Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Improve Openshift documentation #17867

Merged
merged 6 commits into from
Apr 23, 2020
Merged

Improve Openshift documentation #17867

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
4c84db1
Improve Openshift documentation
ChrsMark Apr 21, 2020
6a1b6e2
Fix proxy comment section
ChrsMark Apr 22, 2020
0fe11d9
Update daemonset too
ChrsMark Apr 22, 2020
8587d78
add CA suggestion
ChrsMark Apr 22, 2020
3d357ea
review suggestions
ChrsMark Apr 23, 2020
2881f98
improve daemonset comment
ChrsMark Apr 23, 2020
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 3 additions & 2 deletions deploy/kubernetes/metricbeat-kubernetes.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -79,10 +79,11 @@ data:
hosts: ["https://${NODE_NAME}:10250"]
bearer_token_file: /var/run/secrets/kubernetes.io/serviceaccount/token
ssl.verification_mode: "none"
# If using Red Hat OpenShift remove ssl.verification_mode entry and
# uncomment these settings:
# If there is a CA bundle that contains the issuer of the certificate used in the Kubelet API,
# remove ssl.verification_mode entry and use the CA, for instance:
#ssl.certificate_authorities:
#- /var/run/secrets/kubernetes.io/serviceaccount/service-ca.crt
# Currently `proxy` metricset is not supported on Openshift, comment out section
- module: kubernetes
metricsets:
- proxy
Expand Down
5 changes: 3 additions & 2 deletions deploy/kubernetes/metricbeat/metricbeat-daemonset-configmap.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -79,10 +79,11 @@ data:
hosts: ["https://${NODE_NAME}:10250"]
bearer_token_file: /var/run/secrets/kubernetes.io/serviceaccount/token
ssl.verification_mode: "none"
# If using Red Hat OpenShift remove ssl.verification_mode entry and
# uncomment these settings:
# If there is a CA bundle that contains the issuer of the certificate used in the Kubelet API,
# remove ssl.verification_mode entry and use the CA, for instance:
#ssl.certificate_authorities:
#- /var/run/secrets/kubernetes.io/serviceaccount/service-ca.crt
# Currently `proxy` metricset is not supported on Openshift, comment out section
- module: kubernetes
metricsets:
- proxy
Expand Down
30 changes: 29 additions & 1 deletion metricbeat/docs/running-on-kubernetes.asciidoc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -85,6 +85,15 @@ spec:
If you are using Red Hat OpenShift, you need to specify additional settings in
the manifest file and enable the container to run as privileged.

. Modify the `DaemonSet` container spec in the manifest file:
+
[source,yaml]
-----
securityContext:
runAsUser: 0
privileged: true
-----
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Would it be good to place this inside of the DaemonSet commented out, that way it can be quickly commented out.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

actually, would it be possible to use the oc patch command to streamline adding this?

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@blakerouse we already have it

beats/deploy/kubernetes/metricbeat-kubernetes.yaml

Line 142 in 4c84db1

# If using Red Hat OpenShift uncomment this:
(and some for Fileveat).

@exekias it is possible with oc -n kube-system patch ds metricbeat -p '{"spec": {"template": {"spec": {"containers": [{"name": "metricbeat", "securityContext": {"privileged": true, "runAsUser": 0}}]}}}}' but it will restart the pods of the DS. Is this really wanted?

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

yeah, by looking at the command and restart behavior, sounds like uncommenting may actually be cleaner


. In the manifest file, edit the `metricbeat-daemonset-modules` ConfigMap, and
specify the following settings under `kubernetes.yml` in the `data` section:
+
Expand All @@ -103,7 +112,26 @@ specify the following settings under `kubernetes.yml` in the `data` section:
hosts: ["https://${NODE_NAME}:10250"]
bearer_token_file: /var/run/secrets/kubernetes.io/serviceaccount/token
ssl.certificate_authorities:
- /var/run/secrets/kubernetes.io/serviceaccount/service-ca.crt
- /path/to/kubelet-service-ca.crt
-----
NOTE: `kubelet-service-ca.crt` can be any CA bundle that contains the issuer of the certificate used in the Kubelet API.
According to each specific installation of Openshift this can be found either in `secrets` or in `configmaps`.
In some installations it can be available as part of the service account secret, in
`/var/run/secrets/kubernetes.io/serviceaccount/service-ca.crt`.
In case of using Openshift installer[https://github.com/openshift/installer/blob/master/docs/user/gcp/install.md]
for GCP then the following `configmap` can be mounted in Metricbeat Pod and use `ca-bundle.crt`
in `ssl.certificate_authorities`:
+
[source,shell]
-----
Name: kubelet-serving-ca
Namespace: openshift-kube-apiserver
Labels: <none>
Annotations: <none>

Data
====
ca-bundle.crt:
-----

. Under the `metricbeat` ClusterRole, add the following resources:
Expand Down