Skip to content

Commit 9dc8968

Browse files
raphaelquatiraphaelquati
committed
Implement Azure Storage upload
Signed-off-by: Raphael Couto <raphcouto@hotmail.com>
1 parent c315d2d commit 9dc8968

12 files changed

Lines changed: 1291 additions & 219 deletions

File tree

‎Cargo.lock‎

Lines changed: 605 additions & 158 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎README.md‎

Lines changed: 7 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
# Core Dump Handler
22

3-
This helm chart is designed to deploy functionality that automatically saves core dumps from most public cloud kubernetes service providers and private kubernetes instances to an S3 compatible storage service.
3+
This helm chart is designed to deploy functionality that automatically saves core dumps from most public cloud kubernetes service providers and private kubernetes instances to an object storage service.
44

55
[![build status](https://github.com/ibm/core-dump-handler/workflows/CI/badge.svg)](https://github.com/ibm/core-dump-handler/actions)
66
[![Docker Repository on Quay](https://quay.io/repository/icdh/core-dump-handler/status "Docker Repository on Quay")](https://quay.io/repository/icdh/core-dump-handler)
@@ -99,7 +99,7 @@ This chart aims to tackle the problems surrounding core dumps by leveraging comm
9999

100100
The chart deploys two processes:
101101

102-
1. The **agent** manages the updating of `/proc/sys/kernel/*` configuration, deploys the composer service and uploads the core dumps zipfile created by the composer to an object storage instance.
102+
1. The **agent** manages the updating of `/proc/sys/kernel/*` configuration, deploys the composer service and uploads the core dumps zipfile created by the composer to an object storage instance. Native S3-compatible and Azure Blob Storage uploads are supported.
103103

104104
2. The **composer** handles the processing of a core dump and creating runtime, container coredump and image JSON documents from CRICTL and inserting them into a single zip file. The zip file is stored on the local file system of the node for the agent to upload.
105105

@@ -205,6 +205,11 @@ or run the helm install command with the settings
205205
S3_SECRET=XXXX
206206
S3_BUCKET_NAME=XXXX
207207
S3_REGION=XXXX
208+
209+
# Or for Azure Blob Storage
210+
STORAGE_PROVIDER=azure
211+
AZURE_STORAGE_CONNECTION_STRING=DefaultEndpointsProtocol=https;AccountName=XXXX;AccountKey=XXXX;EndpointSuffix=core.windows.net
212+
AZURE_STORAGE_CONTAINER_NAME=core-dumps
208213
```
209214
210215
1. Change directory to the integration folder and run the test

‎charts/core-dump-handler/README.md‎

Lines changed: 56 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,12 @@
11
# Core Dump Handler
22

3-
This helm chart is designed to deploy functionality that automatically saves core dumps from any public cloud kubernetes service provider or [RedHat OpenShift Kubernetes Service](https://cloud.ibm.com/kubernetes/catalog/create?platformType=openshift) to an S3 compatible storage service.
3+
This helm chart is designed to deploy functionality that automatically saves core dumps from any public cloud kubernetes service provider or [RedHat OpenShift Kubernetes Service](https://cloud.ibm.com/kubernetes/catalog/create?platformType=openshift) to an object storage service.
44

55
## Prerequisites
66

77
The [Helm](https://helm.sh/) cli to run the chart
88

9-
An [S3 Protocol Compatible](https://en.wikipedia.org/wiki/Amazon_S3) object storage solution.
9+
An object storage solution reachable from the cluster. Native S3-compatible uploads and Azure Blob Storage uploads are supported.
1010

1111
A [CRIO](https://cri-o.io/) compatible container runtime on the kubernetes hosts. If you service provider uses something else we will willingly recieve patches to support them.
1212

@@ -22,6 +22,30 @@ helm install core-dump-handler . --create-namespace --namespace observe \
2222

2323
Where the `--set` options are configuration for your S3 protocol compatible provider
2424

25+
Azure Blob Storage is auto-detected when `daemonset.azureClientId` is present. The agent prioritizes managed identity authentication; if the client ID is not set, it falls back to connection string / account key.
26+
27+
**With Azure Workload Identity (recommended):**
28+
29+
```
30+
helm install core-dump-handler . --create-namespace --namespace observe \
31+
--set daemonset.azureClientId=00000000-0000-0000-0000-000000000000 \
32+
--set daemonset.azureTenantId=00000000-0000-0000-0000-000000000000 \
33+
--set daemonset.azureStorageContainerName=core-dumps \
34+
--set daemonset.azureStorageBlobEndpoint=https://myaccount.blob.core.windows.net \
35+
--set serviceAccount.annotations.azure\.workload\.identity/client-id=00000000-0000-0000-0000-000000000000 \
36+
--set daemonset.podLabels.azure\.workload\.identity/use=true
37+
```
38+
39+
Note: `storageProvider` is automatically set to Azure when a client ID is provided.
40+
41+
**Fallback with connection string (if managed identity is not available):**
42+
43+
```
44+
helm install core-dump-handler . --create-namespace --namespace observe \
45+
--set daemonset.azureStorageConnectionString='DefaultEndpointsProtocol=https;AccountName=XXX;AccountKey=XXX;EndpointSuffix=core.windows.net' \
46+
--set daemonset.azureStorageContainerName=core-dumps
47+
```
48+
2549
For the following providers an additional option of values should be provided using the `--values` flag
2650

2751
e.g.
@@ -33,6 +57,9 @@ helm install core-dump-handler . --create-namespace --namespace observe \
3357
```
3458

