mirror of
https://github.com/helm/charts.git
synced 2026-08-23 22:37:45 +00:00
Néstor Salceda
e761e8c892
* Add support for deploying Custom App Checks using Helm Chart Signed-off-by: Néstor Salceda <nestor.salceda@sysdig.com> * Add a DESIGN document which works a reminder for known issues Signed-off-by: Néstor Salceda <nestor.salceda@sysdig.com> * Fix issues from @bencer's review Signed-off-by: Néstor Salceda <nestor.salceda@sysdig.com> * Add an script for generating Helm config files with custom AppChecks Signed-off-by: Néstor Salceda <nestor.salceda@sysdig.com>
149 lines
6.6 KiB
Markdown
149 lines
6.6 KiB
Markdown
# Sysdig
|
|
|
|
[Sysdig](https://www.sysdig.com/) is a unified platform for container and microservices monitoring, troubleshooting, security and forensics. Sysdig platform has been built on top of [Sysdig tool](https://sysdig.com/opensource/sysdig/) and [Sysdig Inspect](https://sysdig.com/blog/sysdig-inspect/) open-source technologies.
|
|
|
|
## Introduction
|
|
|
|
This chart adds the Sysdig agent for [Sysdig Monitor](https://sysdig.com/product/monitor/) and [Sysdig Secure](https://sysdig.com/product/secure/) to all nodes in your cluster via a DaemonSet.
|
|
|
|
## Prerequisites
|
|
|
|
- Kubernetes 1.2+ with Beta APIs enabled
|
|
|
|
## Installing the Chart
|
|
|
|
To install the chart with the release name `my-release`, retrieve your Sysdig Monitor Access Key from your [Account Settings](https://app.sysdigcloud.com/#/settings/agentInstallation) and run:
|
|
|
|
```bash
|
|
$ helm install --name my-release \
|
|
--set sysdig.accessKey=YOUR-KEY-HERE stable/sysdig
|
|
```
|
|
|
|
After a few seconds, you should see hosts and containers appearing in Sysdig Monitor and Sysdig Secure.
|
|
|
|
> **Tip**: List all releases using `helm list`
|
|
|
|
## Uninstalling the Chart
|
|
|
|
To uninstall/delete the `my-release` deployment:
|
|
|
|
```bash
|
|
$ helm delete my-release
|
|
```
|
|
> **Tip**: Use helm delete --purge my-release to completely remove the release from Helm internal storage
|
|
|
|
The command removes all the Kubernetes components associated with the chart and deletes the release.
|
|
|
|
## Configuration
|
|
|
|
The following table lists the configurable parameters of the Sysdig chart and their default values.
|
|
|
|
| Parameter | Description | Default |
|
|
| --- | --- | --- |
|
|
| `image.repository` | The image repository to pull from | `sysdig/agent` |
|
|
| `image.tag` | The image tag to pull | `latest` |
|
|
| `image.pullPolicy` | The Image pull policy | `Always` |
|
|
| `rbac.create` | If true, create & use RBAC resources | `true` |
|
|
| `serviceAccount.create` | Create serviceAccount | `true` |
|
|
| `serviceAccount.name` | Use this value as serviceAccountName | ` ` |
|
|
| `sysdig.accessKey` | Your Sysdig Monitor Access Key | `Nil` You must provide your own key |
|
|
| `sysdig.settings` | Settings for agent's configuration file | `{}` |
|
|
| `secure.enabled` | Enable Sysdig Secure | `false` |
|
|
| `customAppChecks` | The custom app checks deployed with your agent | `{}` |
|
|
| `tolerations` | The tolerations for scheduling | `node-role.kubernetes.io/master:NoSchedule` |
|
|
|
|
Specify each parameter using the `--set key=value[,key=value]` argument to `helm install`. For example,
|
|
|
|
```bash
|
|
$ helm install --name my-release \
|
|
--set sysdig.accessKey=YOUR-KEY-HERE,sysdig.AgentTags="role:webserver,location:europe" \
|
|
stable/sysdig
|
|
```
|
|
|
|
Alternatively, a YAML file that specifies the values for the parameters can be provided while installing the chart. For example,
|
|
|
|
```bash
|
|
$ helm install --name my-release -f values.yaml stable/sysdig
|
|
```
|
|
|
|
> **Tip**: You can use the default [values.yaml](values.yaml)
|
|
|
|
## On-Premise deployment settings
|
|
|
|
There are several people who runs Sysdig platform On-Premise, in its own infrastructure.
