Deploy OTel Container Insights with Helm

To add the Helm repository

1. Run the following command to add the repository.

   helm repo add aws-observability \
     https://aws-observability.github.io/helm-charts

2. Update the repository to get the latest chart versions.

   helm repo update

To create the IAM role for the CloudWatch agent

1. Retrieve the OIDC issuer URL for your cluster. Replace cluster-name with the name of your Amazon EKS cluster.

   aws eks describe-cluster \
     --name cluster-name \
     --query "cluster.identity.oidc.issuer" \
     --output text

2. Create the IAM role with a trust policy for IRSA. Replace account-id with your AWS account ID and oidc-id with the OIDC provider ID from the preceding step (the portion after https://oidc.eks.region.amazonaws.com/id/).

   aws iam create-role \
     --role-name EKS-CW-Observability-Role \
     --assume-role-policy-document '{
       "Version": "2012-10-17",
       "Statement": [{
         "Effect": "Allow",
         "Principal": {
           "Federated": "arn:aws:iam::account-id:oidc-provider/oidc.eks.region.amazonaws.com/id/oidc-id"
         },
         "Action": "sts:AssumeRoleWithWebIdentity",
         "Condition": {
           "StringEquals": {
             "oidc.eks.region.amazonaws.com/id/oidc-id:sub": "system:serviceaccount:amazon-cloudwatch:cloudwatch-agent"
           }
         }
       }]
     }'

3. Attach the CloudWatchAgentServerPolicy managed policy to the role.

   aws iam attach-role-policy \
     --role-name EKS-CW-Observability-Role \
     --policy-arn arn:aws:iam::aws:policy/CloudWatchAgentServerPolicy

To install the Helm chart

• Run the following command. Replace cluster-name with the name of your Amazon EKS cluster, region with your AWS Region, and account-id with your AWS account ID.

  helm install amazon-cloudwatch-observability \
    aws-observability/amazon-cloudwatch-observability \
    --namespace amazon-cloudwatch \
    --create-namespace \
    --set clusterName=cluster-name \
    --set region=region \
    --set agent.serviceAccount.name=cloudwatch-agent \
    --set "agent.serviceAccount.annotations.eks\\.amazonaws\\.com/role-arn=arn:aws:iam::account-id:role/EKS-CW-Observability-Role" \
    --set otelContainerInsights.enabled=true

  Important

  The otelContainerInsights.enabled parameter is required. OTel Container Insights is not enabled by default.

To verify the Helm installation

1. Verify that the Helm release status shows deployed.

   helm list -n amazon-cloudwatch

2. Confirm that the operator pod is running.

   kubectl get pods -n amazon-cloudwatch -l app.kubernetes.io/name=amazon-cloudwatch-observability

3. Confirm that the CloudWatch agent pods are running on all nodes.

   kubectl get pods -n amazon-cloudwatch -l app.kubernetes.io/name=cloudwatch-agent

   All agent pods must show Running status.

To configure cert-manager integration

1. Verify that cert-manager is installed in your cluster.

   kubectl get pods -n cert-manager

2. Install the Helm chart with cert-manager enabled. Replace cluster-name with the name of your Amazon EKS cluster, region with your AWS Region, and account-id with your AWS account ID.

   helm install amazon-cloudwatch-observability \
     aws-observability/amazon-cloudwatch-observability \
     --namespace amazon-cloudwatch \
     --create-namespace \
     --set clusterName=cluster-name \
     --set region=region \
     --set agent.serviceAccount.name=cloudwatch-agent \
     --set "agent.serviceAccount.annotations.eks\\.amazonaws\\.com/role-arn=arn:aws:iam::account-id:role/EKS-CW-Observability-Role" \
     --set otelContainerInsights.enabled=true \
     --set admissionWebhooks.certManager.enabled=true

To upgrade the Helm chart

1. Update the Helm repository to get the latest chart versions.

   helm repo update

2. Run the upgrade command with your desired values. Replace cluster-name with the name of your Amazon EKS cluster, region with your AWS Region, and account-id with your AWS account ID.

   helm upgrade amazon-cloudwatch-observability \
     aws-observability/amazon-cloudwatch-observability \
     --namespace amazon-cloudwatch \
     --set clusterName=cluster-name \
     --set region=region \
     --set agent.serviceAccount.name=cloudwatch-agent \
     --set "agent.serviceAccount.annotations.eks\\.amazonaws\\.com/role-arn=arn:aws:iam::account-id:role/EKS-CW-Observability-Role" \
     --set otelContainerInsights.enabled=true

3. Verify that the upgrade completed successfully.

   helm list -n amazon-cloudwatch

   The revision number must increment and the status must show deployed.

To uninstall the Helm chart

1. Run the following command to uninstall the release.

   helm uninstall amazon-cloudwatch-observability \
     --namespace amazon-cloudwatch

2. Optionally, delete the namespace if it is no longer needed.

   kubectl delete namespace amazon-cloudwatch

To check metrics in CloudWatch

1. Open the CloudWatch console at https://console.aws.amazon.com/cloudwatch/.

2. In the navigation pane, choose Container Insights.

3. Verify that your cluster appears in the cluster list and that infrastructure metrics are populating.