diff --git a/charts/kubezero-operators/README.md b/charts/kubezero-operators/README.md index e637d9ff..b4754a75 100644 --- a/charts/kubezero-operators/README.md +++ b/charts/kubezero-operators/README.md @@ -1,6 +1,6 @@ # kubezero-operators -![Version: 0.1.3](https://img.shields.io/badge/Version-0.1.3-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) +![Version: 0.1.4](https://img.shields.io/badge/Version-0.1.4-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) Various operators supported by KubeZero @@ -19,8 +19,8 @@ Kubernetes: `>= 1.26.0` | Repository | Name | Version | |------------|------|---------| | https://cdn.zero-downtime.net/charts/ | kubezero-lib | >= 0.1.6 | -| https://helm.elastic.co | eck-operator | 2.12.1 | -| https://opensearch-project.github.io/opensearch-k8s-operator/ | opensearch-operator | 2.6.0 | +| https://helm.elastic.co | eck-operator | 2.13.0 | +| https://opensearch-project.github.io/opensearch-k8s-operator/ | opensearch-operator | 2.6.1 | ## Values diff --git a/charts/kubezero-operators/charts/eck-operator/Chart.yaml b/charts/kubezero-operators/charts/eck-operator/Chart.yaml index 6b261018..774c48f4 100644 --- a/charts/kubezero-operators/charts/eck-operator/Chart.yaml +++ b/charts/kubezero-operators/charts/eck-operator/Chart.yaml @@ -1,5 +1,5 @@ apiVersion: v2 -appVersion: 2.12.1 +appVersion: 2.13.0 description: Elastic Cloud on Kubernetes (ECK) operator home: https://github.com/elastic/cloud-on-k8s icon: https://helm.elastic.co/icons/eck.png @@ -18,4 +18,4 @@ maintainers: name: Elastic name: eck-operator type: application -version: 2.12.1 +version: 2.13.0 diff --git a/charts/kubezero-operators/charts/eck-operator/crds/all-crds.yaml b/charts/kubezero-operators/charts/eck-operator/crds/all-crds.yaml index ffe87cc7..88bc7ee0 100644 --- a/charts/kubezero-operators/charts/eck-operator/crds/all-crds.yaml +++ b/charts/kubezero-operators/charts/eck-operator/crds/all-crds.yaml @@ -5,12 +5,13 @@ kind: CustomResourceDefinition metadata: annotations: controller-gen.kubebuilder.io/version: v0.14.0 + helm.sh/resource-policy: keep labels: app.kubernetes.io/instance: 'logging' app.kubernetes.io/managed-by: 'Helm' app.kubernetes.io/name: 'eck-operator-crds' - app.kubernetes.io/version: '2.12.1' - helm.sh/chart: 'eck-operator-crds-2.12.1' + app.kubernetes.io/version: '2.13.0' + helm.sh/chart: 'eck-operator-crds-2.13.0' name: agents.agent.k8s.elastic.co spec: group: agent.k8s.elastic.co @@ -245,7 +246,8 @@ spec: - `url`: the URL to reach the Elastic resource - `username`: the username of the user to be authenticated to the Elastic resource - `password`: the password of the user to be authenticated to the Elastic resource - - `ca.crt`: the CA certificate in PEM format (optional). + - `ca.crt`: the CA certificate in PEM format (optional) + - `api-key`: the key to authenticate against the Elastic resource instead of a username and password (supported only for `elasticsearchRefs` in AgentSpec and in BeatSpec) This field cannot be used in combination with the other fields name, namespace or serviceName. type: string serviceName: @@ -280,7 +282,8 @@ spec: - `url`: the URL to reach the Elastic resource - `username`: the username of the user to be authenticated to the Elastic resource - `password`: the password of the user to be authenticated to the Elastic resource - - `ca.crt`: the CA certificate in PEM format (optional). + - `ca.crt`: the CA certificate in PEM format (optional) + - `api-key`: the key to authenticate against the Elastic resource instead of a username and password (supported only for `elasticsearchRefs` in AgentSpec and in BeatSpec) This field cannot be used in combination with the other fields name, namespace or serviceName. type: string serviceName: @@ -725,7 +728,8 @@ spec: - `url`: the URL to reach the Elastic resource - `username`: the username of the user to be authenticated to the Elastic resource - `password`: the password of the user to be authenticated to the Elastic resource - - `ca.crt`: the CA certificate in PEM format (optional). + - `ca.crt`: the CA certificate in PEM format (optional) + - `api-key`: the key to authenticate against the Elastic resource instead of a username and password (supported only for `elasticsearchRefs` in AgentSpec and in BeatSpec) This field cannot be used in combination with the other fields name, namespace or serviceName. type: string serviceName: @@ -1132,12 +1136,13 @@ kind: CustomResourceDefinition metadata: annotations: controller-gen.kubebuilder.io/version: v0.14.0 + helm.sh/resource-policy: keep labels: app.kubernetes.io/instance: 'logging' app.kubernetes.io/managed-by: 'Helm' app.kubernetes.io/name: 'eck-operator-crds' - app.kubernetes.io/version: '2.12.1' - helm.sh/chart: 'eck-operator-crds-2.12.1' + app.kubernetes.io/version: '2.13.0' + helm.sh/chart: 'eck-operator-crds-2.13.0' name: apmservers.apm.k8s.elastic.co spec: group: apm.k8s.elastic.co @@ -1219,7 +1224,8 @@ spec: - `url`: the URL to reach the Elastic resource - `username`: the username of the user to be authenticated to the Elastic resource - `password`: the password of the user to be authenticated to the Elastic resource - - `ca.crt`: the CA certificate in PEM format (optional). + - `ca.crt`: the CA certificate in PEM format (optional) + - `api-key`: the key to authenticate against the Elastic resource instead of a username and password (supported only for `elasticsearchRefs` in AgentSpec and in BeatSpec) This field cannot be used in combination with the other fields name, namespace or serviceName. type: string serviceName: @@ -1663,7 +1669,8 @@ spec: - `url`: the URL to reach the Elastic resource - `username`: the username of the user to be authenticated to the Elastic resource - `password`: the password of the user to be authenticated to the Elastic resource - - `ca.crt`: the CA certificate in PEM format (optional). + - `ca.crt`: the CA certificate in PEM format (optional) + - `api-key`: the key to authenticate against the Elastic resource instead of a username and password (supported only for `elasticsearchRefs` in AgentSpec and in BeatSpec) This field cannot be used in combination with the other fields name, namespace or serviceName. type: string serviceName: @@ -2352,12 +2359,13 @@ kind: CustomResourceDefinition metadata: annotations: controller-gen.kubebuilder.io/version: v0.14.0 + helm.sh/resource-policy: keep labels: app.kubernetes.io/instance: 