Kubernetes Special Agent - Helm Installation erstellt keine Secrets

martin.hirschvogel · November 14, 2022, 8:52am

Erstmal zu dir Thomas:
Das zweite // kommt dadurch, dass du ein trailing / bei in der values.yaml irgendwo angegeben hast. Damit wird Helm in der Erstellung der Notes nicht einfach so umgehen können. Muss es aber auch nicht, da der Collector auch so richtig erstellt wird.

To test access you can run:
{{- if .Values.clusterCollector.ingress.enabled }}
{{- if $.Values.tlsCommunication.enabled }}
  curl -k -H "Authorization: Bearer $TOKEN" https://{{ (first .Values.clusterCollector.ingress.hosts).host }}{{ (first ((first .Values.clusterCollector.ingress.hosts).paths)).path }}/metadata | jq
{{- else }}
  curl -H "Authorization: Bearer $TOKEN" {{ (first .Values.clusterCollector.ingress.hosts).host }}{{ (first ((first .Values.clusterCollector.ingress.hosts).paths)).path }}/metadata | jq
{{- end }}
{{- if $.Values.networkPolicy.enabled }}
...

github.com

tribe29/checkmk_kube_agent/blob/main/deploy/charts/checkmk/templates/NOTES.txt#L39


      
          {{- if semverCompare ">= 1.24-0" (include "checkmk.kubeVersion" .) }}
          Run the following to create a token and fetch the ca-certificate of the cluster:
            export TOKEN=$(kubectl create token --duration=0s -n {{ .Release.Namespace }} {{ template "checkmk.serviceAccountName.checkmk" . }});
            export CA_CRT="$(kubectl get configmap kube-root-ca.crt -o 'jsonpath={.data.ca\.crt}')";
          {{- else }}
          Run the following to fetch its token and the ca-certificate of the cluster:
            export TOKEN=$(kubectl get secret $(kubectl get serviceaccount {{ template "checkmk.serviceAccountName.checkmk" . }} -o=jsonpath='{.secrets[*].name}' -n {{ .Release.Namespace }}) -n {{ .Release.Namespace }} -o=jsonpath='{.data.token}' | base64 --decode);
            export CA_CRT="$(kubectl get secret $(kubectl get serviceaccount {{ template "checkmk.serviceAccountName.checkmk" . }} -o=jsonpath='{.secrets[*].name}' -n {{ .Release.Namespace }}) -n {{ .Release.Namespace }} -o=jsonpath='{.data.ca\.crt}' | base64 --decode)";
            # Note: Quote the variable when echo'ing to preserve proper line breaks: `echo "$CA_CRT"`
          {{- end }}
          To test access you can run:
          {{- if .Values.clusterCollector.ingress.enabled }}
          {{- if $.Values.tlsCommunication.enabled }}
            curl -k -H "Authorization: Bearer $TOKEN" https://{{ (first .Values.clusterCollector.ingress.hosts).host }}{{ (first ((first .Values.clusterCollector.ingress.hosts).paths)).path }}/metadata | jq
          {{- else }}
            curl -H "Authorization: Bearer $TOKEN" {{ (first .Values.clusterCollector.ingress.hosts).host }}{{ (first ((first .Values.clusterCollector.ingress.hosts).paths)).path }}/metadata | jq
          {{- end }}
          {{- if $.Values.networkPolicy.enabled }}
            NOTE: You have NetworkPolicies enabled, so you need to make sure traffic from your ingress-controller is allowed.
          {{- end }}
          {{- else if contains "NodePort" .Values.clusterCollector.service.type }}