Skip to content

Commit 2b825b9

Browse files
Jordan-Williams2Jordan-Williams2
Jordan-Williams2
authored and
Jordan-Williams2
committed
feat: use common helm
1 parent ad3e696 commit 2b825b9

File tree

12 files changed

+167
-448
lines changed

12 files changed

+167
-448
lines changed

‎README.md‎

Lines changed: 11 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -82,7 +82,7 @@ No modules.
8282

8383
| Name | Type |
8484
|------|------|
85-
| [helm_release.logs_agent](https://registry.terraform.io/providers/hashicorp/helm/latest/docs/resources/release) | resource |
85+
| [helm_release.sysdig_agent](https://registry.terraform.io/providers/hashicorp/helm/latest/docs/resources/release) | resource |
8686
| [ibm_container_cluster.cluster](https://registry.terraform.io/providers/ibm-cloud/ibm/latest/docs/data-sources/container_cluster) | data source |
8787
| [ibm_container_cluster_config.cluster_config](https://registry.terraform.io/providers/ibm-cloud/ibm/latest/docs/data-sources/container_cluster_config) | data source |
8888
| [ibm_container_vpc_cluster.cluster](https://registry.terraform.io/providers/ibm-cloud/ibm/latest/docs/data-sources/container_vpc_cluster) | data source |
@@ -91,29 +91,21 @@ No modules.
9191

