Skip to content

Commit 6e4dbb1

Browse files
mukulpalit-ibmmukulpalit-ibm
committed
add monitoring and logs agent
1 parent cf01b7c commit 6e4dbb1

File tree

5 files changed

+142
-34
lines changed

5 files changed

+142
-34
lines changed

‎examples/monolith/README.md‎

Lines changed: 12 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -6,18 +6,21 @@ The following resources are provisioned by this example:
66
- A new resource group, if an existing one is not passed in.
77
- A Key Protect instance with 2 root keys, one for cluster encryption, and one for worker boot volume encryption.
88
- A VPC with subnets across 3 zones.
9-
- A public gateway for all the three zones
9+
- A public gateway for all the three zones.
1010
- A multi-zone (3 zone) KMS encrypted OCP VPC cluster, with worker pools in each zone.
1111
- An additional worker pool named workerpool is created and attached to the cluster using the worker-pool submodule.
1212
- Auto scaling enabled for the default worker pool.
1313
- Taints against the workers in zone-2 and zone-3.
1414
- Enable Kubernetes API server audit logs.
15-
- A Cloud logs instance
16-
- A Cloud monitoring instance
17-
- An activity tracker event routing instance
18-
- A secrets manager instance
15+
- A Cloud logs instance.
16+
- A Cloud monitoring instance.
17+
- An activity tracker event routing instance.
18+
- A secrets manager instance.
1919
- A COS instance along with 3 buckets for VPC flow logs, metrics/data bucket and activity tracker bucket.
20-
- A SCC-WP instance
21-
- A VPC instance
22-
- An event notifications instance
23-
- An app configuration service with aggregator enabled
20+
- A SCC-WP instance.
21+
- A VPC instance.
22+
- An event notifications instance.
23+
- An app configuration service with aggregator enabled.
24+
- Monitoring agent.
25+
- A Trusted Profile with Sender role to logs service.
26+
- Logs agent.

‎examples/monolith/main.tf‎

Lines changed: 84 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -216,3 +216,87 @@ module "kube_audit" {
216216
audit_webhook_listener_image = var.audit_webhook_listener_image
217217
audit_webhook_listener_image_tag_digest = var.audit_webhook_listener_image_tag_digest
218218
}
219+
220+
##############################################################################
221+
# Monitoring Agents
222+
##############################################################################
223+
224+
module "monitoring_agent" {
225+
source = "terraform-ibm-modules/monitoring-agent/ibm"
226+
version = "1.19.0"
227+
cluster_id = module.ocp_base.cluster_id
228+
cluster_resource_group_id = module.resource_group.resource_group_id
229+
is_vpc_cluster = true
230+
access_key = module.monolith_add_ons.cloud_monitoring_access_key
231+
instance_region = var.region
232+
metrics_filter = [{ exclude = "metricA.*" }, { include = "metricB.*" }]
233+
container_filter = [{ type = "exclude", parameter = "kubernetes.namespace.name", name = "kube-system" }]
234+
blacklisted_ports = [22, 2379, 3306]
235+
agent_tags = { "environment" : "test", "custom" : "value" }
236+
agent_mode = "troubleshooting"
237+
}
238+
239+
##############################################################################
240+
# Logs Agent
241+
##############################################################################
242+
243+
locals {
244+
logs_agent_namespace = "ibm-observe"
245+
logs_agent_name = "logs-agent"
246+
}
247+
248+
module "trusted_profile" {
249+
source = "terraform-ibm-modules/trusted-profile/ibm"
250+
version = "3.2.0"
251+
trusted_profile_name = "${var.prefix}-profile"
252+
trusted_profile_description = "Logs agent Trusted Profile"
253+
# As a `Sender`, you can send logs to your IBM Cloud Logs service instance - but not query or tail logs. This role is meant to be used by agent and routers sending logs.
254+
trusted_profile_policies = [{
255+
roles = ["Sender"]
256+
unique_identifier = "logs-agent"
257+
resources = [{
258+
service = "logs"
259+
}]
260+
}]
261+
# Set up fine-grained authorization for `logs-agent` running in ROKS cluster in `ibm-observe` namespace.
262+
trusted_profile_links = [{
263+
cr_type = "ROKS_SA"
264+
unique_identifier = "logs-agent-link"
265+
links = [{
266+
crn = module.ocp_base.cluster_crn
267+
namespace = local.logs_agent_namespace
268+
name = local.logs_agent_name
269+
}]
270+
}
271+
]
272+
}
273+
274+
module "logs_agent" {
275+
source = "terraform-ibm-modules/logs-agent/ibm"
276+
version = "1.10.0"
277+
cluster_id = module.ocp_base.cluster_id
278+
cluster_resource_group_id = module.resource_group.resource_group_id
279+
# Logs agent
280+
logs_agent_trusted_profile_id = module.trusted_profile.trusted_profile.id
281+
logs_agent_namespace = local.logs_agent_namespace
282+
logs_agent_name = local.logs_agent_name
283+
cloud_logs_ingress_endpoint = module.monolith_add_ons.cloud_logs_ingress_private_endpoint
284+
cloud_logs_ingress_port = 3443
285+
# example of how to add additional metadata to the logs agent
286+
logs_agent_additional_metadata = [{
287+
key = "cluster_id"
288+
value = module.ocp_base.cluster_id
289+
}]
290+
logs_agent_resources = {
291+
limits = {
292+
cpu = "500m"
293+
memory = "3Gi"
294+
}
295+
requests = {
296+
cpu = "100m"
297+
memory = "1Gi"
298+
}
299+
}
300+
# example of how to add additional log source path
301+
logs_agent_system_logs = ["/logs/*.log"]
302+
}

