From cd01e327b9373c7e31200872f78e13e2391780d2 Mon Sep 17 00:00:00 2001 From: Jon Whitcraft Date: Thu, 18 Jan 2018 13:38:37 -0500 Subject: [PATCH] Fluentd-Cloudwatch Changes (#3229) * Fluentd-Cloudwatch Changes - Add support for awsRoles vai kube2iam role - Add rbac create support - Standardize helpers with other charts * Fix the lint errors * Forgot to update the secrets * Address Code Review Comments --- incubator/fluentd-cloudwatch/Chart.yaml | 2 +- incubator/fluentd-cloudwatch/README.md | 6 ++++++ .../fluentd-cloudwatch/templates/_helpers.tpl | 5 +++-- .../templates/clusterrole.yaml | 15 +++++++++++++++ .../templates/clusterrolebinding.yaml | 19 +++++++++++++++++++ .../templates/daemonset.yaml | 8 ++++++-- .../fluentd-cloudwatch/templates/secrets.yaml | 2 ++ .../templates/serviceaccount.yaml | 11 +++++++++++ incubator/fluentd-cloudwatch/values.yaml | 8 ++++++++ 9 files changed, 71 insertions(+), 5 deletions(-) create mode 100644 incubator/fluentd-cloudwatch/templates/clusterrole.yaml create mode 100644 incubator/fluentd-cloudwatch/templates/clusterrolebinding.yaml create mode 100644 incubator/fluentd-cloudwatch/templates/serviceaccount.yaml diff --git a/incubator/fluentd-cloudwatch/Chart.yaml b/incubator/fluentd-cloudwatch/Chart.yaml index 0738f847e3..b334dbce4a 100644 --- a/incubator/fluentd-cloudwatch/Chart.yaml +++ b/incubator/fluentd-cloudwatch/Chart.yaml @@ -1,5 +1,5 @@ name: fluentd-cloudwatch -version: 0.1.2 +version: 0.2.0 appVersion: 0.1.1 description: A Fluentd CloudWatch Helm chart for Kubernetes. icon: https://raw.githubusercontent.com/fluent/fluentd-docs/master/public/logo/Fluentd_square.png diff --git a/incubator/fluentd-cloudwatch/README.md b/incubator/fluentd-cloudwatch/README.md index ad8ae72d9b..619635f7dc 100644 --- a/incubator/fluentd-cloudwatch/README.md +++ b/incubator/fluentd-cloudwatch/README.md @@ -15,6 +15,7 @@ This chart bootstraps a [Fluentd](https://www.fluentd.org/) [Cloudwatch](https:/ ## Prerequisites - Kubernetes 1.4+ with Beta APIs enabled +- [kube2iam](../../stable/kube2iam) installed to used the **awsRole** config option ## Installing the Chart @@ -23,6 +24,8 @@ To install the chart with the release name `my-release`: ```console $ # edit secrets/aws_access_key_id and secrets/aws_access_key_id with the key/password of a AWS user with a policy to access Cloudwatch $ helm install --name my-release incubator/fluentd-cloudwatch +$ # or add a role to aws with the correct policy to add to cloud watch +$ helm install --name my-release incubator/fluentd-cloudwatch --set awsRole=roll_name_here ``` The command deploys Fluentd Cloudwatch on the Kubernetes cluster in the default configuration. The [configuration](#configuration) section lists the parameters that can be configured during installation. @@ -53,8 +56,11 @@ The following tables lists the configurable parameters of the Fluentd Cloudwatch | `hostNetwork` | Host network | `false` | | `annotations` (removed for now) | Annotations | `nil` | | `awsRegion` | AWS Cloudwatch region | `us-east-1` | +| `awsRole` | AWS IAM Role To Use | `nil` | | `fluentdConfig` | Fluentd configuration | `example configuration` | | `logGroupName` | AWS Cloudwatch log group | `kubernetes` | +| `rbac.create` | If true, create & use RBAC resources | `false` | +| `rbac.serviceAccountName` | existing ServiceAccount to use (ignored if rbac.create=true) | `default` | Specify each parameter using the `--set key=value[,key=value]` argument to `helm install`. For example, diff --git a/incubator/fluentd-cloudwatch/templates/_helpers.tpl b/incubator/fluentd-cloudwatch/templates/_helpers.tpl index 9663251908..81757a0488 100644 --- a/incubator/fluentd-cloudwatch/templates/_helpers.tpl +++ b/incubator/fluentd-cloudwatch/templates/_helpers.tpl @@ -3,7 +3,7 @@ Expand the name of the chart. */}} {{- define "fluentd-cloudwatch.name" -}} -{{- default .Chart.Name .Values.nameOverride | trunc 24 -}} +{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}} {{- end -}} {{/* @@ -12,5 +12,6 @@ We truncate at 24 chars because some Kubernetes name fields are limited to this */}} {{- define "fluentd-cloudwatch.fullname" -}} {{- $name := default .Chart.Name .Values.nameOverride -}} -{{- printf "%s-%s" .Release.Name $name | trunc 24 -}} +{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}} {{- end -}} + diff --git a/incubator/fluentd-cloudwatch/templates/clusterrole.yaml