Changes according to IBM ICP content guidelines and best practices #1

mrgadgil · 2019-05-24T19:39:33Z

No description provided.

mrgadgil · 2019-05-24T19:41:29Z

cluster-agent/Chart.yaml

+  - ICP
+  - DevOps
+  - amd64
+  - Commercial


Keywords are required by charts who want to be a part of ICP catalog.
https://github.com/IBM/charts/blob/master/GUIDELINES.md#required-chart-keywords

mrgadgil · 2019-05-24T19:42:14Z

cluster-agent/Chart.yaml

+  - amd64
+  - Commercial
+tillerVersion: ">=2.9.1"
+kubeVersion: ">1.7"


Recommended for charts who want to be a part of ICP catalog.

mrgadgil · 2019-05-24T19:44:23Z

cluster-agent/LICENSE

@@ -0,0 +1,202 @@
+


Apache License is required by charts to be included in the community repo. https://github.com/IBM/charts/blob/master/GUIDELINES.md#license
This license is for the helm chart.
Any product licenses can go in a separate LICENSES folder.

mrgadgil · 2019-05-24T19:49:39Z

cluster-agent/README.md

-* An AppDynamics account. AppDynamics offers a [free trial](https://www.appdynamics.com/free-trial/)
+* An AppDynamics account.
+
+### Create a secret


A single Tiller instance is used to store all Helm releases in a single location. Anyone who has the authority to access Helm (an ICP Cluster Admin, Team Admin or Team Operator) has the ability to list the contents of any Helm release, regardless of the namespace that it was installed into.
Any sensitive data that is passed to chart as values can be obtained when we run helm get release command.
Therefore the recommended approach is to never store any sensitive data with the chart. Secret resources should be handled independently of the chart.
Therefore I have added capability for the user to pre-create the secret and pass it to the chart.
I did not remove the secret generation from the chart but tried to steer user to pre-create secret.

mrgadgil · 2019-05-24T19:51:01Z

cluster-agent/README.md

+  --namespace namespace_name
+```
+
+### Image Security Policies


ICP clusters generally have image security policies enforced. Image repositories have to be whitelisted so that images can be pulled during chart install.

mrgadgil · 2019-05-24T19:54:12Z

cluster-agent/README.md

+   - name: docker.io/appdynamics/cluster-agent:*
+```
+
+### Pod Security Policies


Cluster agent container runs as root.
ICP recommends to run the container as a non-root user. This is not a hard requirement for our first round.
It will become a mandate if this chart intends to become a cloud pak. Cloud paks are required to run containers as non-root users and have to specify a security context in deployment.
For our initial take, I have added documentation for user to create a namespace with less restrictive PSP that allows containers to run as root.

mrgadgil · 2019-05-24T19:54:38Z

cluster-agent/README.md

@@ -57,20 +94,21 @@ helm install appdynamics-charts/cluster-agent --name=stable \
 | `deployment.image.tag` | Tag of the machine agent image | `latest`
 | `deployment.image.pullPolicy` | The machine agent image pull policy| `IfNotPresent`
 | `deployment.resources ` | Resources directive  | See below
-
+| `existingSecret` | Name of existing secret to use for ClusterAgent application in AppDyanamics   |


Please see the explanation above for adding existing secret field.

