在与外部网络隔离的 AWS GovCloud 环境中安装 Instana
您可以在运行于 GovCloud （美国）且处于物理隔离环境的 OpenShift Container Platform 集群上安装 Instana。
先决条件
确保满足下列先决条件：
- Instana 已获取代理密钥和下载密钥。
- 可以使用下列工具：
过程
要在隔离环境中通过 GovCloud 运行的 OpenShift Container Platform 集群上安装 Instana ，请执行以下步骤：
安装 Instana kubectl 插件，请参阅 《安装 Instana kubectl 插件 》。
安装 Helm:
curl -fsSL -o get_helm.sh https://raw.githubusercontent.com/helm/helm/master/scripts/get-helm-3 chmod 700 get_helm.sh ./get_helm.sh验证 Instana 和Operator的版本：
kubectl instana -v获取 Instana 后端上的图片列表：
kubectl instana versions list-images -d <downloadKey> > images.txt要访问 Instana Artifactory ，请根据您使用的是 Skopeo 还是 Docker ，运行以下其中一条命令：
Skopeo:
skopeo login -u _ -p <downloadKey> artifact-public.instana.ioDocker:
docker login -u _ -p <downloadKey> artifact-public.instana.io
将映像复制到内部 Red Hat OpenShift 映像注册表:
列出安装所需的 Instana 图像：
kubectl instana versions list-images -d <downloadKey> > images.txt访问内部 Red Hat OpenShift 映像注册表:
oc port-forward svc/image-registry -n openshift-image-registry --address=0.0.0.0 5000:5000登录到内部映像存储库。 根据您是使用 Skopeo 还是 Docker，运行下列其中一个命令:
使用 Skopeo:
skopeo login -u openshift -p $(oc whoami -t) localhost:5000使用 Docker:
docker login -u _ -p <downloadKey> artifact-public.instana.io docker login -u openshift -p $(oc whoami -t) localhost:5000
为数据存储器创建名称空间:
oc create ns instana-zookeeper oc create ns instana-kafka oc create ns instana-clickhouse oc create ns instana-postgres oc create ns instana-cassandra oc create ns instana-elastic oc create ns instana-core oc create ns instana-units oc create ns instana-operator oc create ns cert-manager将映像从防御主机复制到您自己的内部映像注册表。 根据是使用 Skopeo 还是 Docker，完成下列其中一个步骤:
Skopeo:
复制 Zookeeper 映像:
skopeo copy --dest-tls-verify=false docker://artifact-public.instana.io/self-hosted-images/3rd-party/zookeeper-operator:0.2.15_v0.2.0 docker://localhost:5000/instana-zookeeper/zookeeper-operator:0.2.15_v0.2.0 skopeo copy --dest-tls-verify=false docker://artifact-public.instana.io/self-hosted-images/3rd-party/zookeeper:3.8.3_v0.2.0 docker://localhost:5000/instana-zookeeper/zookeeper:3.8.3_v0.2.0 skopeo copy --dest-tls-verify=false docker://lachlanevenson/k8s-kubectl:v1.23.2 docker://localhost:5000/instana-zookeeper/k8s-kubectl:v1.23.2复制 Strimzi 映像:
skopeo copy --dest-tls-verify=false docker://artifact-public.instana.io/self-hosted-images/3rd-party/strimzi/operator:0.38.0_v0.3.0 docker://localhost:5000/instana-kafka/operator:0.38.0_v0.3.0 skopeo copy --dest-tls-verify=false docker://artifact-public.instana.io/self-hosted-images/3rd-party/strimzi/kafka:3.6.0_v0.3.0 docker://localhost:5000/instana-kafka/kafka:3.6.0_v0.3.0复制 Elasticsearch 映像:
skopeo copy --dest-tls-verify=false docker://artifact-public.instana.io/self-hosted-images/3rd-party/elasticsearch-operator:2.9.0_v0.3.0 docker://localhost:5000/instana-elastic/elasticsearch-operator:2.9.0_v0.3.0 skopeo copy --dest-tls-verify=false docker://artifact-public.instana.io/self-hosted-images/3rd-party/elasticsearch:7.17.14_v0.2.0 docker://localhost:5000/instana-elastic/elasticsearch:7.17.4_v0.2.0复制云本机映像:
skopeo copy --dest-tls-verify=false docker://artifact-public.instana.io/self-hosted-images/3rd-party/cloudnative-pg-operator:1.21.1_v0.1.0 docker://localhost:5000/instana-postgres/cloudnative-pg-operator:1.21.1_v0.1.0 skopeo copy --dest-tls-verify=false docker://artifact-public.instana.io/self-hosted-images/3rd-party/cnpg-containers:15_v0.1.0 docker://localhost:5000/instana-postgres/cnpg-containers:15_v0.1.0复制 Cassandra 映像:
skopeo copy --dest-tls-verify=false docker://artifact-public.instana.io/self-hosted-images/3rd-party/cass-operator:1.18.2_v0.1.0 docker://localhost:5000/instana-cassandra/cass-operator:1.18.2_v0.1.0 skopeo copy --dest-tls-verify=false docker://artifact-public.instana.io/self-hosted-images/3rd-party/k8ssandra-management-api-for-apache-cassandra:4.1.2_v0.2.0 docker://localhost:5000/instana-cassandra/k8ssandra-management-api-for-apache-cassandra:4.1.2_v0.2.0 skopeo copy --dest-tls-verify=false docker://artifact-public.instana.io/self-hosted-images/3rd-party/system-logger:1.18.2_v0.1.0 docker://localhost:5000/instana-cassandra/system-logger:1.18.2_v0.1.0 skopeo copy --dest-tls-verify=false docker://artifact-public.instana.io/self-hosted-images/3rd-party/k8ssandra-k8ssandra-client:0.2.2_v0.1.0 docker://localhost:5000/instana-cassandra/k8ssandra-k8ssandra-client:0.2.2_v0.1.0复制 Clickhouse 图像:
skopeo copy --dest-tls-verify=false docker://artifact-public.instana.io/clickhouse-operator:v0.1.2 docker://localhost:5000/instana-clickhouse/clickhouse-operator:v0.1.2 skopeo copy --dest-tls-verify=false docker://artifact-public.instana.io/clickhouse-openssl:23.8.9.54-1-lts-ibm docker://localhost:5000/instana-clickhouse/clickhouse-openssl:23.8.9.54-1-lts-ibm复制 cert-manager 目录下的图片：
skopeo copy --dest-tls-verify=false docker://quay.io/jetstack/cert-manager-controller:v1.13.2 docker://localhost:5000/cert-manager/cert-manager-controller:v1.13.2 skopeo copy --dest-tls-verify=false docker://quay.io/jetstack/cert-manager-webhook:v1.13.2 docker://localhost:5000/cert-manager/cert-manager-webhook:v1.13.2 skopeo copy --dest-tls-verify=false docker://quay.io/jetstack/cert-manager-cainjector:v1.13.2 docker://localhost:5000/cert-manager/cert-manager-cainjector:v1.13.2 skopeo copy --dest-tls-verify=false docker://quay.io/jetstack/cert-manager-acmesolver:v1.13.2 docker://localhost:5000/cert-manager/cert-manager-acmesolver:v1.13.2 skopeo copy --dest-tls-verify=false docker://quay.io/jetstack/cert-manager-ctl:v1.13.2 docker://localhost:5000/cert-manager/cert-manager-ctl:v1.13.2复制 Instana 后端和Operator镜像：
while read p; do SOURCE=`echo "$p" | tac -s'/' | head -1`; echo $SOURCE; skopeo copy --dest-tls-verify=false docker://artifact-public.instana.io/backend/$SOURCE docker://localhost:5000/instana-core/$SOURCE; done<images.txt OPERATOR_IMAGE=`echo "$(cat images.txt | tail -1)" | tac -s'/' | head -1` skopeo copy --dest-tls-verify=false docker://artifact-public.instana.io/infrastructure/$OPERATOR_IMAGE docker://localhost:5000/instana-operator/$OPERATOR_IMAGE
Docker
复制 Zookeeper 图像：
拉动图像：
docker pull artifact-public.instana.io/self-hosted-images/3rd-party/zookeeper-operator:0.2.15_v0.2.0 docker pull artifact-public.instana.io/self-hosted-images/3rd-party/zookeeper:3.8.3_v0.2.0 docker pull lachlanevenson/k8s-kubectl:v1.23.2重命名图像
docker tag artifact-public.instana.io/self-hosted-images/3rd-party/zookeeper-operator:0.2.15_v0.2.0 localhost:5000/instana-zookeeper/zookeeper-operator:0.2.15_v0.2.0 docker tag artifact-public.instana.io/self-hosted-images/3rd-party/zookeeper:3.8.3_v0.2.0 localhost:5000/instana-zookeeper/zookeeper:3.8.3_v0.2.0 docker tag lachlanevenson/k8s-kubectl:v1.23.2 localhost:5000/instana-zookeeper/k8s-kubectl:v1.23.2推送图片：
