Armory Docs – Armory Scale Agent Service Deployment Methods

Plugins: Deploy the Armory Scale Agent Service Using Kubernetes Manifests

Mon, 01 Jan 0001 00:00:00 +0000

Before you begin

You have installed the Scale Agent plugin and obtained its LoadBalancer address.

Create a namespace

In the deployment target cluster, execute kubectl create ns spin-agent to create a namespace for the Armory Scale Agent service.

Configure permissions

The Agent can run with most features on the default ServiceAccount. However, if you want the Scale Agent to load balance connections or assign a precise Zone ID, the Scale Agent needs permissions to get Pods, Deployments, ReplicaSets, and Namespaces in your cluster. Rather than modifying the default ServiceAccount permissions, Armory recommends creating a new ServiceAccount, ClusterRole, and ClusterRoleBinding for the Scale Agent.

Apply the following manifest in your spin-agent namespace:

Show me a manifest

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
 name: spin-cluster-role
rules:
- apiGroups:
 - ""
 resources:
 - configmaps
 - endpoints
 - events
 - ingresses
 - ingresses/status
 - jobs
 - jobs/status
 - namespaces
 - namespaces/finalize
 - namespaces/status
 - pods
 - pods/log
 - pods/status
 - secrets
 - services
 - services/status
 - services/finalizers
 verbs:
 - create
 - get
 - list
 - update
 - watch
 - patch
 - delete
- apiGroups:
 - batch
 resources:
 - jobs
 - jobs/status
 verbs:
 - create
 - get
 - list
 - update
 - watch
 - patch
 - delete
- apiGroups:
 - apps
 - extensions
 resources:
 - daemonsets
 - daemonsets/status
 - deployments
 - deployments/finalizers
 - deployments/scale
 - deployments/status
 - replicasets
 - replicasets/finalizers
 - replicasets/scale
 - replicasets/status
 - statefulsets
 - statefulsets/finalizers
 - statefulsets/scale
 - statefulsets/status
 verbs:
 - create
 - get
 - list
 - update
 - watch
 - patch
 - delete
- apiGroups:
 - monitoring.coreos.com
 resources:
 - servicemonitors
 verbs:
 - get
 - create
- apiGroups:
 - spinnaker.armory.io
 resources:
 - '*'
 - spinnakerservices
 verbs:
 - create
 - get
 - list
 - update
 - watch
 - patch
- apiGroups:
 - apiextensions.k8s.io
 resources:
 - customresourcedefinitions
 verbs:
 - '*'
- apiGroups:
 - admissionregistration.k8s.io
 resources:
 - validatingwebhookconfigurations
 verbs:
 - '*'
- apiGroups:
 - argoproj.io
 resources:
 - '*'
 verbs:
 - '*'
---
apiVersion: v1
kind: ServiceAccount
metadata:
 namespace: spin-agent
 name: spin-sa
---
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
 name: spin-cluster-role-binding
subjects:
 - kind: ServiceAccount
 name: spin-sa
 namespace: spin-agent
roleRef:
 apiGroup: rbac.authorization.k8s.io
 kind: ClusterRole
 name: spin-cluster-role

Configure the service

Configure the Armory Scale Agent service using a ConfigMap. Define armory-agent.yml in the data section:

apiVersion: v1
kind: ConfigMap
metadata:
 name: armory-agent-config
 namespace: spin-agent
data:
 armory-agent.yml: |
 server:
 port: 8082

Clouddriver plugin LoadBalancer

Replace spin-clouddriver-grpc with the IP address of your Clouddriver service.

apiVersion: v1
kind: ConfigMap
metadata:
 name: armory-agent-config
 namespace: spin-agent
data:
 armory-agent.yaml: |
 clouddriver:
 grpc: spin-clouddriver-grpc:9091
 insecure: true

Kubernetes account

Add your Kubernetes account configuration for your cluster:

apiVersion: v1
kind: ConfigMap
metadata:
 name: kubesvc-config
 namespace: spin-agent
data:
 armory-agent.yaml: |
 clouddriver:
 grpc: spin-clouddriver-grpc:9091
 insecure: true
 kubernetes:
 accounts:
 - name:
 kubeconfigFile:
 insecure:
 context:
 oAuthScopes:
 serviceAccount: true
 serviceAccountName: spin-sa
 namespaces: []
 omitNamespaces: []
 onlyNamespacedResources:
 kinds: []
 omitKinds: []
 customResourceDefinitions: [{kind:}]
 metrics:
 permissions: []
 maxResumableResourceAgeMs:
 onlySpinnakerManaged:
 noProxy:

See the Agent options for field explanations.

