Skip to main content
Traceable Documentation

Installing the Platform Agent on k8s | On-Prem

Saad Farooq
  • Updated

Overview

The purpose of the document is to list the steps required to install a Traceable Platform Agent in a K8S environment and configure it to report into a Traceable Platform installed on-premise.

Prerequisites

  1. Successfully installed and running Traceable Platform
  2. Public Certificate of the Root Certificate Authority to be trusted by the TPA installation
  3. Access/Refresh Token from the Traceable Platform:token.png

Network Connection Requirements

Inbound port requirements

The typical listening port signature of the TPA will look like:

% kubectl get services -n traceableai
NAME    TYPE        CLUSTER-IP       EXTERNAL-IP   PORT(S)                                                                                                 AGE
agent   ClusterIP   172.20.199.217   <none>        5443/TCP,5441/TCP,5442/TCP,8181/TCP,4317/TCP,4318/TCP,55678/TCP,9411/TCP,14250/TCP,14268/TCP,8889/TCP   20h

The TPA will listen on the following ports and the service agent will expose the following ports on the Cluster IP Address:

  • 5443/TCP
  • 5441/TCP
  • 5442/TCP
  • 8181/TCP
  • 4317/TCP
  • 4318/TCP
  • 55678/TCP
  • 9411/TCP
  • 14250/TCP
  • 14268/TCP
  • 8889/TCP

Outbound Connection Requirement

The TPA will make an outbound connection to the Traceable Platform to report the collected information on the api end-point. By default the TPA tries to reach the api endpoint on the Secure TLS Connection on the TCP port  (defaults to 443). As mentioned in the document ahead, this end-point is specified in the values.yaml file as:

endpoint: api.yourdomain.com

 

The exact API end-point of the platform can be looked up in the Platform Installation tool:

endpoint.png

 

Steps to Install TPA on K8S

Customize values.yaml file

To customize installation parameters, it is recommended to use the helm installation mechanism where we can use a values.yaml file to provide customized parameters for the installation.

 

In this case we would need the following parameters set in the values.yaml file:

  1. token:

Provide the Traceable Platform Access Token in this parameter (3rd steps from the Prerequisite section).

     2. environment:

Provide the name of the environment that will be reported into the Traceable Platform

     3. endpoint:

Provide the DNS end-point name of the Traceable Platform Service (eg. api.traceable.mycompany.com). Make sure it’s the host name or one of the alternate names in your certificate.

     4. remoteCaBundle:

The base64 encoded CA Certificate(s) to be trusted by the Traceable Platform Agent.

 

If you have the Root CA certificate pem/crt file containing the Public Certificate of the Certificate Authority, you can convert it using the steps below:

% cat rootCA.crt                        
-----BEGIN CERTIFICATE-----
MIIFFDCCAvwCCQDZwOug6bnDnTANBgkqhkiG9w0BAQsFADBMMQswCQYDVQQGEwJV
UzELMAkGA1UECAwCQ0ExEjAQBgNVBAoMCVRyYWNlYWJsZTEcMBoGA1UEAwwTbXZr
NC55b3VyZG9tYWluLmNvbTAeFw0yMjA0MTMwMjExNDFaFw0yNTAxMzEwMjExNDFa
……
5WGuIvBThdeHPc9QwUQiE0quXL88SfxpOa526K/zIHXqjytdzRN4AuiKew2g0zuj
dawf9NQZPA467dY4FzHkkhUrVc2yqI0h6Bym5zbr8v/MxB2i/c21Mu6eBj3tl8PQ
2dQ4r4SlVdDK7yWhpygCvRVM7jwR9xjpc/HY0rzewGM7hLhAUbe/kZwvAuiTxml2
yyRWayTNcnM=
-----END CERTIFICATE-----

% cat rootCA.crt | base64
LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUZGRENDQXZ3Q0NRRFp3T3VnNmJuRG5UQU5CZ2txaGtpRzl3MEJBUXNGQURCTU1Rc3dDUVlEVlFRR0V3SlYKVXpFTE1Ba0dBMVVFQ0F3Q1EwRXhFakFRQmdOVkJBb01DVlJ5WVdObFlXSnNaVEVjTUJvR0ExVUVBd3dUYlhacgpOQzU1YjNWeVpHpltNXpicjh2L014QjJpL2MyMU11NmVCajN0bDhQUQoyZFE0cjRTbFZkREs3eVdocHlnQ3ZSVk03andSOXhqcGMvSFkwcnpld0dNN2hMaEFVYmUva1p3dkF1aVR4bWwyCnl5UldheVROY25NPQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg==

 

The resulting base64 value can be used as the value to the remoteCaBundle parameter.

     5. injector.propagationFormats:

Use this specific value if planning to instrumenting an istio service mesh or if integrating with an existing Tracing Soution, in which case set this value to {B3}.

Eg: 

injector:
  propagationFormats:
    - B3

If not instrumenting Istio, or not integrating with an existing tracing solution, do not include this property in the yaml file For more information about the B3 Propagation headers please refer to this.

