Merge pull request #12 from j-fuentes/installation-guide

jetstack-bot · web-flow · commit 49adbe480bd8 · 2019-12-05T13:46:37.000Z
In-cluster installation guide
diff --git a/.gitignore b/.gitignore
@@ -3,4 +3,7 @@
 /builds
 /bundles
 /output
-credentials.json
+credentials.json
+.terraform
+terraform.tfstate
+terraform.tfstate.backup
diff --git a/README.md b/README.md
@@ -9,8 +9,8 @@ Preflight is a tool to automatically perform Kubernetes cluster configuration ch
     - [Background](#background)
     - [Preflight Packages](#preflight-packages)
     - [Install Preflight](#install-preflight)
-    - [Use Preflight locally](#use-preflight-locally)
-    - [Get periodic reports by running Preflight as a CronJob](#get-periodic-reports-by-running-preflight-as-a-cronjob)
+        - [Use Preflight locally](#use-preflight-locally)
+        - [Get periodic reports by running Preflight as a CronJob](#get-periodic-reports-by-running-preflight-as-a-cronjob)
 
 <!-- markdown-toc end -->
 
@@ -53,10 +53,9 @@ preflight package lint <path to package>
 
 ## Install Preflight
 
-You can compile Preflight by running `make build`. It will create the binary in `builds/preflight`.
-
+### Use Preflight locally
 
-## Use Preflight locally
+You can compile Preflight by running `make build`. It will create the binary in `builds/preflight`.
 
 Create your `preflight.yaml` configuration file (you can take inspiration from the ones in `./examples`).
 
@@ -78,6 +77,6 @@ If you want to visualice the report in your browser, you can access [preflight.j
 
 You can give it a try without even running the tool, since we provide some report examples ([gke.json](./examples/reports/gke.json), [pods.json](./examples/reports/pods.json)) ready to be loaded in [preflight.jetstack.io](https://preflight.jetstack.io/).
 
-## Get periodic reports by running Preflight as a CronJob
+### Get periodic reports by running Preflight as a CronJob
 
