Skip to content

Commit ca434de

Browse files
mergify[bot]pkoutsovasilis
mergify[bot]
and
pkoutsovasilis
authored
[8.16](backport #5593) [helm] support using user-created serviceAccount and clusterRole (#5976)
* [helm] support using user-created serviceAccount and clusterRole (#5593) * feat: support using user-created serviceAccount and clusterRole * feat: add support for defining automountServiceAccountToken per preset * fix: add preset-wide annotations to serviceaccount, clusterrole, clusterrolebinding (cherry picked from commit 5ac225d) * fix: render helm chart examples --------- Co-authored-by: Panos Koutsovasilis <panos.koutsovasilis@elastic.co>
1 parent 3f07f2f commit ca434de

File tree

16 files changed

+1962
-83
lines changed

16 files changed

+1962
-83
lines changed

‎deploy/helm/elastic-agent/examples/fleet-managed/fleet-values.yaml

Lines changed: 29 additions & 25 deletions
Original file line numberDiff line numberDiff line change
@@ -9,31 +9,35 @@ agent:
99
mode: deployment
1010
securityContext:
1111
runAsUser: 0
12-
rules:
13-
# minimum cluster role ruleset required by agent
14-
- apiGroups: [ "" ]
15-
resources:
16-
- nodes
17-
- namespaces
18-
- pods
19-
verbs:
20-
- get
21-
- watch
22-
- list
23-
- apiGroups: [ "apps" ]
24-
resources:
25-
- replicasets
26-
verbs:
27-
- get
28-
- list
29-
- watch
30-
- apiGroups: [ "batch" ]
31-
resources:
32-
- jobs
33-
verbs:
34-
- get
35-
- list
36-
- watch
12+
serviceAccount:
13+
create: true
14+
clusterRole:
15+
create: true
16+
rules:
17+
# minimum cluster role ruleset required by agent
18+
- apiGroups: [ "" ]
19+
resources:
20+
- nodes
21+
- namespaces
22+
- pods
23+
verbs:
24+
- get
25+
- watch
26+
- list
27+
- apiGroups: [ "apps" ]
28+
resources:
29+
- replicasets
30+
verbs:
31+
- get
32+
- list
33+
- watch
34+
- apiGroups: [ "batch" ]
35+
resources:
36+
- jobs
37+
verbs:
38+
- get
39+
- list
40+
- watch
3741
providers:
3842
kubernetes_leaderelection:
3943
enabled: false

‎deploy/helm/elastic-agent/examples/nginx-custom-integration/agent-nginx-values.yaml

Lines changed: 29 additions & 25 deletions
Original file line numberDiff line numberDiff line change
@@ -36,31 +36,35 @@ agent:
3636
mode: deployment
3737
securityContext:
3838
runAsUser: 0
39-
rules:
40-
# minimum cluster role ruleset required by agent
41-
- apiGroups: [ "" ]
42-
resources:
43-
- nodes
44-
- namespaces
45-
- pods
46-
verbs:
47-
- get
48-
- watch
49-
- list
50-
- apiGroups: [ "apps" ]
51-
resources:
52-
- replicasets
53-
verbs:
54-
- get
55-
- list
56-
- watch
57-
- apiGroups: [ "batch" ]
58-
resources:
59-
- jobs
60-
verbs:
61-
- get
62-
- list
63-
- watch
39+
serviceAccount:
40+
create: true
41+
clusterRole:
42+
create: true
43+
rules:
44+
# minimum cluster role ruleset required by agent
45+
- apiGroups: [ "" ]
46+
resources:
47+
- nodes
48+
- namespaces
49+
- pods
50+
verbs:
51+
- get
52+
- watch
53+
- list
54+
- apiGroups: [ "apps" ]
55+
resources:
56+
- replicasets
57+
verbs:
58+
- get
59+
- list
60+
- watch
61+
- apiGroups: [ "batch" ]
62+
resources:
63+
- jobs
64+
verbs:
65+
- get
66+
- list
67+
- watch
6468
providers:
6569
kubernetes_leaderelection:
6670
enabled: false

