Skip to content

Commit b115471

Browse files
author
Robert Bailey
authored
Update helm configuration to allow annotations to be added to service (agones-dev#2134)
Adds helm configuration options and documentation to enable stackdriver on GKE clusters using workload identity.
1 parent 1db7ed4 commit b115471

7 files changed

Lines changed: 62 additions & 30 deletions

File tree

‎install/helm/agones/templates/controller.yaml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -69,7 +69,7 @@ spec:
6969
{{- if .Values.agones.createPriorityClass }}
7070
priorityClassName: {{ .Values.agones.priorityClassName }}
7171
{{- end }}
72-
serviceAccountName: {{ .Values.agones.serviceaccount.controller }}
72+
serviceAccountName: {{ .Values.agones.serviceaccount.controller.name }}
7373
containers:
7474
- name: agones-controller
7575
image: "{{ .Values.agones.image.registry }}/{{ .Values.agones.image.controller.name}}:{{ default .Values.agones.image.tag .Values.agones.image.controller.tag }}"
@@ -94,7 +94,7 @@ spec:
9494
- name: SIDECAR_MEMORY_LIMIT
9595
value: {{ .Values.agones.image.sdk.memoryLimit | quote }}
9696
- name: SDK_SERVICE_ACCOUNT
97-
value: {{ .Values.agones.serviceaccount.sdk | quote }}
97+
value: {{ .Values.agones.serviceaccount.sdk.name | quote }}
9898
- name: PROMETHEUS_EXPORTER
9999
value: {{ .Values.agones.metrics.prometheusEnabled | quote }}
100100
- name: STACKDRIVER_EXPORTER

‎install/helm/agones/templates/service/allocation.yaml‎

Lines changed: 7 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,7 @@
1818
apiVersion: v1
1919
kind: Service
2020
metadata:
21-
name: agones-allocator
21+
name: {{ $.Values.agones.serviceaccount.allocator.name }}
2222
namespace: {{ .Release.Namespace }}
2323
labels:
2424
component: allocator
@@ -101,7 +101,7 @@ spec:
101101
tolerations:
102102
{{ toYaml .Values.agones.allocator.tolerations | indent 8 }}
103103
{{- end }}
104-
serviceAccountName: agones-allocator
104+
serviceAccountName: {{ $.Values.agones.serviceaccount.allocator.name }}
105105
volumes:
106106
- name: tls
107107
secret:
@@ -223,7 +223,10 @@ metadata:
223223
chart: {{ template "agones.chart" $ }}
224224
release: {{ $.Release.Name }}
225225
heritage: {{ $.Release.Service }}
226-
226+
{{- if .Values.agones.serviceaccount.allocator.annotations }}
227+
annotations:
228+
{{- toYaml .Values.agones.serviceaccount.allocator.annotations | nindent 4 }}
229+
{{- end }}
227230
---
228231
# Bind the agones-allocator ServiceAccount to the agones-allocator ClusterRole
229232
apiVersion: rbac.authorization.k8s.io/v1
@@ -238,7 +241,7 @@ metadata:
238241
heritage: {{ $.Release.Service }}
239242
subjects:
240243
- kind: ServiceAccount
241-
name: agones-allocator
244+
name: {{ $.Values.agones.serviceaccount.allocator.name }}
242245
namespace: {{ .Release.Namespace }}
243246
roleRef:
244247
apiGroup: rbac.authorization.k8s.io