mrgadgil · 2019-05-24T20:03:17Z

cluster-agent/README.md

 ```
+## Limitation


Added limitation as I could not make chart work with AppDyanamics Trial account.
Please let me know we need more investigation on using AppDynamics lite account.

mrgadgil · 2019-05-24T20:04:14Z

cluster-agent/README.md

-
-
-
+## Support


This section is a mandatory section to be included in the ReadMe for charts in the catalog.
https://github.com/IBM/charts/blob/master/GUIDELINES.md#support-statement

mrgadgil · 2019-05-24T20:04:53Z

cluster-agent/templates/NOTES.txt

@@ -1,4 +1,4 @@
-{{- if and .Values.controller.apiUser .Values.controller.url }}
+{{- if and .Values.controller.url ( or .Values.controller.apiUser .Values.existingSecret) }}


Change to include existing secret in the condition.

mrgadgil · 2019-05-24T20:05:51Z

cluster-agent/templates/_helpers.tpl

+{{- else -}}
+    {{- printf "%s" (include "cluster-agent.fullname" .) -}}
+{{- end -}}
+{{- end -}}


Created function to get secret name depending on whether user provides an existing secret or lets chart create one.

mrgadgil · 2019-05-24T20:07:05Z

cluster-agent/templates/agent-config.yaml

+    helm.sh/chart: {{ include "cluster-agent.name" . }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/managed-by: {{ .Release.Service }}
+    release: {{ .Release.Name }}


Best Practice: Added metadata labels.
https://github.com/helm/helm/blob/master/docs/chart_best_practices/labels.md

mrgadgil · 2019-05-24T20:07:29Z

cluster-agent/templates/deployment.yaml

+    helm.sh/chart: {{ include "cluster-agent.name" . }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/managed-by: {{ .Release.Service }}
+    release: {{ .Release.Name }}


Best Practice: Added metadata labels.
https://github.com/helm/helm/blob/master/docs/chart_best_practices/labels.md

mrgadgil · 2019-05-24T20:08:14Z

cluster-agent/templates/deployment.yaml

+        app.kubernetes.io/name: {{ include "cluster-agent.name" . }}
+        helm.sh/chart: {{ include "cluster-agent.name" . }}
+        app.kubernetes.io/instance: {{ .Release.Name }}
+        app.kubernetes.io/managed-by: {{ .Release.Service }}


Best Practice: Added metadata labels.
https://github.com/helm/helm/blob/master/docs/chart_best_practices/labels.md

mrgadgil · 2019-05-24T20:09:16Z

cluster-agent/Chart.yaml

+  - DevOps
+  - amd64
+  - Commercial
+tillerVersion: ">=2.9.1"


Best Practice: https://github.com/helm/helm/blob/master/docs/chart_best_practices/conventions.md#restricting-tiller-by-version

mrgadgil · 2019-05-24T20:10:47Z

cluster-agent/templates/deployment.yaml

-      containers: 
-        - env: 
+    spec:
+      restartPolicy: Always


Corrected indentation so that the yaml is rendered correctly.

mrgadgil · 2019-05-24T20:12:05Z

cluster-agent/templates/deployment.yaml

                  key: controller-key
-                  name: cluster-agent-secret
+                  name: {{ template "cluster-agent.secretName" . }}


Changed hard coded name to generate one using template macro.
Secret name will also contain the release name which binds all release objects together and will allow multiple releases.

mrgadgil · 2019-05-24T20:12:30Z

cluster-agent/templates/deployment.yaml

            - containerPort: {{ .Values.deployment.port }}
              protocol: TCP
          resources:
 {{- if .Values.deployment.resources }}
-{{ toYaml .Values.deployment.resources | indent 10 }}
+{{ toYaml .Values.deployment.resources | indent 12 }}


Corrected indentation so that the yaml is rendered correctly.

mrgadgil · 2019-05-24T20:12:37Z

cluster-agent/templates/deployment.yaml

 {{- else if .Values.resources }}
-{{ toYaml .Values.resources | indent 10 }}
+{{ toYaml .Values.resources | indent 12 }}


Corrected indentation so that the yaml is rendered correctly.

mrgadgil · 2019-05-24T20:12:56Z

cluster-agent/templates/rbac.yaml

+    helm.sh/chart: {{ include "cluster-agent.name" . }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/managed-by: {{ .Release.Service }}
+    release: {{ .Release.Name }}


Best Practice: Added metadata labels.
https://github.com/helm/helm/blob/master/docs/chart_best_practices/labels.md

mrgadgil · 2019-05-24T20:13:03Z

cluster-agent/templates/rbac.yaml

+    helm.sh/chart: {{ include "cluster-agent.name" . }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/managed-by: {{ .Release.Service }}
+    release: {{ .Release.Name }}


Best Practice: Added metadata labels.
https://github.com/helm/helm/blob/master/docs/chart_best_practices/labels.md

mrgadgil · 2019-05-24T20:13:11Z

cluster-agent/templates/rbac.yaml

+    helm.sh/chart: {{ include "cluster-agent.name" . }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/managed-by: {{ .Release.Service }}
