chore(monitor): update grafana dashboard,telegraf inputs.kubernetes

duanhongyi · duanhongyi · commit 293dcd5d9473 · 2020-08-14T15:55:20.000+08:00
diff --git a/charts/monitor/charts/grafana/templates/monitor-grafana-deployment.yaml b/charts/monitor/charts/grafana/templates/monitor-grafana-deployment.yaml
@@ -60,7 +60,7 @@ spec:
               key: password
         {{- else }}
         - name: "INFLUXDB_URLS"
-          value: http://$(DRYCC_MONITOR_INFLUXAPI_SERVICE_HOST):$(DRYCC_MONITOR_INFLUXAPI_SERVICE_PORT_TRANSPORT)
+          value: http://$(DRYCC_MONITOR_INFLUXDB_API_SERVICE_HOST):$(DRYCC_MONITOR_INFLUXDB_API_SERVICE_PORT_TRANSPORT)
         {{- end }}
         - name: "BIND_PORT"
           value: "3500"
diff --git a/charts/monitor/charts/influxdb/templates/monitor-influxdb-api-certificate.yaml b/charts/monitor/charts/influxdb/templates/monitor-influxdb-api-certificate.yaml
@@ -2,15 +2,15 @@
 apiVersion: cert-manager.io/v1alpha2
 kind: Certificate
 metadata:
-  name: drycc-monitor-influx-api
+  name: drycc-monitor-influxdb-api
   namespace: "{{ .Release.Namespace }}"
 spec:
-  secretName: drycc-monitor-influx-api-auto-tls
+  secretName: drycc-monitor-influxdb-api-auto-tls
   issuerRef:
     name: drycc-cluster-issuer
     kind: ClusterIssuer
   dnsNames:
-  - drycc-monitor-influx-api.{{ .Values.global.platform_domain }}
+  - drycc-monitor-influxdb-api.{{ .Values.global.platform_domain }}
   privateKey:
     rotationPolicy: Always
 {{- end }}
diff --git a/charts/monitor/charts/influxdb/templates/monitor-influxdb-api-ingress.yaml b/charts/monitor/charts/influxdb/templates/monitor-influxdb-api-ingress.yaml
@@ -2,9 +2,9 @@ apiVersion: networking.k8s.io/v1beta1
 kind: Ingress
 metadata:
   namespace: "{{ .Release.Namespace }}"
-  name: "drycc-monitor-influx-api-ingress"
+  name: "drycc-monitor-influxdb-api-ingress"
   labels:
-    app: "drycc-monitor-influx-api"
+    app: "drycc-monitor-influxdb-api"
     chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
     release: "{{ .Release.Name }}"
     heritage: "{{ .Release.Service }}"
@@ -15,7 +15,7 @@ metadata:
     {{ end }}
 spec:
   rules:
-  - host: drycc-monitor-influx-api.{{ .Values.global.platform_domain }}
+  - host: drycc-monitor-influxdb-api.{{ .Values.global.platform_domain }}
     http:
       paths:
       {{- if eq .Values.global.ingress_class "gce" "alb" }}
@@ -24,11 +24,11 @@ spec:
       - path: /
       {{- end }}
         backend:
-          serviceName: drycc-monitor-influx-api
+          serviceName: drycc-monitor-influxdb-api
           servicePort: 80
   {{ if .Values.global.cert_manager_enabled }}
   tls:
-    - secretName: drycc-monitor-influx-api-auto-tls
+    - secretName: drycc-monitor-influxdb-api-auto-tls
       hosts:
-        - drycc-monitor-influx-api.{{ .Values.global.platform_domain }}
+        - drycc-monitor-influxdb-api.{{ .Values.global.platform_domain }}
   {{- end }}
diff --git a/charts/monitor/charts/influxdb/templates/monitor-influxdb-api-svc.yaml b/charts/monitor/charts/influxdb/templates/monitor-influxdb-api-svc.yaml
@@ -2,10 +2,10 @@
 apiVersion: v1
 kind: Service
 metadata:
-  name: drycc-monitor-influx-api
+  name: drycc-monitor-influxdb-api
   labels:
     heritage: drycc
-    app: drycc-monitor-influx-api
+    app: drycc-monitor-influxdb-api
 spec:
   ports:
   - port: 80
diff --git a/charts/monitor/charts/telegraf/templates/monitor-telegraf-daemon.yaml b/charts/monitor/charts/telegraf/templates/monitor-telegraf-daemon.yaml
@@ -62,9 +62,9 @@ spec:
                 key: password
           {{- else }}
           - name: "INFLUXDB_URLS"