‎install/helm/agones/templates/serviceaccounts/controller.yaml‎

Lines changed: 13 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -16,20 +16,24 @@
1616
apiVersion: v1
1717
kind: ServiceAccount
1818
metadata:
19-
name: {{ .Values.agones.serviceaccount.controller }}
19+
name: {{ .Values.agones.serviceaccount.controller.name }}
2020
namespace: {{ .Release.Namespace }}
2121
labels:
2222
app: {{ template "agones.name" . }}
2323
chart: {{ template "agones.chart" . }}
2424
release: {{ .Release.Name }}
2525
heritage: {{ .Release.Service }}
26+
{{- if .Values.agones.serviceaccount.controller.annotations }}
27+
annotations:
28+
{{- toYaml .Values.agones.serviceaccount.controller.annotations | nindent 4 }}
29+
{{- end }}
2630
---
2731
{{- end}}
2832
{{- if .Values.agones.rbacEnabled }}
2933
apiVersion: rbac.authorization.k8s.io/v1
3034
kind: ClusterRole
3135
metadata:
32-
name: {{ .Values.agones.serviceaccount.controller }}
36+
name: {{ .Values.agones.serviceaccount.controller.name }}
3337
namespace: {{ .Release.Namespace }}
3438
labels:
3539
app: {{ template "agones.name" . }}
@@ -74,7 +78,7 @@ rules:
7478
apiVersion: rbac.authorization.k8s.io/v1
7579
kind: ClusterRoleBinding
7680
metadata:
77-
name: {{ .Values.agones.serviceaccount.controller }}-access
81+
name: {{ .Values.agones.serviceaccount.controller.name }}-access
7882
namespace: {{ .Release.Namespace }}
7983
labels:
8084
app: {{ template "agones.name" . }}
@@ -83,40 +87,40 @@ metadata:
8387
heritage: {{ .Release.Service }}
8488
subjects:
8589
- kind: User
86-
name: system:serviceaccount:{{ .Release.Namespace }}:{{ .Values.agones.serviceaccount.controller }}
90+
name: system:serviceaccount:{{ .Release.Namespace }}:{{ .Values.agones.serviceaccount.controller.name }}
8791
apiGroup: rbac.authorization.k8s.io
8892
roleRef:
8993
apiGroup: rbac.authorization.k8s.io
9094
kind: ClusterRole
91-
name: {{ .Values.agones.serviceaccount.controller }}
95+
name: {{ .Values.agones.serviceaccount.controller.name }}
9296
---
9397
#
9498
# RBACs for APIService
9599
#
96100
apiVersion: rbac.authorization.k8s.io/v1
97101
kind: ClusterRoleBinding
98102
metadata:
99-
name: {{ .Values.agones.serviceaccount.controller }}:system:auth-delegator
103+
name: {{ .Values.agones.serviceaccount.controller.name }}:system:auth-delegator
100104
roleRef:
101105
apiGroup: rbac.authorization.k8s.io
102106
kind: ClusterRole
103107
name: system:auth-delegator
104108
subjects:
105109
- kind: ServiceAccount
106-
name: {{ .Values.agones.serviceaccount.controller }}
110+
name: {{ .Values.agones.serviceaccount.controller.name }}
107111
namespace: {{ .Release.Namespace }}
108112
---
109113
apiVersion: rbac.authorization.k8s.io/v1
110114
kind: RoleBinding
111115
metadata:
112-
name: {{ .Values.agones.serviceaccount.controller }}-auth-reader
116+
name: {{ .Values.agones.serviceaccount.controller.name }}-auth-reader
113117
namespace: kube-system
114118
roleRef:
115119
apiGroup: rbac.authorization.k8s.io
116120
kind: Role
117121
name: extension-apiserver-authentication-reader
118122
subjects:
119123
- kind: ServiceAccount
120-
name: {{ .Values.agones.serviceaccount.controller }}
124+
name: {{ .Values.agones.serviceaccount.controller.name }}
121125
namespace: {{ .Release.Namespace }}
122126
{{- end }}

‎install/helm/agones/templates/serviceaccounts/sdk.yaml‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,7 @@
1616
apiVersion: v1
1717
kind: ServiceAccount
1818
metadata:
19-
name: {{ $.Values.agones.serviceaccount.sdk }}
19+
name: {{ $.Values.agones.serviceaccount.sdk.name }}
2020
namespace: {{ . }}
2121
labels:
2222
app: {{ template "agones.name" $ }}
@@ -29,7 +29,7 @@ metadata:
2929
apiVersion: rbac.authorization.k8s.io/v1
3030
kind: ClusterRole
3131
metadata:
32-
name: {{ .Values.agones.serviceaccount.sdk }}
32+
name: {{ .Values.agones.serviceaccount.sdk.name }}
3333
namespace: {{ .Release.Namespace }}
3434
labels:
3535
app: {{ template "agones.name" . }}
@@ -48,7 +48,7 @@ rules:
4848
apiVersion: rbac.authorization.k8s.io/v1
4949
kind: RoleBinding
5050
metadata:
51-
name: {{ $.Values.agones.serviceaccount.sdk }}-access
51+
name: {{ $.Values.agones.serviceaccount.sdk.name }}-access
5252
namespace: {{ . }}
5353
labels:
5454
app: {{ template "agones.name" $ }}
@@ -57,12 +57,12 @@ metadata:
5757
heritage: {{ $.Release.Service }}
5858
subjects:
5959
- kind: User
60-
name: system:serviceaccount:{{ . }}:{{ $.Values.agones.serviceaccount.sdk }}
60+
name: system:serviceaccount:{{ . }}:{{ $.Values.agones.serviceaccount.sdk.name }}
6161
apiGroup: rbac.authorization.k8s.io
6262
roleRef:
6363
apiGroup: rbac.authorization.k8s.io
6464
kind: ClusterRole
65-
name: {{ $.Values.agones.serviceaccount.sdk }}
65+
name: {{ $.Values.agones.serviceaccount.sdk.name }}
6666
---
6767
{{- end }}
6868
{{- end }}

