Add support for Container Insights on Windows

.github/workflows/build-and-upload-windows-staging.yml

@@ -0,0 +1,73 @@
+# Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+# SPDX-License-Identifier: Apache-2.0
+
+name: Build And Upload Staging Artifact for Windows
+env:
+  # Use terraform assume role for uploading to ecr
+  AWS_ASSUME_ROLE: ${{ secrets.TERRAFORM_AWS_ASSUME_ROLE }}
+  ECR_OPERATOR_STAGING_IMAGE: ${{ secrets.ECR_OPERATOR_WINDOWS_CI_STAGING_IMAGE }}
+
+on:
+  push:
+    branches:
+      - main-ciwindows
+  workflow_dispatch:
+  workflow_call:
+
+jobs:
+  MakeBinary:
+    name: 'MakeContainerImage'
+    runs-on: ubuntu-latest
+    permissions:
+      id-token: write
+      contents: read
+    steps:
+      - uses: actions/checkout@v3
+        with:
+          fetch-depth: 0
+
+      - name: Set up Go 1.x
+        uses: actions/setup-go@v4
+        with:
+          go-version: ~1.19.6
+          cache: false
+
+      - name: Configure AWS Credentials
+        uses: aws-actions/configure-aws-credentials@v2
+        with:
+          role-to-assume: ${{ env.AWS_ASSUME_ROLE }}
+          aws-region: us-west-2
+
+      - name: Login to ECR
+        if: steps.cached_binaries.outputs.cache-hit == false
+        id: login-ecr
+        uses: aws-actions/amazon-ecr-login@v1
+
+      - name: Set up Docker Buildx
+        if: steps.cached_binaries.outputs.cache-hit == false
+        uses: docker/setup-buildx-action@v1
+
+      - name: Set up QEMU
+        if: steps.cached_binaries.outputs.cache-hit == false
+        uses: docker/setup-qemu-action@v1
+
+      - name: Build Cloudwatch Agent Operator Image and push to ECR
+        uses: docker/build-push-action@v4
+        if: steps.cached_binaries.outputs.cache-hit == false
+        with:
+          file: ./Dockerfile
+          context: .
+          push: true
+          tags: ${{ env.ECR_OPERATOR_STAGING_IMAGE }}
+          platforms: linux/amd64, linux/arm64
+
+  e2e-test:
+    needs: MakeBinary
+    uses: ./.github/workflows/appsignals-e2e-test.yml
+    secrets: inherit
+    # Two E2E tests should not run at the same time in the same EKS cluster
+    concurrency:
+      group: 'e2e-cw-agent-operator-test'
+      cancel-in-progress: false
+    with:
+      test-cluster-name: 'e2e-cw-agent-operator-test'

