Repository navigation
[monitoring] Improve multi-tenant log isolation, dashboard scoping, and VM monitoring #2194
Description
Description
Several gaps exist in the current monitoring stack for multi-tenant deployments. This issue tracks them together since they affect the same area.
1. No per-tenant log routing (CRITICAL)
monitoring-agents fluent-bit sends all container logs to vlogs-generic.<target>.svc (typically tenant-root).
Tenants that deploy their own monitoring stack get a VLogs instance (vlogs-generic.<tenant>.svc) but it receives no logs — everything goes to the parent tenant.
Current workaround: Manual patch of the fluent-bit ConfigMap with rewrite_tag + per-tenant OUTPUT blocks.
➡️ PR: #2195
2. Infrastructure metadata leaked in logs
kubernetes_node_name is exposed in log metadata, leaking node topology to end-users. Other sensitive fields: kubernetes_host, infrastructure labels.
➡️ PR: #2196
3. All tenants receive infrastructure dashboards
dashboards.list loads VictoriaMetrics, Hubble, LINSTOR, Flux, control-plane, and other infrastructure dashboards for every tenant, even though these are only relevant to the platform operator (tenant-root).
➡️ PR: #2197
4. Missing VM dashboard files
dashboards.list on main references vm/virtual-machines and vm/console-logs but the corresponding JSON files do not exist under dashboards/vm/.
➡️ PR: #2198
5. No KubeVirt VM metrics scraping
No network policy allows tenant vmagent to reach virt-handler on port 8443 for KubeVirt VM metrics.
➡️ PR: #2199
6. vmagent lacks additionalScrapeConfigs
The tenant VMAgent resource does not support additionalScrapeConfigs, preventing custom scrape targets.
➡️ PR: #2200
PR Summary
| # | PR | Scope | Component |
|---|---|---|---|
| 1 | #2195 | Per-tenant log routing in fluent-bit | monitoring-agents |
| 2 | #2196 | Strip infrastructure metadata from logs | monitoring-agents |
| 3 | #2197 | Scope infra dashboards to tenant-root only |
monitoring |
| 4 | #2198 | Add KubeVirt VM dashboards | monitoring |
| 5 | #2199 | Egress to virt-handler for VM metrics | tenant |
| 6 | #2200 | additionalScrapeConfigs support in vmagent |
monitoring |
All PRs are independent and can be reviewed/merged separately.
Environment
- Cozystack v1.0.0-rc.2
- Multi-tenant deployment with child tenants using monitoring
Activity
[tenant] Allow egress to virt-handler for VM metrics scraping (#2199)
[monitoring] Scope infrastructure dashboards to tenant-root only (#2197)
[monitoring] Add inlineScrapeConfig support to tenant vmagent (#2200)
fix(monitoring): strip infrastructure metadata from tenant logs
fix(monitoring): strip infrastructure metadata from tenant logs (#2196)
feat(monitoring): add KubeVirt VM dashboard (#2198)
feat(monitoring): auto-route tenant logs using namespace labels (#2195)