Apply the manifest to your spin-agent namespace.

Deploy the Armory Scale Agent service

Apply the following Agent deployment manifest in your spin-agent namespace:

Show me the manifest

apiVersion: apps/v1
kind: Deployment
metadata:
 labels:
 app: spin
 app.kubernetes.io/name: armory-agent
 app.kubernetes.io/part-of: spinnaker
 cluster: spin-armory-agent
 name: spin-armory-agent
spec:
 replicas: 1
 selector:
 matchLabels:
 app: spin
 cluster: spin-armory-agent
 template:
 metadata:
 labels:
 app: spin
 app.kubernetes.io/name: armory-agent
 app.kubernetes.io/part-of: spinnaker
 cluster: spin-armory-agent
 spec:
 serviceAccount: spin-sa
 containers:
 - image: armory/agent-k8s:<version> # must be compatible with your Spinnaker or Armory CD version
 imagePullPolicy: IfNotPresent
 name: armory-agent
 ports:
 - name: health
 containerPort: 8082
 protocol: TCP
 - name: metrics
 containerPort: 8008
 protocol: TCP
 readinessProbe:
 httpGet:
 port: health
 path: /health
 failureThreshold: 3
 periodSeconds: 10
 successThreshold: 1
 timeoutSeconds: 1
 terminationMessagePath: /dev/termination-log
 terminationMessagePolicy: File
 volumeMounts:
 - mountPath: /opt/armory/config
 name: volume-armory-agent-config
 # - mountPath: /kubeconfigfiles
 # name: volume-armory-agent-kubeconfigs
 restartPolicy: Always
 volumes:
 - name: volume-armory-agent-config
 configMap:
 name: armory-agent-config
 # - name: volume-armory-agent-kubeconfigs
 # secret:
 # defaultMode: 420
 # secretName: kubeconfigs-secret

Confirm success

Create a pipeline with a Deploy manifest stage. You should see your target cluster available in the Accounts list. Deploy a static manifest.

What’s next

Troubleshoot the Armory Scale Agent Service and Plugin page if you run into issues.
Learn how to Integrate Prometheus. Agent CPU usage is low, but the amount of memory depends on the size of the cluster the Armory Scale Agent is monitoring. The gRPC buffer consumes about 4MB of memory.
Configure Mutual TLS Authentication
Read about Kubernetes Permissions for the Armory Scale Agent

Plugins: Deploy the Armory Scale Agent Service Using a Helm Chart

Mon, 01 Jan 0001 00:00:00 +0000

Chart overview

Exposes all settings for installing the Armory Scale Agent service.
Enables you to easily deploy the Armory Scale Agent service with default configuration using a single command.
Gives you the ability to customize the service settings in a file or via the command line.

Connecting to Armory Cloud services is enabled by default. Armory Cloud services is required for some features to function and affects how you configure the Armory Scale Agent service installation. If you want to connect to Armory Cloud services, you must include your Armory Cloud client ID and secret. You can disable connecting to Armory Cloud services by setting a gPRC URL instead of providing your Armory Cloud services credentials.

Before you begin

Ensure you have completed the following steps before you install the Armory Scale Agent using the Helm chart:

You have installed the Clouddriver plugin.
You are familiar with Helm and have installed v3.6.3+.
You have added or updated the Armory charts repo in your Kubernetes environment.

To add the Armory chart repo, execute the following command:
```
helm repo add armory-charts https://armory-charts.s3.amazonaws.com/
```
If you have previously added the chart repo, update it with the following commands:
```
helm repo update
helm upgrade armory-agent armory-charts/agent-k8s-full
```
You are familiar with the various use cases for deploying Scale Agent services to your Kubernetes clusters.

Quickstart

Run one of the following commands:

If you want to connect to Armory Cloud services:

You must include your Armory Cloud clientId and clientSecret credentials.

helm install armory-agent armory-charts/agent-k8s-full \
--create-namespace \
--namespace=<agent-namespace> \
--set hub.auth.armory.clientId=<your-clientID>,hub.auth.armory.secret=<your-clientSecret>

If you don’t want to connect to Armory Cloud services:

You must include your gPRC endpoint, such as localhost:9090.

helm install armory-agent armory-charts/agent-k8s-full \
--create-namespace \
--namespace=<agent-namespace> \
--set config.clouddriver.grpc=<endpoint>

Command options:

--create-namespace: (Optional) Creates the namespace if not present. See the Helm install docs.
--namespace=<agent-namespace>: (Required) The namespace where you install the Armory Scale Agent, which is also the deployment target for your app.

