Skip to content

Commit 6321522

Browse files
paliwalparitoshpaliwalparitosh
authored
Bug-Fix: Discovery policy placement & scope updated (#69)
* policy scope bug fix
1 parent 0834572 commit 6321522

File tree

6 files changed

+56
-82
lines changed

6 files changed

+56
-82
lines changed

‎.gitignore‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -62,6 +62,9 @@ charts/tests/
6262
charts/**/Chart.lock
6363
charts/**/charts/
6464

65+
# RM Schema Validation
66+
meta-schema.yaml
67+
6568
# zip artifacts
6669
releases/
6770

‎terraform/modules/helm/helm.tf‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,9 +5,11 @@ locals {
55
helm_repo_url = "https://oracle-quickstart.github.io/oci-kubernetes-monitoring"
66
helm_repo_chart = "oci-onm"
77

8+
k8s_namespace = var.deploy_mushop_config ? "livelab-test" : var.kubernetes_namespace
9+
810
helm_inputs = {
911
# global
10-
"global.namespace" = var.deploy_mushop_config ? "livelab-test" : var.kubernetes_namespace
12+
"global.namespace" = local.k8s_namespace
1113
"global.kubernetesClusterID" = var.oke_cluster_ocid
1214
"global.kubernetesClusterName" = var.oke_cluster_name
1315

‎terraform/modules/helm/outputs.tf‎

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,35 @@
1+
locals {
2+
cmd_1_helm_repo_add = "helm repo add oci-onm https://oracle-quickstart.github.io/oci-kubernetes-monitoring"
3+
cmd_2_helm_repo_update = "helm repo update"
4+
5+
helm_install_opt_entity_id = var.oke_cluster_entity_ocid == "DEFAULT" ? "" : "--set oci-onm-logan.ociLAClusterEntityID=${var.oke_cluster_entity_ocid}"
6+
7+
cmd_3_helm_install = join(" ", [
8+
"helm install oci-kubernetes-monitoring oci-onm/oci-onm",
9+
"--set global.namespace=${local.k8s_namespace}",
10+
"--set global.kubernetesClusterID=${var.oke_cluster_ocid}",
11+
"--set global.kubernetesClusterName=${var.oke_cluster_name}",
12+
"--set oci-onm-logan.ociLALogGroupID=${var.oci_la_logGroup_id}",
13+
"--set oci-onm-logan.ociLANamespace=${var.oci_la_namespace}",
14+
local.helm_install_opt_entity_id,
15+
"--set oci-onm-mgmt-agent.deployMetricServer=${var.opt_deploy_metric_server}",
16+
"--set oci-onm-mgmt-agent.mgmtagent.installKeyFileContent=${var.mgmt_agent_install_key_content}"
17+
])
18+
}
19+
120
# Helm release artifacts for local testing and validation.
221
output "helm_template" {
322
value = var.generate_helm_template ? data.helm_template.oci-kubernetes-monitoring[0].manifest : null
23+
}
24+
25+
output "cmd_1_helm_repo_add" {
26+
value = local.cmd_1_helm_repo_add
27+
}
28+
29+
output "cmd_2_helm_repo_update" {
30+
value = local.cmd_2_helm_repo_update
31+
}
32+
33+
output "cmd_3_helm_install" {
34+
value = local.cmd_3_helm_install
435
}

‎terraform/modules/iam/iam.tf‎

Lines changed: 11 additions & 25 deletions
Original file line numberDiff line numberDiff line change
@@ -2,38 +2,24 @@
22
# Licensed under the Universal Permissive License v1.0 as shown at https://oss.oracle.com/licenses/upl.
33

44
locals {
5-
# Compartments
6-
oci_onm_compartment_name = data.oci_identity_compartment.oci_onm_compartment.name
7-
oke_compartment_name = data.oci_identity_compartment.oke_compartment.name
5+
cluster_ocid_md5 = md5(var.oke_cluster_ocid)
86

97
# Dynmaic Group
10-
uuid_dynamic_group = md5(var.oke_cluster_ocid)
11-
dynamic_group_name = "oci-kubernetes-monitoring-${local.uuid_dynamic_group}"
8+
dynamic_group_name = "oci-kubernetes-monitoring-${local.cluster_ocid_md5}"
129
dynamic_group_desc = "Auto generated by Resource Manager Stack - oci-kubernetes-monitoring. Required for monitoring OKE Cluster - ${var.oke_cluster_ocid}"
1310
instances_in_compartment_rule = ["ALL {instance.compartment.id = '${var.oke_compartment_ocid}'}"]
1411
management_agent_rule = ["ALL {resource.type='managementagent', resource.compartment.id='${var.oci_onm_compartment_ocid}'}"]
1512
dynamic_group_matching_rules = concat(local.instances_in_compartment_rule, local.management_agent_rule)
1613
complied_dynamic_group_rules = "ANY {${join(",", local.dynamic_group_matching_rules)}}"
1714