-See [Run Preflight In-Cluster](./docs/preflight-in-cluster.md).
+See [Installation Manual: Preflight In-Cluster](./docs/installation_manual_in_cluster.md).
diff --git a/deployment/kubernetes/base/00-rbac.yaml b/deployment/kubernetes/base/00-rbac.yaml
@@ -45,8 +45,7 @@ spec:
 apiVersion: v1
 kind: ServiceAccount
 metadata:
-  namespace: preflight
-  name: preflight
+  name: preflight-scanner
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
@@ -66,11 +65,9 @@ apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
 metadata:
   name: preflight-list-pods-global
-  namespace: preflight
 subjects:
 - kind: ServiceAccount
-  name: preflight
-  namespace: preflight
+  name: preflight-scanner
 roleRef:
   kind: ClusterRole
   name: list-pods-global
diff --git a/deployment/kubernetes/base/01-cronjob.yaml b/deployment/kubernetes/base/01-cronjob.yaml
@@ -18,11 +18,11 @@ spec:
     spec:
       template:
         spec:
-          serviceAccountName: preflight
+          serviceAccountName: preflight-scanner
           restartPolicy: Never
           containers:
           - name: preflight
-            image: jetstack/preflight:latest
+            image: quay.io/jetstack/preflight
             imagePullPolicy: Always
             resources:
               requests:
diff --git a/deployment/kubernetes/base/kustomization.yaml b/deployment/kubernetes/base/kustomization.yaml
@@ -1,4 +1,3 @@
 resources:
-- 00-namespace.yaml
-- 01-rbac.yaml
-- 02-cronjob.yaml
+- 00-rbac.yaml
+- 01-cronjob.yaml
diff --git a/deployment/kubernetes/overlays/.gitignore b/deployment/kubernetes/overlays/.gitignore
diff --git a/deployment/kubernetes/overlays/sample/kustomization.yaml b/deployment/kubernetes/overlays/sample/kustomization.yaml
diff --git a/deployment/kubernetes/overlays/sample/preflight.yaml b/deployment/kubernetes/overlays/sample/preflight.yaml
diff --git a/deployment/kubernetes/overlays/scanner/.gitignore b/deployment/kubernetes/overlays/scanner/.gitignore
@@ -0,0 +1,2 @@
+/secrets/*
+!/secrets/.keep
diff --git a/deployment/kubernetes/overlays/scanner/cluster-role-binding-namespace.yaml b/deployment/kubernetes/overlays/scanner/cluster-role-binding-namespace.yaml
@@ -0,0 +1,9 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: preflight-list-pods-global
+  namespace: preflight-scanner
+subjects:
+- kind: ServiceAccount
+  name: preflight-scanner
+  namespace: preflight-scanner
diff --git a/deployment/kubernetes/overlays/scanner/config/preflight.yaml b/deployment/kubernetes/overlays/scanner/config/preflight.yaml
@@ -0,0 +1,27 @@
+# this cluster-name is just used to mark the generated reports
+cluster-name: mycluster
+
+data-gatherers:
+  gke:
+    # change these properties to point to your GKE cluster
+    project: my-gcp-project
+    location: europe-west1-b
+    cluster: mycluster
+
+  k8s/pods:
+    kubeconfig: {}
+
+package-sources:
+- type: local
+  dir: /preflight-packages/
+
+enabled-packages:
+  - "examples.jetstack.io/gke_basic"
+  - "examples.jetstack.io/pods_basic"
+
+outputs:
+- type: gcs
+  format: json
+  # change this to your bucket
+  bucket-name: preflight-results
+  credentials-path: /var/run/secrets/preflight/credentials.json
diff --git a/deployment/kubernetes/overlays/scanner/image.yaml b/deployment/kubernetes/overlays/scanner/image.yaml
@@ -1,4 +1,3 @@
-# Change the CronJob to use a custom image
 apiVersion: batch/v1beta1
 kind: CronJob
 metadata:
@@ -10,5 +9,5 @@ spec:
         spec:
           containers:
           - name: preflight
-            # You can change this to use an image of your choice.
-            image: eu.gcr.io/jetstack-preflight/preflight-cli:latest
+            # you can change this to point to your image
+            image: quay.io/jetstack/preflight
diff --git a/deployment/kubernetes/overlays/scanner/kustomization.yaml b/deployment/kubernetes/overlays/scanner/kustomization.yaml
@@ -0,0 +1,20 @@
+bases:
+- ../../base
+namespace: preflight-scanner
+resources:
+- namespace.yaml
+configMapGenerator:
+- name: preflight-config
+  namespace: preflight-scanner
+  files:
+  - ./config/preflight.yaml
+secretGenerator:
+- name: gcs-credentials
+  namespace: preflight-scanner
+  files:
+  - ./secrets/credentials.json
+patchesStrategicMerge:
+- ./period.yaml
+- ./cluster-role-binding-namespace.yaml
+- ./workload-identity.yaml
+- ./image.yaml
diff --git a/deployment/kubernetes/overlays/scanner/namespace.yaml b/deployment/kubernetes/overlays/scanner/namespace.yaml
@@ -1,4 +1,4 @@
 apiVersion: v1
 kind: Namespace
 metadata:
-  name: preflight
+  name: preflight-scanner
diff --git a/deployment/kubernetes/overlays/scanner/period.yaml b/deployment/kubernetes/overlays/scanner/period.yaml
@@ -0,0 +1,7 @@
