From 8a797fa921ea914c2890ec716892f9f9fd195953 Mon Sep 17 00:00:00 2001 From: "Ryan J. Geyer" Date: Fri, 25 Jun 2021 17:55:19 -0700 Subject: [PATCH 1/3] Hack the integrationsmixin to be always applied --- .../tanka/grafana-agent/v1/lib/integrations.libsonnet | 6 +++--- production/tanka/grafana-agent/v1/main.libsonnet | 2 +- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/production/tanka/grafana-agent/v1/lib/integrations.libsonnet b/production/tanka/grafana-agent/v1/lib/integrations.libsonnet index 0a6620922896..c462af0955cd 100644 --- a/production/tanka/grafana-agent/v1/lib/integrations.libsonnet +++ b/production/tanka/grafana-agent/v1/lib/integrations.libsonnet @@ -20,14 +20,14 @@ local container = k.core.v1.container; container.mixin.securityContext.withPrivileged(true) + container.mixin.securityContext.withRunAsUser(0), - local controller = self.agent._controller, - agent+:: + local controller = self._controller, + agent+: // procfs, sysfs, rotfs k.util.hostVolumeMount('proc', '/proc', '/host/proc', readOnly=true) + k.util.hostVolumeMount('sys', '/sys', '/host/sys', readOnly=true) + k.util.hostVolumeMount('root', '/', '/host/root', readOnly=true) + - controller.mixin.spec.template.spec.withHostPid(true) + + controller.mixin.spec.template.spec.withHostPID(true) + controller.mixin.spec.template.spec.withHostNetwork(true), }, } diff --git a/production/tanka/grafana-agent/v1/main.libsonnet b/production/tanka/grafana-agent/v1/main.libsonnet index a42703855bd8..d525898689a3 100644 --- a/production/tanka/grafana-agent/v1/main.libsonnet +++ b/production/tanka/grafana-agent/v1/main.libsonnet @@ -124,7 +124,7 @@ local service = k.core.v1.service; else {}, } + ( if has_loki_config then $.lokiPermissionsMixin else {} - ), + ) + $.integrationsMixin, agent_etc: if std.length(etc_instances) > 0 then agent.newAgent(name + '-etc', namespace, self._images.agent, self.etc_config, use_daemonset=false) + From 7522a71c1ac39563fabb0aeddf12e8df71332f7b Mon Sep 17 00:00:00 2001 From: "Ryan J. Geyer" Date: Fri, 25 Jun 2021 18:22:44 -0700 Subject: [PATCH 2/3] Remove hack which always applies integrations mixin. Fix copy/pasta --- production/tanka/grafana-agent/v1/lib/integrations.libsonnet | 2 +- production/tanka/grafana-agent/v1/main.libsonnet | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/production/tanka/grafana-agent/v1/lib/integrations.libsonnet b/production/tanka/grafana-agent/v1/lib/integrations.libsonnet index c462af0955cd..870481f3cbeb 100644 --- a/production/tanka/grafana-agent/v1/lib/integrations.libsonnet +++ b/production/tanka/grafana-agent/v1/lib/integrations.libsonnet @@ -9,7 +9,7 @@ local container = k.core.v1.container; // https://github.com/grafana/agent/blob/main/docs/configuration-reference.md#integrations_config withIntegrations(integrations):: { assert std.objectHasAll(self, '_mode') : ||| - withLokiConfig must be merged with the result of calling new. + withIntegrations must be merged with the result of calling new. |||, _integrations:: integrations, }, diff --git a/production/tanka/grafana-agent/v1/main.libsonnet b/production/tanka/grafana-agent/v1/main.libsonnet index d525898689a3..a42703855bd8 100644 --- a/production/tanka/grafana-agent/v1/main.libsonnet +++ b/production/tanka/grafana-agent/v1/main.libsonnet @@ -124,7 +124,7 @@ local service = k.core.v1.service; else {}, } + ( if has_loki_config then $.lokiPermissionsMixin else {} - ) + $.integrationsMixin, + ), agent_etc: if std.length(etc_instances) > 0 then agent.newAgent(name + '-etc', namespace, self._images.agent, self.etc_config, use_daemonset=false) + From a83b3a0b1555b67532e6e12de218580eb36a31f5 Mon Sep 17 00:00:00 2001 From: "Ryan J. Geyer" Date: Tue, 29 Jun 2021 09:49:21 -0700 Subject: [PATCH 3/3] Conditionally mutate agent daemonset or deployment when node_exporter integration is enabled --- production/tanka/grafana-agent/v1/lib/integrations.libsonnet | 1 - production/tanka/grafana-agent/v1/main.libsonnet | 2 ++ 2 files changed, 2 insertions(+), 1 deletion(-) diff --git a/production/tanka/grafana-agent/v1/lib/integrations.libsonnet b/production/tanka/grafana-agent/v1/lib/integrations.libsonnet index 870481f3cbeb..ce8feefb9dd3 100644 --- a/production/tanka/grafana-agent/v1/lib/integrations.libsonnet +++ b/production/tanka/grafana-agent/v1/lib/integrations.libsonnet @@ -14,7 +14,6 @@ local container = k.core.v1.container; _integrations:: integrations, }, - // TODO(rfratto): only enable this when node_exporter is used. integrationsMixin:: { container+:: container.mixin.securityContext.withPrivileged(true) + diff --git a/production/tanka/grafana-agent/v1/main.libsonnet b/production/tanka/grafana-agent/v1/main.libsonnet index a42703855bd8..d2f5a508b38b 100644 --- a/production/tanka/grafana-agent/v1/main.libsonnet +++ b/production/tanka/grafana-agent/v1/main.libsonnet @@ -124,6 +124,8 @@ local service = k.core.v1.service; else {}, } + ( if has_loki_config then $.lokiPermissionsMixin else {} + ) + ( + if has_integrations && std.objectHas(this._integrations, 'node_exporter') then $.integrationsMixin else {} ), agent_etc: if std.length(etc_instances) > 0 then