Skip to content

Commit 13e16a7

Browse files
pebrcpebrc
committed
First draft for Fleet ingress
1 parent 24a990e commit 13e16a7

File tree

2 files changed

+361
-0
lines changed

2 files changed

+361
-0
lines changed

‎config/recipes/elastic-agent/README.asciidoc

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -46,3 +46,7 @@ Deploys single instance Elastic Agent Deployment in Fleet mode with APM integrat
4646
===== Synthetic monitoring - `synthetic-monitoring.yaml`
4747

4848
Deploys an Fleet-enrolled Elastic Agent that can be used as for link:https://www.elastic.co/guide/en/observability/current/monitor-uptime-synthetics.html[Synthetic monitoring]. This Elastic Agent uses the `elastic-agent-complete` image. The agent policy still needs to be link:https://www.elastic.co/guide/en/observability/current/synthetics-private-location.html#synthetics-private-location-add[registered as private location] in Kibana.
49+
50+
===== Fleet Server exposed both internally and externally - `fleet-ingress-setup.yaml`
51+
52+
This example shows how to expose the Fleet Server to the outside world using a Kubernetes Ingress resource. The Fleet Server is configured to use custom TLS certificates, and all communications are secured with TLS. The same Fleet Server is also accessible from within the cluster, allowing agents to connect to it regardless of their location. Refer to the comments in the `fleet-ingress-setup.yaml` file for more details on how to set up the Ingress resource and TLS certificates to enable this configuration.