Before you start, make sure:

Each account has a kubeconfig file that grants access to the deployment target cluster. If you use Amazon EKS, you can run the following command:
```
aws eks update-kubeconfig --name <target-cluster>
```
Each account has a kubeconfig file and a secret created from that file. For example:
```
kubectl create secret generic kubeconfig --from-file=<path>/.kube/config -n <namespace>
```
See the kubectl create secret generic docs for command details.

Run one of the following commands:

If you want to connect to Armory Cloud services:

You must set your Armory Cloud clientId and clientSecret credentials.

You must set your kubeconfig file and secret. <kubeconfig> is the name of the file you used when you created the secret. If you used --from-file=<path>/.kube/config, the value of <kubeconfig> is config.

helm install armory-agent armory-charts/agent-k8s-full \
--create-namespace \
--namespace=<agent-namespace> \
--set hub.auth.armory.clientId=<your-clientID> \
,hub.auth.armory.secret=<your-clientSecret> \
,kubeconfigs.<account-name>.file=<kubeconfig> \
,kubeconfigs.<account-name>.secret=<secret>

If you don’t want to connect to Armory Cloud services:

You must include your gPRC endpoint, such as localhost:9090.

You must set your kubeconfig file and secret. <kubeconfig> is the name of the file you used when you created the secret. If you used --from-file=<path>/.kube/config, the value of <kubeconfig> is config.
```
helm install armory-agent armory-charts/agent-k8s-full \
--create-namespace \
--namespace=<agent-namespace> \
--set config.clouddriver.grpc=<endpoint> \
,kubeconfigs.<account-name>.file=<kubeconfig> \
,kubeconfigs.<account-name>.secret=<secret>
```

Command options:

--create-namespace: (Optional) Creates the namespace if not present. See the Helm install docs.
--namespace=<agent-namespace>: (Required) The namespace where you install the Armory Scale Agent, which is also the deployment target for your app.

Confirm success

Create a pipeline with a Deploy manifest stage. You should see your target cluster available in the Accounts list. Deploy a static manifest.

Set proxy settings

The env parameters are optional and only need to be used if Armory CD is behind an HTTP(S) proxy. If you need to set more than one of the env parameters, you must increment the index value for the parameters. For example: env[0].name="HTTP_PROXY, env[1].name="HTTPS_PROXY", and env[2].name="NO_PROXY".

1
2
3
4
5
6


helm install armory-agent armory-charts/agent-k8s-full \
--create-namespace \
--namespace=<agent-namespace> \
--set env[0].name=”HTTP_PROXY”,env[0].value="<hostname>:<port>" \
,env[1].name=”HTTPS_PROXY”,env[1].value="<hostname>:<port>" \
,env[2].name=”NO_PROXY”,env[2].value="localhost,127.0.0.1,*.spinnaker"

Alternatively, you can create a values.yaml file to include the parameters:

env:
 - name: HTTP_PROXY
 value: <hostname>:<port>
 - name: HTTPS_PROXY
 value: <hostname>:<port>
 - name: NO_PROXY
 value: localhost,127.0.0.1,*.spinnaker

With the file, you can avoid setting individual env parameters in the helm install command. Instead include the --values parameter as part of the Helm install command:

--values=<path>/values.yaml

Set a custom Agent image registry

If you need to download the Armory Scale Agent image from a different registry, you can specify that repository using the following settings:

--set image.repository=<repo-name>,image.imagePullPolicy=IfNotPresent, /
image.imagePullSecrets=<secret>

Alternatively, you can create a values.yaml file to include the settings:

image:
 repository: <repo-name>
 imagePullPolicy: IfNotPresent
 imagePullSecrets: <secret>

Include the --values parameter as part of the Helm install command:

--values=<path>/values.yaml

Custom configuration

If you need greater flexibility, you can override any supported configuration option, either by setting values using the command line or by setting values in an armory-agent.yml file.

Set config values using the command line

You can update configuration options via the command line by using --set config.<option>. For example, if you want to set logging.level to debug, use --set config.logging.level=debug to do that.

Set config in a file

You can also override default settings in your own armory-agent.yml file. For example, if you want to modify the default logging settings, create an armory-agent.yml file with the following content:

logging:
 file: "my-log"
 format: "json"
 level: "debug"

Note that you do not use “config” in the armory-agent file even though you do when setting config using the command line.

Then use the --set-file option in the Helm install command:

1
2
3
4


helm install armory-agent armory-charts/agent-k8s-full \
--create-namespace \
--namespace=<agent-namespace> \
--set-file agentyml=<path-to>/armory-agent.yml

You can pass in an armory-agent.yml file and also override values on the command line:

1
2
3
4
5


helm install armory-agent armory-charts/agent-k8s-full \
--create-namespace \
--namespace=<agent-namespace> \
--set-file agentyml=<path-to>/armory-agent.yml \
--set config.logging.level=debug

The difference between `values.yaml` and `armory-agent.yml`

armory-agent.yml: any supported configuration option listed in the Armory Scale Agent Options configuration option section.

values.yaml: environmental values such as proxy settings and image repository.

