From e6f281aa4de18d5ba1aa10aa36da9796c3b22a47 Mon Sep 17 00:00:00 2001 From: Panos Koutsovasilis Date: Wed, 30 Oct 2024 15:33:57 +0200 Subject: [PATCH] [helm]: implement system integration as chart built-in (#5855) * feat: implement system integration as chart built-in * feat: restructure logs streams in system integration to allow passing user-supplied vars * doc: add an example of system integration * feat: add missing rendered file for system integration example --- deploy/helm/elastic-agent/README.md | 18 +- deploy/helm/elastic-agent/examples/README.md | 1 + .../system-custom-auth-paths/README.md | 25 ++ .../agent-system-values.yaml | 13 + .../rendered/manifest.yaml | 399 ++++++++++++++++++ deploy/helm/elastic-agent/templates/NOTES.txt | 3 + .../templates/agent/_helpers.tpl | 1 + .../integrations/_system/_system.tpl | 6 + .../integrations/_system/_system_logs.tpl | 71 ++++ .../integrations/_system/_system_metrics.tpl | 103 +++++ deploy/helm/elastic-agent/values.schema.json | 106 ++++- deploy/helm/elastic-agent/values.yaml | 61 ++- 12 files changed, 788 insertions(+), 19 deletions(-) create mode 100644 deploy/helm/elastic-agent/examples/system-custom-auth-paths/README.md create mode 100644 deploy/helm/elastic-agent/examples/system-custom-auth-paths/agent-system-values.yaml create mode 100644 deploy/helm/elastic-agent/examples/system-custom-auth-paths/rendered/manifest.yaml create mode 100644 deploy/helm/elastic-agent/templates/integrations/_system/_system.tpl create mode 100644 deploy/helm/elastic-agent/templates/integrations/_system/_system_logs.tpl create mode 100644 deploy/helm/elastic-agent/templates/integrations/_system/_system_metrics.tpl diff --git a/deploy/helm/elastic-agent/README.md b/deploy/helm/elastic-agent/README.md index 3cde27d9ccc..9afcf8625e1 100644 --- a/deploy/helm/elastic-agent/README.md +++ b/deploy/helm/elastic-agent/README.md @@ -123,12 +123,24 @@ The chart built-in [kubernetes integration](https://docs.elastic.co/integrations | kubernetes.system.metrics.enabled | bool | `true` | enable system metric stream (kubelet) [ref](https://www.elastic.co/docs/current/integrations/kubernetes/kubelet#system) | | kubernetes.system.metrics.vars | object | `{}` | system metric stream vars | -### 3 - User Extra Integrations +### 4 - System integration +| Key | Type | Default | Description | +|-----|------|---------|-------------| +| system.enabled | bool | `false` | enable System integration. | +| system.output | string | `"default"` | name of the output used in System integration. Note that this output needs to be defined in [outputs](#1-outputs) | +| system.namespace | string | `"default"` | output namespace | +| system.authLogs.enabled | bool | `true` | enable auth logs | +| system.authLogs.vars | object | `{}` | override default variables of auth logs stream. Look in the [values.schema.json](values.schema.json) to see the available variables | +| system.syslog.enabled | bool | `true` | enable syslog | +| system.syslog.vars | object | `{}` | override default variables of syslog stream. Look in the [values.schema.json](values.schema.json) to see the available variables | +| system.metrics.enabled | bool | `true` | enable metrics | + +### 5 - User Extra Integrations | Key | Type | Default | Description | |-----|------|---------|-------------| | extraIntegrations | object | `{}` | extra [user-defined integrations](https://www.elastic.co/guide/en/fleet/current/elastic-agent-input-configuration.html) to be added to the Elastic Agent An example can be found [here](./examples/nginx-custom-integration/README.md) | -### 3 - Elastic-Agent Configuration +### 6 - Elastic-Agent Configuration | Key | Type | Default | Description | |-----|------|---------|-------------| | agent.version | string | `"9.0.0"` | elastic-agent version | @@ -138,7 +150,7 @@ The chart built-in [kubernetes integration](https://docs.elastic.co/integrations | agent.unprivileged | bool | `false` | enable unprivileged mode | | agent.presets | map[string]{} | `{ "perNode" : {...