[fluentd-kubernetes] add serviceaccount (#247)

cloudposse · Jun 23, 2020 · 55d38cf · 55d38cf
1 parent 1ce8a8c
commit 55d38cf
Show file tree

Hide file tree

Showing 11 changed files with 240 additions and 117 deletions.
diff --git a/incubator/fluentd-kubernetes/Chart.yaml b/incubator/fluentd-kubernetes/Chart.yaml
@@ -2,8 +2,8 @@ apiVersion: v1
 description: Kubernetes logs collect and forward with Fluentd.
 icon: https://raw.githubusercontent.com/fluent/fluentd-docs/master/public/logo/Fluentd_square.png
 name: fluentd-kubernetes
-version: 0.3.0
-appVersion: 0.12
+version: 0.4.0
+appVersion: 1.8.0
 home: https://www.fluentd.org/
 sources:
 - https://quay.io/repository/coreos/fluentd-kubernetes
@@ -12,4 +12,6 @@ maintainers:
 - name: cloudposse
   email: [email protected]
 - name: goruha
-  email: [email protected]
+  email: [email protected]
+- name: 3h4x
+  email: [email protected]
diff --git a/incubator/fluentd-kubernetes/README.md b/incubator/fluentd-kubernetes/README.md
@@ -31,7 +31,7 @@ env:
     OUTPUT_BUFFER_QUEUE_LIMIT: 8
 
 configDir: /etc/fluent/config.d
-configMap:
+configMaps:
   general.conf: |
     <match fluentd.**>
       @type null
@@ -132,7 +132,7 @@ env:
    OUTPUT_BUFFER_QUEUE_LIMIT: 8
 
 configDir: /etc/fluent/config.d
-configMap:
+configMaps:
   system.conf: |-
     <system>
       root_dir /tmp/fluentd-buffers/

