From 594a66de6d95f2533ab2fa67ca65e92d7e094edd Mon Sep 17 00:00:00 2001 From: pierre Date: Tue, 4 Aug 2026 15:45:40 +0100 Subject: [PATCH] moving to kustomize --- child/conf/go.d.yaml | 3 + child/conf/kubelet.yaml | 8 + child/conf/kubeproxy.yaml | 5 + child/conf/netdata.conf | 12 ++ child/conf/otel.yaml | 37 +++++ child/conf/sd-config.yml | 242 +++++++++++++++++++++++++++++ child/conf/stream.conf | 8 + child/conf/web_log.yaml | 7 + child/daemonset.yaml | 156 +++++++++++++++++++ k8s-state/conf/dnsquery.yaml | 14 ++ k8s-state/conf/go.d-k8s_state.yaml | 3 + k8s-state/conf/go.d.yaml | 6 + k8s-state/conf/httpcheck.yaml | 11 ++ k8s-state/conf/netdata.conf | 28 ++++ k8s-state/conf/stream.conf | 8 + k8s-state/conf/x509check.yaml | 3 + k8s-state/deployment.yaml | 101 ++++++++++++ k8s-state/pvc.yaml | 13 ++ kustomization.yaml | 51 ++++++ namespace.yaml | 4 + parent/conf/health.conf | 4 + parent/conf/netdata.conf | 18 +++ parent/conf/stream.conf | 6 + parent/deployment.yaml | 101 ++++++++++++ parent/ingress.yaml | 21 +++ parent/pvc.yaml | 27 ++++ parent/service.yaml | 17 ++ rbac.yaml | 48 ++++++ 28 files changed, 962 insertions(+) create mode 100755 child/conf/go.d.yaml create mode 100755 child/conf/kubelet.yaml create mode 100755 child/conf/kubeproxy.yaml create mode 100755 child/conf/netdata.conf create mode 100755 child/conf/otel.yaml create mode 100755 child/conf/sd-config.yml create mode 100755 child/conf/stream.conf create mode 100755 child/conf/web_log.yaml create mode 100755 child/daemonset.yaml create mode 100755 k8s-state/conf/dnsquery.yaml create mode 100755 k8s-state/conf/go.d-k8s_state.yaml create mode 100755 k8s-state/conf/go.d.yaml create mode 100755 k8s-state/conf/httpcheck.yaml create mode 100755 k8s-state/conf/netdata.conf create mode 100755 k8s-state/conf/stream.conf create mode 100755 k8s-state/conf/x509check.yaml create mode 100755 k8s-state/deployment.yaml create mode 100755 k8s-state/pvc.yaml create mode 100755 kustomization.yaml create mode 100755 namespace.yaml create mode 100755 parent/conf/health.conf create mode 100755 parent/conf/netdata.conf create mode 100755 parent/conf/stream.conf create mode 100755 parent/deployment.yaml create mode 100755 parent/ingress.yaml create mode 100755 parent/pvc.yaml create mode 100755 parent/service.yaml create mode 100755 rbac.yaml diff --git a/child/conf/go.d.yaml b/child/conf/go.d.yaml new file mode 100755 index 0000000..bceb549 --- /dev/null +++ b/child/conf/go.d.yaml @@ -0,0 +1,3 @@ +modules: + pulsar: no + prometheus: yes diff --git a/child/conf/kubelet.yaml b/child/conf/kubelet.yaml new file mode 100755 index 0000000..af51250 --- /dev/null +++ b/child/conf/kubelet.yaml @@ -0,0 +1,8 @@ +update_every: 1 +autodetection_retry: 0 +jobs: + - name: local + url: http://127.0.0.1:10255/metrics + - name: local + url: https://localhost:10250/metrics + tls_skip_verify: yes diff --git a/child/conf/kubeproxy.yaml b/child/conf/kubeproxy.yaml new file mode 100755 index 0000000..d5d5887 --- /dev/null +++ b/child/conf/kubeproxy.yaml @@ -0,0 +1,5 @@ +update_every: 1 +autodetection_retry: 0 +jobs: + - name: local + url: http://127.0.0.1:10249/metrics diff --git a/child/conf/netdata.conf b/child/conf/netdata.conf new file mode 100755 index 0000000..a87310a --- /dev/null +++ b/child/conf/netdata.conf @@ -0,0 +1,12 @@ +[db] + mode = ram +[web] + bind to = localhost:19999 +[health] + enabled = no +[ml] + enabled = no +[plugins] + otel = yes +[plugin:otel] + command options = --otel-endpoint 0.0.0.0:4317 --otel-logs-journal-dir /var/log/netdata/otel/v1 diff --git a/child/conf/otel.yaml b/child/conf/otel.yaml new file mode 100755 index 0000000..c7ee8e5 --- /dev/null +++ b/child/conf/otel.yaml @@ -0,0 +1,37 @@ +# OpenTelemetry Plugin Configuration +# To customize, run: edit-config otel.yaml +# Only include the fields you want to change — missing fields keep their defaults. + +endpoint: + path: "127.0.0.1:4317" + tls_cert_path: null + tls_key_path: null + tls_ca_cert_path: null + +metrics: + chart_configs_dir: /etc/netdata/otel.d/v1/metrics + interval_secs: 10 + grace_period_secs: 60 + expiry_duration_secs: 900 + max_new_charts_per_request: 100 + +base_dir: /var/log/netdata/otel/v2 + +remote_storage: + enabled: false + uri: "fs:///var/log/netdata/otel/v2/remote" + read_cache_max_size: "1GB" + +auth: + enabled: false + +logs: + rotation: + default: + max_file_size: "25MB" + max_entries: 50000 + retention: + default: + max_files: 100000 + max_total_size: "1GB" + max_age: "7 days" diff --git a/child/conf/sd-config.yml b/child/conf/sd-config.yml new file mode 100755 index 0000000..b2deabe --- /dev/null +++ b/child/conf/sd-config.yml @@ -0,0 +1,242 @@ +disabled: no + +name: 'kubernetes' + +discover: + - discoverer: k8s + k8s: + - tags: unknown + role: pod + pod: + local_mode: yes +classify: + - name: "Control-Plane" + selector: unknown + tags: -unknown control_plane + match: + - tags: kube_scheduler + expr: '{{ glob .Image "k8s.gcr.io/kube-scheduler:*" }}' + - tags: kube_controller_manager + expr: '{{ glob .Image "k8s.gcr.io/kube-controller-manager:*" }}' + - name: "Applications" + selector: unknown + tags: -unknown applications + match: + - tags: activemq + expr: '{{ and (eq .Port "8161") (glob .Image "*/activemq*") }}' + - tags: apache + expr: '{{ and (eq .Port "80" "8080") (glob .Image "httpd*" "*/httpd*") }}' + - tags: bind + expr: '{{ and (eq .Port "8653") (glob .Image "*/bind*") }}' + - tags: cockroachdb + expr: '{{ and (eq .Port "8080") (glob .Image "*/cockroach*") }}' + - tags: consul + expr: '{{ and (eq .Port "8500") (glob .Image "consul*" "*/consul*") }}' + - tags: coredns + expr: '{{ and (eq .Port "9153") (glob .Image "*/coredns*") }}' + - tags: elasticsearch + expr: '{{ and (eq .Port "9200") (glob .Image "elasticsearch:*" "*/elasticsearch:*") }}' + - tags: fluentd + expr: '{{ and (eq .Port "24220") (glob .Image "fluentd*" "*/fluentd*") }}' + - tags: freeradius + expr: '{{ and (eq .Port "18121") (glob .Image "*/freeradius*") }}' + - tags: hdfs + expr: '{{ and (eq .Port "50070") (glob .Image "*/hdfs*") }}' + - tags: lighttpd + expr: '{{ and (eq .Port "80" "8080") (glob .Image "*/lighttpd*") }}' + - tags: logstash + expr: '{{ and (eq .Port "9600") (glob .Image "logstash*" "*/logstash*") }}' + - tags: mysql + expr: '{{ and (eq .Port "3306") (glob .Image "mysql*" "*/mysql*" "mariadb*" "*/mariadb*") }}' + - tags: nginx + expr: '{{ and (eq .Port "80" "8080") (glob .Image "nginx*" "*/nginx*") }}' + - tags: openvpn + expr: '{{ and (eq .Port "7505") (glob .Image "*/openvpn") }}' + - tags: phpfpm + expr: '{{ and (eq .Port "80" "8080") (glob .Image "*/phpfpm*" "*/php-fpm*") }}' + - tags: rabbitmq + expr: '{{ and (eq .Port "15672") (glob .Image "rabbitmq*" "*/rabbitmq*") }}' + - tags: solr + expr: '{{ and (eq .Port "8983") (glob .Image "solr*" "*/solr*") }}' + - tags: tengine + expr: '{{ and (eq .Port "80" "8080") (glob .Image "*/tengine*") }}' + - tags: unbound + expr: '{{ and (eq .Port "8953") (glob .Image "*/unbound*") }}' + - tags: vernemq + expr: '{{ and (eq .Port "8888") (glob .Image "*/vernemq*") }}' + - tags: zookeeper + expr: '{{ and (eq .Port "2181") (glob .Image "zookeeper*" "*/zookeeper*") }}' + - tags: consul_envoy + expr: | + {{ $imageOK := glob .Image "*/consul-dataplane*" -}} + {{ $scrapeOK := eq (get .Annotations "prometheus.io/scrape") "true" -}} + {{ $promPort := get .Annotations "prometheus.io/port" -}} + {{ $portOK1 := and (eq .Port $promPort) (not (empty .Port)) -}} + {{ $portOK2 := and (empty .Port) (not (empty $promPort)) -}} + {{ and $imageOK $scrapeOK (or $portOK1 $portOK2) }} + - name: "Prometheus Generic Applications" + selector: unknown + tags: -unknown prometheus_generic + match: + - tags: prometheus_generic + expr: | + {{ $scrapeOK := eq (get .Annotations "prometheus.io/scrape") "true" -}} + {{ $portOK := eq (default .Port (get .Annotations "prometheus.io/port")) .Port -}} + {{ $imageOK := not (glob .Image "netdata/netdata*" "*pulsar*" "*telegraf*") -}} + {{ and $scrapeOK $portOK $imageOK }} +compose: + - name: "Control-Plane" + selector: '!unknown control_plane' + config: + - selector: kube_scheduler + template: | + - module: prometheus + name: prometheus-{{.TUID}} + url: http://{{.PodIP}}:{{default "10251" .Port}}/metrics + app: '{{.ContName}}' + update_every: 10 + max_time_series: 1000 + - selector: kube_controller_manager + template: | + - module: prometheus + name: prometheus-{{.TUID}} + url: http://{{.PodIP}}:{{default "10252" .Port}}/metrics + app: '{{.ContName}}' + update_every: 10 + max_time_series: 2000 + - name: "Prometheus Generic Applications" + selector: '!unknown prometheus_generic' + config: + - selector: prometheus_generic + template: | + {{ $path := default "/metrics" (get .Annotations "prometheus.io/path") -}} + - module: prometheus + name: prometheus-{{.TUID}} + url: http://{{.Address}}{{$path}} + app: '{{.ContName}}' + update_every: 10 + max_time_series: 4000 + - name: "Applications" + selector: '!unknown applications' + tags: file + config: + - selector: activemq + template: | + - module: activemq + name: activemq-{{.TUID}} + url: http://{{.Address}} + - selector: apache + template: | + - module: apache + name: apache-{{.TUID}} + url: http://{{.Address}}/server-status?auto + - selector: bind + template: | + - module: bind + name: bind-{{.TUID}} + url: http://{{.Address}}/json/v1 + - selector: cockroachdb + template: | + - module: cockroachdb + name: cockroachdb-{{.TUID}} + url: http://{{.Address}}/_status/vars + - selector: consul + template: | + - module: consul + name: consul-{{.TUID}} + url: http://{{.Address}} + - selector: coredns + template: | + - module: coredns + name: coredns-{{.TUID}} + url: http://{{.Address}}/metrics + - selector: elasticsearch + template: | + - module: elasticsearch + name: elasticsearch-{{.TUID}} + url: http://{{.Address}} + - selector: consul_envoy + template: | + {{ $path := default "/metrics" (get .Annotations "prometheus.io/path") -}} + {{ $promPort := get .Annotations "prometheus.io/port" -}} + {{ $port := ternary .Port $promPort (not (empty .Port)) -}} + - module: envoy + name: {{.TUID}} + url: http://{{ .PodIP }}:{{ $port }}{{ $path }} + - selector: fluentd + template: | + - module: fluentd + name: fluentd-{{.TUID}} + url: http://{{.Address}} + - selector: freeradius + template: | + - module: freeradius + name: freeradius-{{.TUID}} + address: {{.PodIP}} + port: {{.Port}} + - selector: hdfs + template: | + - module: hdfs + name: hdfs-{{.TUID}} + url: http://{{.Address}}/jmx + - selector: lighttpd + template: | + - module: lighttpd + name: lighttpd-{{.TUID}} + url: http://{{.Address}}/server-status?auto + - selector: logstash + template: | + - module: logstash + name: logstash-{{.TUID}} + url: http://{{.Address}} + - selector: mysql + template: | + - module: mysql + name: mysql-{{.TUID}} + dsn: 'netdata@tcp({{.Address}})/' + - selector: nginx + template: | + - module: nginx + name: nginx-{{.TUID}} + url: http://{{.Address}}/stub_status + - selector: openvpn + template: | + - module: openvpn + name: openvpn-{{.TUID}} + address: {{.Address}} + - selector: phpfpm + template: | + - module: phpfpm + name: phpfpm-{{.TUID}} + url: http://{{.Address}}/status?full&json + - selector: rabbitmq + template: | + - module: rabbitmq + name: rabbitmq-{{.TUID}} + url: http://{{.Address}} + - selector: solr + template: | + - module: solr + name: solr-{{.TUID}} + url: http://{{.Address}} + - selector: tengine + template: | + - module: tengine + name: tengine-{{.TUID}} + url: http://{{.Address}}/us + - selector: unbound + template: | + - module: unbound + name: unbound-{{.TUID}} + address: {{.Address}} + use_tls: false + - selector: vernemq + template: | + - module: vernemq + name: vernemq-{{.TUID}} + url: http://{{.Address}}/metrics + - selector: zookeeper + template: | + - module: zookeeper + name: zookeeper-{{.TUID}} + address: {{.Address}} diff --git a/child/conf/stream.conf b/child/conf/stream.conf new file mode 100755 index 0000000..d324dcb --- /dev/null +++ b/child/conf/stream.conf @@ -0,0 +1,8 @@ +[stream] + enabled = yes + destination = netdata:19999 + api key = 11111111-2222-3333-4444-555555555555 + timeout seconds = 60 + buffer size bytes = 1048576 + reconnect delay seconds = 5 + initial clock resync iterations = 60 diff --git a/child/conf/web_log.yaml b/child/conf/web_log.yaml new file mode 100755 index 0000000..6b1698e --- /dev/null +++ b/child/conf/web_log.yaml @@ -0,0 +1,7 @@ +jobs: + - name: django_testing + path: /host/var/log/pods/django-testing_django-testing-7f89d9ffc5-mcm9g_ad5b3bbf-33ca-410f-aa0e-457664c6345b/django-testing/0.log + log_type: auto + - name: nginx + path: /host/var/log/pods/reverse-proxy_reverse-proxy-67c767c86f-pxvdz_af6033a7-dfcb-4430-a67b-ee75ea424cf7/reverse-proxy/0.log + log_type: auto diff --git a/child/daemonset.yaml b/child/daemonset.yaml new file mode 100755 index 0000000..7033b54 --- /dev/null +++ b/child/daemonset.yaml @@ -0,0 +1,156 @@ +apiVersion: apps/v1 +kind: DaemonSet +metadata: + name: netdata-child + labels: + app: netdata + role: child +spec: + selector: + matchLabels: + app: netdata + role: child + template: + metadata: + annotations: + container.apparmor.security.beta.kubernetes.io/netdata: unconfined + labels: + app: netdata + role: child + spec: + serviceAccountName: netdata + restartPolicy: Always + hostPID: true + hostIPC: true + hostNetwork: true + initContainers: + - name: init-persistence + image: "alpine:latest" + resources: + requests: + cpu: 10m + imagePullPolicy: Always + volumeMounts: + - name: persistencevarlibdir + mountPath: "/persistencevarlibdir" + command: ["/bin/sh"] + args: + - "-c" + - "chmod 777 /persistencevarlibdir;" + containers: + - name: netdata + image: "netdata/netdata:edge" + imagePullPolicy: Always + env: + - name: NETDATA_CLAIM_URL + value: "https://api.netdata.cloud" + - name: NETDATA_CLAIM_TOKEN + value: "CIlCwV6GawNWIfhrqMVmPAJixo_BSaGvwVbHKFOCQCHbYG5J8Ac0FDxKrObJ727F1dndg8J-v6apUhzGho6RIOlkrqJ_F7DKodjLqbsSWb7Ta-GSHkkuHcTXidxKxEo5RK0jiqU" + - name: NETDATA_CLAIM_ROOMS + value: "e15a4f12-89d7-4d5b-b588-6658fa835473" + - name: MY_POD_NAME + valueFrom: + fieldRef: + fieldPath: metadata.name + - name: MY_NODE_NAME + valueFrom: + fieldRef: + fieldPath: spec.nodeName + - name: MY_POD_NAMESPACE + valueFrom: + fieldRef: + fieldPath: metadata.namespace + - name: NETDATA_LISTENER_PORT + value: '19999' + ports: + - name: http + containerPort: 19999 + protocol: TCP + livenessProbe: + exec: + command: ["/usr/sbin/netdatacli", "ping"] + initialDelaySeconds: 0 + failureThreshold: 3 + periodSeconds: 30 + successThreshold: 1 + timeoutSeconds: 1 + readinessProbe: + exec: + command: ["/usr/sbin/netdatacli", "ping"] + initialDelaySeconds: 0 + failureThreshold: 3 + periodSeconds: 30 + successThreshold: 1 + timeoutSeconds: 1 + volumeMounts: + - name: proc + readOnly: true + mountPath: /host/proc + - name: sys + mountPath: /host/sys + - name: os-release + mountPath: /host/etc/os-release + - name: varlog + mountPath: /host/var/log + - name: configmap + mountPath: /etc/netdata/go.d.conf + subPath: go.d + - name: configmap + mountPath: /etc/netdata/go.d/k8s_kubelet.conf + subPath: kubelet + - name: configmap + mountPath: /etc/netdata/go.d/k8s_kubeproxy.conf + subPath: kubeproxy + - name: configmap + mountPath: /etc/netdata/go.d/web_log.conf + subPath: web_log + - name: configmap + mountPath: /etc/netdata/otel.yaml + subPath: otel + - name: configmap + mountPath: /etc/netdata/netdata.conf + subPath: netdata + - name: configmap + mountPath: /etc/netdata/stream.conf + subPath: stream + - name: persistencevarlibdir + mountPath: /var/lib/netdata + - name: sdconfigmap + mountPath: "/etc/netdata/go.d/sd/k8s.conf" + subPath: config.yml + securityContext: + capabilities: + add: + - SYS_PTRACE + - SYS_ADMIN + resources: {} + tolerations: + - effect: NoSchedule + operator: Exists + terminationGracePeriodSeconds: 30 + volumes: + - name: proc + hostPath: + path: /proc + - name: sys + hostPath: + path: /sys + - name: os-release + hostPath: + path: /etc/os-release + - name: varlog + hostPath: + path: /var/log + - name: configmap + configMap: + name: netdata-conf-child + optional: true + - name: persistencevarlibdir + hostPath: + path: /var/lib/netdata-k8s-child/var/lib/netdata + type: DirectoryOrCreate + - name: sdconfigmap + configMap: + name: netdata-child-sd-config-map + optional: true + dnsPolicy: ClusterFirstWithHostNet diff --git a/k8s-state/conf/dnsquery.yaml b/k8s-state/conf/dnsquery.yaml new file mode 100755 index 0000000..e59473f --- /dev/null +++ b/k8s-state/conf/dnsquery.yaml @@ -0,0 +1,14 @@ +update_every: 3600 +autodetection_retry: 0 +jobs: + - name: job1 + record_types: + - A + - AAAA + domains: + - google.com + - github.com + - gitea.tryton.geeraert.eu + servers: + - 8.8.8.8 + - 8.8.4.4 diff --git a/k8s-state/conf/go.d-k8s_state.yaml b/k8s-state/conf/go.d-k8s_state.yaml new file mode 100755 index 0000000..07f3bd0 --- /dev/null +++ b/k8s-state/conf/go.d-k8s_state.yaml @@ -0,0 +1,3 @@ +jobs: + - name: k8s_state + update_every: 1 diff --git a/k8s-state/conf/go.d.yaml b/k8s-state/conf/go.d.yaml new file mode 100755 index 0000000..faadcbb --- /dev/null +++ b/k8s-state/conf/go.d.yaml @@ -0,0 +1,6 @@ +default_run: no +modules: + k8s_state: yes + httpcheck: yes + dnsquery: yes + x509check: yes diff --git a/k8s-state/conf/httpcheck.yaml b/k8s-state/conf/httpcheck.yaml new file mode 100755 index 0000000..cb2ec01 --- /dev/null +++ b/k8s-state/conf/httpcheck.yaml @@ -0,0 +1,11 @@ +update_every: 1 +autodetection_retry: 0 +jobs: + - name: gitea + url: https://gitea.tryton.geeraert.eu:443 + headers: + Host: localhost:8080 + User-Agent: netdata/go.d.plugin + Accept: "*/*" + - name: bitwarden + url: https://bitwarden.tryton.geeraert.eu:443 diff --git a/k8s-state/conf/netdata.conf b/k8s-state/conf/netdata.conf new file mode 100755 index 0000000..9fc277e --- /dev/null +++ b/k8s-state/conf/netdata.conf @@ -0,0 +1,28 @@ +[global] + hostname = netdata-k8s-state +[db] + mode = ram +[web] + bind to = localhost:19999 +[health] + enabled = no +[ml] + enabled = no +[plugins] + timex = no + checks = no + idlejitter = no + tc = no + diskspace = no + proc = no + cgroups = no + enable running new plugins = no + slabinfo = no + perf = no + go.d = yes + ioping = no + ebpf = no + charts.d = no + apps = no + python.d = no + fping = no diff --git a/k8s-state/conf/stream.conf b/k8s-state/conf/stream.conf new file mode 100755 index 0000000..d324dcb --- /dev/null +++ b/k8s-state/conf/stream.conf @@ -0,0 +1,8 @@ +[stream] + enabled = yes + destination = netdata:19999 + api key = 11111111-2222-3333-4444-555555555555 + timeout seconds = 60 + buffer size bytes = 1048576 + reconnect delay seconds = 5 + initial clock resync iterations = 60 diff --git a/k8s-state/conf/x509check.yaml b/k8s-state/conf/x509check.yaml new file mode 100755 index 0000000..31851ef --- /dev/null +++ b/k8s-state/conf/x509check.yaml @@ -0,0 +1,3 @@ +jobs: + - name: my_site_cert + source: https://gitea.tryton.geeraert.eu:443 diff --git a/k8s-state/deployment.yaml b/k8s-state/deployment.yaml new file mode 100755 index 0000000..5fbbb0b --- /dev/null +++ b/k8s-state/deployment.yaml @@ -0,0 +1,101 @@ +apiVersion: apps/v1 +kind: Deployment +metadata: + name: netdata-k8s-state + labels: + app: netdata + role: k8sState +spec: + strategy: + type: Recreate + selector: + matchLabels: + app: netdata + role: k8sState + template: + metadata: + annotations: + container.apparmor.security.beta.kubernetes.io/netdata: unconfined + labels: + app: netdata + role: k8sState + spec: + securityContext: + fsGroup: 201 + serviceAccountName: netdata + restartPolicy: Always + containers: + - name: netdata + image: "netdata/netdata:edge" + imagePullPolicy: Always + env: + - name: MY_POD_NAME + valueFrom: + fieldRef: + fieldPath: metadata.name + - name: MY_POD_NAMESPACE + valueFrom: + fieldRef: + fieldPath: metadata.namespace + - name: NETDATA_LISTENER_PORT + value: '19999' + ports: + - name: http + containerPort: 19999 + protocol: TCP + livenessProbe: + exec: + command: ["/usr/sbin/netdatacli", "ping"] + initialDelaySeconds: 0 + failureThreshold: 3 + periodSeconds: 30 + successThreshold: 1 + timeoutSeconds: 1 + readinessProbe: + exec: + command: ["/usr/sbin/netdatacli", "ping"] + initialDelaySeconds: 0 + failureThreshold: 3 + periodSeconds: 30 + successThreshold: 1 + timeoutSeconds: 1 + volumeMounts: + - name: os-release + mountPath: /host/etc/os-release + - name: configmap + mountPath: /etc/netdata/go.d.conf + subPath: go.d + - name: configmap + mountPath: /etc/netdata/go.d/httpcheck.conf + subPath: httpcheck + - name: configmap + mountPath: /etc/netdata/go.d/dns_query.conf + subPath: dnsquery + - name: configmap + mountPath: /etc/netdata/go.d/x509check.conf + subPath: x509check + - name: configmap + mountPath: /etc/netdata/go.d/k8s_state.conf + subPath: go.d-k8s_state + - name: configmap + mountPath: /etc/netdata/netdata.conf + subPath: netdata + - name: configmap + mountPath: /etc/netdata/stream.conf + subPath: stream + - name: varlib + mountPath: /var/lib/netdata + resources: {} + terminationGracePeriodSeconds: 30 + volumes: + - name: os-release + hostPath: + path: /etc/os-release + - name: configmap + configMap: + name: netdata-conf-k8s-state + optional: true + - name: varlib + persistentVolumeClaim: + claimName: netdata-k8s-state-varlib + dnsPolicy: ClusterFirstWithHostNet diff --git a/k8s-state/pvc.yaml b/k8s-state/pvc.yaml new file mode 100755 index 0000000..4855082 --- /dev/null +++ b/k8s-state/pvc.yaml @@ -0,0 +1,13 @@ +apiVersion: v1 +kind: PersistentVolumeClaim +metadata: + name: netdata-k8s-state-varlib + labels: + app: netdata + role: k8sState +spec: + storageClassName: nfs-storage-intelligent + accessModes: ["ReadWriteOnce"] + resources: + requests: + storage: 1Gi diff --git a/kustomization.yaml b/kustomization.yaml new file mode 100755 index 0000000..16d3ab7 --- /dev/null +++ b/kustomization.yaml @@ -0,0 +1,51 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization + +namespace: netdata + +resources: + - namespace.yaml + - rbac.yaml + - child/daemonset.yaml + - k8s-state/deployment.yaml + - k8s-state/pvc.yaml + - parent/deployment.yaml + - parent/service.yaml + - parent/pvc.yaml + - parent/ingress.yaml + +# configMapGenerator