‎install/helm/agones/values.yaml‎

Lines changed: 8 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -30,8 +30,14 @@ agones:
3030
install: true
3131
cleanupOnDelete: true
3232
serviceaccount:
33-
controller: agones-controller
34-
sdk: agones-sdk
33+
allocator:
34+
name: agones-allocator
35+
annotations: {}
36+
controller:
37+
name: agones-controller
38+
annotations: {}
39+
sdk:
40+
name: agones-sdk
3541
createPriorityClass: true
3642
priorityClassName: agones-system
3743
controller:

‎site/content/en/docs/Guides/metrics.md‎

Lines changed: 20 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -206,22 +206,36 @@ Open a web browser to [http://localhost:3000](http://localhost:3000), you should
206206

207207
### Stackdriver installation
208208

209-
In order to use [Stackdriver monitoring](https://app.google.stackdriver.com) you should [enable Stackdriver Monitoring API](https://cloud.google.com/monitoring/api/enable-api) on Google Cloud Console. You need to grant all the necessary permissions to the users (see [Access Control Guide](https://cloud.google.com/monitoring/access-control)). Stackdriver exporter uses a strategy called Application Default Credentials (ADC) to find your application's credentials. Details could be found here [Setting Up Authentication for Server to Server Production Applications](https://cloud.google.com/docs/authentication/production).
209+
In order to use [Stackdriver monitoring](https://app.google.stackdriver.com) you must [enable the Monitoring API](https://cloud.google.com/monitoring/api/enable-api) in the Google Cloud Console. You need to grant all the necessary permissions to the users (see [Access Control Guide](https://cloud.google.com/monitoring/access-control)). Stackdriver exporter uses a strategy called Application Default Credentials (ADC) to find your application's credentials. Details can be found in [Setting Up Authentication for Server to Server Production Applications](https://cloud.google.com/docs/authentication/production).
210210

211-
Note that Stackdriver monitoring is enabled by default on GKE clusters, however you can follow this [guide](https://cloud.google.com/kubernetes-engine/docs/how-to/monitoring#enabling_stackdriver_monitoring) if it was disabled on your GKE cluster.
211+
{{< alert title="Note" color="info">}}
212+
Cloud Operations for GKE (including stackdriver monitoring) is enabled by default on GKE clusters, however you can follow this [guide](https://cloud.google.com/stackdriver/docs/solutions/gke/installing#upgrade-instructions) if it is currently disabled in your GKE cluster.
213+
{{< /alert >}}
212214

213-
Default metrics exporter is Prometheus. If you are using the [Helm installation]({{< ref "/docs/Installation/Install Agones/helm.md" >}}), you can install or upgrade Agones to use Stackdriver, using the following chart parameters:
215+
The default metrics exporter installed with Agones is Prometheus. If you are using the [Helm installation]({{< ref "/docs/Installation/Install Agones/helm.md" >}}), you can install or upgrade Agones to use Stackdriver, using the following chart parameters:
214216
```
215217
helm upgrade --install --wait --set agones.metrics.stackdriverEnabled=true --set agones.metrics.prometheusEnabled=false --set agones.metrics.prometheusServiceDiscovery=false my-release-name agones/agones --namespace=agones-system
216218
```
217219

