diff --git a/docs/_config.yml b/docs/_config.yml index ca0a5d2d..d32efbff 100644 --- a/docs/_config.yml +++ b/docs/_config.yml @@ -34,9 +34,6 @@ footer_social_links: Twitter: fa_icon: fab fa-twitter url: https://twitter.com/VMWEventBroker - Slack: - fa_icon: fab fa-slack - url: https://vmwarecode.slack.com/archives/CQLT9B5AA Email: fa_icon: fas fa-envelope url: mail:dl-veba@vmware.com diff --git a/docs/_data/default.yml b/docs/_data/default.yml index 66c5c98a..11acd4d3 100644 --- a/docs/_data/default.yml +++ b/docs/_data/default.yml @@ -7,18 +7,18 @@ toc: - page: Architecture id: intro-architecture url: /kb/architecture - - page: VMware Event Router - id: intro-event-router - url: /kb/event-router + - page: VMware Tanzu Sources for Knative + id: intro-tanzu-sources + url: /kb/tanzu-sources - page: Functions id: intro-functions url: /kb/functions - title: Install subfolderitems: - - page: VEBA (Knative) - id: install-knative - url: /kb/install-knative + - page: VMware Event Broker Appliance + id: install-veba + url: /kb/install-veba - title: Use subfolderitems: @@ -43,9 +43,6 @@ toc: - page: Build Functions id: contribute-functions url: /kb/contribute-functions - - page: Build Event Router - id: contribute-eventrouter - url: /kb/contribute-eventrouter - page: Build Appliance id: contribute-appliance url: /kb/contribute-appliance @@ -57,22 +54,28 @@ toc: subfolderitems: - page: Deploy VEBA to Kubernetes id: advanced-deploy-k8s - url: /kb/event-router#deployment - - page: Deploy Event Router to Kind + url: /kb/tanzu-sources#installation-tanzu-sources-for-knative + - page: Deploy Tanzu Sources with KinD id: site-resources - url: /kb/deploy-event-router-kind - - page: In-depth Function Tutorial + url: /kb/deploy-tanzu-sources-kind + - page: Function Tutorial - Intro id: function-tutorial-intro url: /kb/function-tutorial-intro - - page: Replace TLS Certificates on VEBA + - page: Function Tutorial - Deploy + id: function-tutorial-deploy + url: kb/function-tutorial-deploy + - page: Function Tutorial - Modify & Test + id: function-tutorial-modtest + url: /kb/function-tutorial-modtest + - page: Certificate Management for VEBA id: advanced-certificates url: /kb/advanced-certificates - page: Using Private Container Registry with VEBA id: private-registry url: /kb/private-registry - - page: Monitoring VEBA with vROps + - page: Monitoring VEBA with Aria Operations id: site-resources - external_url: https://rguske.github.io/post/monitoring-the-vmware-event-broker-appliance-with-vrealize-operations-manager/ + external_url: https://docs.vmware.com/en/VMware-vRealize-Operations-Management-Pack-for-Kubernetes/1.8/management-pack-for-kubernetes/GUID-4ED07321-A5C9-46D6-8EB0-2661D853C0E9.html - title: Troubleshoot subfolderitems: diff --git a/docs/_data/team.yml b/docs/_data/team.yml index 95b1cde0..79aeae94 100644 --- a/docs/_data/team.yml +++ b/docs/_data/team.yml @@ -13,6 +13,11 @@ members: website: https://www.williamlam.com/ twitter: lamw github: lamw + - name: Robert Guske + img: https://avatars1.githubusercontent.com/u/31652019?v=4 + website: https://rguske.github.io/ + twitter: vmw_rguske + github: rguske - name: Frankie Gold img: https://avatars1.githubusercontent.com/u/17328443?v=4 twitter: codegold79 @@ -27,11 +32,6 @@ members: website: http://www.patrickkremer.com/ twitter: kremerpatrick github: kremerpatrick - - name: Robert Guske - img: https://avatars1.githubusercontent.com/u/31652019?v=4 - website: https://rguske.github.io/ - twitter: vmw_rguske - github: rguske - name: Vladimir Velikov img: https://avatars3.githubusercontent.com/u/46163850?v=4 website: https://pluginsblog.com/ diff --git a/docs/index.html b/docs/index.html index 5d35f40b..4d77cfbc 100644 --- a/docs/index.html +++ b/docs/index.html @@ -36,12 +36,12 @@ secondary_ctas: cta1: title: Appliance for VMware vSphere - url: /kb/install-knative + url: /kb/install-veba content: Deploy VEBA directly onto vSphere by using the ready-to-run appliance (OVA). cta2: title: Installation on Kubernetes with Knative - url: /kb/event-router#deployment - content: Deploy VEBA to an existing Kubernetes Knative installation with Helm. + url: /kb/tanzu-sources#deployment + content: Deploy VEBA to an existing Kubernetes Knative installation using the Tanzu Sources for Knative. cta3: title: Explore our documentation to help you get started quickly url: /kb diff --git a/docs/kb/advanced-certificates.md b/docs/kb/advanced-certificates.md index c066ac57..b92fbfb1 100644 --- a/docs/kb/advanced-certificates.md +++ b/docs/kb/advanced-certificates.md @@ -8,9 +8,29 @@ cta: description: Replacing the default self-signed TLS certificate in VMware Event Broker Appliance. --- -## Updating the TLS Certificate on VEBA +# Certificates in VEBA + +In project VMware Event Broker Appliance, both client certificates and TLS (Transport Layer Security) certificates play essential roles in securing communication between various components within the cluster. Client certificates are generated by `kubeadm` during the Kubernetes cluster installation and are vital for authentication and authorization of users and services. + +In order to encrypt the communication channels between Kubernetes components, the VMware Event Broker Appliance generates a self-signed TLS certificate. This TLS certificate is also used to support different web endpoints running on the appliance such as Stats (`/stats`), Status (`/status`), Logs (`/bootstrap`) and Events (`/events`). This will cause browsers to show the certificate as untrusted. + +This sections includes documentaiton on how to e.g. update or renew the client as well as TLS certificates in VEBA. + + +## Table of Contents + +- [Certificates in VEBA](#certificates-in-veba) + - [Updating the TLS Certificate on VEBA](#updating-the-tls-certificate-on-veba) + - [Assumptions](#assumptions) + - [Steps](#steps) + - [Replacing an existing Certificate on VEBA](#replacing-an-existing-certificate-on-veba) + - [Assumptions](#assumptions-1) + - [Steps](#steps-1) + - [Obtaining a Signed SSL Certificate from Let's Encrypt](#obtaining-a-signed-ssl-certificate-from-lets-encrypt) + - [Steps](#steps-2) + - [Renew Kubeadm generated Certificates](#renew-kubeadm-generated-certificates) -By default, the VMware Event Broker Appliance generates a self-signed TLS certificate that is used to support different web endpoints running on the appliance such as Stats (`/stats`), Status (`/status`), Logs (`/bootstrap`) and Events (`/events`). This will cause browsers to show the certificate as untrusted. +## Updating the TLS Certificate on VEBA For organizations that require the use of a TLS certificate from a trusted authority, the VMware Event Broker Appliance provides an option for users to provide their certificate information during the OVF property configuration when deploying the virtual appliance. @@ -18,14 +38,14 @@ In order to use a certificates from a trusted authority, please follow the steps ### Assumptions -* Certificates from a trusted authority pre-downloaded onto your local desktop - * The public/private key pair must exist before hand. The public key certificate must be .PEM encoded and match the given private key. +- Certificates from a trusted authority pre-downloaded onto your local desktop + - The public/private key pair must exist before hand. The public key certificate must be .PEM encoded and match the given private key. ### Steps In the example, the private key file is named `privateKey.key` and certificate file is named `certificate.crt` -1. Encode both the private key and the certificate file using base64 encoding. +- **Step 1:** Encode both the private key and the certificate file using base64 encoding. Microsoft Windows (PowerShell) @@ -58,176 +78,93 @@ cat certificate.crt | base64 LS0tLS1CRUd......== ``` -2. Using the output from the previous step, the base64 content can now be provided in `Custom TLS Certificate Configuration` section of the OVF property during the deployment of the VMware Event Broker Appliance. - * Custom VMware Event Broker Appliance TLS Certificate Private Key (Base64) - * Custom VMware Event Broker Appliance TLS Certificate Authority Certificate (Base64) +- **Step 2:** Using the output from the previous step, the base64 content can now be provided in `Custom TLS Certificate Configuration` section of the OVF property during the deployment of the VMware Event Broker Appliance. + +- Custom VMware Event Broker Appliance TLS Certificate Private Key (Base64) +- Custom VMware Event Broker Appliance TLS Certificate Authority Certificate (Base64) -3. Power on the VMware Event Broker Appliance and ensure that the provided TLS certificate is now used instead of the auto-generated self-sign TLS certificate by opening a browser to one of the VMware Event Broker Appliance endpoints such as `/status`. +- **Step 3:** Power on the VMware Event Broker Appliance and ensure that the provided TLS certificate is now used instead of the auto-generated self-sign TLS certificate by opening a browser to one of the VMware Event Broker Appliance endpoints such as `/status` (admin/VMware1!). -## Replacing an Existing Cert on VEBA +## Replacing an existing Certificate on VEBA If you need to replace the default self-signed certificate, or replace an expired certificate, follow the steps outlined below. ### Assumptions -* Your SSL certificate must match the FQDN that you picked when you deployed VEBA -* Pre-download your public and private key from your Certificate Authority, which must be .PEM encoded. + +- Your SSL certificate must match the FQDN that you picked when you deployed VEBA +- Pre-download your public and private key from your Certificate Authority, which must be .PEM encoded. ### Steps -Step 1 - Transfer or copy the contents of the root certificate to the VMware Event Broker Appliance. If you need a free, publicly signed certificate, see the [Let's Encrypt](#letsencrypt) section below. +- **Step 1:** Transfer or copy the contents of the root certificate to the VMware Event Broker Appliance. If you need a free, publicly signed certificate, see the [Let's Encrypt](#letsencrypt) section below. -Step 2 - Delete the existing Event Router TLS secret + +- **Step 2:** Delete the existing Event Router TLS secret + ```console kubectl -n vmware-system delete secret eventrouter-tls ``` -Step 3 - Create a new Event Router TLS secret with the new certificate keypair. +- **Step 3:** Create a new Event Router TLS secret with the new certificate keypair. + ```console kubectl -n vmware-system create secret tls eventrouter-tls --key privkey.pem --cert pubkey.pem ``` -Step 4 - Delete the existing Contour TLS secret +- **Step 4:** Delete the existing Contour TLS secret + ```console kubectl -n contour-external delete secret default-cert ``` -Step 5 - Create a new Contour TLS secret with the new certificate keypair. +- **Step 5:** Create a new Contour TLS secret with the new certificate keypair. + ```console kubectl -n contour-external create secret tls default-cert --key privkey.pem --cert pubkey.pem ``` -Step 6 - Check for valid HTTPproxy status +- **Step 6:** Check for valid HTTPproxy status + ```console kubectl -n vmware-system get httpproxy ``` + Expected output: + ```console NAME FQDN TLS SECRET STATUS STATUS DESCRIPTION event-router veba.domain.com eventrouter-tls valid Valid HTTPProxy ``` -## Adding a Trusted Root Certificate to VEBA - -For organizations that require the use of a Private or Enterprise Certificate Authority (CA) and wish to have full TLS trust when the VMware Event Broker Appliance is configured with a vCenter Server that has a TLS certificate generated by the internal CA, a root of trust must be established. - -To support this use case, a post-deployment reconfiguration of the VMware Event Broker Appliance is required to import the trusted root certificate of your internal certificate authority. If this is not performed, you may see the following warning in the VMware Event Router logs when connecting to the configured vCenter Server. - -```console -WARN [VCENTER] vcenter/vcenter.go:112 using potentially insecure connection to vCenter {"address": "https://vcsa.primp-industries.local", "insecure": true} -``` - -In order to import your trusted root certificate, please follow the steps outlined below. - -### Assumptions -* Pre-download your root certificates from your internal certificate, which must be .PEM encoded +## Obtaining a Signed SSL Certificate from Let's Encrypt -In the example, the downloaded root certificate file is named `ca-root.crt` +This section demonstrates installation of the Let's Encrypt Certbot Docker image onto the VEBA appliance, then uses DNS validation to verify domain ownership. ### Steps -Step 1 - Transfer or copy the contents of the root certificate to the VMware Event Broker Appliance and create a new kubernetes configMap from that file. - -```console -kubectl -n vmware-system create cm ca-root-cert --from-file ca-root.crt -``` - -Step 2 - Undeploy the VMware Event Router and delete the current configuration secret. - -```console -kubectl -n vmware-system delete deploy vmware-event-router -kubectl -n vmware-system delete secret event-router-config -``` - -Step 3 - Edit `/root/config/event-router-k8s.yaml` and append the additional `volumenMount` and `volume` entry as shown in the snippet below. - -```console -snip -... - volumeMounts: - - name: config - mountPath: /etc/vmware-event-router/ - readOnly: true - - name: ca-root-cert - mountPath: /etc/vmware-event-router/ssl - readOnly: true - volumes: - - name: config - secret: - secretName: event-router-config - - name: ca-root-cert - configMap: - name: ca-root-cert -``` - -Step 4 - In the same file (step 3) append the additional `certificates` section to the end of the file as shown in the snippet below. - -```console -snip -... -metricsProvider: - default: - bindAddress: 0.0.0.0:8082 - name: veba-metrics - type: default -certificates: - rootCAs: - - /etc/ssl/certs/ca-certificates.crt - - /etc/vmware-event-router/ssl/ca-root.crt -``` - -> **Note:** If `insecureSSL` is set to `true`, please update that to `false` which will now ensure TLS verification is performed when connecting to your vCenter Server. - -Step 5 - Recreate the VMware Event Router configuration and redeploy the VMware Event Router deployment. +- **Step 1:** Start the Docker daemon. VEBA uses containerd for its container runtime - the Docker daemon is disabled by default. ```console -kubectl -n vmware-system create secret generic event-router-config --from-file=/root/config/event-router/vmware-event-router-config-vcenter.yaml -kubectl -n vmware-system apply -f /root/config/event-router-k8s.yaml +systemctl start docker ``` -Step 6 - Verify the VMware Event Router pod is running successfully. +- **Step 2:** Pull the Certbot Docker image ```console -kubectl -n vmware-system get pods -NAME READY STATUS RESTARTS AGE -tinywww-dd88dc7db-q6pzw 1/1 Running 0 166m -veba-rabbit-server-0 1/1 Running 0 167m -veba-ui-8d6584f84-ckvwb 1/1 Running 0 166m -vmware-event-router-7759d8bffc-45c92 1/1 Running 0 37m -``` - -Lastly, you can also look at the VMware Event Router log and ensure that you no longer see the message `potentially insecure connection to vCenter`, which is what you would see if the connection was not trusted if you had TLS verified disabled. The following `DEBG` log entry should appear when the VMware Event Router is deployed with the debug flag. - -``` -kubectl -n vmware-system logs vmware-event-router-7759d8bffc-kt2jm - -DEBUG [VCENTER] vcenter/vcenter.go:136 setting custom root CAs {"certificates": "/etc/ssl/certs/ca-certificates.crt:/etc/vmware-event-router/ssl/ca-root.crt"} +docker pull certbot/certbot ``` -## Obtaining a Signed SSL certificate from Let's Encrypt - -This section demonstrates installation of the Let's Encrypt Certbot Docker image onto the VEBA appliance, then uses DNS validation to verify domain ownership. - -### Steps -Step 1 - Start the Docker daemon. VEBA uses containerd for its container runtime - the Docker daemon is disabled by default. +- **Step 3:** Run certbot. For the `-d` (domain) switch, use your VEBA FQDN. You will be prompted for an e-mail address as well as some yes/no questions. ```console -systemctl start docker -``` - -Step 2 - Pull the Certbot Docker image -```console -docker pull certbot/certbot +docker run -it --rm --name certbot -v "/etc/letsencrypt:/etc/letsencrypt" ` +-v "/var/lib/letsencrypt:/var/lib/letsencrypt" ` +-v "/var/log/letsencrypt:/var/log/letsencrypt" ` +certbot/certbot certonly --manual -d veba02.vmweventbroker.io --preferred-challenges dns ``` -Step 3 - Run certbot. For the `-d` (domain) switch, use your VEBA FQDN. You will be prompted for an e-mail address as well as some yes/no questions. ```console - docker run -it --rm --name certbot -v "/etc/letsencrypt:/etc/letsencrypt" ` - -v "/var/lib/letsencrypt:/var/lib/letsencrypt" ` - -v "/var/log/letsencrypt:/var/log/letsencrypt" ` - certbot/certbot certonly --manual -d veba02.vmweventbroker.io --preferred-challenges dns - ``` -``` Enter email address (used for urgent renewal and security notices) (Enter 'c' to cancel): certificates@vmweventbroker.io @@ -269,11 +206,11 @@ value(s) you've just added. Press Enter to Continue ``` -Step 4 - Using your public DNS provider's tools, configure the required TXT record as prompted in Step 2. +- **Step 4:** Using your public DNS provider's tools, configure the required TXT record as prompted in Step 2. -Step 5 - Press Enter to continue. If you have configured DNS properly, the certificate PEM files will be saved in the location specified. +- **Step 5:** Press Enter to continue. If you have configured DNS properly, the certificate PEM files will be saved in the location specified. -``` +```console - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Press Enter to Continue @@ -287,12 +224,163 @@ NEXT STEPS: - This certificate will not be renewed automatically. Autorenewal of --manual certificates requires the use of an authentication hook script (--manual-auth-hook) but one was not provided. To renew this certificate, repeat this same certbot command before the certificate's expiry date. ``` -Step 6 - Install the certificate - follow the instructions starting with step 2 of [Replacing an Existing Cert on VEBA](#replacestep2). Note from the output above that the public key file is named `fullchain.pem` - you will need to pass this value for the `--cert` argument when creating the Kubernetes TLS certificates. +- **Step 6:** Install the certificate - follow the instructions starting with step 2 of [Replacing an Existing Cert on VEBA](#replacestep2). Note from the output above that the public key file is named `fullchain.pem` - you will need to pass this value for the `--cert` argument when creating the Kubernetes TLS certificates. -Step 7 - Stop the Docker daemon +- **Step 7:** Stop the Docker daemon ```console systemctl stop docker ``` -Step 8 (optional) - If you want to automate renewals, this is an excellent blog on configuring [automated certificate renewals](https://chariotsolutions.com/blog/post/automating-lets-encrypt-certificate-renewal-using-dns-challenge-type/) using DNS validation. \ No newline at end of file +- **Step 8:** (optional) - If you want to automate renewals, this is an excellent blog on configuring [automated certificate renewals](https://chariotsolutions.com/blog/post/automating-lets-encrypt-certificate-renewal-using-dns-challenge-type/) using DNS validation. + +## Renew Kubeadm generated Certificates + +The VMware Event Broker Appliance is using `kubeadm` to setup Kubernetes. By default, `kubeadm` generates all the certificates needed for a cluster to run. The client certificates expire after 1 year by default. See also the official section in the Kubernetes documentation: [Certificate Management with kubeadm](https://v1-25.docs.kubernetes.io/docs/tasks/administer-cluster/kubeadm/kubeadm-certs/). + +Normally, certificates will be renewed during a Kubernetes version upgrade. It's not intended to run in-place updates for a VEBA instance. Users would just redeploy a new VEBA version. If a VEBA instance runs longer than 365 days, all