docker push localhost:5000/instana-zookeeper/zookeeper-operator:0.2.15_v0.2.0 docker push localhost:5000/instana-zookeeper/zookeeper:3.8.3_v0.2.0 docker push localhost:5000/instana-zookeeper/k8s-kubectl:v1.23.2
安装 Helm Chart:
添加 helm 软件源：
helm repo add instana https://artifact-public.instana.io/artifactory/rel-helm-customer-virtual --username=_ --password=<AGENT_KEY>helm repo update下载 Helm Chart:
helm pull instana/ibm-clickhouse-operator --version=v0.1.2 helm pull instana/zookeeper-operator --version=0.2.15 helm pull instana/strimzi-kafka-operator --version 0.38.0 helm pull instana/eck-operator --version=2.9.0 helm pull instana/cloudnative-pg --version 0.20.0 helm pull instana/cass-operator --version=0.45.2 helm pull instana/cert-manager --version v1.13.2
安装数据存储器操作程序:
创建 Zookeeper 数据存储器。
安装 Zookeeper 操作程序:
helm install instana -n instana-zookeeper --create-namespace zookeeper-operator-0.2.15.tgz --version=0.2.15 --set image.repository=image-registry.openshift-image-registry.svc:5000/instana-zookeeper/zookeeper-operator --set image.tag=0.2.15_v0.2.0 --set hooks.image.repository=image-registry.openshift-image-registry.svc:5000/instana-zookeeper/k8s-kubectl --set hooks.image.tag=v1.23.2为数据存储创建一个 YAML 文件：
apiVersion: "zookeeper.pravega.io/v1beta1" kind: "ZookeeperCluster" metadata: name: "instana-zookeeper" spec: # For all params and defaults, see https://github.com/pravega/zookeeper-operator/tree/master/charts/zookeeper#configuration replicas: 3 image: repository: image-registry.openshift-image-registry.svc:5000/instana-zookeeper/zookeeper tag: 3.8.3_v0.2.0 config: tickTime: 2000 initLimit: 10 syncLimit: 5 maxClientCnxns: 0 autoPurgeSnapRetainCount: 20 autoPurgePurgeInterval: 1 persistence: reclaimPolicy: Delete spec: resources: requests: storage: "10Gi"在 Instana 的Clickhouse中提供对服务账户的访问权限：
oc policy add-role-to-group system:image-puller system:serviceaccounts:instana-clikchouse --namespace=instana-zookeeper安装 Zookeeper 数据存储:
oc apply -f zookeeper-ds.yaml -n instana-clickhouse
创建 Strimzi 数据存储:
安装 Strimzi Kafka 操作程序:
helm install strimzi ./$(ls | grep 'strimzi*' | head -1) --version 0.38.0 -n instana-kafka --create-namespace --set image.registry=image-registry.openshift-image-registry.svc:5000 --set image.repository=instana-kafka --set image.name=operator --set image.tag=0.38.0_v0.3.0 --set kafka.image.registry=image-registry.openshift-image-registry.svc:5000 --set kafka.image.repository=instana-kafka --set kafka.image.name=kafka --set kafka.image.tag=3.6.0_v0.3.0 --set topicOperator.image.registry=image-registry.openshift-image-registry.svc:5000 --set topicOperator.image.repository=instana-kafka --set topicOperator.image.tag=0.38.0_v0.3.0 --set userOperator.image.registry=image-registry.openshift-image-registry.svc:5000 --set userOperator.image.repository=instana-kafka --set userOperator.image.tag=0.38.0_v0.3.0 --set tlsSidecarEntityOperator.image.registry=image-registry.openshift-image-registry.svc:5000 --set tlsSidecarEntityOperator.image.repository=instana-kafka --set tlsSidecarEntityOperator.image.tag=3.6.0_v0.3.0为数据存储创建一个 YAML 文件：
