Skip to content

Commit 4c26d80

Browse files
naemononaemono
committed
Add additional notes to the example and add back the recipe.
Signed-off-by: Michael Montgomery <[email protected]>
1 parent c26e9fd commit 4c26d80

File tree

2 files changed

+332
-0
lines changed

2 files changed

+332
-0
lines changed

‎config/recipes/elastic-agent/README.asciidoc‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -31,6 +31,10 @@ Deploys two Elasticsearch clusters and two Kibana instances together with single
3131

3232
Deploys Elastic Agent as a DaemonSet in Fleet mode with System and Kubernetes integrations enabled. System integration collects syslog logs, auth logs and system metrics (for CPU, I/O, filesystem, memory, network, process and others). Kubernetes integrations collects API server, Container, Event, Node, Pod, Volume and system metrics.
3333

34+
===== System and Kubernetes integrations running as non-root - `fleet-kubernetes-integration-nonroot.yaml`
35+
36+
The provided example is functionally identical to the previous section but runs the Elastic Agent processes (both the Elastic Agent running as the Fleet server and the Elastic Agent connected to Fleet) as a non-root user by utilizing a DaemonSet to ensure directory and file permissions. *Note* This is only required when Elastic Agent is < 8.16.0. Also the DaemonSet itself must run as root to set up permissions and ECK >= 2.10.0 is required.
37+
3438
===== Custom logs integration with autodiscover - `fleet-custom-logs-integration.yaml`
3539

3640
Deploys Elastic Agent as a DaemonSet in Fleet mode with Custom Logs integration enabled. Collects logs from all Pods in the `default` namespace using autodiscover feature.