Kubernetes client certificates will expire. + +This section describes how to renew the respective certificates. + +- **Step 1:** Check the expiration of all certificates generated by `kubeadm`. + +```console +kubeadm certs check-expiration +[check-expiration] Reading configuration from the cluster... +[check-expiration] FYI: You can look at this config file with 'kubectl -n kube-system get cm kubeadm-config -o yaml' + +CERTIFICATE EXPIRES RESIDUAL TIME CERTIFICATE AUTHORITY EXTERNALLY MANAGED +admin.conf Jan 11, 2025 20:45 UTC 359d ca no +apiserver Jan 11, 2025 20:45 UTC 359d ca no +apiserver-etcd-client Jan 11, 2025 20:45 UTC 359d etcd-ca no +apiserver-kubelet-client Jan 11, 2025 20:45 UTC 359d ca no +controller-manager.conf Jan 11, 2025 20:45 UTC 359d ca no +etcd-healthcheck-client Jan 11, 2025 20:45 UTC 359d etcd-ca no +etcd-peer Jan 11, 2025 20:45 UTC 359d etcd-ca no +etcd-server Jan 11, 2025 20:45 UTC 359d etcd-ca no +front-proxy-client Jan 11, 2025 20:45 UTC 359d front-proxy-ca no +scheduler.conf Jan 11, 2025 20:45 UTC 359d ca no + +CERTIFICATE AUTHORITY EXPIRES RESIDUAL TIME EXTERNALLY MANAGED +ca Jan 09, 2034 20:45 UTC 9y no +etcd-ca Jan 09, 2034 20:45 UTC 9y no +front-proxy-ca Jan 09, 2034 20:45 UTC 9y no +``` + +- **Step 2:** Initiate the certificate renewal process by executing `kubeadm certs renew all`. + +```console +kubeadm certs renew all + +[renew] Reading configuration from the cluster... +[renew] FYI: You can look at this config file with 'kubectl -n kube-system get cm kubeadm-config -o yaml' + +certificate embedded in the kubeconfig file for the admin to use and for kubeadm itself renewed +certificate for serving the Kubernetes API renewed +certificate the apiserver uses to access etcd renewed +certificate for the API server to connect to kubelet renewed +certificate embedded in the kubeconfig file for the controller manager to use renewed +certificate for liveness probes to healthcheck etcd renewed +certificate for etcd nodes to communicate with each other renewed +certificate for serving etcd renewed +certificate for the front proxy client renewed +certificate embedded in the kubeconfig file for the scheduler manager to use renewed + +Done renewing certificates. You must restart the kube-apiserver, kube-controller-manager, kube-scheduler and etcd, so that they can use the new certificates. +``` + +- **Step 3:** Reboot the appliance. + +- **Step 4:** Since the client certificates has changed, the old kubeconfig is not valid anymore. Copy the newly created kubeconfig to `/root/.kube/`. + +Backup the old `config` file: + +```console +cp /root/.kube/config /root/.kube/old-$(date --iso)-config + +ls -rtl /root/.kube/ + +total 12 +-rw------- 1 root root 5639 Jan 12 20:45 old-2024-01-18-config +drwxr-x--- 4 root root 4096 Jan 13 09:08 cache +``` + +Copy the new `config` file. + +```console +cp /etc/kubernetes/admin.conf /root/.kube/config + +ls -rtl /root/.kube/ + +total 20 +-rw------- 1 root root 5639 Jan 12 20:45 old-2024-01-18-config +drwxr-x--- 4 root root 4096 Jan 13 09:08 cache +-rw------- 1 root root 5635 Jan 18 08:26 config +``` + +Validate functionality. + +```console +kubectl get deploy -A + +NAMESPACE NAME READY UP-TO-DATE AVAILABLE AGE +cert-manager cert-manager 1/1 1 1 5d11h +cert-manager cert-manager-cainjector 1/1 1 1 5d11h +cert-manager cert-manager-webhook 1/1 1 1 5d11h +contour-external contour 2/2 2 2 5d11h +contour-internal contour 2/2 2 2 5d11h +knative-eventing eventing-controller 1/1 1 1 5d11h +knative-eventing eventing-webhook 1/1 1 1 5d11h +knative-eventing pingsource-mt-adapter 0/0 0 0 5d11h +knative-eventing rabbitmq-broker-controller 1/1 1 1 5d11h +knative-eventing rabbitmq-broker-webhook 1/1 1 1 5d11h +knative-serving activator 1/1 1 1 5d11h +knative-serving autoscaler 1/1 1 1 5d11h +knative-serving controller 1/1 1 1 5d11h +knative-serving domain-mapping 1/1 1 1 5d11h +knative-serving domainmapping-webhook 1/1 1 1 5d11h +knative-serving net-contour-controller 1/1 1 1 5d11h +knative-serving webhook 1/1 1 1 5d11h +kube-system antrea-controller 1/1 1 1 5d11h +kube-system coredns 2/2 2 2 5d11h +local-path-storage local-path-provisioner 1/1 1 1 5d11h +rabbitmq-system messaging-topology-operator 1/1 1 1 5d11h +rabbitmq-system rabbitmq-cluster-operator 1/1 1 1 5d11h +vmware-functions default-broker-ingress 1/1 1 1 5d11h +vmware-functions kn-pcli-tag-00001-deployment 1/1 1 1 21h +vmware-functions sockeye 1/1 1 1 5d11h +vmware-functions sockeye-trigger-dispatcher 1/1 1 1 5d11h +vmware-functions vcsa-source-adapter 1/1 1 1 5d11h +vmware-functions veba-pcli-tag-trigger-dispatcher 1/1 1 1 21h +vmware-sources horizon-source-controller 1/1 1 1 5d11h +vmware-sources horizon-source-webhook 1/1 1 1 5d11h +vmware-sources vsphere-source-webhook 1/1 1 1 5d11h +vmware-system tinywww 1/1 1 1 5d11h +vmware-system veba-ui 1/1 1 1 5d11h +vmware-system vmware-event-router-webhook 1/1 1 1 5d11h +``` + +Check the new expiration dates. + +```console +kubeadm certs check-expiration +[check-expiration] Reading configuration from the cluster... +[check-expiration] FYI: You can look at this config file with 'kubectl -n kube-system get cm kubeadm-config -o yaml' + +CERTIFICATE EXPIRES RESIDUAL TIME CERTIFICATE AUTHORITY EXTERNALLY MANAGED +admin.conf Jan 17, 2025 08:11 UTC 364d ca no +apiserver Jan 17, 2025 08:11 UTC 364d ca no +apiserver-etcd-client Jan 17, 2025 08:11 UTC 364d etcd-ca no +apiserver-kubelet-client Jan 17, 2025 08:11 UTC 364d ca no +controller-manager.conf Jan 17, 2025 08:11 UTC 364d ca no +etcd-healthcheck-client Jan 17, 2025 08:11 UTC 364d etcd-ca no +etcd-peer Jan 17, 2025 08:11 UTC 364d etcd-ca no +etcd-server Jan 17, 2025 08:11 UTC 364d etcd-ca no +front-proxy-client Jan 17, 2025 08:11 UTC 364d front-proxy-ca no +scheduler.conf Jan 17, 2025 08:11 UTC 364d ca no + +CERTIFICATE AUTHORITY EXPIRES RESIDUAL TIME EXTERNALLY MANAGED +ca Jan 09, 2034 20:45 UTC 9y no +etcd-ca Jan 09, 2034 20:45 UTC 9y no +front-proxy-ca Jan 09, 2034 20:45 UTC 9y no +``` diff --git a/docs/kb/contribute-appliance.md b/docs/kb/contribute-appliance.md index 6eee0110..48f24411 100644 --- a/docs/kb/contribute-appliance.md +++ b/docs/kb/contribute-appliance.md @@ -1,42 +1,62 @@ --- layout: docs toc_id: contribute-appliance -title: Building the VMware Event Broker Appliance +title: Building the VMware Event Broker Appliance description: Building the VMware Event Broker Appliance permalink: /kb/contribute-appliance cta: - title: Have a question? + title: Have a question? description: Please check our [Frequently Asked Questions](/faq) first. --- -## Getting Started Build Guide for VMware Event Broker Appliance +# Getting Started Build Guide for VMware Event Broker Appliance + + +## Table of Contents + +- [Getting Started Build Guide for VMware Event Broker Appliance](#getting-started-build-guide-for-vmware-event-broker-appliance) + - [Requirements](#requirements) + - [Step 1 - Clone the Repository](#step-1---clone-the-repository) + - [Step 2 - Specify the Build-Host](#step-2---specify-the-build-host) + - [Step 3 - Specify the Build-Branch](#step-3---specify-the-build-branch) + - [Step 4 - Start Building](#step-4---start-building) + ## Requirements * 6 vCPU and 8GB of memory for VMware Event Broker Appliance -* ESXi host v6.7 or greater +* ESXi host v7.0 or greater * Datastore with at least 60GB of free space * SSH must be enabled on the host * Enable GuestIPHack on the host by running `esxcli system settings advanced set -o /Net/GuestIPHack -i 1` * The following must be installed on your development machine: * [VMware OVFTool](https://www.vmware.com/support/developer/ovf/){:target="_blank"} * [Docker Client](https://docs.docker.com/v17.09/engine/installation/){:target="_blank"} - * [Packer](https://www.packer.io/intro/getting-started/install.html){:target="_blank"} (v1.6.3 or greater) * [jq](https://stedolan.github.io/jq/){:target="_blank"} + * [Packer](https://www.packer.io/intro/getting-started/install.html){:target="_blank"} (v1.6.3 or greater) + * Run `packer init .` to download the [Packer plugin binaries](https://developer.hashicorp.com/packer/docs/commands/init) for vSphere. + * Powershell for + * [Linux](https://learn.microsoft.com/en-us/powershell/scripting/install/installing-powershell-on-linux) + * [MacOS](https://learn.microsoft.com/en-us/powershell/scripting/install/installing-powershell-on-macos) + * [Windows](https://learn.microsoft.com/en-us/powershell/scripting/install/installing-powershell-on-windows) * Development machine must have the firewall disabled for the duration of the build > **Note:** It has been seen that Packer can bind to an IPv6 on the development machine - you may wish to disable IPv6! * Development machine must be on the same L2 subnet as the target VM portgroup defined in `builder_host_portgroup` below -Step 1 - Clone the VMware Event Broker Appliance Git repository +### Step 1 - Clone the Repository -``` +Clone the VMware Event Broker Appliance Git repository: + +```console git clone https://github.com/vmware-samples/vcenter-event-broker-appliance.git ``` -Step 2 - Edit the `photon-builder.json` file to configure the vSphere endpoint for building the VMware Event Broker Appliance +### Step 2 - Specify the Build-Host -``` +Edit the `photon-builder.json` file to configure the vSphere endpoint for building the VMware Event Broker Appliance: + +```console { "builder_host": "192.168.30.10", "builder_host_username": "root", @@ -48,31 +68,37 @@ Step 2 - Edit the `photon-builder.json` file to configure the vSphere endpoint f > **Note:** If you need to change the default root password on the VMware Event Broker Appliance, take a look at `photon-version.json` -Step 3 - The `veba-bom.json` will need to be updated to specify the branch you wish to build the vCenter Event Broker Appliance code from whether that is from master, a release- branch or from development. Below are two examples of how to correctly set the versions needed prior to building. +### Step 3 - Specify the Build-Branch + +The `veba-bom.json` will need to be updated to specify the branch you wish to build the vCenter Event Broker Appliance code from whether that is from master, a release- branch or from development. Below are two examples of how to correctly set the versions needed prior to building. > **Note:** The default BOM version in development will be the development branch. No changes will be necessary unless you wish to build from a release or master branch. Example 1 (build from master branch): -``` + +```console ".veba.version" => "v0.5.0" "vmware-event-router.version" => "v0.5.0" "vmware-event-router.containers[0].version" => "v0.5.0" ``` Example 2 (build from development branch): -``` + +```console ".veba.version" => "development" "vmware-event-router.version" => "development" "vmware-event-router.containers[0].version" => "development" ``` -* master branch will be reflected using a stable tag, e.g. v0.5.0 -* Any release- branch will be reflected using release- omitting v for backwards-compat reasons, e.g. release-0.5.0 -* Router image tags, based on the branch where changes are pushed to, will use :v0.5.0 for master, :release-0.5.0 for release- and :development on every push to development branch. In addition, the master and development container images will also be tagged with the corresponding COMMIT_ID of the pushed commit. +- master branch will be reflected using a stable tag, e.g. v0.5.0 +- Any release- branch will be reflected using release- omitting v for backwards-compat reasons, e.g. release-0.5.0 +- Router image tags, based on the branch where changes are pushed to, will use :v0.5.0 for master, :release-0.5.0 for release- and :development on every push to development branch. In addition, the master and development container images will also be tagged with the corresponding COMMIT_ID of the pushed commit. -Step 4 - Start the build by running the build script +### Step 4 - Start Building -``` +Start the build by running the build script: + +```console ./build.sh ```` diff --git a/docs/kb/contribute-eventrouter.md b/docs/kb/contribute-eventrouter.md deleted file mode 100644 index 95ae1a93..00000000 --- a/docs/kb/contribute-eventrouter.md +++ /dev/null @@ -1,106 +0,0 @@ ---- -layout: docs -toc_id: contribute-eventrouter -title: Building the Event Router -description: Building the Event Router -permalink: /kb/contribute-eventrouter -cta: - title: Have a question? - description: Please check our [Frequently Asked Questions](/faq) first. ---- - -# Contribute - -If you would like to make modification/additions to this code base, please -follow our [CONTRIBUTION](https://vmweventbroker.io/community) guidelines first. - -In the `Makefile` we provide `make` targets for building a binary and validating -changes via unit/integration tests (`make test`). These tests will run when a pull -request is submitted, but in order to run them locally to verify your changes -you need to have the following bits installed: - -`make unit-test`: - -- `go` tool chain -- `make` -- `gofmt` - -To run the integration tests without the need to create the testbed manually use -the following script: - -`./hack/run_integration_tests.sh`: - -- `go` tool chain -- `jq` -- `kind` -- `docker` - -# Build VMware Event Router from Source - -**Note:** This step is only required if you made code changes to the Go code. - -This repository uses [`ko`](https://github.com/google/ko) to build and push -container artifacts. [`goreleaser`](https://goreleaser.com/) is used to build -binary artifacts. - -Requirements: - -- [`go`](https://go.dev/) -- [`ko`](https://github.com/google/ko) to build images (does not require Docker) -- [`goreleaser`](https://goreleaser.com/) to build executable binaries -- `make` -- A container runtime like Docker or `cri` to run images/integration tests locally -- [`kind`](https://kind.sigs.k8s.io/) to run integration tests - -For convenience a `Makefile` is provided. - -```console -# from within the vmware-event-router folder -make - -Usage: - make [target] - -Targets: - help Display usage - tidy Sync and clean up Go dependencies - build Build binary - gofmt Check code is gofmted - unit-test Run unit tests - integration-test Run integration tests (requires Kubernetes cluster w/ OpenFaaS or use hack/run_integration_tests.sh) - test Run unit and integration tests -``` - -To build an image with `kind`: - -```console -# only when using kind: -# export KIND_CLUSTER_NAME=kind -# export KO_DOCKER_REPO=kind.local - -export KO_DOCKER_REPO=my-docker-username -export KO_COMMIT=$(git rev-parse --short=8 HEAD) -export KO_TAG=$(git describe --abbrev=0 --tags) - -# build, push and run the router in the configured Kubernetes context -# and vmware Kubernetes namespace -ko resolve -BRf deploy/event-router-k8s.yaml | kubectl -n vmware apply -f - -``` - -To delete the deployment: - -```console -ko -n vmware delete -f deploy/event-router-k8s.yaml -``` - -> **Note:** For `_test.go` files your editor (e.g. vscode) might show errors and -> not be able to resolve symbols. This is due to the use of build tags which -> `gopls` currently does [not -> support](https://github.com/golang/go/issues/29202#issuecomment-515170916). In -> vscode add this to your configuration: -> -> ```json -> "go.toolsEnvVars": { -> "GOFLAGS": "-tags=integration,unit" -> } -> ``` \ No newline at end of file diff --git a/docs/kb/contribute-functions.md b/docs/kb/contribute-functions.md index 15301f02..6c5f2d2e 100644 --- a/docs/kb/contribute-functions.md +++ b/docs/kb/contribute-functions.md @@ -14,7 +14,31 @@ cta: The VMware Event Broker Appliance (VEBA) uses Knative as a Function-as-a-Service (FaaS) platform. If you are looking to understand the basics of functions, start [here](functions). You can also get started quickly with these quickstart -[templates](https://github.com/vmware-samples/vcenter-event-broker-appliance/tree/master/examples/knative){:target="_blank"}. +[templates](https://github.com/vmware-samples/vcenter-event-broker-appliance/tree/master/examples/knative). + + +## Table of Contents + +- [Writing your own Functions](#writing-your-own-functions) + - [Intro](#intro) + - [Instructions](#instructions) + - [Credentials (Secrets)](#credentials-secrets) + - [Dockerfile](#dockerfile) + - [Function (Business Logic) with PowerCLI](#function-business-logic-with-powercli) + - [A Note on Exception Handling](#a-note-on-exception-handling) + - [Build the Container Image](#build-the-container-image) + - [The Function Manifest](#the-function-manifest) + - [Create an Event Trigger](#create-an-event-trigger) + - [Deploy the Function in VEBA](#deploy-the-function-in-veba) + - [Coding - Best Practices](#coding---best-practices) + - [Single Responsibility Principle](#single-responsibility-principle) + - [Deterministic Behavior](#deterministic-behavior) + - [Keep Functions slim and up to date](#keep-functions-slim-and-up-to-date) + - [Keep Functions "warm"](#keep-functions-warm) + - [Return early/externalize long-running Tasks](#return-earlyexternalize-long-running-tasks) + - [Retries and Idempotency](#retries-and-idempotency) + - [Out of Order Message Arrival](#out-of-order-message-arrival) + - [Support Debugging](#support-debugging) ## Intro @@ -22,7 +46,7 @@ This guide describes how to create a function with PowerCLI (PowerShell) to apply a vSphere tag when a Virtual Machine is powered on. > **Note:** The following steps assume VMware Event Broker Appliance has been -> [installed (configured with Knative)](install-knative) and is running +> [installed (configured with Knative)](install-veba) and is running > correctly. Access to the Kubernetes environment in VEBA via `kubectl` is also > assumed to be working. @@ -47,7 +71,7 @@ and used inside a function. ### Credentials (Secrets) There's multiple ways to inject credentials or other forms of secrets into a -VEBA function. +VEBA function. The schema and encoding of your credentials is flexible and will be projected into your function using OS environment variables (can be changed). The @@ -86,7 +110,6 @@ cat << EOF > simple_token.txt a1b2c3d4e5f6g7h8i9j0 EOF - # create a JSON file holding credentials and configuration information cat << EOF > vc_creds.json { @@ -278,7 +301,7 @@ docker push ${REGISTRY}:${TAG} ### The Function Manifest Create a file `function.yaml` to wire all components together before deploying -it to VEBA. +it to VEBA. > **Note:** The following steps assume a working Knative environment using the > default Rabbit broker. The Knative service and trigger will be installed in @@ -326,10 +349,10 @@ Let's discuss some important fields here: - `env`: array with a list of additional key/value strings projected as environment variables inside the function -#### Create an Event Trigger +### Create an Event Trigger In order to have your function execute on (specific) events, e.g assign a tag -on a `DrsVmPoweredOnEvent`, we also need to create a `Trigger`. +on a `com.vmware.vsphere.DrsVmPoweredOnEvent.v0`, we also need to create a `Trigger`. ```bash cat << EOF >> function.yaml @@ -344,7 +367,7 @@ spec: broker: default filter: attributes: - subject: DrsVmPoweredOnEvent + type: com.vmware.vsphere.DrsVmPoweredOnEvent.v0 subscriber: ref: apiVersion: serving.knative.dev/v1 @@ -399,7 +422,7 @@ undesired blocking behavior. Single Responsibility Principle (SRP) is the philosophy behind the UNIX command line tools. "Do one job and do it well". Solve complex problems by breaking them down with composition where the output of one program becomes the input of the -next program. +next program. ⚠️ Generally, workflows should not be handled in functions but by workflow engines, such as vRealize Orchestrator (vRO). vRO and the VMware @@ -536,7 +559,7 @@ Function Process-Init { Your primary goal should be to avoid long-running functions (minutes) as much as possible. The longer your function runs, the more things can go wrong and you might have to start from scratch (which might not be possible without additional -persistency and safety measures in your logic). +persistency and safety measures in your logic). Usually that's an indicator that your function can be further broken down into smaller steps or