Skip to content

Commit 060705b

Browse files
arikalon1arikalon1
authored
Backend support for CRDs visualization (#1947)
* Backend support for CRDs visualization * Backend support for CRDs visualization * Backend support for CRDs visualization * Backend support for CRDs visualization
1 parent eda0360 commit 060705b

8 files changed

Lines changed: 914 additions & 4 deletions

File tree

‎Dockerfile‎

Lines changed: 14 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -8,11 +8,13 @@ RUN apt-get update \
88
&& pip3 install --no-cache-dir --upgrade pip \
99
&& rm -rf /var/lib/apt/lists/*
1010

11-
ENV ENV_TYPE=DEV
12-
1311
RUN mkdir /app
1412
WORKDIR /app
1513

14+
RUN curl -fsSL https://pkgs.k8s.io/core:/stable:/v1.33/deb/Release.key -o /app/Release.key
15+
16+
ENV ENV_TYPE=DEV
17+
1618
# Create and activate virtual environment
1719
RUN python -m venv /app/venv --upgrade-deps && \
1820
. /app/venv/bin/activate
@@ -67,7 +69,7 @@ WORKDIR /app
6769
RUN apt-get update \
6870
&& dpkg --add-architecture arm64 \
6971
&& pip3 install --no-cache-dir --upgrade pip \
70-
&& apt-get install -y --no-install-recommends git ssh curl libcairo2 \
72+
&& apt-get install -y --no-install-recommends git ssh curl libcairo2 apt-transport-https gnupg2 \
7173
&& apt-get install -y --no-install-recommends libexpat1 \
7274
&& rm -rf /var/lib/apt/lists/*
7375

@@ -84,6 +86,15 @@ COPY --from=builder /etc/robusta/playbooks/defaults /etc/robusta/playbooks/defau
8486
# Copy virtual environment and application files from the build stage
8587
COPY --from=builder /app /app
8688

89+
# Set up kubectl
90+
COPY --from=builder /app/Release.key /tmp/Release.key
91+
RUN cat /tmp/Release.key | gpg --dearmor -o /etc/apt/keyrings/kubernetes-apt-keyring.gpg \
92+
&& echo 'deb [signed-by=/etc/apt/keyrings/kubernetes-apt-keyring.gpg] https://pkgs.k8s.io/core:/stable:/v1.33/deb/ /' | tee /etc/apt/sources.list.d/kubernetes.list \
93+
&& apt-get update \
94+
&& apt-get install -y kubectl \
95+
&& rm -rf /var/lib/apt/lists/* \
96+
&& rm /tmp/Release.key
97+
8798
# Run the application
8899
# -u disables stdout buffering https://stackoverflow.com/questions/107705/disable-output-buffering
89100
CMD [ "python3", "-u", "-m", "robusta.runner.main"]

‎docs/index.rst‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -130,6 +130,7 @@
130130

131131
configuration/exporting/robusta-pro-features
132132
setup-robusta/alertsui
133+
setup-robusta/crds
133134
configuration/exporting/send-alerts-api
134135
configuration/exporting/configuration-changes-api
135136
configuration/exporting/alert-export-api