9292
| Name | Description | Type | Default | Required |
9393
|------|-------------|------|---------|:--------:|
94+
| <a name="input_agent_additional_metadata"></a> [agent\_additional\_metadata](#input\_agent\_additional\_metadata) | The list of additional metadata fields to add to the routed logs. | <pre>list(object({<br/> key = optional(string)<br/> value = optional(string)<br/> }))</pre> | `[]` | no |
95+
| <a name="input_agent_iam_api_key"></a> [agent\_iam\_api\_key](#input\_agent\_iam\_api\_key) | The IBM Cloud API key for the Logs agent to authenticate and communicate with the IBM Cloud Logs. | `string` | n/a | yes |
96+
| <a name="input_agent_name"></a> [agent\_name](#input\_agent\_name) | The name of the Logs agent. The name is used in all Kubernetes and Helm resources in the cluster. | `string` | `"logs-agent"` | no |
97+
| <a name="input_agent_namespace"></a> [agent\_namespace](#input\_agent\_namespace) | The namespace where the Logs agent is deployed. The default value is `ibm-agent`. | `string` | `"ibm-agent"` | no |
98+
| <a name="input_agent_resources"></a> [agent\_resources](#input\_agent\_resources) | The resources configuration for cpu/memory/storage. [Learn More](https://cloud.ibm.com/docs/cloud-logs?topic=cloud-logs-agent-helm-template-clusters#agent-helm-template-clusters-chart-options-resources) | <pre>object({<br/> limits = object({<br/> cpu = string<br/> memory = string<br/> })<br/> requests = object({<br/> cpu = string<br/> memory = string<br/> })<br/> })</pre> | <pre>{<br/> "limits": {<br/> "cpu": "500m",<br/> "memory": "3Gi"<br/> },<br/> "requests": {<br/> "cpu": "100m",<br/> "memory": "1Gi"<br/> }<br/>}</pre> | no |
99+
| <a name="input_agent_tolerations"></a> [agent\_tolerations](#input\_agent\_tolerations) | List of tolerations to apply to Logs agent. The default value means a pod will run on every node. | <pre>list(object({<br/> key = optional(string)<br/> operator = optional(string)<br/> value = optional(string)<br/> effect = optional(string)<br/> tolerationSeconds = optional(number)<br/> }))</pre> | <pre>[<br/> {<br/> "operator": "Exists"<br/> }<br/>]</pre> | no |
100+
| <a name="input_chart_location"></a> [chart\_location](#input\_chart\_location) | The location of the Helm chart for the Sysdig agent. | `string` | `"sysdig-deploy"` | no |
101+
| <a name="input_chart_repository"></a> [chart\_repository](#input\_chart\_repository) | The repository URL for the Sysdig Helm chart. | `string` | `"https://charts.sysdig.com"` | no |
102+
| <a name="input_chart_version"></a> [chart\_version](#input\_chart\_version) | The version of the Sysdig Helm chart to deploy. | `string` | `"1.14.6"` | no |
94103
| <a name="input_cloud_logs_ingress_endpoint"></a> [cloud\_logs\_ingress\_endpoint](#input\_cloud\_logs\_ingress\_endpoint) | The host for IBM Cloud Logs ingestion. Ensure you use the ingress endpoint. See https://cloud.ibm.com/docs/cloud-logs?topic=cloud-logs-endpoints_ingress. | `string` | n/a | yes |
95-
| <a name="input_cloud_logs_ingress_port"></a> [cloud\_logs\_ingress\_port](#input\_cloud\_logs\_ingress\_port) | The target port for the IBM Cloud Logs ingestion endpoint. The port must be 443 if you connect by using a VPE gateway, or port 3443 when you connect by using CSEs. | `number` | `3443` | no |
96104
| <a name="input_cluster_config_endpoint_type"></a> [cluster\_config\_endpoint\_type](#input\_cluster\_config\_endpoint\_type) | The type of endpoint to use for the cluster config access: `default`, `private`, `vpe`, or `link`. The `default` value uses the default endpoint of the cluster. | `string` | `"default"` | no |
97105
| <a name="input_cluster_id"></a> [cluster\_id](#input\_cluster\_id) | The ID of the cluster to deploy the agent. | `string` | n/a | yes |
98106
| <a name="input_cluster_resource_group_id"></a> [cluster\_resource\_group\_id](#input\_cluster\_resource\_group\_id) | The resource group ID of the cluster. | `string` | n/a | yes |
99107
| <a name="input_is_vpc_cluster"></a> [is\_vpc\_cluster](#input\_is\_vpc\_cluster) | Specify true if the target cluster for the agent is a VPC cluster, false if it is a classic cluster. | `bool` | `true` | no |
100-
| <a name="input_logs_agent_additional_log_source_paths"></a> [logs\_agent\_additional\_log\_source\_paths](#input\_logs\_agent\_additional\_log\_source\_paths) | The list of additional log sources. By default, the Logs agent collects logs from a single source at `/var/log/containers/*.log`. | `list(string)` | `[]` | no |
101-
| <a name="input_logs_agent_additional_metadata"></a> [logs\_agent\_additional\_metadata](#input\_logs\_agent\_additional\_metadata) | The list of additional metadata fields to add to the routed logs. | <pre>list(object({<br/> key = optional(string)<br/> value = optional(string)<br/> }))</pre> | `[]` | no |
102-
| <a name="input_logs_agent_chart_location"></a> [logs\_agent\_chart\_location](#input\_logs\_agent\_chart\_location) | The location of the Helm chart for the Logs agent. | `string` | `"oci://icr.io/ibm/observe/logs-agent-helm"` | no |
103-
| <a name="input_logs_agent_chart_version"></a> [logs\_agent\_chart\_version](#input\_logs\_agent\_chart\_version) | The version of the helm chart to deploy. | `string` | `"1.4.2"` | no |