‎modules/monolith/README.md‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,8 @@ The primary goal of this module is to provision an OpenShift cluster on VPC and
1313
* `Activity Tracker and Event Routing`: Configure event routing for platform audit logs to a COS bucket or IBM Cloud Logs.
1414
* `Security & Compliance`: Optional integration with IBM Cloud Security and Compliance Center (SCC) Workload Protection.
1515
* `VPE Gateways`: Optional configuration of Virtual Private Endpoint (VPE) gateways for secure private connectivity to cloud services.
16+
* `Event Notifications`: Optional provision and configuration of IBM Cloud Event Notifications for centralized event routing and management, with support for KMS encryption and failed event collection in COS.
17+
* `App Configuration`: Optional provision and configuration of IBM Cloud App Configuration for centralized feature flag and property management, securely integrated with KMS and Event Notifications.
1618

1719
## Usage
1820

@@ -203,7 +205,7 @@ module "monolith_ocp_add_ons" {
203205
| <a name="input_metrics_router_routes"></a> [metrics\_router\_routes](#input\_metrics\_router\_routes) | Routes for IBM Cloud Metrics Routing. | <pre>list(object({<br/> name = string<br/> rules = list(object({<br/> action = string<br/> targets = list(object({<br/> id = string<br/> }))<br/> inclusion_filters = list(object({<br/> operand = string<br/> operator = string<br/> values = list(string)<br/> }))<br/> }))<br/> }))</pre> | `[]` | no |
204206
| <a name="input_metrics_routing_route_name"></a> [metrics\_routing\_route\_name](#input\_metrics\_routing\_route\_name) | The name of the IBM Cloud Metrics Routing route for the default route that indicate what metrics are routed in a region and where to store them. If the prefix variable is passed, the name of the target is prefixed to the value in the `<prefix>-value` format. | `string` | `"metrics-routing-route"` | no |
205207
| <a name="input_metrics_routing_target_name"></a> [metrics\_routing\_target\_name](#input\_metrics\_routing\_target\_name) | The name of the IBM Cloud Metrics Routing target where metrics are collected. If the prefix variable is passed, the name of the target is prefixed to the value in the `<prefix>-value` format. | `string` | `"cloud-monitoring-target"` | no |
206-
| <a name="input_network_acls"></a> [network\_acls](#input\_network\_acls) | The list of ACLs to create. Provide at least one rule for each ACL. | <pre>list(<br/> object({<br/> name = string<br/> add_ibm_cloud_internal_rules = optional(bool)<br/> add_vpc_connectivity_rules = optional(bool)<br/> prepend_ibm_rules = optional(bool)<br/> rules = list(<br/> object({<br/> name = string<br/> action = string<br/> destination = string<br/> direction = string<br/> source = string<br/> tcp = optional(<br/> object({<br/> port_max = optional(number)<br/> port_min = optional(number)<br/> source_port_max = optional(number)<br/> source_port_min = optional(number)<br/> })<br/> )<br/> udp = optional(<br/> object({<br/> port_max = optional(number)<br/> port_min = optional(number)<br/> source_port_max = optional(number)<br/> source_port_min = optional(number)<br/> })<br/> )<br/> icmp = optional(<br/> object({<br/> type = optional(number)<br/> code = optional(number)<br/> })<br/> )<br/> })<br/> )<br/> })<br/> )</pre> | <pre>[<br/> {<br/> "add_ibm_cloud_internal_rules": true,<br/> "add_vpc_connectivity_rules": true,<br/> "name": "vpc-acl",<br/> "prepend_ibm_rules": true,<br/> "rules": [<br/> {<br/> "action": "allow",<br/> "destination": "0.0.0.0/0",<br/> "direction": "inbound",<br/> "name": "allow-all-443-inbound",<br/> "source": "0.0.0.0/0",<br/> "tcp": {<br/> "port_max": 443,<br/> "port_min": 443,<br/> "source_port_max": 443,<br/> "source_port_min": 443<br/> }<br/> },<br/> {<br/> "action": "allow",<br/> "destination": "0.0.0.0/0",<br/> "direction": "inbound",<br/> "name": "allow-all-80-inbound",<br/> "source": "0.0.0.0/0",<br/> "tcp": {<br/> "port_max": 80,<br/> "port_min": 80,<br/> "source_port_max": 80,<br/> "source_port_min": 80<br/> }<br/> },<br/> {<br/> "action": "allow",<br/> "destination": "0.0.0.0/0",<br/> "direction": "inbound",<br/> "name": "allow-all-22-inbound",<br/> "source": "0.0.0.0/0",<br/> "tcp": {<br/> "port_max": 22,<br/> "port_min": 22,<br/> "source_port_max": 22,<br/> "source_port_min": 22<br/> }<br/> },<br/> {<br/> "action": "allow",<br/> "destination": "0.0.0.0/0",<br/> "direction": "outbound",<br/> "name": "allow-all-443-outbound",<br/> "source": "0.0.0.0/0",<br/> "tcp": {<br/> "port_max": 443,<br/> "port_min": 443,<br/> "source_port_max": 443,<br/> "source_port_min": 443<br/> }<br/> },<br/> {<br/> "action": "allow",<br/> "destination": "0.0.0.0/0",<br/> "direction": "outbound",<br/> "name": "allow-all-80-outbound",<br/> "source": "0.0.0.0/0",<br/> "tcp": {<br/> "port_max": 80,<br/> "port_min": 80,<br/> "source_port_max": 80,<br/> "source_port_min": 80<br/> }<br/> },<br/> {<br/> "action": "allow",<br/> "destination": "0.0.0.0/0",<br/> "direction": "outbound",<br/> "name": "allow-all-22-outbound",<br/> "source": "0.0.0.0/0",<br/> "tcp": {<br/> "port_max": 22,<br/> "port_min": 22,<br/> "source_port_max": 22,<br/> "source_port_min": 22<br/> }<br/> }<br/> ]<br/> }<br/>]</pre> | no |
208+
| <a name="input_network_acls"></a> [network\_acls](#input\_network\_acls) | The list of ACLs to create. Provide at least one rule for each ACL. | <pre>list(<br/> object({<br/> name = string<br/> add_ibm_cloud_internal_rules = optional(bool)<br/> add_vpc_connectivity_rules = optional(bool)<br/> prepend_ibm_rules = optional(bool)<br/> rules = list(<br/> object({<br/> name = string<br/> action = string<br/> destination = string<br/> direction = string<br/> source = string<br/> tcp = optional(<br/> object({<br/> port_max = optional(number)<br/> port_min = optional(number)<br/> source_port_max = optional(number)<br/> source_port_min = optional(number)<br/> })<br/> )<br/> udp = optional(<br/> object({<br/> port_max = optional(number)<br/> port_min = optional(number)<br/> source_port_max = optional(number)<br/> source_port_min = optional(number)<br/> })<br/> )<br/> icmp = optional(<br/> object({<br/> type = optional(number)<br/> code = optional(number)<br/> })<br/> )<br/> })<br/> )<br/> })<br/> )</pre> | <pre>[<br/> {<br/> "add_ibm_cloud_internal_rules": true,<br/> "add_vpc_connectivity_rules": true,<br/> "name": "vpc-acl",<br/> "prepend_ibm_rules": true,<br/> "rules": [<br/> {<br/> "action": "allow",<br/> "destination": "0.0.0.0/0",<br/> "direction": "inbound",<br/> "name": "allow-443-inbound-source",<br/> "source": "0.0.0.0/0",<br/> "tcp": {<br/> "source_port_max": 443,<br/> "source_port_min": 443<br/> }<br/> },<br/> {<br/> "action": "allow",<br/> "destination": "0.0.0.0/0",<br/> "direction": "inbound",<br/> "name": "allow-443-inbound-dest",<br/> "source": "0.0.0.0/0",<br/> "tcp": {<br/> "port_max": 443,<br/> "port_min": 443<br/> }<br/> },<br/> {<br/> "action": "allow",<br/> "destination": "0.0.0.0/0",<br/> "direction": "inbound",<br/> "name": "allow-all-80-inbound",<br/> "source": "0.0.0.0/0",<br/> "tcp": {<br/> "source_port_max": 80,<br/> "source_port_min": 80<br/> }<br/> },<br/> {<br/> "action": "allow",<br/> "destination": "0.0.0.0/0",<br/> "direction": "inbound",<br/> "name": "allow-all-ingress-inbound",<br/> "source": "0.0.0.0/0",<br/> "tcp": {<br/> "source_port_max": 32767,<br/> "source_port_min": 30000<br/> }<br/> },<br/> {<br/> "action": "allow",<br/> "destination": "0.0.0.0/0",<br/> "direction": "outbound",<br/> "name": "allow-443-outbound-source",<br/> "source": "0.0.0.0/0",<br/> "tcp": {<br/> "source_port_max": 443,<br/> "source_port_min": 443<br/> }<br/> },<br/> {<br/> "action": "allow",<br/> "destination": "0.0.0.0/0",<br/> "direction": "outbound",<br/> "name": "allow-443-outbound-dest",<br/> "source": "0.0.0.0/0",<br/> "tcp": {<br/> "port_max": 443,<br/> "port_min": 443<br/> }<br/> },<br/> {<br/> "action": "allow",<br/> "destination": "0.0.0.0/0",<br/> "direction": "outbound",<br/> "name": "allow-all-80-outbound",<br/> "source": "0.0.0.0/0",<br/> "tcp": {<br/> "port_max": 80,<br/> "port_min": 80<br/> }<br/> },<br/> {<br/> "action": "allow",<br/> "destination": "0.0.0.0/0",<br/> "direction": "outbound",<br/> "name": "allow-all-ingress-outbound",<br/> "source": "0.0.0.0/0",<br/> "tcp": {<br/> "port_max": 32767,<br/> "port_min": 30000<br/> }<br/> }<br/> ]<br/> }<br/>]</pre> | no |
207209
| <a name="input_prefix"></a> [prefix](#input\_prefix) | The prefix to add to all resources that this solution creates (e.g `prod`, `test`, `dev`). To skip using a prefix, set this value to null or an empty string. | `string` | n/a | yes |
208210
| <a name="input_region"></a> [region](#input\_region) | The region to provision all resources in. | `string` | `"us-south"` | no |
209211
| <a name="input_resource_group_id"></a> [resource\_group\_id](#input\_resource\_group\_id) | The ID of an existing IBM Cloud resource group where the cluster is grouped. | `string` | n/a | yes |