'logging' app.kubernetes.io/managed-by: 'Helm' app.kubernetes.io/name: 'eck-operator-crds' - app.kubernetes.io/version: '2.12.1' - helm.sh/chart: 'eck-operator-crds-2.12.1' + app.kubernetes.io/version: '2.13.0' + helm.sh/chart: 'eck-operator-crds-2.13.0' name: beats.beat.k8s.elastic.co spec: group: beat.k8s.elastic.co @@ -2592,7 +2600,8 @@ spec: - `url`: the URL to reach the Elastic resource - `username`: the username of the user to be authenticated to the Elastic resource - `password`: the password of the user to be authenticated to the Elastic resource - - `ca.crt`: the CA certificate in PEM format (optional). + - `ca.crt`: the CA certificate in PEM format (optional) + - `api-key`: the key to authenticate against the Elastic resource instead of a username and password (supported only for `elasticsearchRefs` in AgentSpec and in BeatSpec) This field cannot be used in combination with the other fields name, namespace or serviceName. type: string serviceName: @@ -2626,7 +2635,8 @@ spec: - `url`: the URL to reach the Elastic resource - `username`: the username of the user to be authenticated to the Elastic resource - `password`: the password of the user to be authenticated to the Elastic resource - - `ca.crt`: the CA certificate in PEM format (optional). + - `ca.crt`: the CA certificate in PEM format (optional) + - `api-key`: the key to authenticate against the Elastic resource instead of a username and password (supported only for `elasticsearchRefs` in AgentSpec and in BeatSpec) This field cannot be used in combination with the other fields name, namespace or serviceName. type: string serviceName: @@ -2670,7 +2680,8 @@ spec: - `url`: the URL to reach the Elastic resource - `username`: the username of the user to be authenticated to the Elastic resource - `password`: the password of the user to be authenticated to the Elastic resource - - `ca.crt`: the CA certificate in PEM format (optional). + - `ca.crt`: the CA certificate in PEM format (optional) + - `api-key`: the key to authenticate against the Elastic resource instead of a username and password (supported only for `elasticsearchRefs` in AgentSpec and in BeatSpec) This field cannot be used in combination with the other fields name, namespace or serviceName. type: string serviceName: @@ -2710,7 +2721,8 @@ spec: - `url`: the URL to reach the Elastic resource - `username`: the username of the user to be authenticated to the Elastic resource - `password`: the password of the user to be authenticated to the Elastic resource - - `ca.crt`: the CA certificate in PEM format (optional). + - `ca.crt`: the CA certificate in PEM format (optional) + - `api-key`: the key to authenticate against the Elastic resource instead of a username and password (supported only for `elasticsearchRefs` in AgentSpec and in BeatSpec) This field cannot be used in combination with the other fields name, namespace or serviceName. type: string serviceName: @@ -2836,12 +2848,13 @@ kind: CustomResourceDefinition metadata: annotations: controller-gen.kubebuilder.io/version: v0.14.0 + helm.sh/resource-policy: keep labels: app.kubernetes.io/instance: 'logging' app.kubernetes.io/managed-by: 'Helm' app.kubernetes.io/name: 'eck-operator-crds' - app.kubernetes.io/version: '2.12.1' - helm.sh/chart: 'eck-operator-crds-2.12.1' + app.kubernetes.io/version: '2.13.0' + helm.sh/chart: 'eck-operator-crds-2.13.0' name: elasticmapsservers.maps.k8s.elastic.co spec: group: maps.k8s.elastic.co @@ -2935,7 +2948,8 @@ spec: - `url`: the URL to reach the Elastic resource - `username`: the username of the user to be authenticated to the Elastic resource - `password`: the password of the user to be authenticated to the Elastic resource - - `ca.crt`: the CA certificate in PEM format (optional). + - `ca.crt`: the CA certificate in PEM format (optional) + - `api-key`: the key to authenticate against the Elastic resource instead of a username and password (supported only for `elasticsearchRefs` in AgentSpec and in BeatSpec) This field cannot be used in combination with the other fields name, namespace or serviceName. type: string serviceName: @@ -3433,12 +3447,13 @@ kind: CustomResourceDefinition metadata: annotations: controller-gen.kubebuilder.io/version: v0.14.0 + helm.sh/resource-policy: keep labels: app.kubernetes.io/instance: 'logging' app.kubernetes.io/managed-by: 'Helm' app.kubernetes.io/name: 'eck-operator-crds' - app.kubernetes.io/version: '2.12.1' - helm.sh/chart: 'eck-operator-crds-2.12.1' + app.kubernetes.io/version: '2.13.0' + helm.sh/chart: 'eck-operator-crds-2.13.0' name: elasticsearchautoscalers.autoscaling.k8s.elastic.co spec: group: autoscaling.k8s.elastic.co @@ -3790,12 +3805,13 @@ kind: CustomResourceDefinition metadata: annotations: controller-gen.kubebuilder.io/version: v0.14.0 + helm.sh/resource-policy: keep labels: app.kubernetes.io/instance: 'logging' app.kubernetes.io/managed-by: 'Helm' app.kubernetes.io/name: 'eck-operator-crds' - app.kubernetes.io/version: '2.12.1' - helm.sh/chart: 'eck-operator-crds-2.12.1' + app.kubernetes.io/version: '2.13.0' + helm.sh/chart: 'eck-operator-crds-2.13.0' name: elasticsearches.elasticsearch.k8s.elastic.co spec: group: elasticsearch.k8s.elastic.co @@ -3859,6 +3875,10 @@ spec: description: Auth contains user authentication and authorization security settings for Elasticsearch. properties: + disableElasticUser: + description: DisableElasticUser disables the default elastic user + that is created by ECK. + type: boolean fileRealm: description: FileRealm to propagate to the Elasticsearch cluster. items: @@ -4330,7 +4350,8 @@ spec: - `url`: the URL to reach the Elastic resource - `username`: the username of the user to be authenticated to the Elastic resource - `password`: the password of the user to be authenticated to the Elastic resource - - `ca.crt`: the CA certificate in PEM format (optional). + - `ca.crt`: the CA certificate in PEM format (optional) + - `api-key`: the key to authenticate against the Elastic resource instead of a username and password (supported only for `elasticsearchRefs` in AgentSpec and in BeatSpec) This field cannot be used in combination with the other fields name, namespace or serviceName. type: string serviceName: @@ -4370,7 +4391,8 @@ spec: - `url`: the URL to reach the Elastic resource - `username`: the username of the user to be authenticated to the Elastic resource - `password`: the password of the user to be authenticated to the Elastic resource - - `ca.crt`: the CA certificate in PEM format (optional). + - `ca.crt`: the CA certificate in PEM format (optional) + - `api-key`: the key to authenticate against the Elastic resource instead of a username and password (supported only for `elasticsearchRefs` in AgentSpec and in BeatSpec) This field cannot be used in combination with the other fields name, namespace or serviceName. type: string serviceName: @@ -6500,12 +6522,13 @@ kind: CustomResourceDefinition metadata: annotations: controller-gen.kubebuilder.io/version: v0.14.0 + helm.sh/resource-policy: keep labels: app.kubernetes.io/instance: 'logging' app.kubernetes.io/managed-by: 'Helm' app.kubernetes.io/name: 'eck-operator-crds' - app.kubernetes.io/version: '2.12.1' - helm.sh/chart: 'eck-operator-crds-2.12.1' + app.kubernetes.io/version: '2.13.0' + helm.sh/chart: 'eck-operator-crds-2.13.0' name: enterprisesearches.enterprisesearch.k8s.elastic.co spec: group: enterprisesearch.k8s.elastic.co @@ -6598,7 +6621,8 @@ spec: - `url`: the URL to reach the Elastic resource - `username`: the username of the user to be authenticated to the Elastic resource - `password`: the password of the user to be authenticated to the Elastic resource - - `ca.crt`: the CA certificate in PEM format (optional). + - `ca.crt`: the CA certificate in PEM format (optional) + - `api-key`: the key to authenticate against the Elastic resource instead of a username and password (supported only for `elasticsearchRefs` in AgentSpec and in BeatSpec) This field cannot be used in combination with the other fields name, namespace or serviceName. type: string serviceName: @@ -7170,7 +7194,8 @@ spec: - `url`: the URL to reach the Elastic resource - `username`: the username of the user to be authenticated to the Elastic resource - `password`: the password of the user to be authenticated to the Elastic resource - - `ca.crt`: the CA certificate in PEM format (optional). + - `ca.crt`: the CA certificate in PEM format (optional) + - `api-key`: the key to authenticate against the Elastic resource instead of a username and password (supported only for `elasticsearchRefs` in AgentSpec and in BeatSpec) This field cannot be used in combination with the other fields name, namespace or serviceName. type: string serviceName: @@ -7654,12 +7679,13 @@ kind: CustomResourceDefinition metadata: annotations: controller-gen.kubebuilder.io/version: v0.14.0 + helm.sh/resource-policy: keep labels: app.kubernetes.io/instance: 'logging' app.kubernetes.io/managed-by: 'Helm' app.kubernetes.io/name: 'eck-operator-crds' - app.kubernetes.io/version: '2.12.1' - helm.sh/chart: 'eck-operator-crds-2.12.1' + app.kubernetes.io/version: '2.13.0' + helm.sh/chart: 'eck-operator-crds-2.13.0' name: kibanas.kibana.k8s.elastic.co spec: group: kibana.k8s.elastic.co @@ -7741,7 +7767,8 @@ spec: - `url`: the URL to reach the Elastic resource - `username`: the username of the user to be authenticated to the Elastic resource - `password`: the password of the user to be authenticated to the Elastic resource - - `ca.crt`: the CA certificate in PEM format (optional). + - `ca.crt`: the CA certificate in PEM format (optional) + - `api-key`: the key to authenticate against the Elastic resource instead of a username and password (supported only for `elasticsearchRefs` in AgentSpec and in BeatSpec) This field cannot be used in combination with the other fields name, namespace or serviceName. type: string serviceName: @@ -7771,7 +7798,8 @@ spec: - `url`: the URL to reach the Elastic resource - `username`: the username of the user to be authenticated to the Elastic resource - `password`: the password of the user to be authenticated to the Elastic resource - - `ca.crt`: the CA certificate in PEM format (optional). + - `ca.crt`: the CA certificate in PEM format (optional) + - `api-key`: the key to authenticate against the Elastic resource instead of a username and password (supported only for `elasticsearchRefs` in AgentSpec and in BeatSpec) This field cannot be used in combination with the other fields name, namespace or serviceName. type: string serviceName: @@ -8229,7 +8257,8 @@ spec: - `url`: the URL to reach the Elastic resource - `username`: the username of the user to be authenticated to the Elastic resource - `password`: the password of the user to be authenticated to the Elastic resource - - `ca.crt`: the CA certificate in PEM format (optional). + - `ca.crt`: the CA certificate in PEM format (optional) + - `api-key`: the key to authenticate against the Elastic resource instead of a username and password (supported only for `elasticsearchRefs` in AgentSpec and in BeatSpec) This field cannot be used in combination with the other fields name, namespace or serviceName. type: string serviceName: @@ -8269,7 +8298,8 @@ spec: - `url`: the URL to reach the Elastic resource - `username`: the username of the user to be authenticated to the Elastic resource - `password`: the password of the user to be authenticated to the Elastic resource - - `ca.crt`: the CA certificate in PEM format (optional). + - `ca.crt`: the CA certificate in PEM format (optional) + - `api-key`: the key to authenticate against the Elastic resource instead of a username and password (supported only for `elasticsearchRefs` in AgentSpec and in BeatSpec) This field cannot be used in combination with the other fields name, namespace or serviceName. type: string serviceName: @@ -8952,12 +8982,13 @@ kind: CustomResourceDefinition metadata: annotations: controller-gen.kubebuilder.io/version: v0.14.0 + helm.sh/resource-policy: keep labels: app.kubernetes.io/instance: 'logging' app.kubernetes.io/managed-by: 'Helm' app.kubernetes.io/name: 'eck-operator-crds' - app.kubernetes.io/version: '2.12.1' - helm.sh/chart: 'eck-operator-crds-2.12.1' + app.kubernetes.io/version: '2.13.0' + helm.sh/chart: 'eck-operator-crds-2.13.0' name: logstashes.logstash.k8s.elastic.co spec: group: logstash.k8s.elastic.co @@ -9063,7 +9094,8 @@ spec: - `url`: the URL to reach the Elastic resource - `username`: the username of the user to be authenticated to the Elastic resource - `password`: the password of the user to be authenticated to the Elastic resource - - `ca.crt`: the CA certificate in PEM format (optional). + - `ca.crt`: the CA certificate in PEM format (optional) + - `api-key`: the key to authenticate against the Elastic resource instead of a username and password (supported only for `elasticsearchRefs` in