1815
# Policy
19-
uuid_policy = md5("${local.dynamic_group_name}${local.oci_onm_compartment_name}")
20-
policy_name = "oci-kubernetes-monitoring-${local.uuid_policy}"
21-
policy_desc = "Auto generated by Resource Manager Stack - oci-kubernetes-monitoring. Allows Fluentd and MgmtAgent Pods running inside Kubernetes Cluster to send the data to OCI Logging Analytics and OCI Monitoring respectively."
22-
policy_scope = var.root_compartment_ocid == var.oci_onm_compartment_ocid ? "tenancy" : "compartment ${local.oci_onm_compartment_name}"
23-
mgmt_agent_policy = ["Allow dynamic-group ${local.dynamic_group_name} to use METRICS in ${local.policy_scope} WHERE target.metrics.namespace = 'mgmtagent_kubernetes_metrics'"]
24-
fluentd_agent_policy = ["Allow dynamic-group ${local.dynamic_group_name} to {LOG_ANALYTICS_LOG_GROUP_UPLOAD_LOGS} in ${local.policy_scope}"]
25-
discovery_api_policy = ["Allow dynamic-group ${local.dynamic_group_name} to {LOG_ANALYTICS_DISCOVERY_UPLOAD} in ${local.policy_scope}"]
26-
policy_statements = concat(local.fluentd_agent_policy, local.mgmt_agent_policy, local.discovery_api_policy)
27-
}
28-
29-
# Logging Analytics Compartment
30-
data "oci_identity_compartment" "oci_onm_compartment" {
31-
id = var.oci_onm_compartment_ocid
32-
}
33-
34-
# OKE Compartment
35-
data "oci_identity_compartment" "oke_compartment" {
36-
id = var.oke_compartment_ocid
16+
policy_name = "oci-kubernetes-monitoring-${local.cluster_ocid_md5}"
17+
policy_scope = var.root_compartment_ocid == var.oci_onm_compartment_ocid ? "tenancy" : "compartment id ${var.oci_onm_compartment_ocid}"
18+
policy_desc = "Auto generated by Resource Manager Stack - oci-kubernetes-monitoring. Allows Fluentd and MgmtAgent Pods running inside Kubernetes Cluster to send the data to OCI Logging Analytics and OCI Monitoring respectively."
19+
mgmt_agent_stmt = ["Allow dynamic-group ${local.dynamic_group_name} to use METRICS in ${local.policy_scope} WHERE target.metrics.namespace = 'mgmtagent_kubernetes_metrics'"]
20+
fluentd_agent_stmt = ["Allow dynamic-group ${local.dynamic_group_name} to {LOG_ANALYTICS_LOG_GROUP_UPLOAD_LOGS} in ${local.policy_scope}"]
21+
discovery_api_stmt = ["Allow dynamic-group ${local.dynamic_group_name} to {LOG_ANALYTICS_DISCOVERY_UPLOAD} in tenancy"]
22+
compiled_policy_statements = concat(local.fluentd_agent_stmt, local.mgmt_agent_stmt, local.discovery_api_stmt)
3723
}
3824

3925
# Dynmaic Group
@@ -49,8 +35,8 @@ resource "oci_identity_dynamic_group" "oke_dynamic_group" {
4935
resource "oci_identity_policy" "oke_monitoring_policy" {
5036
name = local.policy_name
5137
description = local.policy_desc
52-
compartment_id = var.oci_onm_compartment_ocid
53-
statements = local.policy_statements
38+
compartment_id = var.root_compartment_ocid
39+
statements = local.compiled_policy_statements
5440
#provider = oci.home_region
5541

5642
depends_on = [oci_identity_dynamic_group.oke_dynamic_group]

‎terraform/oke/main.tf‎

Lines changed: 4 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -18,8 +18,7 @@ locals {
1818
module_controls_enable_iam_module = alltrue([var.toggle_iam_module, var.opt_create_dynamicGroup_and_policies, !var.livelab_switch])
1919
module_controls_enable_logan_module = alltrue([var.toggle_logan_module])
2020
module_controls_enable_mgmt_agent_module = alltrue([var.toggle_mgmt_agent_module])
21-
module_controls_enable_helm_module = alltrue([var.toggle_helm_module, local.deploy_helm,
22-
local.module_controls_enable_mgmt_agent_module, local.module_controls_enable_logan_module])
21+
module_controls_enable_helm_module = alltrue([var.toggle_helm_module, local.module_controls_enable_mgmt_agent_module, local.module_controls_enable_logan_module])
2322
}
2423

