Installing and Configuring cloudeye-exporter in OIDC Mode

Constraints

• When cloudeye-exporter exports metrics, it needs to call cloud service APIs to query resources. Some cloud services do not support OIDC authentication. These cloud services can use AK/SK authentication. Table 1 lists the cloud services that do not support OIDC authentication and related dimensions.
  

  Cloud Eye can monitor dimensions nested to up to four levels (levels 0 to 3). Level 3 is the deepest level. For example, if the monitored dimension of a metric is gaussdb_mysql_instance_id,gaussdb_mysql_node_id, gaussdb_mysql_instance_id indicates level 0 and gaussdb_mysql_node_id indicates level 1.

  Table 1 Cloud services that do not support OIDC authentication

  Cloud Service	Namespace	Dimension	Description
  GeminiDB (DynamoDB-Compatible API)	SYS.NoSQL	ddb_table_id	GeminiDB Serverless table ID
  DataArts Lake Formation	SYS.LakeFormation	instance_id	LakeFormation instance ID
  Cloud Connect	SYS.CC	cloud_connect_id,bwp_id,region_bandwidth_id	Cloud Connect ID, bandwidth package ID, and inter-region bandwidth ID
  Scalable File Service	SYS.SFS	share_id	Capacity-oriented file system ID
  		bucket_name	General-purpose file system ID
  TaurusDB	SYS.GAUSSDB	gaussdb_mysql_instance_id,gaussdb_mysql_node_id	TaurusDB instance ID and node ID
  		gaussdb_mysql_ha_id,gaussdb_mysql_ha_node_id	TaurusDB Classic Architecture instance ID and node ID

• Currently, cloudeye-exporter can be installed only on Linux x86 OSs. The host specifications must be 4 vCPUs | 8 GiB or higher.
• OIDC authentication applies only to the scenario where cloudeye-exporter is deployed in a CCE cluster.
• If cloudeye-exporter is deployed on an ECS and the ECS and the service providing the metric data are deployed in different regions, you must bind an EIP to the ECS for data access. For details about how to bind an EIP, see Binding an EIP to an Instance.
• For details about the extended labels supported by cloudeye-exporter, see Extended Labels Supported.

Prerequisites

• Ensure that your OS supports Docker for building the cloudeye-exporter image.
• Ensure that your Huawei Cloud account has the required permissions for exporting monitoring data. For details, see APIs and Actions Required for cloudeye-exporter to Export Monitoring Data.

Procedure

Obtaining the Signature Key of a CCE Cluster and Creating a Service Account.

1. Log in to the CCE node. For details, see Logging In to a Node.
2. Use kubectl to connect to the cluster. For details, see Accessing a Cluster Using kubectl.
3. Obtain the public key.

   kubectl get --raw /openid/v1/jwks

   The returned result is the public key of the cluster. The following is an example command output, where the sensitive information is hidden by asterisks (*):

   # kubectl get --raw /openid/v1/jwks
   {"keys":[{"use":"sig","kty":"RSA","kid":"*****","alg":"RS256","n":"*****","e":"AQAB"}]}

4. Create a service account.

   kubectl  create sa oidc-token

   

   oidc-token is the name of the service account, which is used in Configuring an Identity Provider on IAM and Creating and Running a cloudeye-exporter Workload with the OIDC Capability.

Configuring an Identity Provider on IAM

1. Log in to the IAM console.
2. In the navigation pane, choose Identity Providers.
3. Click Create Identity Provider in the upper right corner.
4. On the displayed page, enter the name and set other parameters as prompted.
   Figure 1 Creating an identity provider
   
   • Protocol: OpenID Connect
   • SSO Type: Virtual user
   • Status: Enabled
5. Click OK to create the identity provider.
6. On the Identity Providers page, click Modify in the Operation column of the created identity provider.
7. On the displayed page, change the value of Access Type to Programmatic access.
8. Configure Configuration Information.
   • Identity Provider URL:
     1. Log in to the CCE console.
     2. Click the name of a cluster to view its details.
     3. In the Connection Information area on the overview page, check whether OIDC Provider is enabled.
        • If yes, perform 8.d.
        • If no, use the default identity provider of the cluster, that is, https://kubernetes.default.svc.cluster.local.
     4. View the URL of the identity provider.
        1. Click Settings on the left of the cluster details page.
        2. Click the Kubernetes tab.
        3. On the displayed page, the value of Service Account Issuer (service-account-issuer) is the URL of the identity provider.
   • Client ID: corresponds to audience in the exporter-deploy.yaml configuration file in Creating and Running a cloudeye-exporter Workload with the OIDC Capability. Enter an ID, for example, ces-test.
   • Signing Key: Enter the signature public key of the CCE cluster. For details, see the return result in 3.
9. In the Identity Conversion Rules area, click Create Rule to create an identity conversion rule.
10. In the Create Rule dialog box, enter the username and set rule parameters. For details, see Configuring Identity Conversion Rules.
    An identity mapping rule maps the service account of a workload to an IAM user. To ensure that you have the permissions of the admin user group when using your identity provider ID to access cloud services, map the service account named oidc-token created in the default namespace of the cluster in step 4 to the admin user group. Configure the conditions for the identity conversion rule to take effect based on the template shown in Figure 2.

