Armory Docs – Dynamic Accounts Tasks

Plugins: Enable and Configure Dynamic Accounts in the Armory Scale Agent

Mon, 01 Jan 0001 00:00:00 +0000

Before you begin

You are familiar with Dynamic Accounts Architecture and Features.
The following Dynamic Accounts features use Clouddriver Account Management:
- Automatic account migration
- Clouddriver Account Management API request interception
Clouddriver Account Management is not enabled by default in Spinnaker or Armory Continuous Deployment. See Spinnaker’s Clouddriver Account Management page for how to enable the feature.

Scale Agent plugin

Dynamic Accounts is enabled by default starting with plugin versions v0.11.21/0.10.69/0.9.85.

If you are using a prior version of the plugin, you should enable Dynamic Accounts by setting kubesvc.dynamicAccounts.enabled: true in your plugin configuration. For example:

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35


spec:
 spinnakerConfig:
 profiles:
 clouddriver:
 spinnaker:
 extensibility:
 repositories:
 armory-agent-k8s-spinplug-releases:
 enabled: true
 url: https://raw.githubusercontent.com/armory-io/agent-k8s-spinplug-releases/master/repositories.json
 plugins:
 Armory.Kubesvc:
 enabled: true
 version: 0.11.26 # Replace with a version compatible with your Armory CD version
 extensions:
 armory.kubesvc:
 enabled: true
 # Plugin config
 kubesvc:
 cluster: kubernetes
 cluster-kubernetes:
 kubeconfigFile: <path-to-file> # (Optional; default: null)
 verifySsl: <true|false> # Optional; default: true)
 namespace: <string> # (Optional; default: null)
 httpPortName: <string> # (Optional; default: http)
 clouddriverServiceNamePrefix: <string> # (Optional; default: spin-clouddriver)
 dynamicAccounts:
 enabled: <true|false>
 maxRetries: <int>
 retryFrequencySeconds: <int>
 interceptor: # requires Clouddriver Account Management be enabled in Spinnaker/Armory Continuous Deployment
 enabled: <true|false>
 scanBatchSize: <int> # (Optional) # requires Clouddriver Account Management be enabled in Spinnaker/Armory Continuous Deployment
 scanFrequencySeconds: <int> # (Optional) # requires Clouddriver Account Management be enabled in Spinnaker/Armory Continuous Deployment
 namePatterns: ['^account1.*','^.*account2.*'] # (Optional) # requires Clouddriver Account Management be enabled in Spinnaker/Armory Continuous Deployment

dynamicAccounts:

enabled: (Optional) default: false; set to true to enable the Dynamic Accounts feature
maxRetries: (Optional) default: 3; the number of times to retry adding an account that fails the first time
retryFrequencySeconds: (Optional) default: 5; the number of seconds to wait between trying to add a FAILED account

The remaining optional attributes in the dynamicAccounts section are for configuring automatic migration of Clouddriver accounts to the Scale Agent. These options are discussed in detail in Migrate Clouddriver Kubernetes Accounts to the Armory Scale Agent.

If you want to use the interceptor feature to intercept requests sent to Clouddriver’s /credentials endpoint, add:

dynamicAccounts:
 enabled: true
 interceptor:
 enabled: true

Alternately, you can enable the autoscan for new Clouddriver accounts feature by configuring the following:

scanBatchSize:
scanFrequencySeconds:
namePatterns: [’^account1.*’,’^.account2.']

For example:

1
2
3
4
5


dynamicAccounts:
 enabled: true
 scanBatchSize: 15
 scanFrequencySeconds: 120
 namePatterns: ['^account1.*','^.*account2.*']

Access the API

The Dynamic Accounts REST API provides endpoints to create, delete, get, migrate, and update Kubernetes accounts. You can’t access these endpoints through Gate. You should have kubectl access to your Spinnaker cluster and port-forward to be able to call the API.

kubectl port-forward deployment/spin-clouddriver 7002:7002 -n spinnaker

You can then access endpoints via http://localhost:7002.

Scale Agent service

The Dynamic Accounts API is enabled by default in the Scale Agent Service:

 1
 2
 3
 4
 5
 6
 7
 8
 9
10


apiVersion: v1
kind: ConfigMap
metadata:
 name: armory-agent-config
 namespace: spin-agent
data:
 armory-agent.yml: |
 server:
 port: 8082
 dynamicAccountsEnabled: true # (Optional; default: true)

You can disable dynamic accounts features by setting dynamicAccountsEnabled to false.

