diff --git a/Doc/docs/assets/cf_sidecar_proxy_topology.gif b/Doc/docs/assets/cf_sidecar_proxy_topology.gif deleted file mode 100644 index 83ab8153..00000000 Binary files a/Doc/docs/assets/cf_sidecar_proxy_topology.gif and /dev/null differ diff --git a/app.png b/app.png deleted file mode 100644 index 605b3ab7..00000000 Binary files a/app.png and /dev/null differ diff --git a/helm/Chart.yaml b/helm/Chart.yaml new file mode 100644 index 00000000..675510cd --- /dev/null +++ b/helm/Chart.yaml @@ -0,0 +1,5 @@ +apiVersion: v2 +name: CortexBrain +version: 0.1.0 +description: | + This chart installs CortexFlow to a kubernetes cluster, instead of using the cli installation method. diff --git a/helm/README.md b/helm/README.md new file mode 100644 index 00000000..892ad7ba --- /dev/null +++ b/helm/README.md @@ -0,0 +1,85 @@ +# CortexBrain + +![Version: 0.1.0](https://img.shields.io/badge/Version-0.1.0-informational?style=flat-square) + +This chart installs CortexFlow to a kubernetes cluster, instead of using the cli installation method. + +## Values + +| Key | Type | Default | Description | +|-----|------|---------|-------------| +| agent.image.repository | string | `"ghcr.io/cortexflow/agent"` | | +| agent.image.version | string | `"latest"` | | +| agent.priorityClassName | string | `""` | | +| agent.resources.limits.memory | string | `"200Mi"` | | +| agent.resources.requests.cpu | string | `"100m"` | | +| agent.resources.requests.memory | string | `"100Mi"` | | +| agent.securityContext.allowPrivilegeEscalation | bool | `true` | | +| agent.securityContext.capabilities.add[0] | string | `"SYS_ADMIN"` | | +| agent.securityContext.capabilities.add[1] | string | `"NET_ADMIN"` | | +| agent.securityContext.capabilities.add[2] | string | `"SYS_RESOURCE"` | | +| agent.securityContext.capabilities.add[3] | string | `"BPF"` | | +| agent.securityContext.capabilities.add[4] | string | `"SYS_PTRACE"` | | +| agent.securityContext.privileged | bool | `true` | | +| agent.tolerations | list | `[]` | | +| blocklist | string | `""` | | +| bpfMapPermissions.image.repository | string | `"ubuntu"` | | +| bpfMapPermissions.image.version | string | `"24.04"` | | +| bpfMapPermissions.securityContext.allowPrivilegeEscalation | bool | `true` | | +| bpfMapPermissions.securityContext.capabilities.add[0] | string | `"SYS_ADMIN"` | | +| bpfMapPermissions.securityContext.capabilities.add[1] | string | `"NET_ADMIN"` | | +| bpfMapPermissions.securityContext.capabilities.add[2] | string | `"SYS_RESOURCE"` | | +| bpfMapPermissions.securityContext.capabilities.add[3] | string | `"BPF"` | | +| bpfMapPermissions.securityContext.capabilities.add[4] | string | `"SYS_PTRACE"` | | +| bpfMapPermissions.securityContext.privileged | bool | `true` | | +| bpfMapPermissions.securityContext.runAsUser | int | `0` | | +| bpfTool.image.repository | string | `"danielpacak/bpftool-runner"` | | +| bpfTool.image.version | string | `"latest"` | | +| bpfTool.resources.limits.cpu | string | `"1"` | | +| bpfTool.resources.limits.memory | string | `"200Mi"` | | +| bpfTool.resources.requests.cpu | string | `"1"` | | +| bpfTool.resources.requests.memory | string | `"100Mi"` | | +| bpfTool.securityContext.allowPrivilegeEscalation | bool | `true` | | +| bpfTool.securityContext.capabilities.add[0] | string | `"SYS_ADMIN"` | | +| bpfTool.securityContext.capabilities.add[1] | string | `"NET_ADMIN"` | | +| bpfTool.securityContext.capabilities.add[2] | string | `"SYS_RESOURCE"` | | +| bpfTool.securityContext.capabilities.add[3] | string | `"BPF"` | | +| bpfTool.securityContext.capabilities.add[4] | string | `"SYS_PTRACE"` | | +| bpfTool.securityContext.privileged | bool | `true` | | +| global.otel.endpoint | string | `"http://localhost:4317"` | | +| global.otel.protocol | string | `"grpc"` | | +| global.priorityClassName | string | `""` | | +| global.tolerations | list | `[]` | | +| identity.image.repository | string | `"ghcr.io/cortexflow/identity"` | | +| identity.image.version | string | `"latest"` | | +| identity.priorityClassName | string | `""` | | +| identity.resources.limits.memory | string | `"200Mi"` | | +| identity.resources.requests.cpu | string | `"100m"` | | +| identity.resources.requests.memory | string | `"100Mi"` | | +| identity.securityContext.allowPrivilegeEscalation | bool | `true` | | +| identity.securityContext.capabilities.add[0] | string | `"SYS_ADMIN"` | | +| identity.securityContext.capabilities.add[1] | string | `"NET_ADMIN"` | | +| identity.securityContext.capabilities.add[2] | string | `"SYS_RESOURCE"` | | +| identity.securityContext.capabilities.add[3] | string | `"BPF"` | | +| identity.securityContext.capabilities.add[4] | string | `"SYS_PTRACE"` | | +| identity.securityContext.privileged | bool | `true` | | +| identity.tolerations | list | `[]` | | +| metrics.image.repository | string | `"ghcr.io/cortexflow/metrics"` | | +| metrics.image.version | string | `"latest"` | | +| metrics.priorityClassName | string | `""` | | +| metrics.resources.limits.cpu | string | `"1"` | | +| metrics.resources.limits.memory | string | `"200Mi"` | | +| metrics.resources.requests.cpu | string | `"1"` | | +| metrics.resources.requests.memory | string | `"100Mi"` | | +| metrics.securityContext.allowPrivilegeEscalation | bool | `true` | | +| metrics.securityContext.capabilities.add[0] | string | `"SYS_ADMIN"` | | +| metrics.securityContext.capabilities.add[1] | string | `"NET_ADMIN"` | | +| metrics.securityContext.capabilities.add[2] | string | `"SYS_RESOURCE"` | | +| metrics.securityContext.capabilities.add[3] | string | `"BPF"` | | +| metrics.securityContext.capabilities.add[4] | string | `"SYS_PTRACE"` | | +| metrics.securityContext.privileged | bool | `true` | | +| metrics.tolerations | list | `[]` | | +| serviceAccountName | string | `"cortexflow-sa"` | | + +---------------------------------------------- +Autogenerated from chart metadata using [helm-docs v1.14.2](https://github.com/norwoodj/helm-docs/releases/v1.14.2) diff --git a/helm/templates/_helper.tpl b/helm/templates/_helper.tpl new file mode 100644 index 00000000..815611d8 --- /dev/null +++ b/helm/templates/_helper.tpl @@ -0,0 +1,31 @@ +{{/* +Sets tolerations for daemonsets either from the global var or from individual values +*/}} +{{- define "common.tolerations" }} +{{- $ctx := .context }} +{{- $component := .component }} +{{- $local := index $ctx.Values $component "tolerations" }} +{{- $global := $ctx.Values.global.tolerations }} +{{- if and (not (empty $local)) }} +tolerations: +{{ toYaml $local | indent 2 }} +{{- else if and (not (empty $global)) }} +tolerations: +{{ toYaml $global | indent 2 }} +{{- end }} +{{- end }} + +{{/* +Sets priorityClassName for daemonsets either from the global var or from individual values +*/}} +{{- define "common.priorityClassName" }} +{{- $ctx := .context }} +{{- $component := .component }} +{{- $local := index $ctx.Values $component "priorityClassName" }} +{{- $global := $ctx.Values.global.priorityClassName }} +{{- if and (not (empty $local)) }} +priorityClassName: {{ toYaml $local }} +{{- else if and (not (empty $global)) }} +priorityClassName: {{ toYaml $global }} +{{- end }} +{{- end }} diff --git a/helm/templates/agent.yaml b/helm/templates/agent.yaml new file mode 100644 index 00000000..b8036c01 --- /dev/null +++ b/helm/templates/agent.yaml @@ -0,0 +1,106 @@ +apiVersion: apps/v1 +kind: DaemonSet +metadata: + name: cortexflow-agent + labels: + app: cortexflow-agent +spec: + selector: + matchLabels: + app: cortexflow-agent + template: + metadata: + labels: + app: cortexflow-agent + annotations: + checksum/config: {{ include (print $.Template.BasePath "/configmap.yaml") . | sha256sum }} + spec: + serviceAccountName: {{ .Values.serviceAccountName }} + hostPID: true + hostNetwork: true + {{- include "common.tolerations" (dict "context" . "component" "agent") | indent 6 }} + {{- include "common.priorityClassName" (dict "context" . "component" "agent") | indent 6 }} + containers: + - name: agent + image: "{{ .Values.agent.image.repository }}:{{ .Values.agent.image.version }}" + command: ["/bin/bash", "-c"] + args: + - | + echo "Running on kernel $(uname -r)" + if [ ! -d "/sys/fs/bpf" ]; then + echo "ERROR: BPF filesystem not mounted" + exit 1 + else + echo "Checking ebpf path..." + ls -l /sys/fs/bpf + fi + echo "checking privileges" + ls -ld /sys/fs/bpf + + echo "checking if conntracker path" + ls -l /usr/src/cortexbrain-agent/conntracker + + echo "checking if the bpf maps are reachable" + ls -l /sys/fs/bpf/maps + + echo "Running application..." + exec /usr/local/bin/agent-api || echo "Application exited with code $?" + env: + - name: OTEL_SERVICE_NAME + value: cortexflow-agent + - name: OTEL_EXPORTER_OTLP_ENDPOINT + value: {{ .Values.global.otel.endpoint }} + - name: OTEL_EXPORTER_OTLP_PROTOCOL + value: {{ .Values.global.otel.protocol }} + - name: OTEL_RESOURCE_ATTRIBUTES + value: service.namespace=cortexflow,service.version=0.1.5 + - name: AGENT_API_ENABLE_REFLECTION + value: "true" + volumeMounts: + - name: bpf + mountPath: /sys/fs/bpf + mountPropagation: Bidirectional + readOnly: false + - name: proc + mountPath: /host/proc + readOnly: false + - name: kernel-dev + mountPath: /lib/modules + readOnly: false + resources: + {{- .Values.identity.resources | toYaml | nindent 12 }} + securityContext: + {{- .Values.agent.securityContext | toYaml | nindent 12 }} + volumes: + - name: bpf + hostPath: + path: /sys/fs/bpf + type: Directory + - name: proc + hostPath: + path: /proc + type: Directory + - name: kernel-dev + hostPath: + path: /lib/modules + type: Directory + +--- + +apiVersion: v1 +kind: Service +metadata: + name: cortexflow-agent + namespace: cortexflow +spec: + selector: + app: cortexflow-agent + ports: + - protocol: TCP + name: agent-server-port + port: 9090 + targetPort: 9090 + appProtocol: grpc + type: ClusterIP + +--- diff --git a/helm/templates/configmap-role.yaml b/helm/templates/configmap-role.yaml new file mode 100644 index 00000000..70b4f76b --- /dev/null +++ b/helm/templates/configmap-role.yaml @@ -0,0 +1,21 @@ +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + name: configmap-reader +rules: + - apiGroups: [""] + resources: ["configmaps","services"] + verbs: ["get", "list","watch"] +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: configmap-reader-binding +subjects: + - kind: ServiceAccount + name: {{ .Values.serviceAccountName }} + namespace: {{ .Release.Namespace }} +roleRef: + kind: Role + name: configmap-reader + apiGroup: rbac.authorization.k8s.io diff --git a/helm/templates/configmap.yaml b/helm/templates/configmap.yaml new file mode 100644 index 00000000..9a56dc6c --- /dev/null +++ b/helm/templates/configmap.yaml @@ -0,0 +1,6 @@ +apiVersion: v1 +kind: ConfigMap +metadata: + name: cortexbrain-client-config +data: + blocklist: {{ .Values.blocklist | quote }} diff --git a/helm/templates/identity.yaml b/helm/templates/identity.yaml new file mode 100644 index 00000000..a4dbf611 --- /dev/null +++ b/helm/templates/identity.yaml @@ -0,0 +1,120 @@ +apiVersion: apps/v1 +kind: DaemonSet +metadata: + name: cortexflow-identity + labels: + app: cortexflow-identity +spec: + selector: + matchLabels: + app: cortexflow-identity + template: + metadata: + labels: + app: cortexflow-identity + annotations: + checksum/config: {{ include (print $.Template.BasePath "/configmap.yaml") . | sha256sum }} + spec: + serviceAccountName: {{ .Values.serviceAccountName }} + hostPID: true + hostNetwork: true + {{- include "common.tolerations" (dict "context" . "component" "identity") | indent 6 }} + {{- include "common.priorityClassName" (dict "context" . "component" "identity") | indent 6 }} + initContainers: + - name: bpf-map-permissions + image: "{{ .Values.bpfMapPermissions.image.repository }}:{{ .Values.bpfMapPermissions.image.version }}" + command: ["/bin/bash","-c"] + args: + - | + echo "mounting the bpf path " + mount -t bpf bpf /sys/fs/bpf + + echo "checking permissions" + ls -ld /sys/fs/bpf + volumeMounts: + - name: bpf + mountPath: /sys/fs/bpf + mountPropagation: Bidirectional + readOnly: false + - name: kernel-dev + mountPath: /lib/modules + readOnly: false + - name: cgroup + mountPath: /sys/fs/cgroup + readOnly: true + securityContext: + {{- .Values.bpfMapPermissions.securityContext | toYaml | nindent 12}} + containers: + - name: identity + image: "{{ .Values.identity.image.repository }}:{{ .Values.identity.image.version }}" + command: ["/bin/bash", "-c"] + args: + - | + echo "Running on kernel $(uname -r)" + if [ ! -d "/sys/fs/bpf" ]; then + echo "ERROR: BPF filesystem not mounted" + exit 1 + else + echo "Checking ebpf path..." + ls -l /sys/fs/bpf + fi + echo "checking privileges" + ls -ld /sys/fs/bpf + + echo "Running application..." + exec /usr/local/bin/cortexflow-identity-service || echo "Application exited with code $?" + env: + - name: OTEL_SERVICE_NAME + value: cortexflow-identity + - name: OTEL_EXPORTER_OTLP_ENDPOINT + value: {{ .Values.global.otel.endpoint }} + - name: OTEL_EXPORTER_OTLP_PROTOCOL + value: {{ .Values.global.otel.protocol }} + - name: OTEL_RESOURCE_ATTRIBUTES + value: service.namespace=cortexflow,service.version=0.1.5 + resources: + {{- .Values.identity.resources | toYaml | nindent 12 }} + volumeMounts: + - name: bpf + mountPath: /sys/fs/bpf + mountPropagation: Bidirectional + readOnly: false + - name: kernel-dev + mountPath: /lib/modules + readOnly: false + - name: cgroup + mountPath: /sys/fs/cgroup + readOnly: true + securityContext: + {{- .Values.identity.securityContext | toYaml | nindent 12 }} + - name: bpftool-control-manager + image: "{{ .Values.bpfTool.image.repository }}:{{ .Values.bpfTool.image.version }}" + command: ["/bin/bash", "-c","sleep infinity"] + volumeMounts: + - name: bpf + mountPath: /sys/fs/bpf + mountPropagation: Bidirectional + readOnly: false + - name: kernel-dev + mountPath: /lib/modules + readOnly: false + - name: cgroup + mountPath: /sys/fs/cgroup + readOnly: true + resources: + {{- .Values.bpfTool.resources | toYaml | nindent 12 }} + securityContext: + {{- .Values.bpfTool.securityContext | toYaml | nindent 12 }} + volumes: + - name: bpf + hostPath: + path: /sys/fs/bpf + type: Directory + - name: kernel-dev + hostPath: + path: /lib/modules + type: Directory + - name: cgroup + hostPath: + path: /sys/fs/cgroup + type: Directory diff --git a/helm/templates/metrics.yaml b/helm/templates/metrics.yaml new file mode 100644 index 00000000..1f2e71de --- /dev/null +++ b/helm/templates/metrics.yaml @@ -0,0 +1,105 @@ +apiVersion: apps/v1 +kind: DaemonSet +metadata: + name: cortexflow-metrics + namespace: cortexflow + labels: + app: cortexflow-metrics +spec: + selector: + matchLabels: + app: cortexflow-metrics + template: + metadata: + labels: + app: cortexflow-metrics + annotations: + checksum/config: {{ include (print $.Template.BasePath "/configmap.yaml") . | sha256sum }} + spec: + serviceAccountName: {{ .Values.serviceAccountName }} + hostPID: true + hostNetwork: true + {{- include "common.tolerations" (dict "context" . "component" "metrics") | indent 6 }} + {{- include "common.priorityClassName" (dict "context" . "component" "metrics") | indent 6 }} + containers: + - name: metrics + image: "{{ .Values.metrics.image.repository }}:{{ .Values.metrics.image.version }}" + command: ["/bin/bash", "-c"] + args: + - | + echo "Running on kernel $(uname -r)" + if [ ! -d "/sys/fs/bpf" ]; then + echo "ERROR: BPF filesystem not mounted" + exit 1 + else + echo "Checking ebpf path..." + ls -l /sys/fs/bpf + fi + echo "checking privileges" + ls -ld /sys/fs/bpf + + echo "Running application..." + exec /usr/local/bin/cortexflow-metrics || echo "Application exited with