How can I use the Amazon CloudWatch Observability add-on to monitor my Amazon EKS clusters?

Resolution

Note: If you receive errors when you run AWS Command Line Interface (AWS CLI) commands, then see Troubleshooting errors for the AWS CLI. Also, make sure that you use the most recent AWS CLI version.

Prerequisites:

• You have a functional Amazon EKS cluster with attached nodes in an AWS Region that supports CloudWatch Container Insights.
• You installed kubectl on your cluster.
• You installed the eksctl CLI on your machine.

Create an IAM role for the add-on

To create an AWS Identity and Access Management (IAM) OpenID Connect (OIDC) provider, run the following command:

eksctl utils associate-iam-oidc-provider --cluster my-cluster-name --approve

Note: Replace my-cluster-name with your cluster name. For more information, see Assign IAM roles to Kubernetes service accounts.

To create an IAM role with CloudWatchAgentServerPolicy attached, run the following command.

eksctl create iamserviceaccount \ 
  --name cloudwatch-agent \ 
  --namespace amazon-cloudwatch 
  --cluster my-cluster-name \ 
  --role-name AmazonCloudWatchObservabilityRole \ 
  --attach-policy-arn arn:aws:iam::aws:policy/CloudWatchAgentServerPolicy \ 
  --role-only \ 
  --approve

Note: Replace my-cluster-name with your cluster name. The preceding command also configures the agent service account to use OIDC to assume the role.

Install the add-on

To install the add-on, use the Amazon EKS console or the AWS CLI.

Amazon EKS console

Complete the following steps:

1. Open the Amazon EKS console.
2. In the navigation pane, choose Clusters.
3. Choose your cluster name, and then choose the Add-ons tab.
4. Choose Get more add-ons, and then choose Select add-ons.
5. In the Amazon EKS-addons section, select Amazon CloudWatch Observability, and then choose Next.
6. On the Configure selected add-ons settings page, select the Version that you want to use.
7. For Select IAM role, select AmazonCloudWatchObservabilityRole, and then choose Next.
8. On the Review and add page, choose Create.

AWS CLI

To install the add-on, run the following create-addon command:

aws eks create-addon --addon-name amazon-cloudwatch-observability --cluster-name my-cluster-name --service-account-role-arn arn:aws:iam::Account-ID:role/AmazonCloudWatchObservabilityRole

Note: Replace my-cluster-name with your cluster name and Account-ID with your AWS account ID.

After the installation completes, Amazon EKS creates an amazon-cloudwatch namespace in your cluster. The CloudWatch agent and Fluent Bit pods are also active in your cluster.

To view active pods, run the following command:

kubectl get pods -n amazon-cloudwatch

Example output:

NAME                                                              READY   STATUS    RESTARTS   AGE
amazon-cloudwatch-observability-controller-manager-6c685b4wsdbg   1/1     Running   0          16s
cloudwatch-agent-76bnd                                            1/1     Running   0          16s
cloudwatch-agent-nbdgm                                            1/1     Running   0          16s
fluent-bit-45wl4                                                  1/1     Running   0          16s
fluent-bit-rsfc7                                                  1/1     Running   0          16s

Deploy a sample application

If you don't have workloads on your cluster to collect metrics from, then deploy the following sample workload:

cat <<EOF >deployment.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: eks-cw-sample-app
  labels:
    app: eks-cw-sample-app
spec:
  replicas: 3
  selector:
    matchLabels:
      app: eks-cw-sample-app
  template:
    metadata:
      labels:
        app: eks-cw-sample-app
    spec:
      containers:
      - name: nginx
        image: public.ecr.aws/nginx/nginx:1.27
        ports:
        - name: http
          containerPort: 80
        imagePullPolicy: IfNotPresent
EOF

kubectl apply -f deployment.yaml

Use the preceding workload to verify that CloudWatch correctly collects your metrics.

Monitor clusters on the CloudWatch console

After you install Container Insights, view your metrics on the CloudWatch console.

You can also use AWS Fargate logging on your clusters.

Related information

Logging and monitoring on Amazon EKS