From 5f5d05bb55ff299a3bb64d11d1d33681faf09162 Mon Sep 17 00:00:00 2001 From: Julie Stickler Date: Fri, 8 Apr 2022 15:14:41 -0400 Subject: [PATCH] OSSMDOC-463: Verify sidecar injection with Kiali. --- images/ossm-icon-missing-sidecar.png | Bin 0 -> 3774 bytes images/ossm-node-badge-missing-sidecar.svg | 119 ++++++++++++++++++ modules/ossm-automatic-sidecar-injection.adoc | 67 ++++++---- modules/ossm-kiali-viewing-logs.adoc | 10 +- modules/ossm-sidecar-injection-env-var.adoc | 9 +- modules/ossm-sidecar-validate-kiali.adoc | 31 +++++ modules/ossm-update-app-sidecar.adoc | 11 +- modules/ossm-vs-istio.adoc | 25 +++- .../prepare-to-deploy-applications-ossm.adoc | 19 ++- 9 files changed, 246 insertions(+), 45 deletions(-) create mode 100644 images/ossm-icon-missing-sidecar.png create mode 100644 images/ossm-node-badge-missing-sidecar.svg create mode 100644 modules/ossm-sidecar-validate-kiali.adoc diff --git a/images/ossm-icon-missing-sidecar.png b/images/ossm-icon-missing-sidecar.png new file mode 100644 index 0000000000000000000000000000000000000000..5d50229f181020af90af43e77e650905a1a3279a GIT binary patch literal 3774 zcmc&%`8$+R`ya9|gX)zfW6zSEjD0dl$`*<@`#NQ0o2=QhlOkgqOUPDsW+c1OSVn{p zV+~=Db(AgN$Di>1>3y#2dCqh0>s+0%>dgAqb z`%;G%2n04Y(ABmG%-x!OVVeGspMGb%yFRKs0-JRIzED&T{3oVR&(I7USmEO0!8!6t zk7a@KB^p-rAo+$LjZ`y}I2<~9!xbbw&k;$G+jjkavq+pF-9~SDDCj)U$CCm% zVN+^KI1Tc+0^_sxKGGG6;bTt#e=4|!@wxAgQ&vmH_7B_cF%$ zG;!;=1X+D$F(}@Ja9m4{x(AJishC|3gAKEjwYKyOaX5Tk7a7ZCyWR1;SSowG| zSImSAF}y8qZKYDL7S6=X{L=6Seke~pPU_l~E0?kjWBoQJD*k-w?OmEe6zJ*b;NwZ- zr4<#7#>U1!u*gY!UoG3&)}SlMiOR_0VqqyMDF+0CURGB2eM!mU@7Wfz?|k^VriX`z zsf~@srs`zne-(cXFZq0LR1hiHu%I{BGNAdx?NpvlXDY$EpryldB;wekVNFU}M&*@1 zUD<{O@}GGp>cVfI9Gx(q(7njYW)v>Vo;nM)ZX(a*>I!M!xkEQiB4Ht3NTklAN1P&; z69{4E=H`7a3h`gUzv`D;NyS=7#v~;4Uo6zZ!lH9_mJjMV(;3Gf7T?;cu{qU1pOTUS z?BtqV;3Dnm9#Iw)k#I!}E{X2$>w7YI4CS1D5pf3dEBqz%vQTRQW*ud;FXoVn4?{ZpV4X z#>6bnwY?CRmezA|5uv80rb{<4GSYK$5=y@(`rb_9aC1trs0`om?VBmEUI7@4pN@`> zrx%E2T-%F3LQ+y5o%CbgA)%p;PELDGfmQ8NS4!)F$$!i+)@Dg1zuD5f{dHCg6!Aqw zlcIzxMGLOmh^Ym~NK`kCI@FrKZXPLk>NO=avqlx|O%0dR_toU)t3r(cdlphr;gXP$ z*xBEInLl^duWe$&W@c{Aartu8=&0E&=^XQSt7(3R{ILeia6_O~hWA`Mpp)B~JweIq z7jT>u3*}COB5%wH(_#e*dY+GzP`TrRi;nP z&4Tjs9C>+pplE1sFMl`-0)YVRgL&%Lw%h(d$Yk>ORc~)^Aie07aARX*yIu7Bo&Eic z%F4=CZNaxZ=UP?Y!RXl_(HIQxRVLbB!v(J!8<~IZWW)O(FE*@!vK*e z__p8F&Q8mvg`1oE@y7gTKW0Zq$E;gO&dSQlg^dmM1sl+}A3x&b;~6L$e*xeKOGq%z z&d!1&)B}DC2ntdqaY{#3RY`AdZoV_CFn#o>)CWROPw(R9=0w6h%Th&^PK4tXvE8lT zr!7qQ+QZ!Lbo-T^u*eT4E8(GIhHMk1!91%AT`*scsDuQ@)6>&8Sy|w8VUTCOh`@dskdV0EmhQ{^Y6h3qN22n9FVKFg!Mn=X9l-bx^=i%ku{R*9D z37ShzW*Njl*{;dh+;(&nd~9u9XjbuUe7r>FZF+h%E3a}V9)Bs0jsK2^hg4!>qW9_F zUBO{KZtet9lh@MGYC&(#E##ZDw5aZGxRSCm_#}iL*;HH0E@qtjO?+}@Cb{H(W>IxD z7>Jlk;En(bD{I~Jbu$Y~%a24X7VFrbCMqr|2{$xk@kOEP+{Yz*09r|sZ3lr4D3n6L z&vxrRI0d4aSkr#YB$UeF)qZp%2ZOma{dH(4wz*kV#`g1jzr;|iK^9KUdW}s*dE7Kw zZ^B8co)dX?{JvvII^UC}uFk@$k4xb6`cpo>=-AkLAdLuI&f%xK^ycDMHxJgwlI01B zNlDpg^nZ{Z9xlo9hZELbbpVrn*l=@mQz$X3n8P(Tx|EcZyu<+=D-Vy&H)jtd(NcZ!kz*9zrGHRkE8wk{oT`T>zrtr z!Qe+;9q0c}2K)OHu#JsR(veS|aP6ro-MS@@LZSROf5=m`O3eC|z2-Dr+KkShA~65P zhN_hh!NDH2OP0JZ#(RTyfpns}4e(fR?*$S-5z)~!Kx%aj4jPsn4{QF(JsxYXufM!m z$ZLjL9n$mnSFW$GzksRy9_z~DgBQmK>scB>3Lidv0D<&hLt^UcM2lm-%Xh4Ox% z8fPoeQc+R;=m>{}o$l%bOtr8-42z45q_ilV zmSShNJI<@kTWoD@pLlu_aL-79hvHqU7Jq5byTU@M3%k2}6c$UVT_rW6#Oy+L^?poE zb&ZezXJllAj2umsQ)~@K96I8wXvj6rgptI;5w_KvH4I3%USN)hvNAC^91d`SgQsUT z$`(*5T|K?R@^S_=8r|2|*BLM$8u#Oe6(|Bg5g-e1Fqou`$(p6VyGv_iGThsH$C(l| z-T3sA&k`Xb_3<^GS94BvT)xfMDHO`%*F+bEylM1Z5jjOgd^5@{4uNN*y@5^=pd@)&L&+lym$c4YZ z{|<%nkU!ia>6+{vYirB|M>Q7f_boW!