code $?" + env: + - name: OTEL_SERVICE_NAME + value: cortexflow-metrics + - name: OTEL_EXPORTER_OTLP_ENDPOINT + value: {{ .Values.global.otel.endpoint }} + - name: OTEL_EXPORTER_OTLP_PROTOCOL + value: {{ .Values.global.otel.protocol }} + - name: OTEL_RESOURCE_ATTRIBUTES + value: service.namespace=cortexflow,service.version=0.1.5 + volumeMounts: + - name: bpf + mountPath: /sys/fs/bpf + mountPropagation: Bidirectional + readOnly: false + - name: proc + mountPath: /host/proc + readOnly: false + - name: kernel-dev + mountPath: /lib/modules + readOnly: false + - name: tracefs + mountPath: /sys/kernel/debug + readOnly: false + securityContext: + {{- .Values.metrics.securityContext | toYaml | nindent 12 }} + - name: bpftool-control-manager + image: "{{ .Values.bpfTool.image.repository }}:{{ .Values.bpfTool.image.version }}" + command: ["/bin/bash", "-c", "sleep infinity"] + volumeMounts: + - name: bpf + mountPath: /sys/fs/bpf + mountPropagation: Bidirectional + readOnly: false + - name: proc + mountPath: /host/proc + readOnly: false + - name: kernel-dev + mountPath: /lib/modules + readOnly: false + - name: tracefs + mountPath: /sys/kernel/debug + readOnly: false + resources: + {{- .Values.bpfTool.resources | toYaml | nindent 12 }} + securityContext: + {{- .Values.bpfTool.securityContext | toYaml | nindent 12 }} + volumes: + - name: bpf + hostPath: + path: /sys/fs/bpf + type: Directory + - name: proc + hostPath: + path: /proc + type: Directory + - name: kernel-dev + hostPath: + path: /lib/modules + type: Directory + - name: tracefs + hostPath: + path: /sys/kernel/debug + type: Directory diff --git a/helm/templates/serviceAccount.yaml b/helm/templates/serviceAccount.yaml new file mode 100644 index 00000000..aa7977de --- /dev/null +++ b/helm/templates/serviceAccount.yaml @@ -0,0 +1,4 @@ +apiVersion: v1 +kind: ServiceAccount +metadata: + name: {{ .Values.serviceAccountName }} diff --git a/helm/values.yaml b/helm/values.yaml new file mode 100644 index 00000000..f50852ea --- /dev/null +++ b/helm/values.yaml @@ -0,0 +1,117 @@ +global: + otel: + endpoint: http://localhost:4317 + protocol: grpc + tolerations: [] + priorityClassName: "" + +blocklist: "" +serviceAccountName: cortexflow-sa + +agent: + image: + repository: ghcr.io/cortexflow/agent + version: latest + resources: + limits: + memory: "200Mi" + requests: + cpu: "100m" + memory: "100Mi" + securityContext: + privileged: true + allowPrivilegeEscalation: true + capabilities: + add: + - SYS_ADMIN + - NET_ADMIN + - SYS_RESOURCE + - BPF + - SYS_PTRACE + tolerations: [] + priorityClassName: "" + +identity: + image: + repository: ghcr.io/cortexflow/identity + version: latest + resources: + limits: + memory: "200Mi" + requests: + cpu: "100m" + memory: "100Mi" + securityContext: + privileged: true + allowPrivilegeEscalation: true + capabilities: + add: + - SYS_ADMIN + - NET_ADMIN + - SYS_RESOURCE + - BPF + - SYS_PTRACE + tolerations: [] + priorityClassName: "" + +metrics: + image: + repository: ghcr.io/cortexflow/metrics + version: latest + resources: + limits: + cpu: "1" + memory: "200Mi" + requests: + cpu: "1" + memory: "100Mi" + securityContext: + privileged: true + allowPrivilegeEscalation: true + capabilities: + add: + - SYS_ADMIN + - NET_ADMIN + - SYS_RESOURCE + - BPF + - SYS_PTRACE + tolerations: [] + priorityClassName: "" + +bpfTool: + image: + repository: danielpacak/bpftool-runner + version: latest + resources: + limits: + cpu: "1" + memory: "200Mi" + requests: + cpu: "1" + memory: "100Mi" + securityContext: + privileged: true + allowPrivilegeEscalation: true + capabilities: + add: + - SYS_ADMIN + - NET_ADMIN + - SYS_RESOURCE + - BPF + - SYS_PTRACE + +bpfMapPermissions: + image: + repository: ubuntu + version: "24.04" + securityContext: + runAsUser: 0 + privileged: true + allowPrivilegeEscalation: true + capabilities: + add: + - SYS_ADMIN + - NET_ADMIN + - SYS_RESOURCE + - BPF + - SYS_PTRACE