Merge branch 'master' into kristinnardal2/generic-oidc

charts/chronograf/templates/ingress.yaml

 {{- if .Values.ingress.enabled -}}
-apiVersion: extensions/v1beta1
+apiVersion: networking.k8s.io/v1beta1
 kind: Ingress
 metadata:
   name: {{ template "chronograf.fullname" . }}
@@ -21,7 +21,7 @@ spec:
   - host: {{ .Values.ingress.hostname }}
     http:
       paths:
-      - path: /
+      - path: {{ .Values.ingress.path }}
         backend:
           serviceName: {{ template "chronograf.fullname" . }}
           servicePort: 80

charts/chronograf/values.yaml

@@ -66,6 +66,7 @@ ingress:
     # kubernetes.io/ingress.class: "nginx"
     # secretName: my-tls-cert
     # kubernetes.io/tls-acme: "true"
+  path: /
 
 ## OAuth Settings for OAuth Providers
 ## More information -> https://github.com/influxdata/chronograf/blob/master/docs/auth.md

charts/influxdb/Chart.yaml

 apiVersion: v1
 name: influxdb
-version: 4.4.7
+version: 4.4.11
 appVersion: 1.7.10
 description: Scalable datastore for metrics, events, and real-time analytics.
 keywords:

charts/influxdb/README.md

@@ -77,6 +77,8 @@ The command removes all the Kubernetes components associated with the chart and
 | tolerations | [Tolerations](https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/) for pod assignment | [] |
 | securityContext | [securityContext](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/) for pod | {} |
 | env | environment variables for influxdb container | {} |
+| volumes | `volumes` stanza(s) to be used in the main container | nil |
+| mountPoints | `volumeMount` stanza(s) to be used in the main container | nil |
 | config.reporting_disabled | [Details](https://docs.influxdata.com/influxdb/v1.7/administration/config/#reporting-disabled-false) | false |
 | config.rpc | RPC address for backup and storage | {} |
 | config.meta | [Details](https://docs.influxdata.com/influxdb/v1.7/administration/config/#meta) | {} |
@@ -251,6 +253,22 @@ spec:
 At which point the data from the new `<db name>_bak` dbs would have to be side loaded into the original dbs.
 Please see [InfluxDB documentation for more restore examples](https://docs.influxdata.com/influxdb/v1.7/administration/backup_and_restore/#restore-examples).
 
+## Mounting extra volumes
+
+Extra volumes can be mounted by providing the `volumes` and `mountPoints` keys, consistent
+with the behavior of other charts provided by Influxdata.
+
+```yaml
+volumes:
+- name: ssl-cert-volume
+  secret:
+    secretName: secret-name
+mountPoints:
+- name: ssl-cert-volume
+  mountPath: /etc/ssl/certs/selfsigned/
+  readOnly: true
+```
+
 ## Upgrading
 
 ### From < 1.0.0 To >= 1.0.0

charts/influxdb/templates/NOTES.txt

 InfluxDB can be accessed via port {{ .Values.config.http.bind_address | default 8086 }} on the following DNS name from within your cluster:
 
-- http://{{ include "influxdb.fullname" . }}.{{ .Release.Namespace }}:{{ .Values.config.http.bind_address | default 8086 }}
+  http://{{ include "influxdb.fullname" . }}.{{ .Release.Namespace }}:{{ .Values.config.http.bind_address | default 8086 }}
 
-You can easily connect to the remote instance with your local influx cli. To forward the API port to localhost:8086 run the following:
+You can connect to the remote instance with the influx CLI. To forward the API port to localhost:8086, run the following:
 
-- kubectl port-forward --namespace {{ .Release.Namespace }} $(kubectl get pods --namespace {{ .Release.Namespace }} -l app={{ include "influxdb.fullname" . }} -o jsonpath='{ .items[0].metadata.name }') 8086:{{ .Values.config.http.bind_address | default 8086 }}
+  kubectl port-forward --namespace {{ .Release.Namespace }} $(kubectl get pods --namespace {{ .Release.Namespace }} -l app={{ include "influxdb.fullname" . }} -o jsonpath='{ .items[0].metadata.name }') 8086:{{ .Values.config.http.bind_address | default 8086 }}
 