diff --git a/incubator/fluentd-kubernetes/templates/clusterrole.yaml b/incubator/fluentd-kubernetes/templates/clusterrole.yaml
@@ -0,0 +1,21 @@
+{{- if .Values.serviceAccount.enabled }}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: {{ .Values.serviceAccount.name }}
+  labels:
+    app: {{ template "fluentd_kubernetes.name" . }}
+    chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
+    release: {{ .Release.Name }}
+    heritage: {{ .Release.Service }}
+rules:
+  - apiGroups:
+      - ""
+    resources:
+      - pods
+      - namespaces
+    verbs:
+      - get
+      - list
+      - watch
+{{- end }}
diff --git a/incubator/fluentd-kubernetes/templates/clusterrolebinding.yaml b/incubator/fluentd-kubernetes/templates/clusterrolebinding.yaml
@@ -0,0 +1,19 @@
+{{- if .Values.serviceAccount.enabled }}
+kind: ClusterRoleBinding
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: {{ .Values.serviceAccount.name }}
+  labels:
+    app: {{ template "fluentd_kubernetes.name" . }}
+    chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
+    release: {{ .Release.Name }}
+    heritage: {{ .Release.Service }}
+roleRef:
+  kind: ClusterRole
+  name: {{ .Values.serviceAccount.name }}
+  apiGroup: rbac.authorization.k8s.io
+subjects:
+  - kind: ServiceAccount
+    name: {{ .Values.serviceAccount.name }}
+    namespace: {{ .Release.Namespace }}
+{{- end }}
diff --git a/incubator/fluentd-kubernetes/templates/configmap.yaml b/incubator/fluentd-kubernetes/templates/configmap.yaml
@@ -1,14 +1,29 @@
+{{ with index .Values "configMaps" -}}
 apiVersion: v1
 kind: ConfigMap
 metadata:
-  name: {{ template "fluentd_kubernetes.fullname" . }}
+  name: {{ template "fluentd_kubernetes.fullname" $ }}-config
   labels:
-    app: {{ template "fluentd_kubernetes.name" . }}
-    chart: {{ template "fluentd_kubernetes.chart" . }}
-    release: {{ .Release.Name }}
-    heritage: {{ .Release.Service }}
+    app: {{ template "fluentd_kubernetes.name" $ }}
+    chart: {{ template "fluentd_kubernetes.chart" $ }}
+    release: {{ $.Release.Name }}
+    heritage: {{ $.Release.Service }}
 data:
-{{- range $key, $value := .Values.configMaps }}
-  {{ $key }}: |-
-{{ $value | indent 4 }}
+  {{- range $key, $value := . }}
+  {{ $key }}: |- {{ $value | nindent 4 }}
+  {{- end }}
+{{- end }}
+{{- with index .Values "fluent.conf" }}
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: {{ template "fluentd_kubernetes.fullname" $ }}-fluent-conf
+  labels:
+    app: {{ template "fluentd_kubernetes.name" $ }}
+    chart: {{ template "fluentd_kubernetes.chart" $ }}
+    release: {{ $.Release.Name }}
+    heritage: {{ $.Release.Service }}
+data:
+  fluent.conf: |- {{ . | nindent 4 }}
 {{- end }}
diff --git a/incubator/fluentd-kubernetes/templates/daemonset.yaml b/incubator/fluentd-kubernetes/templates/daemonset.yaml
@@ -24,16 +24,22 @@ spec:
       annotations:
         checksum/config: {{ include (print $.Template.BasePath "/configmap.yaml") . | sha256sum }}
     spec:
+      {{- if .Values.serviceAccount.name }}
+      serviceAccountName: {{ .Values.serviceAccount.name }}
+      {{- end }}
       tolerations:
-      - key: node-role.kubernetes.io/master
+      - operator: Exists
         effect: NoSchedule
+      {{- with index .Values "priorityClassName" }}
+      priorityClassName: {{ . }}
+      {{- end }}
       containers:
-{{- if .Values.image.pullSecrets }}
+      {{- if .Values.image.pullSecrets }}
       imagePullSecrets:
-      {{- range $pullSecret := .Values.image.pullSecrets }}
+        {{- range $pullSecret := .Values.image.pullSecrets }}
         - name: {{ $pullSecret }}
+        {{- end }}
       {{- end }}
-{{- end }}
       containers:
       - name: {{ .Chart.Name }}
         image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
@@ -42,30 +48,29 @@ spec:
           runAsNonRoot: false
           runAsUser: 0
         env:
-{{- range $name, $value := .Values.env.open }}
-{{- if not (empty $value) }}
+        {{- range $name, $value := .Values.env.open }}
+        {{- if not (empty $value) }}
         - name: {{ $name | quote }}
           value: {{ $value | quote }}
-{{- end }}
-{{- end }}
-{{- $secret_name := include "fluentd_kubernetes.fullname" . }}
-{{- range $name, $value := .Values.env.secret }}
-{{- if not ( empty $value) }}
+        {{- end }}
+        {{- end }}
+        {{- $secret_name := include "fluentd_kubernetes.fullname" . }}
+        {{- range $name, $value := .Values.env.secret }}
+        {{- if not ( empty $value) }}
         - name: {{ $name | quote }}
           valueFrom:
             secretKeyRef:
               name: {{ $secret_name }}
               key: {{ $name | quote }}
-{{- end }}
-{{- end }}
-        resources:
-{{ toYaml .Values.resources | indent 12 }}
+        {{- end }}
+        {{- end }}
+        resources: {{ toYaml .Values.resources | nindent 12 }}
         ports:
-{{- range $port := .Values.service.ports }}
+        {{- range $port := .Values.service.ports }}
