Skip to content

Commit

Permalink
Remove references to internal tooling and communications channels
Browse files Browse the repository at this point in the history
  • Loading branch information
shelbyspees committed Aug 14, 2023
1 parent 83c96bd commit 88138d6
Showing 1 changed file with 4 additions and 80 deletions.
84 changes: 4 additions & 80 deletions README.md
Original file line number Diff line number Diff line change
Expand Up @@ -17,7 +17,6 @@ This configuration is specific to the strategy we're using at Metal:
## Maintainers

This chart is maintained by the [[Governor] Metal OpenTelemetry GitHub team](https://github.com/orgs/equinixmetal-helm/teams/governor-metal-opentelemetry).
If you would like to be a maintainer, request to join the Metal OpenTelemetry group via Governor.

## Deploy the OpenTelemetry Collector for your service

Expand Down Expand Up @@ -83,8 +82,6 @@ Most k8s-site-{appname} charts will set environment variables in `values.yaml` l
OTEL_EXPORTER_OTLP_INSECURE: "true"
```

If you're not sure where to add the environment variable, ask Applied Resilience Engineering (`#sre`) or the Delivery team (`#em-delivery-eng`) for help.

### Add the ExternalSecretPull for the Honeycomb API key

Equinix Metal uses a global key for all Metal services for each environment.
Expand Down Expand Up @@ -193,12 +190,11 @@ Here's an example:
config_file: .yamllint.yml
```

### Sync in Argo
### Deploy in your application namespace

For initial deployment and any changes to the OTLP endpoint, the app's pods will need to be restarted in order to pick up the new/updated environment variables.
For some configurations, Argo will restart the pods automatically.
For some configurations, Kubernetes will restart the pods automatically.
For others, you may need to manually restart the pods.
Reach out to Applied Resilience Engineering (`#sre`) or the Delivery team (`#em-delivery-eng`) if you need help with that.

### Add OpenTelemetry instrumentation to the application code

Expand All @@ -207,81 +203,9 @@ Follow the configuration instructions in the README.

For Ruby apps, follow the instructions in [Confluence](https://packet.atlassian.net/l/c/XBP11Ef4).

## Manage Honeycomb API keys

As of August 2022, Metal services share a global Honeycomb key for each environment.
Metal service teams no longer need to worry about managing Honeycomb keys for their services.
The Applied Resilience Engineering team manages the Honeycomb API keys.
Reach out in the `#sre` channel in Slack if you have questions.

### Rotate a Honeycomb key

(Note: this step requires that you [set up your local Kubernetes config according to the Delivery Docs](https://delivery-docs.metalkube.net/training_and_guides/kubectl/#import-kube-configs).)

The API key name in Honeycomb should use the format `metal-{appname}`.

You will need to create a yaml manifest file to update the ExternalSecretPush.
(For more information about using Keymaker, see [these instructions on the delivery docs site](https://delivery-docs.metalkube.net/core_services/keymaker/?h=keymaker#add-secret-to-secret-store).)

This file must NOT be committed to git so you can just create it in your home directory, for example:

```shell
vim ~/honeycomb-secret-push.yaml
```

Paste the following contents, being sure to use the correct value for the new Honeycomb API key:

```diff
apiVersion: keymaker.equinixmetal.com/v1
kind: ExternalSecretPush
metadata:
name: honeycomb-key
annotations:
clusterlevelsecret: "true"
spec:
backend: ssm
environment: prod
secrets:
- key: honeycomb-key
- value: OLD_KEY
- version: v1
+ value: NEW_KEY
+ version: v2
```

(Note that the above diff is for demonstration purposes only, since none of these files should be committed to version control.)

#### Perform the ExternalSecretPush

Save the file and run `kubectl apply` to tell Kubernetes to perform the ExternalSecretPush to create/update the key:

```shell
kubectl apply -f ~/honeycomb-secret-push.yaml
```

You can then use `kubectl get events` to confirm that it was saved successfully.
Here's the full output:

```shell
% kubectl apply -f honeycomb-key.yaml
externalsecretpush.keymaker.equinixmetal.com/honeycomb-key created
% kubectl get events
LAST SEEN TYPE REASON OBJECT MESSAGE
80s Normal Backend externalsecretpush/honeycomb-key backend loaded: ssm
81s Normal Secret externalsecretpush/honeycomb-key secret saved to ssm: /prod/honeycomb-key/v1
```

When the secret is successfully added, delete the manifest:

```shell
rm ~/honeycomb-secret-push.yaml
```

The final key path will look like `/prod/honeycomb-secret/v2` (or whatever version you've updated it to).
This will automatically get picked up by the ExternalSecretPull generated by the template in this chart.
## Honeycomb API keys

If you run into issues trying to push a secret, reach out to SRE (#sre) or the Delivery team (`#em-delivery-eng`) for help.
The ExternalSecretPull file references the global Honeycomb API key that's already available in production clusters.

## Troubleshooting

Expand Down

0 comments on commit 88138d6

Please sign in to comment.