-You can also connect to the influx cli from inside the container. To open a shell session in the InfluxDB pod run the following:
+You can also connect to the influx CLI from inside the container. To open a shell session in the InfluxDB pod, run the following:
 
-- kubectl exec -i -t --namespace {{ .Release.Namespace }} $(kubectl get pods --namespace {{ .Release.Namespace }} -l app={{ include "influxdb.fullname" . }} -o jsonpath='{.items[0].metadata.name}') /bin/sh
+  kubectl exec -i -t --namespace {{ .Release.Namespace }} $(kubectl get pods --namespace {{ .Release.Namespace }} -l app={{ include "influxdb.fullname" . }} -o jsonpath='{.items[0].metadata.name}') /bin/sh
 
-To tail the logs for the InfluxDB pod run the following:
+To view the logs for the InfluxDB pod, run the following:
 
-- kubectl logs -f --namespace {{ .Release.Namespace }} $(kubectl get pods --namespace {{ .Release.Namespace }} -l app={{ include "influxdb.fullname" . }} -o jsonpath='{ .items[0].metadata.name }')
+  kubectl logs -f --namespace {{ .Release.Namespace }} $(kubectl get pods --namespace {{ .Release.Namespace }} -l app={{ include "influxdb.fullname" . }} -o jsonpath='{ .items[0].metadata.name }')
 
 {{- if .Values.setDefaultUser.enabled }}
 
@@ -20,11 +20,11 @@ To retrieve the default user name:
 
 {{- if .Values.setDefaultUser.user.existingSecret }}
 
-- echo $(kubectl get secret {{ .Values.setDefaultUser.user.existingSecret }} -o "jsonpath={.data['influxdb-user']}" --namespace {{ .Release.Namespace }} | base64 --decode)
+  echo $(kubectl get secret {{ .Values.setDefaultUser.user.existingSecret }} -o "jsonpath={.data['influxdb-user']}" --namespace {{ .Release.Namespace }} | base64 --decode)
 
 {{- else }}
 
-- echo $(kubectl get secret {{ include "influxdb.fullname" . }}-auth -o "jsonpath={.data['influxdb-user']}" --namespace {{ .Release.Namespace }} | base64 --decode)
+  echo $(kubectl get secret {{ include "influxdb.fullname" . }}-auth -o "jsonpath={.data['influxdb-user']}" --namespace {{ .Release.Namespace }} | base64 --decode)
 
 {{- end }}
 
@@ -32,11 +32,11 @@ To retrieve the default user password:
 
 {{- if .Values.setDefaultUser.user.existingSecret }}
 
-- echo $(kubectl get secret {{ .Values.setDefaultUser.user.existingSecret }} -o "jsonpath={.data['influxdb-password']}" --namespace {{ .Release.Namespace }} | base64 --decode)
+  echo $(kubectl get secret {{ .Values.setDefaultUser.user.existingSecret }} -o "jsonpath={.data['influxdb-password']}" --namespace {{ .Release.Namespace }} | base64 --decode)
 
 {{- else }}
 
-- echo $(kubectl get secret {{ include "influxdb.fullname" . }}-auth -o "jsonpath={.data['influxdb-password']}" --namespace {{ .Release.Namespace }} | base64 --decode)
+  echo $(kubectl get secret {{ include "influxdb.fullname" . }}-auth -o "jsonpath={.data['influxdb-password']}" --namespace {{ .Release.Namespace }} | base64 --decode)
 
