Grafana+PrometheusでKubernetesのリソース監視（Helmを利用した環境設定について）

## Define serviceAccount names for components. Defaults to component's fully qualified name.
##
serviceAccounts:
  alertmanager:
    create: false

server:

  persistentVolume:

    ## Prometheus server data Persistent Volume size
    ##
    size: 10Gi

  ## Use a StatefulSet if replicaCount needs to be greater than 1 (see below)
  ##
  replicaCount: 3

  statefulSet:
    ## If true, use a statefulset instead of a deployment for pod management.
    ## This allows to scale replicas to more than 1 pod
    ##
    enabled: true

#!/bin/bash

cd $(dirname $0)

echo Tune shell options && {
    set -o errexit
    set -o nounset
    set -o xtrace
}

: Define Variables && {
    readonly PROJECT="${1:?}"
    readonly CLUSTER="${2:?}"
    readonly REGION="${3:?}"
    readonly NAMESPACE="${4:?}"

    readonly PROMETHEUS_CHART_VERSION=8.8.0
}

: Set target project/cluser and tiller && {
    gcloud config set project "${PROJECT}"
    gcloud container clusters get-credentials ${CLUSTER} --region "${REGION}"
    kubectl config set-context $(kubectl config current-context) --namespace="${NAMESPACE}"
    helm init --client-only
}

: Deploy Prometheus using Helm && {
    helm upgrade --install \
        --namespace="${NAMESPACE}" \
        --version="${PROMETHEUS_CHART_VERSION}" \
        -f="values.yaml" \
        "prometheus" \
        stable/prometheus
}

rbac:
  namespace: true

replicas: 3

## Enable persistence using Persistent Volume Claims
## ref: http://kubernetes.io/docs/user-guide/persistent-volumes/
##
persistence:
  enabled: true

## Pod annotations
podAnnotations:
    # 秘密情報が入れ替わったときにpodを入れ替えるためにhash値をアノテーションしておく
    checksum/extra-secret: ${SECRET_CHECKSUM:?}

## Expose the grafana service to be accessed from outside the cluster (LoadBalancer service).
## or access it from within the cluster (ClusterIP service). Set the service type and the port to serve it.
## ref: http://kubernetes.io/docs/user-guide/services/
##
service:
  type: NodePort

ingress:
  enabled: true
  annotations:
    kubernetes.io/ingress.global-static-ip-name: "static-ip"
    kubernetes.io/ingress.allow-http: "false"
    ingress.gcp.kubernetes.io/pre-shared-cert: "cert-name"
  path: /*
  hosts:
    - ${DOMAIN_URL}

# Use an existing secret for the admin user.
admin:
  existingSecret: "grafana-admin"

grafana.ini:
  server:
    domain: ${DOMAIN_URL}
    root_url: https://${DOMAIN_URL}
  auth.github:
    enabled: true
    client_id: ${AUTH_GITHUB_CLIENT_ID:?}
    client_secret: ${AUTH_GITHUB_CLIENT_SECRET:?}
    scopes: user:email,read:org
    auth_url: https://github.com/login/oauth/authorize
    token_url: https://github.com/login/oauth/access_token
    api_url: https://api.github.com/user
    allow_sign_up: true
    allowed_organizations: organization_name
  auth.google:
    enabled: ture
    client_id: "${AUTH_GOOGLE_CLIENT_ID:?}"
    client_secret: "${AUTH_GOOGLE_CLIENT_SECRET:?}"
    scopes: https://www.googleapis.com/auth/userinfo.profile https://www.googleapis.com/auth/userinfo.email
    auth_url: https://accounts.google.com/o/oauth2/auth
    token_url: https://accounts.google.com/o/oauth2/token
    allowd_domains: domain.example.com
    allow_sign_up: true

apiVersion: v1
kind: Secret
metadata:
  name: grafana-admin
  namespace: ${NAMESPACE:?}
type: Opaque
data:
  admin-user: ${ADMIN_USER:?}
  admin-password: ${ADMIN_PASSWORD:?}

## Pod annotations
podAnnotations:
    # 秘密情報が入れ替わったときにpodを入れ替えるためにhash値をアノテーションしておく
    checksum/extra-secret: ${SECRET_CHECKSUM:?}

#!/bin/bash

cd $(dirname $0)

echo Tune shell options && {
    set -o errexit
    set -o nounset
    set -o xtrace
}

: Define Variables && {
    readonly PROJECT="${1:?}"
    readonly CLUSTER="${2:?}"
    readonly REGION="${3:?}"
    readonly NAMESPACE="${4:?}"

    # set secret env
    # readonly ADMIN_USER="${5:?}"
    # readonly ADMIN_PASSWORD="${6:?}"
    # readonly AUTH_GITHUB_CLIENT_ID="${7:?}"
    # readonly AUTH_GITHUB_CLIENT_SECRET="${8:?}"
    # readonly AUTH_GOOGLE_CLIENT_ID="${9:?}"
    # readonly AUTH_GOOGLE_CLIENT_SECRET="${10:?}"
    readonly GRAFANA_CHART_VERSION=2.2.1
}

: Set target project/cluser and tiller && {
    gcloud config set project "${PROJECT}"
    gcloud container clusters get-credentials ${CLUSTER} --region "${REGION}"
    kubectl config set-context $(kubectl config current-context) --namespace="${NAMESPACE}"
    helm init --client-only
}

: Create Secrets && {
    sigil -p -f secrets.yaml \
        NAMESPACE="${NAMESPACE}" \
        ADMIN_USER="$(echo ${ADMIN_USER} | base64 -w0)" \
        ADMIN_PASSWORD="$(echo ${ADMIN_PASSWORD} | base64 -w0)" \
    | kubectl apply -f - --record
}

: Deploy Grafana using Helm && {
    sigil -p -f grafana_values.yaml \
        DOMAIN_URL="${DOMAIN_URL}" \
        AUTH_GITHUB_CLIENT_ID="${AUTH_GITHUB_CLIENT_ID}" \
        AUTH_GITHUB_CLIENT_SECRET="${AUTH_GITHUB_CLIENT_SECRET}" \
        AUTH_GOOGLE_CLIENT_ID="${AUTH_GOOGLE_CLIENT_ID}" \
        AUTH_GOOGLE_CLIENT_SECRET="${AUTH_GOOGLE_CLIENT_SECRET}" \
        SECRET_CHECKSUM=$(echo \
            ${ADMIN_USER} \
            ${ADMIN_PASSWORD} \
            ${AUTH_GITHUB_CLIENT_ID} \
            ${AUTH_GITHUB_CLIENT_SECRET} \
            ${AUTH_GOOGLE_CLIENT_ID} \
            ${AUTH_GOOGLE_CLIENT_SECRET} \
        | sha256sum) \
    | helm upgrade --install \
        --namespace="${NAMESPACE}" \
        --version="${GRAFANA_CHART_VERSION}" \
        --values=- \
        "grafana" \
        stable/grafana
}