‎docs/setup-robusta/crds.rst‎

Lines changed: 123 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,123 @@
1+
=============================================
2+
Custom Resource Definitions (CRDs) Monitoring
3+
=============================================
4+
5+
Overview
6+
--------
7+
8+
The CRDs monitoring feature enables you to view and manage Custom Resource Definitions and their instances directly from the Robusta UI. This powerful feature provides visibility into:
9+
10+
* All CRDs deployed in your clusters
11+
* Individual CR (Custom Resource) instances and their status
12+
* Resource events and history
13+
* Full YAML manifests
14+
* Detailed resource descriptions
15+
16+
Prerequisites
17+
-------------
18+
19+
To enable CRD monitoring, the Robusta agent needs appropriate permissions to read custom resources in your cluster. This requires adding cluster role rules to your Robusta configuration.
20+
21+
Configuration
22+
-------------
23+
24+
Basic Configuration
25+
^^^^^^^^^^^^^^^^^^^
26+
27+
Specify read permissions for the CRDs you need to monitor:
28+
29+
.. code-block:: yaml
30+
31+
runner:
32+
customClusterRoleRules:
33+
- apiGroups:
34+
- "cert-manager.io"
35+
resources:
36+
- "certificates"
37+
- "certificaterequests"
38+
- "issuers"
39+
- "clusterissuers"
40+
verbs:
41+
- "list"
42+
- "get"
43+
- apiGroups:
44+
- "acme.cert-manager.io"
45+
resources:
46+
- "challenges"
47+
- "orders"
48+
verbs:
49+
- "list"
50+
- "get"
51+
52+
Applying the Configuration
53+
^^^^^^^^^^^^^^^^^^^^^^^^^^^
54+
55+
1. Update your ``values.yaml`` file with the desired configuration
56+
2. Apply the changes using Helm:
57+
58+
.. code-block:: bash
59+
60+
helm upgrade robusta robusta/robusta \
61+
--values values.yaml \
62+
--namespace robusta \
63+
--reuse-values
64+
65+
Automatic Configuration with Holmes AI
66+
---------------------------------------
67+
68+
Instead of manually configuring permissions for each CRD, you can use Holmes AI to automatically generate the configuration for all CRDs in your cluster.
69+
70+
Using Holmes to Generate Configuration
71+
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
72+
73+
1. Navigate to the **Holmes Ask** page in the Robusta UI
74+
2. Use the following prompt:
75+
76+
.. code-block:: text
77+
78+
I want to add read only cluster roles for all the crds in my cluster.
79+
This is the format for adding one:
80+
runner:
81+
customClusterRoleRules:
82+
- apiGroups:
83+
- "storage.k8s.io"
84+
resources:
85+
- "storageclasses"
86+
verbs:
87+
- "list"
88+
- "get"
89+
Prepare my config
90+
91+
3. Holmes will analyze your cluster and generate a complete configuration including all CRDs
92+
4. Copy the generated configuration and add it to your ``values.yaml``
93+
5. Apply the configuration using Helm as described above
94+
95+
.. tip::
96+
After Holmes generates the configuration, you can review and modify it to remove any CRDs you don't want to monitor before applying it.
97+
98+
Troubleshooting
99+
---------------
100+
101+
Common Issues and Solutions
102+
^^^^^^^^^^^^^^^^^^^^^^^^^^^^
103+
104+
**Issue 1: CRDs not appearing in UI**
105+
106+
* **Check permissions**: Verify the ClusterRole has the correct permissions
107+
108+
.. code-block:: bash
109+
110+
kubectl get clusterrole robusta-runner -o yaml
111+
112+
* **Check agent logs**: Look for permission errors
113+
114+
.. code-block:: bash
115+
116+
kubectl logs -n robusta deployment/robusta-runner | grep -i "forbidden"
117+
118+
**Issue 2: "Forbidden" errors when accessing CRDs**
119+
120+
* **Solution**: Add the specific apiGroup and resource to ``customClusterRoleRules``
121+
* **Example error**: ``cannot get resource "certificates" in API group "cert-manager.io"``
122+
* **Fix**: Add the cert-manager.io apiGroup with certificates resource
123+

‎helm/robusta/templates/runner-service-account.yaml‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,14 @@ rules:
77
{{- if .Values.runner.customClusterRoleRules }}
88
{{ toYaml .Values.runner.customClusterRoleRules | indent 2 }}
99
{{- end }}
10+
- apiGroups:
11+
- "apiextensions.k8s.io"
12+
resources:
13+
- "customresourcedefinitions"
14+
verbs:
15+
- "list"
16+
- "get"
17+
1018
- apiGroups:
1119
- ""
1220
resources:

‎helm/robusta/values.yaml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -92,6 +92,11 @@ lightActions:
9292
- holmes_chat
9393
- holmes_workload_chat
9494
- list_pods
95+
- kubectl_describe
96+
- fetch_resource_yaml
97+
- fetch_resource_events
98+
- fetch_crds
99+
- fetch_cr_instances
95100

96101
# install prometheus, alert-manager, and grafana along with Robusta?
97102
enablePrometheusStack: false

‎src/robusta/core/model/env_vars.py‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -140,4 +140,6 @@ def load_bool(env_var, default: bool):
140140

141141
# enable custom CRDs supported by robusta "["StrimziPodSet", "Cluster"]"
142142
CUSTOM_CRD = json.loads(os.environ.get("CUSTOM_CRD", "[]"))
143-
SET_KRR_SECURITY_CONTEXT = load_bool("SET_KRR_SECURITY_CONTEXT", False)
143+
SET_KRR_SECURITY_CONTEXT = load_bool("SET_KRR_SECURITY_CONTEXT", False)
144+
145+
KUBECTL_CMD_TIMEOUT_SEC=int(os.environ.get("KUBECTL_CMD_TIMEOUT_SEC", 180))

0 commit comments

Comments
 (0)