Skip to content

Commit de45c29

Browse files
yashmehrotrayashmehrotra
authored
feat: gke installation (#378)
1 parent c9f3fd1 commit de45c29

File tree

7 files changed

+332
-105
lines changed

7 files changed

+332
-105
lines changed

‎.editorconfig‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
[*.{md,js,ts,jsx}]
1+
[*.{md,mdx,js,ts,jsx}]
22
quote_type = single
33
indent_size = 2
44
end_of_line = lf

‎common/src/components/Helm.jsx‎

Lines changed: 20 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -76,39 +76,40 @@ export default function Helm({
7676
{createNamespace && `apiVersion: v1
7777
kind: Namespace
7878
metadata:
79-
name: ${namespace}
79+
name: ${namespace}
8080
---
8181
` || ""}
8282
{createRepo && `apiVersion: source.toolkit.fluxcd.io/v1
8383
kind: HelmRepository
8484
metadata:
85-
name: ${repoName}
86-
namespace: ${namespace}
85+
name: ${repoName}
86+
namespace: ${namespace}
8787
spec:
88-
interval: 5m0s
89-
url: ${repo}
88+
interval: 5m0s
89+
url: ${repo}
9090
---
9191
` || ""}
9292
{`apiVersion: helm.toolkit.fluxcd.io/v2
9393
kind: HelmRelease
9494
metadata:
95-
name: ${chart}
96-
namespace: ${namespace}
97-
spec:
98-
chart:
99-
spec:
100-
chart: ${chart}
101-
sourceRef:
102-
kind: HelmRepository
103-
name: ${repoName}
95+
name: ${chart}
10496
namespace: ${namespace}
105-
interval: 1m
97+
spec:
98+
chart:
99+
spec:
100+
chart: ${chart}
101+
sourceRef:
102+
kind: HelmRepository
103+
name: ${repoName}
104+
namespace: ${namespace}
105+
interval: 5m
106106
`}
107-
{valueFile || values && "values:\n"}
108-
{valueFile && valueFile.replace(/^/gm, ' ')}
107+
108+
{(valueFile || values) && "values:\n"}
109109
{values && Object.keys(values).map((k) => {
110-
return ` ${k}: ${values[k]}\n`
111-
}).join("")}
110+
return ` ${k}: ${values[k]}`
111+
}).join("\n")}
112+
{valueFile && valueFile.split('\n').map(line => ` ${line}\n`).join('')}
112113
</CodeBlock>;
113114

114115

‎mission-control/docs/installation/_aws_iam.mdx‎

Lines changed: 79 additions & 79 deletions
Original file line numberDiff line numberDiff line change
@@ -73,85 +73,85 @@ You can also create a new policy with only the permissions required by Mission C
7373
## Configure IAM Roles for Mission Control
7474