apiVersion: kafka.strimzi.io/v1beta2 kind: Kafka metadata: name: instana labels: strimzi.io/cluster: instana spec: kafka: version: 3.6.0 replicas: 3 listeners: - name: scram port: 9092 type: internal tls: false authentication: type: scram-sha-512 configuration: useServiceDnsDomain: true authorization: type: simple superUsers: - strimzi-kafka-user storage: type: jbod volumes: - id: 0 type: persistent-claim size: 50Gi deleteClaim: true config: offsets.topic.replication.factor: 3 transaction.state.log.replication.factor: 3 transaction.state.log.min.isr: 2 default.replication.factor: 3 min.insync.replicas: 2 max.message.bytes: 52428800 replica.fetch.max.bytes: 52428800 template: pod: tmpDirSizeLimit: 100Mi zookeeper: replicas: 3 storage: type: persistent-claim size: 5Gi deleteClaim: true entityOperator: template: pod: tmpDirSizeLimit: 100Mi userOperator: image: image-registry.openshift-image-registry.svc:5000/instana-kafka/operator:0.38.0_v0.3.0部署 Kafka:
kubectl apply -f kafka.yaml -n instana-kafka kubectl wait kafka/instana --for=condition=Ready --timeout=300s -n instana-kafka在 Kafka中创建 SASL/SCRAM 用户。 创建一个名为 YAML 的文件，例如
strimzi-kafka-user.yaml:apiVersion: kafka.strimzi.io/v1beta2 kind: KafkaUser metadata: name: strimzi-kafka-user labels: strimzi.io/cluster: instana spec: authentication: type: scram-sha-512 authorization: type: simple acls: - resource: type: topic name: '*' patternType: literal operation: All host: "*" - resource: type: group name: '*' patternType: literal operation: All host: "*"应用 Kafka 用户:
kubectl apply -f strimzi-kafka-user.yaml -n instana-kafka kubectl wait kafka/instana --for=condition=Ready --timeout=300s -n instana-kafka检索 Strimzi-Kafka 用户的密码以进行下一个配置:
kubectl get secret strimzi-kafka-user -n instana-kafka --template='{{index .data.password | base64decode}}' && echo将检索到的密码存储在
config.yaml文件中:datastoreConfigs: ... kafkaConfig: adminUser: strimzi-kafka-user adminPassword: <RETRIEVED_FROM_SECRET> consumerUser: strimzi-kafka-user consumerPassword: <RETRIEVED_FROM_SECRET> producerUser: strimzi-kafka-user producerPassword: <RETRIEVED_FROM_SECRET>
创建 Elasticsearch 数据存储器。
安装 Elasticsearch 操作程序:
helm install elastic-operator ./$(ls | grep 'eck*' | head -1) -n instana-elastic --create-namespace --version=2.9.0 --set image.repository=image-registry.openshift-image-registry.svc:5000/instana-elastic/elasticsearch-operator --set image.tag=2.9.0_v0.3.0为数据存储创建一个 YAML 文件：
apiVersion: elasticsearch.k8s.elastic.co/v1 kind: Elasticsearch metadata: name: instana spec: version: 7.17.14 image: image-registry.openshift-image-registry.svc:5000/instana-elastic/elasticsearch:7.17.14_v0.2.0 nodeSets: - name: default count: 3 config: node.master: true node.data: true node.ingest: true node.store.allow_mmap: false volumeClaimTemplates: - metadata: name: elasticsearch-data # Do not change this name unless you set up a volume mount for the data path. spec: accessModes: - ReadWriteOnce resources: requests: storage: 20Gi http: tls: selfSignedCertificate: disabled: true部署 Elasticsearch:
kubectl apply -f elastic.yaml -n instana-elastic kubectl wait elasticsearch/instana --for=condition=ReconciliationComplete --timeout=300s -n instana-elastic缺省情况下，将使用随机生成的密码创建名称为 "elastic" 的用户。
检索下一个配置的用户密码:
kubectl get secret instana-es-elastic-user -n instana-elastic -o go-template='{{.data.elastic | base64decode}}' && echo请将
config.yaml文件中的 <RETRIEVED_FROM_SECRET> 替换为已获取的密码：datastoreConfigs: ... elasticsearchConfig: adminUser: elastic adminPassword: <RETRIEVED_FROM_SECRET> user: elastic password: <RETRIEVED_FROM_SECRET> ...