‎config/recipes/elastic-agent/fleet-ingress-setup.yaml

Lines changed: 357 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,357 @@
1+
apiVersion: kibana.k8s.elastic.co/v1
2+
kind: Kibana
3+
metadata:
4+
name: kibana
5+
spec:
6+
version: 9.1.0
7+
count: 1
8+
elasticsearchRef:
9+
name: elasticsearch
10+
config:
11+
xpack.fleet.agents.elasticsearch.hosts: ["https://es.example.com:443"]
12+
xpack.fleet.agents.fleet_server.hosts: [ "https://fleet.example.com:443"]
13+
xpack.fleet.packages:
14+
- name: system
15+
version: latest
16+
- name: elastic_agent
17+
version: latest
18+
- name: fleet_server
19+
version: latest
20+
- name: kubernetes
21+
version: latest
22+
- name: apm
23+
version: latest
24+
xpack.fleet.agentPolicies:
25+
- name: Fleet Server on ECK policy
26+
id: eck-fleet-server
27+
namespace: elastic
28+
is_managed: true
29+
monitoring_enabled:
30+
- logs
31+
- metrics
32+
unenroll_timeout: 900
33+
package_policies:
34+
- name: fleet_server-1
35+
id: fleet_server-1
36+
package:
37+
name: fleet_server
38+
- name: Elastic Agent on ECK policy
39+
id: eck-agent
40+
namespace: elastic
41+
is_managed: true
42+
monitoring_enabled:
43+
- logs
44+
- metrics
45+
unenroll_timeout: 900
46+
package_policies:
47+
- package:
48+
name: system
49+
name: system-1
50+
- package:
51+
name: kubernetes
52+
name: kubernetes-1
53+
54+
---
55+
apiVersion: elasticsearch.k8s.elastic.co/v1
56+
kind: Elasticsearch
57+
metadata:
58+
name: elasticsearch
59+
spec:
60+
version: 9.1.0
61+
nodeSets:
62+
- name: default-3
63+
count: 3
64+
config:
65+
node.store.allow_mmap: false
66+
volumeClaimTemplates:
67+
- metadata:
68+
name: elasticsearch-data
69+
spec:
70+
accessModes: ["ReadWriteOnce"]
71+
resources:
72+
requests:
73+
storage: 30Gi
74+
75+
---
76+
apiVersion: networking.k8s.io/v1
77+
kind: Ingress
78+
metadata:
79+
name: fleet-ingress
80+
annotations:
81+
# Disable HTTP traffic
82+
kubernetes.io/ingress.allow-http: "false"
83+
nginx.ingress.kubernetes.io/backend-protocol: "HTTPS"
84+
nginx.ingress.kubernetes.io/proxy-ssl-verify: "off"
85+
nginx.ingress.kubernetes.io/ssl-redirect: "true"
86+
# Depending on the ingress implementation in your environment you may need to specify the ingress class
87+
# kubernetes.io/ingress.class: "example"
88+
spec:
89+
# or alternatively use the ingressClassName field. Consult the documentation of your ingress controller.
90+
# ingressClassName: example
91+
tls:
92+
# The assumption here is that these are certificates that are trusted both by agents outside the cluster as well as
93+
# as inside. See the comments in the Agent spec below for more details.
94+
- hosts: ["fleet.example.com"]
95+
secretName: fleet-server-acme
96+
- hosts: ["es.example.com"]
97+
secretName: es-acme
98+
- hosts: ["kb.example.com"]
99+
secretName: kb-acme
100+
rules:
101+
- host: "kb.example.com"
102+
http:
103+
paths:
104+
- path: "/"
105+
pathType: Prefix
106+
backend:
107+
service:
108+
name: kibana-kb-http
109+
port:
110+
number: 5601
111+
- host: "es.example.com"
112+
http:
113+
paths:
114+
- path: "/"
115+
pathType: Prefix
116+
backend:
117+
service:
118+
name: elasticsearch-es-http
119+
port:
120+
number: 9200
121+
- host: "fleet.example.com"
122+
http:
123+
paths:
124+
- path: "/"
125+
pathType: Prefix
126+
backend:
127+
service:
128+
name: fleet-server-agent-http
129+
port:
130+
number: 8220
131+
---
132+
apiVersion: agent.k8s.elastic.co/v1alpha1
133+
kind: Agent
134+
metadata:
135+
name: fleet-server
136+
spec:
137+
version: 9.1.0
138+
http:
139+
# Configuring the same certificates used for the ingress here has the effect that
140+
# the CA certificate that is expected in ca.crt inside this secret is propagated to the agents
141+
# and configured in the FLEET_CA environment variable.
142+
# Without this the agents would only trust the self-signed certificates generated by ECK.
143+
tls:
144+
certificate:
145+
secretName: fleet-server-acme
146+
kibanaRef:
147+
name: kibana
148+
elasticsearchRefs:
149+
- name: elasticsearch
150+
mode: fleet
151+
fleetServerEnabled: true
152+
policyID: eck-fleet-server
153+
deployment:
154+