}, "clusterWide": {...}, "ksmSharded": {...} }` | Map of deployment presets for the Elastic Agent. The key of the map is the name of the preset. See more for the presets required by the built-in Kubernetes integration [here](./values.yaml) | -### 3.1 - Elastic-Agent Managed Configuration +### 6.1 - Elastic-Agent Managed Configuration | Key | Type | Default | Description | |-----|------|---------|-------------| | agent.fleet.enabled | bool | `false` | enable elastic-agent managed | diff --git a/deploy/helm/elastic-agent/examples/README.md b/deploy/helm/elastic-agent/examples/README.md index 198819db953..7c0963b94f7 100644 --- a/deploy/helm/elastic-agent/examples/README.md +++ b/deploy/helm/elastic-agent/examples/README.md @@ -3,6 +3,7 @@ Here is a collection of example configurations for the eck-integrations chart. - [Kubernetes - defaults](kubernetes-default/README.md) +- [System - custom authlogs path](kubernetes-default/README.md) - [Kubernetes - only container logs](kubernetes-only-logs/README.md) - [Kubernetes - only hints autodiscover](kubernetes-hints-autodiscover/README.md) - [Custom Integration - nginx](nginx-custom-integration/README.md) diff --git a/deploy/helm/elastic-agent/examples/system-custom-auth-paths/README.md b/deploy/helm/elastic-agent/examples/system-custom-auth-paths/README.md new file mode 100644 index 00000000000..69f45ba1429 --- /dev/null +++ b/deploy/helm/elastic-agent/examples/system-custom-auth-paths/README.md @@ -0,0 +1,25 @@ +# Example: System Integration with custom auth log paths + +In this example we install the built-in `system` integration and specify custom paths for the auth logs stream (see [agent-system-values.yaml](agent-system-values.yaml)). + +## Prerequisites: +1. A k8s secret that contains the connection details to an Elasticsearch cluster such as the URL and the API key ([Kibana - Creating API Keys](https://www.elastic.co/guide/en/kibana/current/api-keys.html)): + ```console + kubectl create secret generic es-api-secret \ + --from-literal=api_key=... \ + --from-literal=url=... + ``` + +2. `system` integration assets installed through Kibana ([Kibana - Install and uninstall Elastic Agent integration assets](https://www.elastic.co/guide/en/fleet/current/install-uninstall-integration-assets.html)) + +## Run: +```console +helm install elastic-agent ../../ \ + -f ./agent-system-values.yaml \ + --set outputs.default.type=ESSecretAuthAPI \ + --set outputs.default.secretName=es-api-secret +``` + +## Validate: + +1. The Kibana `system`-related dashboards should start showing up the respective info. diff --git a/deploy/helm/elastic-agent/examples/system-custom-auth-paths/agent-system-values.yaml b/deploy/helm/elastic-agent/examples/system-custom-auth-paths/agent-system-values.yaml new file mode 100644 index 00000000000..52615a36cb5 --- /dev/null +++ b/deploy/helm/elastic-agent/examples/system-custom-auth-paths/agent-system-values.yaml @@ -0,0 +1,13 @@ +system: + enabled: true + authLogs: + vars: + paths: + - /var/log/custom_auth.log + syslog: + vars: + paths: + - /var/log/custom_syslog.log + +agent: + unprivileged: true diff --git a/deploy/helm/elastic-agent/examples/system-custom-auth-paths/rendered/manifest.yaml b/deploy/helm/elastic-agent/examples/system-custom-auth-paths/rendered/manifest.yaml new file mode 100644 index 00000000000..12e861df54d --- /dev/null +++ b/deploy/helm/elastic-agent/examples/system-custom-auth-paths/rendered/manifest.yaml @@ -0,0 +1,399 @@ +--- +# Source: elastic-agent/templates/agent/service-account.yaml +apiVersion: v1 +kind: ServiceAccount +metadata: + name: agent-pernode-example + namespace: "default" + labels: + helm.sh/chart: elastic-agent-0.0.1 + app.kubernetes.io/name: elastic-agent + app.kubernetes.io/instance: example + app.kubernetes.io/version: 9.0.0 + app.kubernetes.io/managed-by: Helm +--- +# Source: elastic-agent/templates/agent/k8s/secret.yaml +apiVersion: v1 +kind: Secret +metadata: + name: agent-pernode-example + namespace: "default" + labels: + helm.sh/chart: elastic-agent-0.0.1 + app.kubernetes.io/name: elastic-agent + app.kubernetes.io/instance: example + app.kubernetes.io/version: 9.0.0 + app.kubernetes.io/managed-by: Helm +stringData: + + agent.yml: |- + id: agent-pernode-example + outputs: + default: + hosts: + - http://elasticsearch:9200 + password: changeme + type: elasticsearch + username: elastic + secret_references: [] + agent: + monitoring: + enabled: true + logs: true + metrics: true + namespace: default + use_output: default + providers: + kubernetes: + node: ${NODE_NAME} + scope: node + kubernetes_leaderelection: + enabled: false + inputs: + - data_stream: + namespace: default + id: system-logs + streams: + - data_stream: + dataset: system.auth + type: logs + exclude_files: + - \.gz$ + ignore_older: 72h + multiline: + match: after + pattern: ^\s + paths: + - /var/log/custom_auth.log + processors: + - add_locale: null + tags: + - system-auth + - data_stream: + dataset: system.syslog + type: logs + exclude_files: + - \.gz$ + ignore_older: 72h + multiline: + match: after + pattern: ^\s + paths: + - /var/log/custom_syslog.log + processors: + - add_locale: null + tags: null + type: logfile + use_output: default + - data_stream: + namespace: default + id: system-metrics + streams: + - cpu.metrics: + - percentages + - normalized_percentages + data_stream: + dataset: system.cpu + type: metrics + metricsets: + - cpu + period: 10s + - data_stream: + dataset: system.diskio + type: metrics + diskio.include_devices: null + metricsets: + - diskio + period: 10s + - data_stream: + dataset: system.filesystem + type: metrics + metricsets: + - filesystem + period: 1m + processors: + - drop_event.when.regexp: + system.filesystem.mount_point: ^/(sys|cgroup|proc|dev|etc|host|lib|snap)($|/) + - data_stream: + dataset: system.fsstat + type: metrics + metricsets: + - fsstat + period: 1m + processors: + - drop_event.when.regexp: + system.fsstat.mount_point: ^/(sys|cgroup|proc|dev|etc|host|lib|snap)($|/) + - condition: ${host.platform} != 'windows' + data_stream: + dataset: system.load + type: metrics + metricsets: + - load + period: 10s + - data_stream: + dataset: system.memory + type: metrics + metricsets: + - memory + period: 10s + - data_stream: + dataset: system.network + type: metrics + metricsets: + - network + network.interfaces: null + period: 10s + - data_stream: + dataset: system.process + type: metrics + metricsets: + - process + period: 10s + process.cgroups.enabled: false + process.cmdline.cache.enabled: true + process.include_cpu_ticks: false + process.include_top_n.by_cpu: 5 + process.include_top_n.by_memory: 5 + processes: + - .* + - data_stream: + dataset: system.process_summary + type: metrics + metricsets: + - process_summary + period: 10s + - data_stream: + dataset: system.socket_summary + type: metrics + metricsets: + - socket_summary + period: 10s + - data_stream: + dataset: system.uptime + type: metrics + metricsets: + - uptime + period: 10s + type: system/metrics + use_output: default +--- +# Source: elastic-agent/templates/agent/cluster-role.