Proposal: Secure Management of Instana Agent Configuration from the Web Console
Currently, certain advanced Instana Agent configurations require modifying the configuration.yaml file directly on the server where the agent is installed. These configurations include, among others, process and service monitoring and other sensor- and agent-specific parameters.
IBM documentation identifies configuration.yaml as a key mechanism for configuring different Host Agent capabilities, including the definition of processes and services to be monitored.
In enterprise environments, particularly those supporting business-critical or regulated services, this operating model creates a significant dependency: the Observability team must request access to the server to perform changes that are strictly related to monitoring configuration.
In many cases, the servers are owned by different teams or customers, and Observability personnel should not have administrative privileges over the operating system. As a result, a simple monitoring adjustment may require access requests, change windows, coordination with multiple teams, and involvement from the server owner, significantly increasing the time required to implement basic monitoring changes.
Proposed Enhancement
We propose adding a centralized and secure configuration.yaml management capability to the Instana web console, allowing authorized administrators to manage supported Agent configuration parameters without requiring direct operating-system access to the monitored server.
The functionality should provide the ability to:
- View the current Agent configuration.
- Edit supported configuration.yaml parameters.
- Validate YAML syntax before applying changes.
- Remotely apply configuration changes to the Agent.
- Assign configurations to a specific host, Agent group, zone, or environment.
- Maintain configuration versioning and change history.
- Display configuration differences (diff) between versions.
- Roll back to a previous configuration.
- Record the user, date, time, and changes performed through an audit trail.
- Integrate with RBAC to control who can modify configurations.
- Maintain separation of duties between Observability administration and operating-system administration.
- Optionally provide an approval workflow for production environments.
IBM already provides capabilities related to Agent configuration management and Host Agent administration. This proposal would extend those capabilities toward a fully centralized configuration-management experience from the Instana web console.
Business and Operational Value
This capability would be particularly valuable for MSP and multi-customer environments, where a centralized Observability team manages agents installed across infrastructure owned and controlled by different organizations or departments.
The objective is not to provide administrative access to customer servers, but rather to separate infrastructure administration from monitoring administration.
Current model
Monitoring request → Server access request → YAML modification → Apply → Validation
Proposed model
Instana Administrator → Instana Web Console → RBAC/Audit → Configuration → Instana Agent
This would significantly reduce the time required to onboard new monitoring requirements or perform operational adjustments while maintaining the principles of least privilege, segregation of duties, traceability, and change control.
Example Use Case
A customer requests monitoring for a new process or service running on a production server. Today, the Observability team may need to coordinate with the server administrator to modify the Agent's configuration.yaml.
With the proposed capability, an authorized Instana administrator could perform the change directly from the Instana console:
Host → Agent → Configuration → Processes/Services → Validate → Apply
The change would be recorded in the audit trail and could be rolled back if required, without granting operating-system administrative access to the Observability operator.
Request to IBM
We believe this capability would provide significant value for Instana enterprise customers, managed services providers, and business-critical environments by accelerating Observability operations without compromising security, governance, or infrastructure access controls.
We would like IBM to consider introducing a centralized and secure configuration.yaml editor and management capability within the Instana web console, including RBAC, auditability, validation, versioning, and rollback capabilities.
This enhancement would help organizations reduce operational dependencies between Observability and infrastructure teams and enable faster response to basic monitoring requirements, particularly in environments where direct server access is restricted.
IBM References
- IBM Instana – Configuring Host Agents using the agent configuration file
- IBM Instana – Managing Host Agents
Recommended framing for IBM: position this as a “Centralized, Secure Agent Configuration Management” enhancement, rather than simply a request for “web-based YAML editing.” This emphasizes the enterprise value around RBAC, auditability, governance, least privilege, and MSP operations.
