc +++ b/modules/telemetry-consequences-of-disabling-telemetry.adoc @@ -5,14 +5,14 @@ [id="telemetry-consequences-of-disabling-telemetry_{context}"] = Consequences of disabling remote health reporting -In {product-title}, customers can opt out of reporting health and usage information. However, connected clusters allow Red Hat to react more quickly to problems and better support our customers, as well as better understand how product upgrades impact clusters. +In {product-title}, customers can opt out of reporting usage information. However, connected clusters allow Red Hat to react more quickly to problems and better support our customers, as well as better understand how product upgrades impact clusters. Connected clusters also help to simplify the subscription and entitlement process and enable the {cloud-redhat-com} service to provide an overview of your clusters and their subscription status. Red Hat strongly recommends leaving health and usage reporting enabled for pre-production and test clusters even if it is necessary to opt out for production clusters. This allows Red Hat to be a participant in qualifying {product-title} in your environments and react more rapidly to product issues. Some of the consequences of opting out of having a connected cluster are: * Red Hat will not be able to monitor the success of product upgrades or the health of your clusters without a support case being opened. -* Red Hat will not be able to use anonymized configuration data to better triage customer support cases and identify which configurations our customers find important. +* Red Hat will not be able to use configuration data to better triage customer support cases and identify which configurations our customers find important. * The {cloud-redhat-com} will not show data about your clusters including health and usage information. ifndef::openshift-origin[] * Your subscription entitlement information must be manually entered via cloud.redhat.com without the benefit of automatic usage reporting. diff --git a/modules/telemetry-what-information-is-collected.adoc b/modules/telemetry-what-information-is-collected.adoc index d2347d80aa..1778957432 100644 --- a/modules/telemetry-what-information-is-collected.adoc +++ b/modules/telemetry-what-information-is-collected.adoc @@ -10,27 +10,26 @@ endif::[] [id="what-information-is-collected_{context}"] = Information collected by Telemetry -Primary information collected by Telemetry includes: +The following information is collected by Telemetry: -* The number of updates available per cluster -* Channel and image repository used for an update -* The number of errors that occurred during an update -* Progress information of running updates -* The number of machines per cluster -* The number of CPU cores and size of RAM of the machines -* The number of members in the etcd cluster and number of objects currently stored in the etcd cluster -* The number of CPU cores and RAM used per machine type - infra or master -* The number of CPU cores and RAM used per cluster +* The unique random identifier that is generated during an installation +* Version information, including the {product-title} cluster version and installed update details that are used to determine update version availability +* Update information, including the number of updates available per cluster, the channel and image repository used for an update, update progress information, and the number of errors that occur in an update +* The name of the provider platform that {product-title} is deployed on and the data center location +* Sizing information about clusters, machine types, and machines, including the number of CPU cores and the amount of RAM used for each ifdef::virt-cluster[] -* The number of running virtual machine instances in the cluster +* The number of running virtual machine instances in a cluster endif::virt-cluster[] -* Use of {product-title} framework components per cluster -* The version of the {product-title} cluster -* Health, condition, and status for any {product-title} framework component that is installed on the cluster, for example Cluster Version Operator, Cluster Monitoring, Image Registry, and Elasticsearch for Logging -* A unique random identifier that is generated during installation -* The name of the platform that {product-title} is deployed on, such as Amazon Web Services +* The number of etcd members and the number of objects stored in the etcd cluster +* The {product-title} framework components installed in a cluster and their condition and status +* Usage information about components, features, and extensions +* Usage details about Technology Previews and unsupported configurations +* Information about degraded software and nodes marked as `NotReady` +* Events for all namespaces listed as "related objects" for a degraded Operator +* Configuration details that help Red Hat Support to provide beneficial support for customers. This includes node configuration at the cloud infrastructure level, host names, IP addresses, Kubernetes pod names, namespaces, and services. +* Information about the validity of certificates -Telemetry does not collect identifying information such as user names, passwords, or the names or addresses of user resources. +Telemetry does not collect identifying information such as user names, or passwords. Red Hat does not intend to collect personal information. If Red Hat discovers that personal information has been inadvertently received, Red Hat will delete such information. To the extent that any telemetry data constitutes personal data, please refer to the link:https://www.redhat.com/en/about/privacy-policy[Red Hat Privacy Statement] for more information about Red Hat’s privacy practices. ifeval::["{context}" == "virt-openshift-cluster-monitoring"] :!virt-cluster: diff --git a/modules/understanding-telemetry-and-insights-operator-data-flow.adoc b/modules/understanding-telemetry-and-insights-operator-data-flow.adoc new file mode 100644 index 