content-hashes each ConfigMap's name (e.g. netdata-conf-child-a1b2c3d4). +# Kustomize automatically rewrites every Deployment/DaemonSet reference to the new hashed +# name whenever any file below changes. Since the pod template's volume spec then differs, +# Kubernetes rolls the pods automatically on `kubectl apply` — no manual checksum bump, +# no manual `rollout restart`, ever again. +configMapGenerator: + - name: netdata-conf-child + files: + - go.d=child/conf/go.d.yaml + - kubelet=child/conf/kubelet.yaml + - kubeproxy=child/conf/kubeproxy.yaml + - web_log=child/conf/web_log.yaml + - netdata=child/conf/netdata.conf + - stream=child/conf/stream.conf + - otel=child/conf/otel.yaml + + - name: netdata-child-sd-config-map + files: + - config.yml=child/conf/sd-config.yml + + - name: netdata-conf-k8s-state + files: + - go.d=k8s-state/conf/go.d.yaml + - go.d-k8s_state=k8s-state/conf/go.d-k8s_state.yaml + - netdata=k8s-state/conf/netdata.conf + - stream=k8s-state/conf/stream.conf + - httpcheck=k8s-state/conf/httpcheck.yaml + - dnsquery=k8s-state/conf/dnsquery.yaml + - x509check=k8s-state/conf/x509check.yaml + + - name: netdata-conf-parent + files: + - health=parent/conf/health.conf + - netdata=parent/conf/netdata.conf + - stream=parent/conf/stream.conf diff --git a/namespace.yaml b/namespace.yaml new file mode 100755 index 0000000..e5724c0 --- /dev/null +++ b/namespace.yaml @@ -0,0 +1,4 @@ +apiVersion: v1 +kind: Namespace +metadata: + name: netdata diff --git a/parent/conf/health.conf b/parent/conf/health.conf new file mode 100755 index 0000000..ca10502 --- /dev/null +++ b/parent/conf/health.conf @@ -0,0 +1,4 @@ +SEND_EMAIL="NO" +SEND_SLACK="YES" +SLACK_WEBHOOK_URL="" +DEFAULT_RECIPIENT_SLACK="" diff --git a/parent/conf/netdata.conf b/parent/conf/netdata.conf new file mode 100755 index 0000000..f681eed --- /dev/null +++ b/parent/conf/netdata.conf @@ -0,0 +1,18 @@ +[global] + hostname = netdata-parent +[db] + mode = dbengine + +[plugins] + cgroups = no + tc = no + enable running new plugins = no + check for new plugins every = 72000 + python.d = no + charts.d = no + go.d = no + node.d = no + apps = no + proc = no + idlejitter = no + diskspace = no diff --git a/parent/conf/stream.conf b/parent/conf/stream.conf new file mode 100755 index 0000000..4a9af88 --- /dev/null +++ b/parent/conf/stream.conf @@ -0,0 +1,6 @@ +[11111111-2222-3333-4444-555555555555] + enabled = yes + history = 3600 + default memory mode = dbengine + health enabled by default = auto + allow from = * diff --git a/parent/deployment.yaml b/parent/deployment.yaml new file mode 100755 index 0000000..8858b43 --- /dev/null +++ b/parent/deployment.yaml @@ -0,0 +1,101 @@ +apiVersion: apps/v1 +kind: Deployment +metadata: + name: netdata-parent + labels: + app: netdata + role: parent +spec: + replicas: 1 + strategy: + type: Recreate + selector: + matchLabels: + app: netdata + role: parent + template: + metadata: + labels: + app: netdata + role: parent + spec: + securityContext: + fsGroup: 201 + serviceAccountName: netdata + containers: + - name: netdata + image: "netdata/netdata:edge" + imagePullPolicy: Always + env: + - name: NETDATA_CLAIM_URL + value: "https://api.netdata.cloud" + - name: NETDATA_CLAIM_TOKEN + value: "CIlCwV6GawNWIfhrqMVmPAJixo_BSaGvwVbHKFOCQCHbYG5J8Ac0FDxKrObJ727F1dndg8J-v6apUhzGho6RIOlkrqJ_F7DKodjLqbsSWb7Ta-GSHkkuHcTXidxKxEo5RK0jiqU" + - name: NETDATA_CLAIM_ROOMS + value: "e15a4f12-89d7-4d5b-b588-6658fa835473" + - name: MY_POD_NAME + valueFrom: + fieldRef: + fieldPath: metadata.name + - name: MY_POD_NAMESPACE + valueFrom: + fieldRef: + fieldPath: metadata.namespace + - name: NETDATA_LISTENER_PORT + value: '19999' + ports: + - name: http + containerPort: 19999 + protocol: TCP + livenessProbe: + exec: + command: ["/usr/sbin/netdatacli", "ping"] + initialDelaySeconds: 0 + failureThreshold: 3 + periodSeconds: 30 + successThreshold: 1 + timeoutSeconds: 1 + readinessProbe: + exec: + command: ["/usr/sbin/netdatacli", "ping"] + initialDelaySeconds: 0 + failureThreshold: 3 + periodSeconds: 30 + successThreshold: 1 + timeoutSeconds: 1 + securityContext: + runAsUser: 201 + runAsGroup: 201 + volumeMounts: + - name: os-release + mountPath: /host/etc/os-release + - name: configmap + mountPath: /etc/netdata/health_alarm_notify.conf + subPath: health + - name: configmap + mountPath: /etc/netdata/netdata.conf + subPath: netdata + - name: configmap + mountPath: /etc/netdata/stream.conf + subPath: stream + - name: database + mountPath: /var/cache/netdata + - name: alarms + mountPath: /var/lib/netdata + resources: {} + terminationGracePeriodSeconds: 300 + volumes: + - name: os-release + hostPath: + path: /etc/os-release + - name: configmap + configMap: + name: netdata-conf-parent + optional: true + - name: database + persistentVolumeClaim: + claimName: netdata-parent-database + - name: alarms + persistentVolumeClaim: + claimName: netdata-parent-alarms + dnsPolicy: Default diff --git a/parent/ingress.yaml b/parent/ingress.yaml new file mode 100755 index 0000000..1767b3a --- /dev/null +++ b/parent/ingress.yaml @@ -0,0 +1,21 @@ +apiVersion: networking.k8s.io/v1 +kind: Ingress +metadata: + name: netdata + labels: + app: netdata + annotations: + kubernetes.io/ingress.class: nginx + kubernetes.io/tls-acme: "true" +spec: + rules: + - host: netdata.k8s.local + http: + paths: + - path: / + pathType: Prefix + backend: + service: + name: netdata + port: + name: http diff --git a/parent/pvc.yaml b/parent/pvc.yaml new file mode 100755 index 0000000..97953b3 --- /dev/null +++ b/parent/pvc.yaml @@ -0,0 +1,27 @@ +apiVersion: v1 +kind: PersistentVolumeClaim +metadata: + name: netdata-parent-database + labels: + app: netdata + role: parent +spec: + storageClassName: nfs-storage-intelligent + accessModes: ["ReadWriteOnce"] + resources: + requests: + storage: 15Gi +--- +apiVersion: v1 +kind: PersistentVolumeClaim +metadata: + name: netdata-parent-alarms + labels: + app: netdata + role: parent +spec: + storageClassName: nfs-storage-intelligent + accessModes: ["ReadWriteOnce"] + resources: + requests: + storage: 1Gi diff --git a/parent/service.yaml b/parent/service.yaml new file mode 100755 index 0000000..f37f5cc --- /dev/null +++ b/parent/service.yaml @@ -0,0 +1,17 @@ +apiVersion: v1 +kind: Service +metadata: + name: netdata + labels: + app: netdata + role: parent +spec: + type: ClusterIP + ports: + - port: 19999 + targetPort: http + protocol: TCP + name: http + selector: + app: netdata + role: parent diff --git a/rbac.yaml b/rbac.yaml new file mode 100755 index 0000000..4adbeb4 --- /dev/null +++ b/rbac.yaml @@ -0,0 +1,48 @@ +apiVersion: v1 +kind: ServiceAccount +metadata: + name: netdata + labels: + app: netdata +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: netdata + labels: + app: netdata +rules: + - apiGroups: [""] + resources: + - "pods" + - "services" + - "configmaps" + - "secrets" + - "nodes" + - "nodes/metrics" + - "nodes/proxy" + verbs: ["get", "list", "watch"] + - apiGroups: ["apps"] + resources: ["deployments"] + verbs: ["get", "list", "watch"] + - apiGroups: ["batch"] + resources: ["cronjobs", "jobs"] + verbs: ["get", "list", "watch"] + - apiGroups: [""] + resources: ["namespaces"] + verbs: ["get"] +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: netdata + labels: + app: netdata +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: netdata +subjects: + - kind: ServiceAccount + name: netdata + namespace: netdata