|
| 1 | +--- |
| 2 | +id: version-2.1.1-installation |
| 3 | +title: Installation |
| 4 | +original_id: installation |
| 5 | +--- |
| 6 | + |
| 7 | +This section describes the installation details for the inspectIT Ocelot agent. |
| 8 | + |
| 9 | +## Supported Java Runtime Environments |
| 10 | + |
| 11 | +The inspectIT Ocelot supports Java Runtime Environments in version 1.8.0 and above. You will not be able to use the agent with the lower Java versions. |
| 12 | +The agent works with different JRE distributions including Oracle, openJDK, Azul, etc. |
| 13 | + |
| 14 | +## Adding the Agent to a JVM |
| 15 | + |
| 16 | +The best option for using the inspectIT Ocelot is to include it to the start of the JVM by using the `-javaagent` command-line option. |
| 17 | +This way the agent will be initialized before your application starts. |
| 18 | + |
| 19 | +```bash |
| 20 | +$ java -javaagent:"/path/to/inspectit-ocelot-agent-2.1.1.jar" -jar my-java-program.jar |
| 21 | +``` |
| 22 | + |
| 23 | +> Some application servers have dedicated scripts that are used to launch the actual JVM that runs the application. In such cases, you must alter the start-up scripts in order to instrument the correct JVM. |
| 24 | +
|
| 25 | +## Attaching the Agent to a Running JVM |
| 26 | + |
| 27 | +inspectIT Ocelot also supports attaching the agent to an already running JVM. |
| 28 | +In such a scenario the collection of metrics and traces will start from the point of the attachment. |
| 29 | + |
| 30 | +The attaching can easily be done using the agent itself and executing the following command: |
| 31 | + |
| 32 | +```bash |
| 33 | +$ java -jar inspectit-ocelot-agent-2.1.1.jar <PID> [<AGENT_ARGUMENTS>] |
| 34 | +``` |
| 35 | + |
| 36 | +In the following example, we are attaching the agent to the JVM process `1337` and passing some [additional arguments](configuration/configuration-sources.md#java-agent-arguments) to it: |
| 37 | +```bash |
| 38 | +$ java -jar inspectit-ocelot-agent-2.1.1.jar 1337 '{"inspectit":{"service-name":"my-agent"}}' |
| 39 | +``` |
| 40 | + |
| 41 | +> The agent is internally using the utility [jattach](https://github.com/apangin/jattach) for attaching itself to a running JVM. |
| 42 | +
|
| 43 | +In order to find the process ID of a running JVM, you can use the `jcmd` to list all the running Java processes on your machine: |
| 44 | + |
| 45 | +```bash |
| 46 | +$ jcmd -l |
| 47 | +``` |
| 48 | + |
| 49 | +### Attaching Using jattach |
| 50 | + |
| 51 | +Another way of attaching the agent to a running JVM is to use the utility [jattach](https://github.com/apangin/jattach): |
| 52 | + |
| 53 | +```bash |
| 54 | +$ ./jattach.sh <PID> load instrument false /path/to/inspectit-ocelot-agent-2.1.1.jar='{"inspectit.service-name" : "MyService"}' |
| 55 | +``` |
| 56 | +In this example we're also passing [JSON arguments](configuration/configuration-sources.md#java-agent-arguments) to the agent in order to configure its service name. |
| 57 | + |
| 58 | +> Using the attach options has some limitations with respect to using the OpenCensus instrumentation library in combination with the inspectIT Ocelot agent. Please refer to [OpenCensus Configuration](configuration/open-census-configuration.md) section to understand these limitations. |
| 59 | +
|
| 60 | +## Using the Agent With a Security Manager |
| 61 | + |
| 62 | +If a Java Security Manager is enabled, the agent needs to be granted additional permissions to work. |
| 63 | +For this, add the following to your policy file: |
| 64 | + |
| 65 | +``` |
| 66 | +grant codeBase "file:<absolute_path_to_inspectit-ocelot-agent.jar>" { |
| 67 | + permission java.security.AllPermission; |
| 68 | +}; |
| 69 | +``` |
| 70 | + |
| 71 | +The correct policy file location depends on different factors. |
| 72 | +See the [official Java documentation](https://docs.oracle.com/en/java/javase/17/security/permissions-jdk1.html#GUID-789089CA-8557-4017-B8B0-6899AD3BA18D) for further information. |
| 73 | + |
| 74 | +## Using the Agent with Kubernetes |
| 75 | + |
| 76 | +There are several ways to use the agent in a Kubernetes cluster. |
| 77 | +For example, you could integrate the agent directly into the application container images, but this requires customizing all images. |
| 78 | + |
| 79 | +Another possibility is that the agent is automatically injected into the application containers using an **operator** and attached to the JVM processes. |
| 80 | +For this purpose, the [OpenTelemetry K8s Operator](https://github.com/open-telemetry/opentelemetry-operator) can be used, with which it is possible to automatically roll out the inspectIT Ocelot Java Agent. |
| 81 | +It is still under development, so it is not feature-complete, but depending on your needs the current version could already provide everything needed. |