 {{- end }}
 {{- end }}

charts/influxdb/templates/ingress.yaml

@@ -18,7 +18,7 @@ spec:
   - host: {{ .Values.ingress.hostname }}
     http:
       paths:
-      - path: /
+      - path: {{ .Values.ingress.path }}
         backend:
           serviceName: {{ include "influxdb.fullname" . }}
           servicePort: 8086

charts/influxdb/templates/statefulset.yaml

@@ -121,6 +121,9 @@ spec:
         - name: init
           mountPath: /docker-entrypoint-initdb.d
         {{- end }}
+        {{- if .Values.mountPoints }}
+{{ toYaml .Values.mountPoints | indent 8 }}
+        {{- end }}
       volumes:
       - name: config
         configMap:
@@ -140,6 +143,9 @@ spec:
         persistentVolumeClaim:
           claimName: {{ .Values.persistence.existingClaim }}
       {{- end }}
+      {{- if .Values.volumes }}
+{{ toYaml .Values.volumes | indent 6 }}
+      {{- end }}
   # Must use volume claim template in enterprise mode
   {{- if and .Values.persistence.enabled (or (not .Values.persistence.existingClaim) .Values.enterprise.enabled) }}
   volumeClaimTemplates:

charts/influxdb/values.yaml

@@ -164,6 +164,18 @@ ingress:
   annotations: {}
     # kubernetes.io/ingress.class: "nginx"
     # kubernetes.io/tls-acme: "true"
+  path: /
+
+
+## Add custom volume and volumeMounts
+# volumes:
+#   - name: ssl-cert-volume
+#     secret:
+#       secretName: secret-name
+# mountPoints:
+#   - name: ssl-cert-volume
+#     mountPath: /etc/ssl/certs/selfsigned/
+#     readOnly: true
 
 ## Use an alternate scheduler, e.g. "stork".
 ## ref: https://kubernetes.io/docs/tasks/administer-cluster/configure-multiple-schedulers/

charts/kapacitor/Chart.yaml

 apiVersion: v1
 name: kapacitor
-version: 1.2.9
+version: 1.3.0
 appVersion: 1.5.4
 description: InfluxDB's native data processing engine. It can process both stream
   and batch data from InfluxDB.

charts/kapacitor/README.md

@@ -66,6 +66,20 @@ The following table lists the configurable parameters of the Kapacitor chart and
 | `envVars` | Environment variables to set initial Kapacitor configuration (https://hub.docker.com/_/kapacitor/) | `{}` |
 | `influxURL` | InfluxDB url used to interact with Kapacitor (also can be set with ```envVars.KAPACITOR_INFLUXDB_0_URLS_0```) | `http://influxdb-influxdb.tick:8086` |
 | `existingSecret` | Name of an existing Secrect used to set the environment variables for the InfluxDB user and password. The expected keys in the secret are `influxdb-user` and `influxdb-password`. |
+| `rbac.create` | Create and use RBAC resources | `true` |
+| `rbac.namespaced` | Creates Role and Rolebinding instead of the default ClusterRole and ClusteRoleBindings for the Kapacitor instance  | `false` |
+| `serviceAccount.annotations` | ServiceAccount annotations | `{}` |
+| `serviceAccount.create` | Create service account | `true` |
+| `serviceAccount.name` | Service account name to use, when empty will be set to created account if `serviceAccount.create` is set else to `default` | `` |
+| `sidecar.image` | Sidecar image | `kiwigrid/k8s-sidecar:0.1.116` |
+| `sidecar.imagePullPolicy` | Sidecar image pull policy | `IfNotPresent` |
+| `sidecar.resources` | Sidecar resources | `{}` |
+| `sidecar.skipTlsVerify` | Set to true to skip tls verification for kube api calls | `nil` |
+| `sidecar.sideload.enabled` | Enables the search for sideloads and adds/updates/deletes them in Kapacitor | `false` |
+| `sidecar.sideload.label` | Label that configmaps with sideloads should have to be added | `kapacitor_sideload` |
+| `sidecar.sideload.searchNamespace` | If specified, the sidecar will search for sideload configmaps inside this namespace. Otherwise the namespace in which the sidecar is running will be used. It's also possible to specify ALL to search in all namespaces | `nil` |
+| `sidecar.sideload.folder` | Folder in the pod that should hold the collected sideloads. This path will be mounted. | `/var/lib/kapacitor/sideload` |
+| `namespaceOverride` | Override the deployment namespace | `""` (`Release.Namespace`) |
 
 The configurable parameters of the Kapacitor chart and the default values are listed in `values.yaml`.
 
