From 9f4ffb2e399e6e1626eb3a6fb5ddf57872a63277 Mon Sep 17 00:00:00 2001 From: Justin Scott Date: Fri, 19 Jul 2019 11:37:14 -0700 Subject: [PATCH] Kustomize all the things This commit replaces our static manifests with Kustomize versions and adds scripting to apply them. Signed-off-by: Justin Scott --- clr-k8s-examples/0-canal/canal.yaml | 407 - .../0-canal/overlays/v3.3/kustomization.yaml | 6 + .../overlays/v3.3/patch_daemonset.yaml | 15 + clr-k8s-examples/0-canal/rbac.yaml | 131 - clr-k8s-examples/0-canal/versions | 2 - .../aggregated-metrics-reader.yaml | 12 - .../1-core-metrics/auth-delegator.yaml | 13 - .../1-core-metrics/auth-reader.yaml | 14 - .../1-core-metrics/metrics-apiservice.yaml | 14 - .../metrics-server-deployment.yaml | 41 - .../metrics-server-service.yaml | 15 - .../overlays/v0.3.3/kustomization.yaml | 8 + .../1-core-metrics/resource-reader.yaml | 29 - clr-k8s-examples/1-core-metrics/versions | 1 - .../2-dashboard/dashboard-admin.yaml | 14 - .../2-dashboard/kubernetes-dashboard.yaml | 176 - .../overlays/v1.10.1/kustomization.yaml | 3 + .../overlays/v2.0.0-beta2/kustomization.yaml | 3 + clr-k8s-examples/2-dashboard/versions | 1 - clr-k8s-examples/3-efk/es-service.yaml | 17 - clr-k8s-examples/3-efk/es-statefulset.yaml | 117 - .../3-efk/fluentd-es-configmap.yaml | 464 -- clr-k8s-examples/3-efk/fluentd-es-ds.yaml | 108 - .../3-efk/fluentd-es-image/Dockerfile | 58 - .../3-efk/fluentd-es-image/Gemfile | 12 - .../3-efk/fluentd-es-image/Makefile | 25 - .../3-efk/fluentd-es-image/README.md | 14 - .../3-efk/fluentd-es-image/clean-apt | 29 - .../3-efk/fluentd-es-image/clean-install | 30 - .../3-efk/fluentd-es-image/fluent.conf | 8 - .../3-efk/fluentd-es-image/run.sh | 23 - clr-k8s-examples/3-efk/kibana-deployment.yaml | 39 - clr-k8s-examples/3-efk/kibana-service.yaml | 17 - .../3-efk/overlays/v1.15.1/kustomization.yaml | 18 + clr-k8s-examples/3-efk/versions | 1 - .../00namespace-namespace.yaml | 4 - ...0alertmanagerCustomResourceDefinition.yaml | 2468 ------ ...r-0prometheusCustomResourceDefinition.yaml | 3169 ------- ...rometheusruleCustomResourceDefinition.yaml | 342 - ...ervicemonitorCustomResourceDefinition.yaml | 291 - .../0prometheus-operator-clusterRole.yaml | 66 - ...rometheus-operator-clusterRoleBinding.yaml | 12 - .../0prometheus-operator-deployment.yaml | 44 - .../0prometheus-operator-service.yaml | 15 - .../0prometheus-operator-serviceAccount.yaml | 5 - .../0prometheus-operator-serviceMonitor.yaml | 14 - .../alertmanager-alertmanager.yaml | 20 - .../alertmanager-secret.yaml | 8 - .../alertmanager-service.yaml | 15 - .../alertmanager-serviceAccount.yaml | 5 - .../alertmanager-serviceMonitor.yaml | 14 - .../grafana-dashboardDatasources.yaml | 8 - .../grafana-dashboardDefinitions.yaml | 7347 ----------------- .../grafana-dashboardSources.yaml | 21 - .../4-kube-prometheus/grafana-deployment.yaml | 118 - .../4-kube-prometheus/grafana-service.yaml | 12 - .../grafana-serviceAccount.yaml | 5 - .../kube-state-metrics-clusterRole.yaml | 69 - ...kube-state-metrics-clusterRoleBinding.yaml | 12 - .../kube-state-metrics-deployment.yaml | 97 - .../kube-state-metrics-role.yaml | 30 - .../kube-state-metrics-roleBinding.yaml | 12 - .../kube-state-metrics-service.yaml | 18 - .../kube-state-metrics-serviceAccount.yaml | 5 - .../kube-state-metrics-serviceMonitor.yaml | 27 - .../node-exporter-clusterRole.yaml | 17 - .../node-exporter-clusterRoleBinding.yaml | 12 - .../node-exporter-daemonset.yaml | 80 - .../node-exporter-service.yaml | 15 - .../node-exporter-serviceAccount.yaml | 5 - .../node-exporter-serviceMonitor.yaml | 19 - .../overlays/v0.1.0/kustomization.yaml | 67 + .../prometheus-clusterRole.yaml | 15 - .../prometheus-clusterRoleBinding.yaml | 12 - .../prometheus-prometheus.yaml | 34 - .../prometheus-roleBindingConfig.yaml | 13 - ...metheus-roleBindingSpecificNamespaces.yaml | 42 - .../prometheus-roleConfig.yaml | 12 - .../prometheus-roleSpecificNamespaces.yaml | 54 - .../4-kube-prometheus/prometheus-rules.yaml | 1129 --- .../4-kube-prometheus/prometheus-service.yaml | 15 - .../prometheus-serviceAccount.yaml | 5 - .../prometheus-serviceMonitor.yaml | 14 - .../prometheus-serviceMonitorApiserver.yaml | 29 - .../prometheus-serviceMonitorCoreDNS.yaml | 20 - ...s-serviceMonitorKubeControllerManager.yaml | 23 - ...rometheus-serviceMonitorKubeScheduler.yaml | 18 - .../prometheus-serviceMonitorKubelet.yaml | 31 - clr-k8s-examples/4-kube-prometheus/versions | 1 - clr-k8s-examples/5-ingres-lb/mandatory.yaml | 240 - .../overlays/nginx-0.25.0/kustomization.yaml | 13 + .../nginx-0.25.0/patch_clusterrole.yaml | 5 + .../5-ingres-lb/service-nodeport.yaml | 25 - clr-k8s-examples/5-ingres-lb/versions | 1 - clr-k8s-examples/6-metal-lb/metallb.yaml | 225 - .../overlays/v0.7.3/kustomization.yaml | 8 + .../v0.7.3/patch_configmap.yaml} | 1 - clr-k8s-examples/6-metal-lb/versions | 2 - clr-k8s-examples/7-rook/000-operator.yaml | 360 - clr-k8s-examples/7-rook/001-cluster.yaml | 142 - clr-k8s-examples/7-rook/002-storageclass.yaml | 31 - .../7-rook/overlays/v0.8.3/kustomization.yaml | 7 + .../overlays/v0.8.3/patch_operator.yaml | 13 + .../7-rook/overlays/v1.0.3/kustomization.yaml | 8 + .../overlays/v1.0.3/patch_operator.yaml | 13 + clr-k8s-examples/7-rook/update.sh | 8 - .../8-kata/deploy/kata-cleanup.yaml | 46 - .../8-kata/deploy/kata-deploy.yaml | 69 - clr-k8s-examples/8-kata/deploy/kata-rbac.yaml | 29 - .../8-kata/kata-fc-runtimeClass.yaml | 5 - .../8-kata/kata-qemu-runtimeClass.yaml | 12 - .../1.8.0-kernel-config/kustomization.yaml | 6 + clr-k8s-examples/DEVELOP.md | 137 + clr-k8s-examples/create_stack.sh | 181 +- clr-k8s-examples/reset_stack.sh | 1 + 115 files changed, 488 insertions(+), 18940 deletions(-) delete mode 100644 clr-k8s-examples/0-canal/canal.yaml create mode 100644 clr-k8s-examples/0-canal/overlays/v3.3/kustomization.yaml create mode 100644 clr-k8s-examples/0-canal/overlays/v3.3/patch_daemonset.yaml delete mode 100644 clr-k8s-examples/0-canal/rbac.yaml delete mode 100644 clr-k8s-examples/0-canal/versions delete mode 100644 clr-k8s-examples/1-core-metrics/aggregated-metrics-reader.yaml delete mode 100644 clr-k8s-examples/1-core-metrics/auth-delegator.yaml