Steps for GKE

Google Kubernetes Engine (GKE) is a managed environment for running Kubernetes in Google Cloud, in order to deploy containerized applications. As of Sysdig agent version 0.88, Sysdig supports all flavors of GKE, including Ubuntu and GKE's default Container-Optimized OS (COS).

Note that the standard Sysdig agent cannot be installed on GKE COS because Sysdig relies on a kernel module that COS does not allow. To accommodate this limitation Sysdig has developed an alternate probe built on eBPF, a "universal in-kernel virtual machine."

The instructions below describe a standard GKE agent install and call out the special steps needed to install the eBPF probe if you are using COS.

Preparation

Open Port 6443 for Agent Egress

Because GKE uses stateful firewalls, you must actively open port 6443 for the Sysdig agent outbound traffic.

Note

In earlier versions, the Sysdig Agent connected to port 6666. This behavior has been deprecated, as the Sysdig agent now connects to port 6443.

GKE COS/eBPF-Specific Requirements

  • Linux kernel version >= 4.14.

  • When performing the installation steps, you will add one additional parameter to install the eBPF probe. See Step 7, below.

Background Info

You can review Agent Install: Kubernetes | GKE | OpenShift | IBM and the Host Requirements for Agent Installation for additional context, if desired.

Installation Steps

To deploy agents using Kubernetes daemonsets, you will download the following configuration files, edit them as required, and deploy them.

  • sysdig-agent-clusterrole.yaml

  • sysdig-agent-daemonset-v2.yaml

  • sysdig-agent-configmap.yaml

Note

HELM CHART OPTIONKubernetes also offers a package manager, Helm, which uses charts to simplify this process.

If you are using Helm charts in your K8s environment, we recommend using them to deploy Sysdig agents, as described here.

Deploy the Agents

  1. Download the sample files:

    • sysdig-agent-clusterrole.yaml

    • sysdig-agent-daemonset-v2.yaml

    • sysdig-agent-configmap.yaml

    • sysdig-agent-service.yaml

  2. Create a namespace to use for the Sysdig agent.

    Note

    You can use whatever name you want. In this document, we used sysdig-agent for both the namespace and the service account.

    kubectl create ns sysdig-agent

  3. Create a secret key:

    kubectl create secret generic sysdig-agent --from-literal=access-key=<your sysdig access key> -n sysdig-agent

  4. If you are running Kubernetes 1.6 or higher, you must

    1. Grant your user the ability to create roles in Kubernetes by running the following command (see Google documentation for more):

      kubectl create clusterrolebinding your-user-cluster-admin-binding --clusterrole=cluster-admin --user=your.google.cloud.email@example.org

    2. Create a service account for the Sysdig agent using the clusterrole.yaml file.

      The Sysdig agent must be granted read-only access to certain Kubernetes APIs, which the agent uses to populate metadata and provide component metrics.

      Sysdig provides a config file in GitHub. Deploying this file creates a cluster role and service account in Kubernetes, and defines cluster role binding that grants the Sysdig agent rules in the cluster role.

      Run the following commands (using whatever namespace you defined in Step 2):

      kubectl apply -f sysdig-agent-clusterrole.yaml -n sysdig-agent
kubectl create serviceaccount sysdig-agent -n sysdig-agent
kubectl create clusterrolebinding sysdig-agent --clusterrole=sysdig-agent --serviceaccount=sysdig-agent:sysdig-agent

  5. Edit sysdig-agent-configmap.yaml to add the collector address, port, and the SSL/TLS information :

    collector: 
collector_port: 
ssl: #true or false
check_certificate: #true or false

  6. (All installs) Apply the sysdig-agent-configmap.yaml file using the command:

    kubectl apply -f sysdig-agent-configmap.yaml -n sysdig-agent

  7. FOR GKE COS ONLY: To enable the eBPF probe required for COS, uncomment the following parameters in  sysdig-agent-daemonset-v2.yaml under the env section:

    env:
  - name: SYSDIG_BPF_PROBE
    value: ""

  8. Apply the sysdig-agent-service.yaml file:

    kubectl apply -f sysdig-agent-service.yaml -n sysdig-agent

    This allows the agent to receive Kubernetes audit events from the Kubernetes API server. See Kubernetes Audit Logging for information on enabling Kubernetes audit logging.