What’s next

Plugins: Manage Kubernetes Accounts in the Armory Scale Agent

Mon, 01 Jan 0001 00:00:00 +0000

Manage accounts overview

kubectl port-forward deployment/spin-clouddriver 7002:7002 -n spinnaker

You can then access endpoints via http://localhost:7002.

See Migrate Clouddriver Kubernetes Accounts to the Armory Scale Agent for details on how to manually or automatically migrate accounts from Clouddriver to the Scale Agent using the Dynamic Accounts API.

Create accounts

Like migrating accounts, creating new accounts is a two-step process:

POST new account data; this adds the new accounts in an INACTIVE state
PATCH to change state to ACTIVE and begin using the account.

Provision accounts

Endpoint: POST<Account[]> /armory/accounts/dynamic

Request body:

{
"name": "<account-name>",
"zoneId": "<zone-id>",
"kubeconfigContents": "encryptedFile:k8s!n:kubeconfig-t!k:config!ns:spinnaker"
}

Required fields:

name: the account name

and one of the following:

kubeconfigContents: encrypted contents of the kubeconfig file
kubeconfigFile: Path to the kubeconfig file if not using serviceAccount.
serviceAccount: true or false; if true, use the current service account to call to the current API server. In this mode, you don’t need to provide a kubeconfig file.

Optional fields:

zoneId: (Optional) the zoneId for the targeted Agent service, which is by default deploymentName_namespace. This can optionally be supplied during the activation step.
You can include any kubernetes.accounts[] attribute from the Scale Agent service config options list.

Example:

 curl --request POST \
 --url http://clouddriver:7002/armory/accounts \
 --header 'Content-Type: application/json' \
 --data '[
 {
 "name": "account-01"
 },
 {
 "name": "account-02",
 "zoneId": "agent-1_namespace1",
 "kubeconfigFile": "encryptedFile:k8s!n:kubeconfig!k:config!ns:spinnaker"
 }
 ]'

Response:

202 Accepted: [] empty array
409 Conflict: [] array containing already migrated accounts (still processes valid ones)
400 Bad Request: in case the account array is empty
501 Not Implemented: if the Dynamic Accounts feature isn’t enabled

Activate accounts

Endpoint: PATCH<Account[]> /armory/accounts/dynamic

Request body:

[
{
 "name": "<account-name>",
 "state": "<INACTIVE | FAILED>",
 "zoneId": "<zone-id>",
 "kubeconfigFile": "<encrypted-kubeconfig>"
}
]

Required fields:

name: the account name
state: the account state; valid values are INACTIVE or FAILED.

and one of the following: kubeconfigContents, kubeconfigFile, or serviceAccount (whichever one you used in the POST request).

zoneId is optional if you included one in the provision step.

Example:

curl --request PATCH \
 --url http://localhost:7002/armory/accounts \
 --header 'Content-Type: application/json' \
 --data '[
 {
 "name": "account-01",
 "state": "ACTIVE"
 },
 {
 "name": "account-02",
 "state": "ACTIVE",
 "zoneId": "agent-1_namespace1",
 "kubeconfigFile": "encryptedFile:k8s!n:kubeconfig!k:config!ns:spinnaker"
 }
]'

Response:

202 Accepted
501 Not Implemented: if the Dynamic Accounts feature isn’t enabled

Deactivate accounts

This action changes the state to INACTIVE and instructs the Scale Agent service to stop watching the account(s).

Endpoint: PATCH <Account[]> /armory/accounts

Request body:

[
 {
 "name": "<account-name>",
 "state": "INACTIVE"
 },
 {
 "name": "<account-name>",
 "state": "INACTIVE"
 }
]

Example:

curl --request PATCH \
 --url http://localhost:7002/armory/accounts \
 --header 'Content-Type: application/json' \
 --data '[
 {
 "name": "account-01",
 "state": "INACTIVE"
 },
 {
 "name": "account-02",
 "state": "INACTIVE"
 }
]'

Response:

202 Accepted - no body.
501 Not Implemented: if the Dynamic Accounts feature isn’t enabled

Delete accounts

This action removes the account from the Scale Agent service that watches it. Then the plugin removes the account from the clouddriver.kubesvc_accounts table.

Account must be of type dynamic in clouddriver.kubesvc_accounts.