Sample values.yaml file

A sample values.yaml file pointing to the on-premise Traceable Platform will look something like this:

 

% cat values.yaml
token: eyJhbGciOiJIUzI1NiIsInR5cCIgOiAiSldUIiwia2lkIiA6ICJlYjExZjhjNy01MjIwLTRiZDktYTc5ZC05MDZmZDFjNWY5NzYifQ.eyJpYXQiOjE2NDk5MDA3ODEsImp0aSI6IjQxMTg4NDg2LTBjODYtNDdiZC05NjQ0LWM2YjJmNmE3OGQ1NyIsImlzcyI6Imh0dHBzOi8va2V5Y2xvYWsubXZrNC55b3VyZG9tYWluLmNvbS9hdXRoL3JlYWxtcy90cmFjZWFibGUiLCJhdWQiOiJodHRwczovL2tleWNsb2FrLm12azQueW91cmRvbWFpbi5jb20vYXV0aC9yZWFsbXMvdHJhY2VhYmxlIiwic3ViIjoiYjY4OTRjMmYtMWEwYy00OTM5LTk3N2MtNjBkZjNhZTZjNjRjIiwidHlwIjoiT2ZmbGluZSIsImF6cCI6ImlhbS1jbGllbnQiLCJzZXNzaW9uX3N0YXRlIjoiYjZlODk5ZTgtMTY4Mi00ZDA0LTkzNmYtMGM1ZGIzMWJjMTFlIiwic2NvcGUiOiJvcGVuaWQgZW1haWwgcHJvZmlsZSBvZmZsaW5lX2FjY2VzcyIsInNpZCI6ImI2ZTg5OWU4LTE2ODItNGQwNC05MzZmLTBjNWRiMzFiYzExZSJ9.goDhIVk_ryrcimqd_P9fjMgSHX3OYCqcYJ8XnLATYfM
environment: test-env
endpoint: api.yourdomain.com
remoteCaBundle: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUZGRENDQXZ3Q0NRRFp3T3VnNmJuRG5UQU5CZ2txaGtpRzl3MEJBUXNGQURCTU1Rc3dDUVlEVlFRR0V3SlYKVXpFTE1Ba0dBMVVFQ0F3Q1EwRXhFakFRQmdOVkJBb01DVlJ5WVdObFlXSnNaVEVjTUJvR0ExVUVBd3dUYlhacgpOQzU1YjNWeVpHpltNXpicjh2L014QjJpL2MyMU11NmVCajN0bDhQUQoyZFE0cjRTbFZkREs3eVdocHlnQ3ZSVk03andSOXhqcGMvSFkwcnpld0dNN2hMaEFVYmUva1p3dkF1aVR4bWwyCnl5UldheVROY25NPQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg==
injector:
  propagationFormats:
    - B3

Install TPA

Once you have the Traceable Platform Installed and the values.yaml file for TPA installation ready, use the following steps to install the TPA on the K8S cluster

% helm repo add traceableai https://helm.traceable.ai
% helm repo update
% helm install --namespace traceableai traceable-agent traceableai/traceable-agent --create-namespace --values values.yaml

 

Once the TPA is installed, confirm the installation is successful by running:

% kubectl get pods -n traceableai
NAME                               READY   STATUS    RESTARTS   AGE
traceable-agent-5b995d4fbb-5q7fv   1/1     Running   0          108m

Check the logs to see if there are any error messages or exceptions while starting the TPA:

% kubectl logs traceable-agent-5b995d4fbb-5q7fv -n traceableai
......
{"level":"info","time":"2022-04-15T16:53:06.003Z","message":"Received config update from upstream."}
2022-04-15T16:53:06.022Z info aggregatedprocessor/aggregator.go:230 Reloading traces processor pipeline. {"kind": "processor", "name": "aggregatedprocessor", "processors": ["traceable_spanremover", "traceable_barespanconverter", "traceable_protection_mode", "traceable_protoprocessor", "traceable_parser", "traceable_end_user", "traceable_modsec/core", "traceable_sampling_processor", "traceable_redaction", "traceable_modsec/advanced", "traceable_metadata", "attributes/environment", "batch"]}
2022-04-15T16:53:06.051Z info redactionprocessor/factory.go:49  processor drop spans config evaluated. {"kind": "processor", "name": "aggregatedprocessor", "component_name": "", "drop_spans": false}
2022-04-15T16:53:06.080Z info parsingprocessor/factory.go:48  processor drop spans config evaluated. {"kind": "processor", "name": "aggregatedprocessor", "component_name": "", "drop_spans": false}
2022-04-15T16:53:06.080Z info aggregatedprocessor/processor.go:78 Replacing subprocessors {"kind": "processor", "name": "aggregatedprocessor"}
2022-04-15T16:53:06.080Z info aggregatedprocessor/processor.go:90 Shutting down old subprocessors {"kind": "processor", "name": "aggregatedprocessor"}
2022-04-15T16:53:06.092Z info aggregatedprocessor/processor.go:96 Shutdown of old subprocessors complete {"kind": "processor", "name": "aggregatedprocessor"}
{"level":"info","time":"2022-04-15T16:53:10.276Z","message":"Setting grpc log level to error"}

 

Related articles