Skip to content

Commit 97177ee

Browse files
RJrocksOmar
RJrocks
and
Omar
authored
EKS container insights (#204)
* adot-container-insight-tf-code by Rajat Omar * Documentation and naming convention added * PR review fixes * PR CI pipeline fixes * pr ci run fixes * added the variables mentioned in ci build * ci variable fixes * changed the module name --------- Co-authored-by: Omar <[email protected]>
1 parent 4d88d16 commit 97177ee

File tree

15 files changed

+484
-0
lines changed

15 files changed

+484
-0
lines changed

‎docs/container-insights/eks.md‎

Lines changed: 59 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,59 @@
1+
# Setting Up Container Insights for your EKS Cluster
2+
3+
This example deploys AWS Distro of OpenTelemetry on your EKS cluster as a Daemonset which will enable
4+
Container Insights metrics Dashboard on Amazon CloudWatch.
5+
6+
7+
## Prerequisites
8+
9+
!!! note
10+
Make sure to complete the [prerequisites section](https://aws-observability.github.io/terraform-aws-observability-accelerator/concepts/#prerequisites) before proceeding.
11+
12+
## Setup
13+
14+
### 1. Download sources and initialize Terraform
15+
16+
```
17+
git clone https://github.com/aws-observability/terraform-aws-observability-accelerator.git
18+
cd terraform-aws-observability-accelerator/examples/eks-container-insights
19+
terraform init
20+
```
21+
22+
### 2. AWS Region
23+
24+
Specify the AWS Region where the resources will be deployed:
25+
26+
```bash
27+
export TF_VAR_aws_region=xxx
28+
```
29+
### 2. EKS Cluster Name
30+
31+
Specify the EKS Cluster Name where the resources will be deployed:
32+
33+
```bash
34+
export TF_VAR_eks_cluster_id=xxx
35+
```
36+
37+
## Deploy
38+
39+
Simply run this command to deploy the example
40+
41+
```bash
42+
terraform apply
43+
```
44+
45+
## Visualization
46+
47+
After apply, open your Amazon CloudWatch console in the same region as your EKS cluster, then from the left hand side choose `Insights -> Container Insights`, there choose the `Performance montoring` from the drop down, choose the `cluster name` and you will see the metrics shown on the dashboard:
48+
49+
50+
<img width="1423" alt="Screenshot 2023-08-08 at 1.15.14 PM" src="https://github.com/RJrocks/terraform-aws-observability-accelerator/assets/5756583/4c5e4ed3-2e1f-4d41-b568-01976fbfd303">
51+
52+
53+
## Cleanup
54+
55+
To clean up your environment, destroy the Terraform example by running
56+
57+
```sh
58+
terraform destroy
59+
```

‎examples/eks-container-insights/README.md‎

Lines changed: 54 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,54 @@
1+
# Enable Container Insights for EKS cluster
2+
3+
This example deploys ADOT as a daemonset on your EKS cluster which enables Container Insights metrics on CloudWatch.
4+
5+
Step-by-step instructions available on our [docs site](https://aws-observability.github.io/terraform-aws-observability-accelerator/)
6+
under **Amazon CloudWatch Container Insights**
7+
8+
9+
<!-- BEGINNING OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
10+
## Requirements
11+
12+
| Name | Version |
13+
|------|---------|
14+
| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 1.1.0 |
15+
| <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 5.0.0 |
16+
| <a name="requirement_helm"></a> [helm](#requirement\_helm) | >= 2.4.1 |
17+
| <a name="requirement_kubectl"></a> [kubectl](#requirement\_kubectl) | >= 1.14 |
18+
| <a name="requirement_kubernetes"></a> [kubernetes](#requirement\_kubernetes) | >= 2.10 |
19+
20+
## Providers
21+
22+
| Name | Version |
23+
|------|---------|
24+
| <a name="provider_aws"></a> [aws](#provider\_aws) | >= 5.0.0 |
25+
26+
## Modules
27+
28+
| Name | Source | Version |
29+
|------|--------|---------|
30+
| <a name="module_eks_container_insights"></a> [eks\_container\_insights](#module\_eks\_container\_insights) | ../../modules/eks-container-insights | n/a |
31+
32+
## Resources
33+
34+
| Name | Type |
35+
|------|------|
36+
| [aws_caller_identity.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/caller_identity) | data source |
37+
| [aws_eks_cluster.eks_cluster](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/eks_cluster) | data source |
38+
| [aws_partition.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/partition) | data source |
39+
| [aws_region.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/region) | data source |
40+
41+
## Inputs
42+
43+
| Name | Description | Type | Default | Required |
44+
|------|-------------|------|---------|:--------:|
45+
| <a name="input_aws_region"></a> [aws\_region](#input\_aws\_region) | EKS cluster region | `string` | n/a | yes |
46+
| <a name="input_eks_cluster_id"></a> [eks\_cluster\_id](#input\_eks\_cluster\_id) | EKS cluster name | `string` | n/a | yes |
47+
| <a name="input_irsa_iam_permissions_boundary"></a> [irsa\_iam\_permissions\_boundary](#input\_irsa\_iam\_permissions\_boundary) | IAM permissions boundary for IRSA roles | `string` | `null` | no |
48+
| <a name="input_irsa_iam_role_path"></a> [irsa\_iam\_role\_path](#input\_irsa\_iam\_role\_path) | IAM role path for IRSA roles | `string` | `"/"` | no |
49+
| <a name="input_tags"></a> [tags](#input\_tags) | Additional tags (e.g. `map('BusinessUnit`,`XYZ`) | `map(string)` | `{}` | no |
50+
51+
## Outputs
52+
53+
No outputs.
54+
<!-- END OF PRE-COMMIT-TERRAFORM DOCS HOOK -->