_e|u+k2ep0&wjk+06RZb9Lm>ZwzRaYqGU?_ zw+PiDiDp_~U&kA-w6(RRW@IS8`}dMmW}Fw*)C2`Y@!;UV!O1BK;1;L7<$j%fYs^1~ zJfN0g?-V}YnmAS$h{m4ZZ?pK6T#-ChT0Ae0svZKb>hH|D+B1jU)hLn zBO{SxWhTPX(yRbNt+4LnwOfxKKCB=a-M`QK%@YuQP8pkcS7L_a*)b)MTu}xnP0GQ+ za{v()Fp!Xt&<>!r-9T&?7Z+=BIKm1sv(C8}+|$$3NhC4@F8c-sx?6+x9lX3=TQ_+M zs;i%*W;{?MQXYgf&|?F*6=eMcL;lfF>bRhI?TxJtk&wPVv4jQj6~yv&%u4$iGnnAG zOan488RkH5+q1sS%}owHIV>zLzJ$Z!;**l_8#NtZ&_!AFb7_f#lQT9pmd?t`>UN3Q z#e!eY&cEV?!V66WWMsevA$yE~lmgI>%_GM|M=xL}?R4DTB}d1`9z1+Vn|ha~#4I6C zJ)oONMD`&E=t)L~h89hvvEm>Ogoj6RR1~$xd^;Zp2ggNnm6V8P$l9l>xO=`INP_CrVH#eqw?%H8s_$Jwz4cK+KSSb613ci3tt};O5rW?(dduAt>}us$C2E z9%I^&U(qiaotbsx=%GBhwW7mAh`^DJnESa6xyekm9&KLy>>zVnbM2?zg8ezqlzoLw ztN7`&RWARxmRed`Z-^`84ZEV*>}k8@bVh!cSSLqazw~vyQ<|LQ#LO0c1s3d6io3=a z9`+k3T)i{)6-#Id?#r7{1bAUtX%F^(qMm2@+$bObIxsM>@bjm_ob6(MgAKol(J203 z!RK$^yG+f-lhP!&!qwc|#NnMDjL`ds5G9Ya9?r%DZ<0gZY}gTU%Rq4Ggpm z3>fd-yC;xI>}^R3=S8@`@F^|5HkosxbZCtscTK?yT1NJ?uNs4IDJcouyvYm{Q=h`l z)Owuce+_28EH4*VQBz9^_|wN#=zY0cBJ4Ns6}Xb=|MX_`|Gt-fKL@Sv^zk;WZIXct OD9Aw1ShpJP5cPleQyp>u literal 0 HcmV?d00001 diff --git a/images/ossm-node-badge-missing-sidecar.svg b/images/ossm-node-badge-missing-sidecar.svg new file mode 100644 index 000000000000..f8005984ad1e --- /dev/null +++ b/images/ossm-node-badge-missing-sidecar.svg @@ -0,0 +1,119 @@ + + + + + + + + + + + + image/svg+xml + + + + + + + + + + + + + + + + + + + + + diff --git a/modules/ossm-automatic-sidecar-injection.adoc b/modules/ossm-automatic-sidecar-injection.adoc index f407d6e604bc..5b418907a206 100644 --- a/modules/ossm-automatic-sidecar-injection.adoc +++ b/modules/ossm-automatic-sidecar-injection.adoc @@ -7,63 +7,76 @@ [id="ossm-automatic-sidecar-injection_{context}"] = Enabling automatic sidecar injection -When deploying an application, you must opt-in to injection by setting the `sidecar.istio.io/inject` annotation to `"true"`. Opting in ensures that the sidecar injection does not interfere with other {product-title} features such as builder pods used by numerous frameworks within the {product-title} ecosystem. +When deploying an application, you must opt-in to injection by configuring the annotation `sidecar.istio.io/inject` in `spec.template.metadata.annotations` to `true` in the `deployment` object. Opting in ensures that the sidecar injection does not interfere with other {product-title} features such as builder pods used by numerous frameworks within the {product-title} ecosystem. .Prerequisites -* Identify the deployments for which you want to enable automatic sidecar injection. +* Identify the namespaces that are part of your service mesh and the deployments that need automatic sidecar injection. .Procedure -. Open the application's deployment configuration YAML file in an editor. To find a deployment use the `oc get` command. For example, for an app called `sleep` in the `sleep` namespace, use the following command to see the resource in YAML format. +. To find your deployments use the `oc get` command. + [source,terminal] ---- -$ oc get deployment sleep -o yaml +$ oc get deployment -n ---- ++ +For example, to view the deployment file for the 'ratings-v1' microservice in the `bookinfo` namespace, use the following command to see the resource in YAML format. ++ +[source,terminal] +---- +oc get deployment -n bookinfo ratings-v1 -o yaml +---- ++ +. Open the application's deployment configuration YAML file in an editor. -. Add `sidecar.istio.io/inject` to