3559
<table><thead><td>Provider</td><td>Product</td><td>Values</td></thead>
60+
<tr>
61+
<td>Microsoft</td><td>AKS with Azure Blob Storage</td><td><a href="values.azure.yaml">values.azure.yaml</a></td>
62+
</tr>
3663
<tr>
3764
<td>AWS</td><td>EKS</td><td><a href="values.aws.yaml">values.aws.yaml</a></td>
3865
</tr>
@@ -234,6 +261,13 @@ The agent pod has the following environment variables and these are all set by t
234261
e.g. --set S3_REGION=host.mycloud.com
235262
236263
See https://github.com/IBM/core-dump-handler/issues/124 for further discussion.
264+
* STORAGE_PROVIDER - Optional explicit backend selector. Supported values are `s3` and `azure`. When omitted, the agent auto-detects Azure if Azure storage settings are present, otherwise it uses S3.
265+
* AZURE_STORAGE_CONNECTION_STRING - Azure Blob Storage connection string. When set, the agent derives account and endpoint settings from it.
266+
* AZURE_STORAGE_ACCOUNT_NAME - Azure storage account name when not using a connection string.
267+
* AZURE_STORAGE_ACCOUNT_KEY - Azure storage account key when not using a connection string.
268+
* AZURE_STORAGE_CONTAINER_NAME - Blob container that receives the uploaded archives.
269+
* AZURE_STORAGE_BLOB_ENDPOINT - Blob service endpoint, for example `https://myaccount.blob.core.windows.net`.
270+
* AZURE_STORAGE_BLOB_PREFIX - Optional virtual folder prefix prepended to each uploaded blob name.
237271
* VENDOR - Some older hosts may require targeted builds for the composer.
238272
239273
default(Default) - A RHEL8 build
@@ -258,6 +292,18 @@ The following secrets are configurable and map to the corresponding environment
258292
259293
key: s3Region
260294
295+
key: azureStorageConnectionString
296+
297+
key: azureStorageAccountName
298+
299+
key: azureStorageAccountKey
300+
301+
key: azureStorageContainerName
302+
303+
key: azureStorageBlobEndpoint
304+
305+
key: azureStorageBlobPrefix
306+
261307
### Values
262308
263309
General
@@ -322,14 +368,21 @@ Daemonset
322368
* useINotify: Maps to the USE_INOTIFY environment variable (Default false)
323369
* DeployCrioConfig: Maps to the DEPLOY_CRIO_CONFIG enviroment variable (Default false)
324370
* includeCrioExe: Maps to the DEPLOY_CRIO_EXE enviroment variable (Default false)
325-
* manageStoreSecret: Defines if the chart will be responsible for creating the S3 environment variables.
371+
* manageStoreSecret: Defines if the chart will be responsible for creating the storage environment variables.
326372
327373
Set to false if you are using an external secrets managment system (Default true)
328374
375+
* storageProvider : Maps to the STORAGE_PROVIDER enviroment variable. Use `azure` to force Azure Blob Storage, `s3` to force S3, or leave empty for autodetection.
329376
* s3AccessKey : Maps to the S3_ACCESS_KEY enviroment variable
330377
* s3Secret : Maps to the S3_SECRET enviroment variable
331378
* s3BucketName : Maps to the S3_BUCKET_NAME enviroment variable
332379
* 3Region : Maps to the S3_REGION enviroment variable
380+
* azureStorageConnectionString : Maps to the AZURE_STORAGE_CONNECTION_STRING environment variable
381+
* azureStorageAccountName : Maps to the AZURE_STORAGE_ACCOUNT_NAME environment variable
382+
* azureStorageAccountKey : Maps to the AZURE_STORAGE_ACCOUNT_KEY environment variable
383+
* azureStorageContainerName : Maps to the AZURE_STORAGE_CONTAINER_NAME environment variable
384+
* azureStorageBlobEndpoint : Maps to the AZURE_STORAGE_BLOB_ENDPOINT environment variable
385+
* azureStorageBlobPrefix : Maps to the AZURE_STORAGE_BLOB_PREFIX environment variable
333386
* extraEnvVars: Option for passing additional configuration to the agent such as endpoint properties.
334387
* envFrom: Array of [EnvFromSource](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.25/#envfromsource-v1-core) to inject into main container.
335388
* sidecarContainers: Array of [Container](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.25/#container-v1-core) to define as part of the pod.

