Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Remove references to internal tooling and communications channels #67

Merged
merged 1 commit into from
Aug 16, 2023
Merged

Remove references to internal tooling and communications channels #67

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
84 changes: 4 additions & 80 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,7 +17,6 @@ This configuration is specific to the strategy we're using at Metal:
## Maintainers

This chart is maintained by the [[Governor] Metal OpenTelemetry GitHub team](https://github.com/orgs/equinixmetal-helm/teams/governor-metal-opentelemetry).
If you would like to be a maintainer, request to join the Metal OpenTelemetry group via Governor.

## Deploy the OpenTelemetry Collector for your service

Expand Down Expand Up @@ -83,8 +82,6 @@ Most k8s-site-{appname} charts will set environment variables in `values.yaml` l
OTEL_EXPORTER_OTLP_INSECURE: "true"
```

If you're not sure where to add the environment variable, ask Applied Resilience Engineering (`#sre`) or the Delivery team (`#em-delivery-eng`) for help.

### Add the ExternalSecretPull for the Honeycomb API key

Equinix Metal uses a global key for all Metal services for each environment.
Expand Down Expand Up @@ -193,12 +190,11 @@ Here's an example:
config_file: .yamllint.yml
```

### Sync in Argo
### Deploy in your application namespace

For initial deployment and any changes to the OTLP endpoint, the app's pods will need to be restarted in order to pick up the new/updated environment variables.
For some configurations, Argo will restart the pods automatically.
For some configurations, Kubernetes will restart the pods automatically.
For others, you may need to manually restart the pods.
Reach out to Applied Resilience Engineering (`#sre`) or the Delivery team (`#em-delivery-eng`) if you need help with that.

### Add OpenTelemetry instrumentation to the application code

Expand All @@ -207,81 +203,9 @@ Follow the configuration instructions in the README.

For Ruby apps, follow the instructions in [Confluence](https://packet.atlassian.net/l/c/XBP11Ef4).

## Manage Honeycomb API keys

As of August 2022, Metal services share a global Honeycomb key for each environment.
Metal service teams no longer need to worry about managing Honeycomb keys for their services.
The Applied Resilience Engineering team manages the Honeycomb API keys.
Reach out in the `#sre` channel in Slack if you have questions.

### Rotate a Honeycomb key

(Note: this step requires that you [set up your local Kubernetes config according to the Delivery Docs](https://delivery-docs.metalkube.net/training_and_guides/kubectl/#import-kube-configs).)

The API key name in Honeycomb should use the format `metal-{appname}`.

You will need to create a yaml manifest file to update the ExternalSecretPush.
(For more information about using Keymaker, see [these instructions on the delivery docs site](https://delivery-docs.metalkube.net/core_services/keymaker/?h=keymaker#add-secret-to-secret-store).)

This file must NOT be committed to git so you can just create it in your home directory, for example:

```shell
vim ~/honeycomb-secret-push.yaml
```

Paste the following contents, being sure to use the correct value for the new Honeycomb API key:

```diff
apiVersion: keymaker.equinixmetal.com/v1
kind: ExternalSecretPush
metadata:
name: honeycomb-key
annotations:
clusterlevelsecret: "true"
spec:
backend: ssm
environment: prod
secrets:
- key: honeycomb-key
- value: OLD_KEY
- version: v1
+ value: NEW_KEY
+ version: v2
```

(Note that the above diff is for demonstration purposes only, since none of these files should be committed to version control.)

#### Perform the ExternalSecretPush

Save the file and run `kubectl apply` to tell Kubernetes to perform the ExternalSecretPush to create/update the key:

```shell
kubectl apply -f ~/honeycomb-secret-push.yaml
```

You can then use `kubectl get events` to confirm that it was saved successfully.
Here's the full output:

```shell
% kubectl apply -f honeycomb-key.yaml

externalsecretpush.keymaker.equinixmetal.com/honeycomb-key created
% kubectl get events
LAST SEEN TYPE REASON OBJECT MESSAGE
80s Normal Backend externalsecretpush/honeycomb-key backend loaded: ssm
81s Normal Secret externalsecretpush/honeycomb-key secret saved to ssm: /prod/honeycomb-key/v1
```

When the secret is successfully added, delete the manifest:

```shell
rm ~/honeycomb-secret-push.yaml
```

The final key path will look like `/prod/honeycomb-secret/v2` (or whatever version you've updated it to).
This will automatically get picked up by the ExternalSecretPull generated by the template in this chart.
## Honeycomb API keys

If you run into issues trying to push a secret, reach out to SRE (#sre) or the Delivery team (`#em-delivery-eng`) for help.
The ExternalSecretPull file references the global Honeycomb API key that's already available in production clusters.

## Troubleshooting

Expand Down