.github/workflows/helm-integ-test.yml

@@ -75,4 +75,116 @@ jobs:
           retry_wait_seconds: 5
           command: |
             cd integration-tests/terraform/helm
+            terraform destroy --auto-approve
+
+  HelmChartsIntegrationTestWindows-2022:
+    name: HelmChartsIntegrationTestWindows-2022
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+    steps:
+      - uses: actions/checkout@v3
+        with:
+          fetch-depth: 0
+
+      - name: Generate testing id
+        run: echo TESTING_ID="${{ github.run_id }}-${{ github.run_number }}" >> $GITHUB_ENV
+
+      - name: Configure AWS Credentials
+        uses: aws-actions/configure-aws-credentials@v2
+        with:
+          role-to-assume: ${{ env.TERRAFORM_AWS_ASSUME_ROLE }}
+          aws-region: ${{ env.AWS_DEFAULT_REGION }}
+
+      #  local directory to store the kubernetes config
+      - name: Create kubeconfig directory
+        run: mkdir -p ${{ github.workspace }}/../../../.kube
+
+      - name: Set KUBECONFIG environment variable
+        run: echo KUBECONFIG="${{ github.workspace }}/../../../.kube/config" >> $GITHUB_ENV
+
+      - name: Verify Terraform version
+        run: terraform --version
+
+      - name: Terraform apply
+        uses: nick-fields/retry@v2
+        with:
+          max_attempts: 1
+          timeout_minutes: 60 # EKS takes about 20 minutes to spin up a cluster and service on the cluster
+          retry_wait_seconds: 5
+          command: |
+            cd integration-tests/terraform/helm-windows
+            terraform init
+            if terraform apply -auto-approve \
+                -var="windows_os_version=WINDOWS_CORE_2022_x86_64" -var="kube_dir=${{ github.workspace }}/../../../.kube"; then
+              terraform destroy -auto-approve
+            else
+              terraform destroy -auto-approve && exit 1
+            fi
+
+      - name: Terraform destroy
+        if: ${{ cancelled() || failure() }}
+        uses: nick-fields/retry@v2
+        with:
+          max_attempts: 3
+          timeout_minutes: 8
+          retry_wait_seconds: 5
+          command: |
+            cd integration-tests/terraform/helm-windows
+            terraform destroy --auto-approve
+
+  HelmChartsIntegrationTestWindows-2019:
+    name: HelmChartsIntegrationTestWindows-2019
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+    steps:
+      - uses: actions/checkout@v3
+        with:
+          fetch-depth: 0
+
+      - name: Generate testing id
+        run: echo TESTING_ID="${{ github.run_id }}-${{ github.run_number }}" >> $GITHUB_ENV
+
+      - name: Configure AWS Credentials
+        uses: aws-actions/configure-aws-credentials@v2
+        with:
+          role-to-assume: ${{ env.TERRAFORM_AWS_ASSUME_ROLE }}
+          aws-region: ${{ env.AWS_DEFAULT_REGION }}
+
+      #  local directory to store the kubernetes config
+      - name: Create kubeconfig directory
+        run: mkdir -p ${{ github.workspace }}/../../../.kube
+
+      - name: Set KUBECONFIG environment variable
+        run: echo KUBECONFIG="${{ github.workspace }}/../../../.kube/config" >> $GITHUB_ENV
+
+      - name: Verify Terraform version
+        run: terraform --version
+
+      - name: Terraform apply
+        uses: nick-fields/retry@v2
+        with:
+          max_attempts: 1
+          timeout_minutes: 60 # EKS takes about 20 minutes to spin up a cluster and service on the cluster
+          retry_wait_seconds: 5
+          command: |
+            cd integration-tests/terraform/helm-windows
+            terraform init
+            if terraform apply -auto-approve \
+                -var="windows_os_version=WINDOWS_CORE_2019_x86_64" -var="kube_dir=${{ github.workspace }}/../../../.kube"; then
+              terraform destroy -auto-approve
+            else
+              terraform destroy -auto-approve && exit 1
+            fi
+
+      - name: Terraform destroy
+        if: ${{ cancelled() || failure() }}
+        uses: nick-fields/retry@v2
+        with:
+          max_attempts: 3
+          timeout_minutes: 8
+          retry_wait_seconds: 5
+          command: |
+            cd integration-tests/terraform/helm-windows
             terraform destroy --auto-approve

helm/templates/_helpers.tpl

@@ -24,16 +24,20 @@ Get the current recommended cloudwatch agent image for a region
 {{- printf "%s/%s:%s" $imageDomain .Values.agent.image.repository .Values.agent.image.tag -}}
 {{- end -}}
 
+{{/*
+Get the current recommended cloudwatch agent image for a region
+todo: replace this with latest official cw image for Windows
+*/}}
+{{- define "cloudwatch-agent-windows.image" -}}
+{{- default "506463145083.dkr.ecr.us-west-2.amazonaws.com/windows-container-internal:latest" -}}
+{{- end -}}
+
 {{/*
 Get the current recommended cloudwatch agent operator image for a region
+todo: replace this with latest official operator
 */}}
 {{- define "cloudwatch-agent-operator.image" -}}
-{{- $imageDomain := "" -}}
-{{- $imageDomain = index .Values.manager.image.repositoryDomainMap .Values.region -}}
-{{- if not $imageDomain -}}
-{{- $imageDomain = .Values.manager.image.repositoryDomainMap.public -}}
-{{- end -}}
-{{- printf "%s/%s:%s" $imageDomain .Values.manager.image.repository .Values.manager.image.tag -}}
+{{- default "506463145083.dkr.ecr.us-west-2.amazonaws.com/cwagent-operator-ciwindows-internal:latest" -}}
 {{- end -}}
 