‎examples/eks-container-insights/locals.tf‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
data "aws_partition" "current" {}
2+
3+
data "aws_caller_identity" "current" {}
4+
5+
data "aws_region" "current" {}
6+
7+
data "aws_eks_cluster" "eks_cluster" {
8+
name = var.eks_cluster_id
9+
}

‎examples/eks-container-insights/main.tf‎

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
provider "aws" {
2+
region = var.aws_region
3+
}
4+
5+
provider "kubernetes" {
6+
host = local.eks_cluster_endpoint
7+
cluster_ca_certificate = base64decode(data.aws_eks_cluster.eks_cluster.certificate_authority[0].data)
8+
exec {
9+
api_version = "client.authentication.k8s.io/v1beta1"
10+
args = ["eks", "get-token", "--cluster-name", var.eks_cluster_id]
11+
command = "aws"
12+
}
13+
}
14+
15+
provider "helm" {
16+
kubernetes {
17+
host = local.eks_cluster_endpoint
18+
cluster_ca_certificate = base64decode(data.aws_eks_cluster.eks_cluster.certificate_authority[0].data)
19+
exec {
20+
api_version = "client.authentication.k8s.io/v1beta1"
21+
args = ["eks", "get-token", "--cluster-name", var.eks_cluster_id]
22+
command = "aws"
23+
}
24+
}
25+
}
26+
27+
28+
# Deploy the ADOT Container Insights
29+
30+
module "eks_container_insights" {
31+
source = "../../modules/eks-container-insights"
32+
# source = "github.com/aws-observability/terraform-aws-observability-accelerator//modules/eks-container-insights?ref=v2.5.4"
33+
eks_cluster_id = var.eks_cluster_id
34+
}

‎examples/eks-container-insights/outputs.tf‎

Whitespace-only changes.

‎examples/eks-container-insights/variables.tf‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
variable "eks_cluster_id" {
2+
description = "EKS cluster name"
3+
type = string
4+
}
5+
6+
variable "aws_region" {
7+
description = "EKS cluster region"
8+
type = string
9+
}
10+
11+
variable "irsa_iam_role_path" {
12+
description = "IAM role path for IRSA roles"
13+
type = string
14+
default = "/"
15+
}
16+
17+
variable "irsa_iam_permissions_boundary" {
18+
description = "IAM permissions boundary for IRSA roles"
19+
type = string
20+
default = null
21+
}
22+
23+
variable "tags" {
24+
description = "Additional tags (e.g. `map('BusinessUnit`,`XYZ`)"
25+
type = map(string)
26+
default = {}
27+
}

‎examples/eks-container-insights/versions.tf‎

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
terraform {
2+
required_version = ">= 1.1.0"
3+
4+
required_providers {
5+
aws = {
6+
source = "hashicorp/aws"
7+
version = ">= 5.0.0"
8+
}
9+
kubernetes = {
10+
source = "hashicorp/kubernetes"
11+
version = ">= 2.10"
12+
}
13+
kubectl = {
14+
source = "gavinbunney/kubectl"
15+
version = ">= 1.14"
16+
}
17+
helm = {
18+
source = "hashicorp/helm"
19+
version = ">= 2.4.1"
20+
}
21+
}
22+
23+
# ## Used for end-to-end testing on project; update to suit your needs
24+
# backend "s3" {
25+
# bucket = "aws-observability-accelerator-terraform-states"
26+
# region = "us-west-2"
27+
# key = "e2e/eks_container_insights/terraform.tfstate"
28+
# }
29+
30+
}

