[metricbeat] Adding custerRole permissions for leader election #1422

framsouza · 2021-10-18T15:58:39Z

This PR adds permissions to metricbeat use leader election (auto discovery)

Fix #1415

framsouza · 2021-10-19T07:20:02Z

jenkins test this please

jmlrt

LGTM⛴

Do you know if we may need this new rule for some other charts?

jmlrt

Looking at https://github.com/elastic/beats/blob/ac8275f72e55b699fb5ae41c68774280d7188bd3/deploy/kubernetes/metricbeat/metricbeat-role.yaml#L46-L59, we may need to add this to a simple role instead of a cluster role.

apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: metricbeat
  # should be the namespace where metricbeat is running
  namespace: kube-system
  labels:
    k8s-app: metricbeat
rules:
  - apiGroups:
      - coordination.k8s.io
    resources:
      - leases
    verbs: ["get", "create", "update"]

Seems related to elastic/beats#24958

jmlrt · 2021-11-10T11:53:42Z

LGTM⛴

Do you know if we may need this new rule for some other charts?

We may also add it to Filebeat chart => https://github.com/elastic/beats/blob/ac8275f72e55b699fb5ae41c68774280d7188bd3/deploy/kubernetes/filebeat/filebeat-role.yaml#L22-L35

framsouza · 2021-11-16T11:37:38Z

@jmlrt Just added a single role for filebeat and metricbeat, can you please have a look at it?

jmlrt · 2021-12-09T12:36:14Z

metricbeat/values.yaml

+  - apiGroups: ["coordination.k8s.io"]
+    resources:
+      - leases
+    verbs: ["create", "get", "list", "update"]


I think this should also be added to

helm-charts/filebeat/values.yaml

Lines 203 to 213 in c52ad07

clusterRoleRules:

- apiGroups:

- ""

resources:

- namespaces

- nodes

- pods

verbs:

- get

- list

- watch

…ic#1422) * Adding support to Ingress networking.k8s.io/v1 * Adjusting ES service name * Removing ingress typo & adjusting python test * Adjusting python tests to use the new ingress version * fixing conflict * Adding support to kubernetes ingress v1 & ClassName * Adding reformatted files * fixing conflict * Adding ClassName & Pathtype on ingress settings * Performing syntax adjustments and removing comments * custerRole permissions for leader election in k8s 1.19+ * Adding fb & mb role Co-authored-by: jmlrt <8582351+jmlrt@users.noreply.github.com>

#1600) * Adding support to Ingress networking.k8s.io/v1 * Adjusting ES service name * Removing ingress typo & adjusting python test * Adjusting python tests to use the new ingress version * fixing conflict * Adding support to kubernetes ingress v1 & ClassName * Adding reformatted files * fixing conflict * Adding ClassName & Pathtype on ingress settings * Performing syntax adjustments and removing comments * custerRole permissions for leader election in k8s 1.19+ * Adding fb & mb role Co-authored-by: jmlrt <8582351+jmlrt@users.noreply.github.com> Co-authored-by: framsouza <francismara.souza@elastic.co>

This commits add a rolebinding and cluster role rules to match https://github.com/elastic/beats/blob/main/deploy/kubernetes/metricbeat-kubernetes.yaml Follow-up of elastic#1422

This commits add a rolebinding and cluster role rules to match https://github.com/elastic/beats/blob/main/deploy/kubernetes/metricbeat-kubernetes.yaml Follow-up of #1422

…1603) This commits add a rolebinding and cluster role rules to match https://github.com/elastic/beats/blob/main/deploy/kubernetes/metricbeat-kubernetes.yaml Follow-up of elastic#1422

…1607) This commits add a rolebinding and cluster role rules to match https://github.com/elastic/beats/blob/main/deploy/kubernetes/metricbeat-kubernetes.yaml Follow-up of #1422