104-
| <a name="input_logs_agent_enable_scc"></a> [logs\_agent\_enable\_scc](#input\_logs\_agent\_enable\_scc) | Whether to enable creation of Security Context Constraints in Openshift. When installing on an OpenShift cluster, this setting is mandatory to configure permissions for pods within your cluster. | `bool` | `true` | no |
105-
| <a name="input_logs_agent_exclude_log_source_paths"></a> [logs\_agent\_exclude\_log\_source\_paths](#input\_logs\_agent\_exclude\_log\_source\_paths) | The list of log sources to exclude. Specify the paths that the Logs agent ignores. | `list(string)` | `[]` | no |
106-
| <a name="input_logs_agent_iam_api_key"></a> [logs\_agent\_iam\_api\_key](#input\_logs\_agent\_iam\_api\_key) | The IBM Cloud API key for the Logs agent to authenticate and communicate with the IBM Cloud Logs. It is required if `logs_agent_iam_mode` is set to `IAMAPIKey`. | `string` | `null` | no |
107-
| <a name="input_logs_agent_iam_environment"></a> [logs\_agent\_iam\_environment](#input\_logs\_agent\_iam\_environment) | IAM authentication Environment: `Production` or `PrivateProduction` or `Staging` or `PrivateStaging`. `Production` specifies the public endpoint & `PrivateProduction` specifies the private endpoint. | `string` | `"PrivateProduction"` | no |
108-
| <a name="input_logs_agent_iam_mode"></a> [logs\_agent\_iam\_mode](#input\_logs\_agent\_iam\_mode) | IAM authentication mode: `TrustedProfile` or `IAMAPIKey`. | `string` | `"TrustedProfile"` | no |
109-
| <a name="input_logs_agent_log_source_namespaces"></a> [logs\_agent\_log\_source\_namespaces](#input\_logs\_agent\_log\_source\_namespaces) | The list of namespaces from which logs should be forwarded by agent. If namespaces are not listed, logs from all namespaces will be sent. | `list(string)` | `[]` | no |
110-
| <a name="input_logs_agent_name"></a> [logs\_agent\_name](#input\_logs\_agent\_name) | The name of the Logs agent. The name is used in all Kubernetes and Helm resources in the cluster. | `string` | `"logs-agent"` | no |
111-
| <a name="input_logs_agent_namespace"></a> [logs\_agent\_namespace](#input\_logs\_agent\_namespace) | The namespace where the Logs agent is deployed. The default value is `ibm-agent`. | `string` | `"ibm-agent"` | no |
112-
| <a name="input_logs_agent_resources"></a> [logs\_agent\_resources](#input\_logs\_agent\_resources) | The resources configuration for cpu/memory/storage. [Learn More](https://cloud.ibm.com/docs/cloud-logs?topic=cloud-logs-agent-helm-template-clusters#agent-helm-template-clusters-chart-options-resources) | <pre>object({<br/> limits = object({<br/> cpu = string<br/> memory = string<br/> })<br/> requests = object({<br/> cpu = string<br/> memory = string<br/> })<br/> })</pre> | <pre>{<br/> "limits": {<br/> "cpu": "500m",<br/> "memory": "3Gi"<br/> },<br/> "requests": {<br/> "cpu": "100m",<br/> "memory": "1Gi"<br/> }<br/>}</pre> | no |
113-
| <a name="input_logs_agent_selected_log_source_paths"></a> [logs\_agent\_selected\_log\_source\_paths](#input\_logs\_agent\_selected\_log\_source\_paths) | The list of specific log sources paths. Logs will only be collected from the specified log source paths. If no paths are specified, it will send logs from `/var/log/containers`. | `list(string)` | `[]` | no |
114-
| <a name="input_logs_agent_tolerations"></a> [logs\_agent\_tolerations](#input\_logs\_agent\_tolerations) | List of tolerations to apply to Logs agent. The default value means a pod will run on every node. | <pre>list(object({<br/> key = optional(string)<br/> operator = optional(string)<br/> value = optional(string)<br/> effect = optional(string)<br/> tolerationSeconds = optional(number)<br/> }))</pre> | <pre>[<br/> {<br/> "operator": "Exists"<br/> }<br/>]</pre> | no |
115-
| <a name="input_logs_agent_trusted_profile"></a> [logs\_agent\_trusted\_profile](#input\_logs\_agent\_trusted\_profile) | The IBM Cloud trusted profile ID. Used only when `logs_agent_iam_mode` is set to `TrustedProfile`. The trusted profile must have an IBM Cloud Logs `Sender` role. | `string` | `null` | no |
116-
| <a name="input_logs_agent_version"></a> [logs\_agent\_version](#input\_logs\_agent\_version) | The version of the Logs agent to deploy. | `string` | `"1.4.2"` | no |
108+
| <a name="input_node_analyzer_enabled"></a> [node\_analyzer\_enabled](#input\_node\_analyzer\_enabled) | Enable or disable the Node Analyzer feature in the Sysdig agent. | `bool` | `true` | no |
117109
| <a name="input_wait_till"></a> [wait\_till](#input\_wait\_till) | To avoid long wait times when you run your Terraform code, you can specify the stage when you want Terraform to mark the cluster resource creation as completed. Depending on what stage you choose, the cluster creation might not be fully completed and continues to run in the background. However, your Terraform code can continue to run without waiting for the cluster to be fully created. Supported args are `MasterNodeReady`, `OneWorkerNodeReady`, `IngressReady` and `Normal` | `string` | `"Normal"` | no |
118110
| <a name="input_wait_till_timeout"></a> [wait\_till\_timeout](#input\_wait\_till\_timeout) | Timeout for wait\_till in minutes. | `number` | `90` | no |
119111

