Skip to content

Commit

Permalink
k8s/fargate: update install instructions
Browse files Browse the repository at this point in the history
  • Loading branch information
roobre committed Jan 31, 2022
1 parent 26b483c commit 5317935
Showing 1 changed file with 57 additions and 29 deletions.
Original file line number Diff line number Diff line change
Expand Up @@ -32,7 +32,7 @@ New Relic Logging is not yet supported on Fargate nodes.

## Installation [#installation]

You can choose between two alternatives for installing New Relic full observability in your EKS Fargate cluster:
You can choose between two alternatives for installing New Relic full observability in your EKS Fargate cluster:

* [Automatic injection (recommended)](#automatic)
* [Manual injection](#manual)
Expand Down Expand Up @@ -70,7 +70,7 @@ The `ClusterRoleBinding` grants the following permissions to the pod being injec
```

<Callout variant="tip">
In order for the sidecar to be injected, and therefore to get metrics from pods deployed before the operator has been installed, you need to manually perform a rollout (restart) of the affected deployments. This way, when the pods are created, the operator will be able to inject the monitoring sidecar. New Relic has chosen not to do this automatically in order to prevent unexpected service disruptions and resource usage spikes.
In order for the sidecar to be injected, and therefore to get metrics from pods deployed before the operator has been installed, you need to manually perform a rollout (restart) of the affected deployments. This way, when the pods are created, the operator will be able to inject the monitoring sidecar. New Relic has chosen not to do this automatically in order to prevent unexpected service disruptions and resource usage spikes.
</Callout>

Here's the injection workflow:
Expand All @@ -83,25 +83,53 @@ Here's the injection workflow:
The following steps are for a default setup. Before completing these, we suggest you take a look at the [Configuration](#config-auto) section below to see if you want to modify any aspects of the automatic injection.
</Callout>

In order to install the operator in charge of injecting the infrastructure sidecar, it is enough to run the following command. Please note that this command is the same one that is used for the general [installation command for `nri-kubernetes`](/docs/integrations/kubernetes-integration/installation/install-kubernetes-integration-using-helm/#install-k8-helm), with two extra fargate-specific flags (highlighted):
First, add the New Relic Helm repository if you have not done so before:

```shell
helm repo add newrelic https://helm-charts.newrelic.com
```
helm upgrade --install newrelic newrelic/nri-bundle \
--namespace newrelic --create-namespace \
--set global.licenseKey=<var>YOUR_NEW_RELIC_LICENSE_KEY</var> \
--set global.cluster=K8S_CLUSTER_NAME \
--set infrastructure.enabled=true \
--set prometheus.enabled=true \
--set webhook.enabled=true \
--set ksm.enabled=true \
--set kubeEvents.enabled=true \
<var>--set global.fargate=true</var> \
<var>--set newrelic-infra-operator.enabled=true</var>

Then, in order to install the operator in charge of injecting the infrastructure sidecar, please create a file named `values-newrelic.yaml`, which will be used to define your configuration:

```yaml
global:
licenseKey: <var>YOUR_NEW_RELIC_LICENSE_KEY</var>
cluster: <var>K8S_CLUSTER_NAME</var>
fargate: <mark>true</mark> # Enable fargate support

prometheus:
# Automatically scrape prometheus metrics for annotated services in the cluster
# Collecting prometheus metrics for large clusters might impact data usage significantly
enabled: <mark>false</mark>
webhook:
# Deploy our webhook to link APM and Kubernetes entities
enabled: true
kubeEvents:
# Report Kubernetes events
enabled: true
logging:
# Report logs for containers running in the cluster
enabled: true
ksm:
# Deploy kube-state-metrics in the cluster.
# Set this to true unless it is already deployed.
enabled: true
newrelic-infra-operator:
# Deploy the infrastructure operator, which will inject the monitoring sidecar on fargate pods
enabled: <mark>true</mark>
```

Finally, after creating and tweaking the file, you can deploy the solution using the following Helm command:

```shell
helm upgrade --install <mark>newrelic</mark> newrelic/nri-bundle \
--namespace <mark>newrelic</mark> --create-namespace \
-f values-newrelic.yaml \
<mark>--devel</mark>
```

<Callout variant="important">
When deploying the solution on a hybrid cluster (with both EC2 and Fargate nodes), please make sure that the solution is not selected by any Fargate profiles; otherwise, the `DaemonSet` instances will be stuck in a pending state. For fargate-only environments this is not a concern because no `DaemonSet` instances are created.

</Callout>

#### Configuration [#config-auto]
Expand All @@ -116,12 +144,12 @@ Specifying your own custom injection rules will discard the default ruleset that

#### Update to the latest version or to a new configuration [#update-auto-install-version]

To update to the latest version of the EKS Fargate integration, upgrade the chart and reinstall the bundle by simply running again the command above.
To update to the latest version of the EKS Fargate integration, upgrade the Helm repository using `helm repo update newrelic` and reinstall the bundle by simply running again the command above.

To update the configuration of the infrastructure agent injected or the operator itself, modify the `values.yaml` and upgrade the Helm release with the new configuration. The operator is updated immediately. However, another rollout of the workloads is needed in order to inject the infrastructure agent sidecar with the new configuration.
To update the configuration of the infrastructure agent injected or the operator itself, modify the `values-newrelic.yaml` and upgrade the Helm release with the new configuration. The operator is updated immediately, and your workloads will be instrumented with the new version on their next restart. If you wish to upgrade them immediately, you can force a restart of your workloads by running:

```
$ kubectl rollout restart deployment <var>YOUR_DEPLOY</var>
```shell
kubectl rollout restart deployment <var>your-application</var>
```

#### Uninstall the Fargate integration [#uninstall-auto-injection]
Expand Down Expand Up @@ -156,7 +184,7 @@ The following objects are required for the sidecar to successfully report data:

* The `ClusterRole` providing the permission needed by the `nri-kubernetes` integration
* A `ClusterRoleBinding` linking the `ClusterRole` and the service account of the pod
* The secret storing the New Relic `licenseKey` in each Fargate namespace
* The secret storing the New Relic `licenseKey` in each Fargate namespace
* The sidecar container in the spec template of the monitored workload

#### Manual injection installation [#manual-injection-install]
Expand All @@ -176,7 +204,7 @@ Complete the following for manual injection:
>
You can use this snippet as it appears below, without any changes:

```
```
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
Expand Down Expand Up @@ -204,7 +232,7 @@ Complete the following for manual injection:
</Collapser>
</CollapserGroup>

2. For each workload you want to monitor, add an additional sidecar container for the `newrelic/infrastructure-k8s` image. Here is an example of an injected sidecar.
2. For each workload you want to monitor, add an additional sidecar container for the `newrelic/infrastructure-k8s` image. Here is an example of an injected sidecar.

<CollapserGroup>
<Collapser
Expand Down Expand Up @@ -290,13 +318,13 @@ Complete the following for manual injection:
id="cluster-role-binding"
title="ClusterRoleBinding"
>
Create the following `ClusterRoleBinding` that has as subjects the service account of the pods you want to monitor.
Create the following `ClusterRoleBinding` that has as subjects the service account of the pods you want to monitor.

<Callout variant="tip">
You don't need to repeat the same service account twice. Each time you want to monitor a pod with a service account that isn't included yet, just add it to the list.
</Callout>

```
```
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
Expand Down Expand Up @@ -324,7 +352,7 @@ Complete the following for manual injection:

Create the following `Secret` that has a license with the Base64 encoded value of your NewRelic license key. One secret is needed in each namespace where a pod you want to monitor is running.

```
```
apiVersion: v1
data:
license: <var>INSERT_YOUR_NEW_RELIC_LICENSE_ENCODED_IN_BASE64</var>
Expand All @@ -344,7 +372,7 @@ When adding the manifest of the sidecar agent manually, you can use any agent co

#### Update to the latest version [#manual-update-version]

To update any of the components, you just need to modify the deployed yaml.
To update any of the components, you just need to modify the deployed yaml.

Updating any of the fields of the injected container will cause the pod to be re-created.

Expand All @@ -355,8 +383,8 @@ The agent cannot hot load the New Relic license key. After updating the secret,
#### Uninstall the Fargate integration [#manual-uninstall]

To remove the injected container and the related resources, you just have to remove the following:
* The sidecar from the workloads that should be no longer monitored.
* All the secrets containing the newrelic license.
* The sidecar from the workloads that should be no longer monitored.
* All the secrets containing the newrelic license.
* `ClusterRole` and `ClusterRoleBinding` objects.

Notice that removing the sidecar container will cause the pod to be re-created.
Expand Down

0 comments on commit 5317935

Please sign in to comment.