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: agent-perNode-example-default + labels: + helm.sh/chart: elastic-agent-0.0.1 + app.kubernetes.io/name: elastic-agent + app.kubernetes.io/instance: example + app.kubernetes.io/version: 9.0.0 + app.kubernetes.io/managed-by: Helm +rules: + - apiGroups: [ "" ] # "" indicates the core API group + resources: + - nodes + - namespaces + - events + - pods + - services + - configmaps + - persistentvolumes + - persistentvolumeclaims + - persistentvolumeclaims/status + - nodes/metrics + - nodes/proxy + - nodes/stats + verbs: + - get + - watch + - list + - apiGroups: + - storage.k8s.io + resources: + - storageclasses + verbs: + - get + - watch + - list + - nonResourceURLs: + - /metrics + verbs: + - get + - watch + - list + - apiGroups: [ "coordination.k8s.io" ] + resources: + - leases + verbs: + - get + - create + - update + - nonResourceURLs: + - /healthz + - /healthz/* + - /livez + - /livez/* + - /metrics + - /metrics/slis + - /readyz + - /readyz/* + verbs: + - get + - apiGroups: [ "apps" ] + resources: + - replicasets + - deployments + - daemonsets + - statefulsets + verbs: + - get + - list + - watch + - apiGroups: [ "batch" ] + resources: + - jobs + - cronjobs + verbs: + - get + - list + - watch +--- +# Source: elastic-agent/templates/agent/cluster-role-binding.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: agent-perNode-example-default + labels: + helm.sh/chart: elastic-agent-0.0.1 + app.kubernetes.io/name: elastic-agent + app.kubernetes.io/instance: example + app.kubernetes.io/version: 9.0.0 + app.kubernetes.io/managed-by: Helm +subjects: + - kind: ServiceAccount + name: agent-pernode-example + namespace: "default" +roleRef: + kind: ClusterRole + name: agent-perNode-example-default + apiGroup: rbac.authorization.k8s.io +--- +# Source: elastic-agent/templates/agent/k8s/daemonset.yaml +apiVersion: apps/v1 +kind: DaemonSet +metadata: + name: agent-pernode-example + namespace: "default" + labels: + helm.sh/chart: elastic-agent-0.0.1 + app.kubernetes.io/name: elastic-agent + app.kubernetes.io/instance: example + app.kubernetes.io/version: 9.0.0 + app.kubernetes.io/managed-by: Helm +spec: + selector: + matchLabels: + name: agent-pernode-example + template: + metadata: + labels: + name: agent-pernode-example + annotations: + checksum/config: 39e00ed2a77861d6ce0f1436c373284c3651db4325dbe5d25300677203cfdca7 + + spec: + dnsPolicy: ClusterFirstWithHostNet + automountServiceAccountToken: true + nodeSelector: + kubernetes.io/os: linux + serviceAccountName: agent-pernode-example + volumes: + - hostPath: + path: /proc + name: proc + - hostPath: + path: /sys/fs/cgroup + name: cgroup + - hostPath: + path: /var/lib/docker/containers + name: varlibdockercontainers + - hostPath: + path: /var/log + name: varlog + - hostPath: + path: /etc + name: etc-full + - hostPath: + path: /var/lib + name: var-lib + - name: agent-data + hostPath: + + path: /etc/elastic-agent/default/agent-pernode-example/state + type: DirectoryOrCreate + + - name: config + secret: + defaultMode: 0444 + secretName: agent-pernode-example + containers: + - name: agent + imagePullPolicy: IfNotPresent + image: "docker.elastic.co/beats/elastic-agent:9.0.0-SNAPSHOT" + args: ["-c", "/etc/elastic-agent/agent.yml", "-e"] + securityContext: + capabilities: + add: + - DAC_READ_SEARCH + - CHOWN + - SETPCAP + - SYS_PTRACE + drop: + - ALL + privileged: false + runAsGroup: 1000 + runAsUser: 1000 + resources: + limits: + memory: 1000Mi + requests: + cpu: 100m + memory: 400Mi + volumeMounts: + - mountPath: /hostfs/proc + name: proc + readOnly: true + - mountPath: /hostfs/sys/fs/cgroup + name: cgroup + readOnly: true + - mountPath: /var/lib/docker/containers + name: varlibdockercontainers + readOnly: true + - mountPath: /var/log + name: varlog + readOnly: true + - mountPath: /hostfs/etc + name: etc-full + readOnly: true + - mountPath: /hostfs/var/lib + name: var-lib + readOnly: true + - name: agent-data + mountPath: /usr/share/elastic-agent/state + - name: config + mountPath: /etc/elastic-agent/agent.yml + readOnly: true + subPath: agent.yml + env: + - name: NODE_NAME + valueFrom: + fieldRef: + fieldPath: spec.nodeName + - name: POD_NAME + valueFrom: + fieldRef: + fieldPath: metadata.name + - name: STATE_PATH + value: "/usr/share/elastic-agent/state" + - name: ELASTIC_NETINFO + value: "false" diff --git a/deploy/helm/elastic-agent/templates/NOTES.txt b/deploy/helm/elastic-agent/templates/NOTES.txt index e7f9d2caede..0b8587db0fb 100644 --- a/deploy/helm/elastic-agent/templates/NOTES.txt +++ b/deploy/helm/elastic-agent/templates/NOTES.txt @@ -22,6 +22,9 @@ Installed integrations: {{- if eq $.Values.kubernetes.enabled true }} - kubernetes [built-in chart integration] {{- end }} +{{- if eq $.Values.system.enabled true }} + - system [built-in chart integration] +{{- end }} {{- range $customInputName, $customInputVal := $.Values.extraIntegrations }} - {{$customInputName}} [user-defined integration] {{- end }} diff --git a/deploy/helm/elastic-agent/templates/agent/_helpers.tpl b/deploy/helm/elastic-agent/templates/agent/_helpers.tpl index 0de739754ee..d3021d69bd4 100644 --- a/deploy/helm/elastic-agent/templates/agent/_helpers.tpl +++ b/deploy/helm/elastic-agent/templates/agent/_helpers.tpl @@ -65,6 +65,7 @@ Initialise input templates if we are not deploying as managed {{- if eq $.Values.agent.fleet.enabled false -}} {{/* standalone agent so initialise inputs */}} {{- include "elasticagent.kubernetes.init" $ -}} +{{- include "elasticagent.system.init" $ -}} {{- range $customInputName, $customInputVal := $.Values.extraIntegrations -}} {{- $customInputPresetName := ($customInputVal).preset -}} {{- $presetVal := get $.Values.agent.presets $customInputPresetName -}} diff --git a/deploy/helm/elastic-agent/templates/integrations/_system/_system.tpl b/deploy/helm/elastic-agent/templates/integrations/_system/_system.tpl new file mode 100644 index 00000000000..fee22b990e9 --- /dev/null +++ b/deploy/helm/elastic-agent/templates/integrations/_system/_system.tpl @@ -0,0 +1,6 @@ +{{- define "elasticagent.system.init" -}} +{{- if eq $.Values.system.enabled true -}} +{{- include "elasticagent.system.config.logs.init" $ -}} +{{- include "elasticagent.system.config.metrics.init" $ -}} +{{- end -}} +{{- end -}} diff --git a/deploy/helm/elastic-agent/templates/integrations/_system/_system_logs.tpl b/deploy/helm/elastic-agent/templates/integrations/_system/_system_logs.tpl new file mode 100644 index 00000000000..60c5a403996 --- /dev/null +++ b/deploy/helm/elastic-agent/templates/integrations/_system/_system_logs.tpl @@ -0,0 +1,71 @@ +{{- define "elasticagent.system.config.logs.init" -}} +{{- if eq $.Values.system.enabled true }} +{{- $preset := $.Values.agent.presets.perNode -}} +{{- $inputVal := (include "elasticagent.system.config.logs.input" $ | fromYaml) -}} +{{- if ($inputVal).streams }} +{{- include "elasticagent.preset.mutate.inputs" (list $ $preset (list $inputVal)) -}} +{{- include "elasticagent.preset.applyOnce" (list $ $preset "elasticagent.kubernetes.pernode.preset") -}} +{{- end -}} +{{- end -}} +{{- end -}} + +{{- define "elasticagent.system.config.logs.input" -}} +id: system-logs +type: logfile +use_output: {{ $.Values.system.output }} +data_stream: + namespace: {{ $.Values.system.namespace }} +streams: + {{- if eq $.Values.system.authLogs.enabled true }} + - data_stream: + dataset: system.auth + type: logs + multiline: + pattern: ^\s + match: after + {{- $vars := (include "elasticagent.system.config.auth_logs.default_vars" .) | fromYaml -}} + {{- mergeOverwrite $vars $.Values.system.authLogs.vars | toYaml | nindent 4 }} + {{- end }} + {{- if eq $.Values.system.syslog.enabled true }} + - data_stream: + dataset: system.syslog + type: logs + multiline: + pattern: ^\s + match: after + {{- $vars := (include "elasticagent.system.config.syslog.default_vars" .) | fromYaml -}} + {{- mergeOverwrite $vars $.Values.system.syslog.vars | toYaml | nindent 4 }} + {{- end }} +{{- end -}} + +{{/* +Defaults for auth log input stream +*/}} +{{- define "elasticagent.system.config.auth_logs.default_vars" -}} +paths: + - /var/log/auth.log* + - /var/log/secure* +exclude_files: + - \.gz$ +processors: + - add_locale: null +tags: + - system-auth +ignore_older: 72h +{{- end -}} + +{{/* +Defaults for auth log syslog stream +*/}} +{{- define "elasticagent.system.config.syslog.default_vars" -}} +paths: + - /var/log/messages* + - /var/log/syslog* + - /var/log/system* +exclude_files: + - \.gz$ +processors: + - add_locale: null +tags: null +ignore_older: 72h +{{- end -}} diff --git a/deploy/helm/elastic-agent/templates/integrations/_system/_system_metrics.tpl b/deploy/helm/elastic-agent/templates/integrations/_system/_system_metrics.tpl new file mode 100644 index 00000000000..0661020385e --- /dev/null +++ b/deploy/helm/elastic-agent/templates/integrations/_system/_system_metrics.tpl @@ -0,0 +1,103 @@ +{{- define "elasticagent.system.config.metrics.init" -}} +{{- if $.Values.system.metrics.enabled}} +{{- $preset := $.Values.agent.presets.perNode -}} +{{- $inputVal := (include "elasticagent.system.config.metrics.input" $ | fromYamlArray) -}} +{{- include "elasticagent.preset.mutate.inputs" (list $ $preset $inputVal) -}} +{{- include "elasticagent.preset.applyOnce" (list $ $preset "elasticagent.kubernetes.pernode.preset") -}} +{{- end -}} +{{- end -}} + +{{- define "elasticagent.system.config.metrics.input" -}} +- id: system-metrics + type: system/metrics + use_output: {{ $.Values.system.output }} + data_stream: + namespace: {{ $.Values.system.namespace }} + streams: + - data_stream: + dataset: system.cpu + type: metrics + period: 10s + cpu.metrics: + - percentages + - normalized_percentages + metricsets: + - cpu + - data_stream: + dataset: system.diskio + type: metrics + period: 10s + diskio.include_devices: null + metricsets: + - diskio + - data_stream: + dataset: system.filesystem + type: metrics + period: 1m + metricsets: + - filesystem + processors: + - drop_event.when.regexp: + system.filesystem.mount_point: ^/(sys|cgroup|proc|dev|etc|host|lib|snap)($|/) + - data_stream: + dataset: system.fsstat + type: metrics + period: 1m + metricsets: + - fsstat + processors: + - drop_event.when.regexp: + system.fsstat.mount_point: ^/(sys|cgroup|proc|dev|etc|host|lib|snap)($|/) + - data_stream: + dataset: system.load + type: metrics + condition: '${host.platform} != ''windows''' + period: 10s + metricsets: + - load + - data_stream: + dataset: system.memory + type: metrics + period: 10s + metricsets: + - memory + - data_stream: + dataset: system.network + type: metrics + period: 10s + network.interfaces: null + metricsets: + - network + - data_stream: + dataset: system.process + type: metrics + period: 10s + processes: + - .