the configuration YAML with a value of `"true"` in the `spec.template.metadata.annotations.sidecar.istio/inject` field. See the following example for an app called `sleep`. +. Add `spec.template.metadata.annotations.sidecar.istio/inject` to your Deployment YAML and set `sidecar.istio.io/inject` to `true` as shown in the following example. + -.Sleep test application example sleep.yaml +.Example snippet from bookinfo deployment-ratings-v1.yaml [source,yaml] ---- apiVersion: apps/v1 kind: Deployment metadata: + name: ratings-v1 + namespace: bookinfo labels: - app: sleep - name: sleep + app: ratings + version: v1 spec: - replicas: 1 - selector: - matchLabels: - app: sleep template: metadata: annotations: - sidecar.istio.io/inject: "true" - labels: - app: sleep - spec: - containers: - - name: sleep - image: curlimages/curl - command: ["/bin/sleep","3650d"] - imagePullPolicy: IfNotPresent + sidecar.istio.io/inject: 'true' ---- ++ +. Save the Deployment configuration file. -. Save the configuration file. - -. Add the file back to the project that contains your app. In this example, `sleep` is the name of the project that contains the `sleep` app and `sleep.yaml` is the file you edited. +. Add the file back to the project that contains your app. + [source,terminal] ---- -$ oc apply -n sleep -f sleep.yaml +$ oc apply -n -f deployment.yaml ---- - ++ +In this example, `bookinfo` is the name of the project that contains the `ratings-v1` app and `deployment-ratings-v1.yaml` is the file you edited. ++ +[source,terminal] +---- +$ oc apply -n bookinfo -f deployment-ratings-v1.yaml +---- ++ . To verify that the resource uploaded successfully, run the following command. + [source,terminal] ---- -$ oc get deployment sleep -o yaml +$ oc get deployment -n -o yaml +---- ++ +For example, ++ +[source,terminal] +---- +$ oc get deployment -n bookinfo ratings-v1 -o yaml ---- diff --git a/modules/ossm-kiali-viewing-logs.adoc b/modules/ossm-kiali-viewing-logs.adoc index 136575f9281e..c699176b9044 100644 --- a/modules/ossm-kiali-viewing-logs.adoc +++ b/modules/ossm-kiali-viewing-logs.adoc @@ -11,13 +11,12 @@ You can view logs for your workloads in the Kiali console. The *Workload Detail To change the logging level on the logs displayed in Kiali, you change the logging configuration for the workload or the proxy. -// TODO once released - Kiali can also add-in trace span information to help identify important traces based on associated logging. More powerful features include substring or regex Show/Hide, full-screen, and the ability to set proxy log level without a pod restart. - .Prerequisites * Service Mesh installed and configured. * Kiali installed and configured. * The address for the Kiali console. +* Application or Bookinfo sample application added to the mesh. .Procedure @@ -31,6 +30,11 @@ The Kiali Overview page displays namespaces that have been added to the mesh tha . On the *Workloads* page, select the project from the *Namespace* menu. -. If necessary, use the filter to find the workload whose logs you want to view. Click the workload *Name*. +. If necessary, use the filter to find the workload whose logs you want to view. Click the workload *Name*. For example, click *ratings-v1*. . On the *Workload Details* page, click the *Logs* tab to view the logs for the workload. + +[TIP] +==== +If you do not see any log entries, you may need to adjust either the Time Range or the Refresh interval. +==== diff --git