+apiVersion: batch/v1beta1
+kind: CronJob
+metadata:
+  name: preflight
+spec:
+  # every 30 minutes
+  schedule: "*/30 * * * *"
diff --git a/deployment/kubernetes/overlays/scanner/secrets/.keep b/deployment/kubernetes/overlays/scanner/secrets/.keep
diff --git a/deployment/kubernetes/overlays/scanner/workload-identity.yaml b/deployment/kubernetes/overlays/scanner/workload-identity.yaml
@@ -0,0 +1,10 @@
+# Use Workload Identity (https://cloud.google.com/kubernetes-engine/docs/how-to/workload-identity)
+# to allow the Preflight pod to query the Google Cloud API for information about GKE. This relies
+# on an out-of-cluster Google Cloud service account existing.
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: preflight-scanner
+  annotations:
+    # Example, replace with your Google cloud service account name
+    iam.gke.io/gcp-service-account: preflight-scanner@<project>.iam.gserviceaccount.com
diff --git a/deployment/terraform/gke-datagatherer/googlecloud-scanner-serviceaccount.tf b/deployment/terraform/gke-datagatherer/googlecloud-scanner-serviceaccount.tf
@@ -0,0 +1,35 @@
+# This creates a service account in GCP with the permissions that Preflight needs for the GKE data-gatherer.
+
+terraform {
+  required_version = "~> 0.12"
+}
+
+variable "scanner_gcp_project_id" {
+  type        = string
+  description = "The ID of the project where the cluster Preflight is going check is."
+}
+
+# https://www.terraform.io/docs/providers/google/index.html
+provider "google" {
+  version = "2.5.1"
+  project = var.scanner_gcp_project_id
+}
+
+resource "google_service_account" "preflight_scanner_service_account" {
+  account_id   = "preflight-scanner"
+  display_name = "Service account for getting cluster information with workload identity"
+  project = var.scanner_gcp_project_id
+}
+
+resource "google_project_iam_member" "preflight_scanner_cluster_viewer" {
+  project = var.scanner_gcp_project_id
+  role    = "roles/container.clusterViewer"
+  member  = "serviceAccount:${google_service_account.preflight_scanner_service_account.email}"
+}
+
+resource "google_project_iam_binding" "preflight_scanner_workload_identity" {
+  project = var.scanner_gcp_project_id
+  role    = "roles/iam.workloadIdentityUser"
+  members = ["serviceAccount:${var.scanner_gcp_project_id}.svc.id.goog[preflight-scanner/preflight-scanner]",
+    "serviceAccount:${google_service_account.preflight_scanner_service_account.email}"]
+}
diff --git a/deployment/terraform/results-bucket/googlecloud-reports-bucket-scanner-sa.tf b/deployment/terraform/results-bucket/googlecloud-reports-bucket-scanner-sa.tf
@@ -0,0 +1,24 @@
+# This creates the service account that Preflight scanner can use to push the reports to the bucket.
+
+resource "google_service_account" "preflight-scanner-reports-writer-sa" {
+  account_id   = "preflight-scanner-reports"
+  display_name = "Service account for Preflight to write the reports in the destination bucket"
+}
+
+resource "google_storage_bucket_iam_binding" "preflight-scanner-reports-writer-binding" {
+  bucket = var.reports_bucket_name
+  role   = "roles/storage.objectCreator"
+
+  members = [
+    "serviceAccount:${google_service_account.preflight-scanner-reports-writer-sa.email}"
+  ]
+}
+
+resource "google_service_account_key" "preflight-scanner-reports-writter-key" {
+  service_account_id = google_service_account.preflight-scanner-reports-writer-sa.name
+}
+
+resource "local_file" "preflight-scanner-reports-writter-key-file" {
+  sensitive_content = base64decode(google_service_account_key.preflight-scanner-reports-writter-key.private_key)
+  filename = "${path.module}/../../kubernetes/overlays/scanner/secrets/credentials.json"
+}
diff --git a/deployment/terraform/results-bucket/googlecloud-reports-bucket.tf b/deployment/terraform/results-bucket/googlecloud-reports-bucket.tf
@@ -0,0 +1,26 @@
+# This creates a bucket where to store the reports from Preflight.
+
+terraform {
+  required_version = "~> 0.12"
+}
+
+variable "reports_bucket_name" {
+  type = string
+  description = "The name of the bucket where to store the reports."
+}
+
+variable "reports_bucket_gcp_project_id" {
+  type        = string
+  description = "The ID of the project where the reports are going to be stored."
+}
+
+# https://www.terraform.io/docs/providers/google/index.html
+provider "google" {
+  version = "2.5.1"
+  project = var.reports_bucket_gcp_project_id
+}
+
+resource "google_storage_bucket" "report_store" {
+  name     = var.reports_bucket_name
+  location = "EU"
+}
diff --git a/docs/installation_manual_in_cluster.md b/docs/installation_manual_in_cluster.md
diff --git a/docs/preflight-in-cluster.md b/docs/preflight-in-cluster.md
