Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

feat: irsa checks #98

Open
wants to merge 5 commits into
base: main
Choose a base branch
from
Open

feat: irsa checks #98

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
1b981e9
WIP
leiicamundi Oct 24, 2024
4817361
WIP
leiicamundi Oct 29, 2024
8270780
wip: irsa checks for aws
leiicamundi Oct 30, 2024
67594d9
finish implementation
leiicamundi Oct 30, 2024
ed9f8d0
Merge branch 'main' into feature/irsa-checks
leiicamundi Oct 30, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
42 changes: 41 additions & 1 deletion README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,10 +24,13 @@ The `checks` directory contains scripts for verifying Kubernetes and Zeebe conne

### Kubernetes

Before using the Kubernetes health check scripts, ensure you have access to Kubernetes with a properly defined `kube config` context.

Before using the Kubernetes health check scripts, ensure you have access to Kubernetes with a properly defined `kube config` context pointing to the cluster you wish to debug.

For more information on setting up `kube config` context, refer to the [Kubernetes documentation](https://kubernetes.io/docs/reference/kubectl/generated/kubectl_config/kubectl_config_use-context/).

Additionally, ensure that the AWS CLI is configured and connected to the appropriate tenant for debugging when `awscli` is used.

#### Deployment Check (`/checks/kube/deployment.sh`)

##### Description:
Expand Down Expand Up @@ -55,6 +58,43 @@ Options:

- `kubectl`: Required for interacting with Kubernetes clusters.

### IRSA Configuration Check (`/checks/kube/aws-irsa.sh`)
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'd add somewhere that a Helm chart release install is a requirement for this script.
E.g. helm template + kustomize or ArgoCD (uses helm template) would not result in Helm chart releases.


##### Description:

This script checks the IRSA (IAM Roles for Service Accounts) configuration for AWS Kubernetes. It ensures that the necessary components are configured correctly for OpenSearch and PostgreSQL.

##### Usage:
```bash
Usage: ./checks/kube/aws-irsa.sh [-h] [-n NAMESPACE] [-e EXCLUDE_COMPONENTS] [-p COMPONENTS_PG] [-l COMPONENTS_OS] [-s]
Options:
-h Display this help message
-n NAMESPACE Specify the namespace to use
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

since that's the only value that is required, should this be marked?

-e EXCLUDE_COMPONENTS Comma-separated list of components to exclude from the check (reference of the component is the root key used in the chart)
-p COMPONENTS_PG Comma-separated list of components to check IRSA for PostgreSQL (overrides default list)
-l COMPONENTS_OS Comma-separated list of components to check IRSA for OpenSearch (overrides default list)
-s Disable pod spawn for IRSA and network flow verification
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

maybe we could explain in a bit more detail what this means?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Agreed, it was supposed to be part of the documentation, but will not hurt to add some context here aswell

```

##### Example:
```bash
./checks/kube/aws-irsa.sh -n camunda-primary -p "identity,webModeler" -l "zeebe,operate"
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

curious how precise does the naming have to be?
Woudln't it be easier to just convert everything to lowercase, so customers can supply it however they want and we also don't have to care too much about special cases à la webModeler.

Maybe easier for the helm chart handling, just curious.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

very precise (case sensitive) as we use the name of the component for jq queries.

Introducing key insensitivity in jq directly could be challenging (https://stackoverflow.com/questions/67725386/jq-unsensitive-case-key-filter), that said, we could have a static map at the beggining that does that for us.

I'll implement it

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

was just an idea, I'm also fine with keeping it as is.

```

##### Notes:
- The script will display which components are being checked for IRSA support for both PostgreSQL and OpenSearch.
- You can exclude specific components from the checks if necessary.
- By default, the script will spawn debugging pods using the `amazonlinux:latest` container image in the cluster.
- Basic Linux commands such as `sed`, `awk`, and `grep` will also be required for the script's operation.

##### Dependencies:

- `kubectl`: Required for interacting with Kubernetes clusters.
- `aws-cli`: Required for checking AWS-specific configurations.
- `jq`: Required for processing JSON data. [Install jq](https://jqlang.github.io/jq/download/).
- `yq`: Required for processing YAML data. [Install yq](https://mikefarah.gitbook.io/yq/v3.x).
- `helm`: Required for managing Kubernetes applications. [Install helm](https://helm.sh/docs/intro/install/).

#### Connectivity Check (`/checks/kube/connectivity.sh`)

##### Description:
Expand Down
Loading