Endpoint: DELETE <string[]> /armory/accounts

Request body:

["account-01","account-02"]

Example:

curl --request DELETE \
 --url http://localhost:7002/armory/accounts \
 --header 'Content-Type: application/json' \
 --data '["account-01","account-02"]'

Response:

202 Accepted - no body.
501 Not Implemented: if the Dynamic Accounts feature isn’t enabled

Get an account

Use this to fetch the status and definition of an account.

Endpoint: GET /agents/kubernetes/accounts/{account-name}

Example:

curl --request GET \
 --url http://localhost:7002/agents/kubernetes/accounts/account-01

Response:

200 Accepted: {name:..., kubeconfigContents:..., ... } account object found or empty object if none.
501 Not Implemented: if the Dynamic Accounts feature isn’t enabled

Example response:

{
 "name":"my-account-1",
 "type":"kubernetes",
 "source":"clouddriver",
 "config":{

 },
 "zoneId":"agent-private-network-1",
 "agents":{
 {
 "agentId":"agent-private-network-1-54865d798c-cpqgm",
 "caching":true
 },
 {
 "agentId":"agent-private-network-1-54865d798c-tdfvw",
 "caching":false
 }
 },
 "status": "ACTIVE",
 "lastAssignmentMsg": "successfully assigned to Agent agent-private-network-1-54865d798c-tdfvw for executing operations"
}

Update a single account

Updating an account is similar to creating a new one. The API detects it by its name and performs the update. If the account is already ACTIVE, the plugin immediately propagates the changes to the corresponding Scale Agent services.

Endpoint: PUT /armory/accounts/dynamic

Request body:

{
"name": "<account-name>",
"type": "kubernetes",
"kubeconfigFile":"encryptedFile:k8s!n:kubeconfig-t!k:config!ns:spinnaker",
"kubeconfigAgent":"encryptedFile:k8s!n:kubeconfig-agent!k:config!ns:spinnaker"
}

Required fields:

name: the account name

Optional fields:

kubeconfigAgent: you only need to include this if the account is in an ACTIVE state and if the target Scale Agent service needs a different kubeconfig from the original one.
You can include any kubernetes.accounts[] attribute from the Scale Agent service config options list.

Example:

curl --request PUT \
 --url http://localhost:7002/armory/accounts/dynamic \
 --header 'Content-Type: application/json' \
 --data '{
"name": "demo-acc-02",
"type": "kubernetes",
"kubeconfigContents":"encryptedFile:k8s!n:kubeconfig-t!k:config!ns:spinnaker",
"metrics": false,
"kinds": [],
"omitKinds": [],
"onlyNamespacedResources": false,
"namespaces": [
 "dev",
 "spinnaker",
 "default"
]
}'

Response:

202 Accepted: [] empty array
400 Bad Request: in case the request is empty or body is an array.
501 Not Implemented: if the Dynamic Accounts feature isn’t enabled

What’s next

Migrate Clouddriver Kubernetes Accounts to the Armory Scale Agent

Plugins: Migrate Clouddriver Kubernetes Accounts to the Armory Scale Agent

Mon, 01 Jan 0001 00:00:00 +0000

Migration overview

kubectl port-forward deployment/spin-clouddriver 7002:7002 -n spinnaker

You can then access endpoints via http://localhost:7002.

Before you begin

Familiarize yourself with Dynamic Accounts Architecture and Features.
Enable the Dynamic Accounts feature in the Scale Agent plugin.
You know how to fetch account data from Clouddriver.
The accounts you want to migrate must exist in a Clouddriver credential definition source such as clouddriver-local.yaml or the clouddriver.accounts table.

Manual migration

Manually migrating Clouddriver accounts is a two-step process:

Migrate accounts using POST<Account[]> /armory/accounts

This fetches the specified accounts from a Clouddriver credential source and adds them to the Scale Agent (clouddriver.kubesvc_accounts) with an INACTIVE state.