b/incubator/fluentd-cloudwatch/templates/clusterrole.yaml new file mode 100644 index 0000000000..14fc05487f --- /dev/null +++ b/incubator/fluentd-cloudwatch/templates/clusterrole.yaml @@ -0,0 +1,15 @@ +{{- if .Values.rbac.create }} +apiVersion: rbac.authorization.k8s.io/v1beta1 +kind: ClusterRole +metadata: + name: {{ template "fluentd-cloudwatch.fullname" . }} + labels: + app: {{ template "fluentd-cloudwatch.name" . }} + chart: "{{ .Chart.Name }}-{{ .Chart.Version }}" + release: "{{ .Release.Name }}" + heritage: "{{ .Release.Service }}" +rules: +- apiGroups: [""] + resources: ["fluentd-cloudwatch.namespaces", "pods"] + verbs: ["get", "list", "watch"] +{{- end }} diff --git a/incubator/fluentd-cloudwatch/templates/clusterrolebinding.yaml b/incubator/fluentd-cloudwatch/templates/clusterrolebinding.yaml new file mode 100644 index 0000000000..f88a511975 --- /dev/null +++ b/incubator/fluentd-cloudwatch/templates/clusterrolebinding.yaml @@ -0,0 +1,19 @@ +{{ if .Values.rbac.create }} +apiVersion: rbac.authorization.k8s.io/v1beta1 +kind: ClusterRoleBinding +metadata: + name: {{ template "fluentd-cloudwatch.fullname" . }} + labels: + app: {{ template "fluentd-cloudwatch.name" . }} + chart: "{{ .Chart.Name }}-{{ .Chart.Version }}" + release: "{{ .Release.Name }}" + heritage: "{{ .Release.Service }}" +subjects: +- kind: ServiceAccount + name: {{ template "fluentd-cloudwatch.fullname" . }} + namespace: {{ .Release.Namespace }} +roleRef: + kind: ClusterRole + name: {{ template "fluentd-cloudwatch.fullname" . }} + apiGroup: rbac.authorization.k8s.io +{{ end }} diff --git a/incubator/fluentd-cloudwatch/templates/daemonset.yaml b/incubator/fluentd-cloudwatch/templates/daemonset.yaml index a1596ef879..c030a11f4b 100644 --- a/incubator/fluentd-cloudwatch/templates/daemonset.yaml +++ b/incubator/fluentd-cloudwatch/templates/daemonset.yaml @@ -14,8 +14,12 @@ spec: app: {{ template "fluentd-cloudwatch.name" . }} release: "{{ .Release.Name }}" annotations: + {{ if .Values.awsRole }}iam.amazonaws.com/role: {{ .Values.awsRole }}{{ end }} +{{- if .Values.podAnnotations }} {{ toYaml .Values.annotations | indent 8 }} +{{- end }} spec: + serviceAccountName: {{ if .Values.rbac.create }}{{ template "fluentd-cloudwatch.fullname" . }}{{ else }}"{{ .Values.rbac.serviceAccountName }}"{{ end }} containers: - name: {{ template "fluentd-cloudwatch.fullname" . }} image: "{{ .Values.image }}:{{ .Values.imageTag }}" @@ -26,7 +30,7 @@ spec: value: {{ .Values.awsRegion }} - name: LOG_GROUP_NAME value: {{ .Values.logGroupName }} - +{{- if not .Values.awsRole }} - name: AWS_ACCESS_KEY_ID valueFrom: secretKeyRef: @@ -37,7 +41,7 @@ spec: secretKeyRef: key: aws_secret_access_key name: {{ template "fluentd-cloudwatch.fullname" . }} - +{{- end }} resources: {{ toYaml .Values.resources | indent 10 }} volumeMounts: diff --git a/incubator/fluentd-cloudwatch/templates/secrets.yaml b/incubator/fluentd-cloudwatch/templates/secrets.yaml index 9e864c60ec..f244253645 100644 --- a/incubator/fluentd-cloudwatch/templates/secrets.yaml +++ b/incubator/fluentd-cloudwatch/templates/secrets.yaml @@ -1,3 +1,4 @@ +{{- if not .Values.awsRole }} apiVersion: v1 kind: Secret metadata: @@ -10,3 +11,4 @@ metadata: type: Opaque data: {{ (.Files.Glob "secrets/*").AsSecrets | indent 2 }} +{{- end }} diff --git a/incubator/fluentd-cloudwatch/templates/serviceaccount.yaml b/incubator/fluentd-cloudwatch/templates/serviceaccount.yaml new file mode 100644 index 0000000000..8453303cf6 --- /dev/null +++ b/incubator/fluentd-cloudwatch/templates/serviceaccount.yaml @@ -0,0 +1,11 @@ +{{- if .Values.rbac.create }} +apiVersion: v1 +kind: ServiceAccount +metadata: + name: {{ template "fluentd-cloudwatch.fullname" . }} + labels: + app: {{ template "fluentd-cloudwatch.name" . }} + chart: "{{ .Chart.Name }}-{{ .Chart.Version }}" + release: "{{ .Release.Name }}" + heritage: "{{ .Release.Service }}" +{{- end }} diff --git a/incubator/fluentd-cloudwatch/values.yaml b/incubator/fluentd-cloudwatch/values.yaml index eeea5a15ac..868f6d0c7a 100644 --- a/incubator/fluentd-cloudwatch/values.yaml +++ b/incubator/fluentd-cloudwatch/values.yaml @@ -23,8 +23,16 @@ resources: annotations: {} awsRegion: us-east-1 +awsRole: logGroupName: kubernetes +rbac: + ## If true, create and use RBAC resources + create: false + + ## Ignored if rbac.create is true + serviceAccountName: default + fluentdConfig: | type null