2524
// Only execute for livelab stack
@@ -78,7 +77,7 @@ module "helm_release" {
7877
source = "./modules/helm"
7978
helm_abs_path = abspath("./charts/oci-onm")
8079
use_local_helm_chart = var.toggle_use_local_helm_chart
81-
install_helm = var.toggle_install_helm
80+
install_helm = local.deploy_helm && var.toggle_install_helm
8281
generate_helm_template = var.toggle_generate_helm_template
8382
oke_compartment_ocid = var.oke_compartment_ocid
8483
oke_cluster_ocid = var.oke_cluster_ocid
@@ -101,6 +100,6 @@ module "import_kubernetes_dashbords" {
101100
source = "./modules/dashboards"
102101
compartment_ocid = var.oci_onm_compartment_ocid
103102

104-
count = local.module_controls_enable_dashboards_module ? 1 : 0
105-
depends_on = [ module.helm_release ]
103+
count = local.module_controls_enable_dashboards_module ? 1 : 0
104+
depends_on = [module.helm_release]
106105
}

‎terraform/oke/outputs.tf‎

Lines changed: 4 additions & 51 deletions
Original file line numberDiff line numberDiff line change
@@ -1,69 +1,22 @@
11
# Copyright (c) 2023, Oracle and/or its affiliates.
22
# Licensed under the Universal Permissive License v1.0 as shown at https://oss.oracle.com/licenses/upl.
33

4-
locals {
5-
# generate_helm_output evaluates to true in production
6-
generate_helm_output = alltrue([local.module_controls_enable_mgmt_agent_module, local.module_controls_enable_logan_module])
7-
8-
output_helm_external_values = local.generate_helm_output ? yamlencode({
9-
"global" = {
10-
"kubernetesClusterID" = var.oke_cluster_ocid
11-
"kubernetesClusterName" = local.oke_cluster_name
12-
}
13-
"oci-onm-logan" = {
14-
"ociLANamespace" = module.loggingAnalytics[0].oci_la_namespace
15-
"ociLALogGroupID" = module.loggingAnalytics[0].oci_la_logGroup_ocid
16-
"ociLAClusterEntityID" = var.oke_cluster_entity_ocid == "DEFAULT" ? null : var.oke_cluster_entity_ocid
17-
}
18-
"oci-onm-mgmt-agent" = {
19-
"mgmtagent" = {
20-
"installKeyFileContent" = module.management_agent[0].mgmt_agent_install_key_content
21-
}
22-
}
23-
}) : null
24-
25-
26-
cmd_1_helm_repo_add = "helm repo add oci-onm https://oracle-quickstart.github.io/oci-kubernetes-monitoring"
27-
28-
cmd_2_helm_repo_update = "helm repo update"
29-
30-
helm_install_opt_entity_id = var.oke_cluster_entity_ocid == "DEFAULT" ? "" : "--set oci-onm-logan.ociLAClusterEntityID=${var.oke_cluster_entity_ocid}"
31-
32-
cmd_3_helm_install = local.generate_helm_output ? join(" ", [
33-
"helm install oci-kubernetes-monitoring oci-onm/oci-onm",
34-
"--set global.kubernetesClusterID=${var.oke_cluster_ocid}",
35-
"--set global.kubernetesClusterName=${local.oke_cluster_name}",
36-
"--set oci-onm-logan.ociLALogGroupID=${module.loggingAnalytics[0].oci_la_logGroup_ocid}",
37-
"--set oci-onm-logan.ociLANamespace=${module.loggingAnalytics[0].oci_la_namespace}",
38-
local.helm_install_opt_entity_id,
39-
"--set oci-onm-mgmt-agent.mgmtagent.installKeyFileContent=${module.management_agent[0].mgmt_agent_install_key_content}"
40-
]) : null
41-
}
42-
434
###
44-
# helm outputs
5+
# Module outputs
456
###
467

478
output "cmd_1_helm_repo_add" {
48-
value = local.generate_helm_output ? local.cmd_1_helm_repo_add : null
9+
value = local.module_controls_enable_helm_module ? module.helm_release[0].cmd_1_helm_repo_add : null
4910
}
5011

5112
output "cmd_2_helm_repo_update" {
52-
value = local.generate_helm_output ? local.cmd_2_helm_repo_update : null
13+
value = local.module_controls_enable_helm_module ? module.helm_release[0].cmd_2_helm_repo_update : null
5314
}
5415

5516
output "cmd_3_helm_install" {
56-
value = local.generate_helm_output ? local.cmd_3_helm_install : null
17+
value = local.module_controls_enable_helm_module ? module.helm_release[0].cmd_3_helm_install : null
5718
}
5819

59-
/* output "external_values_yaml" {
60-
value = local.output_helm_external_values
61-
} */
62-
63-
###
64-
# Module outputs
65-
###
66-
6720
output "oke_cluster_name" {
6821
value = local.oke_cluster_name
6922
}

0 commit comments

Comments
 (0)