could be better handled with a workflow engine, see [Single @@ -572,7 +595,7 @@ the `broker` (manual step in VEBA). Even though unlikely due to the underlying TCP/IP guarantees, but nevertheless possible depending on event delivery issues, concurrency, retries, etc. dealing with out of order message arrival in your function/downstream logic might be a -requirement. +requirement. Depending on the incoming event, e.g. a CloudEvent created by the `vcenter` event `provider` in VEBA, a function can use a specific ordering key (if @@ -610,7 +633,7 @@ There's one guarantee in distributed systems: Things will go wrong. Besides writing safe, secure and deterministic code (see earlier sections), it's also important to provide useful and correct debugging information by logging to standard output (which then can be forwarded to a centrally logging system for -durability). +durability). Here's another pseudo-code example (Python) which does not meet these requirements: diff --git a/docs/kb/contribute-site.md b/docs/kb/contribute-site.md index ee1be917..e535c018 100644 --- a/docs/kb/contribute-site.md +++ b/docs/kb/contribute-site.md @@ -5,13 +5,25 @@ title: VMware Event Broker Appliance - Docs description: Contributing Documentation/Website Updates permalink: /kb/contribute-site cta: - title: Have a question? + title: Have a question? description: Please check our [Frequently Asked Questions](/faq) first. --- # Contribute to the Documentation or the Website + +## Table of Contents + +- [Contribute to the Documentation or the Website](#contribute-to-the-documentation-or-the-website) + - [Structure](#structure) + - [Other Key Files and Folders](#other-key-files-and-folders) + - [Run the website locally](#run-the-website-locally) + - [Pre-Reqs](#pre-reqs) + - [Build and View Documentation](#build-and-view-documentation) + + ## Structure + The website is hosted using [Github Pages](https://help.github.com/en/github/working-with-github-pages/about-github-pages){:target="_blank"} and built using [Jekyll](https://jekyllrb.com/){:target="_blank"}. The files that make up the website are contained within the `docs` folder (as Github Pages requires) within the master branch. You'll find more details about how they are organized and their purpose below. ``` @@ -45,6 +57,7 @@ permalink: /resources # this is the short link for the page, if empty th ``` ### Other Key Files and Folders + - **_data/default.yml:** YAML content that drives the side-nav bar for the documentation - **_data/resources.yml:** YAML content for the videos, links and external references contained in the resources page - **_data/team.yml:** YAML data of the core team for the landing page @@ -57,37 +70,42 @@ permalink: /resources # this is the short link for the page, if empty th - **resources** - specifically designed for the resources page ## Run the website locally + To validate changes to any file/folder to the website, please verify them locally before you push to the repo. ### Pre-Reqs -* Install [Docker Client for your operating system](https://docs.docker.com/get-docker/) + +- Install [Docker Client for your operating system](https://docs.docker.com/get-docker/) ### Build and View Documentation -Step 1 - Change into the `docs` directory +- **Step 1:** Change into the `docs` directory -Step 2 - Run the following command to start the [Jekyll Docker container image](https://github.com/envygeeks/jekyll-docker/) and begin serving the documentation: +- **Step 2:** Run the following command to start the [Jekyll Docker container image](https://github.com/envygeeks/jekyll-docker/) and begin serving the documentation: Linux/Mac -```bash + +```console docker run --rm \ --volume="$PWD:/srv/jekyll" \ --publish 4000:4000 \ - jekyll/jekyll:3.8 \ + jekyll/jekyll:3.8.6 \ jekyll serve ``` -Windows: +Windows: + ```powershell docker run --rm ` --volume="${PWD}:/srv/jekyll" ` --publish 4000:4000 ` - jekyll/jekyll:3.8 ` + jekyll/jekyll:3.8.6 ` jekyll serve ``` > Note: You may seen a warning saying `Auto-regeneration may not work on some Windows versions.` Symptoms of this warning are the inability to automatically see any local website changes in your browser. This makes website changes difficult as you must restart Jekyll after every local change to view the results. To work around this issue, try the `--force-polling` switch to the `jekyll serve` command. -```powershell + +```console docker run --rm ` --volume="${PWD}:/srv/jekyll" ` --publish 4000:4000 ` @@ -95,9 +113,9 @@ docker run --rm ` jekyll serve --force-polling ``` -Step 3 - Once the server is ready, you can open a browser to `http://localhost:4000` to review the documentation locally. If you need to change the default port (`4000`), modify the `--publish` arguments from step 2. +- **Step 3:** Once the server is ready, you can open a browser to `http://localhost:4000` to review the documentation locally. If you need to change the default port (`4000`), modify the `--publish` arguments from step 2. -```bash +```console Configuration file: /srv/jekyll/_config.yml @@ -116,4 +134,4 @@ YAML Exception reading /srv/jekyll/site/examples-knative.md: (): did no Server running... press ctrl-c to stop. ``` -**Note:** To stop serving the documentation using the Jekyll container, press Ctrl+C \ No newline at end of file +**Note:** To stop serving the documentation using the Jekyll container, press Ctrl+C diff --git a/docs/kb/contribute-start.md b/docs/kb/contribute-start.md index 67a90987..8eaca26e 100644 --- a/docs/kb/contribute-start.md +++ b/docs/kb/contribute-start.md @@ -20,11 +20,27 @@ The VMware Event Broker Appliance team welcomes contributions from the community Before you start working with the VMware Event Broker Appliance, please read our [Developer Certificate of Origin](https://cla.vmware.com/dco){:target="_blank"}. All contributions to this repository must be signed as described on that page. Your signature certifies that you wrote the patch or have the right to pass it on as an open-source patch. + +## Table of Contents + +- [Contributing](#contributing) +- [Step-by-step help](#step-by-step-help) + - [Preqrequisites](#preqrequisites) + - [Quickstart for Contributing](#quickstart-for-contributing) + - [Download the VEBA source code](#download-the-veba-source-code) + - [Configure git to sign code with your verified name and email](#configure-git-to-sign-code-with-your-verified-name-and-email) + - [Contribute documentation changes](#contribute-documentation-changes) + - [Changing or contributing new functions](#changing-or-contributing-new-functions) + - [Submitting Bug Reports and Feature Requests](#submitting-bug-reports-and-feature-requests) + - [Pull Requests (PRs)](#pull-requests-prs) + - [Commits](#commits) + - [Breaking Changes](#breaking-changes) + # Step-by-step help If you're just starting out with containers and source control and are looking for additional guidance, browse to this [blog series](http://www.patrickkremer.com/veba/){:target="_blank"} on VEBA. The blog goes step-by-step with screenshots and assumes zero experience with any of the required tooling. -# Preqrequisites +## Preqrequisites You must create a [Github](https://github.com/join){:target="_blank"} account. You need to verify your email with Github in order to contribute to the VEBA repository. @@ -33,27 +49,31 @@ The following tools are required: * [Docker](https://docs.docker.com/){:target="_blank"} * [Knative CLI](https://knative.dev/docs/install/install-kn/){:target="_blank"} -# Quickstart for Contributing +## Quickstart for Contributing + +### Download the VEBA source code -## Download the VEBA source code ```bash git clone https://github.com/vmware-samples/vcenter-event-broker-appliance ``` -## Configure git to sign code with your verified name and email +### Configure git to sign code with your verified name and email + ```bash git config --global user.name "Your Name" git config --global user.email "youremail@domain.com" ``` -## Contribute documentation changes +### Contribute documentation changes + +Make the necessary changes and save your files. -Make the necessary changes and save your files. ```bash git diff ``` This is sample output from git. It will show you files that have changed as well as all display all changes. + ```bash user@wrkst01 MINGW64 ~/Documents/git/vcenter-event-broker-appliance(master) $ git diff @@ -63,17 +83,16 @@ index 4245046..f86f09f 100644 +++ b/docs/kb/contribute-start.md @@ -6,6 +6,32 @@ description: Getting Started permalink: /kb/contribute-start - --- +--- +# Preqrequisites + -+Three tools are required in order to contribute functions - ++Three tools are required in order to contribute functions - (output truncated) ``` Commit the code and push your commit. -a commits all changed files, -s signs your commit, and -m is a commit message - a short description of your change. - ```bash git commit -a -s -m "Add prereq and git diff output to contribution page." git push @@ -81,9 +100,9 @@ git push You can then submit a pull request (PR) to the VEBA maintainers - a step-by-step guide with screenshots is available [here](http://www.patrickkremer.com/2019/12/vcenter-event-broker-appliance-part-v-contributing-to-the-veba-project/){:target="_blank"} -# Changing or contributing new functions +### Changing or contributing new functions -The git commands are the same, but in order to change code, you must reference your own Docker image. The example YAML below comes from the Knative [kn-pcli-tag]](https://github.com/vmware-samples/vcenter-event-broker-appliance/tree/master/examples/knative/powercli/kn-pcli-tag){:target="_blank"} sample function. +The git commands are the same, but in order to change code, you must reference your own Docker image. The example YAML below comes from the Knative [kn-pcli-tag](https://github.com/vmware-samples/vcenter-event-broker-appliance/tree/master/examples/knative/powercli/kn-pcli-tag) sample function. > Note: The `image:` references the `vmware` harbor registry account. You must change this to your own docker account. @@ -94,17 +113,15 @@ metadata: name: kn-pcli-tag labels: app: veba-ui +spec: template: metadata: annotations: autoscaling.knative.dev/maxScale: "1" autoscaling.knative.dev/minScale: "1" -spec: - template: - metadata: spec: containers: - - image: projects.registry.vmware.com/veba/kn-pcli-tag:1.1 + - image: ghcr.io/vmware-samples/vcenter-event-broker-appliance/kn-pcli-tag:1.5 envFrom: - secretRef: name: tag-secret @@ -122,8 +139,7 @@ spec: broker: default filter: attributes: - type: com.vmware.event.router/event - subject: DrsVmPoweredOnEvent + type: com.vmware.vsphere.DrsVmPoweredOnEvent.v0 subscriber: ref: apiVersion: serving.knative.dev/v1 @@ -132,12 +148,14 @@ spec: ``` Once you've written or changed function code, you can deploy it to your VEBA appliance for testing. + ```bash export TAG= docker build -t /kn-pcli-tag:${TAG} . docker push /kn-pcli-tag:${TAG} kubectl -n vmware-functions apply -f function.yaml ``` + If everything works as expected, you can then commit your code and file a pull request for inclusion into the project. ## Submitting Bug Reports and Feature Requests @@ -151,12 +169,13 @@ Feature requests should fall within the scope of the project. ## Pull Requests (PRs) Before submitting a pull request, please make sure that your change satisfies the following requirements: + - VMware Event Broker Appliance can be built and deployed. See the getting started build guide [here](contribute-eventrouter.md). - The change is signed as described by the [Developer Certificate of Origin](https://cla.vmware.com/dco){:target="_blank"} doc. - The change is clearly documented and follows Git commit [best practices](https://chris.beams.io/posts/git-commit/){:target="_blank"} - Contributions to the [examples](/examples) contain a titled readme. -### Commits +## Commits Please follow the guidance provided [here](https://chris.beams.io/posts/git-commit/) how to write good commit @@ -182,7 +201,7 @@ git add git commit -s -m "fix: Race in VMware Event Router" -m "Closes: #issue-number" ``` -### Breaking Changes +## Breaking Changes If this PR introduces a **breaking** change, please indicate this in the corresponding commit: diff --git a/docs/kb/deploy-event-router-kind.md b/docs/kb/deploy-event-router-kind.md deleted file mode 100644 index 465326ce..00000000 --- a/docs/kb/deploy-event-router-kind.md +++ /dev/null @@ -1,312 +0,0 @@ ---- -layout: docs -toc_id: deploy-event-router-kind -title: Deploy Event Router to Kind -description: Deploy Event Router to Kind -permalink: /kb/deploy-event-router-kind ---- - -# Installation of VMware Event Router with `kind` - -The following steps describe the installation of the [VMware Event -Router](https://github.com/vmware-samples/vcenter-event-broker-appliance/tree/master/vmware-event-router) -in a local [kind](https://kind.sigs.k8s.io/) cluster and [Knative](https://knative.dev/) environment. - -The steps assume a Mac OSX environment but the links provide resources to -install the components for other platforms. - -## Install Knative with [KonK](https://github.com/csantanapr/knative-kind). - -Requires: - -- [Docker](https://www.docker.com/products/docker-desktop) -- [kind](https://github.com/kubernetes-sigs/kind) -- kubectl - -```console -export KIND_CLUSTER_NAME=kind -curl -sL get.konk.dev | bash -``` - -## Install Knative CLI `kn` - -[kn](https://knative.dev/docs/client/install-kn/) lets you work with Knative -resources, e.g. services, brokers, etc. instead of using kubectl. - -```console -brew install knative/client/kn - -kn version -Version: v0.25.1 -Build Date: 2021-09-01T17:15:33Z -Git Revision: 99e2c927 -Supported APIs: -* Serving - - serving.knative.dev/v1 (knative-serving v0.25.0) -* Eventing - - sources.knative.dev/v1 (knative-eventing v0.25.0) - - eventing.knative.dev/v1 (knative-eventing v0.25.0) -``` - -## Install Sockeye (recommended) - -[`Sockeye`](https://github.com/n3wscott/sockeye/) lets you view incoming events in the browser, which can be helpful with troubleshooting. - -```console -kubectl apply -f https://github.com/n3wscott/sockeye/releases/download/v0.7.0/release.yaml -service.serving.knative.dev/sockeye created -``` - -Open the Sockeye UI: - -```console -kn service list -NAME URL LATEST AGE CONDITIONS READY REASON -hello http://hello.default.127.0.0.1.nip.io hello-00001 14m 3 OK / 3 True -sockeye http://sockeye.default.127.0.0.1.nip.io sockeye-00001 6m4s 3 OK / 3 True - -open http://sockeye.default.127.0.0.1.nip.io -``` - -💡 The KonK stack uses `nip.io` so you can access Knative services from your -local machine via the shown URLs. - -To avoid missing an event, disable scale-to-zero for the `Sockeye` Knative `service`. Note that this -might only happen because we're using an in-memory `broker` using goroutines as -channels which is not intended for production use. - -```console -kn service update --scale 1 sockeye -Updating Service 'sockeye' in namespace 'default': - - 0.032s The Configuration is still working to reflect the latest desired specification. - 4.340s Traffic is not yet migrated to the latest revision. - 4.411s Ingress has not yet been reconciled. - 4.470s Waiting for load balancer to be ready - 4.611s Ready to serve. - -Service 'sockeye' updated to latest revision 'sockeye-00002' is available at URL: -http://sockeye.default.127.0.0.1.nip.io -``` - -## Install vCenter Simulator (Event Provider) - -To trigger events, e.g. from vSphere, we can use [`vcsim`](https://github.com/vmware/govmomi/tree/master/vcsim). - -```console -cat << EOF | kubectl create -f - -apiVersion: apps/v1 -kind: Deployment -metadata: - name: vcsim -spec: - selector: - matchLabels: - app: vcsim - template: - metadata: - labels: - app: vcsim - spec: - containers: - - name: vcsim - image: vmware/vcsim:latest - args: ["/vcsim", "-l", ":8989"] - ports: - - name: https - containerPort: 8989 - ---- -apiVersion: v1 -kind: Service -metadata: - name: vcsim -spec: - selector: - app: vcsim - ports: - - name: https - port: 443 - targetPort: 8989 -EOF - -deployment.apps/vcsim created -service/vcsim created -``` - -## Install `govc` - -[`govc`](https://github.com/vmware/govmomi/tree/master/govc) is used to perform -operations against the (simulated) vCenter, e.g. powering off a virtual machine -which will trigger a corresponding event. - -```console -brew install govc - -govc about -govc: specify an ESX or vCenter URL -``` - -## Install `Helm` - -The easiest way to deploy the VMware Event Router is via -[Helm](https://helm.sh/). - -```console -brew install helm - -helm version -version.BuildInfo{Version:"v3.7.1", GitCommit:"1d11fcb5d3f3bf00dbe6fe31b8412839a96b3dc4", GitTreeState:"clean", GoVersion:"go1.17.2"} -``` - -## Add the VMware Event Router Helm Repo - -```console -helm repo add vmware-veba https://projects.registry.vmware.com/chartrepo/veba - -# update index in case the repo was already installed -helm repo update - -# ignore the index error message which is due to the Harbor environment -helm search repo event-router -index.go:346: skipping loading invalid entry for chart "event-router" "release-0.5.0" from /Users/mgasch/Library/Caches/helm/repository/vmware-veba-index.yaml: validation: chart.metadata.version "release-0.5.0" is invalid -NAME CHART VERSION APP VERSION DESCRIPTION -vmware-veba/event-router v0.7.0 v0.7.0 The VMware Event Router is used to connect to v... -``` - -## Deploy VMware Event Router - -Before installing the VMware Event Router create a configuration (Helm -"override") file (passed via `-f -` and read from stdin). - -The following commands assume a Knative `broker` in the `default` Kubernetes -namespace with the name `example-broker`. As of writing this document these are -the values used by the KonK stack. You can verify this via: - -```console -kubectl get brokers -A -NAMESPACE NAME URL AGE READY REASON -default example-broker http://broker-ingress.knative-eventing.svc.cluster.local/default/example-broker 28m True -``` - -It is also assumed that you created the `vcsim` deployment as shown above, -otherwise change the address and settings if you have done a custom deployment. - -```console -# create the deployment "router" in the "vmware-system" namespace -cat << EOF | helm install -n vmware-system --create-namespace -f - router vmware-veba/event-router -eventrouter: - config: - logLevel: debug - vcenter: - address: https://vcsim.default.svc.cluster.local - username: user - password: pass - insecure: true # ignore TLS certs - eventProcessor: knative - knative: - destination: - ref: - apiVersion: eventing.knative.dev/v1 - kind: Broker - name: example-broker - namespace: default -EOF -``` - -Verify the `router` is correctly running, otherwise make sure you followed the steps as described above: - -```console -kubectl -n vmware logs deploy/router - - _ ____ ___ ______ __ ____ __ -| | / / |/ / ______ _________ / ____/ _____ ____ / /_ / __ \____ __ __/ /____ _____ -| | / / /|_/ / | /| / / __ / ___/ _ \ / __/ | | / / _ \/ __ \/ __/ / /_/ / __ \/ / / / __/ _ \/ ___/ -| |/ / / / /| |/ |/ / /_/ / / / __/ / /___ | |/ / __/ / / / /_ / _, _/ /_/ / /_/ / /_/ __/ / -|___/_/ /_/ |__/|__/\__,_/_/ \___/ /_____/ |___/\___/_/ /_/\__/ /_/ |_|\____/\__,_/\__/\___/_/ - -2021-11-19T13:37:34.243Z WARN [VCENTER] vcenter/vcenter.go:126 using potentially insecure connection to vCenter {"address": "https://vcsim.default.svc.cluster.local", "insecure": true} -2021-11-19T13:37:34.243Z INFO [MAIN] router/main.go:114 connecting to vCenter {"commit": "82df3ff", "version": "v0.7.0", "address": "https://vcsim.default.svc.cluster.local"} -2021-11-19T13:37:34.262Z INFO [KNATIVE] injection/injection.go:61 Starting informers... -2021-11-19T13:37:34.263Z INFO [MAIN] router/main.go:169 created Knative processor {"commit": "82df3ff", "version": "v0.7.0", "sink": "http://broker-ingress.knative-eventing.svc.cluster.local/default/example-broker"} -2021-11-19T13:37:34.374Z WARN [METRICS] metrics/server.go:59 disabling basic auth: no authentication data provided -2021-11-19T13:37:34.375Z INFO [METRICS] metrics/server.go:98 starting metrics server {"address": "http://0.0.0.0:8082/stats"} -2021-11-19T13:37:34.375Z INFO [VCENTER] vcenter/vcenter.go:213 checkpointing disabled, setting begin of event stream {"beginTimestamp": "2021-11-19 13:37:34.3756582 +0000 UTC"} -2021-11-19T13:37:35.000Z DEBUG [VCENTER] vcenter/vcenter.go:313 no new events, backing off {"delaySeconds": 1} -2021-11-19T13:37:36.001Z DEBUG [VCENTER] vcenter/vcenter.go:313 no new events, backing off {"delaySeconds": 2} -``` - -💡 You can easily remove the Helm installation with `helm -n vmware-system uninstall -router`. - -## Trigger an Event - -Trigger an event and observe the output in the `Sockeye` UI (browser). - -**Notes:** - -- If you reload the `Sockeye` UI it will discard previous events (stateless) -- Since we're using an in-memory Knative Broker (non-production), in **rare** - cases, some events are lost - if you feel the event should have gone through, - please retry by triggering the event again - -Create a Knative [`Trigger`](https://knative.dev/docs/eventing/broker/triggers/) -to subscribe to the `Broker` for (all) incoming events: - -```console -# assumes example-broker in default namespace -kn trigger create sockeye --broker example-broker --sink ksvc:sockeye -Trigger 'sockeye' successfully created in namespace 'default'. - -# conditions must show 5/5 indicating READY -kn trigger list -NAME BROKER SINK AGE CONDITIONS READY REASON -hello-display example-broker ksvc:hello-display 53m 5 OK / 5 True -sockeye example-broker ksvc:sockeye 10s 5 OK / 5 True -``` - -💡 Optionally a filter to only subscribe to specific events can be specified. - -Open the `Sockeye` UI: - -```console -open http://sockeye.default.127.0.0.1.nip.io -``` - -In a separate terminal create a Kubernetes port-forwarding so we can use `govc` to connect to `vcsim` running inside Kubernetes. - -```console -kubectl port-forward deploy/vcsim 8989:8989 -Forwarding from 127.0.0.1:8989 -> 8989 -Forwarding from [::1]:8989 -> 8989 -``` - -Open another terminal to trigger an event. First, set `govc` environment -variables (connection): - -```console -export GOVC_INSECURE=true -export GOVC_URL=https://user:pass@127.0.0.1:8989/sdk - -# verify govc connects correctly by printing the vcsim inventory -govc ls -/DC0/vm -/DC0/host -/DC0/datastore -/DC0/network -``` - -Trigger an event and observe the output in `Sockeye`: - -```console -govc vm.power -off /DC0/vm/DC0_H0_VM0 -Powering off VirtualMachine:vm-54... OK -``` - -`Sockeye` should show a `VmStoppingEvent` followed by a `VmPoweredOffEvent`. - - - -If you don't see any output, make sure you followed all steps above, with -correct naming and that all resources (`broker`, `trigger`, `service`, `router`, -etc.) are in a `READY` state. \ No newline at end of file diff --git a/docs/kb/deploy-tanzu-sources-kind.md b/docs/kb/deploy-tanzu-sources-kind.md new file mode 100644 index 00000000..45e5b320 --- /dev/null +++ b/docs/kb/deploy-tanzu-sources-kind.md @@ -0,0 +1,642 @@ +--- +layout: docs +toc_id: deploy-tanzu-sources-kind +title: Deploy Tanzu Sources with KinD +description: Deploy Tanzu Sources with KinD +permalink: /kb/deploy-tanzu-sources-kind +--- + +# Deploy Tanzu Sources with KinD + +It is possible to mimic VEBA's base functionalities on your local computer by +using KinD. KinD, short for "Kubernetes in Docker," is an open-source project +that provides a lightweight and easy way to create Kubernetes clusters for +development and testing purposes. + + +## Table of Contents + +- [Deploy Tanzu Sources with KinD](#deploy-tanzu-sources-with-kind) + - [Prerequisites](#prerequisites) + - [Install the Tanzu Sources on KinD](#install-the-tanzu-sources-on-kind) + - [Install Event Viewer Application Sockeye](#install-event-viewer-application-sockeye) + - [Provider Type vcsim](#provider-type-vcsim) + - [Run the vCenter Simulator](#run-the-vcenter-simulator) + - [Create a vcsim VSphereSource](#create-a-vcsim-vspheresource) + - [Install the govc CLI](#install-the-govc-cli) + - [Troubleshooting](#troubleshooting) + - [Delete a VSphereSource](#delete-a-vspheresource) + - [Delete a HorizonSource](#delete-a-horizonsource) + - [Delete a KinD Cluster](#delete-a-kind-cluster) + +## Prerequisites + +The following prerequisites must be in place: + +- [KinD](https://kind.sigs.k8s.io/docs/user/quick-start/) installed +- Kubernetes CLI + [`kubectl`](https://kubernetes.io/docs/tasks/tools/install-kubectl) installed +- Knative CLI [`kn`](https://knative.dev/docs/install/quickstart-install/) + installed +- Knative CLI plugin + [quickstart](https://knative.dev/docs/install/quickstart-install/#install-the-knative-quickstart-plugin) + installed + +The Knative CLI plugin `quickstart` uses `kind` to create a new Kubernetes cluster locally. +Additionally, it also installs the two Knative subprojects `Serving` and `Eventing`. + +**Example:** + +```console +kn quickstart kind --registry + +Running Knative Quickstart using Kind +✅ Checking dependencies... + Kind version is: 0.20.0 +💽 Installing local registry... +☸ Creating Kind cluster... +Creating cluster "knative" ... + ✓ Ensuring node image (kindest/node:v1.26.6) 🖼 + ✓ Preparing nodes 📦 + ✓ Writing configuration 📜 + ✓ Starting control-plane 🕹️ + ✓ Installing CNI 🔌 + ✓ Installing StorageClass 💾 + ✓ Waiting ≤ 2m0s for control-plane = Ready ⏳ + • Ready after 15s 💚 +Set kubectl context to "kind-knative" +You can now use your cluster with: + +kubectl cluster-info --context kind-knative + +Have a nice day! 👋 + +🍿 Installing Knative Serving v1.12.0 ... + CRDs installed... + Core installed... + Finished installing Knative Serving +🕸️ Installing Kourier networking layer v1.12.0 ... + Kourier installed... + Ingress patched... + Finished installing Kourier Networking layer +🕸 Configuring Kourier for Kind... + Kourier service installed... + Domain DNS set up... + Finished configuring Kourier +🔥 Installing Knative Eventing v1.12.0 ... + CRDs installed... + Core installed... + In-memory channel installed... + Mt-channel broker installed... + Example broker installed... + Finished installing Knative Eventing +🚀 Knative install took: 2m23s +🎉 Now have some fun with Serverless and Event Driven Apps! +``` + +The above provided output outlines the successful installation of a new +Kubernetes cluster, with having Knative `Serving` and `Eventing` installed. + +Validate the installation: + +```console +kubectl get deploy,po -A + +NAMESPACE NAME READY UP-TO-DATE AVAILABLE AGE +knative-eventing deployment.apps/eventing-controller 1/1 1 1 63s +knative-eventing deployment.apps/eventing-webhook 1/1 1 1 63s +knative-eventing deployment.apps/imc-controller 1/1 1 1 31s +knative-eventing deployment.apps/imc-dispatcher 1/1 1 1 31s +knative-eventing deployment.apps/mt-broker-controller 1/1 1 1 21s +knative-eventing deployment.apps/mt-broker-filter 1/1 1 1 21s +knative-eventing deployment.apps/mt-broker-ingress 1/1 1 1 21s +knative-eventing deployment.apps/pingsource-mt-adapter 0/0 0 0 63s +knative-serving deployment.apps/activator 1/1 1 1 108s +knative-serving deployment.apps/autoscaler 1/1 1 1 108s +knative-serving deployment.apps/controller 1/1 1 1 108s +knative-serving deployment.apps/net-kourier-controller 1/1 1 1 91s +knative-serving deployment.apps/webhook 1/1 1 1 108s +kourier-system deployment.apps/3scale-kourier-gateway 1/1 1 1 90s +kube-system deployment.apps/coredns 2/2 2 2 2m11s +local-path-storage deployment.apps/local-path-provisioner 1/1 1 1 2m10s + +NAMESPACE NAME READY STATUS RESTARTS AGE +knative-eventing pod/eventing-controller-79547fd7f4-x48pg 1/1 Running 0 63s +knative-eventing pod/eventing-webhook-8458d5898c-sclpj 1/1 Running 0 63s +knative-eventing pod/imc-controller-6d55d956f-dlj78 1/1 Running 0 31s +knative-eventing pod/imc-dispatcher-895bfd847-c8hnj 1/1 Running 0 31s +knative-eventing pod/mt-broker-controller-6754559b7c-29jvc 1/1 Running 0 21s +knative-eventing pod/mt-broker-filter-7475984f8-gjm44 1/1 Running 0 21s +knative-eventing pod/mt-broker-ingress-6786db9bfd-8j67c 1/1 Running 0 21s +knative-serving pod/activator-8c964665f-wzw5t 1/1 Running 0 108s +knative-serving pod/autoscaler-5fc869cc5-x545x 1/1 Running 0 108s +knative-serving pod/controller-5946d56bc-shcsz 1/1 Running 0 108s +knative-serving pod/net-kourier-controller-d46684575-xdscv 1/1 Running 0 91s +knative-serving pod/webhook-75d84c68b9-bfmrx 1/1 Running 0 108s +kourier-system pod/3scale-kourier-gateway-6f84654dc4-klbfc 1/1 Running 0 90s +kube-system pod/coredns-787d4945fb-79smc 1/1 Running 0 117s +kube-system pod/coredns-787d4945fb-978th 1/1 Running 0 117s +kube-system pod/etcd-knative-control-plane 1/1 Running 0 2m11s +kube-system pod/kindnet-hnhml 1/1 Running 0 117s +kube-system pod/kube-apiserver-knative-control-plane 1/1 Running 0 2m11s +kube-system pod/kube-controller-manager-knative-control-plane 1/1 Running 0 2m12s +kube-system pod/kube-proxy-j8qwh 1/1 Running 0 117s +kube-system pod/kube-scheduler-knative-control-plane 1/1 Running 0 2m11s +local-path-storage pod/local-path-provisioner-6bd6454576-v46rk 1/1 Running 0 117s +``` + +## Install the Tanzu Sources on KinD + +```console +kubectl apply -f https://github.com/vmware-tanzu/sources-for-knative/releases/latest/download/release.yaml +``` + +By default the [Channel based +Broker](https://knative.dev/docs/eventing/brokers/broker-types/channel-based-broker/) +is shipped with Knative Eventing. The installation of the KinD cluster also +includes the creation of an +[InMemoryChannel](https://github.com/knative/eventing/blob/release-1.12/config/channels/in-memory-channel/README.md) +broker for event routing. + +The broker got installed into the `default` namespace: + +```console +kn broker list + +NAME URL AGE CONDITIONS READY REASON +example-broker http://broker-ingress.knative-eventing.svc.cluster.local/default/example-broker 14m 6 OK / 6 True +``` + +```console +kubectl get broker + +NAME URL AGE READY REASON +example-broker http://broker-ingress.knative-eventing.svc.cluster.local/default/example-broker 14m True +``` + +If you would like to receive events from an existing vSphere environment, create a new `VShereSource` like described in section [Create a new VSphereSource via CLI](#create-a-new-vspheresource-via-cli) above. + +## Install Event Viewer Application Sockeye + +Sockeye lets you view incoming events in the browser, which can be helpful with +troubleshooting as well as when creating new functions. + +Install Sockeye by simply executing `kubectl apply -f https://github.com/n3wscott/sockeye/releases/download/v0.7.0/release.yaml` +or by applying the following manifest file: + +```yaml +apiVersion: serving.knative.dev/v1 +kind: Service +metadata: + name: sockeye + namespace: default +spec: + template: + spec: + containerConcurrency: 0 + containers: + - image: n3wscott/sockeye:v0.7.0 +``` + +If not adjusted, the new Knative Service (`ksvc`) will be created in the `default` namespace: + +```console +kn service list + +NAME URL LATEST AGE CONDITIONS READY REASON +sockeye http://sockeye.default.127.0.0.1.sslip.io sockeye-00001 15m 3 OK / 3 True +``` + +Update the `ksvc` Sockeye to be not automatically scaled to 0 by Knative: + +```console +kn service update --scale 1 sockeye +``` + +This command will set the values for `autoscaling.knative.dev/max-scale` as well +as for `.../min-scale` to `1`. + +In order to ultimately receive events from a `broker`, a `trigger` for Sockeye +must be created: + +```console +kn trigger create sockeye --broker example-broker --sink ksvc:sockeye +``` + +Validate the conditions of the trigger: + +```console +kn trigger list + +NAME BROKER SINK AGE CONDITIONS READY REASON +sockeye example-broker ksvc:sockeye 19m 7 OK / 7 True +``` + +You should see incoming events from the vCenter server now. Use the log output +for this: + +```console +kubectl logs sockeye-00004-deployment-759dc8cffc-p6ttk +``` + +**Example:** + +```json +[...] +Context Attributes, + specversion: 1.0 + type: com.vmware.vsphere.DrsVmPoweredOnEvent.v0 + source: https://vcsa.mydomain.com/sdk + id: 16957152 + time: 2023-11-27T10:00:08.715999Z + datacontenttype: application/json +Extensions, + eventclass: event + knativearrivaltime: 2023-11-27T10:00:12.697365304Z + vsphereapiversion: 8.0.2.0 +Data, + { + "Key": 16957152, + "ChainId": 16957145, + "CreatedTime": "2023-11-27T10:00:08.715999Z", + "UserName": "mydomain.com\\Administrator", + "Datacenter": { + "Name": "DC1", + "Datacenter": { + "Type": "Datacenter", + "Value": "datacenter-1" + } + }, + "ComputeResource": { + "Name": "Cluster1", + "ComputeResource": { + "Type": "ClusterComputeResource", + "Value": "domain-c8" + } + }, + "Host": { + "Name": "esx01.mydomain.com", + "Host": { + "Type": "HostSystem", + "Value": "host-15" + } + }, + "Vm": { + "Name": "vm1", + "Vm": { + "Type": "VirtualMachine", + "Value": "vm-81" + } + }, + "Ds": null, + "Net": null, + "Dvs": null, + "FullFormattedMessage": "DRS powered on vm1 on esx01.mydomain.com in DC1", + "ChangeTag": "", + "Template": false + } +[...] +``` + +## Provider Type vcsim + +The [vcsim](https://github.com/vmware/govmomi/tree/main/vcsim) provider is a Go +application to simulate VMware vCenter Server environments. + +⚠️ This provider is for experimental usage only! It is limited in its +functionalities and not comparable with a real VMware vCenter Server +environment. + +### Run the vCenter Simulator + +Run the simulator e.g. as a pod on your Kubernetes cluster in a dedicated namespace +named `ns-vcsim` for example. + +Create the new namespace: + +```console +kubectl create ns ns-vcsim + +namespace/ns-vcsim created +``` + +Instantiate the `vcsim` pod: + +```console +kubectl -n ns-vcsim run vcsim --image=vmware/vcsim:v0.33.0 --port=8989 --image-pull-policy=Always + +pod/vcsim created +``` + +Create a new Kubernetes `Service` to expose the pod on the cluster: + +```console +kubectl -n ns-vcsim expose pod vcsim + +service/vcsim exposed +``` + +### Create a vcsim VSphereSource + +Create a new `VSphereSource` to receive events from `vcsim`. The source will be +created within the same namespace `ns-vcsim`. + +Begin with the `auth` part like describe before in section [Create a new VSphereSource via CLI](#create-a-new-vspheresource-via-cli). + +```console +kn vsphere auth create \ +--namespace ns-vcsim \ +--username user \ +--password pass \ +--name vcsim-creds \ +--verify-url https://127.0.0.1:8989/sdk \ +--verify-insecure +``` + +Create the new `VSphereSource`: + +```console +kn vsphere source create \ +--namespace ns-vcsim \ +--name vcsim-source \ +--vc-address https://vcsim.ns-vcsim:8989/sdk \ +--skip-tls-verify \ +--secret-ref vcsim-creds \ +--sink-uri http://broker-ingress.knative-eventing.svc.cluster.local/default/example-broker \ +--encoding json +``` + +Validate the condition of the source: + +```console +kn vsphere source list -n ns-vcsim + +NAME VCENTER INSECURE CREDENTIALS AGE CONDITIONS READY REASON +vcsim-source https://vcsim.ns-vcsim:8989/sdk true vcsim-creds 5m53s 3 OK / 3 True +``` + +Additionally, check the logs: + +```console +kubectl -n ns-vcsim logs vcsim-source-adapter-6576ff85fb-s6bbw +{"level":"warn","ts":"2023-12-05T14:41:45.035Z","logger":"vsphere-source-adapter","caller":"v2/config.go:198","msg":"Tracing configuration is invalid, using the no-op default{error 26 0 empty json tracing config}","commit":"bd08a1c-dirty"} +{"level":"warn","ts":"2023-12-05T14:41:45.035Z","logger":"vsphere-source-adapter","caller":"v2/config.go:191","msg":"Sink timeout configuration is invalid, default to -1 (no timeout)","commit":"bd08a1c-dirty"} +{"level":"info","ts":"2023-12-05T14:41:45.051Z","logger":"vsphere-source-adapter","caller":"kvstore/kvstore_cm.go:54","msg":"Initializing configMapKVStore...","commit":"bd08a1c-dirty"} +{"level":"info","ts":"2023-12-05T14:41:45.057Z","logger":"vsphere-source-adapter","caller":"vsphere/adapter.go:92","msg":"configuring checkpointing","commit":"bd08a1c-dirty","ReplayWindow":"5m0s","Period":"10s"} +{"level":"warn","ts":"2023-12-05T14:41:45.057Z","logger":"vsphere-source-adapter","caller":"vsphere/adapter.go:131","msg":"could not retrieve checkpoint configuration","commit":"bd08a1c-dirty","error":"key checkpoint does not exist"} +{"level":"info","ts":"2023-12-05T14:41:45.057Z","logger":"vsphere-source-adapter","caller":"vsphere/adapter.go:311","msg":"no valid checkpoint found","commit":"bd08a1c-dirty"} +{"level":"info","ts":"2023-12-05T14:41:45.057Z","logger":"vsphere-source-adapter","caller":"vsphere/adapter.go:312","msg":"setting begin of event stream","commit":"bd08a1c-dirty","beginTimestamp":"2023-12-05 14:41:45.057729228 +0000 UTC"} +``` + +### Install the govc CLI + +[`govc`](https://github.com/vmware/govmomi/tree/master/govc) is used to perform +operations against the (simulated) vCenter, e.g. powering off a virtual machine +which will trigger a corresponding event. + +```console +brew install govc + +govc about +govc: specify an ESX or vCenter URL +``` + +In a separate terminal create a Kubernetes port-forwarding so we can use `govc` +to connect to `vcsim` running inside Kubernetes: + +```console +kubectl -n ns-vcsim port-forward pod/vcsim 8989:8989 + +Forwarding from 127.0.0.1:8989 -> 8989 +Forwarding from [::1]:8989 -> 8989 +``` + +Open the logs of the instantiated container: + +```console +kubectl -n ns-vcsim logs vcsim + +export GOVC_URL=https://user:pass@10.244.0.73:8989/sdk GOVC_SIM_PID=1 +``` + +If the information above isn't displayed anymore, just replace the pod IP +address with the one you'll receive from `kubectl -n ns-vcsim get pods -o wide`. + +Open another terminal to trigger an event. First, set `govc` environment +variables (connection): + +```console +# ignore self-signed certificate warnings +export GOVC_INSECURE=1 + +# use default credentials and local port-forwarding address +export GOVC_URL=https://user:pass@127.0.0.1:8989/sdk GOVC_SIM_PID=1 +``` + +List all available resources of the simulated vSphere environment. + +```console +govc ls + +/DC0/vm +/DC0/host +/DC0/datastore +/DC0/network +``` + +Trigger an event and observe the output in `Sockeye`: + +```console +govc vm.power -off /DC0/vm/DC0_H0_VM0 + +Powering off VirtualMachine:vm-55... OK +``` + +`Sockeye` should show a `com.vmware.vsphere.VmStoppingEvent.v0` event followed by a `com.vmware.vsphere.VmPoweredOffEvent.v0` event. +. + +```json +[...] + +got Validation: valid +Context Attributes, + specversion: 1.0 + type: com.vmware.vsphere.VmStoppingEvent.v0 + source: https://vcsim.ns-vcsim:8989/sdk + id: 40 + time: 2023-12-05T13:06:12.871792908Z + datacontenttype: application/json +Extensions, + eventclass: event + knativearrivaltime: 2023-12-05T13:06:13.764523682Z + vsphereapiversion: 6.5 +Data, + { + "Key": 40, + "ChainId": 40, + "CreatedTime": "2023-12-05T13:06:12.871792908Z", + "UserName": "user", + "Datacenter": { + "Name": "DC0", + "Datacenter": { + "Type": "Datacenter", + "Value": "datacenter-2" + } + }, + "ComputeResource": { + "Name": "DC0_H0", + "ComputeResource": { + "Type": "ComputeResource", + "Value": "computeresource-23" + } + }, + "Host": { + "Name": "DC0_H0", + "Host": { + "Type": "HostSystem", + "Value": "host-21" + } + }, + "Vm": { + "Name": "DC0_H0_VM0", + "Vm": { + "Type": "VirtualMachine", + "Value": "vm-55" + } + }, + "Ds": { + "Name": "LocalDS_0", + "Datastore": { + "Type": "Datastore", + "Value": "datastore-52" + } + }, + "Net": null, + "Dvs": null, + "FullFormattedMessage": "DC0_H0_VM0 on host DC0_H0 in DC0 is stopping", + "ChangeTag": "", + "Template": false + } + +[...] +``` + +If you don't see any output, make sure you followed all steps above, with +correct naming and that all resources (`broker`, `trigger`, `service`, `router`, +etc.) are in a `READY` state. + +## Troubleshooting + +All components follow the Knative logging convention. +The log level (`debug`, `info`, `error`, etc. is configurable per component, +e.g. `vsphere-source-webhook`, `VSphereSource` adapter, etc. + +The default logging level is `info`. + +The log level for adapters, e.g. a particular `VSphereSource` `deployment` can +be changed at runtime via the `config-logging` `ConfigMap` which is +[created](./config/config-logging.yaml) when deploying the Tanzu Sources for +Knative manifests in this repository. + +⚠️ **Note:** These settings will affect **all adapter** (created sources) deployments. +Changes to a particular adapter deployment are currently not possible. + +```console +kubectl -n vmware-sources edit cm config-logging +``` + +An interactive editor opens. Change the settings in the JSON object under the +`zap-logger-config` key. For example, to change the log level from `info` to +`debug` use this configuration in the editor: + +```yaml +apiVersion: v1 +data: + # details omitted + zap-logger-config: | + { + "level": "debug" + "development": false, + "outputPaths": ["stdout"], + "errorOutputPaths": ["stderr"], + "encoding": "json", + "encoderConfig": { + "timeKey": "ts", + "levelKey": "level", + "nameKey": "logger", + "callerKey": "caller", + "messageKey": "msg", + "stacktraceKey": "stacktrace", + "lineEnding": "", + "levelEncoder": "", + "timeEncoder": "iso8601", + "durationEncoder": "", + "callerEncoder": "" + } + } +``` + +Save and leave the interactive editor to apply the `ConfigMap` changes. +Kubernetes will validate and confirm the changes: + +```console +configmap/config-logging edited +``` + +To verify that the `Source` adapter owners (e.g. `vsphere-source-webhook` for a +`VSphereSource`) have noticed the desired change, inspect the log messages of +the owner (here: `vsphere-source-webhook`) `Pod`: + +```console +vsphere-source-webhook-f7d8ffbc9-4xfwl vsphere-source-webhook {"level":"info","ts":"2022-03-29T12:25:20.622Z","logger":"vsphere-source-webhook","caller":"vspheresource/vsphere.go:250","msg":"update from logging ConfigMap{snip...