    Figure 2 Creating a rule
    

    • User Groups: admin
    • Attribute: sub
    • Condition: any_one_of
    • Value: system:serviceaccount:default:oidc-token
      The value rules are as follows. Namespace indicates the namespace of the cluster where the created service account is located, and ServiceAccountName indicates the service account name.

      system:serviceaccount:{Namespace}:{ServiceAccountName}

11. In the Create Rule dialog box, click OK.
12. On the Modify Identity Provider page, click OK.

    Click View in the Operation column of the identity provider. The identity provider details are updated.

Building a cloudeye-exporter Image

1. Log in to the OS where Docker is installed, access the cloudeye-exporter open-source project, and download the latest software package.
2. Decompress the installation package to the image build path.
   Example commands:

   mkdir cloudeye-exporter
   cd cloudeye-exporter
   wget https://github.com/huaweicloud/cloudeye-exporter/releases/download/${version}/cloudeye-exporter-${version}.tar.gz
   tar -xzvf cloudeye-exporter-${version}.tar.gz

3. Create a Dockerfile.

   vi Dockerfile

   The following is an example of the Dockerfile build content:

   FROM alpine:latest
   RUN mkdir -p /exporter
   COPY cloudeye-exporter /exporter/
   COPY endpoints.yml /exporter/
   COPY clouds.yml /exporter/
   COPY i18n.json /exporter/
   COPY metric.yml /exporter/
   COPY unit_standard_transform.json /exporter/
   COPY logs.yml /exporter/
   WORKDIR /exporter
   RUN chmod +x ./cloudeye-exporter
   CMD ["/exporter/cloudeye-exporter"]

4. Wait until the file is created. The directory structure is as follows:

   .
   |-- Dockerfile
   |-- cloudeye-exporter
   |-- clouds.yml
   |-- endpoints.yml
   |-- i18n.json
   |-- logs.yml
   |-- metric.yml
   |-- unit_standard_transform.json

5. Run the build command to generate an image.

   docker build -t cloudeye-exporter:v1.0 .

Pushing a cloudeye-exporter Image to SWR

Before starting cloudeye-exporter, push its image to Huawei Cloud SWR.

If your CCE node supports Docker, directly build a local image on the node. No offline package is required. Otherwise, create an offline image package and push it to SWR.

docker version

Creating and Running a cloudeye-exporter Workload with the OIDC Capability

1. Log in to the CCE node and run the following command to create a main configuration file clouds.yml:

   cd /exporter
   vi clouds.yml

   The following table lists the clouds.yml parameters to be modified.

   Table 2 global parameters

   Parameter	Description	Example Value
   port	Listening port. The default port is 8087.	8087
   prefix	The cloudeye-exporter tool automatically combines the queried metric data with this prefix. The default prefix is huaweicloud. Retain the default value.	huaweicloud
   scrape_batch_size	Number of records per page for querying Cloud Eye metric data. For example, 300 indicates that each page contains 300 metric data records. Retain the default value.	300
   resource_sync_interval_minutes	Interval at which resource information is updated, in minutes. The default value is 180. If the value is less than 10 minutes, the resource information will be updated every 10 minutes.	180
   ignore_ssl_verify	Whether to verify the SSL certificate when the exporter queries resources or metrics. This parameter is optional. If functions are abnormal due to SSL certificate verification, you can set this parameter to true to skip verification. true: skips SSL certificate verification during resource or metric data query. Use this value if functions are abnormal due to SSL certificate verification, for example, monitoring data query fails. false: verifies the SSL certificate during resource or metric data query.	false