‎config/recipes/elastic-agent/fleet-kubernetes-integration-nonroot.yaml‎

Lines changed: 328 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,328 @@
1+
---
2+
# This example only applies to Elastic Agent versions < v8.16.0.
3+
# Since Elastic Agent v8.16.0, the `runAsUser: 0` is not needed
4+
# as Agent changes the ownership of the volumes mounts to the container user id.
5+
apiVersion: apps/v1
6+
kind: DaemonSet
7+
metadata:
8+
name: manage-agent-hostpath-permissions
9+
spec:
10+
selector:
11+
matchLabels:
12+
name: manage-agent-hostpath-permissions
13+
template:
14+
metadata:
15+
labels:
16+
name: manage-agent-hostpath-permissions
17+
spec:
18+
# This is only required when running in an SELinux-enabled/OpenShift environment.
19+
# Ensure this user has been added to the privileged scc in the correct namespace.
20+
# oc adm policy add-scc-to-user privileged -z elastic-agent -n elastic-apps
21+
# serviceAccountName: elastic-agent
22+
volumes:
23+
- hostPath:
24+
path: /var/lib/elastic-agent
25+
type: DirectoryOrCreate
26+
name: "agent-data"
27+
initContainers:
28+
- name: manage-agent-hostpath-permissions
29+
# UBI is only required when needing the `chcon` binary when running
30+
# in an SELinux-enabled/OpenShift environment. If that
31+
# is not required then the following smaller image can be used instead:
32+
# image: registry.access.redhat.com/ubi9/ubi-minimal:latest
33+
image: docker.io/bash:5.2.15
34+
resources:
35+
limits:
36+
cpu: 100m
37+
memory: 32Mi
38+
securityContext:
39+
# privileged is only required when running in an SELinux-enabled/OpenShift environment.
40+
# privileged: true
41+
runAsUser: 0
42+
volumeMounts:
43+
- mountPath: /var/lib/elastic-agent
44+
name: agent-data
45+
command:
46+
- 'bash'
47+
- '-e'
48+
- '-c'
49+
- |-
50+
# Adjust this be /var/lib/elastic-agent/YOUR-NAMESPACE/YOUR-AGENT-NAME/state
51+
# Multiple directories are supported for the fleet-server + agent use case.
52+
dirs=(
53+
"/var/lib/elastic-agent/default/elastic-agent/state"
54+
"/var/lib/elastic-agent/default/fleet-server/state"
55+
)
56+
for dir in ${dirs[@]}; do
57+
mkdir -p "${dir}"
58+
# chcon is only required when running an SELinux-enabled/OpenShift environment.
59+
# chcon -Rt svirt_sandbox_file_t "${dir}"
60+
chmod g+rw "${dir}"
61+
chgrp 1000 "${dir}"
62+
if [ -n "$(ls -A ${dir} 2>/dev/null)" ]
63+
then
64+
chgrp 1000 "${dir}"/*
65+
chmod g+rw "${dir}"/*
66+
fi
67+
done
68+
containers:
69+
- name: pause
70+
image: gcr.io/google-containers/pause-amd64:3.1
71+
---
72+
apiVersion: kibana.k8s.elastic.co/v1
73+
kind: Kibana
74+
metadata:
75+
name: kibana
76+
spec:
77+
version: 9.2.0
78+
count: 1
79+
elasticsearchRef:
80+
name: elasticsearch
81+
config:
82+
xpack.fleet.agents.fleet_server.hosts: ["https://fleet-server-agent-http.default.svc:8220"]
83+
xpack.fleet.outputs:
84+
- id: eck-fleet-agent-output-elasticsearch
85+
is_default: true
86+
name: eck-elasticsearch
87+
type: elasticsearch
88+
hosts: ["https://elasticsearch-es-http.default.svc:9200"]
89+
ssl:
90+
certificate_authorities: ["/mnt/elastic-internal/elasticsearch-association/default/elasticsearch/certs/ca.crt"]
91+
xpack.fleet.packages:
92+
- name: system
93+
version: latest
94+
- name: elastic_agent
95+
version: latest
96+
- name: fleet_server
97+
version: latest
98+
- name: kubernetes
99+
version: latest
100+
xpack.fleet.agentPolicies:
101+
- name: Fleet Server on ECK policy
102+
id: eck-fleet-server
103+
namespace: default
104+
is_managed: true
105+
monitoring_enabled:
106+
- logs
107+
- metrics
108+
unenroll_timeout: 900
109+
package_policies:
110+
- name: fleet_server-1
111+
id: fleet_server-1
112+
package:
113+
name: fleet_server
114+
- name: Elastic Agent on ECK policy
115+
id: eck-agent
116+
namespace: default
117+
is_managed: true
118+
monitoring_enabled:
119+
- logs
120+
- metrics
121+
unenroll_timeout: 900
122+
package_policies:
123+
- package:
124+
name: system
125+