@@ -94,3 +108,24 @@ helm upgrade --install my-release -f values.yaml influxdata/kapacitor
 The [Kapacitor](https://hub.docker.com/_/kapacitor/) image stores data in the `/var/lib/kapacitor` directory in the container.
 
 The chart optionally mounts a [Persistent Volume](http://kubernetes.io/docs/user-guide/persistent-volumes/) at this location. The volume is created using dynamic volume provisioning.
+
+## Sidecar for sideloads
+
+If the parameter `sidecar.sideload.enabled` is set, a sidecar container is deployed in the Kapacitor
+pod. This container watches all configmaps in the cluster and filters out the ones with
+a label as defined in `sidecar.sideload.label`. The files defined in those configmaps are written
+to a folder and can be accessed by TICKscripts. Changes to the configmaps are monitored and the files
+are deleted/updated.
+
+Example sideload config:
+```
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: kapacitor-sideload-influxdb-httpd-clienterror
+  labels:
+    kapacitor_sideload: "1"
+data:
+  influxdb-httpd-clienterror.yml: |
+    [...]
+```
\ No newline at end of file

charts/kapacitor/templates/NOTES.txt

@@ -2,28 +2,28 @@
 {{- if not $bl }}
 Kapacitor can be accessed via port 9092 on the following DNS name from within your cluster:
 
-- http://{{ template "kapacitor.fullname" . }}.{{ .Release.Namespace }}:9092
+  http://{{ template "kapacitor.fullname" . }}.{{ .Release.Namespace }}:9092
 
-You can easily connect to the remote instance from a local kapacitor cli. Forward the api port to localhost:9092
+You can connect to the remote instance from a local Kapacitor CLI. Forward the API port to localhost:9092:
 
-- kubectl port-forward --namespace {{ .Release.Namespace }} $(kubectl get pods --namespace {{ .Release.Namespace }} -l app={{ template "kapacitor.fullname" . }} -o jsonpath='{ .items[0].metadata.name }') 9092:9092
+  kubectl port-forward --namespace {{ .Release.Namespace }} $(kubectl get pods --namespace {{ .Release.Namespace }} -l app={{ template "kapacitor.fullname" . }} -o jsonpath='{ .items[0].metadata.name }') 9092:9092
 
-You can also connect to the container running Kapacitor. To open a shell session in the pod run the following:
+You can also connect to the container running Kapacitor. To open a shell session in the pod, run the following:
 
-- kubectl exec -i -t --namespace {{ .Release.Namespace }} $(kubectl get pods --namespace {{ .Release.Namespace }} -l app={{ template "kapacitor.fullname" . }} -o jsonpath='{.items[0].metadata.name}') /bin/sh
+  kubectl exec -i -t --namespace {{ .Release.Namespace }} $(kubectl get pods --namespace {{ .Release.Namespace }} -l app={{ template "kapacitor.fullname" . }} -o jsonpath='{.items[0].metadata.name}') /bin/sh
 
-To tail the logs for the Kapacitor pod run the following:
+To view the logs for the Kapacitor pod, run the following:
 
-- kubectl logs -f --namespace {{ .Release.Namespace }} $(kubectl get pods --namespace {{ .Release.Namespace }} -l app={{ template "kapacitor.fullname" . }} -o jsonpath='{ .items[0].metadata.name }')
+  kubectl logs -f --namespace {{ .Release.Namespace }} $(kubectl get pods --namespace {{ .Release.Namespace }} -l app={{ template "kapacitor.fullname" . }} -o jsonpath='{ .items[0].metadata.name }')
 
 {{- if eq .Values.service.type "LoadBalancer" }}
 
-To watch for the LoadBalancer IP or Hostname to populate run the following:
+To watch for the LoadBalancer IP or Hostname to populate, run the following:
 
-- kubectl get svc -w --namespace {{ .Release.Namespace }} -l app={{ template "kapacitor.fullname" . }}
+  kubectl get service -w --namespace {{ .Release.Namespace }} -l app={{ template "kapacitor.fullname" . }}
 {{- end }}
 {{- end }}
 
