agent.yaml

apiVersion: apps/v1
kind: Deployment
metadata:
  name: poddeck-agent
spec:
  replicas: 1
  selector:
    matchLabels:
      app: poddeck-agent
  template:
    metadata:
      labels:
        app: poddeck-agent
    spec:
      serviceAccountName: poddeck-agent
      hostNetwork: true
      containers:
        - name: poddeck-agent
          image: poddeck-agent:latest
          imagePullPolicy: Never
          env:
            - name: HELM_REPOSITORY_CACHE
              value: /helm/cache
            - name: HELM_REPOSITORY_CONFIG
              value: /helm/config/repositories.yaml
          volumeMounts:
            - name: helm-cache
              mountPath: /helm/cache
            - name: helm-config
              mountPath: /helm/config
          resources:
            requests:
              cpu: "100m"
              memory: "512Mi"
            limits:
              cpu: "1000m"
              memory: "2Gi"
      volumes:
        - name: helm-cache
          persistentVolumeClaim:
            claimName: poddeck-helm-cache-pvc
        - name: helm-config
          persistentVolumeClaim:
            claimName: poddeck-helm-config-pvc
---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: poddeck-helm-cache-pvc
spec:
  accessModes:
    - ReadWriteOnce
  resources:
    requests:
      storage: 1Gi
---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: poddeck-helm-config-pvc
spec:
  accessModes:
    - ReadWriteOnce
  resources:
    requests:
      storage: 100Mi
---
apiVersion: v1
kind: Namespace
metadata:
  name: monitoring
---
apiVersion: v1
kind: ConfigMap
metadata:
  name: telegraf-config
  namespace: monitoring
data:
  telegraf.conf: |
    [agent]
      interval = "1s"
      round_interval = true
      metric_batch_size = 1000
      metric_buffer_limit = 10000
      collection_jitter = "0s"
      flush_interval = "1s"
      flush_jitter = "0s"
      precision = ""
      debug = false
      quiet = false
      logfile = ""
      hostname = ""

    [[outputs.prometheus_client]]
      listen = ":9273"
      path = "/metrics"
      expiration_interval = "60s"

    [[inputs.cpu]]
      percpu = true
      totalcpu = true
      collect_cpu_time = false
      report_active = false

