Node agent chart changes

network-mapper/templates/_helpers.tpl

@@ -1,3 +1,9 @@
+{{- define "otterize.nodeagent.fullName" -}}
+otterize-node-agent
+{{- end -}}
+{{- define "otterize.piidetector.fullName" -}}
+otterize-pii-detector
+{{- end -}}
 {{- define "otterize.sniffer.fullName" -}}
 otterize-network-sniffer
 {{- end -}}

network-mapper/templates/agent-clusterrole.yaml

@@ -0,0 +1,25 @@
+{{ if .Values.nodeagent.enable }}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: {{ template "otterize.nodeagent.fullName" . }}
+  labels:
+    {{- with .Values.global.commonLabels }}
+    {{- toYaml . | nindent 4 }}
+    {{- end }}
+    app.kubernetes.io/version: {{ .Chart.Version }}
+  annotations:
+    {{- with .Values.global.commonAnnotations }}
+    {{- toYaml . | nindent 4 }}
+    {{- end }}
+    app.kubernetes.io/version: {{ .Chart.Version }}
+rules:
+  - apiGroups:
+      - '*'
+    resources:
+      - '*'
+    verbs:
+      - get
+      - list
+      - watch
+{{ end }}

network-mapper/templates/agent-daemonset.yaml

@@ -0,0 +1,140 @@
+{{ if .Values.nodeagent.enable }}
+apiVersion: apps/v1
+kind: DaemonSet
+metadata:
+  name: {{ template "otterize.nodeagent.fullName" . }}
+  labels:
+    {{- with .Values.global.commonLabels }}
+    {{- toYaml . | nindent 4 }}
+    {{- end }}
+    app.kubernetes.io/version: {{ .Chart.Version }}
+  annotations:
+    {{- with .Values.global.commonAnnotations }}
+    {{- toYaml . | nindent 4 }}
+    {{- end }}
+    app.kubernetes.io/version: {{ .Chart.Version }}
+spec:
+  selector:
+    matchLabels:
+      app: {{ template "otterize.nodeagent.fullName" . }}
+  template:
+    metadata:
+      labels:
+        {{- with .Values.global.podLabels }}
+        {{- toYaml . | nindent 8 }}
+        {{- end }}
+        {{- with .Values.global.commonLabels }}
+        {{- toYaml . | nindent 8 }}
+        {{- end }}
+        app: {{ template "otterize.nodeagent.fullName" . }}
+        app.kubernetes.io/version: {{ .Chart.Version }}
+      annotations:
+        {{- with .Values.global.podAnnotations }}
+        {{- toYaml . | nindent 8 }}
+        {{- end }}
+        {{- with .Values.global.commonAnnotations }}
+        {{- toYaml . | nindent 8 }}
+        {{- end }}
+        app.kubernetes.io/version: {{ .Chart.Version }}
+    spec:
+      serviceAccountName: {{ template "otterize.nodeagent.fullName" . }}
+    {{- if .Values.nodeagent.podSecurityContext }}
+      securityContext:
+        {{- toYaml .Values.nodeagent.podSecurityContext | nindent 8 }}
+    {{- end }}
+      {{ if .Values.nodeagent.pullSecrets }}
+      imagePullSecrets:
+        - name: {{ .Values.nodeagent.pullSecrets }}
+      {{ end }}
+      {{- with .Values.nodeagent.tolerations }}
+      tolerations:  {{- toYaml . | nindent 8 }}
+     {{- end }}
+     {{- with .Values.nodeagent.priorityClassName }}
+      priorityClassName:  {{ . }}
+     {{- end }}      
+      containers:
+      - name: {{ template "otterize.nodeagent.fullName" . }}
+        image: "{{ .Values.nodeagent.repository }}/{{ .Values.nodeagent.image }}:{{ default $.Chart.AppVersion .Values.nodeagent.tag }}"
+        {{ if .Values.nodeagent.pullPolicy }}
+        imagePullPolicy: {{ .Values.nodeagent.pullPolicy }}
+        {{ end }}
+        resources:
+          {{- toYaml .Values.nodeagent.resources | nindent 10 }}
+        env:
+          - name: POD_NAME
+            valueFrom:
+              fieldRef:
+                fieldPath: metadata.name
+          - name: POD_NAMESPACE
+            valueFrom:
+              fieldRef:
+                fieldPath: metadata.namespace
+          - name: NODE_NAME
+            valueFrom:
+              fieldRef:
+                fieldPath: spec.nodeName
+
+          {{ if .Values.debug }}
+          - name: OTTERIZE_DEBUG
+            value: {{ .Values.debug | quote }}
+          {{ end }}
+
+          {{ if .Values.global.otterizeCloud.apiAddress }}
+          - name: OTTERIZE_API_ADDRESS
+            value: "{{ .Values.global.otterizeCloud.apiAddress }}"
+          {{ end }}
+          {{ if .Values.global.otterizeCloud.credentials.clientId }}
+          - name: OTTERIZE_CLIENT_ID
+            value: "{{ .Values.global.otterizeCloud.credentials.clientId }}"
+          {{ end }}
+          {{ if (and .Values.global.otterizeCloud.credentials.clientSecretKeyRef.secretName .Values.global.otterizeCloud.credentials.clientSecretKeyRef.secretKey) }}
+          - name: OTTERIZE_CLIENT_SECRET
+            valueFrom:
+              secretKeyRef:
+                name: "{{ .Values.global.otterizeCloud.credentials.clientSecretKeyRef.secretName }}"
+                key: "{{ .Values.global.otterizeCloud.credentials.clientSecretKeyRef.secretKey }}"
+          {{ else if .Values.global.otterizeCloud.credentials.clientSecret }}
+          - name: OTTERIZE_CLIENT_SECRET
+            valueFrom:
+              secretKeyRef:
+                name: mapper-otterize-cloud-client-secret
+                key: otterize-cloud-client-secret
+          {{ end }}
+
+          - name: OTTERIZE_PII_DETECTOR_API_URL
+            value: http://{{ template "otterize.piidetector.fullName" . }}:5000/
+
+        volumeMounts:
+          - name: host-proc
+            mountPath: /host/proc
+            readOnly: true
+
+          - name: host-socket-k3s
+            mountPath: /run/cri/k3s.sock
+          - name: host-socket-containerd
+            mountPath: /run/cri/containerd.sock
+
+          - mountPath: /host/sys/fs/bpf
+            name: host-bpffs
+            readOnly: false
+
+        securityContext:
+          privileged: true
+
+      volumes:
+        - hostPath:
+            path: /proc
+          name: host-proc
+        - name: component-config
+          configMap:
+            name: {{ template "otterize.mapper.componentConfigmap" . }}
+        - name: host-socket-k3s
+          hostPath:
+            path: "/run/k3s/containerd/containerd.sock"
+        - name: host-socket-containerd
+          hostPath:
+            path: "/run/containerd/containerd.sock"
+        - name: host-bpffs
+          hostPath:
+            path: "/sys/fs/bpf"
+{{ end }}