delete mode 100644 clr-k8s-examples/1-core-metrics/auth-reader.yaml delete mode 100644 clr-k8s-examples/1-core-metrics/metrics-apiservice.yaml delete mode 100644 clr-k8s-examples/1-core-metrics/metrics-server-deployment.yaml delete mode 100644 clr-k8s-examples/1-core-metrics/metrics-server-service.yaml create mode 100644 clr-k8s-examples/1-core-metrics/overlays/v0.3.3/kustomization.yaml delete mode 100644 clr-k8s-examples/1-core-metrics/resource-reader.yaml delete mode 100644 clr-k8s-examples/1-core-metrics/versions delete mode 100644 clr-k8s-examples/2-dashboard/dashboard-admin.yaml delete mode 100644 clr-k8s-examples/2-dashboard/kubernetes-dashboard.yaml create mode 100644 clr-k8s-examples/2-dashboard/overlays/v1.10.1/kustomization.yaml create mode 100644 clr-k8s-examples/2-dashboard/overlays/v2.0.0-beta2/kustomization.yaml delete mode 100644 clr-k8s-examples/2-dashboard/versions delete mode 100644 clr-k8s-examples/3-efk/es-service.yaml delete mode 100644 clr-k8s-examples/3-efk/es-statefulset.yaml delete mode 100644 clr-k8s-examples/3-efk/fluentd-es-configmap.yaml delete mode 100644 clr-k8s-examples/3-efk/fluentd-es-ds.yaml delete mode 100644 clr-k8s-examples/3-efk/fluentd-es-image/Dockerfile delete mode 100644 clr-k8s-examples/3-efk/fluentd-es-image/Gemfile delete mode 100644 clr-k8s-examples/3-efk/fluentd-es-image/Makefile delete mode 100644 clr-k8s-examples/3-efk/fluentd-es-image/README.md delete mode 100755 clr-k8s-examples/3-efk/fluentd-es-image/clean-apt delete mode 100755 clr-k8s-examples/3-efk/fluentd-es-image/clean-install delete mode 100644 clr-k8s-examples/3-efk/fluentd-es-image/fluent.conf delete mode 100755 clr-k8s-examples/3-efk/fluentd-es-image/run.sh delete mode 100644 clr-k8s-examples/3-efk/kibana-deployment.yaml delete mode 100644 clr-k8s-examples/3-efk/kibana-service.yaml create mode 100644 clr-k8s-examples/3-efk/overlays/v1.15.1/kustomization.yaml delete mode 100644 clr-k8s-examples/3-efk/versions delete mode 100644 clr-k8s-examples/4-kube-prometheus/00namespace-namespace.yaml delete mode 100644 clr-k8s-examples/4-kube-prometheus/0prometheus-operator-0alertmanagerCustomResourceDefinition.yaml delete mode 100644 clr-k8s-examples/4-kube-prometheus/0prometheus-operator-0prometheusCustomResourceDefinition.yaml delete mode 100644 clr-k8s-examples/4-kube-prometheus/0prometheus-operator-0prometheusruleCustomResourceDefinition.yaml delete mode 100644 clr-k8s-examples/4-kube-prometheus/0prometheus-operator-0servicemonitorCustomResourceDefinition.yaml delete mode 100644 clr-k8s-examples/4-kube-prometheus/0prometheus-operator-clusterRole.yaml delete mode 100644 clr-k8s-examples/4-kube-prometheus/0prometheus-operator-clusterRoleBinding.yaml delete mode 100644 clr-k8s-examples/4-kube-prometheus/0prometheus-operator-deployment.yaml delete mode 100644 clr-k8s-examples/4-kube-prometheus/0prometheus-operator-service.yaml delete mode 100644 clr-k8s-examples/4-kube-prometheus/0prometheus-operator-serviceAccount.yaml delete mode 100644 clr-k8s-examples/4-kube-prometheus/0prometheus-operator-serviceMonitor.yaml delete mode 100644 clr-k8s-examples/4-kube-prometheus/alertmanager-alertmanager.yaml delete mode 100644 clr-k8s-examples/4-kube-prometheus/alertmanager-secret.yaml delete mode 100644 clr-k8s-examples/4-kube-prometheus/alertmanager-service.yaml delete mode 100644 clr-k8s-examples/4-kube-prometheus/alertmanager-serviceAccount.yaml delete mode 100644 clr-k8s-examples/4-kube-prometheus/alertmanager-serviceMonitor.yaml delete mode 100644 clr-k8s-examples/4-kube-prometheus/grafana-dashboardDatasources.yaml delete mode 100644 clr-k8s-examples/4-kube-prometheus/grafana-dashboardDefinitions.yaml delete mode 100644 clr-k8s-examples/4-kube-prometheus/grafana-dashboardSources.yaml delete mode 100644 clr-k8s-examples/4-kube-prometheus/grafana-deployment.yaml delete mode 100644 clr-k8s-examples/4-kube-prometheus/grafana-service.yaml delete mode 100644 clr-k8s-examples/4-kube-prometheus/grafana-serviceAccount.yaml delete mode 100644 clr-k8s-examples/4-kube-prometheus/kube-state-metrics-clusterRole.yaml delete mode 100644 clr-k8s-examples/4-kube-prometheus/kube-state-metrics-clusterRoleBinding.yaml delete mode 100644 clr-k8s-examples/4-kube-prometheus/kube-state-metrics-deployment.yaml delete mode 100644 clr-k8s-examples/4-kube-prometheus/kube-state-metrics-role.yaml delete mode 100644 clr-k8s-examples/4-kube-prometheus/kube-state-metrics-roleBinding.yaml delete mode 100644 clr-k8s-examples/4-kube-prometheus/kube-state-metrics-service.yaml delete mode 100644 clr-k8s-examples/4-kube-prometheus/kube-state-metrics-serviceAccount.yaml delete mode 100644 clr-k8s-examples/4-kube-prometheus/kube-state-metrics-serviceMonitor.yaml delete mode 100644 clr-k8s-examples/4-kube-prometheus/node-exporter-clusterRole.yaml delete mode 100644 clr-k8s-examples/4-kube-prometheus/node-exporter-clusterRoleBinding.yaml delete mode 100644 clr-k8s-examples/4-kube-prometheus/node-exporter-daemonset.yaml delete mode 100644 clr-k8s-examples/4-kube-prometheus/node-exporter-service.yaml delete mode 100644 clr-k8s-examples/4-kube-prometheus/node-exporter-serviceAccount.yaml delete mode 100644 clr-k8s-examples/4-kube-prometheus/node-exporter-serviceMonitor.yaml create mode 100644 clr-k8s-examples/4-kube-prometheus/overlays/v0.1.0/kustomization.yaml delete mode 100644 clr-k8s-examples/4-kube-prometheus/prometheus-clusterRole.yaml delete mode 100644 clr-k8s-examples/4-kube-prometheus/prometheus-clusterRoleBinding.yaml delete mode 100644 clr-k8s-examples/4-kube-prometheus/prometheus-prometheus.yaml delete mode 100644 clr-k8s-examples/4-kube-prometheus/prometheus-roleBindingConfig.yaml delete mode 100644 clr-k8s-examples/4-kube-prometheus/prometheus-roleBindingSpecificNamespaces.yaml delete mode 100644 clr-k8s-examples/4-kube-prometheus/prometheus-roleConfig.yaml delete mode 100644 clr-k8s-examples/4-kube-prometheus/prometheus-roleSpecificNamespaces.yaml delete mode 100644 clr-k8s-examples/4-kube-prometheus/prometheus-rules.yaml delete mode 100644 clr-k8s-examples/4-kube-prometheus/prometheus-service.yaml delete mode 100644 clr-k8s-examples/4-kube-prometheus/prometheus-serviceAccount.yaml