From 83ad4ad8664d6a975beca04ed90800a4efd3a40c Mon Sep 17 00:00:00 2001 From: Alejandro Moreno Date: Tue, 1 Oct 2019 13:58:20 +0000 Subject: [PATCH] Production and horizontal scaling --- bitnami/fluentd/README.md | 32 ++- bitnami/fluentd/templates/_helpers.tpl | 2 +- .../templates/aggregator-statefulset.yaml | 14 +- bitnami/fluentd/templates/certs.yaml | 15 - .../templates/forwarder-daemonset.yaml | 14 +- bitnami/fluentd/templates/tls-certs.yaml | 13 + bitnami/fluentd/values-production.yaml | 256 ++++++++++++++++++ bitnami/fluentd/values.yaml | 7 +- 8 files changed, 316 insertions(+), 37 deletions(-) delete mode 100644 bitnami/fluentd/templates/certs.yaml create mode 100644 bitnami/fluentd/templates/tls-certs.yaml create mode 100644 bitnami/fluentd/values-production.yaml diff --git a/bitnami/fluentd/README.md b/bitnami/fluentd/README.md index 84d83a882..1eee02417 100644 --- a/bitnami/fluentd/README.md +++ b/bitnami/fluentd/README.md @@ -229,7 +229,37 @@ $ helm install bitnami/fluentd \ --set aggregator.extraEnv[1].value=your-port-here \ ``` -## [Rolling VS Immutable tags](https://docs.bitnami.com/containers/how-to/understand-rolling-tags-containers/) +### Production configuration and horizontal scaling + +This chart includes a `values-production.yaml` file where you can find some parameters oriented to production configuration in comparison to the regular `values.yaml`. + +```console +$ helm install --name my-release -f ./values-production.yaml bitnami/fluentd +``` + +- Number of aggregator nodes: +```diff +- statefulset.replicaCount: 1 ++ statefulset.replicaCount: 2 +``` + +- Enable prometheus to access fluentd metrics endpoint: +```diff +- metrics.enabled: false ++ metrics.enabled: true +``` + +To horizontally scale this chart once it has been deployed: + +```console +$ helm upgrade my-release bitnami/fluentd \ + -f ./values-production.yaml \ + --set statefulset.replicaCount=3 +``` + +> **Note**: Scaling the statefulset with `kubectl scale ...` command is discouraged. Use `helm upgrade ...` for horizontal scaling to ensure the forwarders configuration is refreshed and aware of the new pods. + +### [Rolling VS Immutable tags](https://docs.bitnami.com/containers/how-to/understand-rolling-tags-containers/) It is strongly recommended to use immutable tags in a production environment. This ensures your deployment does not change automatically if the same tag is updated with a different image. diff --git a/bitnami/fluentd/templates/_helpers.tpl b/bitnami/fluentd/templates/_helpers.tpl index 479bc22ae..ce48d30f4 100644 --- a/bitnami/fluentd/templates/_helpers.tpl +++ b/bitnami/fluentd/templates/_helpers.tpl @@ -160,6 +160,6 @@ Get the certificates secret name. {{- if .Values.tls.existingSecret -}} {{- printf "%s" (tpl .Values.tls.existingSecret $) -}} {{- else -}} - {{- printf "%s-certs" (include "fluentd.fullname" . ) -}} + {{- printf "%s-tls" (include "fluentd.fullname" . ) -}} {{- end -}} {{- end -}} diff --git a/bitnami/fluentd/templates/aggregator-statefulset.yaml b/bitnami/fluentd/templates/aggregator-statefulset.yaml index d28a090a5..40f33fdbb 100644 --- a/bitnami/fluentd/templates/aggregator-statefulset.yaml +++ b/bitnami/fluentd/templates/aggregator-statefulset.yaml @@ -80,21 +80,19 @@ spec: - name: buffer mountPath: /opt/bitnami/fluentd/logs/buffers {{- if .Values.tls.enabled }} - - name: {{ template "fluentd.fullname" . }}-certs + - name: certs mountPath: /opt/bitnami/fluentd/certs {{- end }} volumes: {{- if .Values.tls.enabled }} - - name: {{ template "fluentd.fullname" . }}-certs + - name: certs secret: secretName: {{ template "fluentd.tls.secretName" . }} items: - - key: ca_certificate.pem - path: ca_certificate.pem - - key: server_certificate.pem - path: server_certificate.pem - - key: server_key.pem - path: server_key.pem + - key: tls.crt + path: tls.crt + - key: tls.key + path: tls.key {{- end }} - name: fluentd-config configMap: diff --git a/bitnami/fluentd/templates/certs.yaml b/bitnami/fluentd/templates/certs.yaml deleted file mode 100644 index bd08ae891..000000000 --- a/bitnami/fluentd/templates/certs.yaml +++ /dev/null @@ -1,15 +0,0 @@ -{{- if and (not .Values.tls.existingSecret) ( .Values.tls.enabled) }} -apiVersion: v1 -kind: Secret -metadata: - name: {{ include "fluentd.fullname" . }}-certs - labels: {{- include "fluentd.labels" . | nindent 4 }} -type: Opaque -data: - ca_certificate.pem: - {{ required "A valid .Values.tls.caCertificate entry required!" .Values.tls.caCertificate | b64enc | quote }} - server_certificate.pem: - {{ required "A valid .Values.tls.serverCertificate entry required!" .Values.tls.serverCertificate| b64enc | quote }} - server_key.pem: - {{ required "A valid .Values.tls.serverKey entry required!" .Values.tls.serverKey | b64enc | quote }} -{{- end }} diff --git a/bitnami/fluentd/templates/forwarder-daemonset.yaml b/bitnami/fluentd/templates/forwarder-daemonset.yaml index 5c4d5c722..48e2f9bb0 100644 --- a/bitnami/fluentd/templates/forwarder-daemonset.yaml +++ b/bitnami/fluentd/templates/forwarder-daemonset.yaml @@ -76,7 +76,7 @@ spec: - name: buffer mountPath: /opt/bitnami/fluentd/logs/buffers {{- if .Values.tls.enabled }} - - name: {{ template "fluentd.fullname" . }}-certs + - name: certs mountPath: /opt/bitnami/fluentd/certs {{- end }} - name: varlog @@ -85,16 +85,14 @@ spec: mountPath: /var/lib/docker/containers volumes: {{- if .Values.tls.enabled }} - - name: {{ template "fluentd.fullname" . }}-certs + - name: certs secret: secretName: {{ template "fluentd.tls.secretName" . }} items: - - key: ca_certificate.pem - path: ca_certificate.pem - - key: server_certificate.pem - path: server_certificate.pem - - key: server_key.pem - path: server_key.pem + - key: tls.crt + path: tls.crt + - key: tls.key + path: tls.key {{- end }} - name: fluentd-config configMap: diff --git a/bitnami/fluentd/templates/tls-certs.yaml b/bitnami/fluentd/templates/tls-certs.yaml new file mode 100644 index 000000000..f3db2d641 --- /dev/null +++ b/bitnami/fluentd/templates/tls-certs.yaml @@ -0,0 +1,13 @@ +{{- if and (not .Values.tls.existingSecret) ( .Values.tls.enabled) }} +apiVersion: v1 +kind: Secret +metadata: + name: {{ include "fluentd.fullname" . }}-tls + labels: {{- include "fluentd.labels" . | nindent 4 }} +type: kubernetes.io/tls +data: + tls.crt: + {{ required "A valid .Values.tls.certificate entry required!" .Values.tls.certificate | b64enc }} + tls.key: + {{ required "A valid .Values.tls.key entry required!" .Values.tls.key | b64enc }} +{{- end }} diff --git a/bitnami/fluentd/values-production.yaml b/bitnami/fluentd/values-production.yaml new file mode 100644 index 000000000..7a62b4333 --- /dev/null +++ b/bitnami/fluentd/values-production.yaml @@ -0,0 +1,256 @@ +## Global Docker image parameters +## Please, note that this will override the image parameters, including dependencies, configured to use the global value +## Current available global Docker image parameters: imageRegistry and imagePullSecrets +## +global: {} +# imageRegistry: myRegistryName +# imagePullSecrets: +# - myRegistryKeySecretName + +## Bitnami Fluentd image version +## ref: https://hub.docker.com/r/bitnami/fluentd/tags/ +## +image: + registry: docker.io + repository: bitnami/fluentd + tag: 1.7.2-debian-9-r8 + ## Specify a imagePullPolicy + ## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent' + ## ref: http://kubernetes.io/docs/user-guide/images/#pre-pulling-images + ## + pullPolicy: IfNotPresent + ## Optionally specify an array of imagePullSecrets. + ## Secrets must be manually created in the namespace. + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/ + ## + # pullSecrets: + # - myRegistryKeySecretName + +## String to partially override fluentd.fullname template (will maintain the release name) +## +# nameOverride: + +## String to fully override fluentd.fullname template +## +# fullnameOverride: + +## Cluster Domain +clusterDomain: cluster.local + +forwarder: + ## Name of the config file that will be used by Fluentd at launch + ## Fluentd will look for it under the /opt/bitnami/fluentd/conf directory + ## + configFile: fluentd.conf + + ## Name of the configMap that contains the configuration files for fluentd + ## If not specified, one will be created by default + # configMap: + + ## String with extra arguments for the Fluentd command line + ## ref: https://docs.fluentd.org/deployment/command-line-option + ## + extraArgs: "" + + ## Extra environment variables to pass to the container + ## extraEnv: + ## - name: MY_ENV_VAR + ## value: my_value + ## + extraEnv: {} + + ## Configure extra options for liveness and readiness probes + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-probes/#configure-probes) + ## + livenessProbe: + enabled: true + initialDelaySeconds: 60 + periodSeconds: 10 + timeoutSeconds: 5 + failureThreshold: 6 + successThreshold: 1 + readinessProbe: + enabled: true + initialDelaySeconds: 5 + periodSeconds: 10 + timeoutSeconds: 5 + failureThreshold: 6 + successThreshold: 1 + + ## Set up update strategy. + ## ref: https://kubernetes.io/docs/tasks/manage-daemon/update-daemon-set/#daemonset-update-strategy + ## Example: + # updateStrategy: + # type: RollingUpdate + # rollingUpdate: + # maxSurge: 25% + # maxUnavailable: 25% + updateStrategy: + type: RollingUpdate + + ## Configure resource requests and limits + ## ref: http://kubernetes.io/docs/user-guide/compute-resources/ + ## Example: + ## resources: + ## requests: + ## memory: 512Mi + ## cpu: 300m + ## + # resources: + + ## Node labels for pod assignment + ## Ref: https://kubernetes.io/docs/user-guide/node-selection/ + ## + nodeSelector: {} + + ## Tolerations for pod assignment + ## Ref: https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/ + ## + tolerations: [] + + ## Affinity for pod assignment + ## Ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity + ## + affinity: {} + + ## Pod annotations + ## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/ + ## + podAnnotations: {} + +aggregator: + ## Number of aggregator replicas + ## + replicaCount: 2 + + ## Name of the config file that will be used by Fluentd at launch + ## Fluentd will look for it under the /opt/bitnami/fluentd/conf directory + ## + configFile: fluentd.conf + + ## Name of the configMap that contains the configuration files for fluentd + ## If not specified, one will be created by default + # configMap: + + ## Port which the forwarders will connect to to send the logs + ## + port: 24224 + + ## String with extra arguments for the Fluentd command line + ## ref: https://docs.fluentd.org/deployment/command-line-option + ## + extraArgs: "" + + ## Extra environment variables to pass to the container + ## extraEnv: + ## - name: MY_ENV_VAR + ## - value: my_value + ## + extraEnv: {} + + ## Configure extra options for liveness and readiness probes + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-probes/#configure-probes) + ## + livenessProbe: + enabled: true + initialDelaySeconds: 60 + periodSeconds: 10 + timeoutSeconds: 5 + failureThreshold: 6 + successThreshold: 1 + readinessProbe: + enabled: true + initialDelaySeconds: 5 + periodSeconds: 10 + timeoutSeconds: 5 + failureThreshold: 6 + successThreshold: 1 + + ## Set up update strategy. + ## ref: https://kubernetes.io/docs/tutorials/stateful-application/basic-stateful-set/#updating-statefulsets + ## Example: + # updateStrategy: + # type: RollingUpdate + # rollingUpdate: + # maxSurge: 25% + # maxUnavailable: 25% + updateStrategy: + type: RollingUpdate + + ## Configure resource requests and limits + ## ref: http://kubernetes.io/docs/user-guide/compute-resources/ + ## Example: + ## resources: + ## requests: + ## memory: 512Mi + ## cpu: 300m + ## + # resources: + + ## Node labels for pod assignment + ## Ref: https://kubernetes.io/docs/user-guide/node-selection/ + ## + nodeSelector: {} + + ## Tolerations for pod assignment + ## Ref: https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/ + ## + tolerations: [] + + ## Affinity for pod assignment + ## Ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity + ## + affinity: {} + + ## Pod annotations + ## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/ + ## + podAnnotations: {} + +## Pods Service Account +## ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/ +## +serviceAccount: + ## Specifies whether a ServiceAccount should be created + ## + create: true + ## The name of the ServiceAccount to use. + ## If not set and create is true, a name is generated using the fluentd.fullname template + # name: + +## Role Based Access +## ref: https://kubernetes.io/docs/admin/authorization/rbac/ +## +rbac: + create: true + +## Prometheus metrics +## ref: https://github.com/fluent/fluent-plugin-prometheus/blob/master/README.md +## +metrics: + enabled: true + service: + type: ClusterIP + # loadBalancerIP: + port: 24231 + ## Annotations for the Prometheus metrics service + ## + annotations: + prometheus.io/scrape: "true" + prometheus.io/port: "24231" + prometheus.io/path: "/metrics" + +## Mount TLS certificates +## +tls: + enabled: false + certificate: |- + key: |- + # existingSecret: name-of-existing-secret-to-certificates + +## SecurityContext configuration +## +securityContext: + enabled: true + runAsUser: 1001 + fsGroup: 1001 diff --git a/bitnami/fluentd/values.yaml b/bitnami/fluentd/values.yaml index f4d17ba3f..2b05379da 100644 --- a/bitnami/fluentd/values.yaml +++ b/bitnami/fluentd/values.yaml @@ -121,7 +121,7 @@ forwarder: aggregator: ## Number of aggregator replicas ## - replicaCount: 2 + replicaCount: 1 ## Name of the config file that will be used by Fluentd at launch ## Fluentd will look for it under the /opt/bitnami/fluentd/conf directory @@ -244,9 +244,8 @@ metrics: ## tls: enabled: false - caCertificate: |- - serverCertificate: |- - serverKey: |- + certificate: |- + key: |- # existingSecret: name-of-existing-secret-to-certificates ## SecurityContext configuration