0000000000..0a7be2f24a --- /dev/null +++ b/modules/understanding-telemetry-and-insights-operator-data-flow.adoc @@ -0,0 +1,17 @@ +// Module included in the following assemblies: +// +// * support/remote_health_monitoring/about-remote-health-monitoring.adoc + +[id="understanding-telemetry-and-insights-operator-data-flow_{context}"] += Understanding Telemetry and Insights Operator data flow + +The Telemeter Client collects selected time series data from the Prometheus API. The time series data is uploaded to api.openshift.com every four minutes and thirty seconds for processing. + +The Insights Operator gathers selected data from the Kubernetes API and the Prometheus API into an archive. The archive is uploaded to link:https://cloud.redhat.com[cloud.redhat.com] every two hours for processing. The Insights Operator also downloads the latest Insights analysis from link:https://cloud.redhat.com[cloud.redhat.com]. This is used to populate the *Insights status* pop-up that is included in the *Overview* page in the {product-title} web console. + +All of the communication with Red Hat occurs over encrypted channels by using Transport Layer Security (TLS) and mutual certificate authentication. All of the data is encrypted in transit and at rest. + +Access to the systems that handle customer data is controlled through multi-factor authentication and strict authorization controls. Access is granted on a need-to-know basis and is limited to required operations. + +.Telemetry and Insights Operator data flow +image:telmetry-and-insights-operator-data-flow.svg[Telemetry and Insights Operator data flow] \ No newline at end of file diff --git a/support/remote_health_monitoring/about-remote-health-monitoring.adoc b/support/remote_health_monitoring/about-remote-health-monitoring.adoc index 5f3bad5a23..4a06653255 100644 --- a/support/remote_health_monitoring/about-remote-health-monitoring.adoc +++ b/support/remote_health_monitoring/about-remote-health-monitoring.adoc @@ -5,16 +5,91 @@ include::modules/common-attributes.adoc[] toc::[] -{product-title} collects anonymized aggregated information about the health, usage, and size of clusters and reports it to Red Hat via two integrated components: Telemetry and the Insights Operator. This information allows Red Hat to improve {product-title} and to react to issues that impact customers more quickly. This also simplifies the subscription and entitlement process for Red Hat customers and enables the {cloud-redhat-com} service to provide an overview of your clusters and their health and subscription status. +{product-title} collects telemetry and configuration data about your cluster and reports it to Red Hat by using the Telemeter Client and the Insights Operator. The data that is provided to Red Hat enables the benefits outlined in this document. -A cluster that reports data to Red Hat via Telemetry and the Insights Operator is considered a _connected cluster_. +A cluster that reports data to Red Hat through Telemetry and the Insights Operator is considered a _connected cluster_. + +*Telemetry* is the term that Red Hat uses to describe the information being sent to Red Hat by the {product-title} Telemeter Client. Lightweight attributes are sent from connected clusters to Red Hat to enable subscription management automation, monitor the health of clusters, assist with support, and improve customer experience. + +The *Insights Operator* gathers {product-title} configuration data and sends it to Red Hat. The data is used to produce insights about potential issues that a cluster might be exposed to. These insights are communicated to cluster administrators on link:https://cloud.redhat.com/openshift[cloud.redhat.com/openshift]. + +More information is provided in this document about these two processes. + +.Telemetry and Insights Operator benefits + +Telemetry and the Insights Operator enable the following benefits for end-users: + +* *Enhanced identification and resolution of issues*. Events that might seem normal to an end-user can be observed by Red Hat from a broader perspective across a fleet of clusters. Some issues can be more rapidly identified from this point of view and resolved without an end-user needing to open a support case or file a Bugzilla. + +* *Advanced release management*. {product-title} offers the `candidate`, `fast`, and `stable` release channels, which enable you to choose an update strategy. The graduation of a release from `fast` to `stable` is dependent on the success rate of updates and on the events seen during upgrades. With the information provided by connected clusters, Red Hat can improve the quality of releases to `stable` channels and react more rapidly to issues found in the `fast` channels. + +* *Targeted prioritization of new features and functionality*. The data collected provides insights about which areas of {product-title} are used most. With this information, Red Hat can focus on developing the new features and functionality that have the greatest impact for our customers. + +* *A streamlined support experience*. You can provide a cluster ID for a connected cluster when creating a support ticket on the link:https://access.redhat.com/support/[Red Hat Customer Portal]. This enables Red Hat to deliver a streamlined support experience that is specific to your cluster, by using the connected information. This document provides more information about that enhanced support experience. + +* *Predictive analytics*. The insights displayed for your cluster on link:https://cloud.redhat.com/openshift/[cloud.redhat.com/openshift] are enabled by the information collected from connected clusters. Red Hat is investing in applying deep learning, machine learning, and artificial intelligence automation to help identify issues that {product-title} clusters are exposed to. ifdef::openshift-origin[] {product-title} may be installed without a pull secret received at cloud.redhat.com. In this case default imagestreams will not be imported and telemetry