delete mode 100644 clr-k8s-examples/4-kube-prometheus/prometheus-serviceMonitor.yaml delete mode 100644 clr-k8s-examples/4-kube-prometheus/prometheus-serviceMonitorApiserver.yaml delete mode 100644 clr-k8s-examples/4-kube-prometheus/prometheus-serviceMonitorCoreDNS.yaml delete mode 100644 clr-k8s-examples/4-kube-prometheus/prometheus-serviceMonitorKubeControllerManager.yaml delete mode 100644 clr-k8s-examples/4-kube-prometheus/prometheus-serviceMonitorKubeScheduler.yaml delete mode 100644 clr-k8s-examples/4-kube-prometheus/prometheus-serviceMonitorKubelet.yaml delete mode 100644 clr-k8s-examples/4-kube-prometheus/versions delete mode 100644 clr-k8s-examples/5-ingres-lb/mandatory.yaml create mode 100644 clr-k8s-examples/5-ingres-lb/overlays/nginx-0.25.0/kustomization.yaml create mode 100644 clr-k8s-examples/5-ingres-lb/overlays/nginx-0.25.0/patch_clusterrole.yaml delete mode 100644 clr-k8s-examples/5-ingres-lb/service-nodeport.yaml delete mode 100644 clr-k8s-examples/5-ingres-lb/versions delete mode 100644 clr-k8s-examples/6-metal-lb/metallb.yaml create mode 100644 clr-k8s-examples/6-metal-lb/overlays/v0.7.3/kustomization.yaml rename clr-k8s-examples/6-metal-lb/{example-layer2-config.yaml => overlays/v0.7.3/patch_configmap.yaml} (86%) delete mode 100644 clr-k8s-examples/6-metal-lb/versions delete mode 100644 clr-k8s-examples/7-rook/000-operator.yaml delete mode 100644 clr-k8s-examples/7-rook/001-cluster.yaml delete mode 100644 clr-k8s-examples/7-rook/002-storageclass.yaml create mode 100644 clr-k8s-examples/7-rook/overlays/v0.8.3/kustomization.yaml create mode 100644 clr-k8s-examples/7-rook/overlays/v0.8.3/patch_operator.yaml create mode 100644 clr-k8s-examples/7-rook/overlays/v1.0.3/kustomization.yaml create mode 100644 clr-k8s-examples/7-rook/overlays/v1.0.3/patch_operator.yaml delete mode 100755 clr-k8s-examples/7-rook/update.sh delete mode 100644 clr-k8s-examples/8-kata/deploy/kata-cleanup.yaml delete mode 100644 clr-k8s-examples/8-kata/deploy/kata-deploy.yaml delete mode 100644 clr-k8s-examples/8-kata/deploy/kata-rbac.yaml delete mode 100644 clr-k8s-examples/8-kata/kata-fc-runtimeClass.yaml delete mode 100644 clr-k8s-examples/8-kata/kata-qemu-runtimeClass.yaml create mode 100644 clr-k8s-examples/8-kata/overlays/1.8.0-kernel-config/kustomization.yaml create mode 100644 clr-k8s-examples/DEVELOP.md diff --git a/clr-k8s-examples/0-canal/canal.yaml b/clr-k8s-examples/0-canal/canal.yaml deleted file mode 100644 index 17b3cd4..0000000 --- a/clr-k8s-examples/0-canal/canal.yaml +++ /dev/null @@ -1,407 +0,0 @@ -# Canal Version v3.3.2 -# https://docs.projectcalico.org/v3.3/releases#v3.3.2 -# This manifest includes the following component versions: -# calico/node:v3.3.2 -# calico/cni:v3.3.2 -# coreos/flannel:v0.9.1 - -# This ConfigMap is used to configure a self-hosted Canal installation. -kind: ConfigMap -apiVersion: v1 -metadata: - name: canal-config - namespace: kube-system -data: - # The interface used by canal for host <-> host communication. - # If left blank, then the interface is chosen using the node's - # default route. - canal_iface: "" - - # Whether or not to masquerade traffic to destinations not within - # the pod network. - masquerade: "true" - - # The CNI network configuration to install on each node. The special - # values in this config will be automatically populated. - cni_network_config: |- - { - "name": "k8s-pod-network", - "cniVersion": "0.3.0", - "plugins": [ - { - "type": "calico", - "log_level": "info", - "datastore_type": "kubernetes", - "nodename": "__KUBERNETES_NODE_NAME__", - "ipam": { - "type": "host-local", - "subnet": "usePodCidr" - }, - "policy": { - "type": "k8s" - }, - "kubernetes": { - "kubeconfig": "__KUBECONFIG_FILEPATH__" - } - }, - { - "type": "portmap", - "snat": true, - "capabilities": {"portMappings": true} - } - ] - } - - # Flannel network configuration. Mounted into the flannel container. - net-conf.json: | - { - "Network": "10.244.0.0/16", - "Backend": { - "Type": "vxlan" - } - } - ---- - - - -# This manifest installs the calico/node container, as well -# as the Calico CNI plugins and network config on -# each master and worker node in a Kubernetes cluster. -kind: DaemonSet -apiVersion: extensions/v1beta1 -metadata: - name: canal - namespace: kube-system - labels: - k8s-app: canal -spec: - selector: - matchLabels: - k8s-app: canal - updateStrategy: - type: RollingUpdate - rollingUpdate: - maxUnavailable: 1 - template: - metadata: - labels: - k8s-app: canal - annotations: - # This, along with the CriticalAddonsOnly toleration below, - # marks the pod as a critical add-on, ensuring it gets - # priority scheduling and that its resources are reserved - # if it ever gets evicted. - scheduler.alpha.kubernetes.io/critical-pod: '' - spec: - nodeSelector: - beta.kubernetes.io/os: linux - hostNetwork: true - tolerations: - # Make sure canal gets scheduled on all nodes. - - effect: NoSchedule - operator: Exists - # Mark the pod as a critical add-on for rescheduling. - - key: CriticalAddonsOnly - operator: Exists - - effect: NoExecute - operator: Exists - serviceAccountName: canal - # Minimize downtime during a rolling upgrade or deletion; tell Kubernetes to do a "force - # deletion": https://kubernetes.io/docs/concepts/workloads/pods/pod/#termination-of-pods. - terminationGracePeriodSeconds: 0 - containers: - # Runs calico/node container on each Kubernetes node. This - # container programs network policy and routes on each - # host. - - name: calico-node - image: quay.io/calico/node:v3.3.2 - env: - # Use Kubernetes API as the backing datastore. - - name: DATASTORE_TYPE - value: "kubernetes" - # Wait for the datastore. - - name: WAIT_FOR_DATASTORE - value: "true" - # Set based on the k8s node name. - - name: NODENAME - valueFrom: - fieldRef: - fieldPath: spec.nodeName - # Don't enable BGP. - - name: CALICO_NETWORKING_BACKEND - value: "none" - # Cluster type to identify the deployment type - - name: CLUSTER_TYPE - value: "k8s,canal" - # Period, in seconds, at which felix re-applies all iptables state - - name: FELIX_IPTABLESREFRESHINTERVAL - value: "60" - # No IP address needed. - - name: IP - value: "" - # The default IPv4 pool to create on startup if none exists. Pod IPs will be - # chosen from this range. Changing this value after installation will have - # no effect. This should fall within `--cluster-cidr`. - - name: CALICO_IPV4POOL_CIDR - value: "192.168.0.0/16" - # Disable file logging so `kubectl logs` works. - - name: CALICO_DISABLE_FILE_LOGGING - value: "true" - # Set Felix endpoint to host default action to ACCEPT. - - name: FELIX_DEFAULTENDPOINTTOHOSTACTION - value: "ACCEPT" - # Disable IPv6 on Kubernetes. - - name: FELIX_IPV6SUPPORT - value: "false" - # Set Felix logging to "info" - - name: FELIX_LOGSEVERITYSCREEN - value: "info" - - name: FELIX_HEALTHENABLED - value: "true" - - name: FELIX_IGNORELOOSERPF - value: "true" - securityContext: - privileged: true - resources: - requests: - cpu: 250m - livenessProbe: - httpGet: - path: /liveness - port: 9099 - host: localhost - periodSeconds: 10 - initialDelaySeconds: 10 - failureThreshold: 6 - readinessProbe: - httpGet: - path: /readiness - port: 9099 - host: localhost - periodSeconds: 10 - volumeMounts: - - mountPath: /lib/modules - name: lib-modules - readOnly: true - - mountPath: /run/xtables.lock - name: xtables-lock - readOnly: false - - mountPath: /var/run/calico - name: var-run-calico - readOnly: false - - mountPath: /var/lib/calico - name: var-lib-calico - readOnly: false - # This container installs the Calico CNI binaries - # and CNI network config file on each node. - - name: install-cni - image: quay.io/calico/cni:v3.3.2 - command: ["/install-cni.sh"] - env: - # Name of the CNI config file to create. - - name: CNI_CONF_NAME - value: "10-canal.conflist" - # Set the hostname based on the k8s node name. - - name: KUBERNETES_NODE_NAME - valueFrom: - fieldRef: - fieldPath: spec.nodeName - # The CNI network config to install on each node. - - name: CNI_NETWORK_CONFIG - valueFrom: - configMapKeyRef: - name: canal-config - key: cni_network_config - volumeMounts: - - mountPath: /host/opt/cni/bin - name: cni-bin-dir - - mountPath: /host/etc/cni/net.d - name: cni-net-dir - # This container runs flannel using the kube-subnet-mgr backend - # for allocating subnets. - - name: kube-flannel - image: quay.io/coreos/flannel:v0.9.1 - command: [ "/opt/bin/flanneld", "--ip-masq", "--kube-subnet-mgr" ] - securityContext: - privileged: true - env: - - name: POD_NAME - valueFrom: - fieldRef: - fieldPath: metadata.name - - name: POD_NAMESPACE - valueFrom: - fieldRef: - fieldPath: metadata.namespace - - name: FLANNELD_IFACE - valueFrom: - configMapKeyRef: - name: canal-config - key: canal_iface - - name: FLANNELD_IP_MASQ - valueFrom: - configMapKeyRef: - name: canal-config - key: masquerade - volumeMounts: - - mountPath: /run/xtables.lock - name: xtables-lock - readOnly: false - - name: flannel-cfg - mountPath: /etc/kube-flannel/ - volumes: - # Used by calico/node. - - name: lib-modules - hostPath: - path: /lib/modules - - name: var-run-calico - hostPath: - path: /var/run/calico - - name: var-lib-calico - hostPath: - path: /var/lib/calico - - name: xtables-lock - hostPath: - path: /run/xtables.lock - type: FileOrCreate - # Used by flannel. - - name: flannel-cfg - configMap: - name: canal-config - # Used to install CNI. - - name: cni-bin-dir - hostPath: - path: /opt/cni/bin - - name: cni-net-dir - hostPath: - path: /etc/cni/net.d ---- - -apiVersion: v1 -kind: ServiceAccount -metadata: - name: canal - namespace: kube-system - ---- - -# Create all the CustomResourceDefinitions needed for -# Calico policy and networking mode. - -apiVersion: apiextensions.k8s.io/v1beta1 -kind: CustomResourceDefinition -metadata: - name: felixconfigurations.crd.projectcalico.org -spec: - scope: Cluster - group: crd.projectcalico.org - version: v1 - names: - kind: FelixConfiguration - plural: felixconfigurations - singular: felixconfiguration ---- - -apiVersion: apiextensions.k8s.io/v1beta1 -kind: CustomResourceDefinition -metadata: - name: bgpconfigurations.crd.projectcalico.org -spec: - scope: Cluster - group: crd.projectcalico.org - version: v1 - names: - kind: BGPConfiguration - plural: bgpconfigurations - singular: bgpconfiguration - ---- - -apiVersion: apiextensions.k8s.io/v1beta1 -kind: CustomResourceDefinition -metadata: - name: ippools.crd.projectcalico.org -spec: - scope: Cluster - group: crd.projectcalico.org - version: v1 - names: - kind: IPPool - plural: ippools - singular: ippool - ---- - -apiVersion: apiextensions.k8s.io/v1beta1 -kind: CustomResourceDefinition -metadata: - name: hostendpoints.crd.projectcalico.org -spec: - scope: Cluster - group: crd.projectcalico.org - version: v1 - names: - kind: HostEndpoint - plural: hostendpoints - singular: hostendpoint - ---- - -apiVersion: apiextensions.k8s.io/v1beta1 -kind: CustomResourceDefinition -metadata: - name: clusterinformations.crd.projectcalico.org -spec: - scope: Cluster - group: crd.projectcalico.org - version: v1 - names: - kind: ClusterInformation - plural: clusterinformations - singular: clusterinformation - ---- - -apiVersion: apiextensions.k8s.io/v1beta1 -kind: CustomResourceDefinition -metadata: - name: globalnetworkpolicies.crd.projectcalico.org -spec: - scope: Cluster - group: crd.projectcalico.org - version: v1 - names: - kind: GlobalNetworkPolicy - plural: globalnetworkpolicies - singular: globalnetworkpolicy - ---- - -apiVersion: apiextensions.k8s.io/v1beta1 -kind: CustomResourceDefinition -metadata: - name: globalnetworksets.crd.projectcalico.org -spec: - scope: Cluster - group: crd.projectcalico.org - version: v1 - names: - kind: GlobalNetworkSet - plural: globalnetworksets - singular: globalnetworkset - ---- - -apiVersion: apiextensions.k8s.io/v1beta1 -kind: CustomResourceDefinition -metadata: - name: networkpolicies.crd.projectcalico.org -spec: - scope: Namespaced - group: crd.projectcalico.org - version: v1 - names: - kind: NetworkPolicy - plural: networkpolicies - singular: networkpolicy diff --git a/clr-k8s-examples/0-canal/overlays/v3.3/kustomization.yaml b/clr-k8s-examples/0-canal/overlays/v3.3/kustomization.yaml new file mode 100644 index 0000000..803e28b --- /dev/null +++ b/clr-k8s-examples/0-canal/overlays/v3.3/kustomization.yaml @@ -0,0 +1,6 @@ +resources: + - canal/canal.yaml + - canal/rbac.yaml + +patchesStrategicMerge: + - patch_daemonset.yaml diff --git a/clr-k8s-examples/0-canal/overlays/v3.3/patch_daemonset.yaml b/clr-k8s-examples/0-canal/overlays/v3.3/patch_daemonset.yaml new file mode 100644 index 0000000..d264d8c --- /dev/null +++ b/clr-k8s-examples/0-canal/overlays/v3.3/patch_daemonset.yaml @@ -0,0 +1,15 @@ +kind: DaemonSet +apiVersion: extensions/v1beta1 +metadata: + name: canal +spec: + template: + spec: + containers: + - name: calico-node + image: quay.io/calico/node:v3.3.2 + env: + - name: FELIX_IGNORELOOSERPF + value: "true" + - name: install-cni + image: quay.io/calico/cni:v3.3.2 \ No newline at end of file diff --git a/clr-k8s-examples/0-canal/rbac.yaml b/clr-k8s-examples/0-canal/rbac.yaml deleted file mode 100644 index 582954f..0000000 --- a/clr-k8s-examples/0-canal/rbac.yaml +++ /dev/null @@ -1,131 +0,0 @@ -# {{site.prodname}} Roles -# Reference {{site.url}}/{{page.version}}/getting-started/kubernetes/installation/hosted/rbac-kdd.yaml -kind: ClusterRole -apiVersion: rbac.authorization.k8s.io/v1beta1 -metadata: - name: calico -rules: - - apiGroups: [""] - resources: - - namespaces - - serviceaccounts - verbs: - - get - - list - - watch - - apiGroups: [""] - resources: - - pods/status - verbs: - - patch - - apiGroups: [""] - resources: - - pods - verbs: - - get - - list - - watch - - apiGroups: [""] - resources: - - services - verbs: - - get - - apiGroups: [""] - resources: - - endpoints - verbs: - - get - - apiGroups: [""] - resources: - - nodes - verbs: - - get - - list - - update - - watch - - apiGroups: ["networking.k8s.io"] - resources: - - networkpolicies - verbs: - - get - - list - - watch - - apiGroups: ["crd.projectcalico.org"] - resources: - - globalfelixconfigs - - felixconfigurations - - bgppeers - - globalbgpconfigs - - globalnetworksets - - hostendpoints - - bgpconfigurations - - ippools - - globalnetworkpolicies - - networkpolicies - - clusterinformations - verbs: - - create - - get - - list - - update - - watch - ---- - -# Flannel roles -# Pulled from https://github.com/coreos/flannel/blob/master/Documentation/kube-flannel-rbac.yml -kind: ClusterRole -apiVersion: rbac.authorization.k8s.io/v1beta1 -metadata: - name: flannel -rules: - - apiGroups: - - "" - resources: - - pods - verbs: - - get - - apiGroups: - - "" - resources: - - nodes - verbs: - - list - - watch - - apiGroups: - - "" - resources: - - nodes/status - verbs: - - patch ---- - -# Bind the flannel ClusterRole to the canal ServiceAccount. -kind: ClusterRoleBinding -apiVersion: rbac.authorization.k8s.io/v1beta1 -metadata: - name: canal-flannel -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: ClusterRole - name: flannel -subjects: -- kind: ServiceAccount - name: canal - namespace: kube-system - ---- - -# Bind the {{site.prodname}} ClusterRole to the canal ServiceAccount. -apiVersion: rbac.authorization.k8s.io/v1beta1 -kind: ClusterRoleBinding -metadata: - name: canal-calico -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: ClusterRole - name: calico -subjects: -- kind: ServiceAccount - name: canal - namespace: kube-system diff --git a/clr-k8s-examples/0-canal/versions b/clr-k8s-examples/0-canal/versions deleted file mode 100644 index 4cc6f03..0000000 --- a/clr-k8s-examples/0-canal/versions +++ /dev/null @@ -1,2 +0,0 @@ -https://docs.projectcalico.org/v3.3/getting-started/kubernetes/installation/hosted/canal/rbac.yaml -https://docs.projectcalico.org/v3.3/getting-started/kubernetes/installation/hosted/canal/canal.yaml diff --git a/clr-k8s-examples/1-core-metrics/aggregated-metrics-reader.yaml b/clr-k8s-examples/1-core-metrics/aggregated-metrics-reader.yaml deleted file mode 100644 index cdf3415..0000000 --- a/clr-k8s-examples/1-core-metrics/aggregated-metrics-reader.yaml +++ /dev/null @@ -1,12 +0,0 @@ -kind: ClusterRole -apiVersion: rbac.authorization.k8s.io/v1 -metadata: - name: system:aggregated-metrics-reader - labels: - rbac.authorization.k8s.io/aggregate-to-view: "true" - rbac.authorization.k8s.io/aggregate-to-edit: "true" - rbac.authorization.k8s.io/aggregate-to-admin: "true" -rules: -- apiGroups: ["metrics.k8s.io"] - resources: ["pods"] - verbs: ["get", "list", "watch"] diff --git a/clr-k8s-examples/1-core-metrics/auth-delegator.yaml b/clr-k8s-examples/1-core-metrics/auth-delegator.yaml deleted file mode 100644 index e3442c5..0000000 --- a/clr-k8s-examples/1-core-metrics/auth-delegator.yaml +++ /dev/null @@ -1,13 +0,0 @@ ---- -apiVersion: rbac.authorization.k8s.io/v1beta1 -kind: ClusterRoleBinding -metadata: - name: metrics-server:system:auth-delegator -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: ClusterRole - name: system:auth-delegator -subjects: -- kind: ServiceAccount - name: metrics-server - namespace: kube-system diff --git a/clr-k8s-examples/1-core-metrics/auth-reader.yaml b/clr-k8s-examples/1-core-metrics/auth-reader.yaml deleted file mode 100644 index f0616e1..0000000 --- a/clr-k8s-examples/1-core-metrics/auth-reader.yaml +++ /dev/null @@ -1,14 +0,0 @@ ---- -apiVersion: rbac.authorization.k8s.io/v1beta1 -kind: RoleBinding -metadata: - name: metrics-server-auth-reader - namespace: kube-system -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: Role - name: extension-apiserver-authentication-reader -subjects: -- kind: ServiceAccount - name: metrics-server - namespace: kube-system diff --git a/clr-k8s-examples/1-core-metrics/metrics-apiservice.yaml b/clr-k8s-examples/1-core-metrics/metrics-apiservice.yaml deleted file mode 100644 index 08b0530..0000000 --- a/clr-k8s-examples/1-core-metrics/metrics-apiservice.yaml +++ /dev/null @@ -1,14 +0,0 @@ ---- -apiVersion: apiregistration.k8s.io/v1beta1 -kind: APIService -metadata: - name: v1beta1.metrics.k8s.io -spec: - service: - name: metrics-server - namespace: kube-system - group: metrics.k8s.io - version: v1beta1 - insecureSkipTLSVerify: true - groupPriorityMinimum: 100 - versionPriority: 100 diff --git a/clr-k8s-examples/1-core-metrics/metrics-server-deployment.yaml b/clr-k8s-examples/1-core-metrics/metrics-server-deployment.yaml deleted file mode 100644 index 2129614..0000000 --- a/clr-k8s-examples/1-core-metrics/metrics-server-deployment.yaml +++ /dev/null @@ -1,41 +0,0 @@ ---- -apiVersion: v1 -kind: ServiceAccount -metadata: - name: metrics-server - namespace: kube-system ---- -apiVersion: extensions/v1beta1 -kind: Deployment -metadata: - name: metrics-server - namespace: kube-system - labels: - k8s-app: metrics-server -spec: - selector: - matchLabels: - k8s-app: metrics-server - template: - metadata: - name: metrics-server - labels: - k8s-app: metrics-server - spec: - serviceAccountName: metrics-server - volumes: - # mount in tmp so we can safely use from-scratch images and/or read-only containers - - name: tmp-dir - emptyDir: {} - containers: - - name: metrics-server - image: k8s.gcr.io/metrics-server-amd64:v0.3.1 - imagePullPolicy: Always - args: - - --logtostderr - - --kubelet-insecure-tls - - --kubelet-preferred-address-types=InternalIP,Hostname,ExternalIP - volumeMounts: - - name: tmp-dir - mountPath: /tmp - diff --git a/clr-k8s-examples/1-core-metrics/metrics-server-service.yaml b/clr-k8s-examples/1-core-metrics/metrics-server-service.yaml deleted file mode 100644 index 082b00c..0000000 --- a/clr-k8s-examples/1-core-metrics/metrics-server-service.yaml +++ /dev/null @@ -1,15 +0,0 @@ ---- -apiVersion: v1 -kind: Service -metadata: - name: metrics-server - namespace: kube-system - labels: - kubernetes.io/name: "Metrics-server" -spec: - selector: - k8s-app: metrics-server - ports: - - port: 443 - protocol: TCP - targetPort: 443 diff --git a/clr-k8s-examples/1-core-metrics/overlays/v0.3.3/kustomization.yaml b/clr-k8s-examples/1-core-metrics/overlays/v0.3.3/kustomization.yaml new file mode 100644 index 0000000..4050f65 --- /dev/null +++ b/clr-k8s-examples/1-core-metrics/overlays/v0.3.3/kustomization.yaml @@ -0,0 +1,8 @@ +resources: + - metrics-server/deploy/1.8+/aggregated-metrics-reader.yaml + - metrics-server/deploy/1.8+/auth-delegator.yaml + - metrics-server/deploy/1.8+/auth-reader.yaml + - metrics-server/deploy/1.8+/metrics-apiservice.yaml + - metrics-server/deploy/1.8+/metrics-server-deployment.yaml + - metrics-server/deploy/1.8+/metrics-server-service.yaml + - metrics-server/deploy/1.8+/resource-reader.yaml diff --git a/clr-k8s-examples/1-core-metrics/resource-reader.yaml b/clr-k8s-examples/1-core-metrics/resource-reader.yaml deleted file mode 100644 index 4f98772..0000000 --- a/clr-k8s-examples/1-core-metrics/resource-reader.yaml +++ /dev/null @@ -1,29 +0,0 @@ ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRole -metadata: - name: system:metrics-server -rules: -- apiGroups: - - "" - resources: - - pods - - nodes - - nodes/stats - verbs: - - get - - list - - watch ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRoleBinding -metadata: - name: system:metrics-server -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: ClusterRole - name: system:metrics-server -subjects: -- kind: ServiceAccount - name: metrics-server - namespace: kube-system diff --git a/clr-k8s-examples/1-core-metrics/versions b/clr-k8s-examples/1-core-metrics/versions deleted file mode 100644 index e0c0da0..0000000 --- a/clr-k8s-examples/1-core-metrics/versions +++ /dev/null @@ -1 +0,0 @@ -92d8412788e27ee669d38f21f20bad5342211884 diff --git a/clr-k8s-examples/2-dashboard/dashboard-admin.yaml b/clr-k8s-examples/2-dashboard/dashboard-admin.yaml deleted file mode 100644 index 5d76d39..0000000 --- a/clr-k8s-examples/2-dashboard/dashboard-admin.yaml +++ /dev/null @@ -1,14 +0,0 @@ -apiVersion: rbac.authorization.k8s.io/v1beta1 -kind: ClusterRoleBinding -metadata: - name: kubernetes-dashboard - labels: - k8s-app: kubernetes-dashboard -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: ClusterRole - name: cluster-admin -subjects: -- kind: ServiceAccount - name: kubernetes-dashboard - namespace: kube-system diff --git a/clr-k8s-examples/2-dashboard/kubernetes-dashboard.yaml b/clr-k8s-examples/2-dashboard/kubernetes-dashboard.yaml deleted file mode 100644 index 8392c90..0000000 --- a/clr-k8s-examples/2-dashboard/kubernetes-dashboard.yaml +++ /dev/null @@ -1,176 +0,0 @@ -# Copyright 2017 The Kubernetes Authors. -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# http://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. - -# ------------------- Dashboard Secret ------------------- # - -apiVersion: v1 -kind: Secret -metadata: - labels: - k8s-app: kubernetes-dashboard - name: kubernetes-dashboard-certs - namespace: kube-system -type: Opaque - ---- -# ------------------- Dashboard Service Account ------------------- # - -apiVersion: v1 -kind: ServiceAccount -metadata: - labels: - k8s-app: kubernetes-dashboard - name: kubernetes-dashboard - namespace: kube-system - ---- -# ------------------- Dashboard Role & Role Binding ------------------- # - -kind: Role -apiVersion: rbac.authorization.k8s.io/v1 -metadata: - name: kubernetes-dashboard-minimal - namespace: kube-system -rules: - # Allow Dashboard to create 'kubernetes-dashboard-key-holder' secret. -- apiGroups: [""] - resources: ["secrets"] - verbs: ["create"] - # Allow Dashboard to create 'kubernetes-dashboard-settings' config map. -- apiGroups: [""] - resources: ["configmaps"] - verbs: ["create"] - # Allow Dashboard to get, update and delete Dashboard exclusive secrets. -- apiGroups: [""] - resources: ["secrets"] - resourceNames: ["kubernetes-dashboard-key-holder", "kubernetes-dashboard-certs"] - verbs: ["get", "update", "delete"] - # Allow Dashboard to get and update 'kubernetes-dashboard-settings' config map. -- apiGroups: [""] - resources: ["configmaps"] - resourceNames: ["kubernetes-dashboard-settings"] - verbs: ["get", "update"] - # Allow Dashboard to get metrics from heapster. -- apiGroups: [""] - resources: ["services"] - resourceNames: ["heapster"] - verbs: ["proxy"] -- apiGroups: [""] - resources: ["services/proxy"] - resourceNames: ["heapster", "http:heapster:", "https:heapster:"] - verbs: ["get"] - ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: RoleBinding -metadata: - name: kubernetes-dashboard-minimal - namespace: kube-system -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: Role - name: kubernetes-dashboard-minimal -subjects: -- kind: ServiceAccount - name: kubernetes-dashboard - namespace: kube-system - ---- -# ------------------- Dashboard Deployment ------------------- # -apiVersion: v1 -kind: PersistentVolumeClaim -metadata: - name: kubernetes-dashboard-pvc - namespace: kube-system - labels: - k8s-app: kubernetes-dashboard -spec: - accessModes: - - ReadWriteOnce - resources: - requests: - storage: 1Gi ---- -kind: Deployment -apiVersion: apps/v1beta2 -metadata: - labels: - k8s-app: kubernetes-dashboard - name: kubernetes-dashboard - namespace: kube-system -spec: - replicas: 1 - revisionHistoryLimit: 10 - selector: - matchLabels: - k8s-app: kubernetes-dashboard - template: - metadata: - labels: - k8s-app: kubernetes-dashboard - spec: - containers: - - name: kubernetes-dashboard - image: k8s.gcr.io/kubernetes-dashboard-amd64:v1.10.0 - ports: - - containerPort: 8443 - protocol: TCP - args: - - --auto-generate-certificates - # Uncomment the following line to manually specify Kubernetes API server Host - # If not specified, Dashboard will attempt to auto discover the API server and connect - # to it. Uncomment only if the default does not work. - # - --apiserver-host=http://my-address:port - volumeMounts: - - name: kubernetes-dashboard-certs - mountPath: /certs - # Create on-disk volume to store exec logs - - mountPath: /tmp - name: tmp-volume - livenessProbe: - httpGet: - scheme: HTTPS - path: / - port: 8443 - initialDelaySeconds: 30 - timeoutSeconds: 30 - volumes: - - name: kubernetes-dashboard-certs - secret: - secretName: kubernetes-dashboard-certs - - name: tmp-volume - persistentVolumeClaim: - claimName: kubernetes-dashboard-pvc - serviceAccountName: kubernetes-dashboard - # Comment the following tolerations if Dashboard must not be deployed on master - #tolerations: - #- key: node-role.kubernetes.io/master - # effect: NoSchedule - ---- -# ------------------- Dashboard Service ------------------- # - -kind: Service -apiVersion: v1 -metadata: - labels: - k8s-app: kubernetes-dashboard - name: kubernetes-dashboard - namespace: kube-system -spec: - ports: - - port: 443 - targetPort: 8443 - selector: - k8s-app: kubernetes-dashboard diff --git a/clr-k8s-examples/2-dashboard/overlays/v1.10.1/kustomization.yaml b/clr-k8s-examples/2-dashboard/overlays/v1.10.1/kustomization.yaml new file mode 100644 index 0000000..e7174f0 --- /dev/null +++ b/clr-k8s-examples/2-dashboard/overlays/v1.10.1/kustomization.yaml @@ -0,0 +1,3 @@ +resources: + - dashboard/src/deploy/recommended/kubernetes-dashboard.yaml + diff --git a/clr-k8s-examples/2-dashboard/overlays/v2.0.0-beta2/kustomization.yaml b/clr-k8s-examples/2-dashboard/overlays/v2.0.0-beta2/kustomization.yaml new file mode 100644 index 0000000..baded69 --- /dev/null +++ b/clr-k8s-examples/2-dashboard/overlays/v2.0.0-beta2/kustomization.yaml @@ -0,0 +1,3 @@ +resources: + - dashboard/aio/deploy/recommended.yaml + diff --git a/clr-k8s-examples/2-dashboard/versions b/clr-k8s-examples/2-dashboard/versions deleted file mode 100644 index 5dfe879..0000000 --- a/clr-k8s-examples/2-dashboard/versions +++ /dev/null @@ -1 +0,0 @@ -https://github.com/kubernetes/dashboard/commit/5728e0303a742a889d9a25c7ae9c07e426917e90 diff --git a/clr-k8s-examples/3-efk/es-service.yaml b/clr-k8s-examples/3-efk/es-service.yaml deleted file mode 100644 index ede9306..0000000 --- a/clr-k8s-examples/3-efk/es-service.yaml +++ /dev/null @@ -1,17 +0,0 @@ -apiVersion: v1 -kind: Service -metadata: - name: elasticsearch-logging - namespace: kube-system - labels: - k8s-app: elasticsearch-logging - kubernetes.io/cluster-service: "true" - addonmanager.kubernetes.io/mode: Reconcile - kubernetes.io/name: "Elasticsearch" -spec: - ports: - - port: 9200 - protocol: TCP - targetPort: db - selector: - k8s-app: elasticsearch-logging diff --git a/clr-k8s-examples/3-efk/es-statefulset.yaml b/clr-k8s-examples/3-efk/es-statefulset.yaml deleted file mode 100644 index c90c0ec..0000000 --- a/clr-k8s-examples/3-efk/es-statefulset.yaml +++ /dev/null @@ -1,117 +0,0 @@ -# RBAC authn and authz -apiVersion: v1 -kind: ServiceAccount -metadata: - name: elasticsearch-logging - namespace: kube-system - labels: - k8s-app: elasticsearch-logging - kubernetes.io/cluster-service: "true" - addonmanager.kubernetes.io/mode: Reconcile ---- -kind: ClusterRole -apiVersion: rbac.authorization.k8s.io/v1 -metadata: - name: elasticsearch-logging - labels: - k8s-app: elasticsearch-logging - kubernetes.io/cluster-service: "true" - addonmanager.kubernetes.io/mode: Reconcile -rules: -- apiGroups: - - "" - resources: - - "services" - - "namespaces" - - "endpoints" - verbs: - - "get" ---- -kind: ClusterRoleBinding -apiVersion: rbac.authorization.k8s.io/v1 -metadata: - namespace: kube-system - name: elasticsearch-logging - labels: - k8s-app: elasticsearch-logging - kubernetes.io/cluster-service: "true" - addonmanager.kubernetes.io/mode: Reconcile -subjects: -- kind: ServiceAccount - name: elasticsearch-logging - namespace: kube-system - apiGroup: "" -roleRef: - kind: ClusterRole - name: elasticsearch-logging - apiGroup: "" ---- -# Elasticsearch deployment itself -apiVersion: apps/v1 -kind: StatefulSet -metadata: - name: elasticsearch-logging - namespace: kube-system - labels: - k8s-app: elasticsearch-logging - version: v6.3.0 - kubernetes.io/cluster-service: "true" - addonmanager.kubernetes.io/mode: Reconcile -spec: - serviceName: elasticsearch-logging - replicas: 2 - volumeClaimTemplates: - - metadata: - name: elasticsearch-logging - spec: - accessModes: - - ReadWriteOnce - resources: - requests: - storage: 1Gi - selector: - matchLabels: - k8s-app: elasticsearch-logging - version: v6.3.0 - template: - metadata: - labels: - k8s-app: elasticsearch-logging - version: v6.3.0 - kubernetes.io/cluster-service: "true" - spec: - serviceAccountName: elasticsearch-logging - containers: - - image: k8s.gcr.io/elasticsearch:v6.3.0 - name: elasticsearch-logging - resources: - # need more cpu upon initialization, therefore burstable class - limits: - cpu: 1000m - requests: - cpu: 100m - ports: - - containerPort: 9200 - name: db - protocol: TCP - - containerPort: 9300 - name: transport - protocol: TCP - volumeMounts: - - name: elasticsearch-logging - mountPath: /data - env: - - name: "NAMESPACE" - valueFrom: - fieldRef: - fieldPath: metadata.namespace - - # Elasticsearch requires vm.max_map_count to be at least 262144. - # If your OS already sets up this number to a higher value, feel free - # to remove this init container. - initContainers: - - image: alpine:3.6 - command: ["/sbin/sysctl", "-w", "vm.max_map_count=262144"] - name: elasticsearch-logging-init - securityContext: - privileged: true diff --git a/clr-k8s-examples/3-efk/fluentd-es-configmap.yaml b/clr-k8s-examples/3-efk/fluentd-es-configmap.yaml deleted file mode 100644 index c1fecf8..0000000 --- a/clr-k8s-examples/3-efk/fluentd-es-configmap.yaml +++ /dev/null @@ -1,464 +0,0 @@ -kind: ConfigMap -apiVersion: v1 -metadata: - name: fluentd-es-config-v0.1.6 - namespace: kube-system - labels: - addonmanager.kubernetes.io/mode: Reconcile -data: - system.conf: |- - - root_dir /tmp/fluentd-buffers/ - - - containers.input.conf: |- - # This configuration file for Fluentd / td-agent is used - # to watch changes to Docker log files. The kubelet creates symlinks that - # capture the pod name, namespace, container name & Docker container ID - # to the docker logs for pods in the /var/log/containers directory on the host. - # If running this fluentd configuration in a Docker container, the /var/log - # directory should be mounted in the container. - # - # These logs are then submitted to Elasticsearch which assumes the - # installation of the fluent-plugin-elasticsearch & the - # fluent-plugin-kubernetes_metadata_filter plugins. - # See https://github.com/uken/fluent-plugin-elasticsearch & - # https://github.com/fabric8io/fluent-plugin-kubernetes_metadata_filter for - # more information about the plugins. - # - # Example - # ======= - # A line in the Docker log file might look like this JSON: - # - # {"log":"2014/09/25 21:15:03 Got request with path wombat\n", - # "stream":"stderr", - # "time":"2014-09-25T21:15:03.499185026Z"} - # - # The time_format specification below makes sure we properly - # parse the time format produced by Docker. This will be - # submitted to Elasticsearch and should appear like: - # $ curl 'http://elasticsearch-logging:9200/_search?pretty' - # ... - # { - # "_index" : "logstash-2014.09.25", - # "_type" : "fluentd", - # "_id" : "VBrbor2QTuGpsQyTCdfzqA", - # "_score" : 1.0, - # "_source":{"log":"2014/09/25 22:45:50 Got request with path wombat\n", - # "stream":"stderr","tag":"docker.container.all", - # "@timestamp":"2014-09-25T22:45:50+00:00"} - # }, - # ... - # - # The Kubernetes fluentd plugin is used to write the Kubernetes metadata to the log - # record & add labels to the log record if properly configured. This enables users - # to filter & search logs on any metadata. - # For example a Docker container's logs might be in the directory: - # - # /var/lib/docker/containers/997599971ee6366d4a5920d25b79286ad45ff37a74494f262e3bc98d909d0a7b - # - # and in the file: - # - # 997599971ee6366d4a5920d25b79286ad45ff37a74494f262e3bc98d909d0a7b-json.log - # - # where 997599971ee6... is the Docker ID of the running container. - # The Kubernetes kubelet makes a symbolic link to this file on the host machine - # in the /var/log/containers directory which includes the pod name and the Kubernetes - # container name: - # - # synthetic-logger-0.25lps-pod_default_synth-lgr-997599971ee6366d4a5920d25b79286ad45ff37a74494f262e3bc98d909d0a7b.log - # -> - # /var/lib/docker/containers/997599971ee6366d4a5920d25b79286ad45ff37a74494f262e3bc98d909d0a7b/997599971ee6366d4a5920d25b79286ad45ff37a74494f262e3bc98d909d0a7b-json.log - # - # The /var/log directory on the host is mapped to the /var/log directory in the container - # running this instance of Fluentd and we end up collecting the file: - # - # /var/log/containers/synthetic-logger-0.25lps-pod_default_synth-lgr-997599971ee6366d4a5920d25b79286ad45ff37a74494f262e3bc98d909d0a7b.log - # - # This results in the tag: - # - # var.log.containers.synthetic-logger-0.25lps-pod_default_synth-lgr-997599971ee6366d4a5920d25b79286ad45ff37a74494f262e3bc98d909d0a7b.log - # - # The Kubernetes fluentd plugin is used to extract the namespace, pod name & container name - # which are added to the log message as a kubernetes field object & the Docker container ID - # is also added under the docker field object. - # The final tag is: - # - # kubernetes.var.log.containers.synthetic-logger-0.25lps-pod_default_synth-lgr-997599971ee6366d4a5920d25b79286ad45ff37a74494f262e3bc98d909d0a7b.log - # - # And the final log record look like: - # - # { - # "log":"2014/09/25 21:15:03 Got request with path wombat\n", - # "stream":"stderr", - # "time":"2014-09-25T21:15:03.499185026Z", - # "kubernetes": { - # "namespace": "default", - # "pod_name": "synthetic-logger-0.25lps-pod", - # "container_name": "synth-lgr" - # }, - # "docker": { - # "container_id": "997599971ee6366d4a5920d25b79286ad45ff37a74494f262e3bc98d909d0a7b" - # } - # } - # - # This makes it easier for users to search for logs by pod name or by - # the name of the Kubernetes container regardless of how many times the - # Kubernetes pod has been restarted (resulting in a several Docker container IDs). - - # Json Log Example: - # {"log":"[info:2016-02-16T16:04:05.930-08:00] Some log text here\n","stream":"stdout","time":"2016-02-17T00:04:05.931087621Z"} - # CRI Log Example: - # 2016-02-17T00:04:05.931087621Z stdout F [info:2016-02-16T16:04:05.930-08:00] Some log text here - - @id fluentd-containers.log - @type tail - path /var/log/containers/*.log - pos_file /var/log/es-containers.log.pos - tag raw.kubernetes.* - read_from_head true - - @type multi_format - - format json - time_key time - time_format %Y-%m-%dT%H:%M:%S.%NZ - - - format /^(? - - - - # Detect exceptions in the log output and forward them as one log entry. - - @id raw.kubernetes - @type detect_exceptions - remove_tag_prefix raw - message log - stream stream - multiline_flush_interval 5 - max_bytes 500000 - max_lines 1000 - - - system.input.conf: |- - # Example: - # 2015-12-21 23:17:22,066 [salt.state ][INFO ] Completed state [net.ipv4.ip_forward] at time 23:17:22.066081 - - @id minion - @type tail - format /^(?