| 82 | + |
| 83 | +:::warning Up-to-dateness of the Documentation |
| 84 | +Since the OpenTelemetry K8s operator is currently under heavy development, the installation steps described below **may be outdated**. |
| 85 | +They may nevertheless be helpful in navigating the OpenTelemetry Operator installation documentation by showing you which parts you need. |
| 86 | +::: |
| 87 | + |
| 88 | +### Installing the Operator |
| 89 | + |
| 90 | +Install the OpenTelemetry Operator as described in its [official readme file](https://github.com/open-telemetry/opentelemetry-operator#getting-started). This includes the following steps: |
| 91 | + |
| 92 | +1. Install the [cert-manager](https://cert-manager.io/docs/installation/) in your cluster if you have not done it already. |
| 93 | +2. Install the operator using the following command. Please note that this will install the latest version of it: |
| 94 | + |
| 95 | + ```shell |
| 96 | + kubectl apply -f https://github.com/open-telemetry/opentelemetry-operator/releases/latest/download/opentelemetry-operator.yaml |
| 97 | + ``` |
| 98 | + |
| 99 | + By adjusting the URL to a different GitHub release, a specific version of the operator can be used: |
| 100 | + |
| 101 | + ```shell |
| 102 | + kubectl apply -f https://github.com/open-telemetry/opentelemetry-operator/releases/download/v{version}/opentelemetry-operator.yaml |
| 103 | + ``` |
| 104 | + |
| 105 | +### Using the Operator |
| 106 | + |
| 107 | +1. Create an `Instrumentation` object as shown below. Set the `spec.java.image` to the inspectIT Ocelot agent container image you would like to use: |
| 108 | + |
| 109 | + :::note |
| 110 | + Please note that only container images of the inspectIT Ocelot Agent starting from version `1.15.2` are compatible and work with the OpenTelemetry K8s Operator. |
| 111 | + ::: |
| 112 | + |
| 113 | + ```yaml |
| 114 | + apiVersion: opentelemetry.io/v1alpha1 |
| 115 | + kind: Instrumentation |
| 116 | + metadata: |
| 117 | + name: my-instrumentation |
| 118 | + spec: |
| 119 | + java: |
| 120 | + image: inspectit/inspectit-ocelot-agent:1.15.2 |
| 121 | + ``` |
| 122 | + |
| 123 | +2. Annotate namespaces or containers that should receive the agent as described in the [official readme file](https://github.com/open-telemetry/opentelemetry-operator#getting-started). The possible values for the annotation can be: |
| 124 | + |
| 125 | + - `true` - inject the `Instrumentation` resource from the namespace. |
| 126 | + - `my-instrumentation` - name of Instrumentation CR instance. |
| 127 | + - `false` - do not inject |
| 128 | + |
| 129 | + The following annotation can be used for this: |
| 130 | + ```yaml |
| 131 | + instrumentation.opentelemetry.io/inject-java: "true" |
| 132 | + ``` |
| 133 | + |
| 134 | + :::warning Ensure Correct Referencing |
| 135 | + If the operator cannot find the instrumentation object, e.g. because none was created or the name was written incorrectly in the annotation, the containers will not be started! |
| 136 | + ::: |
| 137 | + |
| 138 | +3. (Optional) Add environment variables to the containers to configure the agent. See the following section for using [environment variables to configure](configuration/configuration-sources.md#os-environment-variables) the inspectIT Ocelot agent. |
| 139 | + |
| 140 | + For example, to set a service-name for the agent and connect it to a specific configuration-server, you could set the `INSPECTIT_CONFIG_HTTP_URL` and `INSPECTIT_SERVICE_NAME` environment variable like in the following: |
| 141 | + |
| 142 | + ```yaml |
| 143 | + containers: |
| 144 | + - image: my-app-image |
| 145 | + name: my-app |
| 146 | + env: |
| 147 | + - name: INSPECTIT_CONFIG_HTTP_URL |
| 148 | + value: http://my-ocelot-config-server:8090/api/v1/agent/configuration |
| 149 | + - name: INSPECTIT_SERVICE_NAME |
| 150 | + value: my-service-name |
| 151 | + ``` |
| 152 | + |
| 153 | + You can also take a look at the [deployment file](https://github.com/inspectIT/trading-demo-application/blob/main/k8s/deployment.yaml) of the [trading demo application](https://github.com/inspectIT/trading-demo-application) where exactly this is set up. |
| 154 | + |
| 155 | +4. Start or restart the containers to trigger the injection and attachment of the agent. |
| 156 | + |
| 157 | + Currently, the operator **will not automatically restart running containers** in case changes are made to the `Instrumentation` objects. However, there are plans to provide the ability to restart containers in order to roll out changes of the configurable `Instrumentation` objects automatically (see [issue #553](https://github.com/open-telemetry/opentelemetry-operator/issues/553)). |
0 commit comments