    [[inputs.mem]]
    [[inputs.disk]]
      ignore_fs = ["tmpfs", "devtmpfs"]
    [[inputs.net]]
---
apiVersion: apps/v1
kind: DaemonSet
metadata:
  name: telegraf
  namespace: monitoring
  labels:
    app: telegraf
spec:
  selector:
    matchLabels:
      app: telegraf
  template:
    metadata:
      labels:
        app: telegraf
    spec:
      containers:
        - name: telegraf
          image: telegraf:latest
          resources:
            limits:
              memory: "200Mi"
              cpu: "500m"
            requests:
              memory: "100Mi"
              cpu: "250m"
          volumeMounts:
            - name: telegraf-config
              mountPath: /etc/telegraf
          ports:
            - containerPort: 9273
              name: metrics
              protocol: TCP
          readinessProbe:
            httpGet:
              path: /metrics
              port: 9273
            initialDelaySeconds: 5
            periodSeconds: 10
          livenessProbe:
            httpGet:
              path: /metrics
              port: 9273
            initialDelaySeconds: 10
            periodSeconds: 20
      volumes:
        - name: telegraf-config
          configMap:
            name: telegraf-config
      tolerations:
        - key: "node-role.kubernetes.io/master"
          operator: "Exists"
          effect: "NoSchedule"
        - key: "node-role.kubernetes.io/control-plane"
          operator: "Exists"
          effect: "NoSchedule"
      terminationGracePeriodSeconds: 30
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: poddeck-agent
  namespace: default
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: node-reader
rules:
  - apiGroups: [""]
    resources: ["nodes"]
    verbs: ["get", "list", "watch"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: default-node-reader
subjects:
  - kind: ServiceAccount
    name: poddeck-agent
    namespace: default
roleRef:
  kind: ClusterRole
  name: node-reader
  apiGroup: rbac.authorization.k8s.io
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: poddeck-agent-pod-admin
rules:
  - apiGroups: [""]
    resources:
      - pods
      - pods/log
      - pods/exec
      - pods/attach
      - pods/portforward
      - pods/proxy
      - pods/status
    verbs:
      - "*"
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: poddeck-agent-pod-admin-binding
subjects:
  - kind: ServiceAccount
    name: poddeck-agent
    namespace: default
roleRef:
  kind: ClusterRole
  name: poddeck-agent-pod-admin
  apiGroup: rbac.authorization.k8s.io
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: namespace-admin
rules:
  - apiGroups: [""]
    resources: ["namespaces"]
    verbs:
      - get
      - list
      - watch
      - create
      - delete
      - deletecollection
      - patch
      - update
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: poddeck-agent-namespace-admin
subjects:
  - kind: ServiceAccount
    name: poddeck-agent
    namespace: default
roleRef:
  kind: ClusterRole
  name: namespace-admin
  apiGroup: rbac.authorization.k8s.io
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: poddeck-agent-events
rules:
  - apiGroups: [""]
    resources: ["events"]
    verbs:
      - get
      - list
      - watch
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: poddeck-agent-events-binding
subjects:
  - kind: ServiceAccount
    name: poddeck-agent
    namespace: default
roleRef:
  kind: ClusterRole
  name: poddeck-agent-events
  apiGroup: rbac.authorization.k8s.io
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: poddeck-agent-unit-admin
rules:
  - apiGroups: ["apps"]
    resources:
      - deployments
      - deployments/scale
      - deployments/status
      - daemonsets
      - daemonsets/status
      - statefulsets
      - statefulsets/scale
      - statefulsets/status
      - replicasets
      - replicasets/scale
      - replicasets/status
    verbs:
      - get
      - list
      - watch
      - create
      - update
      - patch
      - delete
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: poddeck-agent-unit-admin-binding
subjects:
  - kind: ServiceAccount
    name: poddeck-agent
    namespace: default
roleRef:
  kind: ClusterRole
  name: poddeck-agent-unit-admin
  apiGroup: rbac.authorization.k8s.io
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: poddeck-agent-service-admin
rules:
  - apiGroups: [""]
    resources:
      - services
      - services/status
    verbs:
      - get
      - list
      - watch
      - create
      - update
      - patch
      - delete
  - apiGroups: [""]
    resources:
      - endpoints
    verbs:
      - get
      - list
      - watch
      - create
      - update
      - patch
      - delete
  - apiGroups: ["discovery.k8s.io"]
    resources:
      - endpointslices
    verbs:
      - get
      - list
      - watch
      - create
      - update
      - patch
      - delete
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: poddeck-agent-service-admin-binding
subjects:
  - kind: ServiceAccount
    name: poddeck-agent
    namespace: default
roleRef:
  kind: ClusterRole
  name: poddeck-agent-service-admin
  apiGroup: rbac.authorization.k8s.io
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: poddeck-agent-cronjob-admin
rules:
  - apiGroups: ["batch"]
    resources:
      - cronjobs
      - cronjobs/status
    verbs:
      - get
      - list
      - watch
      - create
      - update
      - patch
      - delete
  - apiGroups: ["batch"]
    resources:
      - jobs
      - jobs/status
    verbs:
      - get
      - list
      - watch
      - create
      - delete
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: poddeck-agent-cronjob-admin-binding
subjects:
  - kind: ServiceAccount
    name: poddeck-agent
    namespace: default
roleRef:
  kind: ClusterRole
  name: poddeck-agent-cronjob-admin
  apiGroup: rbac.authorization.k8s.io
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: poddeck-agent-helm-secrets
rules:
  - apiGroups: [""]
    resources:
      - secrets
    verbs:
      - get
      - list
      - watch
      - create
      - update
      - patch
      - delete
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: poddeck-agent-helm-secrets-binding
subjects:
  - kind: ServiceAccount
    name: poddeck-agent
    namespace: default
roleRef:
  kind: ClusterRole
  name: poddeck-agent-helm-secrets
  apiGroup: rbac.authorization.k8s.io