AgentSpec and in BeatSpec) This field cannot be used in combination with the other fields name, namespace or serviceName. type: string serviceName: @@ -9112,7 +9144,8 @@ spec: - `url`: the URL to reach the Elastic resource - `username`: the username of the user to be authenticated to the Elastic resource - `password`: the password of the user to be authenticated to the Elastic resource - - `ca.crt`: the CA certificate in PEM format (optional). + - `ca.crt`: the CA certificate in PEM format (optional) + - `api-key`: the key to authenticate against the Elastic resource instead of a username and password (supported only for `elasticsearchRefs` in AgentSpec and in BeatSpec) This field cannot be used in combination with the other fields name, namespace or serviceName. type: string serviceName: @@ -9152,7 +9185,8 @@ spec: - `url`: the URL to reach the Elastic resource - `username`: the username of the user to be authenticated to the Elastic resource - `password`: the password of the user to be authenticated to the Elastic resource - - `ca.crt`: the CA certificate in PEM format (optional). + - `ca.crt`: the CA certificate in PEM format (optional) + - `api-key`: the key to authenticate against the Elastic resource instead of a username and password (supported only for `elasticsearchRefs` in AgentSpec and in BeatSpec) This field cannot be used in combination with the other fields name, namespace or serviceName. type: string serviceName: @@ -10172,12 +10206,13 @@ kind: CustomResourceDefinition metadata: annotations: controller-gen.kubebuilder.io/version: v0.14.0 + helm.sh/resource-policy: keep labels: app.kubernetes.io/instance: 'logging' app.kubernetes.io/managed-by: 'Helm' app.kubernetes.io/name: 'eck-operator-crds' - app.kubernetes.io/version: '2.12.1' - helm.sh/chart: 'eck-operator-crds-2.12.1' + app.kubernetes.io/version: '2.13.0' + helm.sh/chart: 'eck-operator-crds-2.13.0' name: stackconfigpolicies.stackconfigpolicy.k8s.elastic.co spec: group: stackconfigpolicy.k8s.elastic.co diff --git a/charts/kubezero-operators/charts/eck-operator/profile-disable-automounting-api.yaml b/charts/kubezero-operators/charts/eck-operator/profile-disable-automounting-api.yaml new file mode 100644 index 00000000..50f97157 --- /dev/null +++ b/charts/kubezero-operators/charts/eck-operator/profile-disable-automounting-api.yaml @@ -0,0 +1,29 @@ +automountServiceAccountToken: false + +serviceAccount: + automountServiceAccountToken: false + +volumeMounts: +- mountPath: /var/run/secrets/kubernetes.io/serviceaccount + name: serviceaccount-token + readOnly: true + +volumes: +- name: serviceaccount-token + projected: + defaultMode: 0444 + sources: + - serviceAccountToken: + expirationSeconds: 3607 + path: token + - configMap: + name: kube-root-ca.crt + items: + - key: ca.crt + path: ca.crt + - downwardAPI: + items: + - path: namespace + fieldRef: + apiVersion: v1 + fieldPath: metadata.namespace diff --git a/charts/kubezero-operators/charts/eck-operator/templates/_helpers.tpl b/charts/kubezero-operators/charts/eck-operator/templates/_helpers.tpl index 218f5742..ba1a7c83 100644 --- a/charts/kubezero-operators/charts/eck-operator/templates/_helpers.tpl +++ b/charts/kubezero-operators/charts/eck-operator/templates/_helpers.tpl @@ -96,6 +96,8 @@ Determine the name for the webhook secret {{- define "eck-operator.webhookSecretName" -}} {{- if .Values.global.manifestGen -}} elastic-webhook-server-cert +{{- else if .Values.webhook.certsSecret -}} +{{- .Values.webhook.certsSecret }} {{- else -}} {{- $name := include "eck-operator.name" . -}} {{ printf "%s-webhook-cert" $name | trunc 63 }} diff --git a/charts/kubezero-operators/charts/eck-operator/templates/configmap.yaml b/charts/kubezero-operators/charts/eck-operator/templates/configmap.yaml index bc13953a..32d66d81 100644 --- a/charts/kubezero-operators/charts/eck-operator/templates/configmap.yaml +++ b/charts/kubezero-operators/charts/eck-operator/templates/configmap.yaml @@ -79,6 +79,6 @@ data: {{- if not .Values.config.containerSuffix }} ubi-only: {{ .Values.config.ubiOnly }} {{- end }} - {{- with .Values.webhook.secret }} + {{- with .Values.webhook.certsSecret }} webhook-secret: {{ . }} {{- end }} diff --git a/charts/kubezero-operators/charts/eck-operator/templates/service-account.yaml b/charts/kubezero-operators/charts/eck-operator/templates/service-account.yaml index a8901590..f91acdcc 100644 --- a/charts/kubezero-operators/charts/eck-operator/templates/service-account.yaml +++ b/charts/kubezero-operators/charts/eck-operator/templates/service-account.yaml @@ -2,6 +2,7 @@ --- apiVersion: v1 kind: ServiceAccount +automountServiceAccountToken: {{ .Values.serviceAccount.automountServiceAccountToken }} metadata: name: {{ include "eck-operator.serviceAccountName" . }} namespace: {{ .Release.Namespace }} diff --git a/charts/kubezero-operators/charts/eck-operator/templates/statefulset.yaml b/charts/kubezero-operators/charts/eck-operator/templates/statefulset.yaml index 7f6a8f71..a970a17d 100644 --- a/charts/kubezero-operators/charts/eck-operator/templates/statefulset.yaml +++ b/charts/kubezero-operators/charts/eck-operator/templates/statefulset.yaml @@ -5,8 +5,15 @@ kind: StatefulSet metadata: name: {{ include "eck-operator.fullname" . }} namespace: {{ .Release.Namespace }} + {{- with .Values.statefulsetAnnotations }} + annotations: + {{- toYaml . | nindent 4 }} + {{- end }} labels: {{- include "eck-operator.labels" . | nindent 4 }} + {{- with .Values.statefulsetLabels }} + {{- toYaml . | nindent 4 }} + {{- end }} spec: selector: matchLabels: @@ -31,6 +38,7 @@ spec: spec: terminationGracePeriodSeconds: 10 serviceAccountName: {{ include "eck-operator.serviceAccountName" . }} + automountServiceAccountToken: {{ .Values.automountServiceAccountToken }} {{- with .Values.priorityClassName }} priorityClassName: {{ . }} {{- end }} @@ -121,11 +129,16 @@ spec: - "--tls-cert-file=/tls/tls.crt" - "--tls-private-key-file=/tls/tls.key" {{- end }} - {{- if .Values.config.metrics.secureMode.tls.certificateSecret }} + {{- if or .Values.config.metrics.secureMode.tls.certificateSecret .Values.config.metrics.secureMode.volumeMounts }} volumeMounts: - - mountPath: "/tls" - name: tls-certificate - readOnly: true + {{- with .Values.config.metrics.secureMode.volumeMounts }} + {{- toYaml . | nindent 12 }} + {{- end }} + {{- if .Values.config.metrics.secureMode.tls.certificateSecret }} + - mountPath: "/tls" + name: tls-certificate + readOnly: true + {{- end }} {{- end }} ports: - containerPort: {{ $metricsPort }} diff --git a/charts/kubezero-operators/charts/eck-operator/values.yaml b/charts/kubezero-operators/charts/eck-operator/values.yaml index 6a124650..7ed5334d 100644 --- a/charts/kubezero-operators/charts/eck-operator/values.yaml +++ b/charts/kubezero-operators/charts/eck-operator/values.yaml @@ -40,6 +40,12 @@ resources: cpu: 100m memory: 150Mi +# statefulsetAnnotations define the annotations that should be added to the operator StatefulSet. +statefulsetAnnotations: {} + +# statefulsetLabels define additional labels that should be added to the operator StatefulSet. +statefulsetLabels: {} + # podAnnotations define the annotations that should be added to the operator pod. podAnnotations: {} @@ -87,9 +93,14 @@ volumes: [] # createClusterScopedResources determines whether cluster-scoped resources (ClusterRoles, ClusterRoleBindings) should be created. createClusterScopedResources: true +# Automount API credentials for the Service Account into the pod. +automountServiceAccountToken: true + serviceAccount: # create specifies whether a service account should be created for the operator. create: true + # Specifies whether a service account should automount API credentials. + automountServiceAccountToken: true # annotations to add to the service account annotations: {} # name of the service account to use. If not set and create is true, a name is generated using the fullname template. @@ -129,7 +140,7 @@ webhook: # port is the port that the validating webhook binds to. port: 9443 # secret specifies the Kubernetes secret to be mounted into the path designated by the certsDir value to be used for webhook certificates. - secret: "" + certsSecret: "" # hostNetwork allows a Pod to use the Node network namespace. # This is required to allow for communication with the kube API when using some alternate CNIs in conjunction with webhook enabled. @@ -188,6 +199,8 @@ config: # serviceMonitorNamespaceSelector: {} # serviceMonitorSelectorNilUsesHelmValues: false enabled: false + # additional volume mounts for the kube-rbac-proxy container. + volumeMounts: [] tls: # certificateSecret is the name of the tls secret containing the custom TLS certificate and key for the secure metrics endpoint. # diff --git a/charts/kubezero-telemetry/README.md b/charts/kubezero-telemetry/README.md index 82898697..28553899 100644 --- a/charts/kubezero-telemetry/README.md +++ b/charts/kubezero-telemetry/README.md @@ -1,6 +1,6 @@ # kubezero-telemetry -![Version: 0.3.0](https://img.shields.io/badge/Version-0.3.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) +![Version: 0.3.3](https://img.shields.io/badge/Version-0.3.3-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) KubeZero Umbrella Chart for OpenTelemetry, Jaeger etc. @@ -19,10 +19,10 @@ Kubernetes: `>= 1.26.0` | Repository | Name | Version | |------------|------|---------| | https://cdn.zero-downtime.net/charts/ | kubezero-lib | >= 0.1.6 | -| https://fluent.github.io/helm-charts | fluent-bit | 0.46.2 | +| https://fluent.github.io/helm-charts | fluent-bit | 0.47.1 | | https://fluent.github.io/helm-charts | fluentd | 0.5.2 | -| https://jaegertracing.github.io/helm-charts | jaeger | 3.0.8 | -| https://open-telemetry.github.io/opentelemetry-helm-charts | opentelemetry-collector | 0.92.0 | +| https://jaegertracing.github.io/helm-charts | jaeger | 3.1.1 | +| https://open-telemetry.github.io/opentelemetry-helm-charts | opentelemetry-collector | 0.97.1 | ## Values @@ -100,6 +100,7 @@ Kubernetes: `>= 1.26.0` | fluentd.volumes[0].secret.items[0].path | string | `"ca.crt"` | | | fluentd.volumes[0].secret.secretName | string | `"telemetry-nodes-http-tls"` | | | jaeger.agent.enabled | bool | `false` | | +| jaeger.collector.enabled | bool | `false` | | | jaeger.collector.extraEnv[0].name | string | `"ES_TAGS_AS_FIELDS_ALL"` | | | jaeger.collector.extraEnv[0].value | string | `"true"` | | | jaeger.collector.service.otlp.grpc.name | string | `"otlp-grpc"` | | @@ -128,9 +129,41 @@ Kubernetes: `>= 1.26.0` | opensearch.dashboard.istio.url | string | `"telemetry-dashboard.example.com"` | | | opensearch.nodeSets | list | `[]` | | | opensearch.prometheus | bool | `false` | | -| opensearch.version | string | `"2.14.0"` | | +| opensearch.version | string | `"2.15.0"` | | +| opentelemetry-collector.config.exporters.opensearch/trace.http.auth.authenticator | string | `"basicauth/client"` | | +| opentelemetry-collector.config.exporters.opensearch/trace.http.endpoint | string | `"https://telemetry:9200"` | | +| opentelemetry-collector.config.exporters.opensearch/trace.http.tls.insecure | bool | `false` | | +| opentelemetry-collector.config.exporters.opensearch/trace.http.tls.insecure_skip_verify | bool | `true` | | +| opentelemetry-collector.config.extensions.basicauth/client.client_auth.password | string | `"admin"` | | +| opentelemetry-collector.config.extensions.basicauth/client.client_auth.username | string | `"admin"` | | +| opentelemetry-collector.config.extensions.health_check.endpoint | string | `"${env:MY_POD_IP}:13133"` | | +| opentelemetry-collector.config.extensions.memory_ballast | object | `{}` | | +| opentelemetry-collector.config.processors.batch | object | `{}` | | +| opentelemetry-collector.config.processors.memory_limiter | string | `nil` | | +| opentelemetry-collector.config.receivers.jaeger | string | `nil` | | +| opentelemetry-collector.config.receivers.otlp.protocols.grpc.endpoint | string | `"${env:MY_POD_IP}:4317"` | | +| opentelemetry-collector.config.receivers.otlp.protocols.http.endpoint | string | `"${env:MY_POD_IP}:4318"` | | +| opentelemetry-collector.config.receivers.zipkin | string | `nil` | | +| opentelemetry-collector.config.service.extensions[0] | string | `"health_check"` | | +| opentelemetry-collector.config.service.extensions[1] | string | `"memory_ballast"` | | +| opentelemetry-collector.config.service.extensions[2] | string | `"basicauth/client"` | | +| opentelemetry-collector.config.service.pipelines.logs | string | `nil` | | +| opentelemetry-collector.config.service.pipelines.metrics | string | `nil` | | +| opentelemetry-collector.config.service.pipelines.traces.exporters[0] | string | `"opensearch/trace"` | | +| opentelemetry-collector.config.service.pipelines.traces.processors[0] | string | `"memory_limiter"` | | +| opentelemetry-collector.config.service.pipelines.traces.processors[1] | string | `"batch"` | | +| opentelemetry-collector.config.service.pipelines.traces.receivers[0] | string | `"otlp"` | | +| opentelemetry-collector.config.service.telemetry.metrics.address | string | `"${env:MY_POD_IP}:8888"` | | | opentelemetry-collector.enabled | bool | `false` | | +| opentelemetry-collector.image.repository | string | `"otel/opentelemetry-collector-contrib"` | | | opentelemetry-collector.mode | string | `"deployment"` | | +| opentelemetry-collector.podDisruptionBudget.enabled | bool | `false` | | +| opentelemetry-collector.ports.jaeger-compact.enabled | bool | `false` | | +| opentelemetry-collector.ports.jaeger-grpc.enabled | bool | `false` | | +| opentelemetry-collector.ports.jaeger-thrift.enabled | bool | `false` | | +| opentelemetry-collector.ports.metrics.enabled | bool | `true` | | +| opentelemetry-collector.ports.zipkin.enabled | bool | `false` | | +| opentelemetry-collector.serviceMonitor.enabled | bool | `false` | | ## Resources - https://opensearch.org/docs/latest/dashboards/branding/#condensed-header diff --git a/charts/kubezero-telemetry/charts/fluent-bit/Chart.yaml b/charts/kubezero-telemetry/charts/fluent-bit/Chart.yaml index 1b1c6fe8..4c989883 100644 --- a/charts/kubezero-telemetry/charts/fluent-bit/Chart.yaml +++ b/charts/kubezero-telemetry/charts/fluent-bit/Chart.yaml @@ -1,9 +1,9 @@ annotations: artifacthub.io/changes: | - kind: changed - description: "Updated _Fluent Bit_ OCI image to [v3.0.2](https://github.com/fluent/fluent-bit/releases/tag/v3.0.2)." + description: "Updated Fluent Bit OCI image to v3.1.1." apiVersion: v1 -appVersion: 3.0.2 +appVersion: 3.1.1 description: Fast and lightweight log processor and forwarder or Linux, OSX and BSD family operating systems. home: https://fluentbit.io/ @@ -24,4 +24,4 @@ maintainers: name: fluent-bit sources: - https://github.com/fluent/fluent-bit/ -version: 0.46.2 +version: 0.47.1 diff --git a/charts/kubezero-telemetry/charts/fluent-bit/dashboards/fluent-bit.json b/charts/kubezero-telemetry/charts/fluent-bit/dashboards/fluent-bit.json index b0024d31..803014fd 100644 --- a/charts/kubezero-telemetry/charts/fluent-bit/dashboards/fluent-bit.json +++ b/charts/kubezero-telemetry/charts/fluent-bit/dashboards/fluent-bit.json @@ -1559,7 +1559,7 @@ }, "timezone": "", "title": "{{ include "fluent-bit.fullname" . }}", - "uid": "d557c8f6-cac1-445f-8ade-4c351a9076b1", + "uid": null, "version": 7, "weekStart": "" -} \ No newline at end of file +} diff --git a/charts/kubezero-telemetry/charts/fluent-bit/templates/_pod.tpl b/charts/kubezero-telemetry/charts/fluent-bit/templates/_pod.tpl index 7f74f4a5..18258a75 100644 --- a/charts/kubezero-telemetry/charts/fluent-bit/templates/_pod.tpl +++ b/charts/kubezero-telemetry/charts/fluent-bit/templates/_pod.tpl @@ -119,7 +119,11 @@ containers: {{- end }} {{- end }} {{- if .Values.extraContainers }} - {{- toYaml .Values.extraContainers | nindent 2 }} + {{- if kindIs "string" .Values.extraContainers }} + {{- tpl .Values.extraContainers $ | nindent 2 }} + {{- else }} + {{- toYaml .Values.extraContainers | nindent 2 }} + {{- end -}} {{- end }} volumes: - name: config diff --git a/charts/kubezero-telemetry/charts/fluent-bit/templates/service.yaml b/charts/kubezero-telemetry/charts/fluent-bit/templates/service.yaml index 3f9c8f70..2a771e69 100644 --- a/charts/kubezero-telemetry/charts/fluent-bit/templates/service.yaml +++ b/charts/kubezero-telemetry/charts/fluent-bit/templates/service.yaml @@ -17,6 +17,9 @@ spec: {{- if and (eq .Values.service.type "ClusterIP") (.Values.service.clusterIP) }} clusterIP: {{ .Values.service.clusterIP }} {{- end }} + {{- if .Values.service.externalIPs }} + externalIPs: {{- toYaml .Values.service.externalIPs | nindent 4 }} + {{- end }} {{- if (eq .Values.kind "DaemonSet") }} {{- with .Values.service.internalTrafficPolicy }} internalTrafficPolicy: {{ . }} diff --git a/charts/kubezero-telemetry/charts/fluent-bit/values.yaml b/charts/kubezero-telemetry/charts/fluent-bit/values.yaml index 1a60fe7b..ae242086 100644 --- a/charts/kubezero-telemetry/charts/fluent-bit/values.yaml +++ b/charts/kubezero-telemetry/charts/fluent-bit/values.yaml @@ -101,6 +101,10 @@ service: # prometheus.io/path: "/api/v1/metrics/prometheus" # prometheus.io/port: "2020" # prometheus.io/scrape: "true" + externalIPs: [] + # externalIPs: + # - 2.2.2.2 + serviceMonitor: enabled: false @@ -314,11 +318,21 @@ envWithTpl: [] envFrom: [] +# This supports either a structured array or a templatable string extraContainers: [] + +# Array mode +# extraContainers: # - name: do-something # image: busybox # command: ['do', 'something'] +# String mode +# extraContainers: |- +# - name: do-something +# image: bitnami/kubectl:{{ .Capabilities.KubeVersion.Major }}.{{ .Capabilities.KubeVersion.Minor }} +# command: ['kubectl', 'version'] + flush: 1 metricsPort: 2020 diff --git a/charts/kubezero-telemetry/dashboards.yaml b/charts/kubezero-telemetry/dashboards.yaml index dfeef645..bc5ed7ed 100644 --- a/charts/kubezero-telemetry/dashboards.yaml +++ b/charts/kubezero-telemetry/dashboards.yaml @@ -3,11 +3,11 @@ gzip: true folder: Telemetry #condition: '.Values.telemetry.metrics.enabled' dashboards: -- name: jaeger - url: https://grafana.com/api/dashboards/10001/revisions/2/download - tags: - - Jaeger - - Telemetry +#- name: jaeger +# url: https://grafana.com/api/dashboards/10001/revisions/2/download +# tags: +# - Jaeger +# - Telemetry - name: opensearch url: https://grafana.com/api/dashboards/15178/revisions/2/download tags: diff --git a/charts/kubezero-telemetry/templates/grafana-dashboards.yaml b/charts/kubezero-telemetry/templates/grafana-dashboards.yaml index 6174cc01..02e92a84 100644 --- a/charts/kubezero-telemetry/templates/grafana-dashboards.yaml +++ b/charts/kubezero-telemetry/templates/grafana-dashboards.yaml @@ -9,8 +9,6 @@ metadata: annotations: k8s-sidecar-target-directory: Telemetry binaryData: - jaeger.json.gz: - H4sIAAAAAAAC/+2dW3PbuBmG7/0rWF507K1sS7LlOJ3Zab3JppNOmmSTbHuRzXAgEpZQUwADgo4Vj/rbC/AgHiX6JFly3ptEBEACePHhw2McyOsdy7Idh/EgUqH9V+uzvras6/hfHcPJhOpQ++VH5/2Hdy9/f/Hp9bu3+2e/250shU+G1DdJAim8yFVM8H0S5fEeDV3JAhNuUuURahrEj/aIIqGIpEvzuMCPRoy/9tLnTqga0yisxr9NC/c+TxEnmOl/v3SSikn6NWKSNlQty38kyTnhJH848xqDMyn+UY24pDJMa3dy0D3opoXoNGcXEK71qmcWjBuzKgYXMhq0Z9SkK1uoKK9r2ZbvXGXCuVDEtLCROSmI7bNQzUXPi6djhhHz1WvzuF4nDy0Ut7kYOg3lZOibeCUjWggfM68hlLmCvxC+kOaBcjQku92O1e/19D+DQcfq7RUfndX/LK+L9WfrzKdSlYqQqxuOh4JIz07jZvH/X3bSBqna/cssvXUupDURnCkhGR9Z/yV0RKUlI87NJeMWsS5OQ4vySyYFn1CuDqz/CHkRWt+YGlu9g+d/ObBeUeoNiXsR/s1671MSUiuk3LOUsPxI8NHBpfg7nQS+mJr7x1SKA1dM4nrY1GOqIqM94lTFva3X7XZ7SZCxvU9C+IoFOqIbB8b2wyPfj698xi/ijpWYQWzZDR3NFb5PgpB6lSbSWTDvvchtJmnLil1809f940LAVVaa9HpqrrNGKFv6UT/3GOXClU3S2LDPSBhbS1yeWacYOSRx6DnxQ1qKMFbwhvKRikvdrcXRRbe12rpOdc58vyzGAs3muj3rlMOMdqeVsIp8cwmP+oWwcvUTLY9LYb62Wu7Vi0EuR01VNmYQSamNcUHshFwtimF8QUw4Ft9q3T7ppboP+wvuuiR+lLfLwkpr445TVZ8eR3xjnhrX2qbcH3LXovvLe8G4+peI3VQcUG7qgLh0kR0FVNsJV2REG20pME+WxGORyXpQj2s2Qd0UHpU09o3nvlDl8oRUMhq+045fmxttqFO4rMSh0p6pMddQ0SCg3hstYWO8InJEVbmbVrtqMhJcBXHRw2iyK4miu4kbdYyvoa52rY4uIQ/18O9Sdkk9J7aIz4PJl709u1N9mnbJE2Is01ZsQp2k9vVk6TDTYFSmk3BFpbatV8RkX7WNQp95Nc+snoOk5wn0nNmlqFnhqtwQaqzhZix8r6GRTGVeaedS8NmluA90lI7ZDTd+HLNz1XynigcP+6NR2PqQKnwYUrdsRGo+eFxX+y2RtdEgixNSNXiouNM62eDLuMcumRfpPr6w/xbwrsBQiQskV6zBgw4j9yIxvmqdjRdK+66RptJuGTs03LXYQ8290OcvC6swJVf0Bn0ht16dnVR1q8oQvV5AEylGv2h+aDTYxCk33pZ45caoQqXLRtx5IvVY2BmnzYal2WK0aAyL497Qy3nFdpoyKkj341LL6V2o5QTUAmrZNGqpwQrjzteI6hHO1yzD3amjucY6tNrTuSLiCkDzMEBzpi1HG6z+G3w/VtlKVbZ2NdvsAW4AN4AbwM1q4KZ3cge6Oe6DbkA3G083Q6LcsROy7/TOpPLjwcgvRjTroxZN44eZaQGAAEAAIACQda4JPW+ZXTkFf4A/Np4/0imTpGSYK3kQPPktniBJWtva/QhAAaAAUAAo617+aQGU4y4ABYCyaYCybMOKJ4XJrLBfBXMmt9yR8jKREBtSQCQgEhDJutds2pAE+2iBJJs/ZxKSy9bdKKU099uJ8mOyimUUxC4TEAuIZfXEslPJLu+K/0yOYL3IHFv9jKLU1Wg8bLeGs029BWebuj/W2aaTe6xj9ZYjGVaxQGQbR2TVk01aJa4cDSwaLJzICwxK6Vo4urhmyHUCKVwahuWjTtZQY4WOUUI7qpXOJG0Ve91WUkwlAcwAZphKWh21nN6eWvpY2wK2bBy2aHO7GbHE+4EBKM2AcksVwSZgE7AJ2GQ1bNK4zNUGJ1jlApxsI5wke4XBJneePMkFBJWASkAloJL1rfM8a4ESvAwGULK1Cz2SEs/RtdG9G0s896WUgphY3AGqAFWAKutd3GlDFbzZBaiy9XtS6oeZgCv32pHi4WgTkAXIAmR5lDWfNmbBPlowy/Yxi8r2eQrpjAn3fJ0I0yz35JbFooJdwC5gF7DLmk8AHS1nF6wMAV22BF0kDbTXo+lrdWnohNFwwpRqmGdJPCU+eLQS2HE113DqL2kPoA5QB6gD1FnzsaEW1OmBdcA628Y6ycvxVkc6T3tepoYqFTkBKgAVgApAZd1niNpIBZtgQCobRyq1Q0TlCYDC2SFASRlK6sevmudQcKgZQAIgAZCsfZGo7dW9wBHgyHZMnIyVKpx1+aqbW9W3s5hRDZ8XuOOkSpPCmEcBtgBbgC1rXvBpwZYeuAXcsq2bW84J8yM94mPF52E2p2R6AlWAKkAVoMq6l3zaWAVniMAq27k5BaTykHtTwCngFHAKOOVxVoL6g5ajzqAUUMr2rQQtONac9L6OpcuqonCtK0LX10nms9mB/hnnP5s91WUiHIAG0YBoQDQPSTS1WZZFq0RtSNPD54TANBvJNKXxNP/6dCDF1TRhmQRjdI1jQTrZa1o6GgEiHzMvczKJxVqqJ3bdgkxAJuv5/rSkASXVDlv7KvWZ6aab9UXqfvMXqY9PfqwvUj9rwLHyd4+WzDC1HH06Xu06mHmxx6+TQE2bPRtgDbB2B1jLyEIGbrYl1vGJotydOhrkrENrSQJXRFzt/dTrdrvYknxjojvTVqGN0UrVtFI1rd2JdmcspK7gXgioA9QB6jDd9AB8c+OjVN3lfDPAbBMAZuNX0AynxAs4TUeofjrpbsyL9c58P0OA0No91Ea+dwuw6TyoOukyngY6j/78vz/s/tXVH/bs/prdQRadtfXhxrL8sjZZ/vTzo8ryVvD920nzYgtQOKuNqYu1W+wR4F/wL/gX/Lsi/j29C/9iBxn4d1v59zpbaTV4d0gCdqglc2n4WDyzUfS7UJsOuPjugoGYV07M83aoNAPoGfQMegY9r4iem4+JtuEzXmkBfH5q+Hy4H///+uU+QPpmKgGpH0Q6wPUjwXWxQYDZwGxgNjD7lph92nQmqH/TXRotX3Qe4FNBwOyng9nmGC6Lh9301/6h0EoTZcZ5MPcdJAOAP7yOoPG103hL6wDNgeZAc6D5qtC8FngjNsebEsHmT4/NgeHL1QFx30sywPWjwTU4GhwNjl7XyyWqr5H4LaJyuuw1Ejvp3cb1GE9iYo+6iduzQ3dMJ+TfVIbaT8xf063xYZpk4hF5kaTUXJSbZJp5mq39ifpUs7UuxzwzRSeBr//O5qO5LBrbQpUZ/ixJxeIOlMafJ57M5uLbfi/rutqbpGF26baA6U4r85vT2jmZ8y72H3uQe3m71y1cHBUvepP896Dwu1e8OOoWY3IHY/cLv3teIv6XrA5muBGBypxxay7FB58UH1zMpX9cvPDy38+8YnmzspTk+y5iMrTTxi0bVRIYxX+O2N/fvGPPB1eT1A4u57Zy1N2Z/R92O4kbZvgAAA== opensearch.json.gz: H4sIAAAAAAAC/+1dWXPbOLZ+71/B4WSm45TaEWVJlrsqD7YT9+TejuO2nZ5UJR4VREISYi4KSNpW+/r+9jkASRHcJFKWJSrGgxcCIJaDs3w4AA7vf1IUtd8n9sT3XPVX5Qs8K8o9/w05NrIwpKpvL/pn5x8/vLv817tPF2ojyjbRAJssf0IdC3tj7LtxpoFdnZKJRxybFTmbFVEM5CHX8amO49LedMJbysubmP6I2O+NopaC/NOwr3FDKi/wAL+vGsE4Kf7uE4pzRhq1P6JoiGwUV06M3OSIMr+lM24wdcMh7+92drVm2ItGfnsTZAMJs61NxrlticlCS/PbyKMpKaSmnaVjXpPabnN3mbG5xB6Z2PWQl23yIiev9CjzW8tvZ0ELM45Btu1AWchlLBM0qZrE9WYMFHcEcgY+Mb33rCatEacK5M8nK5TBNhqYLN+jPhbSx8TISSW6Yx87pkNZhXQ0QC+bDaWlafCr02ko2o5YdTTow3gsyj+VQxNTL9GFmFvc8cBB1FDDvAf+9+qnkPRpwf44wfYFRlQfK7rpux6miuXYxHMozKZyS7yxIhQR1MC7u4lDWXFkG8qpY+BZCu+Wig3ipaiijmzscUWgdbT9XpDEpOLScUyPTCCjyRP57Nu+aQZPUCcK+6t19zr7+51Wt9fu7vFck9jXXCMEc875KEdD6I5poomLWc1DZLo41nTiBEeN8pwRJcaZE/NOMKcp/riF51ZbSLiLhhE+T9lzNBlJBu/FSnDW7atYqRKPk089DiYmq26pc5svVTrSx/iSWNjxvfSoFjJ0mkXijCHBpnHs2EMyShLFwEPkm16SVAHVOZuLiZBsOVwuVG8M2nzsmIarCgUeGmIVFppMgBVdQWbTkhv1DoaS6G8scUZy0iIy4jsvUNgY29m3PCe/tpD62fpukOnzcTXVRNZD41EdbxV2fIpNE1hghT3XVtrzvcKeUxDEFXa7leq28HSV4CaB4wq5Eg1cx/Q9nOoIWCM8ybJhlioC3xewltB1Jpqp3IdGhQZcbJFfDESvf1nYVHM17RQwndCQtpqG8nhEaKWVbiXxfPVTXo7QE9UB5AAKPoCTVxkFXaj891LKX2stUP5avvJvxUA8YcKCzk2SsCWm0YeQSwdIvx5Rx7dFIgXmNCqCKEZi5jcwI2Q4nWX7IHAiQSjBthdZ2kw2TIev4485HeMGx9SzsgFLDNc7dbxTYHK1UCa5VXEzoh9MtBvZ69w5DNXJfTotMcQM+YMVx58ZqB/bV0RH2EuOJzFcfIetiYloBtzxvEnAyL710gHo5HLo1A/RVZ9hWt+9Dx/f/P9X9UX4/1f1YUd5regwp17emzYMyu3bvjXAtOj9JAWJDclAxixto5wTpHtc7hJGRjXxCNvGiUMt5GVf/u5jOr2MMAjgP8f6NzKvk4UoHgZrvsN45iNBFDGOhU8CI5IAKSz9YkyGXjYjCYqUC07PLDbia4dccLTFAGizxixWzQOmgitatQ2p5zQ0T6jrOeq5XUEXB8OWajjz2gX5i42x0y18rcaauoy+XZe+3gKFfO7bNvMZMF/AivWxVLvbr3a75dRuV6rdZ652mTp4rOotW0cN1W+oTQ91j9xg5S0MRGrUrfPKLHBd9Jo11dKtkr4LrSnV9DNX05BigDT3QdNcP0ZVV6mnvur6LBiFcslGUUVVb3Zfql0g3q1yG1MXY0QNt8K+lHS9LGmx6Gjwku8OR792tnQdkObATgEHSvfLczcwLlcucy1CgymcN19VxMHyIkuzVIW1XyEU6WC5Onh2uraT0rXtkrpW+lykrq2oGvsTSixEpyvXuWLFtde9Z0Ffn0QHSyD8RMp5ucMoDnDOCFc69VITK3BQ0gr0pBWQVqCssiY28QgyyV+gFVZoA9LV1tcCvBd6KjG4VPMbV/NaSbTfkq57qedLK2SKTUeHKVuplk9WWl8dfz7rp0T4UvX/qjR3O2s52V5bE1NyKdFqSRMjTUxZa+DbyHXJyMbGCk1MstL6mphPs34uYWI2u3fcKxD+brm9Y3aoqcLOMSy1kMtvzbqJCx/qAFE3Z/zu+Hdsj7xx8rAKS8fufHIV2GqdWIgPplVkwI+QS3Tl+OyTQuyh8whzHt8HWka9D4lpJu6WsoTfKDKYahTnsZgXelWvOB1kejEmhsGuDYNCztI7YJR4izdXIkNpTPYO3YzStTFB8CkNBpfOsdBdXiqxc1IB5Nxmb2t7jsc7li6dq9ofxDtdPFesjSfeEsNLyJvK5PPMARpE+pwlqPNNKGIXwC8jZBa2kzUBGFga7OEofQt9sXGYsA4xpvGTPM/TszMK5DcwxdwkDE1HuJ/vchb4KPJsvrXhEs7ef/2fI9+dKu+dW0S810n1OgNTfz9ua92WqGQbC6t9b5i4sL5O97DbPqpUH+/mxRQsj1VY7bvmUbvZrF7tJ6BbYaXaSbd53K5e6UfQasW19k72jo5688yWO0E6ztOrYKP06zSPMfA/wcbvwPQZfimBPWb4QhlMlZfEhjZsHe+8JBR5+CU73dvXJ37fxbpjAyrgcnrPFiRg/l0+KQAHotcYSth99YK9tfsK0r85Ayj2Av4APvjSsa52dpRXMKLm0hfo2nORhMAqyv191KuHhxLgobF6Av3sA3f9XC/iMIYvQ5qjJyYN4WqnZsQJdGEZ8hw/LXk4MQj9XjfRen/+h1uGPG+rkWcxRf4GHANm5edG+BBIVvgQqKHZY8Ra0SP9Hpd0hh5/rhVVub1QeCcK6PmuOruxEZeTRE7XuhCEgYe5pDiZu+ATnWhfyl23O8ejEPilXlhwMRoWIHwpIqyuZvF17kW4iyg2soDXdaiXgvgc6/ajNRqxDXJDDB+ZWaeDEIhLDHZ1h+5ICsEOfP06QADiMESvJYw0JxJSqnQ+aJ+B85z10RTdzYOhL16MYZH4v5gta1Rn8A3r3q+atneQnPXhjC+gA9RLuRHCwGrJrrIMZwQzk4llEq5SMsWDZUomWRjyQuHLH027WbvRpBxkGQGaZjkI0O0obx3H03/HN7NeJyJh1c6xkONDsLF369Br7kdQYBGncF01RGIIuM14FbSn9CpkruYv5VboSQfC0zgQksTeqAehwpI02cpK1qQCdgkltU+xjtnpxcHUwxGKKY9cXvWeCLRAt24AFhv4hjBQvOKlZw4dYMJt1yJe3QjB+1WREkc1AXSnoTW4pGg4BOsgwd3S4G5bYFvt+rk+PLbZTS1tP39Xa69ZblfrraP7FrY9d3u2tkoByfUixYPKIfZ6SyDFvdZ8pMjY9tC9zA/tG+DIVGIMI1MZgQSmE7n8pRX0chgyF70thJAtCSHXDiErH6lgFlkHLGVhqDuEVH3D0d0+Pyix5kiAWQW38rMR60NWs8Eo74Fz7oRTWRJVPdZl1uz2NuZkUlP+rUd7zJrduvv/no3DLCeufJBOKVdfyfpq7SVLkm95NJQNabkMHOp0JRyaE5E5g5B0x7ZBOYhGoxYwqfO8YZILKAb3XfJX6Iwrh49ifc5saD8gxBNBKI41FH68twgeJfU9UJKvXZv1QE05/c+HS5Z7jvm9gIBvM6K9JJgCzOabiF3Afi5gqrvfKmJXzuPq41FGc6WAqbu/VwUvSVi0Hi9OrbYDKzt5WvvLoJrec0c1WiVUU0O/z3MBNHw3LQfREGZvWYhE/s9cr88XbXy19G2X+3uFbc0ppbYGa+W2Uc6Rh6XvZlVwY7+zv4S3I56W165aw2NP+52e9OFIsPJEYCXjg1kKrXSbEq1ItLLVaCV8HGKP3dx99ljlD7YxJvHJSvFJr91aBp+wqSA1BSe99p4EJ3KDaTMbTL2qp6T2ullsg8lonAyaUAbvtJ7JYW25tbTFW0sMLiBjAla7xFcqGgqzjH978xW40QaasxUxSw0Dk3z3sR9EKmd34VjRpzqpcwp1A7fc8/7MA0q13mz6g9FLOWY4Uu42rQdetbS9Tj12bxqVOt19bltOG/52TMHHY/baJT8ewy9HVzgnrSN9jC9BThw/oy94FIuj+JPYaYLw/D/D+Go5WUkRYTHo0MtWu9NQOu3gp7l7sJMIJcZL7O03FK110FDaTVakl1OmAznafguKdHgt+ztqhkM2AkqroM6C7WZ1hHyOKu4TGCyis9ZsJmFYlNHMqrS0JMxMzO9srePOK/EB0WtMC11OpcPddRcxfKcU6g2EoJsX3CjBsjlAMAzCGJ6j1fLS5+jy0GQE5kDxHIWHlsvGo0tEGCzSsVFlPCji/Mpac3QfcAP7hOFZBBcFligFe1mZyyBCXoJ4E8f1huQuSfkw8cSxvTB4ntpp/kPIB9CTeYenFb7Ch/8BTebdKQoAT9IXGXBo0HH19HUKZHnO7IX50XbotRmAXIF12YrvWAiWiV7uaaBitB786h0wHaP1Empo6Jt5SxpWs1hPUE2LqauDvUQFWTMnQCCmlaAa30oFMV0ZEOf3Cy1sOXTa/4CtS37+PTjaJV4snF0rnHf0XesVxYcoCaof7W0UKRRZQj4k5QMfYk78P5B8E/MogLM8Lnoi0/ZEpuW585nWYeBZfVOSXyNJX8iyvOBpqDqidbo05tKYb9yYdx9jzHvSmEtjLo15uXB9aYN9QjH+ce21woYnjbY02tJor95oZw7VVLHa7aa02tJqS6u9nNU+vEHEZBX/wKZ7NkZpv6X9lvb7Cex37zH2uyXtt7Tf0n5Xsd8wMBwEne4PFyy7G4rFDlXwgzxvvqqvt9eavyXu9fOz5fKU5IZPSS68r9peJgpHuy1PRMoTkdt0IpL/+6gzkWBByM3cQ5HrDM/xY5ybvOTTopzBFLny4OSaYp5VC3lWj48BVItsJu+XSOS0euSU9fMvFcCsKaGThE61vyibg53mXJNdAJ0o/sbnNgqg/0SYKL5u+6MAI0Z/JaAer0VCpLVApLZ2sHUQqd1qSoi0Voj0DIKZdbrLOIe6z+7bRjIKyMbATWBXDkejZJl0uZg91WRYhnA0nkfsUVpicwAK8j1HTRV5yNQXmUVQIrg/Jq7ngIG0ku89CE9XCbVquFGMemwi1yN6gMnURlVQB6I2/xOW+eclwu9UDqbBVzDzPli5WldXexGss/KiqIBCpkTPkKk/AOjENor7kM34Ku+t0syiqYWTy/Fw2TldDDyTezQMUjL7wiUPEdOnAMhgsqxJTULGHN6MdhX2Fc9PLtNEMmzMqu4199rLRIBT1fp9kACGIj9IIP15W/NBguXQbh1D91J2WumCGHh1GFl+rODHdwICO/aZqPaZPRS9gd9uLHbqtj/GaNL3XWzM/WrBF40BSOW1UlQDMPLcCja3rVoiYl+t/YaAypR/AYkVYiswC6AbpMtwPbuq7XZhOJpQEfk2WQV40578uwgwlq789LoEbttyhK3bWWYfVn5XU2KzLTvbltmkZd8Ln4BC7tO7PvSXWcv50Yy5Z29z8Or88/KwqvFUtPOq0E55pfyibY6Al58LPwNfa1x6/vn15WceYFrpWBKTrgeTdprtrdvG7jQ7chtbAsyanfRbDmHKSxISSNYPSJI0EmKuuZHeZ3Fag3Nm/RDH8J3ieWhoLef4RvrWeuN+O1ZCKkrIs6bd04NOa/uiQh90fvwPkf4UVqu6+hhbKFbLrf0g2Zua4ZkZes0HDOpOONSjfpwwcyschFEvsYnZcY6pOqvc4/qPneWZdRqMkusJXHSfZ2wTc+RiMzBQmUEKt2cnWSiVvEQrFMhFPmAodEomocinhCUCX6nkcbClJ0o8sUEpG/gw/+p3rmtWBa3gkZziUSwAATSKUG1mpb8IZ1vYtwLotJAiQXYUEEJNhM3AQ6aJU1G9KRiDu3RR95pMPlHzYmrreREi4tNWUbfTuiTBv2bUnRRZBHZITNQiCB2gX2KTcC4DsvcD1SZa2tB89tktb9+FRpQwZUfdDsYIu1uBKxKCNWOVRxFIBAAXHrJBYRh/IkrYIoZ/yCpf3lbGbjlmFzQV5yn3j2iEajI3Qx+Wll84ZOaAVkKG7+LLoKJcmL5BDueHC33GI31iD537b86AocXdV9f+AFMbe9jdffV/u694OYChQD/Q/vyoYUOBwhvjfvV/nIFagf2/JYs/nvVXSbmaiEVHisWcyYU1FPzh08ey05fI18v9p2yRxXk7RwZSOD0SgajXTy8HC0gl2X2L2D2ewjfhQXP2P5/b6Aj65sTgfdiDKpaADWF9IlCRfFI0RNHgf5lz4SFYIRIrjrMVx/Rybn/RZgvLMGxX8Imf+LUJ0a+5++8+TvvL4X46dUCdWzdExrEDKF6zKil5Uv3gfsFn7d8Xt9cn++GS9yZeFnPyCZOi7jVhJfnwXxIW2TBO7wAA fluent-logging.json.gz: diff --git a/charts/kubezero-telemetry/values.yaml b/charts/kubezero-telemetry/values.yaml index f4172347..10a8367d 100644 --- a/charts/kubezero-telemetry/values.yaml +++ b/charts/kubezero-telemetry/values.yaml @@ -3,6 +3,74 @@ opentelemetry-collector: mode: deployment + image: + repository: "otel/opentelemetry-collector-contrib" + + config: + extensions: + health_check: + endpoint: ${env:MY_POD_IP}:13133 + memory_ballast: {} + + exporters: + otlp/jaeger: + endpoint: telemetry-jaeger-collector:4317 + tls: + insecure: true + + processors: + batch: {} + # If set to null, will be overridden with values based on k8s resource limits + memory_limiter: null + + receivers: + jaeger: null + zipkin: null + otlp: + protocols: + grpc: + endpoint: ${env:MY_POD_IP}:4317 + http: + endpoint: ${env:MY_POD_IP}:4318 + service: + telemetry: + metrics: + address: ${env:MY_POD_IP}:8888 + extensions: + - health_check + - memory_ballast + pipelines: + metrics: null + logs: null + traces: + exporters: + - otlp/jaeger + processors: + - memory_limiter + - batch + receivers: + - otlp + + ports: + jaeger-compact: + enabled: false + jaeger-thrift: + enabled: false + jaeger-grpc: + enabled: false + zipkin: + enabled: false + metrics: + enabled: true + + serviceMonitor: + enabled: false + + podDisruptionBudget: + enabled: false + # minAvailable: 2 + # maxUnavailable: 1 + jaeger: enabled: false @@ -15,12 +83,12 @@ jaeger: grpc: name: otlp-grpc port: 4317 - http: - name: otlp-http - port: 4318 - extraEnv: - - name: ES_TAGS_AS_FIELDS_ALL - value: "true" + # http: + # name: otlp-http + # port: 4318 + #extraEnv: + # - name: ES_TAGS_AS_FIELDS_ALL + # value: "true" serviceMonitor: enabled: false @@ -52,7 +120,7 @@ jaeger: url: jaeger.example.com opensearch: - version: 2.14.0 + version: 2.15.0 prometheus: false # custom cluster settings @@ -302,6 +370,15 @@ fluent-bit: testFramework: enabled: false + service: + internalTrafficPolicy: Local + + extraPorts: + - name: otel + port: 4318 + containerPort: 4318 + protocol: TCP + serviceMonitor: enabled: false @@ -327,6 +404,9 @@ fluent-bit: sharedKey: secretref+k8s://v1/Secret/kube-system/kubezero-secrets/telemetry.fluentd.source.sharedKey tls: false + output_otel: + host: telemetry-opentelemetry-collector + input: memBufLimit: 16MB refreshInterval: 5 @@ -353,6 +433,7 @@ fluent-bit: Name tail Path /var/log/containers/*.log # Exclude ourselves to current error spam, https://github.com/fluent/fluent-bit/issues/5769 + # Todo: Rather limit / filter spam message than exclude all together -> ideally locally, next dataprepper Exclude_Path *logging-fluent-bit* multiline.parser cri Tag cri.* @@ -363,10 +444,14 @@ fluent-bit: DB.locking true # Buffer_Max_Size 1M {{- with .Values.config.input }} - Mem_Buf_Limit {{ default "16MB" .memBufLimit }} - Refresh_Interval {{ default 5 .refreshInterval }} + Mem_Buf_Limit {{ .memBufLimit }} + Refresh_Interval {{ .refreshInterval }} {{- end }} + [INPUT] + Name opentelemetry + Tag otel + filters: | [FILTER] Name parser @@ -411,7 +496,7 @@ fluent-bit: outputs: | [OUTPUT] - Match * + Match kube.* Name forward Host {{ .Values.config.output.host }} Port 24224 @@ -420,6 +505,15 @@ fluent-bit: Send_options true Require_ack_response true + [OUTPUT] + Name opentelemetry + Match otel + Host {{ .Values.config.output_otel.host }} + Port 4318 + #Metrics_uri /v1/metrics + Traces_uri /v1/traces + #Logs_uri /v1/logs + customParsers: | [PARSER] Name cri-log