data will not be sent. endif::[] include::modules/telemetry-about-telemetry.adoc[leveloffset=+1] + +.Additional resources + +* See the xref:../../updating/updating-cluster-between-minor.adoc#updating-cluster-between-minor[{product-title} update documentation] for more information about updating or upgrading a cluster. + include::modules/telemetry-what-information-is-collected.adoc[leveloffset=+2] +.Additional resources + +* See xref:../../support/remote_health_monitoring/showing-data-collected-by-remote-health-monitoring.adoc#showing-data-collected-from-the-cluster_showing-data-collected-by-remote-health-monitoring[Showing data collected by Telemetry] for details about how to list the attributes that Telemetry gathers from Prometheus in {product-title}. + +* See the link:https://github.com/openshift/cluster-monitoring-operator/blob/master/manifests/0000_50_cluster-monitoring-operator_04-config.yaml[upstream cluster-monitoring-operator source code] for a list of the attributes that Telemetry gathers from Prometheus. + +* Telemetry is installed and enabled by default. If you need to opt out of remote health reporting, see xref:../../support/remote_health_monitoring/opting-out-of-remote-health-reporting.adoc#opting-out-remote-health-reporting[Opting out of remote health reporting]. + include::modules/insights-operator-about.adoc[leveloffset=+1] + +.Additional resources + +* The Insights Operator is installed and enabled by default. If you need to opt out of remote health reporting, see xref:../../support/remote_health_monitoring/opting-out-of-remote-health-reporting.adoc#opting-out-remote-health-reporting[Opting out of remote health reporting]. + include::modules/insights-operator-what-information-is-collected.adoc[leveloffset=+2] + +.Additional resources + +* See xref:../../support/remote_health_monitoring/showing-data-collected-by-remote-health-monitoring.html#insights-operator-showing-data-collected-from-the-cluster_showing-data-collected-by-remote-health-monitoring[Showing data collected by the Insights Operator] for details about how to review the data that is collected by the Insights Operator. + +* The Insights Operator source code is available for review and contribution. See the link:https://github.com/openshift/insights-operator/blob/master/docs/gathered-data.md[Insights Operator upstream project] for a list of the items collected by the Insights Operator. + +include::modules/understanding-telemetry-and-insights-operator-data-flow.adoc[leveloffset=+1] + +.Additional resources + +* See xref:../../monitoring/understanding-the-monitoring-stack.adoc#understanding-the-monitoring-stack_understanding-the-monitoring-stack[Understanding the monitoring stack] for more information about the {product-title} monitoring stack. + +* See xref:../../installing/install_config/configuring-firewall.adoc#configuring-firewall[Configuring your firewall] for details about configuring a firewall and enabling endpoints for Telemetry and Insights + +[id="additional-details-about-how-remote-health-monitoring-data-is-used"] +== Additional details about how remote health monitoring data is used + +The information collected to enable remote health monitoring is detailed in xref:../../support/remote_health_monitoring/about-remote-health-monitoring.adoc#what-information-is-collected_about-remote-health-monitoring[Information collected by Telemetry] and xref:../../support/remote_health_monitoring/about-remote-health-monitoring.adoc#insights-operator-what-information-is-collected_about-remote-health-monitoring[Information collected by the Insights Operator]. + +As further described in the preceding sections of this document, Red Hat collects data about your use of the Red Hat Product(s) for purposes such as providing support and upgrades, optimizing performance or configuration, minimizing service impacts, identifying and remediating threats, troubleshooting, improving the offerings and user experience, responding to issues, and for billing purposes if applicable. + +.Collection safeguards + +Red Hat employs technical and organizational measures designed to protect the telemetry and configuration data. + +.Sharing + +Red Hat may share the data collected through Telemetry and the Insights Operator internally within Red Hat to improve your user experience. Red Hat may share telemetry and configuration data with its business partners in an aggregated form that does not identify customers to help the partners better understand their markets and their customers’ use of Red Hat offerings or to ensure the successful integration of products jointly supported by those partners. + +.Third party service providers + +Red Hat may engage certain service providers to assist in the collection and storage of the telemetry and configuration data. + +.User control / enabling and disabling telemetry and configuration data collection + +You may disable {product-title} Telemetry and the Insights Operator by following the instructions in xref:../../support/remote_health_monitoring/opting-out-of-remote-health-reporting.adoc#opting-out-remote-health-reporting[Opting out of remote health reporting]. \ No newline at end of file diff --git a/support/remote_health_monitoring/opting-out-of-remote-health-reporting.adoc b/support/remote_health_monitoring/opting-out-of-remote-health-reporting.adoc index 8fe94855d3..4d37e6513f 100644 --- a/support/remote_health_monitoring/opting-out-of-remote-health-reporting.adoc +++ b/support/remote_health_monitoring/opting-out-of-remote-health-reporting.adoc @@ -6,7 +6,7 @@ include::modules/common-attributes.adoc[] toc::[] ifdef::openshift-enterprise,openshift-webscale,openshift-origin[] -You might need to opt out of reporting health and usage data for your cluster. For example, you might need to comply with privacy laws or standards governing how your organization reports monitoring data. +You may choose to opt out of reporting health and usage data for your cluster. endif::[] ifdef::openshift-dedicated[]