} +``` + +⚠️ **Note:** To avoid unwanted disruption during event retrieval/delivery, the +changes are **not applied** automatically to deployed adapters, i.e. +`VSphereSource` adapter, etc. The operator is in full control over the lifecycle +(downtime) of the affected `Deployment(s)`. + +To make the changes take affect for existing adapter `Deployment`, an operator +needs to manually perform a rolling upgrade. The existing adapter `Pod` will be +terminated and a new instanced created with the desired log level changes. + +```console +kubectl get vspheresource + +NAME SOURCE SINK READY REASON +example-vc-source https://my-vc.corp.local http://broker-ingress.knative-eventing.svc.cluster.local/default/example-broker True +``` + +```console +kubectl rollout restart deployment/example-vc-source-adapter + +deployment.apps/example-vc-source-adapter restarted +``` + +⚠️ **Note:** To avoid losing events due to this (brief) downtime, consider +enabling the [Checkpointing](#configuring-checkpoint-and-event-replay) +capability. + + +More details can be found at the Tanzu Sources for Knative repository on Github - [Changing Log Levels](https://github.com/vmware-tanzu/sources-for-knative/tree/main#changing-log-levels). + +## Delete a VSphereSource + +```console +kn vsphere source delete --name vcsim-source --namespace ns-vcsim +``` + +## Delete a HorizonSource + +```console +kn source delete --name horizon-example --namespace vmware-system +``` + +## Delete a KinD Cluster + +```code +kind delete cluster --name knative + +Deleting cluster "knative" ... +Deleted nodes: ["knative-control-plane"] +``` diff --git a/docs/kb/function-tutorial-deploy.md b/docs/kb/function-tutorial-deploy.md index 91d9a2f0..271a526d 100644 --- a/docs/kb/function-tutorial-deploy.md +++ b/docs/kb/function-tutorial-deploy.md @@ -10,27 +10,36 @@ cta: actions: - text: Go back to the Function Tutorial Intro [Function Tutorial - Function Intro](function-tutorial-intro) - text: Go back to Modify and Test a Function Locally [Function Tutorial - Function Modify and Test](function-tutorial-modtest) - - text: Look at the [Build Functions](contribute-functions) page for detailed instructions on how to build your own functions. + - text: Look at the [Build Functions](contribute-functions) page for detailed instructions on how to build your own functions. - text: Look at [Troubleshoot Functions](troubleshoot-functions) on help to troubleshoot your functions. --- -# In-depth function tutorial - Deploy a Function to the VEBA Appliance +# Function Tutorial - Deploy Functions This part of the tutorial will go over: -- Pushing the [kn-ps-slack](https://github.com/vmware-samples/vcenter-event-broker-appliance/tree/master/examples/knative/powershell/kn-ps-slack) Docker container to the DockerHub registry. For this example, we will use the modification we developed in the previous example and will restrict sending a Slack webhook when a Virtual Machine is powered off AND the VM Name starts with "prod". -- Create a Kubernetes secret that contains the sensitive Slack webhook address. -- Deploy the [kn-ps-slack](https://github.com/vmware-samples/vcenter-event-broker-appliance/tree/master/examples/knative/powershell/kn-ps-slack) function to the Kubernetes cluster on the VEBA appliance. -- Verify function operation. -- Kubernetes troubleshooting commands +- Pushing the [kn-ps-slack](https://github.com/vmware-samples/vcenter-event-broker-appliance/tree/master/examples/knative/powershell/kn-ps-slack) Docker container to the DockerHub registry. For this example, we will use the modification we developed in the previous example and will restrict sending a Slack webhook when a Virtual Machine is powered off and the VM Name starts with "prod". +- Creating a Kubernetes secret that contains the sensitive Slack webhook address. +- Deploying the [kn-ps-slack](https://github.com/vmware-samples/vcenter-event-broker-appliance/tree/master/examples/knative/powershell/kn-ps-slack) function to VEBA. +- Verifying function operation. +- Troubleshooting + + ## Table of Contents -- [Push the Docker container to the DockerHub registry](#push-the-docker-container-to-the-dockerhub-registry) -- [Introduction to the Kubernetes vmware-functions namespace](#introduction-to-the=kubernetes-vmware-functions-namespace) -- [Deploy kn-ps-slack Function to the VEBA Appliance](#deploy-kn-ps-slack-function-to-the-veba-appliance) -- [Kubernetes Troubleshooting commands](#kubernetes-troubleshooting-commands) -## Push the Docker container to the DockerHub registry +- [Function Tutorial - Deploy Functions](#function-tutorial---deploy-functions) + - [Push the Docker Container to the DockerHub Registry](#push-the-docker-container-to-the-dockerhub-registry) + - [Introduction to the Kubernetes vmware-functions Namespace](#introduction-to-the-kubernetes-vmware-functions-namespace) + - [Deploy kn-ps-slack Function to VEBA](#deploy-kn-ps-slack-function-to-veba) + - [Kubernetes Troubleshooting Commands](#kubernetes-troubleshooting-commands) + - [kubectl describe](#kubectl-describe) + - [kubectl logs](#kubectl-logs) + - [kubectl exec](#kubectl-exec) + - [kubectl port-forward](#kubectl-port-forward) + +## Push the Docker Container to the DockerHub Registry + Since we made a change to the code in the `handler.ps1` file that we'd like to use, we will need to push our new Docker container to the DockerHub registry. This will then make it available to be pulled down into VEBA's Kubernetes cluster. The location of the container to use is referenced in the `function.yaml` file: @@ -49,7 +58,7 @@ spec: autoscaling.knative.dev/minScale: "1" spec: containers: - - image: ghcr.io/vmware-samples/vcenter-event-broker-appliance/kn-ps-slack:1.4 + - image: ghcr.io/vmware-samples/vcenter-event-broker-appliance/kn-ps-slack:1.7 envFrom: - secretRef: name: slack-secret @@ -59,12 +68,12 @@ spec: ``` -You can see that the default container referenced is: `ghcr.io/vmware-samples/vcenter-event-broker-appliance/kn-ps-slack:1.4`. We will replace this with our own container registry address. +You can see that the default container referenced is: `ghcr.io/vmware-samples/vcenter-event-broker-appliance/kn-ps-slack:1.7`. We will replace this with our own container registry address. First, open a command prompt/terminal and push the Docker image (replace docker-username with your Docker username): -``` -docker push /kn-ps-slack:1.1 +```console +docker push /kn-ps-slack:1.x ``` Once the push is complete, log into DockerHub and you will be able to see your container image in the registry: @@ -72,88 +81,109 @@ Once the push is complete, log into DockerHub and you will be able to see your c Note the container image name and the assigned tag. If your company uses a private registry such as [VMware Harbor Registry](https://docs.pivotal.io/vmware-harbor/index.html), the process of pushing your custom Docker image to it will be similar to the example here but may include authentication and a reference to the address of the private registry. When referencing the image in the `function.yaml`, the address of the container image will take the form of: -``` + +```console docker.io//: ``` `docker.io` references the DockerHub registry which is the default registry used by the Docker application and so can also be left off the address. If you use an alternate registry, you will need to use the full address of the registry. You may also use the following format that leaves off the default registry address (either format will work): -``` + +```console /: ``` +## Introduction to the Kubernetes vmware-functions Namespace -## Introduction to the Kubernetes vmware-functions namespace -With the Docker image pushed to the registry, we are now ready to deploy the function to the VEBA appliance. Remember, you will need to copy the Kubernetes config file to your workstation and export the `KUBECONFIG` environment variable so that the `kubectl` command can access the Kubernetes cluster on the VEBA appliance. We will use `kubectl` to deploy the function. Below is a reminder of the steps we used to copy and use the VEBA appliance config file. Getting the Kubernetes config file was covered in the intro [Function Tutorial - Function Intro](function-tutorial-intro). If you have opened a new terminal window, you may need to set the `KUBECONFIG` environment variable once more for the current session. +With the Docker image pushed to the registry, we are now ready to deploy the function to the VEBA appliance. Remember, you will need to copy the Kubernetes config file to your workstation and export the `KUBECONFIG` environment variable so that the `kubectl` command can access the Kubernetes cluster on the VEBA appliance. We will use `kubectl` to deploy the function. Below is a reminder of the steps we used to copy and use the VEBA appliance config file. Getting the Kubernetes config file was covered in the intro [Function Tutorial - Function Intro](function-tutorial-intro). If you have opened a new terminal window, you may need to set the `KUBECONFIG` environment variable once more for the current session. **Hint:** KUBECONFIG export for macOS: -``` +```console export KUBECONFIG=$HOME/veba/config ``` **Hint:** KUBECONFIG export for Windows: -``` +```console Env:KUBECONFIG="$HOME\veba\config" ``` +Kubernetes namespaces are resource boundaries within the cluster. Function related resources in the VEBA appliance are segregated into the "vmware-functions" namespace. Use `kubectl` to list out the resources in the vmware-functions namespace: -Kubernetes namespaces are resource boundaries within the cluster. Function related resources in the VEBA appliance are segregated into the "vmware-functions" namespace. Use `kubectl` to list out the resources in the vmware-functions namespace: - -``` +```console kubectl -n vmware-functions get secrets,all ``` Here is the command output: -``` +```console kubectl -n vmware-functions get secrets,all -NAME TYPE DATA AGE -secret/default-broker-rabbit Opaque 1 14d -secret/default-token-77dnr kubernetes.io/service-account-token 3 14d +NAME TYPE DATA AGE +secret/default-broker-rabbit Opaque 1 9d +secret/tag-secret Opaque 1 4d +secret/vcsa-creds Opaque 2 5d17h -NAME READY STATUS RESTARTS AGE -pod/default-broker-ingress-5c98bf68bc-mwghj 1/1 Running 0 14d -pod/sockeye-5d7db96f66-shzvp 1/1 Running 0 14d -pod/sockeye-trigger-dispatcher-7f4dbd7f78-knllr 1/1 Running 0 14d +NAME READY STATUS RESTARTS AGE +pod/default-broker-ingress-78b9f88599-2vwwn 1/1 Running 4 (2d23h ago) 9d +pod/sockeye-79b7fc7c55-klcnh 1/1 Running 4 (2d23h ago) 9d +pod/sockeye-trigger-dispatcher-84cf59c5d9-wdfqj 1/1 Running 4 (2d23h ago) 9d +pod/vcsa-source-adapter-9984f787-h7bth 1/1 Running 15 (2d23h ago) 5d17h -NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE -service/default-broker-ingress ClusterIP 10.97.111.83 80/TCP,9090/TCP 14d -service/sockeye ClusterIP 10.103.143.20 80/TCP 14d +NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE +service/default-broker-ingress ClusterIP 10.103.91.172 80/TCP,9090/TCP 9d +service/sockeye ClusterIP 10.96.207.10 80/TCP 9d -NAME READY UP-TO-DATE AVAILABLE AGE -deployment.apps/default-broker-ingress 1/1 1 1 14d -deployment.apps/sockeye 1/1 1 1 14d -deployment.apps/sockeye-trigger-dispatcher 1/1 1 1 14d +NAME READY UP-TO-DATE AVAILABLE AGE +deployment.apps/default-broker-ingress 1/1 1 1 9d +deployment.apps/sockeye 1/1 1 1 9d +deployment.apps/sockeye-trigger-dispatcher 1/1 1 1 9d +deployment.apps/vcsa-source-adapter 1/1 1 1 9d + +NAME DESIRED CURRENT READY AGE +replicaset.apps/default-broker-ingress-78b9f88599 1 1 1 9d +replicaset.apps/sockeye-79b7fc7c55 1 1 1 9d +replicaset.apps/sockeye-trigger-dispatcher-84cf59c5d9 1 1 1 9d +replicaset.apps/vcsa-source-adapter-5c8f5f58 0 0 0 9d +replicaset.apps/vcsa-source-adapter-9984f787 1 1 1 6d18h -NAME DESIRED CURRENT READY AGE -replicaset.apps/default-broker-ingress-5c98bf68bc 1 1 1 14d -replicaset.apps/sockeye-5d7db96f66 1 1 1 14d -replicaset.apps/sockeye-trigger-dispatcher-7f4dbd7f78 1 1 1 14d +NAME BROKER SUBSCRIBER_URI AGE READY REASON +trigger.eventing.knative.dev/sockeye-trigger default http://sockeye.vmware-functions.svc.cluster.local 9d True NAME URL AGE READY REASON -broker.eventing.knative.dev/default http://default-broker-ingress.vmware-functions.svc.cluster.local 14d True +broker.eventing.knative.dev/default http://default-broker-ingress.vmware-functions.svc.cluster.local 9d True + +NAME AGE +queue.rabbitmq.com/t.vmware-functions.sockeye-trig2b82649223fd0aa73465c3d599960bab 9d + +NAME AGE +binding.rabbitmq.com/t.vmware-functions.sockeye-trig2b82649223fd0aa73465c3d599960bab 9d + +NAME AGE +exchange.rabbitmq.com/b.vmware-functions.default.6fb6a96a-796e-462e-99d7-a60167a68d3a 9d -NAME BROKER SUBSCRIBER_URI AGE READY REASON -trigger.eventing.knative.dev/sockeye-trigger default http://sockeye.vmware-functions.svc.cluster.local/ 14d True +NAME SOURCE SINK READY REASON +vspheresource.sources.tanzu.vmware.com/vcsa-source https://vcsa.jarvis.lab http://default-broker-ingress.vmware-functions.svc.cluster.local True + +NAME READY REASON +vspherebinding.sources.tanzu.vmware.com/vcsa-source-vspherebinding True ``` -**A note about kubectl:** `kubectl get all` does not return "all" resources - only a partial list. In the above command, secrets are not returned by "all" and so the "secrets" qualifier needs to be added to the command. The "-n" flag allows specification of the namespace to target. Without a "-n" flag, the "default" namespace is targeted. +**A note about kubectl:** `kubectl get all` does not return "all" resources - only a partial list. In the above command, secrets are not returned by "all" and so the "secrets" qualifier needs to be added to the command. The "`-n`" flag allows specification of the namespace to target. Without a "`-n`" flag, the "default" namespace is targeted. -As you can see from the above image, there are some default deployments (default-broker-ingress, sockeye...) but no custom functions yet. Sockeye displays incoming events and is helpful in troubleshooting. Sockeye can be accessed by opening a browser to: "https://veba-fqdn/events" (replace veba-fqdn with the VEBA appliance's FQDN) as shown below: +As you can see from the above image, there are some default deployments (default-broker-ingress, sockeye...) but no custom functions yet. Sockeye displays incoming events and is helpful in troubleshooting. Sockeye can be accessed by opening a browser to: `https://veba-fqdn/events` (replace veba-fqdn with the VEBA appliance's FQDN) as shown below: - + +## Deploy kn-ps-slack Function to VEBA -## Deploy kn-ps-slack Function to the VEBA Appliance -1. Move to the `/vcenter-event-broker-appliance/examples/knative/powershell/kn-ps-slack` directory that you cloned earlier with `git`. +- **Step 1:** Move to the `/vcenter-event-broker-appliance/examples/knative/powershell/kn-ps-slack` directory that you cloned earlier with `git`. -2. Update the `slack_secret.json` file with your Slack webhook URL. +- **Step 2:** Update the `slack_secret.json` file with your Slack webhook URL. -3. Create the Kubernetes secret which can then be accessed from within the function by using the environment variable named `SLACK_SECRET`. +- **Step 3:** Create the Kubernetes secret which can then be accessed from within the function by using the environment variable named `SLACK_SECRET`. -``` +```console # create secret kubectl -n vmware-functions create secret generic slack-secret --from-file=SLACK_SECRET=slack_secret.json @@ -163,13 +193,13 @@ kubectl -n vmware-functions label secret slack-secret app=veba-ui Edit the `function.yaml` file with the name of the custom container image you pushed to DockerHub. For the example listed above, we would use: -``` +```yaml spec: containers: - image: docker.io/atauber/kn-ps-slack:1.1 ``` -By default, the function deployment will filter on the `VmPoweredOffEvent` vCenter server event. If you wish to change this event type, update the subject field within `function.yaml` to the desired event type. The `function.yaml` file is shown below. vCenter server events are described here: [vCenter Events](https://vmweventbroker.io/kb/vcenter-events). +By default, the function deployment will filter on the `com.vmware.vsphere.VmPoweredOffEvent.v0` vCenter server event. If you wish to change this event type, update the subject field within `function.yaml` to the desired event type. The `function.yaml` file is shown below. vCenter server events are described here: [vCenter Events](https://vmweventbroker.io/kb/vcenter-events). ```yaml apiVersion: serving.knative.dev/v1 @@ -204,8 +234,7 @@ spec: broker: default filter: attributes: - type: com.vmware.event.router/event - subject: VmPoweredOffEvent + type: com.vmware.vsphere.VmPoweredOffEvent.v0 subscriber: ref: apiVersion: serving.knative.dev/v1 @@ -215,109 +244,134 @@ spec: Deploy the function to the VEBA Appliance: -``` +```console # deploy function kubectl -n vmware-functions apply -f function.yaml ``` Now with the new function deployed, we should see these resources in the vmware-functions namespace: -``` +```console kubectl -n vmware-functions get secret,all -NAME TYPE DATA AGE -secret/default-broker-rabbit Opaque 1 14d -secret/default-token-77dnr kubernetes.io/service-account-token 3 14d -secret/slack-secret Opaque 1 2m7s - -NAME READY STATUS RESTARTS AGE -pod/default-broker-ingress-5c98bf68bc-mwghj 1/1 Running 0 14d -pod/kn-ps-slack-00001-deployment-6585d95fff-vl85t 2/2 Running 0 88s -pod/sockeye-5d7db96f66-shzvp 1/1 Running 0 14d -pod/sockeye-trigger-dispatcher-7f4dbd7f78-knllr 1/1 Running 0 14d -pod/veba-ps-slack-trigger-dispatcher-6ccb7479cd-kkdtk 1/1 Running 0 13s - -NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE -service/default-broker-ingress ClusterIP 10.97.111.83 80/TCP,9090/TCP 14d -service/kn-ps-slack ExternalName envoy.contour-internal.svc.cluster.local 80/TCP 13s -service/kn-ps-slack-00001 ClusterIP 10.109.162.56 80/TCP 88s -service/kn-ps-slack-00001-private ClusterIP 10.105.5.242 80/TCP,9090/TCP,9091/TCP,8022/TCP 88s -service/sockeye ClusterIP 10.103.143.20 80/TCP 14d +NAME TYPE DATA AGE +secret/default-broker-rabbit Opaque 1 9d +secret/tag-secret Opaque 1 4d +secret/vcsa-creds Opaque 2 5d17h + +NAME READY STATUS RESTARTS AGE +pod/default-broker-ingress-78b9f88599-2vwwn 1/1 Running 4 (2d23h ago) 9d +pod/kn-ps-slack-00001-deployment-6585d95fff-vl85t 2/2 Running 14 (2d23h ago) 4d +pod/sockeye-79b7fc7c55-klcnh 1/1 Running 4 (2d23h ago) 9d +pod/sockeye-trigger-dispatcher-84cf59c5d9-wdfqj 1/1 Running 4 (2d23h ago) 9d +pod/vcsa-source-adapter-9984f787-h7bth 1/1 Running 15 (2d23h ago) 5d17h +pod/veba-ps-slack-trigger-dispatcher-6ccb7479cd-kkdtk 