otelcollector/deploy/addon-chart/azure-monitor-metrics-addon/templates/ama-metrics-deployment.yaml (390 lines of code) (raw):
{{- $arcExtensionSettings := include "arc-extension-settings" . | fromYaml }}
apiVersion: apps/v1
kind: Deployment
metadata:
name: ama-metrics
namespace: kube-system
labels:
component: ama-metrics
kubernetes.azure.com/managedby: aks
spec:
# New TargetAllocator Enabled scenario
{{- if .Values.AzureMonitorMetrics.TargetAllocatorEnabled }}
{{- if $arcExtensionSettings.hpaEnabled }} # If HPA toggle is enabled, allow HPA to modify the deployment spec
{{- $currentSpec := (lookup "apps/v1" "Deployment" "kube-system" "ama-metrics").spec }}
{{- if $currentSpec }}
# in if check
replicas: {{ $currentSpec.replicas }}
{{- else}} # If current spec cannot be found, set to default
replicas: 2
{{- end }}
{{- else }} # HPA is not enabled, set the replicas via helm adapter values
replicas: {{ .Values.AzureMonitorMetrics.DeploymentReplicas }}
{{- end }}
{{- else }} # Legacy with no TargetAllocator Enabled
replicas: 1
{{- end }}
revisionHistoryLimit: 2
paused: false
selector:
matchLabels:
rsName: ama-metrics
strategy:
type: RollingUpdate
template:
metadata:
labels:
rsName: ama-metrics
kubernetes.azure.com/managedby: aks
annotations:
agentVersion: "0.0.0.1"
schema-versions: "v1"
cluster-autoscaler.kubernetes.io/safe-to-evict: "true"
spec:
priorityClassName: system-node-critical
serviceAccountName: ama-metrics-serviceaccount
containers:
- name: prometheus-collector
image: "{{ .Values.AzureMonitorMetrics.ImageRegistry }}{{ .Values.AzureMonitorMetrics.ImageRepository }}:{{ .Values.AzureMonitorMetrics.ImageTag }}"
imagePullPolicy: IfNotPresent
resources:
limits:
cpu: {{ .Values.AzureMonitorMetrics.RsCPULimit }}
memory: {{ .Values.AzureMonitorMetrics.RsMemoryLimit }}
requests:
cpu: {{ .Values.AzureMonitorMetrics.RsCPURequest }}
memory: {{ .Values.AzureMonitorMetrics.RsMemoryRequest }}
{{- if $arcExtensionSettings.isProxyEnabled }}
envFrom:
- secretRef:
name: ama-metrics-proxy-config
optional: true
{{- end }}
env:
- name: CLUSTER
{{- if $arcExtensionSettings.isArcExtension }}
value: "{{ $arcExtensionSettings.resourceId }}"
{{- else }}
value: "{{ .Values.global.commonGlobals.Customer.AzureResourceID }}"
{{- end }}
- name: AKSREGION
{{- if $arcExtensionSettings.isArcExtension }}
value: "{{ $arcExtensionSettings.region }}"
{{- else }}
value: "{{ .Values.global.commonGlobals.Region }}"
{{- end }}
- name: MAC
value: "true"
- name: AZMON_COLLECT_ENV
value: "false"
- name: AZMON_OPERATOR_ENABLED
{{- if $arcExtensionSettings.operatorEnabled }}
value: "true"
{{- else }}
value: "false"
{{- end }}
- name: AZMON_COLLECTOR_HPA_ENABLED
{{- if $arcExtensionSettings.hpaEnabled }}
value: "true"
{{- else }}
value: "false"
{{- end }}
- name: customEnvironment
{{- if .Values.AzureMonitorMetrics.isArcACluster }}
value: "arcautonomous"
{{- else if $arcExtensionSettings.isArcExtension }}
value: "{{ $arcExtensionSettings.cloudEnvironment }}"
{{- else }}
value: "{{ lower .Values.global.commonGlobals.CloudEnvironment }}"
{{- end }}
- name: OMS_TLD
value: "opinsights.azure.com"
{{- if .Values.AzureMonitorMetrics.isArcACluster }}
- name: customRegionalEndpoint
value: {{ required "customRegionalEndpoint is required in Arc Autonomous" .Values.AzureMonitorMetrics.arcAutonomousSettings.customRegionalEndpoint | toString | trim | quote }}
- name: customGlobalEndpoint
value: {{ required "customGlobalEndpoint is required in Arc Autonomous" .Values.AzureMonitorMetrics.arcAutonomousSettings.customGlobalEndpoint | toString | trim | quote }}
- name: customResourceEndpoint
value: {{ required "customResourceEndpoint is required in Arc Autonomous" .Values.AzureMonitorMetrics.arcAutonomousSettings.customResourceEndpoint | toString | trim | quote }}
