Sysdig Documentation

OpenShift Agent Installation Steps

Review the Prerequisites in Agent Install: Kubernetes | GKE | OpenShift | IBM and the Host Requirements for Agent Installation, then proceed with the installation.

Configure for OpenShift

If you are using Red Hat OpenShift, these steps are required. They describe how to create a project, assign and label the node selector, create a privileged service account, and add it to a cluster role.

Copy/Paste Sample Code Block

Note

In the example code, this document uses sysdig-agent for the PROJECT NAME (-n), the SERVICE ACCOUNT (-z), and the NODE SELECTOR.

You can copy-paste the code as-is, or follow the steps below to customize your naming conventions.

oc adm new-project sysdig-agent --node-selector='app=sysdig-agent'
oc label node --all "app=sysdig-agent"
oc project sysdig-agent
oc create serviceaccount sysdig-agent
oc adm policy add-scc-to-user privileged -n sysdig-agent -z sysdig-agent
oc adm policy add-cluster-role-to-user cluster-reader -n sysdig-agent -z sysdig-agent

Or Customize the Code

You can use your own PROJECT NAME and NODE SELECTOR names if desired.

Note that if you use a different SERVICE ACCOUNT name, you will need to edit the default service account in the Sysdig Installation Steps, below.

  1. Create a new OpenShift project for the Sysdig agent deployment and assign the node selector:

    oc adm new-project PROJECT-NAME --node-selector="app=APP-NAME"
  2. Label the node with the node selector:

    oc label node --all "app=APP-NAME"
  3. Change to the new OpenShift Project for the Sysdig agent deployment:

    oc project PROJECT-NAME
  4. Create a service account for the project:

    oc create serviceaccount SERVICE-ACCOUNT
  5. Add the service account to privileged Security Context Constraints:

    oc adm policy add-scc-to-user privileged -n PROJECT-NAME -z SERVICE-ACCOUNT
  6. Add the service account to the cluster-reader Cluster Role:

    oc adm policy add-cluster-role-to-user cluster-reader -n PROJECT-NAME -z SERVICE-ACCOUNT

Sysdig Installation Steps

To deploy agents using Kubernetes daemonsets, you download the configuration files, edit them as required, and deploy them.

sysdig-agent-daemonset-v2.yaml

sysdig-agent-configmap.yaml

Note

HELM CHART OPTIONKubernetes also offers a package manager, Helm, which uses charts to simplify this process.

If you are using Helm charts in your K8s environment, we recommend using them to deploy Sysdig agents, as described here.

Deploy the Agents

  1. Downloadthe sample filessysdig-agent-daemonset-v2.yaml, and sysdig-agent-configmap.yaml

  2. Create a secret key using the command:

    kubectl create secret generic sysdig-agent --from-literal=access-key=<your sysdig access key> -n sysdig-agent
  3. If you created a service account name other than sysdig-agent: Edit sysdig-agent-daemonset-v2.yamlto provide your custom value:

    serviceAccount: sysdig-agent
  4. FOR ON-PREM INSTALLATIONS ONLY: Edit configmap.yaml to add the collectoraddress and port, and SSL/TLS information :

    collector:
    collector_port: 443
    ssl: #true or false
    ssl_verify_certificate: #true or false

    Note

    ssl_verify_certificate should be set to false if a self-signed certificate or private, CA-signed cert is used. See also Step 5 Set Up SSL Connectivity to the Backend.

  5. (ALL INSTALLS): Apply the configmap.yaml file using the command:

    kubectl apply -f sysdig-agent-configmap.yaml -n sysdig-agent
  6. (ALL INSTALLS): Apply the daemonset-v2.yaml file using the command:

    kubectl apply -f sysdig-agent-daemonset-v2.yaml -n sysdig-agent

The agents will be deployed and you can see Getting Started to view some metrics in the Sysdig Monitor UI. You can make further edits to the configmap as described below.

Enable Kube State Metrics and Cluster Name

  1. Edit sysdig-agent-configmap.yaml to uncomment the line: new_k8s: true

    This allows kube state metrics to be automatically detected, monitored, and displayed in Sysdig Monitor.

    For more information, see the Kube State Metrics entry in the Sysdig blog.

  2. Edit sysdig-agent-configmap.yamlto uncomment the line: k8s_cluster_name: and add your cluster name.

    Setting cluster name here allows you to view, scope, and segment metrics in the Sysdig Monitor UI by Kubernetes cluster.

    Note: Alternatively, if you assign a tag with "cluster" in the tag name, Sysdig Monitor displays that as the Kubernetes cluster name.

  3. Apply the configmap changes using the command:

    kubectl apply -f sysdig-agent-configmap.yaml -n sysdig-agent
  4. Proceed to verify the in the Sysdig Monitor UI.

Note

There are two ways to update the agent configuration

Option 1: Edit the files locally and apply the changes with kubectl apply -f:

kubectl apply -f sysdig-agent-configmap.yaml -n sysdig-agent

Option 2: Edit the files on the fly with kubectl edit:

kubectl edit configmap sysdig-agent -n sysdig-agent

Running agents automatically pick the new configuration after Kubernetes pushes the changes across all the nodes in the cluster.

Verify Metrics in Sysdig Monitor UI

Log in to Sysdig Monitor to verify that the agent deployed and the metrics are detected and collected appropriately.

The steps below give one way to do the check.

(See also Sysdig Monitor Documentation.)

  1. Access Sysdig Monitor:

    SaaS: https://app.sysdigcloud.com

    Log in with your Sysdig user name and password.

  2. Select the Explore tab to see if metrics are displayed.

  3. (Once you have enabled new_k8s:true)

    To verify that kube state metrics and cluster name are working correctly: Select the Explore tab and create a grouping by kubernetes.cluster.name and kubernetes.pod.name .

    373574807.png
  4. Select an individual container or pod to see details.

    373574813.png

Note

Kubernetes metadata (pods, deployments etc.) appear a minute or two later than the nodes/containers themselves; if pod names do not appear immediately, wait and retry the Explore view.

If agents are disconnecting, there could be an issue with your MAC addresses. See Troubleshooting Agent Installation for tips.

Additional Options

Connect to the Sysdig Backend via Static IPs (SaaS only)

Sysdig provides a list of static IP addresses that can be whitelisted in a Sysdig environment, allowing users to establish a network connection to the Sysdig backend without opening complete network connectivity. This is done by setting the Collector IP to collector-static.sysdigcloud.com .

Note

The sysdig-agent-configmap.yaml file can be edited either locally or using the edit command in Kubernetes. refer to the section above for more information.

To configure the collector IP in a Kubernetes SaaS instance:

  1. Open sysdig-agent-configmap.yaml in a text editor.

  2. Uncomment the following lines:

    • collector:

    • collector_port

  3. Set the collector: value to collector-static.sysdigcloud.com

  4. Set the collector_port: value to 6443

  5. Save the file.

The example file below shows how the sysdig-agent-configmap.yaml file should look after configuration:

apiVersion: v1
kind: ConfigMap
metadata:
  name: sysdig-agent
data:
  dragent.yaml: |
    ### Agent tags
    # tags: linux:ubuntu,dept:dev,local:nyc

    #### Sysdig Software related config ####

    # Sysdig collector address
    collector: collector-static.sysdigcloud.com

    # Collector TCP port
    collector_port: 6443

    # Whether collector accepts ssl/TLS
    ssl: true

    # collector certificate validation
    ssl_verify_certificate: true

    # Sysdig Secure
    security:
                enabled: true

    #######################################
    # new_k8s: true
    # k8s_cluster_name: production