1/1 Running 1 (2d23h ago) 4d + +NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE +service/default-broker-ingress ClusterIP 10.103.91.172 80/TCP,9090/TCP 9d +service/kn-ps-slack ClusterIP None 80/TCP 4d +service/kn-ps-slack-00001 ClusterIP 10.104.123.16 80/TCP,443/TCP 4d +service/kn-ps-slack-00001-private ClusterIP 10.97.209.58 80/TCP,443/TCP,9090/TCP,9091/TCP,8022/TCP,8012/TCP 4d +service/sockeye ClusterIP 10.96.207.10 80/TCP 9d NAME READY UP-TO-DATE AVAILABLE AGE -deployment.apps/default-broker-ingress 1/1 1 1 14d -deployment.apps/kn-ps-slack-00001-deployment 1/1 1 1 89s -deployment.apps/sockeye 1/1 1 1 14d -deployment.apps/sockeye-trigger-dispatcher 1/1 1 1 14d -deployment.apps/veba-ps-slack-trigger-dispatcher 1/1 1 1 14s - -NAME DESIRED CURRENT READY AGE -replicaset.apps/default-broker-ingress-5c98bf68bc 1 1 1 14d -replicaset.apps/kn-ps-slack-00001-deployment-6585d95fff 1 1 1 89s -replicaset.apps/sockeye-5d7db96f66 1 1 1 14d -replicaset.apps/sockeye-trigger-dispatcher-7f4dbd7f78 1 1 1 14d -replicaset.apps/veba-ps-slack-trigger-dispatcher-6ccb7479cd 1 1 1 14s +deployment.apps/default-broker-ingress 1/1 1 1 9d +deployment.apps/kn-ps-slack-00001-deployment 1/1 1 1 4d +deployment.apps/sockeye 1/1 1 1 9d +deployment.apps/sockeye-trigger-dispatcher 1/1 1 1 9d +deployment.apps/vcsa-source-adapter 1/1 1 1 9d +deployment.apps/veba-ps-slack-trigger-dispatcher 1/1 1 1 4d + +NAME DESIRED CURRENT READY AGE +replicaset.apps/default-broker-ingress-78b9f88599 1 1 1 9d +replicaset.apps/kn-ps-slack-00001-deployment-6585d95fff 1 1 1 4d +replicaset.apps/sockeye-79b7fc7c55 1 1 1 9d +replicaset.apps/sockeye-trigger-dispatcher-84cf59c5d9 1 1 1 9d +replicaset.apps/vcsa-source-adapter-5c8f5f58 0 0 0 9d +replicaset.apps/vcsa-source-adapter-9984f787 1 1 1 6d18h +replicaset.apps/veba-ps-slack-trigger-dispatcher-6ccb7479cd 1 1 1 4d + +NAME BROKER SUBSCRIBER_URI AGE READY REASON +trigger.eventing.knative.dev/sockeye-trigger default http://sockeye.vmware-functions.svc.cluster.local 9d True +trigger.eventing.knative.dev/veba-ps-slack-trigger default http://kn-ps-slack.vmware-functions.svc.cluster.local 4d True NAME URL AGE READY REASON -broker.eventing.knative.dev/default http://default-broker-ingress.vmware-functions.svc.cluster.local 14d True +broker.eventing.knative.dev/default http://default-broker-ingress.vmware-functions.svc.cluster.local 9d True -NAME BROKER SUBSCRIBER_URI AGE READY REASON -trigger.eventing.knative.dev/sockeye-trigger default http://sockeye.vmware-functions.svc.cluster.local/ 14d True -trigger.eventing.knative.dev/veba-ps-slack-trigger default http://kn-ps-slack.vmware-functions.svc.cluster.local 97s True +NAME URL READY REASON +route.serving.knative.dev/kn-ps-slack http://kn-ps-slack.vmware-functions.veba.jarvis.lab True NAME LATESTCREATED LATESTREADY READY REASON -configuration.serving.knative.dev/kn-ps-slack kn-ps-slack-00001 kn-ps-slack-00001 True +configuration.serving.knative.dev/kn-ps-slack kn-ps-slack-00001 kn-ps-slack-00001 True -NAME URL READY REASON -route.serving.knative.dev/kn-ps-slack http://kn-ps-slack.vmware-functions.veba.vebatest.com True +NAME URL LATESTCREATED LATESTREADY READY REASON +service.serving.knative.dev/kn-ps-slack http://kn-ps-slack.vmware-functions.veba.jarvis.lab kn-ps-slack-00001 kn-ps-slack-00001 True -NAME CONFIG NAME K8S SERVICE NAME GENERATION READY REASON -revision.serving.knative.dev/kn-ps-slack-00001 kn-ps-slack kn-ps-slack-00001 1 True +NAME CONFIG NAME K8S SERVICE NAME GENERATION READY REASON ACTUAL REPLICAS DESIRED REPLICAS +revision.serving.knative.dev/kn-ps-slack-00001 kn-ps-slack 1 True 1 1 -NAME URL LATESTCREATED LATESTREADY READY REASON -service.serving.knative.dev/kn-ps-slack http://kn-ps-slack.vmware-functions.veba.vebatest.com kn-ps-slack-00001 kn-ps-slack-00001 True +NAME AGE +queue.rabbitmq.com/t.vmware-functions.sockeye-trig2b82649223fd0aa73465c3d599960bab 9d +queue.rabbitmq.com/t.vmware-functions.veba-ps-taec40e11bf54dbdadd222bf50ccec30af 4d -``` +NAME AGE +binding.rabbitmq.com/t.vmware-functions.sockeye-trig2b82649223fd0aa73465c3d599960bab 9d +binding.rabbitmq.com/t.vmware-functions.veba-ps-taec40e11bf54dbdadd222bf50ccec30af 4d + +NAME AGE +exchange.rabbitmq.com/b.vmware-functions.default.6fb6a96a-796e-462e-99d7-a60167a68d3a 9d + +NAME SOURCE SINK READY REASON +vspheresource.sources.tanzu.vmware.com/vcsa-source https://vcsa.jarvis.lab http://default-broker-ingress.vmware-functions.svc.cluster.local True +NAME READY REASON +vspherebinding.sources.tanzu.vmware.com/vcsa-source-vspherebinding True +``` If we then create a VM named "prod-testvm" and power it off, we should have success! -You will also be able to see the alert in Sockeye by searching for the `VmPoweredOffEvent`: +You will also be able to see the alert in Sockeye by searching for the `com.vmware.vsphere.VmPoweredOffEvent.v0`: + + - +## Kubernetes Troubleshooting Commands -## Kubernetes Troubleshooting commands When things don't work as expected, it is useful to know how to troubleshoot a system. Help in troubleshooting the VEBA appliance and functions can be found here: -- [Troubleshoot Appliance](troubleshoot-appliance) -- [Troubleshoot Functions](troubleshoot-functions) -We have used `kubectl get` and `kubectl apply` in the above examples. The following are some of the more common `kubectl` commands used in troubleshooting. +- [Troubleshoot Appliance](./troubleshoot-appliance.md) +- [Troubleshoot Functions](./troubleshoot-functions.md) + +We have used `kubectl get` and `kubectl apply` in the above examples. The following are some of the more common `kubectl` commands used in troubleshooting. -### describe ### +### kubectl describe + The `kubectl describe` command is very useful and shows details about Kubernetes objects like pods. Remember, we need to explicitly set the namespace if not "default". -``` +```console kubectl -n vmware-functions get pods kubectl -n vmware-functions describe pod ``` The output will look something like this: -```yml +```console kubectl -n vmware-functions get pods NAME READY STATUS RESTARTS AGE -default-broker-ingress-5c98bf68bc-mwghj 1/1 Running 0 14d -kn-ps-slack-00001-deployment-6585d95fff-vl85t 2/2 Running 0 18m -sockeye-5d7db96f66-shzvp 1/1 Running 0 14d -sockeye-trigger-dispatcher-7f4dbd7f78-knllr 1/1 Running 0 14d -veba-ps-slack-trigger-dispatcher-6ccb7479cd-kkdtk 1/1 Running 0 16m +default-broker-ingress-78b9f88599-2vwwn 1/1 Running 4 (3d ago) 9d +kn-ps-slack-00001-deployment-5b97c6795d-xrl8v 2/2 Running 14 (2d23h ago) 4d1h +sockeye-79b7fc7c55-klcnh 1/1 Running 4 (3d ago) 9d +sockeye-trigger-dispatcher-84cf59c5d9-wdfqj 1/1 Running 4 (3d ago) 9d +vcsa-source-adapter-9984f787-h7bth 1/1 Running 15 (2d23h ago) 5d17h +veba-ps-slack-trigger-dispatcher-796895df-6ffhc 1/1 Running 1 (3d ago) 4d1 +``` +```console kubectl -n vmware-functions describe pod kn-ps-slack-00001-deployment-6585d95fff-vl85t Name: kn-ps-slack-00001-deployment-6585d95fff-vl85t @@ -394,34 +448,37 @@ Events: ``` There is some interesting info here: + - The node (in our case, the VEBA VM) and IP where the pod is running - The internal IP address of the pod - Details about the container image that is running - Events: the events are very useful to diagnose issues related to container images not being "pulled" or downloaded successfully. This is the first place to look if the pod doesn't have a "Running" status. -### logs ### +### kubectl logs + The `kubectl logs` command dumps the logs from a pod and is very useful in diagnosing container application issues. What you will see in the logs is analogous to the output on a linux machine's console. The example below dumps the logs for the `veba-ui` pod. If the pod you are issuing the logs command against has more than one container, you will need to add a container name to the end of the command (you will be prompted for this). -``` +```console kubectl -n vmware-system get pods kubectl -n vmware-system logs ``` Output will be similar to this: -``` +```console kubectl -n vmware-system get pods -NAME READY STATUS RESTARTS AGE -cadvisor-72t97 1/1 Running 0 14d -tinywww-dd88dc7db-xdlqg 1/1 Running 0 14d -veba-rabbit-server-0 1/1 Running 0 14d -veba-ui-7cfb9cbf5-9k9sm 1/1 Running 0 14d -vmware-event-router-vcenter-7d85b45d96-5fvnj 1/1 Running 5 14d -vmware-event-router-webhook-55679fd776-rfwrq 1/1 Running 0 14d +NAME READY STATUS RESTARTS AGE +cadvisor-p26cg 1/1 Running 3 (23h ago) 6d11h +tinywww-5b795ddd75-sn5vf 1/1 Running 3 (23h ago) 6d11h +veba-rabbit-server-0 1/1 Running 3 (23h ago) 6d11h +veba-ui-5cf5d5db4-tn76g 1/1 Running 3 (23h ago) 6d11h +vmware-event-router-webhook-6bfb8cc946-8wlsd 1/1 Running 3 (23h ago) 6d11h +``` -kubectl -n vmware-system logs veba-ui-7cfb9cbf5-9k9sm +```console +kubectl -n vmware-system logs veba-ui-5cf5d5db4-tn76g . ____ _ __ _ _ /\\ / ___'_ __ _ _(_)_ __ __ _ \ \ \ \ @@ -431,64 +488,81 @@ kubectl -n vmware-system logs veba-ui-7cfb9cbf5-9k9sm =========|_|==============|___/=/_/_/_/ :: Spring Boot :: (v2.0.3.RELEASE) -2022-01-20 14:57:17.904 INFO 1 --- [ main] c.v.sample.remote.SpringBootApplication : Starting SpringBootApplication on veba-ui-7cfb9cbf5-9k9sm with PID 1 (/app.jar started by root in /) -2022-01-20 14:57:17.909 INFO 1 --- [ main] c.v.sample.remote.SpringBootApplication : No active profile set, falling back to default profiles: default -2022-01-20 14:57:18.019 INFO 1 --- [ main] ConfigServletWebServerApplicationContext : Refreshing org.springframework.boot.web.servlet.context.AnnotationConfigServletWebServerApplicationContext@1996cd68: startup date [Thu Jan 20 14:57:18 UTC 2022]; root of context hierarchy -2022-01-20 14:57:18.976 INFO 1 --- [ main] o.s.b.f.xml.XmlBeanDefinitionReader : Loading XML bean definitions from class path resource [spring-context.xml] -2022-01-20 14:57:19.274 INFO 1 --- [ main] o.s.b.f.s.DefaultListableBeanFactory : Overriding bean definition for bean 'iftttController' with a different definition: replacing [Generic bean: class [com.vmware.sample.remote.controllers.IftttController]; scope=singleton; abstract=false; lazyInit=false; autowireMode=0; dependencyCheck=0; autowireCandidate=true; primary=false; factoryBeanName=null; factoryMethodName=null; initMethodName=null; destroyMethodName=null; defined in URL [jar:file:/app.jar!/BOOT-INF/classes!/com/vmware/sample/remote/controllers/IftttController.class]] with [Generic bean: class [com.vmware.sample.remote.controllers.IftttController]; scope=; abstract=false; lazyInit=false; autowireMode=0; dependencyCheck=0; autowireCandidate=true; primary=false; factoryBeanName=null; factoryMethodName=null; initMethodName=null; destroyMethodName=null; defined in class path resource [spring-context.xml]] -2 +2024-01-18 08:31:14.053 INFO 1 --- [ main] c.v.sample.remote.SpringBootApplication : Starting SpringBootApplication on veba-ui-5cf5d5db4-tn76g with PID 1 (/app.jar started by root in /) +2024-01-18 08:31:14.072 INFO 1 --- [ main] c.v.sample.remote.SpringBootApplication : No active profile set, falling back to default profiles: default +2024-01-18 08:31:14.441 INFO 1 --- [ main] ConfigServletWebServerApplicationContext : Refreshing org.springframework.boot.web.servlet.context.AnnotationConfigServletWebServerApplicationContext@38cccef: startup date [Thu Jan 18 08:31:14 UTC 2024]; root of context hierarchy +2024-01-18 08:31:16.028 INFO 1 --- [ main] o.s.b.f.xml.XmlBeanDefinitionReader : Loading XML bean definitions from class path resource [spring-context.xml] +2024-01-18 08:31:16.768 INFO 1 --- [ main] o.s.b.f.s.DefaultListableBeanFactory : Overriding bean definition for bean 'iftttController' with a different definition: replacing [Generic bean: class [com.vmware.sample.remote.controllers.IftttController]; scope=singleton; abstract=false; lazyInit=false; autowireMode=0; dependencyCheck=0; autowireCandidate=true; primary=false; factoryBeanName=null; factoryMethodName=null; initMethodName=null; destroyMethodName=null; defined in URL [jar:file:/app.jar!/BOOT-INF/classes!/com/vmware/sample/remote/controllers/IftttController.class]] with [Generic bean: class [com.vmware.sample.remote.controllers.IftttController]; scope=; abstract=false; lazyInit=false; autowireMode=0; dependencyCheck=0; autowireCandidate=true; primary=false; factoryBeanName=null; factoryMethodName=null; initMethodName=null; destroyMethodName=null; defined in class path resource [spring-context.xml]] +2024-01-18 08:31:16.961 INFO 1 --- [ main] o.s.b.f.s.DefaultListableBeanFactory : Overriding bean definition for bean 'mvcContentNegotiationManager' with a different definition: replacing [Root bean: class [org.springframework.web.accept.ContentNegotiationManagerFactoryBean]; scope=; abstract=false; lazyInit=false; autowireMode=0; dependencyCheck=0; autowireCandidate=true; primary=false; factoryBeanName=null; factoryMethodName=null; initMethodName=null; destroyMethodName=null] with [Root bean: class [null]; scope=; abstract=false; lazyInit=false; autowireMode=3; dependencyCheck=0; autowireCandidate=true; primary=false; factoryBeanName=org.springframework.boot.autoconfigure.web.servlet.WebMvcAutoConfiguration$EnableWebMvcConfiguration; factoryMethodName=mvcContentNegotiationManager; initMethodName=null; destroyMethodName=(inferred); defined in class path resource [org/springframework/boot/autoconfigure/web/servlet/WebMvcAutoConfiguration$EnableWebMvcConfiguration.class]] +2024-01-18 08:31:16.962 INFO 1 --- [ main] a.ConfigurationClassBeanDefinitionReader : Skipping bean definition for [BeanMethod:name=mvcUriComponentsContributor,declaringClass=org.springframework.web.servlet.config.annotation.WebMvcConfigurationSupport]: a definition for bean 'mvcUriComponentsContributor' already exists. This top-level bean definition is considered as an override. +2024-01-18 08:31:16.962 INFO 1 --- [ main] o.s.b.f.s.DefaultListableBeanFactory : Overriding bean definition for bean 'mvcHandlerMappingIntrospector' with a different definition: replacing [Root bean: class [org.springframework.web.servlet.handler.HandlerMappingIntrospector]; scope=; abstract=false; lazyInit=true; autowireMode=0; dependencyCheck=0; autowireCandidate=true; primary=false; factoryBeanName=null; factoryMethodName=null; initMethodName=null; destroyMethodName=null] with [Root bean: class [null]; scope=; abstract=false; lazyInit=true; autowireMode=3; dependencyCheck=0; autowireCandidate=true; primary=false; factoryBeanName=org.springframework.boot.autoconfigure.web.servlet.WebMvcAutoConfiguration$EnableWebMvcConfiguration; factoryMethodName=mvcHandlerMappingIntrospector; initMethodName=null; destroyMethodName=(inferred); defined in class path resource [org/springframework/boot/autoconfigure/web/servlet/WebMvcAutoConfiguration$EnableWebMvcConfiguration.class]] +2024-01-18 08:31:17.477 INFO 1 --- [ main] f.a.AutowiredAnnotationBeanPostProcessor : JSR-330 'javax.inject.Inject' annotation found and supported for autowiring +2024-01-18 08:31:18.518 INFO 1 --- [ main] o.s.b.w.embedded.tomcat.TomcatWebServer : Tomcat initialized with port(s): 8080 (http) +2024-01-18 08:31:18.577 INFO 1 --- [ main] o.apache.catalina.core.StandardService : Starting service [Tomcat] +2024-01-18 08:31:18.578 INFO 1 --- [ main] org.apache.catalina.core.StandardEngine : Starting Servlet Engine: Apache Tomcat/8.5.31 +2024-01-18 08:31:18.597 INFO 1 --- [ost-startStop-1] o.a.catalina.core.AprLifecycleListener : The APR based Apache Tomcat Native library which allows optimal performance in production environments was not found on the java.library.path: [/usr/java/packages/lib/amd64:/usr/lib64:/lib64:/lib:/usr/lib] +2024-01-18 08:31:18.795 INFO 1 --- [ost-startStop-1] o.a.c.c.C.[.[localhost].[/veba-ui] : Initializing Spring embedded WebApplicationContext +2024-01-18 08:31:18.796 INFO 1 --- [ost-startStop-1] o.s.web.context.ContextLoader : Root WebApplicationContext: initialization completed in 4373 ms +2024-01-18 08:31:18.878 INFO 1 --- [ost-startStop-1] c.v.s.r.configuration.Configuration : VEBA Remote Plugin was initialized with +vCenter Server VCENTER_FQDN: vcsa.jarvis.lab +vCenter Server VCENTER_PORT: 443 +vCenter Server VEBA_FQDN: veba.jarvis.lab ``` -### exec ### -The `kubectl exec` command allows you to get a shell inside a running container. This is especially helpful to determine if secrets are mounted successfully or to determine network name resolution issues. We will shell into the running `veba-ui` pod for this example. +### kubectl exec -**Helpful Tip:** In most cases, the container OS will be very purpose built and streamlined - lacking in tools you might need for diagnosing an issue. In such a case, you can still use a package manager to add the needed tool to the container OS. For example, in an Ubuntu based pod, we could use "apt install dnsutils" if we wanted to use the utility `nslookup`. Just remember to "clean up" the pod by deleting it and reinstalling it to return it to its default state afterwards. +The `kubectl exec` command allows you to get a shell inside a running container. This is especially helpful to determine if secrets are mounted successfully or to determine network name resolution issues. We will shell into the running `veba-ui` pod for this example. -``` +**Helpful Tip:** In most cases, the container OS will be very purpose built and streamlined - lacking in tools you might need for diagnosing an issue. In such a case, you can still use a package manager to add the needed tool to the container OS. For example, in an Ubuntu based pod, we could use "apt install dnsutils" if we wanted to use the utility `nslookup`. Just remember to "clean up" the pod by deleting it and reinstalling it to return it to its default state afterwards. + +```console kubectl -n vmware-system get pods kubectl -n vmware-system exec --stdin --tty -- /bin/sh ``` Output will be similar to: -``` +```console kubectl -n vmware-system get pods -NAME READY STATUS RESTARTS AGE -cadvisor-72t97 1/1 Running 0 14d -tinywww-dd88dc7db-xdlqg 1/1 Running 0 14d -veba-rabbit-server-0 1/1 Running 0 14d -veba-ui-7cfb9cbf5-9k9sm 1/1 Running 0 14d -vmware-event-router-vcenter-7d85b45d96-5fvnj 1/1 Running 5 14d -vmware-event-router-webhook-55679fd776-rfwrq 1/1 Running 0 14d +NAME READY STATUS RESTARTS AGE +cadvisor-p26cg 1/1 Running 3 (23h ago) 6d11h +tinywww-5b795ddd75-sn5vf 1/1 Running 3 (23h ago) 6d11h +veba-rabbit-server-0 1/1 Running 3 (23h ago) 6d11h +veba-ui-5cf5d5db4-tn76g 1/1 Running 3 (23h ago) 6d11h +vmware-event-router-webhook-6bfb8cc946-8wlsd 1/1 Running 3 (23h ago) 6d11h +``` -kubectl -n vmware-system exec --stdin --tty veba-ui-7cfb9cbf5-9k9sm -- /bin/sh +```console +kubectl -n vmware-system exec --stdin --tty veba-ui-5cf5d5db4-tn76g -- /bin/sh # ls app.jar bin boot dev etc home lib lib64 media mnt opt proc root run sbin srv sys tmp usr var # exit ``` -### port-forward #### -The `kubectl port-forward` command will forward ports from pods or services to your local workstation. This is very helpful when your Kubernetes cluster does not have ingress setup for a specific application and you want to see if a specific port is "live" and working. For our example, we will port-forward the sockeye application pod in the vmware-functions namespace. Sockeye is a web application that displays events in the VEBA appliance. Sockeye IS enabled in ingress and usually you can access it by pointing your web browser to "https://veba-fqdn/events". +### kubectl port-forward -``` +The `kubectl port-forward` command will forward ports from pods or services to your local workstation. This is very helpful when your Kubernetes cluster does not have ingress setup for a specific application and you want to see if a specific port is "live" and working. For our example, we will port-forward the sockeye application pod in the vmware-functions namespace. Sockeye is a web application that displays events in the VEBA appliance. Sockeye IS enabled in ingress and usually you can access it by pointing your web browser to "https://veba-fqdn/events". + +```console kubectl -n vmware-functions get pods kubectl -n vmware-functions port-forward 8081:8080 ``` Output will be similar to: -``` +```console kubectl -n vmware-functions get pods NAME READY STATUS RESTARTS