‎deploy/helm/elastic-agent/examples/user-cluster-role/README.md

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,37 @@
1+
# Example: Kubernetes Integration with User-created cluster role
2+
3+
In this example we define a `nginx` custom integration alongside a custom agent preset defined in [agent-nginx-values.yaml](agent-nginx-values.yaml) including the use of a user-created cluster role. Note that the user is responsible for assigning the correct permissions to the cluster role.
4+
5+
## Prerequisites:
6+
1. A k8s secret that contains the connection details to an Elasticsearch cluster such as the URL and the API key ([Kibana - Creating API Keys](https://www.elastic.co/guide/en/kibana/current/api-keys.html)):
7+
```console
8+
kubectl create secret generic es-api-secret \
9+
--from-literal=api_key=... \
10+
--from-literal=url=...
11+
```
12+
13+
2. `nginx` integration assets are installed through Kibana
14+
15+
3. Create a cluster role.
16+
17+
```console
18+
kubectl create clusterrole user-cr --verb=get,list,watch --resource=pods,namespaces,nodes,replicasets,jobs
19+
```
20+
21+
## Run:
22+
1. Install Helm chart
23+
```console
24+
helm install elastic-agent ../../ \
25+
-f ./agent-nginx-values.yaml \
26+
--set outputs.default.type=ESSecretAuthAPI \
27+
--set outputs.default.secretName=es-api-secret
28+
```
29+
30+
2. Install the nginx deployment
31+
```console
32+
kubectl apply -f ./nginx.yaml
33+
```
34+
35+
## Validate:
36+
37+
1. The Kibana `nginx`-related dashboards should start showing nginx related data.

‎deploy/helm/elastic-agent/examples/user-cluster-role/agent-nginx-values.yaml

Lines changed: 50 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,50 @@
1+
kubernetes:
2+
enabled: false
3+
4+
extraIntegrations:
5+
nginx/metrics:
6+
id: nginx/metrics-nginx-69240207-6fcc-4d19-aee3-dbf716e3bb0f
7+
preset: nginx
8+
name: nginx-1
9+
revision: 1
10+
type: nginx/metrics
11+
use_output: default
12+
meta:
13+
package:
14+
name: nginx
15+
version: 1.19.1
16+
data_stream:
17+
namespace: default
18+
package_policy_id: 69240207-6fcc-4d19-aee3-dbf716e3bb0f
19+
streams:
20+
- id: nginx/metrics-nginx.stubstatus-69240207-6fcc-4d19-aee3-dbf716e3bb0f
21+
data_stream:
22+
dataset: nginx.stubstatus
23+
type: metrics
24+
metricsets:
25+
- stubstatus
26+
hosts:
27+
- 'http://nginx.default.svc.cluster.local:80'
28+
tags:
29+
- nginx-stubstatus
30+
period: 10s
31+
server_status_path: /nginx_status
32+
33+
agent:
34+
presets:
35+
nginx:
36+
annotations:
37+
elastic-agent.k8s.elastic.co/preset: nginx
38+
mode: deployment
39+
securityContext:
40+
runAsUser: 0
41+
serviceAccount:
42+
create: true
43+
annotations:
44+
elastic-agent.k8s.elastic.co/sa: nginx
45+
clusterRole:
46+
create: false
47+
name: user-cr
48+
providers:
49+
kubernetes_leaderelection:
50+
enabled: false