Request data array format:
```
[
 {
 "name": "<account-name>",
 "zoneId": "<zone-id>",
 "kubeconfigFile": "<encrypted-kubeconfig>"
 }
]
```
- name: (Required) the account’s name
- zoneId: (Optional) the zoneId for the targeted Agent service, which is by default deploymentName_namespace. This can optionally be supplied during the activation step.
- kubeconfigFile: (Optional) the secret token for the kubeconfig path or file. This should be in [encrypted secret format](https://spinnaker.io/docs/reference/halyard/secrets/](https://spinnaker.io/docs/reference/halyard/secrets/); for example, encryptedFile:k8s!n:kubeconfig!k:config!ns:spinnaker. kubeconfigFile is optional only if the native account’s kubeconfig works for the targeted Agent service; otherwise you need to supply this parameter with a working value.
Example:
```
 curl --request POST \
 --url http://clouddriver:7002/armory/accounts \
 --header 'Content-Type: application/json' \
 --data '[
 {
 "name": "account-01"
 },
 {
 "name": "account-02",
 "zoneId": "agent-1_namespace1",
 "kubeconfigFile": "encryptedFile:k8s!n:kubeconfig!k:config!ns:spinnaker"
 }
 ]'
```
Responses:
- 202 Accepted: [] empty array
- 409 Conflict: [] array containing already migrated accounts (still processes valid ones)
- 400 Bad Request: the account array is empty
- 5501 Not Implemented: if the Dynamic Accounts feature isn’t enabled
Activate the migrated accounts using PATCH <Account[]> /armory/accounts

This activates the specified accounts in the Scale Agent (changed state to ACTIVE in clouddriver.kubesvc_accounts) and sends the account data to the associated Scale Agent service. Each account must meet the following criteria:
- Have a valid JSON object in the definition column of the clouddriver.kubesvc_accounts table
- Be in an INACTIVE or FAILED state
- Have an existing connection to a Scale Agent service running in a cluster
Request data array format:
```
[
 {
 "name": "<account-name>",
 "state": "<INACTIVE | FAILED>",
 "zoneId": "<zone-id>",
 "kubeconfigFile": "<encrypted-kubeconfig>"
 }
]
```
- name: (Required) the account’s name
- state: (Required) the account state; valid values are INACTIVE or FAILED.
- zoneId: (Optional) the zoneId for the targeted Agent service, which is by default deploymentName_namespace. This is not needed if you supplied this value in the previous step.
  
  If you do not include a zoneId, Clouddriver sends the request to every other Clouddriver instance that has a connected Scale Agent service. Each Clouddriver instance subsequently sends the request to all of its connected Agents in an attempt to find one that can process the request. This is resource intensive, so be sure to include a zoneId.
- kubeconfigFile: (Optional) the secret token for the kubeconfig path or file. This should be in [encrypted secret format](https://spinnaker.io/docs/reference/halyard/secrets/](https://spinnaker.io/docs/reference/halyard/secrets/); for example, encryptedFile:k8s!n:kubeconfig!k:config!ns:spinnaker.
  
  kubeconfigFile is optional only if you supplied this value in the previous step or the native account’s kubeconfig works for the targeted Agent service.
Example:
```
curl --request PATCH \
 --url http://localhost:7002/armory/accounts \
 --header 'Content-Type: application/json' \
 --data '[
 {
 "name": "account-01",
 "state": "ACTIVE"
 },
 {
 "name": "account-02",
 "state": "ACTIVE",
 "zoneId": "agent-1_namespace1",
 "kubeconfigFile": "encryptedFile:k8s!n:kubeconfig!k:config!ns:spinnaker"
 }
]'
```
Response:
- 202 Accepted
- 501 Not Implemented: if the Dynamic Accounts feature isn’t enabled
The account state changes to FAILED if the Scale Agent plugin is not able to connect to the target Scale Agent service. The plugin does not inform you of the operation results. Check for an ACTIVE account state in the clouddriver.kubesvc_accounts table by querying the database directly or by calling /agents/kubernetes/accounts/{accountName}.

Automatic migration

This feature requires you to enable the Clouddriver Account Management feature in Spinnaker.

Scan for new accounts

The Scale Agent can automatically migrate accounts and set them to ACTIVE when you enable the automatic scanning mechanism in the plugin configuration.

Add the following to your plugin configuration:

kubesvc:
 dynamicAccounts:
 enabled: true
 scanBatchSize: <int>
 scanFrequencySeconds: <int>
 namePatterns: ['^account1.*','^.*account2.*']

This feature is enabled when namePatterns has at least one value. The Scale Agent uses the account name pattern to identify accounts for migration. Autoscanning minimizes the manual effort and eliminates the add and migrate steps when the namePatterns flag is set to match a specified account naming pattern.

Intercept Clouddriver account creation request

When you enable this option, the Scale Agent plugin intercepts any new account creation request that is sent to Clouddriver’s credentials endpoint (POST <GATE_URL>/credentials). The Scale Agent plugin automatically migrates the new account and sets the account state to ACTIVE.

Add the following to your plugin configuration:

kubesvc:
 dynamicAccounts:
 interceptor:
 enabled: true

What’s next

Manage Kubernetes Accounts in the Armory Scale Agent}