network-mapper/templates/agent-serviceaccount.yaml

@@ -0,0 +1,39 @@
+{{ if .Values.nodeagent.enable }}
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{ template "otterize.nodeagent.fullName" . }}
+  labels:
+    {{- with .Values.global.commonLabels }}
+    {{- toYaml . | nindent 4 }}
+    {{- end }}
+    app.kubernetes.io/version: {{ .Chart.Version }}
+  annotations:
+    {{- with .Values.global.commonAnnotations }}
+    {{- toYaml . | nindent 4 }}
+    {{- end }}
+    app.kubernetes.io/version: {{ .Chart.Version }}
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: {{ template "otterize.nodeagent.fullName" . }}
+  labels:
+    {{- with .Values.global.commonLabels }}
+    {{- toYaml . | nindent 4 }}
+    {{- end }}
+    app.kubernetes.io/version: {{ .Chart.Version }}
+  annotations:
+    {{- with .Values.global.commonAnnotations }}
+    {{- toYaml . | nindent 4 }}
+    {{- end }}
+    app.kubernetes.io/version: {{ .Chart.Version }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: {{ template "otterize.nodeagent.fullName" . }}
+subjects:
+  - kind: ServiceAccount
+    name: {{ template "otterize.nodeagent.fullName" . }}
+    namespace: {{ .Release.Namespace }}
+{{ end }}

network-mapper/templates/pii-detector-deployment.yaml

@@ -0,0 +1,63 @@
+{{ if .Values.nodeagent.enable }}
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{ template "otterize.piidetector.fullName" . }}
+  labels:
+    {{- with .Values.global.commonLabels }}
+      {{- toYaml . | nindent 4 }}
+    {{- end }}
+    app.kubernetes.io/version: {{ .Chart.Version }}
+  annotations:
+    {{- with .Values.global.commonAnnotations }}
+    {{- toYaml . | nindent 4 }}
+    {{- end }}
+    app.kubernetes.io/version: {{ .Chart.Version }}
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: {{ template "otterize.piidetector.fullName" . }}
+  template:
+    metadata:
+      labels:
+        {{- with .Values.global.commonLabels }}
+          {{- toYaml . | nindent 4 }}
+        {{- end }}
+        app.kubernetes.io/version: {{ .Chart.Version }}
+        app: {{ template "otterize.piidetector.fullName" . }}
+      annotations:
+        {{- with .Values.global.commonAnnotations }}
+        {{- toYaml . | nindent 4 }}
+        {{- end }}
+        app.kubernetes.io/version: {{ .Chart.Version }}
+    spec:
+      serviceAccountName: {{ template "otterize.piidetector.fullName" . }}
+      containers:
+        - name: piidetector
+          image: "{{ .Values.piidetector.repository }}/{{ .Values.piidetector.image }}:{{ default $.Chart.AppVersion .Values.piidetector.tag }}"
+          {{ if .Values.piidetector.pullPolicy }}
+          imagePullPolicy: {{ .Values.piidetector.pullPolicy }}
+          {{ end }}
+          ports:
+            - containerPort: 5000
+          env:
+            - name: POD_NAMESPACE
+              valueFrom:
+                fieldRef:
+                  fieldPath: metadata.namespace
+          resources:
+            {{- toYaml .Values.piidetector.resources | nindent 12 }}
+          readinessProbe:
+            httpGet:
+              path: /healthcheck
+              port: 5000
+            initialDelaySeconds: 1
+            periodSeconds: 10
+          livenessProbe:
+            httpGet:
+              path: /healthcheck
+              port: 5000
+            initialDelaySeconds: 30
+            periodSeconds: 10
+{{ end }}

network-mapper/templates/pii-detector-service.yaml

@@ -0,0 +1,22 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ template "otterize.piidetector.fullName" . }}
+  labels:
+    {{- with .Values.global.commonLabels }}
+    {{- toYaml . | nindent 4 }}
+    {{- end }}
+    app.kubernetes.io/version: {{ .Chart.Version }}
+  annotations:
+    {{- with .Values.global.commonAnnotations }}
+    {{- toYaml . | nindent 4 }}
+    {{- end }}
+    app.kubernetes.io/version: {{ .Chart.Version }}
+spec:
+  selector:
+    app: {{ template "otterize.piidetector.fullName" . }}
+  ports:
+    - protocol: TCP
+      port: 5000
+      name: http
+      targetPort: 5000

network-mapper/templates/pii-detector-serviceaccount.yaml

@@ -0,0 +1,16 @@
+{{ if .Values.nodeagent.enable }}
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{ template "otterize.piidetector.fullName" . }}
+  labels:
+    {{- with .Values.global.commonLabels }}
+    {{- toYaml . | nindent 4 }}
+    {{- end }}
+    app.kubernetes.io/version: {{ .Chart.Version }}
+  annotations:
+    {{- with .Values.global.commonAnnotations }}
+    {{- toYaml . | nindent 4 }}
+    {{- end }}
+    app.kubernetes.io/version: {{ .Chart.Version }}
+{{ end }}

network-mapper/values.yaml

@@ -39,6 +39,26 @@ mapper:
   #   cpu: 100m
   #   memory: 128Mi
 
+nodeagent:
+  enable: false
+  repository: otterize
+  image: node-agent
+  tag: latest
+  pullPolicy:
+  tolerations: []
+  resources: { }
+  podSecurityContext:
+    runAsNonRoot: false
+  pullSecrets:
+  priorityClassName: ""
+
+piidetector:
+  repository: otterize
+  image: node-agent
+  tag: latest
+  pullPolicy:
+  tolerations: [ ]
+  resources: { }
 
 sniffer:
   enable: true # enable/disable entire installation of the network sniffer