name: system-1
126+
- package:
127+
name: kubernetes
128+
name: kubernetes-1
129+
---
130+
apiVersion: elasticsearch.k8s.elastic.co/v1
131+
kind: Elasticsearch
132+
metadata:
133+
name: elasticsearch
134+
spec:
135+
version: 9.2.0
136+
nodeSets:
137+
- name: default
138+
count: 3
139+
config:
140+
node.store.allow_mmap: false
141+
---
142+
apiVersion: agent.k8s.elastic.co/v1alpha1
143+
kind: Agent
144+
metadata:
145+
name: fleet-server
146+
spec:
147+
version: 9.2.0
148+
kibanaRef:
149+
name: kibana
150+
elasticsearchRefs:
151+
- name: elasticsearch
152+
mode: fleet
153+
fleetServerEnabled: true
154+
policyID: eck-fleet-server
155+
deployment:
156+
replicas: 1
157+
podTemplate:
158+
spec:
159+
serviceAccountName: fleet-server
160+
automountServiceAccountToken: true
161+
---
162+
apiVersion: agent.k8s.elastic.co/v1alpha1
163+
kind: Agent
164+
metadata:
165+
name: elastic-agent
166+
spec:
167+
version: 9.2.0
168+
kibanaRef:
169+
name: kibana
170+
fleetServerRef:
171+
name: fleet-server
172+
mode: fleet
173+
policyID: eck-agent
174+
daemonSet:
175+
podTemplate:
176+
spec:
177+
hostNetwork: true
178+
dnsPolicy: ClusterFirstWithHostNet
179+
serviceAccountName: elastic-agent
180+
automountServiceAccountToken: true
181+
---
182+
apiVersion: rbac.authorization.k8s.io/v1
183+
kind: ClusterRole
184+
metadata:
185+
name: fleet-server
186+
rules:
187+
- apiGroups: [""]
188+
resources:
189+
- pods
190+
- namespaces
191+
- nodes
192+
verbs:
193+
- get
194+
- watch
195+
- list
196+
- apiGroups: ["apps"]
197+
resources:
198+
- replicasets
199+
verbs:
200+
- get
201+
- watch
202+
- list
203+
- apiGroups: ["batch"]
204+
resources:
205+
- jobs
206+
verbs:
207+
- get
208+
- watch
209+
- list
210+
- apiGroups: ["coordination.k8s.io"]
211+
resources:
212+
- leases
213+
verbs:
214+
- get
215+
- create
216+
- update
217+
---
218+
apiVersion: v1
219+
kind: ServiceAccount
220+
metadata:
221+
name: fleet-server
222+
---
223+
apiVersion: rbac.authorization.k8s.io/v1
224+
kind: ClusterRoleBinding
225+
metadata:
226+
name: fleet-server
227+
subjects:
228+
- kind: ServiceAccount
229+
name: fleet-server
230+
namespace: default
231+
roleRef:
232+
kind: ClusterRole
233+
name: fleet-server
234+
apiGroup: rbac.authorization.k8s.io
235+
---
236+
apiVersion: rbac.authorization.k8s.io/v1
237+
kind: ClusterRole
238+
metadata:
239+
name: elastic-agent
240+
rules:
241+
- apiGroups: [""]
242+
resources:
243+
- pods
244+
- nodes
245+
- namespaces
246+
- events
247+
- services
248+
- configmaps
249+
verbs:
250+
- get
251+
- watch
252+
- list
253+
- apiGroups: ["coordination.k8s.io"]
254+
resources:
255+
- leases
256+
verbs:
257+
- get
258+
- create
259+
- update
260+
- nonResourceURLs:
261+
- "/metrics"
262+
verbs:
263+
- get
264+
- apiGroups: ["extensions"]
265+
resources:
266+
- replicasets
267+
verbs:
268+
- "get"
269+
- "list"
270+
- "watch"
271+
- apiGroups:
272+
- "apps"
273+
resources:
274+
- statefulsets
275+
- deployments
276+
- replicasets
277+
- daemonsets
278+
verbs:
279+
- "get"
280+
- "list"
281+
- "watch"
282+
- apiGroups:
283+
- ""
284+
resources:
285+
- nodes/stats
286+
verbs:
287+
- get
288+
- nonResourceURLs:
289+
- "/metrics"
290+
verbs:
291+
- get
292+
- apiGroups:
293+
- "batch"
294+
resources:
295+
- jobs
296+
- cronjobs
297+
verbs:
298+
- "get"
299+
- "list"
300+
- "watch"
301+
- apiGroups:
302+
- "storage.k8s.io"
303+
resources:
304+
- storageclasses
305+
verbs:
306+
- "get"
307+
- "list"
308+
- "watch"
309+
---
310+
apiVersion: v1
311+
kind: ServiceAccount
312+
metadata:
313+
name: elastic-agent
314+
namespace: default
315+
---
316+
apiVersion: rbac.authorization.k8s.io/v1
317+
kind: ClusterRoleBinding
318+
metadata:
319+
name: elastic-agent
320+
subjects:
321+
- kind: ServiceAccount
322+
name: elastic-agent
323+
namespace: default
324+
roleRef:
325+
kind: ClusterRole
326+
name: elastic-agent
327+
apiGroup: rbac.authorization.k8s.io
328+
...

0 commit comments

Comments
 (0)