GKE Standard

Google Kubernetes Engine (GKE) is a managed environment for running Kubernetes in Google Cloud, in order to deploy containerized applications. Sysdig supports all flavors of GKE, including Ubuntu and GKE’s default Container-Optimized OS(COS).

GKE COS environments require eBPF probe to support agent installation.

Preparation

Open Port 6443 for Agent Egress

Because GKE uses stateful firewalls, you must actively open port 6443 for the Sysdig agent outbound traffic.

In earlier versions, the Sysdig Agent connected to port 6666. This behavior has been deprecated, as the Sysdig agent now connects to port 6443.

GKE COS/eBPF-Specific Requirements

Linux kernel version >= 4.14.
When performing the installation steps, you will add one additional parameter to install the eBPF probe. See Step 7. Note that only the eBPF probe is supported in GKE COS environments.

Prerequisites

You can review Agent Install: Kubernetes and the Agent Installation Requirements for additional context, if desired.

Installation Steps

Helm

Sysdig recommends using helm charts to install Sysdig agent in Kubernetes environments. For the latest chart and installation instructions, see sysdig-deploy.

Manifests

To deploy agents using Kubernetes manifests, you can download the manifest files, edit them as required, and deploy them using kubectl.

Download the sample files:
- sysdig-agent-clusterrole.yaml
- sysdig-agent-daemonset-v2.yaml
- sysdig-agent-configmap.yaml
- sysdig-agent-service.yaml
Create a namespace to use for the Sysdig agent.
You can use whatever name you want. In this document, we used sysdig-agent for both the namespace and the service account.
```
kubectl create ns sysdig-agent
```

Create a secret key:

kubectl create secret generic sysdig-agent --from-literal=access-key=<your sysdig access key> -n sysdig-agent

If you are running Kubernetes 1.6 or higher, you must grant your user the ability to create roles in Kubernetes by running the following command:
```
kubectl create clusterrolebinding your-user-cluster-admin-binding --clusterrole=cluster-admin --user=your.google.cloud.email@example.org
```
See Google documentation for more information.
Create a service account for the Sysdig agent using the clusterrole.yaml file.
The Sysdig agent must be granted read-only access to certain Kubernetes APIs, which the agent uses to populate metadata and provide component metrics.
You can use the Sysdig-provided, sysdig-agent-clusterrole.yaml file. Deploying this file creates a cluster role and service account in Kubernetes, and defines cluster role binding that grants the Sysdig agent rules in the cluster role.
Run the following commands (using whatever namespace you’ve defined in Step 2):
```
kubectl apply -f sysdig-agent-clusterrole.yaml -n sysdig-agent
kubectl create serviceaccount sysdig-agent -n sysdig-agent
kubectl create clusterrolebinding sysdig-agent --clusterrole=sysdig-agent --serviceaccount=sysdig-agent:sysdig-agent
```
Edit sysdig-agent-configmap.yaml to add the collector address, port, and the SSL/TLS information :
```
collector:
collector_port:
ssl: #true or false
check_certificate: #true or false
```
- For SaaS, find the collector address for your region.
- For On-prem, enter the collector endpoint defined in your environment.
- check_certificate should be set to false if a self-signed certificate or private, CA-signed cert is used.
  See Set Up SSL Connectivity to the Backend for more information.

Apply the sysdig-agent-configmap.yaml file:

kubectl apply -f sysdig-agent-configmap.yaml -n sysdig-agent

FOR GKE COS ONLY: To enable the eBPF probe required for COS, uncomment the following parameters in sysdig-agent-daemonset-v2.yaml under the env section:
```
env:
  - name: SYSDIG_BPF_PROBE
    value: ""
```
Apply the sysdig-agent-service.yaml file:
```
kubectl apply -f sysdig-agent-service.yaml -n sysdig-agent
```
This allows the agent to receive Kubernetes audit events from the Kubernetes API server. See Kubernetes Audit Logging for information on enabling Kubernetes audit logging.

Apply the daemonset-v2.yaml file:

kubectl apply -f sysdig-agent-daemonset-v2.yaml -n sysdig-agent

The agents will be deployed and you can see some metrics in the Sysdig Monitor UI.

Next Steps

You can continue with instructions in Additional Options.