* + process.include_top_n.by_cpu: 5 + process.include_top_n.by_memory: 5 + process.cmdline.cache.enabled: true + process.cgroups.enabled: false + process.include_cpu_ticks: false + metricsets: + - process + process.include_cpu_ticks: false + - data_stream: + dataset: system.process_summary + type: metrics + period: 10s + metricsets: + - process_summary + - data_stream: + dataset: system.socket_summary + type: metrics + period: 10s + metricsets: + - socket_summary + - data_stream: + type: metrics + dataset: system.uptime + metricsets: + - uptime + period: 10s +{{- end -}} diff --git a/deploy/helm/elastic-agent/values.schema.json b/deploy/helm/elastic-agent/values.schema.json index f791012c4d4..05fa9281af7 100644 --- a/deploy/helm/elastic-agent/values.schema.json +++ b/deploy/helm/elastic-agent/values.schema.json @@ -18,6 +18,71 @@ } ] }, + "system": { + "type": "object", + "description": "Configuration for system integration.", + "properties": { + "enabled": { + "type": "boolean", + "description": "Enable system integration." + }, + "output": { + "type": "string", + "description": "Name of the output used in system integration. Must be defined in outputs." + }, + "namespace": { + "type": "string", + "description": "output namespace.", + "default": "default" + }, + "authLogs": { + "type": "object", + "properties": { + "enabled": { + "type": "boolean", + "description": "Enable system auth logs stream." + }, + "vars": { + "$ref": "#/definitions/SystemLogsStreamVars" + } + }, + "required": [ + "enabled" + ] + }, + "syslog": { + "type": "object", + "properties": { + "enabled": { + "type": "boolean", + "description": "Enable system syslog stream." + }, + "vars": { + "$ref": "#/definitions/SystemLogsStreamVars" + } + }, + "required": [ + "enabled" + ] + }, + "metrics": { + "type": "object", + "properties": { + "enabled": { + "type": "boolean", + "description": "Enable system metrics stream." + } + }, + "required": [ + "enabled" + ] + } + }, + "required": [ + "enabled", + "output" + ] + }, "kubernetes": { "type": "object", "description": "Configuration for Kubernetes integration.", @@ -534,7 +599,8 @@ "password" ] } - },{ + }, + { "if": { "properties": { "type": { @@ -1183,6 +1249,44 @@ "required": [ "mode" ] + }, + "SystemLogsStreamVars": { + "type": "object", + "description": "System integration log stream variables.", + "properties": { + "paths": { + "type": "array", + "items": { + "type": "string" + }, + "description": "Paths to scan for logs." + }, + "exclude_files": { + "type": "array", + "items": { + "type": "string" + }, + "description": "Files to exclude from logs." + }, + "processors": { + "type": "array", + "items": { + "type": "object" + }, + "description": "Processors for the system auth logs stream." + }, + "tags": { + "type": "array", + "items": { + "type": "string" + }, + "description": "Tags for the logs stream." + }, + "ignore_older": { + "type": "string", + "description": "If this option is specified, events that are older than the specified amount of time are ignored. Valid time units are \"ns\", \"us\" (or \"µs\"), \"ms\", \"s\", \"m\", \"h\"." + } + } } } } diff --git a/deploy/helm/elastic-agent/values.yaml b/deploy/helm/elastic-agent/values.yaml index 800935acb34..7b65b32d77d 100644 --- a/deploy/helm/elastic-agent/values.yaml +++ b/deploy/helm/elastic-agent/values.yaml @@ -64,7 +64,7 @@ kubernetes: # results in overriding and *disabling all* the respective state streams # @section -- 2 - Kubernetes integration enabled: true - # -- deploy kube-state-metrics service as a sidecar container to the elastic agent of `ksmShared` preset. + # -- deploy kube-state-metrics service as a sidecar container to the elastic agent of `ksmSharded` preset. # If set to `false`, kube-state-metrics will *not* get deployed and `clusterWide` agent preset will be used for # collecting kube-state-metrics. # @section -- 2 - Kubernetes integration @@ -287,16 +287,47 @@ kubernetes: # -- system metric stream vars # @section -- 2 - Kubernetes integration vars: {} +system: + # -- enable System integration. + # @section -- 4 - System integration + enabled: false + # -- name of the output used in System integration. Note that this output needs to be defined in + # [outputs](#1-outputs) + # @section -- 4 - System