‎examples/logs-agent-iks/main.tf‎

Lines changed: 1 addition & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -148,9 +148,6 @@ module "logs_agent" {
148148
is_vpc_cluster = var.is_vpc_cluster
149149
cluster_resource_group_id = module.resource_group.resource_group_id
150150
# Logs Agent
151-
logs_agent_iam_mode = "IAMAPIKey"
152-
logs_agent_iam_api_key = module.iam_service_id.service_id_apikey
151+
agent_iam_api_key = module.iam_service_id.service_id_apikey
153152
cloud_logs_ingress_endpoint = module.cloud_logs.ingress_private_endpoint
154-
cloud_logs_ingress_port = 3443
155-
logs_agent_enable_scc = false # only true for Openshift
156153
}

‎examples/logs-agent-ocp/main.tf‎

Lines changed: 25 additions & 36 deletions
Original file line numberDiff line numberDiff line change
@@ -11,37 +11,24 @@ module "resource_group" {
1111
}
1212

1313
##############################################################################
14-
# Trusted Profile
14+
# Service ID with logs sender role + apikey
1515
##############################################################################
1616

17-
locals {
18-
logs_agent_namespace = "ibm-agent"
19-
logs_agent_name = "logs-agent"
20-
}
21-
22-
23-
module "trusted_profile" {
24-
source = "terraform-ibm-modules/trusted-profile/ibm"
25-
version = "1.0.5"
26-
trusted_profile_name = "${var.prefix}-profile"
27-
trusted_profile_description = "Logs agent Trusted Profile"
28-
# As a `Sender`, you can send logs to your IBM Cloud Logs service instance - but not query or tail logs. This role is meant to be used by agent and routers sending logs.
29-
trusted_profile_policies = [{
30-
roles = ["Sender"]
31-
resources = [{
32-
service = "logs"
33-
}]
34-
}]
35-
# Set up fine-grained authorization for `logs-agent` running in ROKS cluster in `ibm-agent` namespace.
36-
trusted_profile_links = [{
37-
cr_type = "ROKS_SA"
38-
links = [{
39-
crn = module.ocp_base.cluster_crn
40-
namespace = local.logs_agent_namespace
41-
name = local.logs_agent_name
42-
}]
17+
# As a `Sender`, you can send logs to your IBM Cloud Logs service instance - but not query or tail logs. This role is meant to be used by agent and routers sending logs.
18+
module "iam_service_id" {
19+
source = "terraform-ibm-modules/iam-service-id/ibm"
20+
version = "1.2.0"
21+
iam_service_id_name = "${var.prefix}-service-id"
22+
iam_service_id_description = "Logs Agent service id"
23+
iam_service_id_apikey_provision = true
24+
iam_service_policies = {
25+
logs = {
26+
roles = ["Sender"]
27+
resources = [{
28+
service = "logs"
29+
}]
4330
}
44-
]
31+
}
4532
}
4633

4734
########################################################################################################################
@@ -172,23 +159,27 @@ module "vpe" {
172159
# Logs Agent
173160
##############################################################################
174161