a/modules/ossm-sidecar-injection-env-var.adoc b/modules/ossm-sidecar-injection-env-var.adoc index 26e272c960df..e2f2131efe87 100644 --- a/modules/ossm-sidecar-injection-env-var.adoc +++ b/modules/ossm-sidecar-injection-env-var.adoc @@ -3,10 +3,13 @@ // * service_mesh/v1x/prepare-to-deploy-applications-ossm.adoc // * service_mesh/v2x/prepare-to-deploy-applications-ossm.adoc +:_content-type: CONCEPT [id="ossm-sidecar-injection-env-var_{context}"] -= Setting environment variables on the proxy in applications through annotations += Setting proxy environment variables through annotations -You can set environment variables on the sidecar proxy for applications by adding pod annotations in the deployment in the `injection-template.yaml` file. The environment variables are injected to the sidecar. +Configuration for the Envoy sidecar proxies is managed by the `ServiceMeshControlPlane`. + +You can set environment variables for the sidecar proxy for applications by adding pod annotations to the deployment in the `injection-template.yaml` file. The environment variables are injected to the sidecar. .Example injection-template.yaml [source,yaml] @@ -28,5 +31,5 @@ spec: [WARNING] ==== -`maistra.io/` labels and annotations should never be included in user-created resources, because they indicate that the resources are generated and managed by the Operator. If you are copying content from an Operator-generated resource when creating your own resources, do not include labels or annotations that start with `maistra.io/` or your resource will be overwritten or deleted by the Operator during the next reconciliation. +You should never include `maistra.io/` labels and annotations when creating your own custom resources. These labels and annotations indicate that the resources are generated and managed by the Operator. If you are copying content from an Operator-generated resource when creating your own resources, do not include labels or annotations that start with `maistra.io/`. Resources that include these labels or annotations will be overwritten or deleted by the Operator during the next reconciliation. ==== diff --git a/modules/ossm-sidecar-validate-kiali.adoc b/modules/ossm-sidecar-validate-kiali.adoc new file mode 100644 index 000000000000..b6d7fb780cd7 --- /dev/null +++ b/modules/ossm-sidecar-validate-kiali.adoc @@ -0,0 +1,31 @@ +//// +This module included in the following assemblies: +* service_mesh/v2x/prepare-to-deploy-applications-ossm.adoc +//// +:_content-type: CONCEPT +[id="ossm-validating-sidecar_{context}"] += Validating sidecar injection + +The Kiali console offers several ways to validate whether or not your applications, services, and workloads have a sidecar proxy. + +.Missing sidecar badge +image::ossm-node-badge-missing-sidecar.svg[Missing Sidecar badge] + +The *Graph* page displays a node badge indicating a *Missing Sidecar* on the following graphs: + +* App graph +* Versioned app graph +* Workload graph + +.Missing sidecar icon +image::ossm-icon-missing-sidecar.png[Missing Sidecar icon] + +The *Applications* page displays a *Missing Sidecar* icon in the *Details* column for any applications in a namespace that do not have a sidecar. + +The *Workloads* page displays a *Missing Sidecar* icon in the *Details* column for any applications in a namespace that do not have a sidecar. + +The *Services* page displays a *Missing Sidecar* icon in the *Details* column for any applications in a namespace that do not have a sidecar. When