From 711f44e49822079709d28a0128a5726706e026a5 Mon Sep 17 00:00:00 2001
From: Matt March <matt.march@logdna.com>
Date: Tue, 30 Jan 2024 16:41:43 -0500
Subject: [PATCH] feat: conditionally enable k8s logs requirements

Adds the ability to conditionally enable some role and volume access
settings to enable k8s logs as a source
Also adds the ability to supply a PersistentVolumeClaim name

ref: LOG-18839
---
 charts/edge/Chart.yaml                 |  2 +-
 charts/edge/README.md                  |  2 ++
 charts/edge/templates/rbac.yaml        | 35 ++++++++++++++++++++++++++
 charts/edge/templates/statefulset.yaml | 29 ++++++++++++++++++++-
 charts/edge/values.yaml                |  5 ++++
 5 files changed, 71 insertions(+), 2 deletions(-)
 create mode 100644 charts/edge/templates/rbac.yaml

diff --git a/charts/edge/Chart.yaml b/charts/edge/Chart.yaml
index 6b04dc2..9677008 100644
--- a/charts/edge/Chart.yaml
+++ b/charts/edge/Chart.yaml
@@ -5,7 +5,7 @@ icon: https://app.mezmo.com/assets/img/mz-logo-square-128.png
 description: A Helm chart for deploying Mezmo Edge
 type: application
 appVersion: "3.1.2"
-version: 0.8.3
+version: 0.8.4
 maintainers:
   - name: Mezmo
     email: help@mezmo.com
diff --git a/charts/edge/README.md b/charts/edge/README.md
index 329dfa4..09eeb21 100644
--- a/charts/edge/README.md
+++ b/charts/edge/README.md
@@ -40,5 +40,7 @@ helm install edge mezmo/edge \
 | service.sourcePorts.start | int      | 8000            | The start of the port range (inclusive [start, end])
 | service.sourcePorts.end   | int      | 8010            | The end of the port range (set 0 or "" to disable port range)
 | service.sourcePorts.list  | array[]  | []              | Optional list of discrete ports to configure on the service
+| enableK8sLogs             | boolean  | false           | Whether or not to add ClusterRole and Volume access required for k8s logs source
+| pvcClaimName              | string   | ""              | Optional name for an existing PersistentStorageClaim to use for default storage
 
 \* Port 8686 is reserved for internal use, and should not be additionally configured for sourcePorts
diff --git a/charts/edge/templates/rbac.yaml b/charts/edge/templates/rbac.yaml
new file mode 100644
index 0000000..f90128b
--- /dev/null
+++ b/charts/edge/templates/rbac.yaml
@@ -0,0 +1,35 @@
+{{- if .Values.enableK8sLogs }}
+# Permissions to use Kubernetes API.
+# Requires that RBAC authorization is enabled.
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: {{ include "edge.fullname" . }}
+  labels:
+    {{- include "edge.labels" . | nindent 4 }}
+rules:
+  - apiGroups:
+      - ""
+    resources:
+      - namespaces
+      - nodes
+      - pods
+    verbs:
+      - list
+      - watch
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: {{ include "edge.fullname" . }}
+  labels:
+    {{- include "edge.labels" . | nindent 4 }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: {{ include "edge.fullname" . }}
+subjects:
+  - kind: ServiceAccount
+    name: {{ include "edge.serviceAccountName" . }}
+    namespace: {{ .Release.Namespace }}
+{{- end }}
diff --git a/charts/edge/templates/statefulset.yaml b/charts/edge/templates/statefulset.yaml
index 6694c21..fd1a7db 100644
--- a/charts/edge/templates/statefulset.yaml
+++ b/charts/edge/templates/statefulset.yaml
@@ -30,12 +30,25 @@ spec:
         {{- toYaml .Values.podSecurityContext | nindent 8 }}
       volumes:
         - name: data
+          {{- if .Values.pvcClaimName }}
+          persistentVolumeClaim:
+            claimName: {{ .Values.pvcClaimName | quote }}
+          {{- else }}
           emptyDir: {}
+          {{- end }}
         - name: config
           projected:
             sources:
               - configMap:
                   name: {{ include "edge.fullname" . }}
+        {{- if .Values.enableK8sLogs }}
+        - hostPath:
+            path: /var/log/
+          name: var-log
+        - hostPath:
+            path: /var/lib/
+          name: var-lib
+        {{- end }}
       terminationGracePeriodSeconds: 60
       containers:
         - name: {{ .Chart.Name }}
@@ -71,6 +84,12 @@ spec:
             valueFrom:
               fieldRef:
                 fieldPath: metadata.labels['apps.kubernetes.io/pod-index']
+          {{- if .Values.enableK8sLogs }}
+          - name: EDGE_SELF_NODE_NAME
+            valueFrom:
+              fieldRef:
+                fieldPath: spec.nodeName
+          {{- end }}
           - name: MEZMO_RESHAPE_MESSAGE
             value: "1"
           args:
@@ -80,10 +99,18 @@ spec:
             {{- toYaml .Values.resources | nindent 12 }}
           volumeMounts:
             - name: data
-              mountPath: "/vector-data-dir"
+              mountPath: "/data/vector"
             - name: config
               mountPath: "/etc/vector/"
               readOnly: true
+            {{- if .Values.enableK8sLogs }}
+            - mountPath: /var/log/
+              name: var-log
+              readOnly: true
+            - mountPath: /var/lib/
+              name: var-lib
+              readOnly: true
+            {{- end }}
       {{- with .Values.nodeSelector }}
       nodeSelector:
         {{- toYaml . | nindent 8 }}
diff --git a/charts/edge/values.yaml b/charts/edge/values.yaml
index af34b80..0444f75 100644
--- a/charts/edge/values.yaml
+++ b/charts/edge/values.yaml
@@ -70,3 +70,8 @@ podSecurityContext: {}
 securityContext: {}
 
 imagePullSecrets: []
+
+enableK8sLogs: false
+
+# Optional PersistentStorageClaim name to use for default storage
+pvcClaimName: ""