AGE -default-broker-ingress-5c98bf68bc-mwghj 1/1 Running 0 14d -kn-ps-slack-00001-deployment-6585d95fff-vl85t 2/2 Running 0 34m -sockeye-5d7db96f66-shzvp 1/1 Running 0 14d -sockeye-trigger-dispatcher-7f4dbd7f78-knllr 1/1 Running 0 14d -veba-ps-slack-trigger-dispatcher-6ccb7479cd-kkdtk 1/1 Running 0 33m +default-broker-ingress-78b9f88599-2vwwn 1/1 Running 4 (3d ago) 9d +kn-ps-slack-00001-deployment-5b97c6795d-xrl8v 2/2 Running 14 (2d23h ago) 4d1h +sockeye-79b7fc7c55-klcnh 1/1 Running 4 (3d ago) 9d +sockeye-trigger-dispatcher-84cf59c5d9-wdfqj 1/1 Running 4 (3d ago) 9d +vcsa-source-adapter-9984f787-h7bth 1/1 Running 15 (2d23h ago) 5d17h +veba-ps-slack-trigger-dispatcher-796895df-6ffhc 1/1 Running 1 (3d ago) 4d1 kubectl -n vmware-functions port-forward sockeye-5d7db96f66-shzvp 8081:8080 diff --git a/docs/kb/function-tutorial-intro.md b/docs/kb/function-tutorial-intro.md index bb3086de..54ed567b 100644 --- a/docs/kb/function-tutorial-intro.md +++ b/docs/kb/function-tutorial-intro.md @@ -12,18 +12,20 @@ cta: - text: Deploy a function to your VEBA appliance [Function Tutorial - Function Deploy](function-tutorial-deploy) --- -# In-depth Function Tutorial - Intro +# Function Tutorial - Intro This tutorial will go over: + - What is a VEBA function - The anatomy of a PowerShell function and how to do basic modifications to it. We will use the [kn-ps-slack](https://github.com/vmware-samples/vcenter-event-broker-appliance/tree/master/examples/knative/powershell/kn-ps-slack) function for our example. - Setting up the required tools on your workstation: `git`, `docker`, and `kubectl` - Modify and test a function locally on your workstation - How to deploy the function to the Kubernetes cluster in your VEBA appliance + ## Table of Contents -- [In-depth Function Tutorial - Intro](#in-depth-function-tutorial---intro) - - [Table of Contents](#table-of-contents) + +- [Function Tutorial - Intro](#function-tutorial---intro) - [The big picture](#the-big-picture) - [The anatomy of a VEBA function](#the-anatomy-of-a-veba-function) - [Installing required tools on your workstation](#installing-required-tools-on-your-workstation) @@ -37,31 +39,33 @@ This tutorial will go over: - [Install and Configure `kubectl`](#install-and-configure-kubectl-1) ## The big picture -VEBA functions provide the "custom" logic to the VEBA appliance to fulfil your business requirements. Functions are packaged as Docker images. The functions can be written in PowerShell, Python, Go, or just about any language, and are packaged and distributed as Docker images. This is because the VEBA appliance runs Kubernetes (on top of the Photon OS) and functions are deployed as containers on the Kubernetes system. Kubernetes provides an abstraction layer to allow containers to run seamlessly on disparate hardware/OSes. + +VEBA functions provide the "custom" logic to the VEBA appliance to fulfill your business requirements. Functions are packaged as Docker images. The functions can be written in PowerShell, Python, Go, or just about any language, and are packaged and distributed as Docker images. This is because the VEBA appliance runs Kubernetes (on top of the Photon OS) and functions are deployed as containers on the Kubernetes system. Kubernetes provides an abstraction layer to allow containers to run seamlessly on disparate hardware/OSes. The VEBA team has provided a library of sample functions for you to get started with: [VEBA Functions](https://github.com/vmware-samples/vcenter-event-broker-appliance/tree/master/examples/knative). As you can see, they are assembled under the "knative" folder. Knative is a framework of building blocks for Kubernetes that provides basic services to the VEBA application. So the first step would be to review the provided functions and determine if there are any functions that match your use case requirements. If your use case was to send an email message when a specific vCenter event occurred, the function: [kn-ps-email](https://github.com/vmware-samples/vcenter-event-broker-appliance/tree/master/examples/knative/powershell/kn-ps-email) would be a good solution to begin with. In looking at the function, you can see that it is currently configured to fire/trigger for a VM deletion event. Don't worry if your use case is a different vCenter event - this is easily modified in the function regardless of if you are adept with PowerShell programming. **A word about programming languages:** If you find a function that meets your requirements but is written in a language you are not comfortable with, don't worry, you will still be able to deploy that function. There are two parts to the VEBA functions: the programming logic and the input variables. Variables contain things like: IP addresses, Event types, authentication parameters, email addresses, or Slack keys. Variables are easily input and modified without knowledge of the specific programming language. You will find examples of this later in the tutorial. ## The anatomy of a VEBA function + All VEBA functions have the same relative format regardless of what programming language the functions are written in. Let's look at the [kn-ps-slack](https://github.com/vmware-samples/vcenter-event-broker-appliance/tree/master/examples/knative/powershell/kn-ps-slack) function. - - **test** - this directory contains scripts to test and run the VEBA function locally on your workstation, without need for the VEBA appliance. - **Dockerfile** contains the instructions for the Docker application on how to build the Docker image. You most likely will not need to modify this file. - **README.md** is the default web page you see at [kn-ps-slack](https://github.com/vmware-samples/vcenter-event-broker-appliance/tree/master/examples/knative/powershell/kn-ps-slack). It is written in markdown language. - **function.yaml** contains the instructions to load the VEBA function into the Kubernetes cluster. This file has two pieces of information that you may want to change: - 1. The vCenter Event that triggers the function. The default event is: `VmPoweredOffEvent` but this may be modified to suit your requirements. + 1. The vCenter Event that triggers the function. The default event is: `com.vmware.vsphere.VmPoweredOffEvent.v0` but this may be modified to suit your requirements. 2. The location of the Docker image to load into Kubernetes. If the PowerShell code will not be modified, you can leave the default image as is. If you modify the PowerShell code in the handler file, you will need to build a new Docker image and specify the name/location in this file. - **handler.ps1** contains the PowerShell code that runs when the specified vCenter event triggers it. The `handler.ps1` file is injected into the Docker image which must be rebuilt every time the code changes. -- **slack_secret.json** contains the Slack key for your Slack channel. This file will be used to create a Kubernetes secret that the function will read. Most functions will include a secret file that contains: usernames/passwords, keys, or other sensitive information that will be used to create a Kubernetes secret. +- **slack_secret.json** contains the Slack webhook URL for your Slack channel. This file will be used to create a Kubernetes secret that the function will read. Most functions will include a secret file that contains: usernames/passwords, keys, or other sensitive information that will be used to create a Kubernetes secret. **What are Kubernetes secrets?** The VEBA appliance runs a Kubernetes cluster on top of the Photon OS. This allows the VEBA functions to be packaged as containers that are then deployed into the Kubernetes cluster. A Kubernetes secret is an object that contains a small amount of sensitive data that can be read by a Kubernets pod (pods are made up of one or more containers). Secrets allow sensitive or confidential data to be packaged separate from a container's application code. ## Installing required tools on your workstation + You will need to install and configure/use three tools: - `git` - used to clone the VEBA github repository down to your workstation (including the function code we want to use) so that you have a local copy to modify/test/deploy. - `docker` - if you modify the function's code, you will use the Docker command line tool to: @@ -70,16 +74,15 @@ You will need to install and configure/use three tools: - test the function locally on your workstation without the need for a deployed VEBA appliance. - `kubectl` - command line interface to the Kubernetes cluster. This command is used to deploy the function and secret to the Kubernetes cluster. It is also used in troubleshooting the VEBA appliance. -Note: even if the function's code is not modified, Docker will still be necessary to run local tests of the function from your workstation. +**Note**: Even if the function's code is not modified, Docker will still be necessary to run local tests of the function from your workstation. Install instructions for the required tools on macOS are below. Install instructions for Windows follow after the macOS instructions. - ## macOS Instructions ### Install `git` and clone the repo to your workstation -The following commands will all be run from a macOS terminal (Applications --> Utilities --> Terminal.app). +The following commands will all be run from a macOS terminal (Applications --> Utilities --> Terminal.app). Install Homebrew if needed. Homebrew is a package manager for macOS. ``` /bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)" @@ -118,7 +121,7 @@ docker login --username dduck --password VMware1! ### Install and Configure `kubectl` -`kubectl` is the command line utility used to access a Kubernetes cluster. With `kubectl`, you can deploy the VEBA function in the form of Kubernetes secrets and pods, check logs, and troubleshoot the health of the Kubernetes cluster and VEBA application. The `kubectl` command line utility determines which Kubernetes cluster to access and which certificate to use for authentication by reading a config file. The default config file resides at: `~/.kube/config` on the VEBA appliance. +Kubectl is the command line utility used to access a Kubernetes cluster. With `kubectl`, you can deploy the VEBA function in the form of Kubernetes secrets and pods, check logs, and troubleshoot the health of the Kubernetes cluster and VEBA application. The `kubectl` command line utility determines which Kubernetes cluster to access and which certificate to use for authentication by reading a config file. The default config file resides at: `~/.kube/config` on the VEBA appliance. Install `kubectl` with brew: @@ -129,16 +132,15 @@ kubectl version Next we will copy the `.kube/config` file from the VEBA appliance to the local workstation. You will need to know the IP address and root password of the deployed VEBA appliance and also verify that SSH has been enabled. These parameters will have been set during the VEBA appliance deployment. Once the config file is copied locally, we will export it so that it becomes the default `kubectl` config file. You can switch which Kubernetes cluster `kubectl` points at by changing the `export KUBECONFIG` file link. This example creates a "veba" folder to store the config file in and uses `scp` to copy the file from the VEBA appliance. Replace below with the VEBA appliance IP address. You will be prompted for the VEBA appliance root password. - -``` +```console cd ~ mkdir veba cd veba scp 'root@:/root/.kube/config' . export KUBECONFIG=$HOME/veba/config ``` -The above sample code is _**one**_ way of configuring the Kubernetes config file to use for access to the cluster. How to navigate between multiple configs is documented here: [Kubernetes configure access](https://kubernetes.io/docs/tasks/access-application-cluster/configure-access-multiple-clusters/). +The above sample code is _**one**_ way of configuring the Kubernetes config file to use for access to the cluster. How to navigate between multiple configs is documented here: [Kubernetes configure access](https://kubernetes.io/docs/tasks/access-application-cluster/configure-access-multiple-clusters/). Check that everything is working. @@ -146,7 +148,7 @@ Check that everything is working. - `kubectl cluster-info`: returns info from the Kubernetes cluster (within the VEBA appliance) - `kubectl get ns`: returns the namespaces from the Kubernetes cluster -``` +```console kubectl config view kubectl cluster-info kubectl get ns @@ -154,7 +156,7 @@ kubectl get ns You should see something similar to the below output: -``` +```yaml kubectl config view apiVersion: v1 @@ -176,7 +178,9 @@ users: user: client-certificate-data: REDACTED client-key-data: REDACTED +``` +```console kubectl cluster-info Kubernetes control plane is running at https://10.161.98.24:6443 @@ -187,19 +191,20 @@ To further debug and diagnose cluster problems, use 'kubectl cluster-info dump'. kubectl get ns NAME STATUS AGE -contour-external Active 14d -contour-internal Active 14d -default Active 14d -knative-eventing Active 14d -knative-serving Active 14d -kube-node-lease Active 14d -kube-public Active 14d -kube-system Active 14d -local-path-storage Active 14d -rabbitmq-system Active 14d -vmware-functions Active 14d -vmware-system Active 14d - +cert-manager Active 9d +contour-external Active 9d +contour-internal Active 9d +default Active 9d +knative-eventing Active 9d +knative-serving Active 9d +kube-node-lease Active 9d +kube-public Active 9d +kube-system Active 9d +local-path-storage Active 9d +rabbitmq-system Active 9d +vmware-functions Active 9d +vmware-sources Active 9d +vmware-system Active 9d ``` @@ -215,19 +220,21 @@ Before we install `git`, lets look at two applications that are recommended: The following commands will all be run from a PowerShell window in Administrator mode (right click on the PowerShell icon and select `Run as administrator`). -``` +```console choco install git ``` Test by retrieving the version and set your username and email (replace with your own): -``` + +```console git --version git config --global user.name "Donald Duck" git config --global user.email "dduck@acme.com" ``` Move to a directory that you'd like to use to develop/test a function and clone the VEBA repo to your local workstation. -``` + +```console cd ~ mkdir test cd test @@ -240,12 +247,13 @@ First, you will need to sign up for a Docker account here: [DockerHub sign up](h Next, install Docker with Chocolatey from a PowerShell window in Administrator mode. -``` +```console choco install docker ``` Now login using the Docker account you just signed up with (replace dduck with your own username below). Open a PowerShell window and submit: -``` + +```console docker login --username dduck ``` @@ -255,29 +263,31 @@ docker login --username dduck Install `kubectl` with Chocolately from a PowerShell window in Administrator mode: -``` +```console choco install kubernetes-cli kubectl version ``` Next we will copy the `.kube/config` file from the VEBA appliance to the local workstation. You will need to know the IP address and root password of the deployed VEBA appliance and also verify that SSH has been enabled. These parameters will have been set during the VEBA appliance deployment. Once the config file is copied locally, we will export it so that it becomes the default `kubectl` config file. You can switch which Kubernetes cluster `kubectl` points at by changing the `Env:KUBECONFIG` file link. This example creates a "veba" folder to store the config file in and uses `scp` to copy the file from the VEBA appliance. `scp` is a secure copy utility and was installed as part of the Chocolately install of `git` earlier. Replace "VEBA IP" below with the VEBA appliance IP address. You will be prompted for the VEBA appliance root password. -``` +```console cd ~ mkdir veba cd veba scp 'root@:/root/.kube/config' . Env:KUBECONFIG="$HOME\veba\config" ``` + The above sample code is _**one**_ way of configuring the Kubernetes config file to use for access to the cluster. How to navigate between multiple configs is documented here: [Kubernetes configure access](https://kubernetes.io/docs/tasks/access-application-cluster/configure-access-multiple-clusters/). Check that everything is working. + - `kubectl config view`: returns the currently loaded config - `kubectl cluster-info`: returns info from the Kubernetes cluster (within the VEBA appliance) - `kubectl get ns`: returns the namespaces from the Kubernetes cluster -``` +```console kubectl config view kubectl cluster-info kubectl get ns @@ -285,7 +295,7 @@ kubectl get ns You should see something similar to the below output: -``` +```yaml kubectl config view apiVersion: v1 @@ -307,7 +317,9 @@ users: user: client-certificate-data: REDACTED client-key-data: REDACTED +``` +```console kubectl cluster-info Kubernetes control plane is running at https://10.161.98.24:6443 @@ -318,17 +330,18 @@ To further debug and diagnose cluster problems, use 'kubectl cluster-info dump'. kubectl get ns NAME STATUS AGE -contour-external Active 14d -contour-internal Active 14d -default Active 14d -knative-eventing Active 14d -knative-serving Active 14d -kube-node-lease Active 14d -kube-public Active 14d -kube-system Active 14d -local-path-storage Active 14d -rabbitmq-system Active 14d -vmware-functions Active 14d -vmware-system Active 14d - +cert-manager Active 9d +contour-external Active 9d +contour-internal Active 9d +default Active 9d +knative-eventing Active 9d +knative-serving Active 9d +kube-node-lease Active 9d +kube-public Active 9d +kube-system Active 9d +local-path-storage Active 9d +rabbitmq-system Active 9d +vmware-functions Active 9d +vmware-sources Active 9d +vmware-system Active 9d ``` diff --git a/docs/kb/function-tutorial-modtest.md b/docs/kb/function-tutorial-modtest.md index 5f062a27..4e091eea 100644 --- a/docs/kb/function-tutorial-modtest.md +++ b/docs/kb/function-tutorial-modtest.md @@ -12,9 +12,10 @@ cta: - text: Deploy a function to your VEBA appliance [Function Tutorial - Function Deploy](function-tutorial-deploy) --- -# In-depth function tutorial - Modify and Test a Function Locally +# Function Tutorial - Modify and Test a Function locally This part of the tutorial will go over: + - Modifying the [kn-ps-slack](https://github.com/vmware-samples/vcenter-event-broker-appliance/tree/master/examples/knative/powershell/kn-ps-slack) PowerShell function. For this example, we will send a Slack webhook when a Virtual Machine is powered off AND the VM Name starts with "prod". - Building a new Docker image locally - The anatomy of the local test folder @@ -22,26 +23,32 @@ This part of the tutorial will go over: **What is a Webhook?