diff --git a/adm-agent/Chart.yaml b/adm-agent/Chart.yaml new file mode 100644 index 00000000..c2ca35ab --- /dev/null +++ b/adm-agent/Chart.yaml @@ -0,0 +1,13 @@ +apiVersion: v2 +appVersion: 141.10.28 +description: A Helm chart for NetScaler ADM Agent +home: https://adm.cloud.com +kubeVersion: '>=v1.16.0-0' +maintainers: +- email: pavan.belani@cloud.com + name: pavan +- email: swapnil.khanderaokakade@cloud.com + name: swapnil +name: adm-agent +type: application +version: 141.10.28 diff --git a/adm-agent/README.md b/adm-agent/README.md new file mode 100644 index 00000000..71a01fc7 --- /dev/null +++ b/adm-agent/README.md @@ -0,0 +1,129 @@ +# Deploy ADM agent + +Deploy container-based ADM agent to connect NetScaler CPX with ADM Service for management and monitoring. + +# Table of Contents +1. [TL; DR;](#tldr) +2. [Introduction](#introduction) +3. [Generate authentication and authorization token from Access ID and Secret to access ADM](#generatetoken) +4. [Deploy ADM agent onboarding using Helm chart](#deploy-adm-agent-using-helm-chart) +6. [Manual creating login secret for NetScaler ADM Agent](#manual-secret) +7. [Automatic login secret for NetScaler ADM Agent](#automatic-secret) +8. [Clean Up](#clean-up) +9. [Configuration Parameters](#configuration-parameters) + + +# TL; DR; +**A) Deploy adm-agent** + +**A.1) Get Access ID and Secret to access ADM** + +For Access ID and secret see [this](#generatetoken). + +**A.2) To create ADM agent login Secret, use the following command:** + + kubectl create secret generic admlogin --from-literal=username=nsroot --from-literal=password= -n + + helm repo add netscaler https://citrix.github.io/citrix-helm-charts + helm install agent netscaler/adm-agent --namespace + +**Note:** If you are deploying Netscaler CPX and ADM agent in different namespaces, please label namespace with `citrix-cpx=enabled` in which Netscaler CPX has been deployed and agent will take care of creating admlogin secret in other namespaces. For more information, see [Create Secret automatically](#automatic-secret). + + +# Introduction + +NetScaler provides a container based ADM agent to connect NetScaler CPX with ADM service for management and monitoring of NetScaler CPX. + +# Prerequisites + +- Ensure that you have a NetScaler ADM account. To use ADM, you must create a [Cloud account](https://docs.citrix.com/en-us/citrix-cloud/overview/signing-up-for-citrix-cloud/signing-up-for-citrix-cloud). To manage ADM with an Express account, see [Getting Started](https://docs.citrix.com/en-us/citrix-application-delivery-management-service/getting-started.html#install-an-agent-as-a-microservice). + +- Ensure that you installed Kubernetes version 1.16 or later. For more information about Kubernetes installation, see [Kubernetes](https://kubernetes.io/). + +- Ensure that you have installed Helm version 3.x. For information about Helm chart installation, see [Helm](https://github.com/citrix/citrix-helm-charts/blob/master/Helm_Installation_version_3.md). + +- Ensure that the ports described in the [Ports](https://docs.citrix.com/en-us/citrix-application-delivery-management-service/system-requirements.html#ports) document are open. + +- Ensure that serviceaccount adm-agent-serviceaccount is given privilege access. For more infomration, please see [this](#serviceaccount) +## **Get Access ID and Secret** + +Perform the following steps to get access ID and secret for accessing ADM: + +1. Log in to NetScaler ADM Service account. + +2. On the left Menu panel, select **Identity and Access Management**. + + ![](images/menu.png) + +3. Go to **API Access**. + + ![](images/apiaccess.png) + +4. Specify the client name and click **Create Client**. + + ![](images/client-detail.png) + +5. Download and save the `access-id` and `access-secret` generated. + + ![](images/downloads-secret.png) + +# Deploy