7575
<Tabs>
76-
<TabItem label="IAM Roles for Service Accounts" value="IRSA">
77-
78-
<Tabs>
79-
<TabItem label="eksctl" value="cli">
80-
2. Setup variables
81-
```bash
82-
# The name of the EKS cluster mission control is being deployed to
83-
export CLUSTER= <CLUSTER_NAME>
84-
# the default namespace the mission-control helm chart uses
85-
export NAMESPACE=mission-control
86-
export ACCOUNT=$(aws sts get-caller-identity --query 'Account' --output text)
87-
```
88-
<p/>
89-
90-
1. Enable [EKS IAM Roles for Service Accounts](https://eksctl.io/usage/iamserviceaccounts/)
91-
92-
```bash
93-
eksctl utils associate-iam-oidc-provider --cluster=$CLUSTER
94-
```
95-
96-
<p />
97-
98-
2. Create the IAM Role mappings
99-
100-
```yaml title="eksctl.yaml"
101-
iam:
102-
withOIDC: true
103-
serviceAccounts:
104-
- metadata:
105-
name: mission-control-sa
106-
namespace: mission-control
107-
roleName: MissionControlRole
108-
roleOnly: true
109-
attachPolicyARNs:
110-
- "arn:aws:iam::aws:policy/ReadOnlyAccess"
111-
- metadata:
112-
name: canary-checker-sa
113-
namespace: mission-control
114-
roleName: CanaryCheckerRole
115-
roleOnly: true
116-
attachPolicyARNs:
117-
- "arn:aws:iam::aws:policy/ReadOnlyAccess"
118-
- metadata:
119-
name: config-db-sa
120-
namespace: mission-control
121-
roleName: ConfigDBRole
122-
roleOnly: true
123-
attachPolicyARNs:
124-
- "arn:aws:iam::aws:policy/ReadOnlyAccess"
125-
126-
```
127-
128-
```bash
129-
eksctl create iamserviceaccount --cluster $CLUSTER -c eksctl.yaml
130-
```
131-
132-
3. <Domain />
133-
134-
4. Install Mission Control
135-
136-
<Helm chart={props.chart} values={props.values} valueFile={`
137-
serviceAccount:
138-
annotations:
139-
# used by mission control for notifications / playbooks
140-
eks.amazonaws.com/role-arn: arn:aws:iam::$ACCOUNT:role/MissionControlRole
141-
142-
canary-checker:
143-
serviceAccount:
144-
annotations:
145-
# used for cloudwatch, S3 and other AWS health checks
146-
eks.amazonaws.com/role-arn: arn:aws:iam::$ACCOUNT:role/CanaryCheckerRole
147-
148-
config-db:
149-
serviceAccount:
150-
annotations:
151-
# used to scrape AWS resources, change history via AWS CloudTrail and cost via Athena
152-
eks.amazonaws.com/role-arn: arn:aws:iam::$ACCOUNT:role/ConfigDBRole`} />
153-
154-
</TabItem>
76+
<TabItem label="IAM Roles for Service Accounts" value="IRSA">
77+
78+
<Tabs>
79+
<TabItem label="eksctl" value="cli">
80+
2. Setup variables
81+
```bash
82+
# The name of the EKS cluster mission control is being deployed to
83+
export CLUSTER= <CLUSTER_NAME>
84+
# the default namespace the mission-control helm chart uses
85+
export NAMESPACE=mission-control
86+
export ACCOUNT=$(aws sts get-caller-identity --query 'Account' --output text)
87+
```
88+
<p/>
89+
90+
1. Enable [EKS IAM Roles for Service Accounts](https://eksctl.io/usage/iamserviceaccounts/)
91+
92+
```bash
93+
eksctl utils associate-iam-oidc-provider --cluster=$CLUSTER
94+
```
95+
96+
<p />
97+
98+
2. Create the IAM Role mappings
99+
100+
```yaml title="eksctl.yaml"
101+
iam:
102+
withOIDC: true
103+
serviceAccounts:
104+
- metadata:
105+
name: mission-control-sa
106+
namespace: mission-control
107+
roleName: MissionControlRole
108+
roleOnly: true
109+
attachPolicyARNs:
110+
- "arn:aws:iam::aws:policy/ReadOnlyAccess"
111+
- metadata:
112+
name: canary-checker-sa
113+
namespace: mission-control
114+
roleName: CanaryCheckerRole
115+
roleOnly: true
116+
attachPolicyARNs:
117+
- "arn:aws:iam::aws:policy/ReadOnlyAccess"
118+
- metadata:
119+
name: config-db-sa
120+
namespace: mission-control
121+
roleName: ConfigDBRole
122+
roleOnly: true
123+
attachPolicyARNs:
124+
- "arn:aws:iam::aws:policy/ReadOnlyAccess"
125+
126+
```
127+
128+
```bash
129+
eksctl create iamserviceaccount --cluster $CLUSTER -c eksctl.yaml
130+
```
131+
132+
3. <Domain />
133+
134+
4. Install Mission Control
135+
136+
<Helm chart={props.chart} values={props.values} valueFile={`
137+
serviceAccount:
138+
annotations:
139+
# used by mission control for notifications / playbooks
140+
eks.amazonaws.com/role-arn: arn:aws:iam::$ACCOUNT:role/MissionControlRole
141+
142+
canary-checker:
143+
serviceAccount:
144+
annotations:
145+
# used for cloudwatch, S3 and other AWS health checks
146+
eks.amazonaws.com/role-arn: arn:aws:iam::$ACCOUNT:role/CanaryCheckerRole
147+
148+
config-db:
149+
serviceAccount:
150+
annotations:
151+
# used to scrape AWS resources, change history via AWS CloudTrail and cost via Athena
152+
eks.amazonaws.com/role-arn: arn:aws:iam::$ACCOUNT:role/ConfigDBRole`} />
153+
154+
</TabItem>
155155
</Tabs>
156156