  9. (All installs) Apply the daemonset-v2.yaml file using the command:

    kubectl apply -f sysdig-agent-daemonset-v2.yaml -n sysdig-agent

The agents will be deployed and you can see Getting Started with Sysdig Monitor to view some metrics in the Sysdig Monitor UI. You can make further edits to the configmap as described below.

Enable Kube State Metrics and Cluster Name

These steps are optional but recommended.

  1. Edit sysdig-agent-configmap.yaml to uncomment the line: new_k8s: true

    This allows kube state metrics to be automatically detected, monitored, and displayed in Sysdig Monitor.

    For more information, see the Kube State Metrics entry in the Sysdig blog.

    Note

    As of agent 9.6.0, new_k8s is enabled by default.

  2. Edit sysdig-agent-configmap.yaml to uncomment the line: k8s_cluster_name: and add your cluster name.

    Setting cluster name here allows you to view, scope, and segment metrics in the Sysdig Monitor UI by the Kubernetes cluster.

    Note: Alternatively, if you assign a tag with "cluster" in the tag name, Sysdig Monitor will display that as the Kubernetes cluster name.

  3. Apply the configmap changes using the command:

    kubectl apply -f sysdig-agent-configmap.yaml -n sysdig-agent

  4. Proceed to verify the metrics in the Sysdig Monitor UI.

Note

There are two ways to update the agent configuration

Option 1: Edit the files locally and apply the changes with kubectl apply -f:

kubectl apply -f sysdig-agent-configmap.yaml -n sysdig-agent

Option 2: Use kubectl edit to edit files on the fly:

kubectl edit configmap sysdig-agent -n sysdig-agent

Running agents will automatically pick the new configuration after Kubernetes pushes the changes across all the nodes in the cluster.

Verify Metrics in Sysdig Monitor UI

Log in to Sysdig Monitor to verify that the agent deployed and the metrics are detected and collected appropriately.

The steps below give one way to do the check.

  1. Access Sysdig Monitor:

    SaaS: See SaaS Regions and IP Ranges and identify the correct domain URL associated with your Sysdig application and region. For example, for US East, the URL is https://app.sysdigcloud.com.

    For other regions, the format is https://<region>.app.sysdig.com. Replace <region> with the region where your Sysidig application is hosted. For example, for Sysdig Monitor in the EU, you use https://eu1.app.sysdig.com.

    Log in with your Sysdig user name and password.

  2. Select the Explore tab to see if metrics are displayed.

  3. (Once you have enabled new_k8s:true): To verify that kube state metrics and cluster name are working correctly: Select the Explore tab and create a grouping by kubernetes.cluster.name and kubernetes.pod.name.

    As of agent 9.6.0, new_k8s is enabled by default.

    373574807.png

  4. Select an individual container or pod to see details.

    373574813.png

Note

Kubernetes metadata (pods, deployments etc.) appear a minute or two later than the nodes/containers themselves; if pod names do not appear immediately, wait and retry the Explore view.

If agents are disconnecting, there could be an issue with your MAC addresses. See Troubleshooting Agent Installation for tips.

Additional Options

Connect to the Sysdig Backend via Static IPs (SaaS only)

Sysdig provides a list of static IP addresses that can be whitelisted in a Sysdig environment, allowing users to establish a network connection to the Sysdig backend without opening complete network connectivity. This is done by setting the Collector IP to collector-static.sysdigcloud.com.

Note

The sysdig-agent-configmap.yaml file can be edited either locally or using the edit command in Kubernetes. refer to the section above for more information.

To configure the collector IP in a Kubernetes SaaS instance:

  1. Open sysdig-agent-configmap.yaml in a text editor.

  2. Uncomment the following lines:

    • collector:

    • collector_port

  3. Set the collector: value to collector-static.sysdigcloud.com

  4. Set the collector_port: value to 6443

  5. Save the file.

The example file below shows how the sysdig-agent-configmap.yaml file should look after configuration:

apiVersion: v1
kind: ConfigMap
metadata:
  name: sysdig-agent
data:
  dragent.yaml: |
    ### Agent tags
    # tags: linux:ubuntu,dept:dev,local:nyc

    #### Sysdig Software related config ####

    # Sysdig collector address
    collector: collector-static.sysdigcloud.com

    # Collector TCP port
    collector_port: 6443

    # Whether collector accepts ssl/TLS
    ssl: true

    # collector certificate validation
    ssl_verify_certificate: true

    # Sysdig Secure
    security:
      enabled: true

    #######################################
    # new_k8s: true
    # k8s_cluster_name: production