ADM agent using the Helm chart + +Before deploying the ADM agent, you must create a Kubernetes Secret containing the access ID and Secret to access ADM. For information about getting the access ID and secret for accessing ADM, see [Access ID and Secret to access ADM](#generatetoken). After the Secret has been created, use the following commands to deploy ADM Agent: + + helm repo add netscaler https://citrix.github.io/citrix-helm-charts + + helm install agent netscaler/adm-agent --namespace + +It deploys ADM Agent and registers with ADM service. It also deploys a sidecar along with ADM Agent which can create a Kubernetes Secret containing login credentials of ADM Agent automatically when namespace is labelled with `citrix-cpx=enabled`, more detail [here](#automatic-secret). + +# Create login secret manually for NetScaler ADM agent + +ADM agent login credentials are required by NetScaler CPX while registering itself to ADM Service. You can create it manually on all the namespaces in which Netscaler CPX will be deployed and also on the namespace in which the ADM agent will be created. + + kubectl create secret generic admlogin --from-literal=username=nsroot --from-literal=password= -n + +After the Secret has been created, you can deploy the ADM agent using the following command: + + helm install agent netscaler/adm-agent --namespace + +# Automatic login secret for NetScaler ADM agent + +ADM agent can create the secret for ADM agent and deploys a sidecar along with the ADM agent that creates the secret automatically whenever a namespace is labelled with `citrix-cpx=enabled`. + +To label a namespace, use the following command: + + kubectl label namespace citrix-cpx=enabled + +# Clean up + +To delete the resources created during the deployment of ADM agent `adm-agent` with the release name `agent`, use the following command: + + helm uninstall agent -n + +**NOTE** While removing Agent, it removes CPX & cluster registered with Agent from ADM Service. You need remove the Cluster and Agent from NetScaler ADM UI manually in case any error happen. + +# ServiceAccount + +To provide privileged permissions to the service account used by ADM Agent, please use following command + + oc adm policy add-scc-to-user privileged system:serviceaccount::adm-agent-serviceaccount + +# Configuration parameters + +The following table provides the configurable parameters and their default values in the Helm chart. + +| Parameter | Description | Default | +|--------------------------------|-------------------------------|---------------------------| +| `imageRegistry` | Image registry of the ADM agent onboarding container | `quay.io` | +| `imageRepository` | Image repository of the ADM agent onboarding container | `citrix/adm-agent` | +| `imageTag` | Image tag of the ADM agent container | `141.10.28` | +| `pullPolicy` | Specifies the image pull policy for ADM agent. | IfNotPresent | +| `accessSecret`| Specifies the ID and Secret to access ADM Service.| Nil| +| `loginSecret`| Specifies the login Secret of NetScaler ADM agent.| Nil| +| `helper.helperImageRegistry` | Image registry of NetScaler ADM agent helper | `quay.io` | +| `helper.helperImageRepository` | Image repository of NetScaler ADM agent helper | `citrix/adm-agent-helper` | +| `helper.helperImageTag` | Image tag of NetScaler ADM agent helper | `1.0.0` | +| `helper.pullPolicy` | Specifies the image pull policy for ADM agent Helper. | IfNotPresent | + +**Note:** You can use the `values.yaml` file packaged in the chart. This file contains the default configuration values for the chart. diff --git a/adm-agent/images/apiaccess.png b/adm-agent/images/apiaccess.png new file mode 100644 index 00000000..109112aa Binary files /dev/null and b/adm-agent/images/apiaccess.png differ diff --git a/adm-agent/images/client-detail.png b/adm-agent/images/client-detail.png