157157
</TabItem>

‎mission-control/docs/installation/_gke_iam.mdx‎

Lines changed: 124 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,124 @@
1+
import Domain from '@site/docs/partials/_domain.mdx'
2+
3+
## Create an IAM Role
4+
5+
Depending on how you want to use Mission Control you need to create an IAM role for mission control to use:
6+
7+
| Use Case | Role |
8+
| -------------------------------------------- | ---------------|
9+
| Read Only Scraping | `roles/viewer` |
10+
| Playbooks to create and update GCP Resources | `roles/editor` |
11+
12+
## Configure IAM Roles for Mission Control
13+
14+
<Tabs>
15+
<TabItem label="Workload Identity" value="Workload Identity">
16+
17+
<Tabs>
18+
<TabItem label="Bind policy to service account" value="federation">
19+
20+
You can also refer the official docs for [Workload Identity](https://cloud.google.com/kubernetes-engine/docs/how-to/workload-identity)
21+
22+
1. Enable workload identity
23+
```bash
24+
# The name of the GKE cluster mission control is being deployed to
25+
export CLUSTER=<CLUSTER_NAME>
26+
# the default namespace the mission-control helm chart uses
27+
export NAMESPACE=mission-control
28+
# GCP Project ID
29+
export PROJECT_ID=gcp-project-id
30+
# GCP Project Number
31+
export PROJECT_NUMBER=gcp-project-number
32+
# Location of GKE Cluster
33+
LOCATION=us-east1
34+
35+
gcloud container clusters update $CLUSTER \
36+
--location=$LOCATION \
37+
--workload-pool=PROJECT_ID.svc.id.goog
38+
```
39+
<p/>
40+
41+
2. Bind IAM Policy
42+
43+
The `$KSA_NAME` refers to the Kubernetes service account name. In our case, we need to bind to 3 service accounts: `mission-control-sa`, `canary-checker-sa` and `config-db-sa`
44+
45+
```bash
46+
gcloud projects add-iam-policy-binding projects/$PROJECT_ID \
47+
--role=$ROLE \
48+
--member=principal://iam.googleapis.com/projects/$PROJECT_NUMBER/locations/global/workloadIdentityPools/$PROJECT_ID.svc.id.goog/subject/ns/$NAMESPACE/sa/mission-control-sa \
49+
--condition=None
50+
51+
gcloud projects add-iam-policy-binding projects/$PROJECT_ID \
52+
--role=$ROLE \
53+
--member=principal://iam.googleapis.com/projects/$PROJECT_NUMBER/locations/global/workloadIdentityPools/$PROJECT_ID.svc.id.goog/subject/ns/$NAMESPACE/sa/canary-checker-sa \
54+
--condition=None
55+
56+
gcloud projects add-iam-policy-binding projects/$PROJECT_ID \
57+
--role=$ROLE \
58+
--member=principal://iam.googleapis.com/projects/$PROJECT_NUMBER/locations/global/workloadIdentityPools/$PROJECT_ID.svc.id.goog/subject/ns/$NAMESPACE/sa/config-db-sa \
59+
--condition=None
60+
```
61+
<p/>
62+
63+
3. <Domain />
64+
65+
4. Install Mission Control
66+
67+
<Helm chart={props.chart} values={props.values}/>
68+
69+
</TabItem>
70+
71+
72+
<TabItem label="Allow ServiceAccount to impresonate IAM Role" value="impersonate">
73+
74+
You can also refer the official docs: https://cloud.google.com/kubernetes-engine/docs/how-to/workload-identity
75+
1. Create a new IAM ServiceAccount
76+
77+
```bash
78+
gcloud iam service-accounts create $IAM_SA_NAME \
79+
--project=$IAM_SA_PROJECT_ID
80+
```
81+
<p/>
82+
83+
2. Bind GCP Service Account to IAM Role
84+
85+
```bash
86+
gcloud projects add-iam-policy-binding $IAM_SA_PROJECT_ID \
87+
--member "serviceAccount:$IAM_SA_NAME@IAM_SA_PROJECT_ID.iam.gserviceaccount.com" \
88+
--role "$ROLE_NAME"
89+
```
90+
3. Create an IAM allow policy that gives the Kubernetes ServiceAccount access to impersonate the IAM service account:
91+
92+
The `$KSA_NAME` refers to the Kubernetes service account name. In our case, we need to bind to 3 service accounts: `mission-control`, `canary-checker` and `config-db`
93+
94+
```bash
95+
gcloud iam service-accounts add-iam-policy-binding IAM_SA_NAME@IAM_SA_PROJECT_ID.iam.gserviceaccount.com \
96+
--role roles/iam.workloadIdentityUser \
97+
--member "serviceAccount:$PROJECT_ID.svc.id.goog[$NAMESPACE/$KSA_NAME]"
98+
```
99+
100+
4. Install Mission Control
101+
<Helm chart={props.chart} values={props.values} valueFile={`
102+
serviceAccount:
103+
annotations:
104+
iam.gke.io/gcp-service-account=IAM_SA_NAME@IAM_SA_PROJECT_ID.iam.gserviceaccount.com
105+
106+
canary-checker:
107+
serviceAccount:
108+
annotations:
109+
iam.gke.io/gcp-service-account=IAM_SA_NAME@IAM_SA_PROJECT_ID.iam.gserviceaccount.com
110+
111+
config-db:
112+
serviceAccount:
113+
annotations:
114+
iam.gke.io/gcp-service-account=IAM_SA_NAME@IAM_SA_PROJECT_ID.iam.gserviceaccount.com
115+
`}/>
116+
117+
118+
5. <Domain/>
119+
</TabItem>
120+
</Tabs>
121+
122+
123+
</TabItem>
124+
</Tabs>

0 commit comments

Comments
 (0)