‎deploy/helm/elastic-agent/examples/user-cluster-role/rendered/manifest.yaml

Lines changed: 161 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,161 @@
1+
---
2+
# Source: elastic-agent/templates/agent/service-account.yaml
3+
apiVersion: v1
4+
kind: ServiceAccount
5+
metadata:
6+
name: agent-nginx-example
7+
namespace: "default"
8+
labels:
9+
helm.sh/chart: elastic-agent-0.0.1
10+
app.kubernetes.io/name: elastic-agent
11+
app.kubernetes.io/instance: example
12+
app.kubernetes.io/version: 8.16.0
13+
app.kubernetes.io/managed-by: Helm
14+
annotations:
15+
elastic-agent.k8s.elastic.co/preset: nginx
16+
elastic-agent.k8s.elastic.co/sa: nginx
17+
---
18+
# Source: elastic-agent/templates/agent/k8s/secret.yaml
19+
apiVersion: v1
20+
kind: Secret
21+
metadata:
22+
name: agent-nginx-example
23+
namespace: "default"
24+
labels:
25+
helm.sh/chart: elastic-agent-0.0.1
26+
app.kubernetes.io/name: elastic-agent
27+
app.kubernetes.io/instance: example
28+
app.kubernetes.io/version: 8.16.0
29+
app.kubernetes.io/managed-by: Helm
30+
annotations:
31+
elastic-agent.k8s.elastic.co/preset: nginx
32+
stringData:
33+
34+
agent.yml: |-
35+
id: agent-nginx-example
36+
outputs:
37+
default:
38+
hosts:
39+
- http://elasticsearch:9200
40+
password: changeme
41+
type: elasticsearch
42+
username: elastic
43+
secret_references: []
44+
inputs:
45+
- data_stream:
46+
namespace: default
47+
id: nginx/metrics-nginx-69240207-6fcc-4d19-aee3-dbf716e3bb0f
48+
meta:
49+
package:
50+
name: nginx
51+
version: 1.19.1
52+
name: nginx-1
53+
package_policy_id: 69240207-6fcc-4d19-aee3-dbf716e3bb0f
54+
preset: nginx
55+
revision: 1
56+
streams:
57+
- data_stream:
58+
dataset: nginx.stubstatus
59+
type: metrics
60+
hosts:
61+
- http://nginx.default.svc.cluster.local:80
62+
id: nginx/metrics-nginx.stubstatus-69240207-6fcc-4d19-aee3-dbf716e3bb0f
63+
metricsets:
64+
- stubstatus
65+
period: 10s
66+
server_status_path: /nginx_status
67+
tags:
68+
- nginx-stubstatus
69+
type: nginx/metrics
70+
use_output: default
71+
providers:
72+
kubernetes_leaderelection:
73+
enabled: false
74+
leader_lease: example-nginx
75+
---
76+
# Source: elastic-agent/templates/agent/cluster-role-binding.yaml
77+
apiVersion: rbac.authorization.k8s.io/v1
78+
kind: ClusterRoleBinding
79+
metadata:
80+
name: agent-nginx-example-default
81+
labels:
82+
helm.sh/chart: elastic-agent-0.0.1
83+
app.kubernetes.io/name: elastic-agent
84+
app.kubernetes.io/instance: example
85+
app.kubernetes.io/version: 8.16.0
86+
app.kubernetes.io/managed-by: Helm
87+
annotations:
88+
elastic-agent.k8s.elastic.co/preset: nginx
89+
subjects:
90+
- kind: ServiceAccount
91+
name: agent-nginx-example
92+
namespace: "default"
93+
roleRef:
94+
kind: ClusterRole
95+
name: user-cr
96+
apiGroup: rbac.authorization.k8s.io
97+
---
98+
# Source: elastic-agent/templates/agent/k8s/deployment.yaml
99+
apiVersion: apps/v1
100+
kind: Deployment
101+
metadata:
102+
name: agent-nginx-example
103+
namespace: "default"
104+
labels:
105+
helm.sh/chart: elastic-agent-0.0.1
106+
app.kubernetes.io/name: elastic-agent
107+
app.kubernetes.io/instance: example
108+
app.kubernetes.io/version: 8.16.0
109+
app.kubernetes.io/managed-by: Helm
110+
spec:
111+
selector:
112+
matchLabels:
113+
name: agent-nginx-example
114+
template:
115+
metadata:
116+
labels:
117+
name: agent-nginx-example
118+
annotations:
119+
checksum/config: 99eaac30ab163ab5f4cedbdbf3e6936d34c2b0e2c22dee59947487bab88fcc26
120+
elastic-agent.k8s.elastic.co/preset: nginx
121+
spec:
122+
automountServiceAccountToken: true
123+
containers:
124+
- args:
125+
- -c
126+
- /etc/elastic-agent/agent.yml
127+
- -e
128+
env:
129+
- name: NODE_NAME
130+
valueFrom:
131+
fieldRef:
132+
fieldPath: spec.nodeName
133+
- name: POD_NAME
134+
valueFrom:
135+
fieldRef:
136+
fieldPath: metadata.name
137+
- name: STATE_PATH
138+
value: /usr/share/elastic-agent/state
139+
image: docker.elastic.co/beats/elastic-agent:8.16.0-SNAPSHOT
140+
imagePullPolicy: IfNotPresent
141+
name: agent
142+
securityContext:
143+
runAsUser: 0
144+
volumeMounts:
145+
- mountPath: /usr/share/elastic-agent/state
146+
name: agent-data
147+
- mountPath: /etc/elastic-agent/agent.yml
148+
name: config
149+
readOnly: true
150+
subPath: agent.yml
151+
dnsPolicy: ClusterFirstWithHostNet
152+
serviceAccountName: agent-nginx-example
153+
volumes:
154+
- hostPath:
155+
path: /etc/elastic-agent/default/agent-nginx-example/state
156+
type: DirectoryOrCreate
157+
name: agent-data
158+
- name: config
159+
secret:
160+
defaultMode: 292
161+
secretName: agent-nginx-example

0 commit comments

Comments
 (0)