You can use both files. For example:

1
2
3
4
5


helm install armory-agent armory-charts/agent-k8s-full \
--create-namespace \
--namespace=<agent-namespace> \
--set-file agentyml=<path-to>/armory-agent.yml \
--values=<path-to>/values.yaml

Examples

Agent mode

Armory Cloud, custom config

This example installs the Armory Scale Agent service into the “dev” namespace with a connection to Armory Cloud services and the following custom configuration:

debug logging level
Increase the Armory Scale Agent request retry attempts to 5
Increase the time (in milliseconds) to wait between retry attempts to 5000
Enables Prometheus.

helm install armory-agent armory-charts/agent-k8s-full \
--create-namespace \
--namespace=dev \
--set hub.auth.armory.clientId=clientID123,hub.auth.armory.secret=s3cret \
,config.logging.level=debug,config.kubernetes.retries.maxRetries=5 \
,config.kubernetes.retries.backOffMs=5000,config.prometheus.enabled=true

The same custom configuration in an armory-agent.yml file:

logging:
 level: "debug"
kubernetes:
 retries:
 maxRetries: 5
 backOffMs: 5000
prometheus:
 enabled: true

Install the Armory Scale Agent with configuration in a file:

helm install armory-agent armory-charts/agent-k8s-full \
--create-namespace \
--namespace=dev \
--set hub.auth.armory.clientId=clientID123,hub.auth.armory.secret=s3cret
--set-file agentyml=/Users/armory/armory-agent.yml

Local gPRC, private image registry, proxy

This example installs the Armory Scale Agent service into the “dev” namespace with a local gPRC endpoint (no Armory Cloud services connection), pulls the image from a private registry, and configures proxy settings.

helm install armory-agent armory-charts/agent-k8s-full \
--create-namespace \
--namespace=dev \
--set config.clouddriver.grpc=spin-clouddriver-grpc:9091 \
,image.repository=private-reg/agent-k8s \
,image.imagePullPolicy=IfNotPresent \
,image.imagePullSecrets=regcred \
,env[0].name=”HTTP_PROXY”,env[0].value="corp.proxy.com:8080" \
,env[1].name=”HTTPS_PROXY”,env[1].value="corp.proxy.com:443" \
,env[2].name=”NO_PROXY”,env[2].value="localhost,127.0.0.1,*.spinnaker"

The same custom configuration in a values.yaml file:

image:
 repository: private-reg/agent-k8s
 imagePullPolicy: IfNotPresent
 imagePullSecrets: regcred

env:
 - name: HTTP_PROXY
 value: corp.proxy.com:8080
 - name: HTTPS_PROXY
 value: corp.proxy.com:443
 - name: NO_PROXY
 value: localhost,127.0.0.1,*.spinnaker

Install the Armory Scale Agent with configuration in a file:

helm install armory-agent armory-charts/agent-k8s-full \
--create-namespace \
--namespace=dev \
--values=/Users/armory/values.yaml
--set config.clouddriver.grpc=spin-clouddriver-grpc:9091

Agent and environment config in files

This example installs the Armory Scale Agent service into the “dev” namespace with a connection to Armory Cloud services and the following custom Agent configuration:

debug logging level
Increase the Armory Scale Agent request retry attempts to 5
Increase the time (in milliseconds) to wait between retry attempts to 5000
Enables Prometheus.

Agent configuration in an armory-agent.yml file:

logging:
 level: "debug"
kubernetes:
 retries:
 maxRetries: 5
 backOffMs: 5000
prometheus:
 enabled: true

Additionally, a values.yaml file contains custom repository and proxy settings:

image:
 repository: private-reg/agent-k8s
 imagePullPolicy: IfNotPresent
 imagePullSecrets: regcred

env:
 - name: HTTP_PROXY
 value: corp.proxy.com:8080
 - name: HTTPS_PROXY
 value: corp.proxy.com:443
 - name: NO_PROXY
 value: localhost,127.0.0.1,*.spinnaker

Install command:

helm install armory-agent armory-charts/agent-k8s-full \
--create-namespace \
--namespace=dev \
--set hub.auth.armory.clientId=clientID123,hub.auth.armory.secret=s3cret
--set-file agentyml=/Users/armory/armory-agent.yml
--vaues=/Users/amory/values.yaml

Infrastructure mode

Armory Cloud, custom config

This example installs the Armory Scale Agent service into the “dev” namespace with a connection to Armory Cloud services and the following custom configuration:

debug logging level
Increase the Armory Scale Agent request retry attempts to 5
Increase the time (in milliseconds) to wait between retry attempts to 5000
Enables Prometheus.