218220
With this configuration only Stackdriver exporter would be used instead of Prometheus exporter.
219221

220-
Create a Fleet or a Gameserver in order to check that connection with stackdriver API is configured properly and so that you will be able to see the metrics data.
222+
{{% feature publishVersion="1.16.0" %}}
223+
#### Using Stackdriver with Workload Identity
224+
225+
If you would like to enable stackdriver in conjunction with [Workload Identity](https://cloud.google.com/kubernetes-engine/docs/how-to/workload-identity), there are a few extra steps you need to follow:
226+
227+
1. When setting up the Google service account following the instructions for [Authenticating to Google Cloud](https://cloud.google.com/kubernetes-engine/docs/how-to/workload-identity#authenticating_to), create two IAM policy bindings, one for `serviceAccount:PROJECT_ID.svc.id.goog[agones-system/agones-controller]` and one for `serviceAccount:PROJECT_ID.svc.id.goog[agones-system/agones-allocator]`.
228+
229+
1. Pass parameters to helm when installing Agones to add annotations to the `agones-controller` and `agones-allocator` Kubernetes service accounts:
230+
231+
```
232+
helm install my-release --namespace agones-system --create-namespace agones/agones --set agones.metrics.stackdriverEnabled=true --set agones.metrics.prometheusEnabled=false --set agones.metrics.prometheusServiceDiscovery=false --set agones.serviceaccount.allocator.annotations."iam\.gke\.io/gcp-service-account"="GSA_NAME@PROJECT_ID\.iam\.gserviceaccount\.com" --set agones.serviceaccount.controller.annotations."iam\.gke\.io/gcp-service-account"="GSA_NAME@PROJECT_ID\.iam\.gserviceaccount\.com"
233+
```
234+
{{% /feature %}}
221235

222-
Visit [Stackdriver monitoring](https://app.google.stackdriver.com) website, select your project, or choose `Create a new Workspace` and select GCP project where your cluster resides. In [Stackdriver metrics explorer](https://cloud.google.com/monitoring/charts/metrics-explorer) you should be able to find new metrics with prefix `agones/` after a couple of minutes. Choose the metrics you are interested in and add to a single or separate graphs. Select `Kubernetes Container` resource type for each of them. You can create multiple graphs, save them into your dashboard and use various aggregation parameters and reducers for each graph.
236+
To verify that metrics are being sent to Stackdriver, create a Fleet or a Gameserver and look for the metrics to show up in the Stackdriver dashboard. Navigate to the [Metrics explorer](https://console.cloud.google.com/monitoring/metrics-explorer) and search for metrics with the prefix `agones/`. Select a metric and look for data to be plotted in the graph to the right.
223237

224-
Example of the dashboard appearance is provided below:
238+
An example of a custom dashboard is:
225239

226240
![stackdriver monitoring dashboard](../../../images/stackdriver-metrics-dashboard.png)
227241

‎site/content/en/docs/Installation/Install Agones/helm.md‎

Lines changed: 7 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -94,8 +94,8 @@ The following tables lists the configurable parameters of the Agones chart and t
9494
| `agones.metrics.stackdriverEnabled` | Enables Stackdriver exporter of controller metrics | `false` |
9595
| `agones.metrics.stackdriverProjectID` | This overrides the default gcp project id for use with stackdriver | \`\` |
9696
| `agones.metrics.stackdriverLabels` | A set of default labels to add to all stackdriver metrics generated in form of key value pair (`key=value,key2=value2`). By default metadata are automatically added using Kubernetes API and GCP metadata enpoint. | \`\` |
97-
| `agones.serviceaccount.controller` | Service account name for the controller | `agones-controller` |
98-
| `agones.serviceaccount.sdk` | Service account name for the sdk | `agones-sdk` |
97+
| `agones.serviceaccount.controller` | Service account name for the controller. **Note**: Will be replaced with `agones.serviceaccount.controller.name` in Agones 1.16 | `agones-controller` |
98+
| `agones.serviceaccount.sdk` | Service account name for the sdk. **Note**: Will be replaced with `agones.serviceaccount.sdk.name` in Agones 1.16 | `agones-sdk` |
9999
| `agones.image.registry` | Global image registry for all images | `gcr.io/agones-images` |
100100
| `agones.image.tag` | Global image tag for all images | `{{< release-version >}}` |
101101
| `agones.image.controller.name` | Image name for the controller | `agones-controller` |
@@ -184,6 +184,11 @@ The following tables lists the configurable parameters of the Agones chart and t
184184

185185
| Parameter | Description | Default |
186186
| --------------------------------------------------- | ----------------------------------------------------------------------------------------------- | ---------------------- |
187+
| `agones.serviceaccount.controller.name` | Service account name for the controller | `agones-controller` |
188+
| `agones.serviceaccount.sdk.name` | Service account name for the sdk | `agones-sdk` |
189+
| `agones.serviceaccount.allocator.name` | Service account name for the allocator | `agones-allocator` |
190+
| `agones.serviceaccount.allocator.annotations` | [Annotations][annotations] added to the Agones allocator service account | `{}` |
191+
| `agones.serviceaccount.controller.annotations` | [Annotations][annotations] added to the Agones controller service account | `{}` |
187192
| | | |
188193
{{% /feature %}}
189194

0 commit comments

Comments
 (0)