{{- end }}
- name: CONTROLLER_TYPE
value: "ReplicaSet"
- name: NODE_IP
valueFrom:
fieldRef:
fieldPath: status.hostIP
- name: NODE_NAME
valueFrom:
fieldRef:
fieldPath: spec.nodeName
- name: POD_NAME
valueFrom:
fieldRef:
fieldPath: metadata.name
- name: POD_NAMESPACE
valueFrom:
fieldRef:
fieldPath: metadata.namespace
- name: CONTAINER_CPU_LIMIT
valueFrom:
resourceFieldRef:
containerName: prometheus-collector
resource: limits.cpu
divisor: 1m
- name: CONTAINER_MEMORY_LIMIT
valueFrom:
resourceFieldRef:
containerName: prometheus-collector
resource: limits.memory
divisor: 1Mi
- name: KUBE_STATE_NAME
value: ama-metrics-ksm
- name: NODE_EXPORTER_NAME
value: "" # Replace this with the node exporter shipped out of box with AKS
- name: NODE_EXPORTER_TARGETPORT
{{- if $arcExtensionSettings.isArcExtension }}
value: "{{ $arcExtensionSettings.nodeExporterTargetPort }}"
{{- else }}
value: "19100"
{{- end }}
{{- if .Values.AzureMonitorMetrics }}
{{- if .Values.AzureMonitorMetrics.KubeStateMetrics }}
- name: KUBE_STATE_VERSION
value: "{{ .Values.AzureMonitorMetrics.KubeStateMetrics.ImageRegistry }}{{ .Values.AzureMonitorMetrics.KubeStateMetrics.ImageRepository }}:{{ .Values.AzureMonitorMetrics.KubeStateMetrics.ImageTag }}"
{{- if .Values.AzureMonitorMetrics.KubeStateMetrics.MetricLabelsAllowlist }}
- name: KUBE_STATE_METRIC_LABELS_ALLOWLIST
value: "{{ .Values.AzureMonitorMetrics.KubeStateMetrics.MetricLabelsAllowlist }}"
{{- end }}
{{- if .Values.AzureMonitorMetrics.KubeStateMetrics.MetricAnnotationsAllowList }}
- name: KUBE_STATE_METRIC_ANNOTATIONS_ALLOWLIST
value: "{{ .Values.AzureMonitorMetrics.KubeStateMetrics.MetricAnnotationsAllowList }}"
{{- end }}
{{- end }}
{{- end }}
{{- if .Values.AzureMonitorMetrics }}
{{- if .Values.AzureMonitorMetrics.TargetAllocatorEnabled }}
- name: OPERATOR_TARGETS_TA_IMG_VERSION
value: "{{ .Values.AzureMonitorMetrics.ImageTagTargetAllocator }}"
- name: OPERATOR_TARGETS_CFG_READER_IMG_VERSION
value: "{{ .Values.AzureMonitorMetrics.ImageTagCfgReader }}"
{{- end }}
{{- end }}
- name: NODE_EXPORTER_VERSION
value: "{{ $arcExtensionSettings.nodeExporterVersion }}"
- name: AGENT_VERSION
value: {{ .Values.AzureMonitorMetrics.ImageTag }}
- name: MODE
value: "advanced" # only supported mode is 'advanced', any other value will be the default/non-advance mode
- name: WINMODE
value: "advanced" # WINDOWS: only supported mode is 'advanced', any other value will be the default/non-advance mode
- name: MINIMAL_INGESTION_PROFILE
value: "true" # only supported value is the string "true"
{{- if $arcExtensionSettings.isArcExtension }} # Env vars for telemetry purposes
- name: IS_ARC_EXTENSION
value: "true"
- name: ARC_DISTRIBUTION
value: "{{ $arcExtensionSettings.distribution }}"
- name: MOUNT_MARINER_CERTS
value: "{{ $arcExtensionSettings.mountMarinerCerts }}"
- name: MOUNT_UBUNTU_CERTS
value: "{{ $arcExtensionSettings.mountUbuntuCerts }}"
{{- end }}
securityContext:
privileged: false
capabilities:
drop:
- ALL
add:
- DAC_OVERRIDE
volumeMounts:
- mountPath: /etc/config/settings
name: settings-vol-config
readOnly: true
- mountPath: /etc/prometheus/certs
name: ama-metrics-tls-secret-volume
readOnly: true
- mountPath: /etc/config/settings/prometheus
name: prometheus-config-vol
readOnly: true
- name: host-log-containers
readOnly: true
mountPath: /var/log/containers
- name: host-log-pods
readOnly: true
mountPath: /var/log/pods
{{- if $arcExtensionSettings.mountMarinerCerts }}
- mountPath: /anchors/mariner
name: anchors-mariner
readOnly: true
{{- end }}
{{- if $arcExtensionSettings.mountUbuntuCerts }}
- mountPath: /anchors/ubuntu
name: anchors-ubuntu
readOnly: true
{{- end }}
{{- if $arcExtensionSettings.isArcExtension }}
- mountPath: /anchors/proxy
name: ama-metrics-proxy-cert
readOnly: true
