From 54e48a802c2704996b5f5715c87a0c6ee3bbc7b5 Mon Sep 17 00:00:00 2001 From: paul foster Date: Tue, 24 Mar 2026 13:56:25 +1100 Subject: [PATCH] added acm spoke hub clusters --- .../network-observability-operator/Chart.yaml | 6 +- .../templates/flowcollector.yaml | 94 +++++++++++- .../templates/loki-namespace.yaml | 10 ++ .../templates/loki-s3-externalsecret.yaml | 35 +++++ .../templates/lokistack.yaml | 33 ++++ .../templates/operatorgroup.yaml | 4 +- .../templates/subscription.yaml | 29 ++-- .../values.yaml | 143 +++++++++++++++++- 8 files changed, 331 insertions(+), 23 deletions(-) create mode 100644 charts/network-observability-operator/templates/loki-namespace.yaml create mode 100644 charts/network-observability-operator/templates/loki-s3-externalsecret.yaml create mode 100644 charts/network-observability-operator/templates/lokistack.yaml diff --git a/charts/network-observability-operator/Chart.yaml b/charts/network-observability-operator/Chart.yaml index 78af014..f9224b4 100644 --- a/charts/network-observability-operator/Chart.yaml +++ b/charts/network-observability-operator/Chart.yaml @@ -1,13 +1,13 @@ apiVersion: v2 name: network-observability-operator -description: Helm chart for deploying the Network Observability Operator for network traffic flow monitoring +description: Helm chart for deploying the Network Observability Operator with Loki-backed flow storage type: application -version: 1.0.2 +version: 2.0.0 appVersion: "1.11" dependencies: - name: helper-status-checker version: 4.4.3 - repository: https://rosa-hcp-dedicated-vpc.github.io/helm-repository/ + repository: https://rh-mobb.github.io/validated-pattern-helm-charts/ condition: helper-status-checker.enabled maintainers: - name: rh-mobb diff --git a/charts/network-observability-operator/templates/flowcollector.yaml b/charts/network-observability-operator/templates/flowcollector.yaml index 6c9167a..9269acb 100644 --- a/charts/network-observability-operator/templates/flowcollector.yaml +++ b/charts/network-observability-operator/templates/flowcollector.yaml @@ -10,7 +10,99 @@ spec: namespace: {{ .Values.flowCollector.namespace }} deploymentModel: {{ .Values.flowCollector.deploymentModel }} agent: - type: eBPF + type: {{ .Values.flowCollector.agent.type }} ebpf: sampling: {{ .Values.flowCollector.agent.sampling }} + cacheActiveTimeout: {{ .Values.flowCollector.agent.cacheActiveTimeout }} + cacheMaxFlows: {{ .Values.flowCollector.agent.cacheMaxFlows }} + logLevel: {{ .Values.flowCollector.agent.logLevel }} + imagePullPolicy: IfNotPresent + excludeInterfaces: + - lo + resources: + {{- toYaml .Values.flowCollector.agent.resources | nindent 8 }} + metrics: + server: + port: 9400 + tls: + insecureSkipVerify: false + type: Disabled + {{- if and .Values.flowCollector.loki.enable .Values.lokiStack.enabled }} + loki: + enable: true + mode: {{ .Values.flowCollector.loki.mode }} + {{- if eq .Values.flowCollector.loki.mode "LokiStack" }} + lokiStack: + name: {{ .Values.lokiStack.name }} + namespace: {{ .Values.lokiStack.namespace }} + {{- end }} + advanced: + {{- toYaml .Values.flowCollector.loki.advanced | nindent 6 }} + writeBatchSize: {{ .Values.flowCollector.loki.writeBatchSize | int64 }} + writeBatchWait: {{ .Values.flowCollector.loki.writeBatchWait }} + readTimeout: {{ .Values.flowCollector.loki.readTimeout }} + writeTimeout: {{ .Values.flowCollector.loki.writeTimeout }} + {{- else }} + loki: + enable: false + {{- end }} + consolePlugin: + enable: {{ .Values.flowCollector.consolePlugin.enable }} + advanced: + port: 9001 + register: {{ .Values.flowCollector.consolePlugin.register }} + logLevel: {{ .Values.flowCollector.consolePlugin.logLevel }} + imagePullPolicy: IfNotPresent + replicas: {{ .Values.flowCollector.consolePlugin.replicas }} + resources: + {{- toYaml .Values.flowCollector.consolePlugin.resources | nindent 6 }} + portNaming: + enable: {{ .Values.flowCollector.consolePlugin.portNaming.enable }} + portNames: + {{- toYaml .Values.flowCollector.consolePlugin.portNaming.portNames | nindent 8 }} + quickFilters: + {{- toYaml .Values.flowCollector.consolePlugin.quickFilters | nindent 6 }} + autoscaler: + maxReplicas: 3 + metrics: + - type: Resource + resource: + name: cpu + target: + type: Utilization + averageUtilization: 50 + minReplicas: 1 + status: Disabled + processor: + logLevel: {{ .Values.flowCollector.processor.logLevel }} + logTypes: {{ .Values.flowCollector.processor.logTypes }} + imagePullPolicy: IfNotPresent + resources: + {{- toYaml .Values.flowCollector.processor.resources | nindent 6 }} + advanced: + conversationEndTimeout: {{ .Values.flowCollector.processor.advanced.conversationEndTimeout }} + conversationHeartbeatInterval: {{ .Values.flowCollector.processor.advanced.conversationHeartbeatInterval }} + conversationTerminatingTimeout: {{ .Values.flowCollector.processor.advanced.conversationTerminatingTimeout }} + dropUnusedFields: {{ .Values.flowCollector.processor.advanced.dropUnusedFields }} + enableKubeProbes: true + healthPort: 8080 + port: 2055 + profilePort: 6060 + metrics: + disableAlerts: [] + server: + port: 9401 + tls: + insecureSkipVerify: false + type: Disabled + multiClusterDeployment: false + prometheus: + querier: + enable: {{ .Values.flowCollector.prometheus.querier.enable }} + mode: {{ .Values.flowCollector.prometheus.querier.mode }} + timeout: {{ .Values.flowCollector.prometheus.querier.timeout }} + exporters: [] + networkPolicy: + additionalNamespaces: [] + enable: false {{- end }} diff --git a/charts/network-observability-operator/templates/loki-namespace.yaml b/charts/network-observability-operator/templates/loki-namespace.yaml new file mode 100644 index 0000000..adbe78a --- /dev/null +++ b/charts/network-observability-operator/templates/loki-namespace.yaml @@ -0,0 +1,10 @@ +{{- if .Values.lokiStack.enabled }} +apiVersion: v1 +kind: Namespace +metadata: + name: {{ .Values.lokiStack.namespace }} + labels: + openshift.io/cluster-monitoring: "true" + annotations: + argocd.argoproj.io/sync-wave: "-1" +{{- end }} diff --git a/charts/network-observability-operator/templates/loki-s3-externalsecret.yaml b/charts/network-observability-operator/templates/loki-s3-externalsecret.yaml new file mode 100644 index 0000000..ee9fb3e --- /dev/null +++ b/charts/network-observability-operator/templates/loki-s3-externalsecret.yaml @@ -0,0 +1,35 @@ +{{- if and .Values.lokiStack.enabled .Values.externalSecret.enabled }} +apiVersion: external-secrets.io/v1beta1 +kind: ExternalSecret +metadata: + name: {{ .Values.lokiStack.storage.secretName }} + namespace: {{ .Values.lokiStack.namespace }} + annotations: + argocd.argoproj.io/sync-wave: "4" + argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true +spec: + refreshInterval: 1h + secretStoreRef: + name: {{ .Values.externalSecret.secretStore }} + kind: ClusterSecretStore + target: + name: {{ .Values.lokiStack.storage.secretName }} + creationPolicy: Owner + data: + - secretKey: audience + remoteRef: + key: {{ .Values.externalSecret.remoteKey }} + property: audience + - secretKey: bucketnames + remoteRef: + key: {{ .Values.externalSecret.remoteKey }} + property: bucketnames + - secretKey: region + remoteRef: + key: {{ .Values.externalSecret.remoteKey }} + property: region + - secretKey: role_arn + remoteRef: + key: {{ .Values.externalSecret.remoteKey }} + property: role_arn +{{- end }} diff --git a/charts/network-observability-operator/templates/lokistack.yaml b/charts/network-observability-operator/templates/lokistack.yaml new file mode 100644 index 0000000..3b9440b --- /dev/null +++ b/charts/network-observability-operator/templates/lokistack.yaml @@ -0,0 +1,33 @@ +{{- if .Values.lokiStack.enabled }} +apiVersion: loki.grafana.com/v1 +kind: LokiStack +metadata: + name: {{ .Values.lokiStack.name }} + namespace: {{ .Values.lokiStack.namespace }} + annotations: + argocd.argoproj.io/sync-wave: "5" + argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true +spec: + size: {{ .Values.lokiStack.size }} + storage: + schemas: + - effectiveDate: {{ .Values.lokiStack.storage.schemaEffectiveDate | quote }} + version: {{ .Values.lokiStack.storage.schemaVersion }} + secret: + name: {{ .Values.lokiStack.storage.secretName }} + type: {{ .Values.lokiStack.storage.secretType }} + credentialMode: {{ .Values.lokiStack.credentialMode }} + storageClassName: {{ .Values.lokiStack.storageClassName }} + tenants: + mode: {{ .Values.lokiStack.tenants.mode }} + {{- if .Values.lokiStack.limits }} + limits: + {{- if .Values.lokiStack.limits.global }} + global: + {{- if .Values.lokiStack.limits.global.queries }} + queries: + {{- toYaml .Values.lokiStack.limits.global.queries | nindent 8 }} + {{- end }} + {{- end }} + {{- end }} +{{- end }} diff --git a/charts/network-observability-operator/templates/operatorgroup.yaml b/charts/network-observability-operator/templates/operatorgroup.yaml index 47af560..8dff8fa 100644 --- a/charts/network-observability-operator/templates/operatorgroup.yaml +++ b/charts/network-observability-operator/templates/operatorgroup.yaml @@ -2,8 +2,8 @@ apiVersion: operators.coreos.com/v1 kind: OperatorGroup metadata: - name: {{ .Values.operatorGroup.name | default .Values.subscription.name }} - namespace: {{ .Values.namespace }} + name: {{ .Values.operatorGroup.name }} + namespace: {{ .Values.operatorGroup.namespace }} annotations: argocd.argoproj.io/sync-wave: "0" spec: diff --git a/charts/network-observability-operator/templates/subscription.yaml b/charts/network-observability-operator/templates/subscription.yaml index febc038..f6e17fd 100644 --- a/charts/network-observability-operator/templates/subscription.yaml +++ b/charts/network-observability-operator/templates/subscription.yaml @@ -1,16 +1,27 @@ +{{- range .Values.subscriptions }} +{{- if .enabled }} +--- apiVersion: operators.coreos.com/v1alpha1 kind: Subscription metadata: - name: {{ .Values.subscription.name }} - namespace: {{ .Values.namespace }} + name: {{ .name }} + namespace: {{ .namespace }} annotations: argocd.argoproj.io/sync-wave: "0" spec: - channel: {{ .Values.subscription.channel }} - installPlanApproval: {{ .Values.subscription.installPlanApproval }} - name: {{ .Values.subscription.name }} - source: {{ .Values.subscription.source }} - sourceNamespace: {{ .Values.subscription.sourceNamespace }} - {{- if .Values.subscription.startingCSV }} - startingCSV: {{ .Values.subscription.startingCSV }} + channel: {{ .channel }} + installPlanApproval: {{ .installPlanApproval }} + name: {{ .name }} + source: {{ .source }} + sourceNamespace: {{ .sourceNamespace }} + {{- if .startingCSV }} + startingCSV: {{ .startingCSV }} {{- end }} + {{- if .roleArn }} + config: + env: + - name: ROLEARN + value: {{ .roleArn }} + {{- end }} +{{- end }} +{{- end }} diff --git a/charts/network-observability-operator/values.yaml b/charts/network-observability-operator/values.yaml index 9f0ca8f..0ea4215 100644 --- a/charts/network-observability-operator/values.yaml +++ b/charts/network-observability-operator/values.yaml @@ -1,30 +1,157 @@ namespace: openshift-netobserv-operator -subscription: - name: netobserv-operator - channel: stable - installPlanApproval: Manual - source: redhat-operators - sourceNamespace: openshift-marketplace - startingCSV: "" +subscriptions: + - name: netobserv-operator + namespace: openshift-netobserv-operator + channel: stable + installPlanApproval: Manual + source: redhat-operators + sourceNamespace: openshift-marketplace + startingCSV: "" + enabled: true + - name: loki-operator + namespace: openshift-operators-redhat + channel: stable-6.2 + installPlanApproval: Manual + source: redhat-operators + sourceNamespace: openshift-marketplace + startingCSV: loki-operator.v6.2.0 + enabled: true + roleArn: "" operatorGroup: create: true + name: netobserv-operator + namespace: openshift-netobserv-operator + +# Loki Stack configuration +lokiStack: + enabled: true + name: loki + namespace: netobserv + size: "1x.demo" + storageClassName: gp3-csi + credentialMode: token + storage: + secretName: loki-s3 + secretType: s3 + schemaVersion: v13 + schemaEffectiveDate: "2023-10-15" + tenants: + mode: openshift-network + limits: + global: + queries: + maxQuerySeries: 2000 +# S3 object storage configuration +objectStorage: + s3: + bucketName: "" + region: ap-southeast-4 + audience: openshift + +# External Secrets Operator configuration for Loki S3 secret +externalSecret: + enabled: true + secretStore: connectivity-link-cluster-secret-store + remoteKey: "" + +# FlowCollector configuration flowCollector: enabled: true namespace: netobserv deploymentModel: Direct agent: + type: eBPF sampling: 50 + cacheActiveTimeout: 5s + cacheMaxFlows: 100000 + logLevel: info + resources: + limits: + memory: 800Mi + requests: + cpu: 100m + memory: 50Mi + loki: + enable: true + mode: LokiStack + advanced: + staticLabels: + app: netobserv-flowcollector + writeMaxBackoff: 5s + writeMaxRetries: 2 + writeMinBackoff: 1s + writeBatchSize: 10485760 + writeBatchWait: 1s + readTimeout: 30s + writeTimeout: 10s + consolePlugin: + enable: true + register: true + logLevel: info + replicas: 1 + resources: + limits: + memory: 100Mi + requests: + cpu: 100m + memory: 50Mi + portNaming: + enable: true + portNames: + "3100": loki + quickFilters: + - name: Applications + default: true + filter: + flow_layer: '"app"' + - name: Infrastructure + filter: + flow_layer: '"infra"' + - name: Pods network + default: true + filter: + src_kind: '"Pod"' + dst_kind: '"Pod"' + - name: Services network + filter: + dst_kind: '"Service"' + processor: + logLevel: info + logTypes: Flows + resources: + limits: + memory: 800Mi + requests: + cpu: 100m + memory: 100Mi + advanced: + conversationEndTimeout: 10s + conversationHeartbeatInterval: 30s + conversationTerminatingTimeout: 5s + dropUnusedFields: true + prometheus: + querier: + enable: true + mode: Auto + timeout: 30s +# Status checker for both operators helper-status-checker: enabled: true approver: true checks: - - operatorName: netobserv-operator + - operatorName: network-observability-operator subscriptionName: netobserv-operator namespace: name: openshift-netobserv-operator serviceAccount: name: "netobserv-install-check" + - operatorName: loki-operator + subscriptionName: loki-operator + namespace: + name: openshift-operators-redhat + serviceAccount: + name: "loki-install-check"