创建 Postgres 数据存储器。
确定 Red Hat OpenShift上的文件系统组标识。 Red Hat OpenShift 要求文件系统组在特定于名称空间的值范围内。 在部署了 CNPG Kubernetes 操作员的集群上，运行：
kubectl get namespace instana-postgres -o yaml将显示类似于以下示例的输出:
apiVersion: v1 kind: Namespace metadata: annotations: ....... openshift.io/sa.scc.uid-range: 1000750000/10000 labels: kubernetes.io/metadata.name: instana-postgres ....... name: instana-postgresopenshift.io/sa.scc.supplemental-groups注释包含允许的标识范围。 范围 1000750000/10000 指示以标识 1000750000 开头且标识范围从 1000750000 到 1000760000 的 10,000 个值。 在此示例中，值 1000750000 用作文件系统组标识。创建 "安全性约束" 文件，例如
postgres-scc.yaml文件:apiVersion: security.openshift.io/v1 kind: SecurityContextConstraints metadata: name: postgres-scc runAsUser: type: MustRunAs uid: 101 seLinuxContext: type: RunAsAny fsGroup: type: RunAsAny allowHostDirVolumePlugin: false allowHostNetwork: true allowHostPorts: true allowPrivilegedContainer: false allowHostIPC: true allowHostPID: true readOnlyRootFilesystem: false users: - system:serviceaccount:instana-postgres:postgres-operator - system:serviceaccount:instana-postgres:postgres-pod - system:serviceaccount:instana-postgres:default应用文件:
oc apply -f postgres-scc.yaml安装 Postgres 操作程序:
helm install cnpg cloudnative-pg-0.20.0.tgz --set image.repository=image-registry.openshift-image-registry.svc:5000/instana-postgres/cloudnative-pg-operator --set image.tag=1.21.1_v0.1.0 --version=0.20.0 --set containerSecurityContext.runAsUser=<UID from namespace> --set containerSecurityContext.runAsGroup=<UID from namespace> -n instana-postgres生成 Postgres 数据存储器的密码。
生成随机密码:
openssl rand -base64 24 | tr -cd 'a-zA-Z0-9' | head -c32; echo创建文件，例如
postgres-secret.yaml:kind: Secret apiVersion: v1 metadata: name: instanaadmin type: Opaque stringData: username: instanaadmin password: <user-generate-password> # Generated password应用
postgres-secrets.yaml文件:kubectl apply -f postgres-secrets.yaml -n instana-postgres
创建一个名为 ` YAML ` 的文件，例如
postgres.yaml用于数据存储配置：apiVersion: postgresql.cnpg.io/v1 kind: Cluster metadata: name: postgres spec: instances: 3 imageName: image-registry.openshift-image-registry.svc:5000/instana-postgres/cnpg-containers:15_v0.0.1 imagePullPolicy: IfNotPresent postgresql: parameters: shared_buffers: 32MB pg_stat_statements.track: all auto_explain.log_min_duration: '10s' pg_hba: - local all all trust - host all all 0.0.0.0/0 md5 - local replication standby trust - hostssl replication standby all md5 - hostnossl all all all reject - hostssl all all all md5 managed: roles: - name: instanaadmin login: true superuser: true createdb: true createrole: true passwordSecret: name: instanaadmin bootstrap: initdb: database: instanaadmin owner: instanaadmin secret: name: instanaadmin superuserSecret: name: instanaadmin storage: size: 1Gi部署 Postgres:
kubectl apply -f postgres.yaml -n instana-postgres将生成的密码存储在
config.yaml文件中:datastoreConfigs: ... postgresConfigs: - user: instanaadmin password: <USER_GENERATED_PASSWORD> adminUser: instanaadmin adminPassword: <USER_GENERATED_PASSWORD> ...