replicas: 1
155+
podTemplate:
156+
spec:
157+
containers:
158+
- name: agent
159+
env:
160+
# Force Elastic Agent to bootstrap itself through the public Fleet Server URL
161+
# We are asuming here the certificates configured above are only valid for the public URL.
162+
- name: FLEET_URL
163+
value: https://fleet.example.com:443
164+
serviceAccountName: fleet-server
165+
automountServiceAccountToken: true
166+
securityContext:
167+
runAsUser: 0
168+
---
169+
apiVersion: agent.k8s.elastic.co/v1alpha1
170+
kind: Agent
171+
metadata:
172+
name: elastic-agent
173+
spec:
174+
config:
175+
fleet:
176+
enabled: true
177+
providers.kubernetes:
178+
add_resource_metadata:
179+
deployment: true
180+
version: 9.1.0
181+
kibanaRef:
182+
name: kibana
183+
fleetServerRef:
184+
name: fleet-server
185+
mode: fleet
186+
policyID: eck-agent
187+
daemonSet:
188+
podTemplate:
189+
spec:
190+
volumes:
191+
- name: fleet-ca
192+
secret:
193+
secretName: fleet-server-acme
194+
containers:
195+
- name: agent
196+
env:
197+
# - name: FLEET_CA
198+
# value: /mnt/extra/ca.crt
199+
- name: FLEET_URL
200+
value: https://fleet.example.com
201+
volumeMounts:
202+
- name: fleet-ca
203+
mountPath: /mnt/extra
204+
serviceAccountName: elastic-agent
205+
hostNetwork: true
206+
dnsPolicy: ClusterFirstWithHostNet
207+
automountServiceAccountToken: true
208+
securityContext:
209+
runAsUser: 0
210+
---
211+
apiVersion: rbac.authorization.k8s.io/v1
212+
kind: ClusterRole
213+
metadata:
214+
name: fleet-server
215+
rules:
216+
- apiGroups: [""]
217+
resources:
218+
- pods
219+
- namespaces
220+
- nodes
221+
verbs:
222+
- get
223+
- watch
224+
- list
225+
- apiGroups: ["apps"]
226+
resources:
227+
- replicasets
228+
verbs:
229+
- get
230+
- watch
231+
- list
232+
- apiGroups: ["batch"]
233+
resources:
234+
- jobs
235+
verbs:
236+
- get
237+
- watch
238+
- list
239+
- apiGroups: ["coordination.k8s.io"]
240+
resources:
241+
- leases
242+
verbs:
243+
- get
244+
- create
245+
- update
246+
---
247+
apiVersion: v1
248+
kind: ServiceAccount
249+
metadata:
250+
name: fleet-server
251+
namespace: default
252+
---
253+
apiVersion: rbac.authorization.k8s.io/v1
254+
kind: ClusterRoleBinding
255+
metadata:
256+
name: fleet-server
257+
subjects:
258+
- kind: ServiceAccount
259+
name: fleet-server
260+
namespace: default
261+
roleRef:
262+
kind: ClusterRole
263+
name: fleet-server
264+
apiGroup: rbac.authorization.k8s.io
265+
---
266+
apiVersion: rbac.authorization.k8s.io/v1
267+
kind: ClusterRole
268+
metadata:
269+
name: elastic-agent
270+
rules:
271+
- apiGroups: [""]
272+
resources:
273+
- pods
274+
- nodes
275+
- namespaces
276+
- events
277+
- services
278+
- configmaps
279+
verbs:
280+
- get
281+
- watch
282+
- list
283+
- apiGroups: ["coordination.k8s.io"]
284+
resources:
285+
- leases
286+
verbs:
287+
- get
288+
- create
289+
- update
290+
- nonResourceURLs:
291+
- "/metrics"
292+
verbs:
293+
- get
294+
- apiGroups: ["extensions"]
295+
resources:
296+
- replicasets
297+
verbs:
298+
- "get"
299+
- "list"
300+
- "watch"
301+
- apiGroups:
302+
- "apps"
303+
resources:
304+
- statefulsets
305+
- deployments
306+
- replicasets
307+
- daemonsets
308+
verbs:
309+
- "get"
310+
- "list"
311+
- "watch"
312+
- apiGroups:
313+
- ""
314+
resources:
315+
- nodes/stats
316+
verbs:
317+
- get
318+
- nonResourceURLs:
319+
- "/metrics"
320+
verbs:
321+
- get
322+
- apiGroups:
323+
- "batch"
324+
resources:
325+
- jobs
326+
- cronjobs
327+
verbs:
328+
- "get"
329+
- "list"
330+
- "watch"
331+
- apiGroups:
332+
- "storage.k8s.io"
333+
resources:
334+
- storageclasses
335+
verbs:
336+
- "get"
337+
- "list"
338+
- "watch"
339+
---
340+
apiVersion: v1
341+
kind: ServiceAccount
342+
metadata:
343+
name: elastic-agent
344+
namespace: default
345+
---
346+
apiVersion: rbac.authorization.k8s.io/v1
347+
kind: ClusterRoleBinding
348+
metadata:
349+
name: elastic-agent
350+
subjects:
351+
- kind: ServiceAccount
352+
name: elastic-agent
353+
namespace: default
354+
roleRef:
355+
kind: ClusterRole
356+
name: elastic-agent
357+
apiGroup: rbac.authorization.k8s.io

0 commit comments

Comments
 (0)