initial commit
This commit is contained in:
allard
268
dev/elasticsearch-kibana/agent/elastic-agent-managed-kubernetes.yaml
Executable file
268
dev/elasticsearch-kibana/agent/elastic-agent-managed-kubernetes.yaml
Executable file
@@ -0,0 +1,268 @@
|
||||
# For more information refer to https://www.elastic.co/guide/en/fleet/current/running-on-kubernetes-managed-by-fleet.html
|
||||
apiVersion: apps/v1
|
||||
kind: DaemonSet
|
||||
metadata:
|
||||
name: elastic-agent
|
||||
namespace: kube-system
|
||||
labels:
|
||||
app: elastic-agent
|
||||
spec:
|
||||
selector:
|
||||
matchLabels:
|
||||
app: elastic-agent
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: elastic-agent
|
||||
spec:
|
||||
# Tolerations are needed to run Elastic Agent on Kubernetes control-plane nodes.
|
||||
# Agents running on control-plane nodes collect metrics from the control plane components (scheduler, controller manager) of Kubernetes
|
||||
tolerations:
|
||||
- key: node-role.kubernetes.io/control-plane
|
||||
effect: NoSchedule
|
||||
- key: node-role.kubernetes.io/master
|
||||
effect: NoSchedule
|
||||
serviceAccountName: elastic-agent
|
||||
hostNetwork: true
|
||||
# 'hostPID: true' enables the Elastic Security integration to observe all process exec events on the host.
|
||||
# Sharing the host process ID namespace gives visibility of all processes running on the same host.
|
||||
hostPID: true
|
||||
dnsPolicy: ClusterFirstWithHostNet
|
||||
containers:
|
||||
- name: elastic-agent
|
||||
image: docker.elastic.co/beats/elastic-agent:8.5.3
|
||||
env:
|
||||
# Set to 1 for enrollment into Fleet server. If not set, Elastic Agent is run in standalone mode
|
||||
- name: FLEET_ENROLL
|
||||
value: "1"
|
||||
# Set to true to communicate with Fleet with either insecure HTTP or unverified HTTPS
|
||||
- name: FLEET_INSECURE
|
||||
value: "true"
|
||||
# Fleet Server URL to enroll the Elastic Agent into
|
||||
# FLEET_URL can be found in Kibana, go to Management > Fleet > Settings
|
||||
- name: FLEET_URL
|
||||
value: "https://fleet-server:8220"
|
||||
# Elasticsearch API key used to enroll Elastic Agents in Fleet (https://www.elastic.co/guide/en/fleet/current/fleet-enrollment-tokens.html#fleet-enrollment-tokens)
|
||||
# If FLEET_ENROLLMENT_TOKEN is empty then KIBANA_HOST, KIBANA_FLEET_USERNAME, KIBANA_FLEET_PASSWORD are needed
|
||||
- name: FLEET_ENROLLMENT_TOKEN
|
||||
value: "token-id"
|
||||
- name: KIBANA_HOST
|
||||
value: "http://kibana:5601"
|
||||
# The basic authentication username used to connect to Kibana and retrieve a service_token to enable Fleet
|
||||
- name: KIBANA_FLEET_USERNAME
|
||||
value: "elastic"
|
||||
# The basic authentication password used to connect to Kibana and retrieve a service_token to enable Fleet
|
||||
- name: KIBANA_FLEET_PASSWORD
|
||||
value: "changeme"
|
||||
- name: NODE_NAME
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: spec.nodeName
|
||||
- name: POD_NAME
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: metadata.name
|
||||
securityContext:
|
||||
runAsUser: 0
|
||||
resources:
|
||||
limits:
|
||||
memory: 500Mi
|
||||
requests:
|
||||
cpu: 100m
|
||||
memory: 200Mi
|
||||
volumeMounts:
|
||||
- name: proc
|
||||
mountPath: /hostfs/proc
|
||||
readOnly: true
|
||||
- name: cgroup
|
||||
mountPath: /hostfs/sys/fs/cgroup
|
||||
readOnly: true
|
||||
- name: varlibdockercontainers
|
||||
mountPath: /var/lib/docker/containers
|
||||
readOnly: true
|
||||
- name: varlog
|
||||
mountPath: /var/log
|
||||
readOnly: true
|
||||
- name: etc-full
|
||||
mountPath: /hostfs/etc
|
||||
readOnly: true
|
||||
- name: var-lib
|
||||
mountPath: /hostfs/var/lib
|
||||
readOnly: true
|
||||
- name: etc-mid
|
||||
mountPath: /etc/machine-id
|
||||
readOnly: true
|
||||
volumes:
|
||||
- name: proc
|
||||
hostPath:
|
||||
path: /proc
|
||||
- name: cgroup
|
||||
hostPath:
|
||||
path: /sys/fs/cgroup
|
||||
- name: varlibdockercontainers
|
||||
hostPath:
|
||||
path: /var/lib/docker/containers
|
||||
- name: varlog
|
||||
hostPath:
|
||||
path: /var/log
|
||||
# The following volumes are needed for Cloud Security Posture integration (cloudbeat)
|
||||
# If you are not using this integration, then these volumes and the corresponding
|
||||
# mounts can be removed.
|
||||
- name: etc-full
|
||||
hostPath:
|
||||
path: /etc
|
||||
- name: var-lib
|
||||
hostPath:
|
||||
path: /var/lib
|
||||
# Mount /etc/machine-id from the host to determine host ID
|
||||
# Needed for Elastic Security integration
|
||||
- name: etc-mid
|
||||
hostPath:
|
||||
path: /etc/machine-id
|
||||
type: File
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
name: elastic-agent
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: elastic-agent
|
||||
namespace: kube-system
|
||||
roleRef:
|
||||
kind: ClusterRole
|
||||
name: elastic-agent
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: RoleBinding
|
||||
metadata:
|
||||
namespace: kube-system
|
||||
name: elastic-agent
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: elastic-agent
|
||||
namespace: kube-system
|
||||
roleRef:
|
||||
kind: Role
|
||||
name: elastic-agent
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: RoleBinding
|
||||
metadata:
|
||||
name: elastic-agent-kubeadm-config
|
||||
namespace: kube-system
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: elastic-agent
|
||||
namespace: kube-system
|
||||
roleRef:
|
||||
kind: Role
|
||||
name: elastic-agent-kubeadm-config
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: elastic-agent
|
||||
labels:
|
||||
k8s-app: elastic-agent
|
||||
rules:
|
||||
- apiGroups: [""]
|
||||
resources:
|
||||
- nodes
|
||||
- namespaces
|
||||
- events
|
||||
- pods
|
||||
- services
|
||||
- configmaps
|
||||
# Needed for cloudbeat
|
||||
- serviceaccounts
|
||||
- persistentvolumes
|
||||
- persistentvolumeclaims
|
||||
verbs: ["get", "list", "watch"]
|
||||
# Enable this rule only if planing to use kubernetes_secrets provider
|
||||
#- apiGroups: [""]
|
||||
# resources:
|
||||
# - secrets
|
||||
# verbs: ["get"]
|
||||
- apiGroups: ["extensions"]
|
||||
resources:
|
||||
- replicasets
|
||||
verbs: ["get", "list", "watch"]
|
||||
- apiGroups: ["apps"]
|
||||
resources:
|
||||
- statefulsets
|
||||
- deployments
|
||||
- replicasets
|
||||
- daemonsets
|
||||
verbs: ["get", "list", "watch"]
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- nodes/stats
|
||||
verbs:
|
||||
- get
|
||||
- apiGroups: [ "batch" ]
|
||||
resources:
|
||||
- jobs
|
||||
- cronjobs
|
||||
verbs: [ "get", "list", "watch" ]
|
||||
# Needed for apiserver
|
||||
- nonResourceURLs:
|
||||
- "/metrics"
|
||||
verbs:
|
||||
- get
|
||||
# Needed for cloudbeat
|
||||
- apiGroups: ["rbac.authorization.k8s.io"]
|
||||
resources:
|
||||
- clusterrolebindings
|
||||
- clusterroles
|
||||
- rolebindings
|
||||
- roles
|
||||
verbs: ["get", "list", "watch"]
|
||||
# Needed for cloudbeat
|
||||
- apiGroups: ["policy"]
|
||||
resources:
|
||||
- podsecuritypolicies
|
||||
verbs: ["get", "list", "watch"]
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: Role
|
||||
metadata:
|
||||
name: elastic-agent
|
||||
# Should be the namespace where elastic-agent is running
|
||||
namespace: kube-system
|
||||
labels:
|
||||
k8s-app: elastic-agent
|
||||
rules:
|
||||
- apiGroups:
|
||||
- coordination.k8s.io
|
||||
resources:
|
||||
- leases
|
||||
verbs: ["get", "create", "update"]
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: Role
|
||||
metadata:
|
||||
name: elastic-agent-kubeadm-config
|
||||
namespace: kube-system
|
||||
labels:
|
||||
k8s-app: elastic-agent
|
||||
rules:
|
||||
- apiGroups: [""]
|
||||
resources:
|
||||
- configmaps
|
||||
resourceNames:
|
||||
- kubeadm-config
|
||||
verbs: ["get"]
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: elastic-agent
|
||||
namespace: kube-system
|
||||
labels:
|
||||
k8s-app: elastic-agent
|
||||
---
|
||||
Reference in New Issue
Block a user