‎charts/core-dump-handler/templates/daemonset.yaml‎

Lines changed: 51 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,9 @@ spec:
1414
metadata:
1515
labels:
1616
name: {{ .Values.daemonset.label }}
17+
{{- with .Values.daemonset.podLabels }}
18+
{{- toYaml . | nindent 8 }}
19+
{{- end }}
1720
annotations:
1821
kubectl.kubernetes.io/default-container: "coredump-container"
1922
{{- with .Values.daemonset.podAnnotations }}
@@ -75,6 +78,16 @@ spec:
7578
value: {{ .Values.daemonset.suidDumpable | quote }}
7679
- name: DEPLOY_CRIO_EXE
7780
value: {{ .Values.daemonset.includeCrioExe | quote }}
81+
- name: STORAGE_PROVIDER
82+
value: {{ .Values.daemonset.storageProvider | quote }}
83+
{{- if .Values.daemonset.azureClientId }}
84+
- name: AZURE_CLIENT_ID
85+
value: {{ .Values.daemonset.azureClientId | quote }}
86+
{{- end }}
87+
{{- if .Values.daemonset.azureTenantId }}
88+
- name: AZURE_TENANT_ID
89+
value: {{ .Values.daemonset.azureTenantId | quote }}
90+
{{- end }}
7891
{{- if .Values.daemonset.manageStoreSecret }}
7992
- name: S3_ACCESS_KEY
8093
valueFrom:
@@ -93,11 +106,49 @@ spec:
93106
secretKeyRef:
94107
name: s3config
95108
key: s3BucketName
109+
optional: true
96110
- name: S3_REGION
97111
valueFrom:
98112
secretKeyRef:
99113
name: s3config
100114
key: s3Region
115+
optional: true
116+
- name: AZURE_STORAGE_CONNECTION_STRING
117+
valueFrom:
118+
secretKeyRef:
119+
name: s3config
120+
key: azureStorageConnectionString
121+
optional: true
122+
- name: AZURE_STORAGE_ACCOUNT_NAME
123+
valueFrom:
124+
secretKeyRef:
125+
name: s3config
126+
key: azureStorageAccountName
127+
optional: true
128+
- name: AZURE_STORAGE_ACCOUNT_KEY
129+
valueFrom:
130+
secretKeyRef:
131+
name: s3config
132+
key: azureStorageAccountKey
133+
optional: true
134+
- name: AZURE_STORAGE_CONTAINER_NAME
135+
valueFrom:
136+
secretKeyRef:
137+
name: s3config
138+
key: azureStorageContainerName
139+
optional: true
140+
- name: AZURE_STORAGE_BLOB_ENDPOINT
141+
valueFrom:
142+
secretKeyRef:
143+
name: s3config
144+
key: azureStorageBlobEndpoint
145+
optional: true
146+
- name: AZURE_STORAGE_BLOB_PREFIX
147+
valueFrom:
148+
secretKeyRef:
149+
name: s3config
150+
key: azureStorageBlobPrefix
151+
optional: true
101152
{{- end }}
102153
- name: VENDOR
103154
value: {{ .Values.daemonset.vendor }}

‎charts/core-dump-handler/templates/secrets.yaml‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,28 @@ stringData:
1111
{{- if .Values.daemonset.s3AccessKey }}
1212
s3AccessKey: {{ .Values.daemonset.s3AccessKey }}
1313
{{- end }}
14+
{{- if .Values.daemonset.s3BucketName }}
1415
s3BucketName: {{ .Values.daemonset.s3BucketName }}
16+
{{- end }}
17+
{{- if .Values.daemonset.s3Region }}
1518
s3Region: {{ .Values.daemonset.s3Region }}
1619
{{- end }}
20+
{{- if .Values.daemonset.azureStorageConnectionString }}
21+
azureStorageConnectionString: {{ .Values.daemonset.azureStorageConnectionString }}
22+
{{- end }}
23+
{{- if .Values.daemonset.azureStorageAccountName }}
24+
azureStorageAccountName: {{ .Values.daemonset.azureStorageAccountName }}
25+
{{- end }}
26+
{{- if .Values.daemonset.azureStorageAccountKey }}
27+
azureStorageAccountKey: {{ .Values.daemonset.azureStorageAccountKey }}
28+
{{- end }}
29+
{{- if .Values.daemonset.azureStorageContainerName }}
30+
azureStorageContainerName: {{ .Values.daemonset.azureStorageContainerName }}
31+
{{- end }}
32+
{{- if .Values.daemonset.azureStorageBlobEndpoint }}
33+
azureStorageBlobEndpoint: {{ .Values.daemonset.azureStorageBlobEndpoint }}
34+
{{- end }}
35+
{{- if .Values.daemonset.azureStorageBlobPrefix }}
36+
azureStorageBlobPrefix: {{ .Values.daemonset.azureStorageBlobPrefix }}
37+
{{- end }}
38+
{{- end }}