Create the namespace:

kubectl create namespace dev

Create the secret:

kubectl create secret generic kubeconfig --from-file=/User/armory/.kube/config -n dev

Install the Armory Scale Agent:

helm install armory-agent armory-charts/agent-k8s-full \
--namespace=dev \
--set hub.auth.armory.clientId=clientID123,hub.auth.armory.secret=s3cret \
,kubeconfigs.account1.file=config \
,kubeconfigs.account1.secret=s3cr3t \
,config.logging.level=debug,config.kubernetes.retries.maxRetries=5 \
,config.kubernetes.retries.backOffMs=5000,config.prometheus.enabled=true

The same custom configuration in an armory-agent.yml file:

logging:
 level: "debug"
kubernetes:
 retries:
 maxRetries: 5
 backOffMs: 5000
prometheus:
 enabled: true

Install the Armory Scale Agent with configuration in a file:

helm install armory-agent armory-charts/agent-k8s-full \
--namespace=dev \
--set hub.auth.armory.clientId=clientID123,hub.auth.armory.secret=s3cret \
,kubeconfigs.account1.file=config \
,kubeconfigs.account1.secret=s3cr3t \
--set-file agentyml=/Users/armory/armory-agent.yml

Local gPRC, private image registry, proxy

Create the namespace:

kubectl create namespace dev

Create the secret:

kubectl create secret generic kubeconfig --from-file=/User/armory/.kube/config -n dev

Install the Armory Scale Agent:

helm install armory-agent armory-charts/agent-k8s-full \
--namespace=dev \
--set config.clouddriver.grpc=spin-clouddriver-grpc:9091 \
,kubeconfigs.account1.file=config \
,kubeconfigs.account1.secret=s3cr3t \
,image.repository=private-reg/agent-k8s \
,image.imagePullPolicy=IfNotPresent \
,image.imagePullSecrets=regcred \
,env[0].name=”HTTP_PROXY”,env[0].value="corp.proxy.com:8080" \
,env[1].name=”HTTPS_PROXY”,env[1].value="corp.proxy.com:443" \
,env[2].name=”NO_PROXY”,env[2].value="localhost,127.0.0.1,*.spinnaker"

The same custom configuration in a values.yaml file:

image:
 repository: private-reg/agent-k8s
 imagePullPolicy: IfNotPresent
 imagePullSecrets: regcred

env:
 - name: HTTP_PROXY
 value: corp.proxy.com:8080
 - name: HTTPS_PROXY
 value: corp.proxy.com:443
 - name: NO_PROXY
 value: localhost,127.0.0.1,*.spinnaker

Install the Armory Scale Agent with configuration in a file:

helm install armory-agent armory-charts/agent-k8s-full \
--namespace=dev \
--values=/Users/armory/values.yaml
--set config.clouddriver.grpc=spin-clouddriver-grpc:9091 \
,kubeconfigs.account1.file=config \
,kubeconfigs.account1.secret=s3cr3t

Uninstall

helm uninstall <release-name> --namespace=<agent-namespace>

<release-name>: (Reqired) the Armory Scale Agent service release, such as 1.0.84.
<agent-namespace>: (Required) The namespace where you installed the Armory Scale Agent.

What’s next

Troubleshoot the Armory Scale Agent Service and Plugin page if you run into issues.
Learn how to Integrate Prometheus. Agent CPU usage is low, but the amount of memory depends on the size of the cluster the Armory Scale Agent is monitoring. The gRPC buffer consumes about 4MB of memory.
Configure Mutual TLS Authentication
Read about Kubernetes Permissions for the Armory Scale Agent

Armory Docs – Armory Scale Agent Service Deployment Methods

Plugins: Deploy the Armory Scale Agent Service Using Kubernetes Manifests

Before you begin

Create a namespace

Configure permissions

Configure the service

Deploy the Armory Scale Agent service

Confirm success

What’s next

Plugins: Deploy the Armory Scale Agent Service Using a Helm Chart

Chart overview

Before you begin

Quickstart

Confirm success

Set proxy settings

Set a custom Agent image registry

Custom configuration

Set config values using the command line

Set config in a file

The difference between values.yaml and armory-agent.yml

Examples

Agent mode

Infrastructure mode

Uninstall

What’s next

The difference between `values.yaml` and `armory-agent.yml`