   Table 3 auth parameters

   Parameter	Description	Example Value
   auth_url	IAM user authentication address. The format is https://iam.{region_id}.myhuaweicloud.com/v3. For details about region_id, see the Region column on the Regions and Endpoints page.	https://iam.cn-north-4.myhuaweicloud.com/v3
   project_name	Huawei Cloud project name. You can log in to the IAM console to view all projects of your account.	cn-north-4
   region	ID of the region where the metric data belongs. For details about the region ID, see Regions and Endpoints.	cn-north-4
   oidc	OIDC authentication parameter. id_token_file_path: path for storing the ID token. The value is /var/run/secrets/tokens/oidc-token. idp_id: ID of the identity provider. The value is the identity provider name in Configuring an Identity Provider on IAM. domain_id: Huawei Cloud user ID. Log in to the IAM console, click the username, and view the user ID in the user details.	-

   An example is provided as follows:

   global:
     port: ":8087"
     prefix: "huaweicloud"
     scrape_batch_size: 300
     resource_sync_interval_minutes: 180
     ignore_ssl_verify: false
   auth:
     auth_url: "https://iam.cn-north-4.myhuaweicloud.com/v3"
     project_name: "cn-north-4"
     region: "cn-north-4"
     oidc:
       id_token_file_path: "/var/run/secrets/tokens/oidc-token"
       idp_id: "CES-Exporter"
       domain_id: "a3e3e8729602496d839bdbdcc5defxxx"

2. Import the main configuration file clouds.yml as ConfigMap.

   kubectl create configmap exporter-config --from-file=/exporter/clouds.yml

   After the import is complete, you can view ConfigMap data in the cluster.

   Figure 7 Viewing ConfigMap data
   
3. Create a cloudeye-exporter workload.

   vi exporter-deploy.yaml

   The configuration content of the workload exporter-deploy.yaml to be mounted is as follows:

   apiVersion: apps/v1
   kind: Deployment
   metadata:
     name: cloudeye-exporter
   spec:
     replicas: 1
     selector:
       matchLabels:
         app: cloudeye-exporter
         version: v1.0
     template:
       metadata:
         labels:
           app: cloudeye-exporter
           version: v1.0
       spec:
         containers:
         - name: container-1
           image: swr.cn-north-4.myhuaweicloud.com/cloud.test/cloudeye-exporter:v1.0  # Tag used for pushing the image to SWR
           command:
             - /exporter/cloudeye-exporter # Startup command
           args:
             - '-auth_mode' # Startup parameter
             - oidc # Start the exporter using the OIDC authentication mode.
           volumeMounts:
           - mountPath: "/var/run/secrets/tokens"  # Mount the Kubernetes-generated service account token to /var/run/secrets/tokens/oidc-token.
             name: oidc-token
           - mountPath: /exporter/clouds.yml # Define the mount path of clouds.yml.
             name: exporter-config-volume # Reference the mounted volume.
             subPath: clouds.yml # Declare subPath to prevent other files from being overwritten and inaccessible.
         imagePullSecrets:
         - name: default-secret
         serviceAccountName: oidc-token # Name of the created service account in section "Creating a Service Account."
         volumes:
         - name: oidc-token
           projected:
             defaultMode: 420
             sources:
             - serviceAccountToken:
                 audience: ces-test # The value is the client ID in section "Creating an Identity Provider on IAM."
                 expirationSeconds: 7200       # Expiration time of the OIDC token, in seconds.
                 path: oidc-token              # Path name. You can change it as needed.
         - name: exporter-config-volume # Obtain the main configuration of clouds.yml.
           configMap:
             name: exporter-config

4. Instantiate the preceding configuration as a workload container.

   kubectl  apply -f exporter-deploy.yaml

5. View the instantiation result.
   1. Log in to the CCE console.
   2. Click the instance name to go to its details page.
   3. In the navigation pane, choose Workloads.
   4. In the workload list, click the name of the target workload.
   5. Check that the container instance is in the Running state and obtain the instance IP address. The instance IP address is used to query monitoring data in 6.
      Figure 8 Checking the instance status
      
      

      If the instance status is abnormal, submit a service ticket to customer service to identify the cause.

6. Check whether the monitoring data can be queried.
   1. Log in to the CCE node.
   2. Query the monitoring data. If the monitoring data can be queried, the exporter is successfully configured.

      curl http://{Container IP address}:8087/metrics?services=SYS.ECS

      Figure 9 Querying monitoring data