安装 Cassandra
安装 Cert-Manager:
helm install cert-manager cert-manager-v1.13.2.tgz --namespace cert-manager --create-namespace --version v1.13.2 --set installCRDs=true --set prometheus.enabled=false --set image.repository=image-registry.openshift-image-registry.svc:5000/cert-manager/cert-manager-controller --set webhook.image.repository=image-registry.openshift-image-registry.svc:5000/cert-manager/cert-manager-webhook --set cainjector.image.repository=image-registry.openshift-image-registry.svc:5000/cert-manager/cert-manager-cainjector --set acmesolver.image.repository=image-registry.openshift-image-registry.svc:5000/cert-manager/cert-manager-acmesolver --set startupapicheck.image.repository=image-registry.openshift-image-registry.svc:5000/cert-manager/cert-manager-ctl创建文件，例如
cassandra-scc.yaml:apiVersion: security.openshift.io/v1 kind: SecurityContextConstraints metadata: name: cassandra-scc runAsUser: type: MustRunAs uid: 999 seLinuxContext: type: RunAsAny fsGroup: type: RunAsAny allowHostDirVolumePlugin: false allowHostNetwork: true allowHostPorts: true allowPrivilegedContainer: false allowHostIPC: true allowHostPID: true readOnlyRootFilesystem: false users: - system:serviceaccount:instana-cassandra:cass-operator - system:serviceaccount:instana-cassandra:default应用文件:
oc apply -f cassandra-scc.yaml安装 Cass 操作程序:
helm install cass-operator cass-operator-0.45.2.tgz -n instana-cassandra --create-namespace --version=0.45.2 --set securityContext.runAsGroup=999 --set securityContext.runAsUser=999 --set image.registry=image-registry.openshift-image-registry.svc:5000 --set image.repository=instana-cassandra/cass-operator --set image.tag=1.18.2_v0.1.0创建文件，例如
cassandra.yaml:apiVersion: cassandra.datastax.com/v1beta1 kind: CassandraDatacenter metadata: name: cassandra spec: clusterName: instana serverType: cassandra serverImage: image-registry.openshift-image-registry.svc:5000/instana-cassandra/k8ssandra-management-api-for-apache-cassandra:4.1.2_v0.2.0 k8ssandraClientImage: image-registry.openshift-image-registry.svc:5000/instana-cassandra/k8ssandra-k8ssandra-client:0.2.2_v0.1.0 systemLoggerImage: image-registry.openshift-image-registry.svc:5000/instana-cassandra/system-logger:1.18.2_v0.1.0 serverVersion: "4.1.2" podTemplateSpec: spec: containers: - name: cassandra managementApiAuth: insecure: {} size: 3 allowMultipleNodesPerWorker: false resources: requests: cpu: 2000m memory: 8Gi limits: cpu: 4000m memory: 16Gi storageConfig: cassandraDataVolumeClaimSpec: accessModes: - ReadWriteOnce resources: requests: storage: 30Gi config: jvm-server-options: initial_heap_size: "4G" max_heap_size: "8G" additional-jvm-opts: - -Dcassandra.allow_unsafe_aggressive_sstable_expiration=true cassandra-yaml: authenticator: org.apache.cassandra.auth.PasswordAuthenticator authorizer: org.apache.cassandra.auth.CassandraAuthorizer role_manager: org.apache.cassandra.auth.CassandraRoleManager memtable_flush_writers: 8 auto_snapshot: false gc_warn_threshold_in_ms: 10000 otc_coalescing_strategy: DISABLED memtable_allocation_type: offheap_objects num_tokens: 256 drop_compact_storage_enabled: true部署 Cassandra:
oc apply -f cassandra.yaml -n instana-cassandra默认情况下， CassandraDatacenter 会创建一个超级用户，例如 clusterName -superuser。 clusterName 是 文件
cassandra.yaml中.spec.clusterName部分指定的值。 私钥名称为 instana-superuser。检索
instana-superuser的密码:kubectl get secret instana-superuser -n instana-cassandra --template='{{index .data.password | base64decode}}' && echo在
config.yaml文件中，将<RETRIEVED_FROM_SECRET>替换为检索到的密码:datastoreConfigs: ... cassandraConfigs: - user: instana-superuser password: <RETRIEVED_FROM_SECRET> adminUser: instana-superuser adminPassword: <RETRIEVED_FROM_SECRET> ...
安装 Clickhouse:
创建文件，例如
clickhouse-scc.yaml:apiVersion: security.openshift.io/v1 kind: SecurityContextConstraints metadata: name: clickhouse-scc runAsUser: type: RunAsAny seLinuxContext: type: RunAsAny fsGroup: type: RunAsAny supplementalGroups: type: RunAsAny allowHostDirVolumePlugin: false allowHostNetwork: true allowHostPorts: true allowPrivilegedContainer: false allowHostIPC: true allowHostPID: true readOnlyRootFilesystem: false users: - system:serviceaccount:instana-clickhouse:clickhouse-operator - system:serviceaccount:instana-clickhouse:clickhouse-operator-ibm-clickhouse-operator - system:serviceaccount:instana-clickhouse:default应用文件:
oc apply -f clickhouse-scc.yaml安装 ClickHouse 操作程序:
helm install clickhouse-operator ibm-clickhouse-operator-v0.1.2.tgz -n instana-clickhouse --version=v0.1.2 --set operator.image.repository=image-registry.openshift-image-registry.svc:5000/instana-clickhouse/clickhouse-operator --set operator.image.tag=v0.1.2创建文件，例如
clickhouse.yaml:apiVersion: "clickhouse.altinity.com/v1" kind: "ClickHouseInstallation" metadata: name: "instana" spec: defaults: templates: dataVolumeClaimTemplate: instana-clickhouse-data-volume logVolumeClaimTemplate: instana-clickhouse-log-volume serviceTemplate: service-template configuration: files: config.d/storage.xml: | <clickhouse> <storage_configuration> <disks> <default/> <cold_disk> <path>/var/lib/clickhouse-cold/</path> </cold_disk> </disks> <policies> <logs_policy> <volumes> <data> <disk>default</disk> </data> <cold> <disk>cold_disk</disk> </cold> </volumes> </logs_policy> <logs_policy_v4> <volumes> <tier1> <disk>default</disk> </tier1> <tier2> <disk>cold_disk</disk> </tier2> </volumes> </logs_policy_v4> </policies> </storage_configuration> </clickhouse> clusters: - name: local templates: podTemplate: clickhouse layout: shardsCount: 1 replicasCount: 2 # The the replication count of 2 is fixed for Instana backend installations schemaPolicy: replica: None shard: None zookeeper: nodes: - host: instana-zookeeper-headless.instana-clickhouse profiles: default/max_memory_usage: 10000000000 # If memory limits are set, this value must be adjusted according to the limits. default/joined_subquery_requires_alias: 0 default/max_execution_time: 100 default/max_query_size: 1048576 default/use_uncompressed_cache: 0 default/enable_http_compression: 1 default/load_balancing: random default/background_pool_size: 32 default/background_schedule_pool_size: 32 default/distributed_directory_monitor_split_batch_on_failure: 1 default/distributed_directory_monitor_batch_inserts: 1 default/insert_distributed_sync: 1 default/log_queries: 1 default/log_query_views: 1 default/max_threads: 16 default/allow_experimental_database_replicated: 1 quotas: default/interval/duration: 3600 default/interval/queries: 0 default/interval/errors: 0 default/interval/result_rows: 0 default/interval/read_rows: 0 default/interval/execution_time: 0 settings: remote_servers/all-sharded/secret: clickhouse-default-pass remote_servers/all-replicated/secret: clickhouse-default-pass remote_servers/local/secret: clickhouse-default-pass max_concurrent_queries: 200 max_table_size_to_drop: 0 max_partition_size_to_drop: 0 users: default/password: "sXOe8Kk4" clickhouse-user/networks/ip: "::/0" clickhouse-user/password_sha256_hex: "4417ddef8349cce2351f5f3e9e377b53390c09c8c133d25b02ce66b5e3ab090c" # Or # Generate password and the corresponding SHA256 hash with: # $ PASSWORD=$(base64 < /dev/urandom | head -c8); echo "$PASSWORD"; echo -n "$PASSWORD" | sha256sum | tr -d '-' # 6edvj2+d <- first line is the password # a927723f4a42cccc50053e81bab1fcf579d8d8fb54a3ce559d42eb75a9118d65 <- second line is the corresponding SHA256 hash # clickhouse-user/password_sha256_hex: "a927723f4a42cccc50053e81bab1fcf579d8d8fb54a3ce559d42eb75a9118d65" # Or # Generate password and the corresponding SHA1 hash with: # $ PASSWORD=$(base64 < /dev/urandom | head -c8); echo "$PASSWORD"; echo -n "$PASSWORD" | sha1sum | tr -d '-' | xxd -r -p | sha1sum | tr -d '-' # LJfoOfxl <- first line is the password, put this in the k8s secret # 3435258e803cefaab7db2201d04bf50d439f6c7f <- the corresponding double SHA1 hash, put this below # clickhouse-user/password_double_sha1_hex: "3435258e803cefaab7db2201d04bf50d439f6c7f" templates: podTemplates: - name: clickhouse spec: containers: - name: instana-clickhouse image: image-registry.openshift-image-registry.svc:5000/instana-clickhouse/clickhouse-openssl:23.8.9.54-1-lts-ibm command: - clickhouse-server - --config-file=/etc/clickhouse-server/config.xml volumeMounts: - mountPath: /var/lib/clickhouse-cold/ name: instana-clickhouse-data-cold-volume - name: clickhouse-log image: image-registry.openshift-image-registry.svc:5000/instana-clickhouse/clickhouse-openssl:23.8.9.54-1-lts-ibm args: - while true; do sleep 30; done; command: - /bin/sh - -c - -- securityContext: fsGroup: 0 runAsGroup: 0 runAsUser: 1001 # Optional - uncomment the lines below if resources need to be specifically defined for the clickhouse pods. The values below are for example only. # resources: # limits: # cpu: "4" # memory: 4Gi # requests: # cpu: "1" # memory: 2Gi volumeClaimTemplates: - name: instana-clickhouse-data-volume spec: accessModes: - ReadWriteOnce resources: requests: storage: 100Gi - name: instana-clickhouse-data-cold-volume spec: accessModes: - ReadWriteOnce resources: requests: storage: 100Gi - name: instana-clickhouse-log-volume spec: accessModes: - ReadWriteOnce resources: requests: storage: 1Gi serviceTemplates: - name: service-template generateName: "clickhouse-{chi}" spec: ports: - name: http port: 8123 - name: tcp port: 9000 type: ClusterIP缺省情况下，会将
clickhouse-user和clickhouse-pass添加到 ClickHouse。使用 ZooKeeper 集群的主机名更新
zookeeper.nodes.host字段。
安装 Instana 企业版。 创建并配置要在
Instana-Operator文件中使用的值文件:- 生成值文件:
kubectl instana operator template --output-dir $(pwd)/opr -n instana-operator - 将以下行添加到值文件:
image: registry: image-registry.openshift-image-registry.svc:5000 repository: instana-operator/instana-operator imagePullSecrets: [] - 应用更改：
kubectl instana operator apply -n instana-operator --values <pathtoFile>/values.yaml- 生成值文件:
验证 Instana 企业版运营商部署：
kubectl get all -n instana-operator下载 Instana 许可证：
kubectl instana license download --sales-key <redacted>定义存储器:
Instana 需要使用存储类型 ReadWriteMany 来存储 rawSpans ，并通过 NFS 或 Ceph 监控数据。 在 AWS GovCloud 或公有云中， Instana 可以使用 S3 存储桶或 GCS。
在部署了集群的同一区域中创建 S3 存储区，创建 IAM 用户或 IAM 角色，并使用 IAM 策略授予所需的 IAM 许可权，请完成下列其中一个步骤:
供应 IAM 角色， IAM 策略 AWS 控制台:
创建具有特权的 IAM 策略。
创建 IAM 角色并关联 IAM 角色:
获取 OIDC Connect 提供商的 ARN，请访问 https://us-east-1.console.aws.amazon.com/iam/home?region=us-west-1#/identity_providers。
更新到区域
gov-cloud。
在 IAM 角色信任关系中，更新文件，如以下示例中所示:
{ "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Principal": { "Federated": "<ReplaceWithActualValue>" }, "Action": "sts:AssumeRoleWithWebIdentity", "Condition": { "StringEquals": { "oidc.op1.openshiftapps.com/<ReplaceWithActual>:aud": "sts.amazonaws.com", "oidc.op1.openshiftapps.com/<ReplaceWithActual>:sub": "system:serviceaccount:instana-core:instana-core" } } } ] }
使用 Red Hat OpenShift Cloud Credential Operator 供应 IAM 角色和 IAM 策略:
在 OpenShift Container Platform 集群中创建
CredentialsRequest:apiVersion: cloudcredential.openshift.io/v1 kind: CredentialsRequest metadata: name: instana-backend-storage namespace: openshift-cloud-credential-operator spec: secretRef: name: instana-backend-storage namespace: instana-core providerSpec: apiVersion: cloudcredential.openshift.io/v1 kind: AWSProviderSpec statementEntries: - effect: Allow action: - s3:CreateBucket - s3:DeleteBucket - s3:PutBucketTagging - s3:GetBucketTagging - s3:PutBucketPublicAccessBlock - s3:GetBucketPublicAccessBlock - s3:PutEncryptionConfiguration - s3:GetEncryptionConfiguration - s3:PutLifecycleConfiguration - s3:GetLifecycleConfiguration - s3:GetBucketLocation - s3:ListBucket - s3:GetObject - s3:PutObject - s3:DeleteObject - s3:ListBucketMultipartUploads - s3:AbortMultipartUpload - s3:ListMultipartUploadParts resource: - arn:aws:s3:::<ReplaceWithActualBucketName> - arn:aws:s3:::<ReplaceWithActualBucketName>/*从私钥
instana-backend-storage instana-core复制 AWS AccessKey 和私钥:kubectl get secrets instana-backend-storage -n instana-core -o yaml
在项目
instana-units中添加映像拉取者角色，以从项目instana-core拉取映像:oc policy add-role-to-group system:image-puller system:serviceaccounts:instana-units --namespace=instana-core安装 Instana 后端，请参阅 《安装 Instana 后端》。