           - name: {{ $port.name }}
-            containerPort: {{ $port.containerPort }}
+            containerPort: {{ $port.targetPort }}
             protocol: {{ $port.protocol }}
-{{- end }}
+        {{- end }}
           - name: http-input
             containerPort: 9880
             protocol: TCP
@@ -76,8 +81,15 @@ spec:
           mountPath: /mnt/pos
         - name: varlibdockercontainers
           mountPath: /var/lib/docker/
-        - name: config-volume-{{ template "fluentd_kubernetes.fullname" . }}
-          mountPath: {{ .Values.configDir }}
+        {{- with index .Values "configMaps" }}
+        - name: config-volume-{{ template "fluentd_kubernetes.fullname" $ }}
+          mountPath: {{ $.Values.configDir }}
+        {{- end }}
+        {{- with index .Values "fluent.conf" }}
+        - name: fluent-conf
+          mountPath: /fluentd/etc/fluent.conf
+          subPath: fluent.conf
+        {{- end }}
       volumes:
       - name: varlog
         hostPath:
@@ -87,18 +99,22 @@ spec:
       - name: varlibdockercontainers
         hostPath:
           path: /var/lib/docker/
-      - name: config-volume-{{ template "fluentd_kubernetes.fullname" . }}
+      {{- with index .Values "fluent.conf" }}
+      - name: fluent-conf
+        configMap:
+          name: {{ template "fluentd_kubernetes.fullname" $ }}-fluent-conf
+      {{- end }}
+      {{- with index .Values "configMaps" }}
+      - name: config-volume-{{ template "fluentd_kubernetes.fullname" $ }}
         configMap:
-          name: {{ template "fluentd_kubernetes.fullname" . }}
+          name: {{ template "fluentd_kubernetes.fullname" $ }}-config
+      {{- end }}
     {{- with .Values.nodeSelector }}
-      nodeSelector:
-{{ toYaml . | indent 8 }}
+      nodeSelector: {{ toYaml . | nindent 8 }}
     {{- end }}
     {{- with .Values.affinity }}
-      affinity:
-{{ toYaml . | indent 8 }}
+      affinity: {{ toYaml . | nindent 8 }}
     {{- end }}
     {{- with .Values.tolerations }}
-      tolerations:
-{{ toYaml . | indent 8 }}
+      tolerations: {{ toYaml . | nindent 8 }}
     {{- end }}
diff --git a/incubator/fluentd-kubernetes/templates/secret.yaml b/incubator/fluentd-kubernetes/templates/secret.yaml
@@ -1,16 +1,18 @@
+{{ with .Values.env.secret }}
 apiVersion: v1
 kind: Secret
 metadata:
-  name: {{ include "fluentd_kubernetes.fullname" . }}
+  name: {{ include "fluentd_kubernetes.fullname" $ }}
   labels:
-    app: {{ template "fluentd_kubernetes.name" . }}
-    chart: {{ template "fluentd_kubernetes.chart" . }}
+    app: {{ template "fluentd_kubernetes.name" $ }}
+    chart: {{ template "fluentd_kubernetes.chart" $ }}
     release: {{ .Release.Name }}
     heritage: {{ .Release.Service }}
 type: Opaque
 data:
-{{- range $name, $value := .Values.env.secret }}
-{{- if not (empty $value) }}
+  {{- range $name, $value := . }}
+  {{- if not (empty $value) }}
   {{ $name }}: {{ $value | b64enc }}
-{{- end }}
+  {{- end }}
+  {{- end }}
 {{- end }}
diff --git a/incubator/fluentd-kubernetes/templates/service.yaml b/incubator/fluentd-kubernetes/templates/service.yaml
@@ -1,3 +1,4 @@
+{{ if .Values.service.enabled -}}
 apiVersion: v1
 kind: Service
 metadata:
@@ -12,10 +13,11 @@ spec:
   ports:
   {{- range $port := .Values.service.ports }}
     - name: {{ $port.name }}
-      port: {{ $port.externalPort }}
-      targetPort: {{ $port.containerPort }}
+      port: {{ $port.port }}
+      targetPort: {{ $port.targetPort }}
       protocol: {{ $port.protocol }}
   {{- end }}
   selector:
     app: {{ template "fluentd_kubernetes.name" . }}
     release: {{ .Release.Name }}
+{{- end }}
diff --git a/incubator/fluentd-kubernetes/templates/serviceaccount.yaml b/incubator/fluentd-kubernetes/templates/serviceaccount.yaml
@@ -0,0 +1,17 @@
+{{- if .Values.serviceAccount.enabled }}
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{ .Values.serviceAccount.name }}
+  {{- with index .Values.serviceAccount "annotations"}}
+  annotations:
+    {{- range $key, $value := . }}
+    "{{ $key }}": "{{ $value }}"
+    {{- end }}
+  {{- end }}
+  labels:
+    app: {{ template "fluentd_kubernetes.name" . }}
+    chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
+    release: {{ .Release.Name }}
+    heritage: {{ .Release.Service }}
+{{- end }}
diff --git a/incubator/fluentd-kubernetes/templates/servicemonitor.yaml b/incubator/fluentd-kubernetes/templates/servicemonitor.yaml
@@ -0,0 +1,18 @@
+{{- if .Values.serviceMonitor.enabled }}
+kind: ServiceMonitor
+apiVersion: monitoring.coreos.com/v1
+metadata:
+  name: {{ template "fluentd_kubernetes.fullname" . }}
+  labels:
+    app: {{ template "fluentd_kubernetes.name" . }}
+    chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
+    release: {{ .Release.Name }}
+    heritage: {{ .Release.Service }}
+spec:
+  endpoints:
+  - port: metrics
+  selector:
+    matchLabels:
+      app: {{ template "fluentd_kubernetes.name" . }}
+      release: {{ .Release.Name }}
+{{- end }}