 {{- if empty .Values.influxURL }}
-You have not set .Values.influxURL. Kapacitor needs an InfluxDB instance to create a subscription on. Please set that value to deploy kapacitor
-{{- end }}
\ No newline at end of file
+You have not set .Values.influxURL. Kapacitor needs an InfluxDB instance to create a subscription on. Please set that value to deploy Kapacitor. (See README for more information.)
+{{- end }}

charts/kapacitor/templates/_helpers.tpl

@@ -14,3 +14,25 @@ We truncate at 63 chars because some Kubernetes name fields are limited to this
 {{- $name := default .Chart.Name .Values.nameOverride -}}
 {{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}}
 {{- end -}}
+
+{{/*
+Create the name of the service account
+*/}}
+{{- define "kapacitor.serviceAccountName" -}}
+{{- if .Values.serviceAccount.create -}}
+    {{ default (include "kapacitor.fullname" .) .Values.serviceAccount.name }}
+{{- else -}}
+    {{ default "default" .Values.serviceAccount.name }}
+{{- end -}}
+{{- end -}}
+
+{{/*
+Allow the release namespace to be overridden for multi-namespace deployments in combined charts
+*/}}
+{{- define "kapacitor.namespace" -}}
+  {{- if .Values.namespaceOverride -}}
+    {{- .Values.namespaceOverride -}}
+  {{- else -}}
+    {{- .Release.Namespace -}}
+  {{- end -}}
+{{- end -}}

charts/kapacitor/templates/clusterrole.yaml

+{{- if and .Values.rbac.create (not .Values.rbac.namespaced) }}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: {{ template "kapacitor.fullname" . }}-clusterrole
+  labels:
+    chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
+    release: "{{ .Release.Name }}"
+    heritage: "{{ .Release.Service }}"
+    app: {{ template "kapacitor.fullname" . }}
+{{- if .Values.sidecar.sideload.enabled }}
+rules:
+- apiGroups: [""] # "" indicates the core API group
+  resources: ["configmaps", "secrets"]
+  verbs: ["get", "watch", "list"]
+{{- else }}
+rules: []
+{{- end}}
+{{- end}}

charts/kapacitor/templates/clusterrolebinding.yaml

+{{- if and .Values.rbac.create (not .Values.rbac.namespaced) }}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: {{ template "kapacitor.fullname" . }}-clusterrolebinding
+  labels:
+    chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
+    release: "{{ .Release.Name }}"
+    heritage: "{{ .Release.Service }}"
+    app: {{ template "kapacitor.fullname" . }}
+subjects:
+  - kind: ServiceAccount
+    name: {{ template "kapacitor.serviceAccountName" . }}
+    namespace: {{ template "kapacitor.namespace" . }}
+roleRef:
+  kind: ClusterRole
+  name: {{ template "kapacitor.fullname" . }}-clusterrole
+  apiGroup: rbac.authorization.k8s.io
+{{- end -}}