-            value: "\"http://$(DRYCC_MONITOR_INFLUXAPI_SERVICE_HOST):$(DRYCC_MONITOR_INFLUXAPI_SERVICE_PORT_TRANSPORT)\""
+            value: "\"http://$(DRYCC_MONITOR_INFLUXDB_API_SERVICE_HOST):$(DRYCC_MONITOR_INFLUXDB_API_SERVICE_PORT_TRANSPORT)\""
           - name: "INFLUXDB_INPUT_URLS"
-            value: "\"http://$(DRYCC_MONITOR_INFLUXAPI_SERVICE_HOST):$(DRYCC_MONITOR_INFLUXAPI_SERVICE_PORT_TRANSPORT)/debug/vars\""
+            value: "\"http://$(DRYCC_MONITOR_INFLUXDB_API_SERVICE_HOST):$(DRYCC_MONITOR_INFLUXDB_API_SERVICE_PORT_TRANSPORT)/debug/vars\""
           - name: "ENABLE_INFLUXDB_INPUT"
             value: "true"
           {{- end }}
diff --git a/charts/monitor/charts/telegraf/templates/monitor-telegraf-role.yaml b/charts/monitor/charts/telegraf/templates/monitor-telegraf-role.yaml
@@ -1,15 +1,32 @@
 {{- if (.Values.global.use_rbac) -}}
 {{- if (.Capabilities.APIVersions.Has (include "rbacAPIVersion" .)) -}}
-kind: Role
+kind: ClusterRole
 apiVersion: {{ template "rbacAPIVersion" . }}
 metadata:
-  name: drycc-monitor-telegraf
+  name: drycc:influx:stats:viewer
   labels:
+    rbac.authorization.k8s.io/aggregate-view-telegraf-stats: "true"
     app: drycc-monitor-telegraf
     heritage: drycc
 rules:
-- apiGroups: [""]
-  resources: ["pods"]
-  verbs: ["get"]
+  - apiGroups: ["metrics.k8s.io"]
+    resources: ["pods"]
+    verbs: ["get", "list", "watch"]
+  - apiGroups: [""]
+    resources: ["nodes/proxy", "nodes/stats"]
+    verbs: ["get", "list", "watch"]
+---
+# Define global role with the default system:aggregate-to-view cluster role and the two rules we just created
+kind: ClusterRole
+apiVersion: {{ template "rbacAPIVersion" . }}
+metadata:
+  name: drycc:influx:telegraf
+aggregationRule:
+  clusterRoleSelectors:
+    - matchLabels:
+        rbac.authorization.k8s.io/aggregate-view-telegraf-stats: "true"
+    - matchLabels:
+        rbac.authorization.k8s.io/aggregate-to-view: "true"
+rules: [] # Rules are automatically filled in by the controller manager.
 {{- end -}}
 {{- end -}}
diff --git a/charts/monitor/charts/telegraf/templates/monitor-telegraf-rolebinding.yaml b/charts/monitor/charts/telegraf/templates/monitor-telegraf-rolebinding.yaml
@@ -1,18 +1,20 @@
 {{- if (.Values.global.use_rbac) -}}
 {{- if (.Capabilities.APIVersions.Has (include "rbacAPIVersion" .)) -}}
-kind: RoleBinding
+kind: ClusterRoleBinding 
 apiVersion: {{ template "rbacAPIVersion" . }}
 metadata:
-  name: drycc-monitor-telegraf
+  name: drycc:influx:telegraf:viewer
   labels:
     app: drycc-monitor-telegraf
     heritage: drycc
 roleRef:
   apiGroup: rbac.authorization.k8s.io
-  kind: Role
-  name: drycc-monitor-telegraf
+  kind: ClusterRole
+  name: drycc:influx:telegraf
 subjects:
 - kind: ServiceAccount
   name: drycc-monitor-telegraf
+  namespace: drycc
 {{- end -}}
 {{- end -}}
+
diff --git a/grafana/rootfs/usr/share/grafana/api/dashboards/kube_health.json b/grafana/rootfs/usr/share/grafana/api/dashboards/kube_health.json
@@ -1099,7 +1099,7 @@
               "selected": false
             }
           ],
-          "query": "show tag values from kubernetes_pod_container with key in (\"container_name\") where container_name =~ /kube.*/",
+          "query": "show tag values from kubernetes_pod_container with key in (\"container_name\")", 
           "refresh": 1,
           "regex": "",
           "type": "query"
diff --git a/grafana/rootfs/usr/share/grafana/start-grafana b/grafana/rootfs/usr/share/grafana/start-grafana
@@ -8,8 +8,8 @@ GRAFANA_USER=${DEFAULT_USER:-admin}
 GRAFANA_PASSWD=${DEFAULT_USER_PASSWORD:-admin}
 GRAFANA_PORT=${BIND_PORT:-3000}
 