+    release: {{ .Release.Name }}


Best Practice: Added metadata labels.
https://github.com/helm/helm/blob/master/docs/chart_best_practices/labels.md

mrgadgil · 2019-05-24T20:14:38Z

cluster-agent/templates/service.yaml

@@ -4,9 +4,10 @@ metadata:
  name: {{ include "cluster-agent.fullname" . }}
  labels:
    app.kubernetes.io/name: {{ include "cluster-agent.name" . }}
-    helm.sh/chart: {{ include "cluster-agent.chart" . }}
+    helm.sh/chart: {{ include "cluster-agent.name" . }}


Labels should not include helm chart version as it can create problems during chart upgrades as the chart version will change with upgrade.

mrgadgil · 2019-05-24T20:16:41Z

cluster-agent/values.yaml

@@ -3,14 +3,22 @@ deployment:
  image:
    repository: docker.io/appdynamics/cluster-agent
    tag: latest
-    pullPolicy: IfNotPresent
+    pullPolicy: Always


IBM recommends to use a tag instead of using latest docker image.
If latest tag is used for docker image, then it is advised to use pull policy of always to get the latest available image.
This is more a recommendation geared towards promoting the chart to become a cloud pak. Not required at our initial pass.
https://github.com/helm/helm/blob/master/docs/chart_best_practices/pods.md#images

mrgadgil · 2019-05-24T20:19:43Z

cluster-agent/values.yaml

 serviceAccount:
  create: true
  name: appdynamics-operator

-metrics-server:
-  install: true


Removed as these configure values are not used in the chart.
Removing them because these unused configure parameters will appear in ICP UI configure page. They will confuse users who set them and see no effect in the chart.

mrgadgil · 2019-05-24T20:21:36Z

cluster-agent/values.yaml

+    memory:
+  requests:
+    cpu:
+    memory:


Adding resources in values.yaml as they are used by the chart.
Values that are set in values.yaml appear as configurable options while deploying chart using ICP UI.
On another note: Do we need deployment.resources as well resources? Will it be okay to keep only one config option?

mrgadgil · 2019-05-24T20:26:54Z

cluster-agent/templates/rbac.yaml

@@ -3,13 +3,24 @@ apiVersion: v1
 kind: ServiceAccount
 metadata:
  name: {{ .Values.serviceAccount.name }}
-namespace: {{ .Release.Namespace }}


namespace is not a valid field for ServiceAccount.

mrgadgil · 2019-05-24T20:35:20Z

cluster-agent/values.yaml

 serviceAccount:
  create: true
  name: appdynamics-operator

-metrics-server:
-  install: true
+existingSecret:


Added existing secret so that user can use a pre-created secret to pass sensitive information.

Changes according to IBM ICP content guidelines and best practices

56eed69

mrgadgil commented May 24, 2019

View reviewed changes

Memory unit defined as M

ef8fad6

mrgadgil commented May 24, 2019

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Changes according to IBM ICP content guidelines and best practices #1

Changes according to IBM ICP content guidelines and best practices #1

mrgadgil commented May 24, 2019

mrgadgil May 24, 2019 •

edited

Loading

mrgadgil May 24, 2019

mrgadgil May 24, 2019

mrgadgil May 24, 2019 •

edited

Loading

mrgadgil May 24, 2019

mrgadgil May 24, 2019 •

edited

Loading

mrgadgil May 24, 2019

mrgadgil May 24, 2019

mrgadgil May 24, 2019

mrgadgil May 24, 2019

mrgadgil May 24, 2019

mrgadgil May 24, 2019

mrgadgil May 24, 2019

mrgadgil May 24, 2019

mrgadgil May 24, 2019

mrgadgil May 24, 2019

mrgadgil May 24, 2019 •

edited

Loading

mrgadgil May 24, 2019

mrgadgil May 24, 2019

mrgadgil May 24, 2019

mrgadgil May 24, 2019

mrgadgil May 24, 2019

mrgadgil May 24, 2019

mrgadgil May 24, 2019 •

edited

Loading

mrgadgil May 24, 2019

mrgadgil May 24, 2019

mrgadgil May 24, 2019

mrgadgil May 24, 2019

		@@ -1,4 +1,4 @@
		{{- if and .Values.controller.apiUser .Values.controller.url }}
		{{- if and .Values.controller.url ( or .Values.controller.apiUser .Values.existingSecret) }}

Changes according to IBM ICP content guidelines and best practices #1

Are you sure you want to change the base?

Changes according to IBM ICP content guidelines and best practices #1

Conversation

mrgadgil commented May 24, 2019

mrgadgil May 24, 2019 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

mrgadgil May 24, 2019 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

mrgadgil May 24, 2019 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

mrgadgil May 24, 2019 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

mrgadgil May 24, 2019 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

mrgadgil May 24, 2019 •

edited

Loading

mrgadgil May 24, 2019 •

edited

Loading

mrgadgil May 24, 2019 •

edited

Loading

mrgadgil May 24, 2019 •

edited

Loading

mrgadgil May 24, 2019 •

edited

Loading