‎mkdocs.yml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -35,6 +35,8 @@ nav:
3535
- Viewing logs: eks/logs.md
3636
- Tracing: eks/tracing.md
3737
- Teardown: eks/destroy.md
38+
- Amazon CloudWatch Container Insights:
39+
- Amazon EKS: container-insights/eks.md
3840
- Monitoring Managed Service for Prometheus Workspaces: workloads/managed-prometheus.md
3941
- Supporting Examples:
4042
- EKS Cluster with VPC: helpers/new-eks-cluster.md

‎modules/eks-container-insights/README.md‎

Lines changed: 61 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,61 @@
1+
# Container Insights ADOT implementation for EKS Cluster Observability
2+
3+
This module provides an automated experience around enabling Container Insights for your EKS cluster using ADOT (AWS Distro for OpenTelemetry).
4+
It provides the following resources:
5+
6+
- ADOT Collector Deployment to your EKS cluster
7+
- Enabling Container Insights on CloudWatch
8+
9+
10+
<!-- BEGINNING OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
11+
## Requirements
12+
13+
| Name | Version |
14+
|------|---------|
15+
| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 1.1.0 |
16+
| <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 5.0.0 |
17+
| <a name="requirement_helm"></a> [helm](#requirement\_helm) | >= 2.4.1 |
18+
| <a name="requirement_kubectl"></a> [kubectl](#requirement\_kubectl) | >= 1.14 |
19+
| <a name="requirement_kubernetes"></a> [kubernetes](#requirement\_kubernetes) | >= 2.10 |
20+
21+
## Providers
22+
23+
| Name | Version |
24+
|------|---------|
25+
| <a name="provider_aws"></a> [aws](#provider\_aws) | >= 5.0.0 |
26+
27+
## Modules
28+
29+
| Name | Source | Version |
30+
|------|--------|---------|
31+
| <a name="module_helm_addon"></a> [helm\_addon](#module\_helm\_addon) | github.com/aws-ia/terraform-aws-eks-blueprints//modules/kubernetes-addons/helm-addon | v4.32.1 |
32+
33+
## Resources
34+
35+
| Name | Type |
36+
|------|------|
37+
| [aws_caller_identity.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/caller_identity) | data source |
38+
| [aws_eks_cluster.eks_cluster](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/eks_cluster) | data source |
39+
| [aws_iam_policy.irsa](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy) | data source |
40+
| [aws_partition.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/partition) | data source |
41+
| [aws_region.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/region) | data source |
42+
43+
## Inputs
44+
45+
| Name | Description | Type | Default | Required |
46+
|------|-------------|------|---------|:--------:|
47+
| <a name="input_adot_otel_helm_chart_verison"></a> [adot\_otel\_helm\_chart\_verison](#input\_adot\_otel\_helm\_chart\_verison) | ADOT collector helm chart version | `string` | `"0.17.0"` | no |
48+
| <a name="input_eks_cluster_id"></a> [eks\_cluster\_id](#input\_eks\_cluster\_id) | EKS Cluster Id | `string` | n/a | yes |
49+
| <a name="input_helm_config"></a> [helm\_config](#input\_helm\_config) | Helm provider config for adot-exporter-for-eks-on-ec2 | `any` | `{}` | no |
50+
| <a name="input_irsa_iam_permissions_boundary"></a> [irsa\_iam\_permissions\_boundary](#input\_irsa\_iam\_permissions\_boundary) | IAM permissions boundary for IRSA roles | `string` | `null` | no |
51+
| <a name="input_irsa_iam_role_path"></a> [irsa\_iam\_role\_path](#input\_irsa\_iam\_role\_path) | IAM role path for IRSA roles | `string` | `"/"` | no |
52+
| <a name="input_irsa_policies"></a> [irsa\_policies](#input\_irsa\_policies) | Additional IAM policies for a IAM role for service accounts | `list(string)` | `[]` | no |
53+
| <a name="input_manage_via_gitops"></a> [manage\_via\_gitops](#input\_manage\_via\_gitops) | Determines if the add-on should be managed via GitOps. | `bool` | `false` | no |
54+
| <a name="input_service_exporters"></a> [service\_exporters](#input\_service\_exporters) | exporter for adot-ci setup | `string` | `"awsemf"` | no |
55+
| <a name="input_service_receivers"></a> [service\_receivers](#input\_service\_receivers) | receiver for adot-ci setup | `string` | `"awscontainerinsightreceiver"` | no |
56+
| <a name="input_tags"></a> [tags](#input\_tags) | Additional tags (e.g. `map('BusinessUnit`,`XYZ`) | `map(string)` | `{}` | no |
57+
58+
## Outputs
59+
60+
No outputs.
61+
<!-- END OF PRE-COMMIT-TERRAFORM DOCS HOOK -->