@jmlrt

* 7.17.1 as default version. | PR | Author | Title | |-----------------------------------------------------------|----------------------------------------------|-------------------------------------------------------------------------| | [elastic#1604](elastic#1604) | [@jmlrt](https://github.com/jmlrt) | [meta] update docker images | | [elastic#1603](elastic#1603) | [@jmlrt](https://github.com/jmlrt) | [metricbeat] add missing rolebinding and cluster role rules | | [elastic#1602](elastic#1602) | [@jmlrt](https://github.com/jmlrt) | [filebeat] add missing rolebinding and cluster role rules | | [elastic#1593](elastic#1593) | [@jmlrt](https://github.com/jmlrt) | [meta] add support for k8s 1.22 | | [elastic#1582](elastic#1582) | [@jmlrt](https://github.com/jmlrt) | [kibana] fix extra values default values | | [elastic#1581](elastic#1581) | [@jmlrt](https://github.com/jmlrt) | [logstash] fix ServiceAccount inconsistencies | | [elastic#1580](elastic#1580) | [@jmlrt](https://github.com/jmlrt) | [elasticsearch] fix ServiceAccount inconsistencies | | [elastic#1570](elastic#1570) | [@jmlrt](https://github.com/jmlrt) | [logstash] add externalTrafficPolicy support | | [elastic#1569](elastic#1569) | [@jmlrt](https://github.com/jmlrt) | [logstash] add flexible ingress | | [elastic#1563](elastic#1563) | [@jmlrt](https://github.com/jmlrt) | [meta] bump Helm version to 3.8.0 | | [elastic#1538](elastic#1538) | [@chetanv-oi](https://github.com/chetanv-oi) | [elasticsearch] move the yaml separator inside the condition | | [elastic#1530](elastic#1530) | [@jmlrt](https://github.com/jmlrt) | [kibana] use bash for readiness script | | [elastic#1527](elastic#1527) | [@ebuildy](https://github.com/ebuildy) | [apm-server] add pod labels | | [elastic#1524](elastic#1524) | [@beatkind](https://github.com/beatkind) | [metricbeat] bump kube-state-metrics to version 4.7.0 | | [elastic#1521](elastic#1521) | [@ebuildy](https://github.com/ebuildy) | [apm-server] fix podLabels | | [elastic#1494](elastic#1494) | [@ebuildy](https://github.com/ebuildy) | [elasticsearch] add keystore container securityContext | | [elastic#1450](elastic#1450) | [@dmarcs](https://github.com/dmarcs) | [logstash] allow array values for extra | | [elastic#1422](elastic#1422) | [@framsouza](https://github.com/framsouza) | [metricbeat] adding custerRole permissions for leader election | | [elastic#1420](elastic#1420) | [@framsouza](https://github.com/framsouza) | [elasticsearch] [logstash] add support to PodDisruptionBudget policy/v1 | | [elastic#1417](elastic#1417) | [@framsouza](https://github.com/framsouza) | [kibana] add annotations at deployment level |

@jmlrt

* 7.17.1 release changelog * 7.17.1 as default version. | PR | Author | Title | |-----------------------------------------------------------|----------------------------------------------|-------------------------------------------------------------------------| | [#1604](#1604) | [@jmlrt](https://github.com/jmlrt) | [meta] update docker images | | [#1603](#1603) | [@jmlrt](https://github.com/jmlrt) | [metricbeat] add missing rolebinding and cluster role rules | | [#1602](#1602) | [@jmlrt](https://github.com/jmlrt) | [filebeat] add missing rolebinding and cluster role rules | | [#1593](#1593) | [@jmlrt](https://github.com/jmlrt) | [meta] add support for k8s 1.22 | | [#1582](#1582) | [@jmlrt](https://github.com/jmlrt) | [kibana] fix extra values default values | | [#1581](#1581) | [@jmlrt](https://github.com/jmlrt) | [logstash] fix ServiceAccount inconsistencies | | [#1580](#1580) | [@jmlrt](https://github.com/jmlrt) | [elasticsearch] fix ServiceAccount inconsistencies | | [#1570](#1570) | [@jmlrt](https://github.com/jmlrt) | [logstash] add externalTrafficPolicy support | | [#1569](#1569) | [@jmlrt](https://github.com/jmlrt) | [logstash] add flexible ingress | | [#1563](#1563) | [@jmlrt](https://github.com/jmlrt) | [meta] bump Helm version to 3.8.0 | | [#1538](#1538) | [@chetanv-oi](https://github.com/chetanv-oi) | [elasticsearch] move the yaml separator inside the condition | | [#1530](#1530) | [@jmlrt](https://github.com/jmlrt) | [kibana] use bash for readiness script | | [#1527](#1527) | [@ebuildy](https://github.com/ebuildy) | [apm-server] add pod labels | | [#1524](#1524) | [@beatkind](https://github.com/beatkind) | [metricbeat] bump kube-state-metrics to version 4.7.0 | | [#1521](#1521) | [@ebuildy](https://github.com/ebuildy) | [apm-server] fix podLabels | | [#1494](#1494) | [@ebuildy](https://github.com/ebuildy) | [elasticsearch] add keystore container securityContext | | [#1450](#1450) | [@dmarcs](https://github.com/dmarcs) | [logstash] allow array values for extra | | [#1422](#1422) | [@framsouza](https://github.com/framsouza) | [metricbeat] adding custerRole permissions for leader election | | [#1420](#1420) | [@framsouza](https://github.com/framsouza) | [elasticsearch] [logstash] add support to PodDisruptionBudget policy/v1 | | [#1417](#1417) | [@framsouza](https://github.com/framsouza) | [kibana] add annotations at deployment level | * add breaking changes + update all toc instructions * fix breaking change error