there are multiple versions of a service, you use the *Service Details* page to view *Missing Sidecar* icons. + +The *Workload Details* page has a special unified *Logs* tab that lets you view and correlate application and proxy logs. You can view the Envoy logs as another way to validate sidecar injection for your application workloads. + +The *Workload Details* page also has an *Envoy* tab for any workload that is an Envoy proxy or has been injected with an Envoy proxy. This tab displays a built-in Envoy dashboard that includes subtabs for *Clusters*, *Listeners*, *Routes*, *Bootstrap*, *Config*, and *Metrics*. diff --git a/modules/ossm-update-app-sidecar.adoc b/modules/ossm-update-app-sidecar.adoc index 2c7e5fa67604..2863f7a47119 100644 --- a/modules/ossm-update-app-sidecar.adoc +++ b/modules/ossm-update-app-sidecar.adoc @@ -1,12 +1,13 @@ // Module included in the following assemblies: // -// * service_mesh/v1x/installing-ossm.adoc -// * service_mesh/v2x/installing-ossm.adoc +// * service_mesh/v1x/prepare-to-deploy-applications-ossm.adoc +// * service_mesh/v2x/prepare-to-deploy-applications-ossm.adoc +:_content-type: PROCEDURE [id="ossm-update-app-sidecar_{context}"] -= Updating your application pods += Updating sidecar proxies -If you selected the Automatic Approval Strategy when you were installing your Operators, then the Operators update the control plane automatically but not your applications. Existing applications continue to be part of the mesh and function accordingly. The application administrator must restart applications to upgrade the sidecar. +In order to update the configuration for sidecar proxies the application administrator must restart the application pods. If your deployment uses automatic sidecar injection, you can update the pod template in the deployment by adding or modifying an annotation. Run the following command to redeploy the pods: @@ -15,4 +16,4 @@ If your deployment uses automatic sidecar injection, you can update the pod temp $ oc patch deployment/ -p '{"spec":{"template":{"metadata":{"annotations":{"kubectl.kubernetes.io/restartedAt": "'`date -Iseconds`'"}}}}}' ---- -If your deployment does not use automatic sidecar injection, you must manually update the sidecars by modifying the sidecar container image specified in the deployment or pod. +If your deployment does not use automatic sidecar injection, you must manually update the sidecars by modifying the sidecar container image specified in the deployment or pod, and then restart the pods. diff --git a/modules/ossm-vs-istio.adoc b/modules/ossm-vs-istio.adoc index 0ec0a13e6861..f8f8c4b3b928 100644 --- a/modules/ossm-vs-istio.adoc +++ b/modules/ossm-vs-istio.adoc @@ -2,7 +2,7 @@ Module included in the following assemblies: -service_mesh/v2x/ossm-vs-community.adoc //// - +:_content-type: CONCEPT [id="ossm-vs-istio_{context}"] = Differences between Istio and {SMProductName} @@ -29,6 +29,29 @@ The upstream Istio community installation automatically injects the sidecar into {SMProductName} does not automatically inject the sidecar to any pods, but requires you to opt in to injection using an annotation without labeling projects. This method requires fewer privileges and does not conflict with other OpenShift capabilities such as builder pods. To enable automatic injection you specify the `sidecar.istio.io/inject` annotation as described in the Automatic sidecar injection section. +//// +Hold for OSSMDOC-547 as to what we support +.Sidecar injection label and annotation settings +[options="header"] +[cols="a, a, a"] +|=== +| +|Upstream Istio +|{ProductName} + +|Namespace Label +|supports "enabled" and "disabled" +|not supported + +|Pod Label +|supports "true" and "false" +|not supported + +|Pod Annotation +|supports "false" only +|"true" and "false" +|=== +//// [id="ossm-rbac_{context}"] == Istio Role Based Access Control features diff --git a/service_mesh/v2x/prepare-to-deploy-applications-ossm.adoc b/service_mesh/v2x/prepare-to-deploy-applications-ossm.adoc index c6df8d406a8d..0b004030389e 100644 --- a/service_mesh/v2x/prepare-to-deploy-applications-ossm.adoc +++ b/service_mesh/v2x/prepare-to-deploy-applications-ossm.adoc @@ -6,25 +6,32 @@ include::_attributes/common-attributes.adoc[] toc::[] -After adding your services to a mesh, enable automatic sidecar injection in the deployment resource for your application. You must enable automatic sidecar injection for each deployment. +After adding the namespaces that contain your services to your mesh, the next step is to enable automatic sidecar injection in the Deployment resource for your application. You must enable automatic sidecar injection for each deployment. -If you have installed the Bookinfo sample application, the application was deployed and the sidecars were injected. If you are using your own project and service, deploy your applications on {product-title}. For more information, see xref:../../applications/deployments/what-deployments-are.html[Understanding Deployment and DeploymentConfig objects]. +If you have installed the Bookinfo sample application, the application was deployed and the sidecars were injected as part of the installation procedure. If you are using your own project and service, deploy your applications on {product-title}. For more information, see the {product-title} documentation, xref:../../applications/deployments/what-deployments-are.html[Understanding Deployment and DeploymentConfig objects]. == Prerequisites -* xref:../../service_mesh/v2x/installing-ossm.adoc#installing-ossm[Adding services to a service mesh] -* A deployment resource for your project +* xref:../../service_mesh/v2x/ossm-create-mesh.adoc#ossm-tutorial-bookinfo-overview_ossm-create-mesh[Services deployed to the mesh], for example the Bookinfo sample application. + +* A Deployment resource file. include::modules/ossm-automatic-sidecar-injection.adoc[leveloffset=+1] -include::modules/ossm-update-app-sidecar.adoc[leveloffset=+1] +include::modules/ossm-sidecar-validate-kiali.adoc[leveloffset=+1] + +For information about enabling Envoy access logs, see the xref:../../service_mesh/v2x/ossm-troubleshooting-istio.adoc#enabling-envoy-access-logs[Troubleshooting] section. + +For information about viewing Envoy logs, see xref:../../service_mesh/v2x/ossm-observability.adoc#ossm-viewing-logs_observability[Viewing logs in the Kiali console] include::modules/ossm-sidecar-injection-env-var.adoc[leveloffset=+1] +include::modules/ossm-update-app-sidecar.adoc[leveloffset=+1] + == Next steps Configure {SMProductName} features for your environment. * xref:../../service_mesh/v2x/ossm-security.adoc#ossm-security[Security] * xref:../../service_mesh/v2x/ossm-traffic-manage.adoc#ossm-routing-traffic[Traffic management] -* xref:../../service_mesh/v2x/ossm-observability.adoc#ossm-observability[Metrics and traces] +* xref:../../service_mesh/v2x/ossm-observability.adoc#ossm-observability[Metrics, logs, and traces]