-INFLUXDB_HOST=${DRYCC_MONITOR_INFLUXAPI_SERVICE_HOST:-"drycc-monitor-influx-api.drycc.svc.cluster.local"}
-INFLUXDB_PORT=${DRYCC_MONITOR_INFLUXAPI_SERVICE_PORT_TRANSPORT:-8086}
+INFLUXDB_HOST=${DRYCC_MONITOR_INFLUXDB_API_SERVICE_HOST:-"drycc-monitor-influxdb-api.drycc.svc.cluster.local"}
+INFLUXDB_PORT=${DRYCC_MONITOR_INFLUXDB_API_SERVICE_PORT_TRANSPORT:-8086}
 INFLUXDB_DATABASE=${INFLUXDB_DATABASE:-kubernetes}
 INFLUXDB_USER=${INFLUXDB_USER:-admin}
 INFLUXDB_PASSWORD=${INFLUXDB_PASSWORD:-admin}
diff --git a/telegraf/rootfs/config.toml.tpl b/telegraf/rootfs/config.toml.tpl
@@ -173,9 +173,9 @@
 [[inputs.kubernetes]]
   url = {{ .KUBERNETES_URL | quote }}
   bearer_token = {{ .KUBERNETES_BEARER_TOKEN_PATH | quote }}
-  {{ if .KUBERNETES_SSL_CA }} ssl_ca = {{ .KUBERNETES_SSL_CA | quote }} {{ end }}
-  {{ if .KUBERNETES_SSL_CERT }} ssl_cert = {{ .KUBERNETES_SSL_CERT | quote }} {{ end }}
-  {{ if .KUBERNETES_SSL_KEY }} ssl_key = {{ .KUBERNETES_SSL_KEY | quote }} {{ end }}
+  {{ if .KUBERNETES_SSL_CA }}tls_ca = {{ .KUBERNETES_SSL_CA | quote }} {{ end }}
+  {{ if .KUBERNETES_SSL_CERT }}tls_cert = {{ .KUBERNETES_SSL_CERT | quote }} {{ end }}
+  {{ if .KUBERNETES_SSL_KEY }}tls_key = {{ .KUBERNETES_SSL_KEY | quote }} {{ end }}
   insecure_skip_verify = {{ default true .KUBERNETES_INSECURE_SKIP_VERIFY }}
 {{ end }}
 
diff --git a/telegraf/rootfs/start-telegraf b/telegraf/rootfs/start-telegraf
@@ -20,7 +20,7 @@ fi
 
 if [ -n "$ENABLE_KUBERNETES" ]; then
   export KUBERNETES_BEARER_TOKEN_PATH=${BEARER_TOKEN_PATH}
-  export KUBERNETES_URL="http://${NODE_IP}:10255"
+  export KUBERNETES_URL="https://${NODE_IP}:10250"
   echo "Setting KUBERNETES_URL: $KUBERNETES_URL"
 fi
 

Original file line number	Diff line number	Diff line change
`@@ -1099,7 +1099,7 @@`
`1099`	`1099`	`"selected": false`
`1100`	`1100`	`}`
`1101`	`1101`	`],`
`1102`		`- "query": "show tag values from kubernetes_pod_container with key in (\"container_name\") where container_name =~ /kube.*/",`
	`1102`	`+ "query": "show tag values from kubernetes_pod_container with key in (\"container_name\")",`
`1103`	`1103`	`"refresh": 1,`
`1104`	`1104`	`"regex": "",`
`1105`	`1105`	`"type": "query"`