new file mode 100644 index 00000000..20d0eb12 Binary files /dev/null and b/adm-agent/images/client-detail.png differ diff --git a/adm-agent/images/downloads-secret.png b/adm-agent/images/downloads-secret.png new file mode 100644 index 00000000..261fff1b Binary files /dev/null and b/adm-agent/images/downloads-secret.png differ diff --git a/adm-agent/images/menu.png b/adm-agent/images/menu.png new file mode 100644 index 00000000..a822e4a7 Binary files /dev/null and b/adm-agent/images/menu.png differ diff --git a/adm-agent/templates/NOTES.txt b/adm-agent/templates/NOTES.txt new file mode 100644 index 00000000..a3165625 --- /dev/null +++ b/adm-agent/templates/NOTES.txt @@ -0,0 +1 @@ +ADM Agent Installed Successfully. diff --git a/adm-agent/templates/_helpers.tpl b/adm-agent/templates/_helpers.tpl new file mode 100644 index 00000000..73c86679 --- /dev/null +++ b/adm-agent/templates/_helpers.tpl @@ -0,0 +1,62 @@ +{{/* +Expand the name of the chart. +*/}} +{{- define "adm-agent.name" -}} +{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }} +{{- end }} + +{{/* +Create a default fully qualified app name. +We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). +If release name contains chart name it will be used as a full name. +*/}} +{{- define "adm-agent.fullname" -}} +{{- if .Values.fullnameOverride }} +{{- .Values.fullnameOverride | trunc 53 | trimSuffix "-" }} +{{- else }} +{{- $name := default .Chart.Name .Values.nameOverride }} +{{- if contains $name .Release.Name }} +{{- .Release.Name | trunc 53 | trimSuffix "-" }} +{{- else }} +{{- printf "%s-%s" .Release.Name $name | trunc 53 | trimSuffix "-" }} +{{- end }} +{{- end }} +{{- end }} + +{{/* +Create chart name and version as used by the chart label. +*/}} +{{- define "adm-agent.chart" -}} +{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }} +{{- end }} + +{{/* +Common labels +*/}} +{{- define "adm-agent.labels" -}} +helm.sh/chart: {{ include "adm-agent.chart" . }} +{{ include "adm-agent.selectorLabels" . }} +{{- if .Chart.AppVersion }} +app.kubernetes.io/version: {{ .Chart.AppVersion | quote }} +{{- end }} +app.kubernetes.io/managed-by: {{ .Release.Service }} +{{- end }} + +{{/* +Selector labels +*/}} +{{- define "adm-agent.selectorLabels" -}} +app.kubernetes.io/name: {{ include "adm-agent.name" . }} +app.kubernetes.io/instance: {{ .Release.Name }} +{{- end }} + +{{/* +Create the name of the service account to use +*/}} +{{- define "adm-agent.serviceAccountName" -}} +{{- if .Values.serviceAccount.create }} +{{- default (include "adm-agent.fullname" .) .Values.serviceAccount.name }} +{{- else }} +{{- default "default" .Values.serviceAccount.name }} +{{- end }} +{{- end }} diff --git a/adm-agent/templates/agent-postinstall.yaml b/adm-agent/templates/agent-postinstall.yaml new file mode 100644 index 00000000..e5ce8780 --- /dev/null +++ b/adm-agent/templates/agent-postinstall.yaml @@ -0,0 +1,59 @@ +apiVersion: batch/v1 +kind: Job +metadata: + name: agent-postinstall + labels: + job-name: agent-postinstall + annotations: + "helm.sh/hook": post-install + "helm.sh/hook-delete-policy": "hook-succeeded,hook-failed" +spec: + backoffLimit: 4 + template: + metadata: + labels: + job-name: agent-postinstall + spec: + restartPolicy: Never + serviceAccountName: adm-agent-serviceaccount + containers: + - name: agent-postinstall + image: "{{ tpl .Values.image . }}" + imagePullPolicy: {{ .Values.pullPolicy }} + securityContext: + privileged: true + env: + - name: DEPL + value: "service" + - name: ORCH + value: "Kubernetes" + - name: CONTROLLER + value: "operator" + - name: CONTAINER_AGENT_MODE + value: "adm-agent-postinstall" + - name: INSTALL_JOB + value: "yes" + - name: IP + value: {{ include "adm-agent.fullname" . }} + - name: APP_ID + value: {{ include "adm-agent.fullname" . }} + - name: API_ID + valueFrom: + secretKeyRef: + name: {{ required "Valid accessSecret is required!" .Values.accessSecret }} + key: accessid + + - name: API_SECRET + valueFrom: + secretKeyRef: + name: {{ required "Valid accessSecret is required!" .Values.accessSecret }} + key: accesssecret + + - name: "ADM_AGENT_PASSWORD" + valueFrom: + secretKeyRef: + name: "{{ required "Valid loginSecret is required!" .Values.loginSecret }}" + key: password + + - name: ADM_URL + value: "{{ .Values.admURL }}" \ No newline at end of file diff --git a/adm-agent/templates/agent-tearoff.yaml b/adm-agent/templates/agent-tearoff.yaml new file mode 100644 index 00000000..2eec1fa3 --- /dev/null +++ b/adm-agent/templates/agent-tearoff.yaml @@ -0,0 +1,59 @@ +apiVersion: batch/v1 +kind: Job +metadata: + name: agent-tearoff + labels: + job-name: agent-tearoff + annotations: + "helm.sh/hook": pre-delete + "helm.sh/hook-delete-policy": "before-hook-creation,hook-succeeded,hook-failed" +spec: + backoffLimit: 4 + template: + metadata: + labels: + job-name: agent-tearoff + spec: + restartPolicy: Never + serviceAccountName: adm-agent-serviceaccount + containers: + - name: agent-tearoff + image: "{{ tpl .Values.image . }}" + imagePullPolicy: {{ .Values.pullPolicy }} + securityContext: + privileged: true + env: + - name: DEPL + value: "service" + - name: ORCH + value: "Kubernetes" + - name: CONTROLLER + value: "operator" + - name: CONTAINER_AGENT_MODE + value: "adm-agent-tearoff" + - name: UNINSTALL_JOB + value: "yes" + - name: IP + value: {{ include "adm-agent.fullname" . }} + - name: APP_ID + value: {{ include "adm-agent.fullname" . }} + - name: API_ID + valueFrom: + secretKeyRef: + name: {{ required "Valid accessSecret is required!" .Values.accessSecret }} + key: accessid + + - name: API_SECRET + valueFrom: + secretKeyRef: + name: {{ required "Valid accessSecret is required!" .Values.accessSecret }} + key: accesssecret + + - name: ADM_URL + value: "{{ .Values.admURL }}" + + - name: AGENT_CONFIG_MAP + value: {{ include "adm-agent.fullname" . }}-configmap + + - name: AGENT_SECRET + value: {{ include "adm-agent.fullname" . }}-secret \ No newline at end of file diff --git a/adm-agent/templates/deployment.yaml b/adm-agent/templates/deployment.yaml new file mode 100644 index 00000000..7e1e83c5 --- /dev/null +++ b/adm-agent/templates/deployment.yaml @@ -0,0 +1,646 @@ +#>>>adm-agent-kad-dep.yaml +apiVersion: apps/v1 +kind: Deployment +metadata: + name: {{ include "adm-agent.fullname" . }}-kad +spec: + selector: + matchLabels: + app: {{ include "adm-agent.fullname" . }}-kad + tier: backend + replicas: 1 + template: + metadata: + labels: + app: {{ include "adm-agent.fullname" . }}-kad + tier: backend + {{- with .Values.podAnnotations }} + annotations: + {{- toYaml . | nindent 8 }} + {{- end }} + spec: + serviceAccountName: adm-agent-serviceaccount + containers: + - name: {{ include "adm-agent.fullname" . }}-helper + image: "{{ tpl .Values.helper.image . }}" + imagePullPolicy: {{ .Values.helper.pullPolicy }} + + resources: + {} + securityContext: + runAsGroup: 32024 + runAsNonRoot: true + runAsUser: 32024 + + env: + - name: ADM_AGENT_LOGIN_SECRET + value: "{{ required "Valid loginSecret is required!" .Values.loginSecret }}" + + - name: {{ include "adm-agent.fullname" . }}-kad + image: "{{ tpl .Values.image . }}" + imagePullPolicy: {{ .Values.pullPolicy }} + + resources: + {{- toYaml .Values.resources | nindent 12 }} + securityContext: + privileged: true + + env: + - name: CONTAINER_AGENT_MODE + value: "adm-agent-kad" + + - name: SERVICE_ACCOUNT + value: "adm-agent-serviceaccount" + + - name: REDIS_HOST + value: "{{ include "adm-agent.fullname" . }}-redis" + + - name: REDIS_PORT + value: "6379" + + - name: IP + value: {{ include "adm-agent.fullname" . }} + + - name: APP_ID + value: {{ include "adm-agent.fullname" . }} + + - name: DEPL + value: "service" + + - name: ORCH + value: "Kubernetes" + + - name: MICROSERVICE_HAS_INVENTORY_WORKER + value: "yes" + + - name: CONTROLLER + value: "operator" + + - name: DISABLE_AGENT_UPGRADE + value: "true" + + - name: "API_ID" + valueFrom: + secretKeyRef: + name: {{ required "Valid accessSecret is required!" .Values.accessSecret }} + key: accessid + + - name: "API_SECRET" + valueFrom: + secretKeyRef: + name: {{ required "Valid accessSecret is required!" .Values.accessSecret }} + key: accesssecret + + - name: ADM_URL + value: "{{ .Values.admURL }}" + + - name: MY_NODE_NAME + valueFrom: + fieldRef: + fieldPath: spec.nodeName + + - name: MY_POD_NAME + valueFrom: + fieldRef: + fieldPath: metadata.name + - name: MY_POD_NAMESPACE + valueFrom: + fieldRef: + fieldPath: metadata.namespace + + volumeMounts: + - name: secret-volume + mountPath: /etc/adm_agent/secret + - name: config-volume + mountPath: /etc/adm_agent/config + + volumes: + - name: secret-volume + secret: + secretName: {{ include "adm-agent.fullname" . }}-secret + - name: config-volume + configMap: + name: {{ include "adm-agent.fullname" . }}-configmap + + {{- with .Values.nodeSelector }} + nodeSelector: + {{- toYaml . | nindent 8 }} + {{- end }} + {{- with .Values.affinity }} + affinity: + {{- toYaml . | nindent 8 }} + {{- end }} + {{- with .Values.tolerations }} + tolerations: + {{- toYaml . | nindent 8 }} + {{- end }} +#<<>>admagent-redis-dep.yaml +apiVersion: apps/v1 +kind: Deployment +metadata: + name: {{ include "adm-agent.fullname" . }}-redis +spec: + selector: + matchLabels: + app: {{ include "adm-agent.fullname" . }}-redis + tier: backend + replicas: 1 + template: + metadata: + labels: + app: {{ include "adm-agent.fullname" . }}-redis + tier: backend + {{- with .Values.podAnnotations }} + annotations: + {{- toYaml . | nindent 8 }} + {{- end }} + spec: + serviceAccountName: adm-agent-serviceaccount + containers: + - name: {{ include "adm-agent.fullname" . }}-redis + image: "{{ tpl .Values.image . }}" + imagePullPolicy: {{ .Values.pullPolicy }} + + resources: + {{- toYaml .Values.resources | nindent 12 }} + + env: + - name: CONTAINER_AGENT_MODE + value: "adm-agent-redis" + + - name: IP + value: {{ include "adm-agent.fullname" . }} + + - name: APP_ID + value: {{ include "adm-agent.fullname" . }} + + - name: DEPL + value: "service" + + - name: ORCH + value: "Kubernetes" + + - name: CONTROLLER + value: "operator" + + - name: DISABLE_AGENT_UPGRADE + value: "true" + + - name: MY_NODE_NAME + valueFrom: + fieldRef: + fieldPath: spec.nodeName + + - name: MY_POD_NAME + valueFrom: + fieldRef: + fieldPath: metadata.name + - name: MY_POD_NAMESPACE + valueFrom: + fieldRef: + fieldPath: metadata.namespace + + securityContext: + privileged: true + + livenessProbe: + exec: + command: + - redis-cli + - ping + failureThreshold: 3 + initialDelaySeconds: 30 + periodSeconds: 60 + successThreshold: 1 + timeoutSeconds: 5 + readinessProbe: + exec: + command: + - redis-cli + - ping + failureThreshold: 3 + initialDelaySeconds: 30 + periodSeconds: 60 + successThreshold: 1 + timeoutSeconds: 5 + + ports: + - name: redis + protocol: TCP + containerPort: 6379 + + volumeMounts: + - name: secret-volume + mountPath: /etc/adm_agent/secret + - name: config-volume + mountPath: /etc/adm_agent/config + + volumes: + - name: secret-volume + secret: + secretName: {{ include "adm-agent.fullname" . }}-secret + - name: config-volume + configMap: + name: {{ include "adm-agent.fullname" . }}-configmap + + {{- with .Values.nodeSelector }} + nodeSelector: + {{- toYaml . | nindent 8 }} + {{- end }} + {{- with .Values.affinity }} + affinity: + {{- toYaml . | nindent 8 }} + {{- end }} + {{- with .Values.tolerations }} + tolerations: + {{- toYaml . | nindent 8 }} + {{- end }} +#<<>>admagent-core-dep.yaml +apiVersion: apps/v1 +kind: Deployment +metadata: + name: {{ include "adm-agent.fullname" . }}-core +spec: + selector: + matchLabels: + app: {{ include "adm-agent.fullname" . }}-core + tier: backend + replicas: 1 + template: + metadata: + labels: + app: {{ include "adm-agent.fullname" . }}-core + tier: backend + {{- with .Values.podAnnotations }} + annotations: + {{- toYaml . | nindent 8 }} + {{- end }} + spec: + serviceAccountName: adm-agent-serviceaccount + containers: + - name: {{ include "adm-agent.fullname" . }}-core + image: "{{ tpl .Values.image . }}" + imagePullPolicy: {{ .Values.pullPolicy }} + + resources: + {{- toYaml .Values.resources | nindent 12 }} + + env: + - name: CONTAINER_AGENT_MODE + value: "adm-agent-core" + + - name: IP + value: {{ include "adm-agent.fullname" . }} + + - name: APP_ID + value: {{ include "adm-agent.fullname" . }} + + - name: DEPL + value: "service" + + - name: ORCH + value: "Kubernetes" + + - name: MICROSERVICE_HAS_INVENTORY_WORKER + value: "yes" + + - name: CONTROLLER + value: "operator" + + - name: DISABLE_AGENT_UPGRADE + value: "true" + + - name: REDIS_HOST + value: "{{ include "adm-agent.fullname" . }}-redis" + + - name: REDIS_PORT + value: "6379" + + - name: MY_NODE_NAME + valueFrom: + fieldRef: + fieldPath: spec.nodeName + + - name: MY_POD_NAME + valueFrom: + fieldRef: + fieldPath: metadata.name + + - name: MY_POD_NAMESPACE + valueFrom: + fieldRef: + fieldPath: metadata.namespace + + - name: KAD_HOST + value: "{{ include "adm-agent.fullname" . }}-kad" + + securityContext: + privileged: true + + livenessProbe: + failureThreshold: 3 + httpGet: + path: /mas_health + port: 80 + scheme: HTTP + initialDelaySeconds: 60 + periodSeconds: 60 + successThreshold: 1 + timeoutSeconds: 5 + readinessProbe: + failureThreshold: 3 + httpGet: + path: /mas_health + port: 80 + scheme: HTTP + initialDelaySeconds: 60 + periodSeconds: 60 + successThreshold: 1 + timeoutSeconds: 5 + + ports: + - name: http + protocol: TCP + containerPort: 80 + + - name: https + protocol: TCP + containerPort: 443 + + - name: snmp + protocol: UDP + containerPort: 162 + + - name: syslog + protocol: UDP + containerPort: 514 + + - name: ipfix + protocol: UDP + containerPort: 4739 + + - name: ulfd + protocol: TCP + containerPort: 5557 + + volumeMounts: + - name: secret-volume + mountPath: /etc/adm_agent/secret + - name: config-volume + mountPath: /etc/adm_agent/config + + volumes: + - name: secret-volume + secret: + secretName: {{ include "adm-agent.fullname" . }}-secret + - name: config-volume + configMap: + name: {{ include "adm-agent.fullname" . }}-configmap + + {{- with .Values.nodeSelector }} + nodeSelector: + {{- toYaml . | nindent 8 }} + {{- end }} + {{- with .Values.affinity }} + affinity: + {{- toYaml . | nindent 8 }} + {{- end }} + {{- with .Values.tolerations }} + tolerations: + {{- toYaml . | nindent 8 }} + {{- end }} +#<<>>admagent-lic-dep.yaml +apiVersion: apps/v1 +kind: Deployment +metadata: + name: {{ include "adm-agent.fullname" . }}-lic +spec: + selector: + matchLabels: + app: {{ include "adm-agent.fullname" . }}-lic + tier: backend + replicas: 1 + template: + metadata: + labels: + app: {{ include "adm-agent.fullname" . }}-lic + tier: backend + {{- with .Values.podAnnotations }} + annotations: + {{- toYaml . | nindent 8 }} + {{- end }} + spec: + serviceAccountName: adm-agent-serviceaccount + containers: + - name: {{ include "adm-agent.fullname" . }}-lic + image: "{{ tpl .Values.image . }}" + imagePullPolicy: {{ .Values.pullPolicy }} + + resources: + {{- toYaml .Values.resources | nindent 12 }} + + env: + - name: CONTAINER_AGENT_MODE + value: "adm-agent-pooled-licensing" + + - name: REDIS_HOST + value: "{{ include "adm-agent.fullname" . }}-redis" + + - name: REDIS_PORT + value: "6379" + + - name: IP + value: {{ include "adm-agent.fullname" . }} + + - name: APP_ID + value: {{ include "adm-agent.fullname" . }} + + - name: DEPL + value: "service" + + - name: ORCH + value: "Kubernetes" + + - name: MICROSERVICE_HAS_INVENTORY_WORKER + value: "yes" + + - name: CONTROLLER + value: "operator" + + - name: DISABLE_AGENT_UPGRADE + value: "true" + + - name: MY_NODE_NAME + valueFrom: + fieldRef: + fieldPath: spec.nodeName + + - name: MY_POD_NAME + valueFrom: + fieldRef: + fieldPath: metadata.name + + - name: MY_POD_NAMESPACE + valueFrom: + fieldRef: + fieldPath: metadata.namespace + + securityContext: + privileged: true + + ports: + - name: http + protocol: TCP + containerPort: 80 + + - name: https + protocol: TCP + containerPort: 443 + + - name: licls + protocol: TCP + containerPort: 27000 + + - name: licvd + protocol: TCP + containerPort: 7279 + + volumeMounts: + - name: secret-volume + mountPath: /etc/adm_agent/secret + - name: config-volume + mountPath: /etc/adm_agent/config + + volumes: + - name: secret-volume + secret: + secretName: {{ include "adm-agent.fullname" . }}-secret + - name: config-volume + configMap: + name: {{ include "adm-agent.fullname" . }}-configmap + + {{- with .Values.nodeSelector }} + nodeSelector: + {{- toYaml . | nindent 8 }} + {{- end }} + {{- with .Values.affinity }} + affinity: + {{- toYaml . | nindent 8 }} + {{- end }} + {{- with .Values.tolerations }} + tolerations: + {{- toYaml . | nindent 8 }} + {{- end }} +#<<>>admagent-sharding-dep.yaml +apiVersion: apps/v1 +kind: Deployment +metadata: + name: {{ include "adm-agent.fullname" . }}-sharding +spec: + selector: + matchLabels: + app: {{ include "adm-agent.fullname" . }}-sharding + tier: backend + replicas: 1 + template: + metadata: + labels: + app: {{ include "adm-agent.fullname" . }}-sharding + tier: backend + {{- with .Values.podAnnotations }} + annotations: + {{- toYaml . | nindent 8 }} + {{- end }} + spec: + serviceAccountName: adm-agent-serviceaccount + containers: + - name: {{ include "adm-agent.fullname" . }}-sharding + image: "{{ tpl .Values.image . }}" + imagePullPolicy: {{ .Values.pullPolicy }} + + resources: + {{- toYaml .Values.resources | nindent 12 }} + + env: + - name: CONTAINER_AGENT_MODE + value: "adm-agent-sharding" + + - name: REDIS_HOST + value: "{{ include "adm-agent.fullname" . }}-redis" + + - name: REDIS_PORT + value: "6379" + + - name: IP + value: {{ include "adm-agent.fullname" . }} + + - name: APP_ID + value: {{ include "adm-agent.fullname" . }} + + - name: DEPL + value: "service" + + - name: ORCH + value: "Kubernetes" + + - name: MICROSERVICE_HAS_INVENTORY_WORKER + value: "yes" + + - name: CONTROLLER + value: "operator" + + - name: DISABLE_AGENT_UPGRADE + value: "true" + + - name: MY_NODE_NAME + valueFrom: + fieldRef: + fieldPath: spec.nodeName + + - name: MY_POD_NAME + valueFrom: + fieldRef: + fieldPath: metadata.name + - name: MY_POD_NAMESPACE + valueFrom: + fieldRef: + fieldPath: metadata.namespace + + securityContext: + privileged: true + + volumeMounts: + - name: secret-volume + mountPath: /etc/adm_agent/secret + - name: config-volume + mountPath: /etc/adm_agent/config + + volumes: + - name: secret-volume + secret: + secretName: {{ include "adm-agent.fullname" . }}-secret + - name: config-volume + configMap: + name: {{ include "adm-agent.fullname" . }}-configmap + + {{- with .Values.nodeSelector }} + nodeSelector: + {{- toYaml . | nindent 8 }} + {{- end }} + {{- with .Values.affinity }} + affinity: + {{- toYaml . | nindent 8 }} + {{- end }} + {{- with .Values.tolerations }} + tolerations: + {{- toYaml . | nindent 8 }} + {{- end }} +#<<>>adm-agent-hpa.yaml +apiVersion: autoscaling/v2 +kind: HorizontalPodAutoscaler +metadata: + name: {{ include "adm-agent.fullname" . }}-hpa +spec: + scaleTargetRef: + apiVersion: apps/v1 + kind: Deployment + name: {{ include "adm-agent.fullname" . }}-core + minReplicas: 1 + maxReplicas: 100 + metrics: + - type: Resource + resource: + name: memory + target: + type: Utilization + averageValue: 