162+
locals {
163+
agent_namespace = "ibm-agent"
164+
agent_name = "logs-agent"
165+
}
166+
175167
module "logs_agent" {
176168
source = "../.."
177169
depends_on = [module.vpe]
178170
cluster_id = module.ocp_base.cluster_id
179171
cluster_resource_group_id = module.resource_group.resource_group_id
180172
# Logs agent
181-
logs_agent_trusted_profile = module.trusted_profile.trusted_profile.id
182-
logs_agent_namespace = local.logs_agent_namespace
183-
logs_agent_name = local.logs_agent_name
173+
agent_namespace = local.agent_namespace
174+
agent_name = local.agent_name
184175
cloud_logs_ingress_endpoint = module.cloud_logs.ingress_private_endpoint
185-
cloud_logs_ingress_port = 443
176+
agent_iam_api_key = module.iam_service_id.service_id_apikey
186177
# example of how to add additional metadata to the logs agent
187-
logs_agent_additional_metadata = [{
178+
agent_additional_metadata = [{
188179
key = "cluster_id"
189180
value = module.ocp_base.cluster_id
190181
}]
191-
logs_agent_resources = {
182+
agent_resources = {
192183
limits = {
193184
cpu = "500m"
194185
memory = "3Gi"
@@ -198,6 +189,4 @@ module "logs_agent" {
198189
memory = "1Gi"
199190
}
200191
}
201-
# example of how to add additional log source path
202-
logs_agent_additional_log_source_paths = ["/logs/*.log"]
203192
}

‎ibm_catalog.json‎

Lines changed: 10 additions & 64 deletions
Original file line numberDiff line numberDiff line change
@@ -90,94 +90,40 @@
9090
"key": "is_vpc_cluster",
9191
"required": true
9292
},
93-
{
94-
"key": "is_ocp_cluster",
95-
"required": true
96-
},
9793
{
9894
"key": "cloud_logs_ingress_endpoint",
9995
"required": true
10096
},
10197
{
102-
"key": "cloud_logs_ingress_port",
98+
"key": "agent_iam_api_key",
10399
"required": true
104100
},
105101
{
106-
"key": "logs_agent_trusted_profile_id",
107-
"required": true
108-
},
109-
{
110-
"key": "logs_agent_chart_location"
111-
},
112-
{
113-
"key": "logs_agent_chart_version"
114-
},
115-
{
116-
"key": "logs_agent_version"
117-
},
118-
{
119-
"key": "logs_agent_resources"
120-
},
121-
{
122-
"key": "logs_agent_additional_log_source_paths"
123-
},
124-
{
125-
"key": "logs_agent_additional_metadata"
126-
},
127-
{
128-
"key": "logs_agent_exclude_log_source_paths"
102+
"key": "node_analyzer_enabled"
129103
},
130104
{
131-
"key": "logs_agent_iam_api_key"
105+
"key": "chart_location"
132106
},
133107
{
134-
"key": "logs_agent_iam_environment",
135-
"options": [
136-
{
137-
"displayname": "Production",
138-
"value": "Production"
139-
},
140-
{
141-
"displayname": "Private Production",
142-
"value": "PrivateProduction"
143-
},
144-
{
145-
"displayname": "Staging",
146-
"value": "Staging"
147-
},
148-
{
149-
"displayname": "Private Staging",
150-
"value": "PrivateStaging"
151-
}
152-
]
108+
"key": "chart_repository"
153109
},
154110
{
155-
"key": "logs_agent_iam_mode",
156-
"options": [
157-
{
158-
"displayname": "Trusted Profile",
159-
"value": "TrustedProfile"
160-
},
161-
{
162-
"displayname": "IAM API Key",
163-
"value": "IAMAPIKey"
164-
}
165-
]
111+
"key": "chart_version"
166112
},
167113
{
168-
"key": "logs_agent_log_source_namespaces"
114+
"key": "agent_resources"
169115
},
170116
{
171-
"key": "logs_agent_name"
117+
"key": "agent_additional_metadata"
172118
},
173119
{
174-
"key": "logs_agent_namespace"
120+
"key": "agent_name"
175121
},
176122
{
177-
"key": "logs_agent_selected_log_source_paths"
123+
"key": "agent_namespace"
178124
},
179125
{
180-
"key": "logs_agent_tolerations"
126+
"key": "agent_tolerations"
181127
},
182128
{
183129
"key": "cluster_config_endpoint_type"

0 commit comments

Comments
 (0)