{{- end }}
livenessProbe:
httpGet:
path: /health
port: 8080
initialDelaySeconds: 60
periodSeconds: 15
timeoutSeconds: 5
failureThreshold: 3
{{- if $arcExtensionSettings.isArcExtension }}
- name: arc-msi-adapter
imagePullPolicy: IfNotPresent
env:
- name: TOKEN_NAMESPACE
value: "azure-arc"
- name: LIVENESS_PROBE_PORT
value: "9999"
{{- .Values.Azure.Identity.MSIAdapterYaml | nindent 10 }}
{{- else }}
- name: addon-token-adapter
command:
- /addon-token-adapter
args:
- --secret-namespace=kube-system
- --secret-name=aad-msi-auth-token
- --token-server-listening-port=7777
- --health-server-listening-port=9999
image: "{{ .Values.AzureMonitorMetrics.AddonTokenAdapter.ImageRegistry }}{{ .Values.AzureMonitorMetrics.AddonTokenAdapter.ImageRepository }}:{{ .Values.AzureMonitorMetrics.AddonTokenAdapter.ImageTag }}"
imagePullPolicy: IfNotPresent
env:
- name: AZMON_COLLECT_ENV
value: "false"
livenessProbe:
httpGet:
path: /healthz
port: 9999
initialDelaySeconds: 10
periodSeconds: 60
resources:
limits:
cpu: 500m
memory: 500Mi
requests:
cpu: 20m
memory: 30Mi
securityContext:
capabilities:
drop:
- ALL
add:
- NET_ADMIN
- NET_RAW
{{- end }}
affinity:
nodeAffinity:
# affinity to schedule on to ephemeral os node if its available
preferredDuringSchedulingIgnoredDuringExecution:
- weight: 100
preference:
matchExpressions:
- key: kubernetes.azure.com/mode
operator: In
values:
- system
- weight: 50
preference:
matchExpressions:
- key: azuremonitor/metrics.replica.preferred
operator: In
values:
- "true"
requiredDuringSchedulingIgnoredDuringExecution:
nodeSelectorTerms:
- matchExpressions:
- key: kubernetes.io/os
operator: In
values:
- linux
- key: type
operator: NotIn
values:
- virtual-kubelet
{{- if not $arcExtensionSettings.isArcExtension }}
- key: kubernetes.azure.com/cluster
operator: Exists
{{- end }}
topologySpreadConstraints:
- maxSkew: 1
topologyKey: kubernetes.io/hostname
whenUnsatisfiable: ScheduleAnyway
labelSelector:
matchLabels:
rsName: ama-metrics
- maxSkew: 1
topologyKey: topology.kubernetes.io/zone
whenUnsatisfiable: ScheduleAnyway
labelSelector:
matchLabels:
rsName: ama-metrics
tolerations:
- key: CriticalAddonsOnly
operator: Exists
{{- if eq (default .Values.tolerationsOnlyForControlPlane false) false }}
- operator: "Exists"
effect: "NoSchedule"
- operator: "Exists"
effect: "NoExecute"
- operator: "Exists"
effect: "PreferNoSchedule"
{{- end }}
- key: "node-role.kubernetes.io/control-plane"
operator: "Exists"
effect: "NoSchedule"
- key: "node-role.kubernetes.io/control-plane"
operator: "Exists"
effect: "NoExecute"
- key: "node-role.kubernetes.io/control-plane"
operator: "Exists"
effect: "PreferNoSchedule"
- key: "node-role.kubernetes.io/master"
operator: "Exists"
effect: "NoSchedule"
- key: "node-role.kubernetes.io/master"
operator: "Exists"
effect: "NoExecute"
- key: "node-role.kubernetes.io/master"
operator: "Exists"
effect: "PreferNoSchedule"
volumes:
- name: settings-vol-config
configMap:
name: ama-metrics-settings-configmap
optional: true
- name: prometheus-config-vol
configMap:
name: ama-metrics-prometheus-config
optional: true
- name: host-log-containers
hostPath:
path: /var/log/containers
- name: host-log-pods
hostPath:
path: /var/log/pods
{{- if $arcExtensionSettings.mountMarinerCerts }}
- name: anchors-mariner
hostPath:
path: /etc/pki/ca-trust/source/anchors/
type: DirectoryOrCreate
{{- end }}
- name: ama-metrics-tls-secret-volume
secret:
secretName: ama-metrics-mtls-secret
optional: true
{{- if $arcExtensionSettings.mountUbuntuCerts }}
- name: anchors-ubuntu
hostPath:
path: /usr/local/share/ca-certificates/
type: DirectoryOrCreate
{{- end }}
{{- if $arcExtensionSettings.isArcExtension }}
- name: ama-metrics-proxy-cert
secret:
secretName: ama-metrics-proxy-cert
optional: true
{{- end }}