4000Mi + name: cpu + target: + type: Utilization + averageValue: 1000m +#<<>>adm-agent-kad-svc.yaml +apiVersion: v1 +kind: Service +metadata: + name: {{ include "adm-agent.fullname" . }}-kad + labels: + app: {{ include "adm-agent.fullname" . }}-kad + tier: backend +spec: + type: ClusterIP + ports: + - port: 80 + targetPort: 8083 + name: kad + selector: + app: {{ include "adm-agent.fullname" . }}-kad + tier: backend +#<<>>adm-agent-redis-svc.yaml +apiVersion: v1 +kind: Service +metadata: + name: {{ include "adm-agent.fullname" . }}-redis + labels: + app: {{ include "adm-agent.fullname" . }}-redis + tier: backend +spec: + type: ClusterIP + ports: + - port: 6379 + targetPort: 6379 + name: redis + selector: + app: {{ include "adm-agent.fullname" . }}-redis + tier: backend +#<<>>adm-agent-core-svc.yaml +apiVersion: v1 +kind: Service +metadata: + name: {{ include "adm-agent.fullname" . }} + labels: + app: {{ include "adm-agent.fullname" . }} + tier: backend +spec: + type: ClusterIP + ports: + - port: 80 + targetPort: 80 + name: http + - port: 443 + targetPort: 443 + name: https + - port: 162 + targetPort: 162 + protocol: UDP + name: snmp + - port: 514 + targetPort: 514 + name: syslog + protocol: UDP + - port: 4739 + targetPort: 4739 + name: ipfix + protocol: UDP + selector: + app: {{ include "adm-agent.fullname" . }}-core + tier: backend +#<<>>adm-agent-lic-svc.yaml +apiVersion: v1 +kind: Service +metadata: + name: {{ include "adm-agent.fullname" . }}-lic + labels: + app: {{ include "adm-agent.fullname" . }}-lic + tier: backend +spec: + type: ClusterIP + ports: + - port: 27000 + targetPort: 27000 + name: licls + - port: 7279 + targetPort: 7279 + name: licvd + selector: + app: {{ include "adm-agent.fullname" . }}-lic + tier: backend +#<<>>adm-agent-headless-svc.yaml +apiVersion: v1 +kind: Service +metadata: + name: {{ include "adm-agent.fullname" . }}-logstream + labels: + app: {{ include "adm-agent.fullname" . }}-logstream + tier: backend +spec: + clusterIP: None + ports: + - port: 5557 + targetPort: 5557 + name: ulfd + protocol: TCP + selector: + app: {{ include "adm-agent.fullname" . }}-core + tier: backend +#<<>>adm-agent-clusterRoleBinding.yaml +kind: ClusterRoleBinding +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: {{ include "adm-agent.fullname" . }} +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: {{ include "adm-agent.fullname" . }} +subjects: +- kind: ServiceAccount + name: adm-agent-serviceaccount + namespace: {{ .Release.Namespace }} +apiVersion: rbac.authorization.k8s.io/v1 +#<<>>adm-agent-clusterRole.yaml +kind: ClusterRole +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: {{ include "adm-agent.fullname" . }} +rules: + - apiGroups: + - "" + resources: + - endpoints + - ingresses + - pods + - secrets + - nodes + - namespaces + - configmaps + - clusters + - daemonsets + verbs: ["get", "list", "create", "update", "patch", "watch", "delete"] + - apiGroups: + - "" + resources: + - services + verbs: ["get", "list", "create", "update", "patch", "watch", "delete"] + - apiGroups: + - "" + resources: + - events + verbs: ["get", "list", "create", "update", "patch", "watch", "delete"] + - apiGroups: + - extensions + - networking.k8s.io + resources: + - ingresses + - ingressclasses + verbs: ["get", "list", "create", "update", "patch", "watch", "delete"] + - apiGroups: + - extensions + - networking.k8s.io + resources: + - ingresses/status + verbs: ["get", "list", "create", "update", "patch", "watch", "delete"] + - apiGroups: + - apps + resources: + - deployments + verbs: ["get", "list", "create", "update", "patch", "watch", "delete"] +#<<>>adm-agent-secret.yaml +apiVersion: v1 +kind: Secret +metadata: + name: adm-agent-serviceaccount + annotations: + kubernetes.io/service-account.name: adm-agent-serviceaccount +type: kubernetes.io/service-account-token +#<<