charts/kapacitor/templates/deployment.yaml

@@ -4,6 +4,7 @@ apiVersion: apps/v1
 kind: Deployment
 metadata:
   name: {{ template "kapacitor.fullname" . }}
+  namespace: {{ template "kapacitor.namespace" . }}
   labels:
     chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
     release: "{{ .Release.Name }}"
@@ -19,6 +20,7 @@ spec:
       labels:
         app: {{ template "kapacitor.fullname" . }}
     spec:
+      serviceAccountName: {{ template "kapacitor.serviceAccountName" . }}
       containers:
       - name: {{ .Chart.Name }}
         image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
@@ -49,8 +51,43 @@ spec:
         volumeMounts:
         - name: data
           mountPath: /var/lib/kapacitor
+{{- if .Values.sidecar.sideload.enabled }}
+        - name: sc-sideload-volume
+          mountPath: {{ .Values.sidecar.sideload.folder | quote }}
+{{- end}}
         resources:
 {{ toYaml .Values.resources | indent 12 }}
+{{- if .Values.sidecar.sideload.enabled }}
+      - name: {{ .Chart.Name }}-sc-sideload
+        image: "{{ .Values.sidecar.image }}"
+        imagePullPolicy: {{ .Values.sidecar.imagePullPolicy }}
+        env:
+        - name: METHOD
+          value: WATCH
+        - name: LABEL
+          value: "{{ .Values.sidecar.sideload.label }}"
+        - name: FOLDER
+          value: "/var/lib/kapacitor/sideload"
+        - name: RESOURCE
+          value: "configmap"
+        {{- if .Values.sidecar.sideload.searchNamespace }}
+        - name: NAMESPACE
+          value: "{{ .Values.sidecar.sideload.searchNamespace }}"
+        {{- end }}
+        {{- if .Values.sidecar.skipTlsVerify }}
+        - name: SKIP_TLS_VERIFY
+          value: "{{ .Values.sidecar.skipTlsVerify }}"
+        {{- end }}
+        - name: REQ_METHOD
+          value: POST
+        - name: REQ_URL
+          value: "http://localhost:9092/kapacitor/v1/sideload/reload"
+        resources:
+{{ toYaml .Values.sidecar.resources | indent 12 }}
+        volumeMounts:
+          - name: sc-sideload-volume
+            mountPath: "/var/lib/kapacitor/sideload"
+{{- end }}
       volumes:
         - name: data
         {{- if .Values.persistence.enabled }}
@@ -59,4 +96,8 @@ spec:
         {{- else }}
           emptyDir: {}
         {{- end }}
+      {{- if .Values.sidecar.sideload.enabled }}
+        - name: sc-sideload-volume
+          emptyDir: {}
+      {{- end -}}
 {{- end }}

charts/kapacitor/templates/role.yaml

+{{- if and .Values.rbac.create .Values.rbac.namespaced -}}
+apiVersion: rbac.authorization.k8s.io/v1beta1
+kind: Role
+metadata:
+  name: {{ template "kapacitor.fullname" . }}
+  namespace: {{ template "kapacitor.namespace" . }}
+  labels:
+    chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
+    release: "{{ .Release.Name }}"
+    heritage: "{{ .Release.Service }}"
+    app: {{ template "kapacitor.fullname" . }}
+{{- if .Values.sidecar.sideload.enabled }}
+rules:
+- apiGroups: [""] # "" indicates the core API group
+  resources: ["configmaps", "secrets"]
+  verbs: ["get", "watch", "list"]
+{{- else }}
+rules: []
+{{- end }}
+{{- end }}

charts/kapacitor/templates/rolebinding.yaml

+{{- if and .Values.rbac.create .Values.rbac.namespaced -}}
+apiVersion: rbac.authorization.k8s.io/v1beta1
+kind: RoleBinding
+metadata:
+  name: {{ template "kapacitor.fullname" . }}
+  namespace: {{ template "kapacitor.namespace" . }}
+  labels:
+    chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
+    release: "{{ .Release.Name }}"
+    heritage: "{{ .Release.Service }}"
+    app: {{ template "kapacitor.fullname" . }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: {{ template "kapacitor.fullname" . }}
+subjects:
+- kind: ServiceAccount
+  name: {{ template "kapacitor.serviceAccountName" . }}
+  namespace: {{ template "kapacitor.namespace" . }}
+roleRef:
+  kind: Role
+  name: {{ template "kapacitor.fullname" . }}
+  apiGroup: rbac.authorization.k8s.io
+{{- end -}}

charts/kapacitor/templates/serviceaccount.yaml

+{{- if .Values.serviceAccount.create }}
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{ template "kapacitor.serviceAccountName" . }}
+  namespace: {{ template "kapacitor.namespace" . }}
+  labels:
+    chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
+    release: "{{ .Release.Name }}"
+    heritage: "{{ .Release.Service }}"
+    app: {{ template "kapacitor.fullname" . }}
+{{- with .Values.serviceAccount.annotations }}
+  annotations:
+{{ toYaml . | indent 4 }}
+{{- end }}
+{{- end -}}