‎modules/monolith/variables.tf‎

Lines changed: 32 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -1704,53 +1704,67 @@ variable "network_acls" {
17041704
prepend_ibm_rules = true
17051705
rules = [
17061706
{
1707-
name = "allow-all-443-inbound"
1707+
name = "allow-443-inbound-source"
17081708
action = "allow"
17091709
direction = "inbound"
17101710
tcp = {
1711-
port_min = 443
1712-
port_max = 443
17131711
source_port_min = 443
17141712
source_port_max = 443
17151713
}
17161714
destination = "0.0.0.0/0"
17171715
source = "0.0.0.0/0"
17181716
},
1717+
{
1718+
name = "allow-443-inbound-dest"
1719+
action = "allow"
1720+
direction = "inbound"
1721+
tcp = {
1722+
port_max = 443
1723+
port_min = 443
1724+
}
1725+
destination = "0.0.0.0/0"
1726+
source = "0.0.0.0/0"
1727+
},
17191728
{
17201729
name = "allow-all-80-inbound"
17211730
action = "allow"
17221731
direction = "inbound"
17231732
tcp = {
1724-
port_min = 80
1725-
port_max = 80
17261733
source_port_min = 80
17271734
source_port_max = 80
17281735
}
17291736
destination = "0.0.0.0/0"
17301737
source = "0.0.0.0/0"
17311738
},
17321739
{
1733-
name = "allow-all-22-inbound"
1740+
name = "allow-all-ingress-inbound"
17341741
action = "allow"
17351742
direction = "inbound"
17361743
tcp = {
1737-
port_min = 22
1738-
port_max = 22
1739-
source_port_min = 22
1740-
source_port_max = 22
1744+
source_port_min = 30000
1745+
source_port_max = 32767
17411746
}
17421747
destination = "0.0.0.0/0"
17431748
source = "0.0.0.0/0"
17441749
},
17451750
{
1746-
name = "allow-all-443-outbound"
1751+
name = "allow-443-outbound-source"
17471752
action = "allow"
17481753
direction = "outbound"
17491754
tcp = {
17501755
source_port_min = 443
17511756
source_port_max = 443
1752-
port_min = 443
1753-
port_max = 443
1757+
}
1758+
destination = "0.0.0.0/0"
1759+
source = "0.0.0.0/0"
1760+
},
1761+
{
1762+
name = "allow-443-outbound-dest"
1763+
action = "allow"
1764+
direction = "outbound"
1765+
tcp = {
1766+
port_min = 443
1767+
port_max = 443
17541768
}
17551769
destination = "0.0.0.0/0"
17561770
source = "0.0.0.0/0"
@@ -1760,23 +1774,19 @@ variable "network_acls" {
17601774
action = "allow"
17611775
direction = "outbound"
17621776
tcp = {
1763-
source_port_min = 80
1764-
source_port_max = 80
1765-
port_min = 80
1766-
port_max = 80
1777+
port_min = 80
1778+
port_max = 80
17671779
}
17681780
destination = "0.0.0.0/0"
17691781
source = "0.0.0.0/0"
17701782
},
17711783
{
1772-
name = "allow-all-22-outbound"
1784+
name = "allow-all-ingress-outbound"
17731785
action = "allow"
17741786
direction = "outbound"
17751787
tcp = {
1776-
source_port_min = 22
1777-
source_port_max = 22
1778-
port_min = 22
1779-
port_max = 22
1788+
port_min = 30000
1789+
port_max = 32767
17801790
}
17811791
destination = "0.0.0.0/0"
17821792
source = "0.0.0.0/0"

‎tests/other_test.go‎

Lines changed: 11 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -219,10 +219,19 @@ func TestMonolithExample(t *testing.T) {
219219
DeleteWorkspaceOnFail: false,
220220
WaitJobCompleteMinutes: 240,
221221
IgnoreAdds: testhelper.Exemptions{
222-
List: []string{"module.monolith_add_ons.module.scc_wp.restapi_object.cspm"},
222+
List: []string{
223+
"module.monolith_add_ons.module.scc_wp.restapi_object.cspm",
224+
},
223225
},
224226
IgnoreUpdates: testhelper.Exemptions{
225-
List: []string{"module.ocp_base.ibm_container_addons.addons"},
227+
List: []string{
228+
"module.ocp_base.ibm_container_addons.addons",
229+
"module.logs_agent.helm_release.logs_agent",
230+
"module.monitoring_agent.helm_release.cloud_monitoring_agent",
231+
// Have to ignore account settings as other tests may be updating them concurrently
232+
// which can cause consistency test to fail if not ignored.
233+
"module.monolith_add_ons.module.metrics_routing[0].ibm_metrics_router_settings.metrics_router_settings[0]",
234+
},
226235
},
227236
})
228237
options.TerraformVars = []testschematic.TestSchematicTerraformVar{

0 commit comments

Comments
 (0)