@jmlrt

* 7.17.1 release changelog * 7.17.1 as default version. | PR | Author | Title | |-----------------------------------------------------------|----------------------------------------------|-------------------------------------------------------------------------| | [#1604](elastic/helm-charts#1604) | [@jmlrt](https://github.com/jmlrt) | [meta] update docker images | | [#1603](elastic/helm-charts#1603) | [@jmlrt](https://github.com/jmlrt) | [metricbeat] add missing rolebinding and cluster role rules | | [#1602](elastic/helm-charts#1602) | [@jmlrt](https://github.com/jmlrt) | [filebeat] add missing rolebinding and cluster role rules | | [#1593](elastic/helm-charts#1593) | [@jmlrt](https://github.com/jmlrt) | [meta] add support for k8s 1.22 | | [#1582](elastic/helm-charts#1582) | [@jmlrt](https://github.com/jmlrt) | [kibana] fix extra values default values | | [#1581](elastic/helm-charts#1581) | [@jmlrt](https://github.com/jmlrt) | [logstash] fix ServiceAccount inconsistencies | | [#1580](elastic/helm-charts#1580) | [@jmlrt](https://github.com/jmlrt) | [elasticsearch] fix ServiceAccount inconsistencies | | [#1570](elastic/helm-charts#1570) | [@jmlrt](https://github.com/jmlrt) | [logstash] add externalTrafficPolicy support | | [#1569](elastic/helm-charts#1569) | [@jmlrt](https://github.com/jmlrt) | [logstash] add flexible ingress | | [#1563](elastic/helm-charts#1563) | [@jmlrt](https://github.com/jmlrt) | [meta] bump Helm version to 3.8.0 | | [#1538](elastic/helm-charts#1538) | [@chetanv-oi](https://github.com/chetanv-oi) | [elasticsearch] move the yaml separator inside the condition | | [#1530](elastic/helm-charts#1530) | [@jmlrt](https://github.com/jmlrt) | [kibana] use bash for readiness script | | [#1527](elastic/helm-charts#1527) | [@ebuildy](https://github.com/ebuildy) | [apm-server] add pod labels | | [#1524](elastic/helm-charts#1524) | [@beatkind](https://github.com/beatkind) | [metricbeat] bump kube-state-metrics to version 4.7.0 | | [#1521](elastic/helm-charts#1521) | [@ebuildy](https://github.com/ebuildy) | [apm-server] fix podLabels | | [#1494](elastic/helm-charts#1494) | [@ebuildy](https://github.com/ebuildy) | [elasticsearch] add keystore container securityContext | | [#1450](elastic/helm-charts#1450) | [@dmarcs](https://github.com/dmarcs) | [logstash] allow array values for extra | | [#1422](elastic/helm-charts#1422) | [@framsouza](https://github.com/framsouza) | [metricbeat] adding custerRole permissions for leader election | | [#1420](elastic/helm-charts#1420) | [@framsouza](https://github.com/framsouza) | [elasticsearch] [logstash] add support to PodDisruptionBudget policy/v1 | | [#1417](elastic/helm-charts#1417) | [@framsouza](https://github.com/framsouza) | [kibana] add annotations at deployment level | * add breaking changes + update all toc instructions * fix breaking change error

framsouza added 16 commits October 11, 2021 12:50

Adding support to Ingress networking.k8s.io/v1

3219977

Adjusting ES service name

ca298fd

Removing ingress typo & adjusting python test

1caaa02

Adjusting python tests to use the new ingress version

4b2b7bf

fixing conflict

2611e28

fixing conflict

3843441

Merge branch 'elastic-master'