‎charts/core-dump-handler/values.azure.yaml‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
# Azure Blob Storage with Managed Identity (recommended)
2+
#
3+
# When AZURE_CLIENT_ID is set, the agent automatically selects Azure Blob Storage
4+
# and authenticates using the managed identity. No need to set storageProvider.
5+
6+
daemonset:
7+
manageStoreSecret: true
8+
azureClientId: "00000000-0000-0000-0000-000000000000"
9+
azureTenantId: "00000000-0000-0000-0000-000000000000"
10+
azureStorageContainerName: core-dumps
11+
azureStorageBlobEndpoint: "https://XXXX.blob.core.windows.net"
12+
13+
# Required for Azure Workload Identity on AKS.
14+
podLabels:
15+
azure.workload.identity/use: "true"
16+
17+
serviceAccount:
18+
annotations:
19+
azure.workload.identity/client-id: "00000000-0000-0000-0000-000000000000"

‎charts/core-dump-handler/values.schema.json‎

Lines changed: 80 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -174,18 +174,61 @@
174174
"properties": {
175175
"manageStoreSecret": {
176176
"const": true
177+
},
178+
"storageProvider": {
179+
"const": "azure"
177180
}
178181
},
179182
"required": [
180-
"manageStoreSecret"
183+
"manageStoreSecret",
184+
"storageProvider"
185+
]
186+
},
187+
"then": {
188+
"required": [
189+
"azureStorageContainerName"
190+
],
191+
"anyOf": [
192+
{
193+
"required": [
194+
"azureStorageConnectionString"
195+
]
196+
},
197+
{
198+
"required": [
199+
"azureStorageAccountName",
200+
"azureStorageAccountKey",
201+
"azureStorageBlobEndpoint"
202+
]
203+
}
181204
]
205+
}
206+
},
207+
{
208+
"if": {
209+
"properties": {
210+
"manageStoreSecret": {
211+
"const": true
212+
}
213+
},
214+
"required": [
215+
"manageStoreSecret"
216+
],
217+
"not": {
218+
"properties": {
219+
"storageProvider": {
220+
"const": "azure"
221+
}
222+
},
223+
"required": [
224+
"storageProvider"
225+
]
226+
}
182227
},
183228
"then": {
184229
"required": [
185-
"s3AccessKey",
186230
"s3BucketName",
187-
"s3Region",
188-
"s3Secret"
231+
"s3Region"
189232
]
190233
}
191234
},
@@ -215,6 +258,12 @@
215258
"type": "string"
216259
}
217260
},
261+
"podLabels": {
262+
"type": "object",
263+
"additionalProperties": {
264+
"type": "string"
265+
}
266+
},
218267
"hostDirectory": {
219268
"type": "string"
220269
},
@@ -230,6 +279,15 @@
230279
"vendor": {
231280
"type": "string"
232281
},
282+
"storageProvider": {
283+
"type": "string"
284+
},
285+
"azureClientId": {
286+
"type": "string"
287+
},
288+
"azureTenantId": {
289+
"type": "string"
290+
},
233291
"interval": {
234292
"type": "integer",
235293
"minimum": 1000
@@ -270,6 +328,24 @@
270328
"s3Region": {
271329
"type": "string"
272330
},
331+
"azureStorageConnectionString": {
332+
"type": "string"
333+
},
334+
"azureStorageAccountName": {
335+
"type": "string"
336+
},
337+
"azureStorageAccountKey": {
338+
"type": "string"
339+
},
340+
"azureStorageContainerName": {
341+
"type": "string"
342+
},
343+
"azureStorageBlobEndpoint": {
344+
"type": "string"
345+
},
346+
"azureStorageBlobPrefix": {
347+
"type": "string"
348+
},
273349
"extraEnvVars": {
274350
"type": "string"
275351
},

0 commit comments

Comments
 (0)