integration + output: default + # -- output namespace + # @section -- 4 - System integration + namespace: default + authLogs: + # -- enable auth logs + # @section -- 4 - System integration + enabled: true + # -- override default variables of auth logs stream. Look in the [values.schema.json](values.schema.json) to see the + # available variables + # @section -- 4 - System integration + vars: {} + syslog: + # -- enable syslog + # @section -- 4 - System integration + enabled: true + # -- override default variables of syslog stream. Look in the [values.schema.json](values.schema.json) to see the + # available variables + # @section -- 4 - System integration + vars: {} + metrics: + # -- enable metrics + # @section -- 4 - System integration + enabled: true # -- extra [user-defined integrations](https://www.elastic.co/guide/en/fleet/current/elastic-agent-input-configuration.html) to be added to the Elastic Agent # An example can be found [here](./examples/nginx-custom-integration/README.md) -# @section -- 3 - User Extra Integrations +# @section -- 5 - User Extra Integrations extraIntegrations: {} agent: # -- elastic-agent version - # @section -- 3 - Elastic-Agent Configuration + # @section -- 6 - Elastic-Agent Configuration version: 9.0.0 # -- image configuration - # @section -- 3 - Elastic-Agent Configuration + # @section -- 6 - Elastic-Agent Configuration image: repository: docker.elastic.co/beats/elastic-agent pullPolicy: IfNotPresent @@ -305,40 +336,40 @@ agent: # @section -- 3 - Elastic-Agent Configuration imagePullSecrets: [] # -- generate kubernetes manifests or [ECK](https://github.com/elastic/cloud-on-k8s) CRDs - # @section -- 3 - Elastic-Agent Configuration + # @section -- 6 - Elastic-Agent Configuration engine: k8s # k8s or eck # -- enable unprivileged mode - # @section -- 3 - Elastic-Agent Configuration + # @section -- 6 - Elastic-Agent Configuration unprivileged: false fleet: # -- enable elastic-agent managed - # @section -- 3.1 - Elastic-Agent Managed Configuration + # @section -- 6.1 - Elastic-Agent Managed Configuration enabled: false # -- Fleet server URL - # @section -- 3.1 - Elastic-Agent Managed Configuration + # @section -- 6.1 - Elastic-Agent Managed Configuration url: "" # -- Fleet enrollment token - # @section -- 3.1 - Elastic-Agent Managed Configuration + # @section -- 6.1 - Elastic-Agent Managed Configuration token: "" # -- Fleet insecure url - # @section -- 3.1 - Elastic-Agent Managed Configuration + # @section -- 6.1 - Elastic-Agent Managed Configuration insecure: false # -- Kibana host to fallback if enrollment token is not supplied - # @section -- 3.1 - Elastic-Agent Managed Configuration + # @section -- 6.1 - Elastic-Agent Managed Configuration kibanaHost: "" # -- Kibana username to fallback if enrollment token is not supplied - # @section -- 3.1 - Elastic-Agent Managed Configuration + # @section -- 6.1 - Elastic-Agent Managed Configuration kibanaUser: "" # -- Kibana password to fallback if enrollment token is not supplied - # @section -- 3.1 - Elastic-Agent Managed Configuration + # @section -- 6.1 - Elastic-Agent Managed Configuration kibanaPassword: "" # -- Agent preset to deploy - # @section -- 3.1 - Elastic-Agent Managed Configuration + # @section -- 6.1 - Elastic-Agent Managed Configuration preset: perNode # -- Map of deployment presets for the Elastic Agent. The key of the map is the name of the preset. See more for the presets # required by the built-in Kubernetes integration [here](./values.yaml) # @notationType -- map[string]{} - # @section -- 3 - Elastic-Agent Configuration + # @section -- 6 - Elastic-Agent Configuration # @default -- `{ "perNode" : {...}, "clusterWide": {...}, "ksmSharded": {...} }` presets: # examplePreset: