Chris Curwick
3bacc1f54b
Add an `azuremonitor` metric template provider that queries the managed Prometheus endpoint of an Azure Monitor Workspace, removing the need to front the workspace with an aad-auth-proxy sidecar. The provider embeds the Prometheus provider and only takes care of authentication. It resolves a Microsoft Entra ID token before each query and hands it to the Prometheus provider as a bearer token, so query handling, headers and error reporting stay unchanged. The identity is taken from the keys present in the referenced secret. A clientId and tenantId pair selects a workload identity, adding a clientSecret selects a service principal, and an absent secret falls back to the workload identity of the Flagger pod. The Azure cloud and the token audience are derived from the workspace host name, so no new provider fields or controller flags are needed. The address is required to be an HTTPS Azure Monitor Workspace query endpoint and insecureSkipVerify is rejected, so that the token is only ever sent to a verified workspace host. Signed-off-by: Chris Curwick <chriscur@microsoft.com>
Flagger Kustomize installer
As an alternative to Helm, Flagger can be installed with Kustomize.
Prerequisites
- Kubernetes cluster >=1.13.0
- Kustomize >=3.6.0
Service mesh specific installers
Install Flagger for Istio:
kustomize build https://github.com/fluxcd/flagger/kustomize/istio?ref=main | kubectl apply -f -
This deploys Flagger in the istio-system namespace and sets the metrics server URL to Istio's Prometheus instance.
Install Flagger for AWS App Mesh:
kustomize build https://github.com/fluxcd/flagger/kustomize/appmesh?ref=main | kubectl apply -f -
This deploys Flagger in the appmesh-system namespace and sets the metrics server URL to App Mesh Prometheus instance.
Install Flagger for Linkerd:
kustomize build https://github.com/fluxcd/flagger/kustomize/linkerd?ref=main | kubectl apply -f -
This deploys Flagger in the linkerd namespace and sets the metrics server URL to linkerd-viz extension's Prometheus instance
which lives under linkerd-viz namespace by default.
If you want to install a specific Flagger release, add the version number to the URL:
kustomize build https://github.com/fluxcd/flagger/kustomize/linkerd?ref=v1.0.0 | kubectl apply -f -
Install Flagger for Contour:
kustomize build https://github.com/fluxcd/flagger/kustomize/contour?ref=main | kubectl apply -f -
This deploys Flagger and Prometheus in the projectcontour namespace and sets Prometheus to scrape Contour's Envoy instances.
Generic installer
Install Flagger and Prometheus:
kustomize build https://github.com/fluxcd/flagger/kustomize/kubernetes?ref=main | kubectl apply -f -
This deploys Flagger and Prometheus in the flagger-system namespace,
sets the metrics server URL to http://flagger-prometheus.flagger-system:9090 and the mesh provider to kubernetes.
To target a different provider you can specify it in the canary custom resource:
apiVersion: flagger.app/v1alpha3
kind: Canary
metadata:
name: app
namespace: test
spec:
# can be: kubernetes, istio, linkerd, appmesh, nginx, skipper, gloo
# use the kubernetes provider for Blue/Green style deployments
provider: nginx
You'll need Prometheus when using Flagger with AWS App Mesh, Gloo, NGINX or Skipper ingress controller.
The Prometheus instance has a two hours data retention and is configured to scrape all pods in your cluster that
have the prometheus.io/scrape: "true" annotation.
Customise the installation
Create a kustomization file using Flagger as base and patch the container args:
cat > kustomization.yaml <<EOF
namespace: istio-system
bases:
- github.com/fluxcd/flagger/kustomize/base/flagger
patches:
- target:
kind: Deployment
name: flagger
patch: |-
apiVersion: apps/v1
kind: Deployment
metadata:
name: flagger
spec:
template:
spec:
containers:
- name: flagger
args:
- -mesh-provider=istio
- -metrics-server=http://prometheus.istio-system:9090
- -slack-user=flagger
- -slack-channel=alerts
- -slack-url=https://hooks.slack.com/services/YOUR/SLACK/WEBHOOK
EOF
Install Flagger for Istio with Slack notifications:
kustomize build . | kubectl apply -f -