 {{/*
@@ -48,6 +52,18 @@ Get the current recommended fluent-bit image for a region
 {{- printf "%s/%s:%s" $imageDomain .Values.containerLogs.fluentBit.image.repository .Values.containerLogs.fluentBit.image.tag -}}
 {{- end -}}
 
+{{/*
+Get the current recommended fluent-bit Windows image for a region
+*/}}
+{{- define "fluent-bit-windows.image" -}}
+{{- $imageDomain := "" -}}
+{{- $imageDomain = index .Values.containerLogs.fluentBit.image.repositoryDomainMap .Values.region -}}
+{{- if not $imageDomain -}}
+{{- $imageDomain = .Values.containerLogs.fluentBit.image.repositoryDomainMap.public -}}
+{{- end -}}
+{{- printf "%s/%s:%s" $imageDomain .Values.containerLogs.fluentBit.image.repository .Values.containerLogs.fluentBit.image.tagWindows -}}
+{{- end -}}
+
 {{/*
 Common labels
 */}}

helm/templates/cloudwatch-agent-daemonset-windows.yaml

@@ -0,0 +1,51 @@
+{{- if .Values.agent.enabled }}
+apiVersion: cloudwatch.aws.amazon.com/v1alpha1
+kind: AmazonCloudWatchAgent
+metadata:
+  name: {{ template "cloudwatch-agent.name" . }}-windows
+  namespace: {{ .Release.Namespace }}
+spec:
+  podSecurityContext:
+    windowsOptions:
+      hostProcess: true
+      runAsUserName: "NT AUTHORITY\\System"
+  hostNetwork: true
+  image: {{ template "cloudwatch-agent-windows.image" . }}
+  mode: daemonset
+  serviceAccount: {{ template "cloudwatch-agent.serviceAccountName" . }}
+  nodeSelector:
+    kubernetes.io/os: windows
+  {{- if .Values.agent.config }}
+  config: {{ .Values.agent.config | toJson | quote }}
+  {{- else }}
+  config: {{ .Values.agent.windowsDefaultConfig | toJson | quote }}
+  {{- end }}
+  resources:
+    requests:
+      memory: "128Mi"
+      cpu: "250m"
+    limits:
+      memory: "512Mi"
+      cpu: "500m"
+  env:
+  - name: K8S_NODE_NAME
+    valueFrom:
+      fieldRef:
+        fieldPath: spec.nodeName
+  - name: HOST_IP
+    valueFrom:
+      fieldRef:
+        fieldPath: status.hostIP
+  - name: HOST_NAME
+    valueFrom:
+      fieldRef:
+        fieldPath: spec.nodeName
+  - name: K8S_NAMESPACE
+    valueFrom:
+      fieldRef:
+        fieldPath: metadata.namespace
+  - name: RUN_IN_CONTAINER
+    value: "True"
+  - name: RUN_AS_HOST_PROCESS_CONTAINER
+    value: "True"
+{{- end }}

helm/templates/cloudwatch-agent-daemonset.yaml

@@ -7,6 +7,8 @@ metadata:
 spec:
   image: {{ template "cloudwatch-agent.image" . }}
   mode: daemonset
+  nodeSelector:
+    kubernetes.io/os: linux
   serviceAccount: {{ template "cloudwatch-agent.serviceAccountName" . }}
   {{- if .Values.agent.config }}
   config: {{ .Values.agent.config | toJson | quote }}

helm/templates/fluent-bit-daemonset.yaml

@@ -96,4 +96,6 @@ spec:
       - name: dmesg
         hostPath:
           path: /var/log/dmesg
-      serviceAccountName: {{ template "cloudwatch-agent.serviceAccountName" . }}
+      serviceAccountName: {{ template "cloudwatch-agent.serviceAccountName" . }}
+      nodeSelector:
+        kubernetes.io/os: linux