charts/kapacitor/values.yaml

@@ -66,3 +66,36 @@ resources:
 ## `influxdb-user` and `influxdb-password`.
 ##
 # existingSecret: influxdb-auth
+
+## Role based access control
+rbac:
+  create: true
+  namespaced: false
+
+## Service account
+serviceAccount:
+  annotations: {}
+  create: true
+  name:
+
+## Sidecars that collect the configmaps with specified label and stores the included files into the respective folders
+sidecar:
+  image: kiwigrid/k8s-sidecar:0.1.116
+  imagePullPolicy: IfNotPresent
+  resources: {}
+    # limits:
+    #   cpu: 100m
+    #   memory: 100Mi
+    # requests:
+    #   cpu: 50m
+    #   memory: 50Mi
+  ## skipTlsVerify Set to true to skip tls verification for kube api calls
+  # skipTlsVerify: true
+  sideload:
+    enabled: false
+    label: kapacitor_sideload
+    searchNamespace: null
+    folder: /var/lib/kapacitor/sideload
+
+## Override the deployment namespace
+namespaceOverride: ""

charts/telegraf-ds/Chart.yaml

 apiVersion: v1
 name: telegraf-ds
-version: 1.0.7
+version: 1.0.9
 appVersion: 1.14
 deprecated: false
 description: Telegraf is an agent written in Go for collecting, processing, aggregating, and writing metrics.

charts/telegraf-ds/README.md

@@ -75,6 +75,11 @@ This chart deploys the following by default:
   * [`kernel`](https://github.com/influxdata/telegraf/tree/master/plugins/inputs/kernel)
   * [`kubernetes`](https://github.com/influxdata/telegraf/tree/master/plugins/inputs/kubernetes)
   * [`mem`](https://github.com/influxdata/telegraf/tree/master/plugins/inputs/mem)
+  * [`net`](https://github.com/influxdata/telegraf/tree/master/plugins/inputs/net)
   * [`processes`](https://github.com/influxdata/telegraf/tree/master/plugins/inputs/processes)
   * [`swap`](https://github.com/influxdata/telegraf/tree/master/plugins/inputs/swap)
   * [`system`](https://github.com/influxdata/telegraf/tree/master/plugins/inputs/system)
+
+The following plugin can be enable through the configuration:
+
+- [`internal`](https://github.com/influxdata/telegraf/tree/master/plugins/inputs/internal)

charts/telegraf-ds/templates/_helpers.tpl

@@ -388,3 +388,11 @@ Create the name of the service account to use
 {{- end -}}
 {{- end -}}
 
+{{/*
+Activate inputs.internal through flag monitor_self
+*/}}
+{{- define "monitor_self" -}}
+{{- if . -}}
+[[inputs.internal]]
+{{- end }}
+{{- end -}}

charts/telegraf-ds/templates/configmap.yaml

@@ -14,10 +14,12 @@ data:
     {{ template "processors" .Values.config.processors }}
     {{ template "aggregators" .Values.config.aggregators }}
     {{ template "outputs" .Values.config.outputs }}
+    {{ template "monitor_self" .Values.config.monitor_self }}
 
     [[inputs.diskio]]
     [[inputs.kernel]]
     [[inputs.mem]]
+    [[inputs.net]]
     [[inputs.processes]]
     [[inputs.swap]]
     [[inputs.system]]

charts/telegraf-ds/values.yaml

@@ -81,3 +81,4 @@ config:
         password: ""
         user_agent: "telegraf"
         insecure_skip_verify: false
+  monitor_self: false

charts/telegraf/Chart.yaml

 apiVersion: v1
 name: telegraf
-version: 1.7.11
+version: 1.7.14
 appVersion: 1.14
 deprecated: false
 description: Telegraf is an agent written in Go for collecting, processing, aggregating, and writing metrics.

charts/telegraf/templates/NOTES.txt

 To open a shell session in the container running Telegraf run the following:
 
-- kubectl exec -i -t --namespace {{ .Release.Namespace }} $(kubectl get pods --namespace {{ .Release.Namespace }} -l app.kubernetes.io/name={{ include "telegraf.fullname" . }} -o jsonpath='{.items[0].metadata.name}') /bin/sh
+  kubectl exec -i -t --namespace {{ .Release.Namespace }} $(kubectl get pods --namespace {{ .Release.Namespace }} -l app.kubernetes.io/name={{ include "telegraf.fullname" . }} -o jsonpath='{.items[0].metadata.name}') /bin/sh
 