1391790

Adding support to kubernetes ingress v1 & ClassName

af7de17

Adding reformatted files

10ee16d

Merge branch 'elastic:master' into master

6407ff9

fixing conflict

aefb05e

Adding ClassName & Pathtype on ingress settings

eb96b28

Merge branch 'elastic:master' into master

027448f

Performing syntax adjustments and removing comments

a6be99c

Merge branch 'elastic:main' into main

795095a

custerRole permissions for leader election in k8s 1.19+

d164d6c

framsouza requested a review from jmlrt October 18, 2021 15:58

framsouza self-assigned this Oct 18, 2021

Merge branch 'elastic:main' into main

851231c

jmlrt previously approved these changes Nov 10, 2021

View reviewed changes

jmlrt reviewed Nov 10, 2021

View reviewed changes

framsouza added 2 commits November 16, 2021 11:12

Merge branch 'main' into adjusting-roles

9913e21

Adding fb & mb role

5ae9a7c

framsouza dismissed jmlrt’s stale review via 5ae9a7c November 16, 2021 11:36

jmlrt suggested changes Dec 9, 2021

View reviewed changes

Merge remote-tracking branch 'origin/main' into adjusting-roles

f0a613c

jmlrt added the enhancement New feature or request label Mar 3, 2022

jmlrt added metricbeat need-backport v7.17.0 labels Mar 3, 2022

jmlrt merged commit 7fbeaa7 into elastic:main Mar 3, 2022

jmlrt mentioned this pull request Mar 3, 2022

[7.17] [metricbeat] Adding custerRole permissions for leader election (#1422) #1600

Merged

jmlrt added the backported label Mar 3, 2022

jmlrt removed the need-backport label Mar 4, 2022

jmlrt mentioned this pull request Mar 4, 2022

[filebeat] add missing rolebinding and cluster role rules #1602

Merged

jmlrt mentioned this pull request Mar 4, 2022

[metricbeat] add missing rolebinding and cluster role rules #1603

Merged

jmlrt mentioned this pull request Mar 8, 2022

7.17.1 bump #1609

Merged

jmlrt added v7.17.1 and removed v7.17.0 labels Mar 8, 2022

jmlrt mentioned this pull request Mar 8, 2022

7.17.1 release changelog #1610

Merged

jmlrt mentioned this pull request Apr 21, 2022

7.17.3 bump #1649

Merged

This was referenced Sep 14, 2022

[meta] fix yaml indent #1698

Merged

[meta] follow-up of #1698 #1700

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[metricbeat] Adding custerRole permissions for leader election #1422

[metricbeat] Adding custerRole permissions for leader election #1422

framsouza commented Oct 18, 2021

framsouza commented Oct 19, 2021

jmlrt left a comment

jmlrt left a comment •

edited

Loading

jmlrt commented Nov 10, 2021

framsouza commented Nov 16, 2021

jmlrt Dec 9, 2021

	clusterRoleRules:
	- apiGroups:
	- ""
	resources:
	- namespaces
	- nodes
	- pods
	verbs:
	- get
	- list
	- watch

[metricbeat] Adding custerRole permissions for leader election #1422

[metricbeat] Adding custerRole permissions for leader election #1422

Conversation

framsouza commented Oct 18, 2021

framsouza commented Oct 19, 2021

jmlrt left a comment

Choose a reason for hiding this comment

jmlrt left a comment • edited Loading

Choose a reason for hiding this comment

jmlrt commented Nov 10, 2021

framsouza commented Nov 16, 2021

jmlrt Dec 9, 2021

Choose a reason for hiding this comment

jmlrt left a comment •

edited

Loading