‎modules/eks-container-insights/locals.tf‎

Lines changed: 78 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,78 @@
1+
data "aws_partition" "current" {}
2+
3+
data "aws_caller_identity" "current" {}
4+
5+
data "aws_region" "current" {}
6+
7+
data "aws_eks_cluster" "eks_cluster" {
8+
name = var.eks_cluster_id
9+
}
10+
11+
data "aws_iam_policy" "irsa" {
12+
arn = "arn:aws:iam::aws:policy/CloudWatchAgentServerPolicy"
13+
}
14+
15+
locals {
16+
name = "adot-exporter-for-eks-on-ec2"
17+
service_account = try(var.helm_config.service_account, "${local.name}-sa")
18+
19+
set_values = [
20+
{
21+
name = "serviceAccount.name"
22+
value = local.service_account
23+
},
24+
{
25+
name = "serviceAccount.create"
26+
value = false
27+
}
28+
]
29+
# https://github.com/aws-observability/aws-otel-helm-charts/tree/main/charts/adot-exporter-for-eks-on-ec2
30+
default_helm_config = {
31+
name = local.name
32+
chart = "adot-exporter-for-eks-on-ec2"
33+
repository = "https://aws-observability.github.io/aws-otel-helm-charts"
34+
version = var.adot_otel_helm_chart_verison
35+
namespace = "amazon-metrics"
36+
values = local.default_helm_values
37+
description = "ADOT Helm Chart Deployment Configuration for Container Insights"
38+
}
39+
40+
helm_config = merge(
41+
local.default_helm_config,
42+
var.helm_config
43+
)
44+
45+
default_helm_values = [templatefile("${path.module}/values.yaml", {
46+
aws_region = local.addon_context.aws_region_name
47+
cluster_name = local.addon_context.eks_cluster_id
48+
service_receivers = format("[\"%s\"]", var.service_receivers)
49+
service_exporters = format("[\"%s\"]", var.service_exporters)
50+
service_account = local.service_account
51+
})]
52+
53+
irsa_config = {
54+
kubernetes_namespace = local.helm_config["namespace"]
55+
kubernetes_service_account = local.service_account
56+
create_kubernetes_namespace = try(local.helm_config["create_namespace"], true)
57+
create_kubernetes_service_account = true
58+
create_service_account_secret_token = try(local.helm_config["create_service_account_secret_token"], false)
59+
irsa_iam_policies = concat([data.aws_iam_policy.irsa.arn], var.irsa_policies)
60+
}
61+
62+
eks_oidc_issuer_url = replace(data.aws_eks_cluster.eks_cluster.identity[0].oidc[0].issuer, "https://", "")
63+
64+
addon_context = {
65+
aws_caller_identity_account_id = data.aws_caller_identity.current.account_id
66+
aws_caller_identity_arn = data.aws_caller_identity.current.arn
67+
aws_eks_cluster_endpoint = data.aws_eks_cluster.eks_cluster.endpoint
68+
aws_partition_id = data.aws_partition.current.partition
69+
aws_region_name = data.aws_region.current.name
70+
eks_cluster_id = var.eks_cluster_id
71+
eks_oidc_issuer_url = replace(data.aws_eks_cluster.eks_cluster.identity[0].oidc[0].issuer, "https://", "")
72+
eks_oidc_provider_arn = "arn:${data.aws_partition.current.partition}:iam::${data.aws_caller_identity.current.account_id}:oidc-provider/${local.eks_oidc_issuer_url}"
73+
tags = var.tags
74+
irsa_iam_role_path = var.irsa_iam_role_path
75+
irsa_iam_permissions_boundary = var.irsa_iam_permissions_boundary
76+
}
77+
78+
}

0 commit comments

Comments
 (0)