AWS EKS Fargate へのインストレーション

## Global values

global:
# -- The cluster name for the Kubernetes cluster.
cluster: "_YOUR_K8S_CLUSTER_NAME_"

# -- The license key for your New Relic Account. This will be preferred configuration option if both `licenseKey` and `customSecret` are specified.
licenseKey: "_YOUR_NEW_RELIC_LICENSE_KEY_"

# -- (bool) In each integration it has different behavior. Enables operating system metric collection on each EC2 K8s node. Not applicable to Fargate nodes.
# @default -- false
privileged: true

# -- (bool) Must be set to `true` when deploying in an EKS Fargate environment
# @default -- false
fargate: true

## Enable nri-bundle sub-charts

newrelic-infra-operator:
# Deploys the infrastructure operator, which injects the monitoring sidecar into Fargate pods
enabled: true
tolerations: 
    - key: "eks.amazonaws.com/compute-type"
    operator: "Equal"
    value: "fargate"
    effect: "NoSchedule"
config:
    ignoreMutationErrors: true
    infraAgentInjection:
    # Injection policies can be defined here.  See [values file](https://github.com/newrelic/newrelic-infra-operator/blob/main/charts/newrelic-infra-operator/values.yaml#L114-L125) for more detail.
    policies:
    - namespaceName: namespace-a
    - namespaceName: namespace-b

newrelic-infrastructure:
# Deploys the Infrastructure Daemonset to EC2 nodes.  Disable for Fargate-only clusters.
enabled: true

nri-metadata-injection:
# Deploy our mutating admission webhook to link APM and Kubernetes entities
enabled: true

kube-state-metrics:
# Deploys Kube State Metrics.  Disable if you are already running KSM in your cluster.
enabled: true

nri-kube-events:
# Deploy the Kubernetes events integration.
enabled: true

newrelic-logging:
# Deploys the New Relic's Fluent Bit daemonset to EC2 nodes.  Disable for Fargate-only clusters.
enabled: true

newrelic-prometheus-agent:
# Deploys the Prometheus agent for scraping Prometheus endpoints.
enabled: true
config:
    kubernetes:
    integrations_filter:
        enabled: true
        source_labels: ["app.kubernetes.io/name", "app.newrelic.io/name", "k8s-app"]
        app_values: ["redis", "traefik", "calico", "nginx", "coredns", "kube-dns", "etcd", "cockroachdb", "velero", "harbor", "argocd", "istio"]

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
    labels:
    app: newrelic-infrastructure
    name: newrelic-newrelic-infrastructure-infra-agent
rules:
    - apiGroups:
        - ""
    resources:
        - nodes
        - nodes/metrics
        - nodes/stats
        - nodes/proxy
        - pods
        - services
    verbs:
        - get
        - list
    - nonResourceURLs:
        - /metrics
    verbs:
        - get

apiVersion: apps/v1
kind: Deployment
spec:
    template:
    spec:
        containers:
        - name: newrelic-infrastructure
        env:
        - name: NRIA_LICENSE_KEY
            valueFrom:
            secretKeyRef:
                key: license
                name: newrelic-newrelic-infrastructure-config
        - name: NRIA_VERBOSE
            value: "1"
        - name: DISABLE_KUBE_STATE_METRICS
            value: "true"
        - name: CLUSTER_NAME
            value: testing-injection
        - name: COMPUTE_TYPE
            value: serverless
        - name: NRK8S_NODE_NAME
            valueFrom:
            fieldRef:
                apiVersion: v1
                fieldPath: spec.nodeName
        - name: NRIA_DISPLAY_NAME
            valueFrom:
            fieldRef:
                apiVersion: v1
                fieldPath: spec.nodeName
        - name: NRIA_CUSTOM_ATTRIBUTES
            value: '{"clusterName":"$(CLUSTER_NAME)", "computeType":"$(COMPUTE_TYPE)", "fargateProfile":"[YOUR FARGATE PROFILE]"}'
        - name: NRIA_PASSTHROUGH_ENVIRONMENT
            value: KUBERNETES_SERVICE_HOST,KUBERNETES_SERVICE_PORT,CLUSTER_NAME,CADVISOR_PORT,NRK8S_NODE_NAME,KUBE_STATE_METRICS_URL,KUBE_STATE_METRICS_POD_LABEL,TIMEOUT,ETCD_TLS_SECRET_NAME,ETCD_TLS_SECRET_NAMESPACE,API_SERVER_SECURE_PORT,KUBE_STATE_METRICS_SCHEME,KUBE_STATE_METRICS_PORT,SCHEDULER_ENDPOINT_URL,ETCD_ENDPOINT_URL,CONTROLLER_MANAGER_ENDPOINT_URL,API_SERVER_ENDPOINT_URL,DISABLE_KUBE_STATE_METRICS,DISCOVERY_CACHE_TTL
        image: newrelic/infrastructure-k8s:2.4.0-unprivileged
        imagePullPolicy: IfNotPresent
        resources:
            limits:
            memory: 100M
            cpu: 200m
            requests:
            cpu: 100m
            memory: 50M
        securityContext:
            allowPrivilegeEscalation: false
            readOnlyRootFilesystem: true
            runAsUser: 1000
        terminationMessagePath: /dev/termination-log
        terminationMessagePolicy: File
        volumeMounts:
        - mountPath: /var/db/newrelic-infra/data
            name: tmpfs-data
        - mountPath: /var/db/newrelic-infra/user_data
            name: tmpfs-user-data
        - mountPath: /tmp
            name: tmpfs-tmp
        - mountPath: /var/cache/nr-kubernetes
            name: tmpfs-cache
[...]

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
    name: newrelic-newrelic-infrastructure-infra-agent
roleRef:
    apiGroup: rbac.authorization.k8s.io
    kind: ClusterRole
    name: newrelic-newrelic-infrastructure-infra-agent
subjects:
    - kind: ServiceAccount
    name: [INSERT_SERVICE_ACCOUNT_NAME_OF_WORKLOAD]
    namespace: [INSERT_SERVICE_ACCOUNT_NAMESPACE_OF_WORKLOAD]

apiVersion: v1
data:
    license: INSERT_YOUR_NEW_RELIC_LICENSE_ENCODED_IN_BASE64
kind: Secret
metadata:
    name: newrelic-newrelic-infrastructure-config
    namespace: [INSERT_NAMESPACE_OF_WORKLOAD]
type: Opaque