STAC-4766 aws-eks kubernetes services

Dockerfiles/manifests/README.md

@@ -2,7 +2,7 @@
 
 ### Cluster creation
 
-If you want to create a cluster using AWS EKS please follow the `manifests/aws/tf/Readme.md` on how to spin that up with Terraform.
+If you want to create a cluster using AWS EKS please follow [this Readme](aws-eks/tf-cluster/README.md) on how to spin that up with Terraform.
 
 ### Configure RBAC 
 
@@ -11,7 +11,7 @@ If your Kubernetes has role-based access control (RBAC) enabled, configure RBAC
 Create the appropriate ClusterRole, ServiceAccount, and ClusterRoleBinding:
 
 ```
-kubectl create -f stackstate-serviceaccount.yaml
+kubectl apply -f stackstate-serviceaccount.yaml
 ```
 
 ### Enable Kubernetes state
@@ -28,12 +28,10 @@ kubectl apply -f <NAME_OF_THE_KUBE_STATE_MANIFESTS_FOLDER>
 
 Before deploying the agent there are few configuration settings to take care of, open the `stackstate-agent.yaml` and:
 
-* replace `<STACKSTATE_BACKEND_IP>` with your Stackstate backend IP
-* if you want to collect only containers information (and no processes) remove the env variable `DD_PROCESS_AGENT_ENABLED`
-* if you want to disable connections gathering remove the env variable `DD_CONNECTIONS_CHECK` (or set it to `false`)
+* replace `<STACKSTATE_BACKEND_URL>` with your StackState backend URL
 
 Now you can deploy the DaemonSet with the following command:
 
 ```
-kubectl create -f stackstate-agent.yaml
+kubectl apply -f stackstate-agent.yaml
 ```

Dockerfiles/manifests/aws-eks/.gitignore

@@ -0,0 +1,2 @@
+eks_rsa*
+eks.deploy

Dockerfiles/manifests/aws-eks/k8s/connection_test/pod-to-service-cluster-ip-2.yaml

@@ -0,0 +1,42 @@
+apiVersion: v1
+kind: Pod
+metadata:
+  name: pod-server-2
+  labels:
+    type: server-2
+spec:
+  containers:
+    - image: itsthenetwork/alpine-ncat
+      name: server-2
+      command: ["/bin/bash", "-c", "ncat -vv --broker --listen -p 123 > /dev/null"]
+      ports:
+        - containerPort: 123
+  nodeSelector:
+    failure-domain.beta.kubernetes.io/zone: us-east-1a
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: pod-service-2
+  labels:
+    type: service-2
+spec:
+  type: ClusterIP
+  ports:
+    - port: 654
+      protocol: TCP
+      targetPort: 123
+  selector:
+    type: server-2
+---
+apiVersion: v1
+kind: Pod
+metadata:
+  name: pod-client-2
+spec:
+  containers:
+    - image: jgkamat/netcat
+      name: client-2
+      command: ["/bin/bash", "-c", "yes | nc -vv pod-service-2 654"]
+  nodeSelector:
+    failure-domain.beta.kubernetes.io/zone: us-east-1b

Dockerfiles/manifests/aws-eks/k8s/connection_test/pod-to-service-cluster-ip.yaml

@@ -0,0 +1,42 @@
+apiVersion: v1
+kind: Pod
+metadata:
+  name: pod-server
+  labels:
+    type: server
+spec:
+  containers:
+    - image: itsthenetwork/alpine-ncat
+      name: server
+      command: ["/bin/bash", "-c", "ncat -vv --broker --listen -p 123 > /dev/null"]
+      ports:
+        - containerPort: 123
+  nodeSelector:
+    failure-domain.beta.kubernetes.io/zone: us-east-1a
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: pod-service
+  labels:
+    type: service
+spec:
+  type: ClusterIP
+  ports:
+    - port: 321
+      protocol: TCP
+      targetPort: 123
+  selector:
+    type: server
+---
+apiVersion: v1
+kind: Pod
+metadata:
+  name: pod-client
+spec:
+  containers:
+    - image: jgkamat/netcat
+      name: client
+      command: ["/bin/bash", "-c", "yes | nc -vv pod-service 321"]
+  nodeSelector:
+    failure-domain.beta.kubernetes.io/zone: us-east-1b

Dockerfiles/manifests/aws-eks/k8s/connection_test/tcptracer-bpf-nettop.yaml

@@ -0,0 +1,60 @@
+apiVersion: apps/v1
+kind: DaemonSet
+metadata:
+  name: tcptracer-bpf-nettop
+spec:
+  selector:
+    matchLabels:
+      app: tcptracer-bpf-nettop
+  template:
+    metadata:
+      labels:
+        app: tcptracer-bpf-nettop
+      name: tcptracer-bpf-nettop
+    spec:
+      serviceAccountName: stackstate-agent
+      containers:
+      - image: stackstate/tcptracer-bpf-nettop:latest
+        imagePullPolicy: Always
+        name: stackstate-agent
+        securityContext:
+          privileged: true
+        resources:
+          requests:
+            memory: "256Mi"
+            cpu: "200m"
+          limits:
+            memory: "256Mi"
+            cpu: "200m"
+        volumeMounts:
+          - name: sys-kernel-debug
+            mountPath: /sys/kernel/debug
+          - name: dockersocket
+            mountPath: /var/run/docker.sock
+          - name: procdir
+            mountPath: /host/proc
+            readOnly: true
+          - name: passwd
+            mountPath: /etc/passwd
+            readOnly: true
+          - name: cgroups
+            mountPath: /host/sys/fs/cgroup
+            readOnly: true
+      hostNetwork: true
+      hostPID: true
+      volumes:
+        - hostPath:
+            path: /sys/kernel/debug
+          name: sys-kernel-debug
+        - hostPath:
+            path: /var/run/docker.sock
+          name: dockersocket
+        - hostPath:
+            path: /proc
+          name: procdir
+        - hostPath:
+            path: /etc/passwd
+          name: passwd
+        - hostPath:
+            path: /sys/fs/cgroup
+          name: cgroups

Dockerfiles/manifests/aws/tf/060_eks_workernodes_scaling_group.tf → Dockerfiles/manifests/aws-eks/tf-cluster/060_eks_workernodes_scaling_group.tf

@@ -47,6 +47,11 @@ systemctl restart kubelet
 USERDATA
 }
 
+resource "aws_key_pair" "eks-key-pair" {
+  key_name   = "eks-deployer-${local.cluster_name}"
+  public_key = "${file("./eks_rsa.pub")}"
+}
+
 resource "aws_launch_configuration" "eks-launch-configuration" {
   associate_public_ip_address = true
   iam_instance_profile        = "${aws_iam_instance_profile.eks-node-instance-profile.name}"
@@ -55,7 +60,7 @@ resource "aws_launch_configuration" "eks-launch-configuration" {
   name_prefix                 = "eks-${local.cluster_name}"
   security_groups             = ["${aws_security_group.eks-nodes-sg.id}"]
   user_data_base64            = "${base64encode(local.eks-node-userdata)}"
-  key_name                    = "${var.SSH_KEY_PAIR}"
+  key_name                    = "${aws_key_pair.eks-key-pair.key_name}"
 
   lifecycle {
     create_before_destroy = true

Dockerfiles/manifests/aws/tf/Makefile → Dockerfiles/manifests/aws-eks/tf-cluster/Makefile

@@ -1,3 +1,12 @@
+plan:
+	terraform init && terraform plan -refresh=true -out eks.deploy
+
+apply:
+	terraform apply eks.deploy
+
+destroy:
+	terraform destroy
+
 kubeconfig:
 	terraform output kubeconfig > kubeconfig
 	export KUBECONFIG=$(PWD)/kubeconfig

