Amazon EKS

Data Collection Setup

Metrics are collected via the Amazon EKS API endpoint and Kubernetes cluster API. See the Network Requirements for more details.

Network Requirements

The BindPlane Collector MUST have access to the following:

• The EKS API Server: Port: 443 (TCP) HTTPS to the Amazon Cloudwatch API
• Kubelet Port: 10250 (TCP)

🚧

For users intending to deploy a BindPlane Collector that is not within the same VPC that the EKS Cluster exists in, please be aware of the following

The security group used to control access to the individual networks will need to open up port 10250 to the collector. This change will usually be performed in the Cloudformation template used to build out the worker nodes, or any other systems being used to manage the EKS worker nodes.

In the Kubernetes Source configuration, the External IPs selection may need to be made if the collector resides on a network segment that does not have access to the private worker node IPs.

Least Privileged User

Amazon User

Navigate to the AWS console and create an IAM user with programmatic access. The user will need the following permissions. You can create a policy specifically for these permissions and apply the permissions to the user.

{
	"Version": "2012-10-17",
	"Statement": [
    	{
        	"Sid": "VisualEditor0",
        	"Effect": "Allow",
        	"Action": [
            	"ec2:Describe*",
            	"ec2:Get*",
            	"ec2:Search*",
            	"eks:Get*",
            	"eks:Describe*"
        	],
        	"Resource": "*"
    	}
	]
}

EKS Cluster: Setting Up A Monitoring User

To setup a monitoring user on the EKS cluster

1. Ensure that you have the aws-iam-authenticator installed. Click here for more details

📘

Where do I install the aws-iam-authenticator?

The installation of the aws-iam-authenticator must be done on your main management workstation.

2. Install the bindplane-monitoring role. To do this, run the following commands against your Kubernetes Cluster:

kubectl apply -f https://raw.githubusercontent.com/BlueMedoraPublic/bm-kube-lpu/master/bluemedora-lpu/bm-clusterrole.yaml

kubectl apply -f https://raw.githubusercontent.com/BlueMedoraPublic/bm-kube-lpu/master/bluemedora-lpu/bm-clusterrolebinding.yaml

kubectl apply -f https://raw.githubusercontent.com/BlueMedoraPublic/bm-kube-lpu/master/bluemedora-lpu/bm-role.yaml

kubectl apply -f https://raw.githubusercontent.com/BlueMedoraPublic/bm-kube-lpu/master/bluemedora-lpu/bm-rolebinding.yaml

kubectl apply -f https://raw.githubusercontent.com/BlueMedoraPublic/bm-kube-lpu/master/bluemedora-lpu/bm-serviceaccount.yaml

3. Obtain the token to use with the monitoring user. (The example below is for a Linux system)

kubectl -n kube-system describe secret $(kubectl -n kube-system get secret | grep bluemedora | awk '{print $1}')

BindPlane Collector & Kubernetes Source Setup

Gather information from your EKS cluster

From the main EKS configuration page, the following information will be needed:

• The API Server endpoint
• VPC
• Subnet(s)
• Security Group

Deploy a collector

Select the AWS Cloudformation platform when deploying a collector in BindPlane:

• Use the same VPC, Subnet, and Security Group collected in the previous step
• "Assign a public IP" can be left off unless you need it for administrative purposes
• Select a Key Pair to allow for the management of the system
• Click Deploy

Configure the Kubernetes Source

• Host: This is the API Server endpoint previously collected, but without the https:// included
• Port: 443
• Kubelet Port: 10250
• Credentials: Use the monitoring token from above
• Use External or Internal IPs: Use Internal IPs
• SSL Configuration: No Verify

Connection Parameters

Metrics

Cluster

Container

Deployment

Job

Namespace

Node

Pod

Volume