-To tail the logs for a Telegraf pod, run the following:
+To view the logs for a Telegraf pod, run the following:
 
-- kubectl logs -f --namespace {{ .Release.Namespace }} $(kubectl get pods --namespace {{ .Release.Namespace }} -l app.kubernetes.io/name={{ include "telegraf.fullname" . }} -o jsonpath='{ .items[0].metadata.name }')
+  kubectl logs -f --namespace {{ .Release.Namespace }} $(kubectl get pods --namespace {{ .Release.Namespace }} -l app.kubernetes.io/name={{ include "telegraf.fullname" . }} -o jsonpath='{ .items[0].metadata.name }')
 
 {{- if eq .Values.service.type "LoadBalancer" }}
 
-To watch for the LoadBalancer IP run the following
+To watch for the LoadBalancer IP run the following:
 
-- kubectl get svc -w --namespace {{ .Release.Namespace }} -l app.kubernetes.io/name={{ include "telegraf.fullname" . }}
-{{- end }}
\ No newline at end of file
+  kubectl get svc -w --namespace {{ .Release.Namespace }} -l app.kubernetes.io/name={{ include "telegraf.fullname" . }}
+{{- end }}

charts/telegraf/templates/deployment.yaml

@@ -35,10 +35,34 @@ spec:
         volumeMounts:
         - name: config
           mountPath: /etc/telegraf
-        {{- range .Values.volumeMounts}}
+        {{- range .Values.volumeMounts }}
         - name: {{ .name }}
           mountPath: {{ .mountPath }}
         {{- end }}
+        {{- if .Values.mountPoints }}
+{{ toYaml .Values.mountPoints | indent 8 }}
+        {{- end }}
+        {{- if .Values.hooks }}
+        {{- if or (.Values.hooks.postStart) (.Values.hooks.preStop) }}
+        lifecycle:
+        {{- if .Values.hooks.postStart }}
+          postStart:
+            exec:
+              command:
+        {{- range .Values.hooks.postStart }}
+                - {{ . | quote }}
+        {{- end }}
+        {{ end }}
+        {{- if .Values.hooks.preStop }}
+          preStop:
+            exec:
+              command:
+        {{- range .Values.hooks.preStop }}
+                - {{ . | quote }}
+        {{- end }}
+        {{ end }}
+        {{ end }}
+        {{ end }}
         {{- range $objectKey, $objectValue := .Values.config.outputs }}
         {{- range $key, $value := . -}}
         {{- $tp := typeOf $value -}}
@@ -66,6 +90,6 @@ spec:
       - name: config
         configMap:
           name: {{ include "telegraf.fullname" . }}
-      {{- if .Values.volumeMounts }}
-{{ toYaml .Values.volumeMounts | indent 6 }}
-      {{- end}}
+      {{- if .Values.volumes }}
+{{ toYaml .Values.volumes | indent 6 }}
+      {{- end }}

charts/telegraf/values.yaml

@@ -17,6 +17,19 @@ env:
   - name: HOSTNAME
     value: "telegraf-polling-service"
 
+# An older "volumeMounts" key was previously added which will likely
+# NOT WORK as you expect. Please use this newer configuration.
+
+# volumes:
+# - name: telegraf-output-influxdb2
+#   configMap:
+#     name: "telegraf-output-influxdb2"
+# mountPoints:
+# - name: telegraf-output-influxdb2
+#   mountPath: /etc/telegraf/conf.d
+#   subPath: influxdb2.conf
+
+
 ## Configure resource requests and limits
 ## ref: http://kubernetes.io/docs/user-guide/compute-resources/
 resources: {}
@@ -124,3 +137,8 @@ config:
         metric_separator: "_"
         allowed_pending_messages: 10000
         percentile_limit: 1000
+
+# Lifecycle hooks
+# hooks:
+#   postStart: ["/bin/sh", "-c", "echo Telegraf started"]
+#   preStop: ["/bin/sh", "-c", "sleep 60"]