Dockerfiles/manifests/aws-eks/tf-cluster/README.md

@@ -0,0 +1,90 @@
+# Kubernetes Cluster Setup
+
+Important: setup follows https://docs.aws.amazon.com/eks/latest/userguide/getting-started.html as of commit date.
+
+In order to start with cluster setup, you will need:
+
+- Terraform
+- AWS credentials with necessary rights
+- AWS authenticator for EKS, called heptio authenticator:
+  ```
+  curl -o <PATH>/heptio-authenticator-aws https://amazon-eks.s3-us-west-2.amazonaws.com/1.10.3/2018-06-05/bin/linux/amd64/heptio-authenticator-aws
+  curl -o <PATH>/heptio-authenticator-aws.md5 https://amazon-eks.s3-us-west-2.amazonaws.com/1.10.3/2018-06-05/bin/linux/amd64/heptio-authenticator-aws.md5
+  chmod +x <PATH>/heptio-authenticator-aws
+  ```
+
+## Variables
+
+Create an ssh key pair that will be used for login in to the EC2 instances:
+
+`ssh-keygen -f eks_rsa`
+
+Set the following environment variables:
+
+```
+export AWS_ACCESS_KEY_ID=
+export AWS_SECRET_ACCESS_KEY=
+export TF_VAR_AWS_SECRET_ACCESS_KEY=...
+export TF_VAR_AWS_ACCESS_KEY_ID=...
+export TF_VAR_AWS_REGION=us-east-1
+export TF_VAR_CLUSTER_NAME=...
+```
+
+## Deploy
+
+### Plan and apply
+
+First `make plan` to check what changes Terraform will apply, then deploy the changes with `make apply`.
+
+The operation takes around 20mins.
+
+### Output
+
+Output are:
+
+- `kubeconfig` file produced by `make kubeconfig`
+
+   You can `export KUBECONFIG=<PATH>/tf/kubeconfig` to let kubectl know how to connect to cluster.
+
+- policy that will allow worker nodes to join cluster `terraform output config-map-aws-auth`
+
+### Destroy
+
+As simple as `make destroy`.
+
+## Configure kubectl
+
+To allow kubectl to talk to your cluster `make kubeconfig` and follow the suggestion to export kube config path.
+
+Make sure nodes can register `make config-map-aws-auth` and wait for nodes to appear.
+
+Your are now ready.
+
+## Kubernetes dashboard
+
+Follow the documentation here https://docs.aws.amazon.com/eks/latest/userguide/dashboard-tutorial.html
+
+
+### Working with multiple clusters at a time
+
+By default, terraform creates one state file, that you will need to replace, if you are working with another cluster.
+To smoothly work with multiple clusters, you can use terraform workspaces (https://www.terraform.io/docs/state/workspaces.html)
+
+For example, you can create workspace by cluster name before provisioning cluster, and use `${terraform.workspace}`
+as a cluster name  `cluster_name= "${terraform.workspace}-cluster"`
+
+`terraform workspace new dummy`
+
+view workspaces:
+
+```
+terraform workspace list
+  default
+* dummy
+```
+
+select specific workplace:
+
+```
+terraform workspace select dummy
+```

Dockerfiles/manifests/aws/tf/main.tf → Dockerfiles/manifests/aws-eks/tf-cluster/main.tf

@@ -4,4 +4,23 @@
 //Associated VPC, Internet Gateway, Security Groups, and Subnets:
 //Operator managed networking resources for the EKS Cluster and worker node instances
 //Associated IAM Roles and Policies:
-//Operator managed access resources for EKS and worker node instances
+//Operator managed access resources for EKS and worker node instances
+
+
+// Remote state in S3 bucket
+terraform {
+  backend "s3" {
+    bucket = "lupulus-terraform-state"
+    key    = "aws-eks.terraform.tfstate"
+    region = "eu-west-1"
+  }
+}
+
+
+// AWS setup
+provider "aws" {
+  version = "~> 1.26"
+  region = "${var.AWS_REGION}"
+  //  secret_key = "${var.AWS_ACCESS_KEY_ID}"
+  //  access_key = "${var.AWS_SECRET_ACCESS_KEY}"
+}

Dockerfiles/manifests/aws/tf/variables.tf → Dockerfiles/manifests/aws-eks/tf-cluster/variables.tf

@@ -4,10 +4,6 @@ variable "AWS_REGION" {
   default = "us-east-1"
 }
 variable "CLUSTER_NAME" {}
-variable "SSH_KEY_PAIR" {
-  description = "This will be used to ssh into the EC2 instances (k8s runners)"
-  default = "EKS"
-}
 
 locals {
   availabilityzone = "${var.AWS_REGION}a"