|
|
|
|
This is also supported by the Helm chart, and you can enable it with the following parameters:
|
|
|
|
| Parameter | Description | Default |
|
|
| --- | --- | --- |
|
|
| `sysdig.settings.collector` | The IP address or hostname of the collector | ` ` |
|
|
| `sysdig.settings.collector_port` | The port where collector is listening | ` `
|
|
| `sysdig.settings.ssl` | The collector accepts SSL | `true` |
|
|
| `sysdig.settings.ssl_verify_certificate` | Set to false if you don't want to verify SSL certificate | `true` |
|
|
|
|
For example:
|
|
|
|
```bash
|
|
$ helm install --name sysdig-agent-on-prem \
|
|
--set sysdig.accessKey=YOUR-KEY-HERE \
|
|
--set sysdig.settings.collector=42.32.196.18 \
|
|
--set sysdig.settings.collector_port=6443 \
|
|
--set sysdig.settings.ssl_verify_certificate=false \
|
|
stable/sysdig
|
|
```
|
|
|
|
## Custom App Checks
|
|
|
|
Application checks are integrations that allow the Sysdig agent to poll specific metrics exposed by any application. Sysdig Monitor has several built-in app checks, but sometimes you need to create your own.
|
|
|
|
You can deploy them with the following YAML:
|
|
|
|
```yaml
|
|
customAppChecks:
|
|
sample.py: |-
|
|
from checks import AgentCheck
|
|
|
|
class MyCustomCheck(AgentCheck):
|
|
def check(self, instance):
|
|
self.gauge("testhelm", 1)
|
|
|
|
sysdig:
|
|
settings:
|
|
app_checks:
|
|
- name: sample
|
|
interval: 10
|
|
pattern: # pattern to match the application
|
|
comm: systemd
|
|
conf:
|
|
key: value
|
|
```
|
|
|
|
The first section, deploys the Custom App Check in a Kubernetes configmap, and the second configures it using dragent.yaml file. So that deploy Sysdig Chart using this file:
|
|
|
|
```bash
|
|
$ helm install --name sysdig-agent-1 \
|
|
--set sysdig.accessKey=SYSDIG_ACCESS_KEY \
|
|
-f custom-appchecks.yaml \
|
|
stable/sysdig
|
|
|
|
```
|
|
|
|
And that's all, you will have your Custom App Check up and running.
|
|
|
|
You can get more information about [Custom App Checks in Sysdig's Official Documentation](https://sysdigdocs.atlassian.net/wiki/spaces/Monitor/pages/204767436/).
|
|
|
|
### Automating the generation of custom-app-checks.yaml file
|
|
|
|
Sometimes edit YAML files with multistrings is a bit cumbersome and error prone, so we added a script for automating this step and make your life easier.
|
|
|
|
This script lives in [Helm Chart repository](https://github.com/helm/charts) in the `stable/sysdig/scripts` directory.
|
|
|
|
Imagine that you would like to add rules for your Redis, MongoDB and Traefik containers, you have to:
|
|
|
|
```bash
|
|
$ git clone https://github.com/kubernetes/charts.git
|
|
$ cd stable/sysdig
|
|
$ ./scripts/appchecks2helm appChecks/solr.py appChecks/traefik.py appChecks/nats.py > custom-app-checks.yaml
|
|
$ helm install --name sysdig -f custom-app-checks.yaml stable/sysdig
|
|
```
|