** A webhook is a service that allows one program to send data to another as soon as a particular event takes place. We will use a Slack webhook to send alert data from the VEBA function to Slack. + ## Table of Contents -- [Modifying the PowerShell Code](#modifying-the-powershell-code) -- [Building the Docker Container Image](#building-the-docker-container-image) -- [Testing the Function Locally](#testing-the-function-locally) + +- [Function Tutorial - Modify and Test a Function locally](#function-tutorial---modify-and-test-a-function-locally) + - [Modifying the PowerShell Code](#modifying-the-powershell-code) + - [Building the Docker Container Image](#building-the-docker-container-image) + - [Testing the Function Locally](#testing-the-function-locally) ## Modifying the PowerShell Code -The PowerShell code is contained in the `handler.ps1` file. The default function sends an alert to a Slack webhook when a Virtual Machine is powered off. This handler file is included in the Docker image and so if it changes, it will require a rebuild of the Docker image. You can see how the `handler.ps1` file is reference in the `Dockerfile` used to build the Docker image - note the `COPY handler.ps1 handler.ps1` command within the file: -``` -FROM ghcr.io/vmware-samples/vcenter-event-broker-appliance/ce-ps-base:1.4 +The PowerShell code is contained in the `handler.ps1` file. The default function sends an alert to a Slack webhook when a Virtual Machine is powered off. This handler file is included in the Docker image and so if it changes, it will require a rebuild of the Docker image. You can see how the `handler.ps1` file is reference in the `Dockerfile` used to build the Docker image - note the `COPY handler.ps1 handler.ps1` command within the file: + +```console +FROM ghcr.io/vmware-samples/vcenter-event-broker-appliance/ce-ps-base:1.5 + +LABEL maintainer="vCenter Event Broker Appliance Community" +LABEL org.opencontainers.image.source="https://github.com/vmware-samples/vcenter-event-broker-appliance" COPY handler.ps1 handler.ps1 CMD ["pwsh","./server.ps1"] ``` +The vCenter event that triggers this function is `com.vmware.vsphere.VmPoweredOffEvent.v0`. You can find this in the `function.yaml` file. If you would like to trigger your function with a different event, please see [vCenter Events](https://vmweventbroker.io/kb/vcenter-events) for a reference. Changing the event trigger in the `function.yaml` file does NOT necessitate a Docker container rebuild. -The vCenter event that triggers this function is `VmPoweredOffEvent`. You can find this in the `function.yaml` file. If you would like to trigger your function with a different event, please see [vCenter Events](https://vmweventbroker.io/kb/vcenter-events) for a reference. Changing the event trigger in the `function.yaml` file does NOT necessitate a Docker container rebuild. - -```yml +```yaml --- apiVersion: eventing.knative.dev/v1 @@ -54,8 +61,7 @@ spec: broker: default filter: attributes: - type: com.vmware.event.router/event - subject: VmPoweredOffEvent + type: com.vmware.vsphere.VmPoweredOffEvent.v0 subscriber: ref: apiVersion: serving.knative.dev/v1 @@ -63,10 +69,9 @@ spec: name: kn-ps-slack ``` +For our example, let's add some PowerShell code to only send the Slack webhook if the VM Name starts with "prod". Move to the `/vcenter-event-broker-appliance/examples/knative/powershell/kn-ps-slack` directory - remember, we git cloned this repo during the previous setup instructions. Use your favorite editor to open the `handler.ps1` file. -For our example, let's add some PowerShell code to only send the Slack webhook if the VM Name starts with "prod". Move to the `/vcenter-event-broker-appliance/examples/knative/powershell/kn-ps-slack` directory - remember, we git cloned this repo during the previous setup instructions. Use your favorite editor to open the `handler.ps1` file. - -``` +```powershell if(${env:FUNCTION_DEBUG} -eq "true") { Write-Host "$(Get-Date) - DEBUG: `"$body`"" } @@ -90,19 +95,21 @@ if ($cloudEventData.Vm.Name.StartsWith("prod")) { As you can see on the fifth line of the code above, I've added some quick and dirty code to only Invoke-WebRequest if the `$cloudEventData.VM.NameStartsWith("prod")` ## Building the Docker Container Image -Now, let's build the Docker container image locally using the modified `handler.ps1` file. To reiterate, a rebuild of the Docker image is only necessary if the handler code changes. Open a command prompt and move to the `/vcenter-event-broker-appliance/examples/knative/powershell/kn-ps-slack` directory. Assign a tag version and replace the docker-username with your own Docker login. Tags are used to assign versions or references to Docker containers. A Docker registry may contain multiple container images with the same name but each will have a different tag to indicate a different version. In the below example, we will use a tag value equal to `1.1` (this is appended to the end of the container image name). Docker container naming and tag rules are described here: [Docker tag](https://docs.docker.com/engine/reference/commandline/tag/). + +Now, let's build the Docker container image locally using the modified `handler.ps1` file. To reiterate, a rebuild of the Docker image is only necessary if the handler code changes. Open a command prompt and move to the `/vcenter-event-broker-appliance/examples/knative/powershell/kn-ps-slack` directory. Assign a tag version and replace the docker-username with your own Docker login. Tags are used to assign versions or references to Docker containers. A Docker registry may contain multiple container images with the same name but each will have a different tag to indicate a different version. In the below example, we will use a tag value equal to `1.1` (this is appended to the end of the container image name). Docker container naming and tag rules are described here: [Docker tag](https://docs.docker.com/engine/reference/commandline/tag/). Use the following command to build the Docker image (replace docker-username with your own Docker username): -``` +```console docker build -t /kn-ps-slack:1.1 . ``` Output will be similar to below: -``` + +```console docker build -t atauber/kn-ps-slack:1.1 . -[+] Building 0.4s (7/7) FINISHED +[+] Building 0.4s (7/7) FINISHED => [internal] load build definition from Dockerfile 0.0s => => transferring dockerfile: 36B 0.0s => [internal] load .dockerignore 0.0s @@ -123,19 +130,22 @@ Use 'docker scan' to run Snyk tests against images to find vulnerabilities and l Use the command `docker images` to see your new image listed. ## Testing the Function Locally + The test subdirectory contains the files used to test the function locally. You will need to edit two files: -1. `docker-test-env-variable` - enter the Slack webhook URL to use. Slack webhook URLs are unique addresses that allow you to post to a Slack channel. You can read how to create a Slack webhook URL [here](https://api.slack.com/messaging/webhooks) -2. `test-payload.json` - change the VM Name to use here. For the example, I will use `Vm.Name="prod-test"` so that the new `handler.ps1` code triggers the Slack call for this specific VM Name. +- **Step 1:** `docker-test-env-variable` - enter the Slack webhook URL to use. Slack webhook URLs are unique addresses that allow you to post to a Slack channel. You can read how to create a Slack webhook URL [here](https://api.slack.com/messaging/webhooks) + +- **Step 2:** `test-payload.json` - change the VM Name to use here. For the example, I will use `Vm.Name="prod-test"` so that the new `handler.ps1` code triggers the Slack call for this specific VM Name. Open a command prompt and run the following command (replacing docker-username with your Docker username). This should be run in the `/vcenter-event-broker-appliance/examples/knative/powershell/kn-ps-slack/test` directory. This will run your new function as a Docker container locally on your workstation. Also remember to use the correct tag (i.e. `1.1`) to reference the version of the container you want to use. -``` +```console docker run -e FUNCTION_DEBUG=true -e PORT=8080 --env-file docker-test-env-variable -it --rm -p 8080:8080 /kn-ps-slack:1.1 ``` + Results will look similar to below: -``` +```console docker run -e FUNCTION_DEBUG=true -e PORT=8080 --env-file docker-test-env-variable -it --rm -p 8080:8080 atauber/kn-ps-slack:1.1 02/03/2022 21:16:24 - PowerShell HTTP server start listening on 'http://*:8080/' @@ -144,7 +154,6 @@ docker run -e FUNCTION_DEBUG=true -e PORT=8080 --env-file docker-test-env-variab 02/03/2022 21:16:24 - Init Processing Completed 02/03/2022 21:16:24 - Starting HTTP CloudEvent listener - ``` Now, open a second command prompt/terminal and run `send-cloudevent-test`: either .sh or .ps1 depending on your workstation OS. This will send test-payload.json data to the listening Docker container function. If all is working, you will see the new Alert pop up in your Slack channel. diff --git a/docs/kb/img/kn-ps-slack-alert3.png b/docs/kb/img/kn-ps-slack-alert3.png deleted file mode 100644 index 02046a2e..00000000 Binary files a/docs/kb/img/kn-ps-slack-alert3.png and /dev/null differ diff --git a/docs/kb/img/kn-ps-slack-events.png b/docs/kb/img/kn-ps-slack-events.png deleted file mode 100644 index 5d8527f6..00000000 Binary files a/docs/kb/img/kn-ps-slack-events.png and /dev/null differ diff --git a/docs/kb/img/sockeye.png b/docs/kb/img/sockeye.png deleted file mode 100644 index 4321aa98..00000000 Binary files a/docs/kb/img/sockeye.png and /dev/null differ diff --git a/docs/kb/img/veba-architecture.png b/docs/kb/img/veba-architecture.png old mode 100644 new mode 100755 index b9fea75b..d1236b0f Binary files a/docs/kb/img/veba-architecture.png and b/docs/kb/img/veba-architecture.png differ diff --git a/docs/kb/img/veba-sockeye-events.png b/docs/kb/img/veba-sockeye-events.png new file mode 100644 index 00000000..59135fba Binary files /dev/null and b/docs/kb/img/veba-sockeye-events.png differ diff --git a/docs/kb/img/veba-sockeye-poweredoff-event.png b/docs/kb/img/veba-sockeye-poweredoff-event.png new file mode 100644 index 00000000..9eb1fbd9 Binary files /dev/null and b/docs/kb/img/veba-sockeye-poweredoff-event.png differ diff --git a/docs/kb/img/veba-sockeye-poweredon-event.png b/docs/kb/img/veba-sockeye-poweredon-event.png new file mode 100644 index 00000000..eb5ba531 Binary files /dev/null and b/docs/kb/img/veba-sockeye-poweredon-event.png differ diff --git a/docs/kb/install-knative.md b/docs/kb/install-knative.md deleted file mode 100644 index 596084a8..00000000 --- a/docs/kb/install-knative.md +++ /dev/null @@ -1,123 +0,0 @@ ---- -layout: docs -toc_id: install-knative -title: VMware Event Broker Appliance - Knative -description: Deploying VMware Event Broker Appliance with Knative -permalink: /kb/install-knative -cta: - title: Deploy a Function - description: At this point, you have successfully deployed the VMware Event Broker Appliance and you are ready to start deploying your functions! - actions: - - text: Check the [Knative Echo Function](https://github.com/vmware-samples/vcenter-event-broker-appliance/tree/master/examples/knative/powershell/kn-ps-echo){:target="_blank"} to quickly get started ---- -# Deploy VMware Event Broker Appliance with Knative - -Customers looking to seamlessly extend their vCenter by either deploying our prebuilt functions or writing your own functions can get started quickly by deploying VMware Event Broker Appliance with Knative as the Event Processor - -## Appliance Deployment Steps - -### Requirements - -* 6 vCPU and 8GB of memory for VMware Event Broker Appliance -* vCenter Server 6.x or greater - * **The VEBA UI requires vCenter Server 7.0 or greater** -* vCenter TCP/443 accessible from Appliance IP address -* Account to login to vCenter Server (readOnly is sufficient) - -### Step 1 - -Download the VMware Event Broker Appliance (OVA) from the [VMware Fling site](https://flings.vmware.com/vmware-event-broker-appliance){:target="_blank"}. - -### Step 2 - -Deploy the VMware Event Broker Appliance OVA to your vCenter Server using the vSphere HTML5 Client. As part of the deployment you will be prompted to provide the following input: - -#### **Networking** (**Required**) - - * Hostname - The FQDN of the VMware Event Broker Appliance. If you do not have DNS in your environment, make sure the hostname provide is resolvable from your desktop which may require you to manually add a hosts entry. Proper DNS resolution is recommended - * IP Address - The IP Address of the VMware Event Broker Appliance - * Network Prefix - Network CIDR Selection (e.g. 24 = 255.255.255.0) - * Gateway - The Network Gateway address - * DNS - DNS Server(s) that will be able to resolve to external sites such as Github for initial configuration. If you have multiple DNS Servers, input needs to be **space separated**. - * DNS Domain - The DNS domain of your network - * NTP Server - NTP Server(s) for proper time synchronization. If you have multiple NTP Servers, input needs to be **space separated**. - -#### **Proxy Settings** (Optional) - * HTTP Proxy Server - HTTP Proxy Server followed by the port (e.g. http://proxy.provider.com:3128) - * HTTPS Proxy - HTTPS Proxy Server followed by the port (e.g. http(s)://proxy.provider.com:3128) - * Proxy Username - Optional Username for Proxy Server - * Proxy Password - Optional Password for Proxy Server - * No Proxy - Exclude internal domain suffix. Comma separated (localhost, 127.0.0.1, domain.local) - -#### **OS Credentials** (**Required**) - * Root Password - This is the OS root password for the VMware Event Broker Appliance - * Enable SSH - Check the box to allow SSH to the Appliance (SSH to the appliance is disabled by default) - -#### **vSphere** (**Required**) - - * vCenter Server - This FQDN or IP Address of your vCenter Server that you wish to associate this VMware Event Broker Appliance to for Event subscription - * vCenter Username - The username to login to vCenter Server, as mentioned earlier, readOnly account is sufficient - * vCenter Password - The password to the vCenter Username - * vCenter Username to register VEBA UI (Optional) - Username to register VMware Event Broker UI to vCenter Server for Knative Processor - * vCenter Password to register VEBA UI (Optional) - Password to register VMware Event Broker UI to vCenter Server for Knative Processor - * Disable vCenter Server TLS Verification - If you have a self-signed SSL Certificate, you will need to check this box - -> **Note:** The minimum vSphere Privileges that is required for proper VEBA UI functionality are: **Register Extension**, **Update Extension** (Installing Plugins) and **Manage Plugins** (Updating Plugins) - -#### **Horizon** (**Optional**) - - * Enable Horizon Event Provider - Enable Horizon Event Provider - * Horizon Server - IP Address or Hostname of Horizon Server - * Horizon Domain Name - Active Directory Domain the username to login to the Horizon Server belongs to (e.g. corp) - * Horizon Username - Username to login to Horizon Server (UPN-style not allowed) - * Horizon Password - Password to login to Horizon Server - * Disable Horizon Server TLS Verification - Disable TLS Verification for Horizon Server (required for self-sign certificate) - -> **Note:** The minimum Horizon Role that is required to retrieve events is the `"Collect Operation Logs"` Role (located under Logs) - -#### **Webhook** (**Optional**) - - * Enable Webhook Event Provider - Enable Webhook Event Provider - * Basic Auth Username (Optional) - Username to login to webhook endpoint - * Basic Auth Password (Optional) - Password to login to webhook endpoint - -#### **Custom TLS Certificate Configuration** (Optional) - - * Custom VMware Event Broker Appliance TLS Certificate Private Key (Base64) - Base64 encoded custom TLS certificate (.PEM) for the VMware Event Broker Appliance - * Custom VMware Event Broker Appliance TLS Certificate Authority Certificate (Base64) - Base64 encoded custom TLS certificate (.CER) for the VMware Event Broker Appliance - -#### **Syslog Server Configuration** (Optional) - - * Hostname or IP Address - Specify the Hostname (FQDN) or IP Address of the Syslog Server - * Port - Syslog Server Port - * Protocol - Choose the Transport Protocol (TCP, TLS or UDP) - * Format - Choose the Syslog Protocol Format (RFC5424 or RFC3164) - -#### **zAdvanced** (Optional) - * Debugging - When enabled, this will output a more verbose log file that can be used to troubleshoot failed deployments - * POD CIDR Network - Customize POD CIDR Network (Default 10.99.0.0/20). Must not overlap with the appliance IP address - -### Step 3 - -Power On the VMware Event Broker Appliance after successful deployment. Depending on your external network connectivity, it can take a few minutes while the system is being setup. You can open the VM Console to view the progress. Once everything is completed, you should see an updated login banner for the various endpoints: - -``` -Appliance Configuration - -Install Logs: https://[hostname]/bootstrap -Resource Utilization: https://[hostname]/top -Events: https://[hostname]/events -Webhook: https://[hostname]/webhook - -Appliance Provider Stats - -vCenter: https://[hostname]/stats/vcenter -Webhook: https://[hostname]/stats/webhook -``` - -> NOTE: If you enable Debugging, the install logs endpoint will automatically contain the more verbose log entries. - - -### Step 4 - -You can verify that everything was deployed correctly by opening a web browser and accessing one of the endpoints along with the associated admin password you had specified as part of the OVA deployment. diff --git a/docs/kb/install-veba.md b/docs/kb/install-veba.md new file mode 100644 index 00000000..25e16eee --- /dev/null +++ b/docs/kb/install-veba.md @@ -0,0 +1,145 @@ +--- +layout: docs +toc_id: install-veba +title: VMware Event Broker Appliance +description: Deploying VMware Event Broker Appliance +permalink: /kb/install-veba +cta: + title: Deploy a Function + description: At this point, you have successfully deployed the VMware Event Broker Appliance and you are ready to start deploying your functions! + actions: + - text: Check the [Knative Echo Function](https://github.com/vmware-samples/vcenter-event-broker-appliance/tree/master/examples/knative/powershell/kn-ps-echo){:target="_blank"} to quickly get started +--- + +# Deploy VMware Event Broker Appliance + +Customers looking to seamlessly extend their vCenter by either deploying our prebuilt functions or writing your own functions can get started quickly by deploying VMware Event Broker Appliance with Knative as the Event Processor + + +## Table of Contents + +- [Deploy VMware Event Broker Appliance](#deploy-vmware-event-broker-appliance) + - [Requirements](#requirements) + - [Step 1 - Download OVA](#step-1---download-ova) + - [Step 2 - Deploy OVA](#step-2---deploy-ova) + - [Networking (Required)](#networking-required) + - [Proxy Settings (Optional)](#proxy-settings-optional) + - [OS Credentials (Required)](#os-credentials-required) + - [vSphere (Required)](#vsphere-required) + - [Horizon (Optional)](#horizon-optional) + - [Webhook (Optional)](#webhook-optional) + - [Custom TLS Certificate Configuration (Optional)](#custom-tls-certificate-configuration-optional) + - [Syslog Server Configuration (Optional)](#syslog-server-configuration-optional) + - [zAdvanced (Optional)](#zadvanced-optional) + - [Step 3 - Verification](#step-3---verification) + +## Requirements + +- 6 vCPU and 8GB of memory for VMware Event Broker Appliance +- vCenter Server 7.x or greater + - **The VEBA UI requires vCenter Server 7.0 or greater** +- vCenter TCP/443 accessible from Appliance IP address +- Account to login to vCenter Server (readOnly is sufficient) + +## Step 1 - Download OVA + +Download the VMware Event Broker Appliance (OVA) from the [VMware Fling site](https://vmwa.re/flings){:target="_blank"}. + +## Step 2 - Deploy OVA + +Deploy the VMware Event Broker Appliance OVA to your vCenter Server using the vSphere HTML5 Client. As part of the deployment you will be prompted to provide the following input: + +### Networking (Required) + +- Hostname - The FQDN of the VMware Event Broker Appliance. If you do not have DNS in your environment, make sure the hostname provide is resolvable from your desktop which may require you to manually add a hosts entry. Proper DNS resolution is recommended +- IP Address - The IP Address of the VMware Event Broker Appliance +- Network Prefix - Network CIDR Selection (e.g. 24 = 255.255.255.0) +- Gateway - The Network Gateway address +- DNS - DNS Server(s) that will be able to resolve to external sites such as Github for initial configuration. If you have multiple DNS Servers, input needs to be **space separated**. +- DNS Domain - The DNS domain of your network +- NTP Server - NTP Server(s) for proper time synchronization. If you have multiple NTP Servers, input needs to be **space separated**. + +### Proxy Settings (Optional) + +- HTTP Proxy Server - HTTP Proxy Server followed by the port (e.g. http://proxy.provider.com:3128) +- HTTPS Proxy - HTTPS Proxy Server followed by the port (e.g. http(s)://proxy.provider.com:3128) +- Proxy Username - Optional Username for Proxy Server +- Proxy Password - Optional Password for Proxy Server +- No Proxy - Exclude internal domain suffix. Comma separated (localhost, 127.0.0.1, domain.local) + +### OS Credentials (Required) + +- Root Password - This is the OS root password for the VMware Event Broker Appliance +- Enable SSH - Check the box to allow SSH to the Appliance (SSH to the appliance is disabled by default) +- Endpoint Username - Specify the username to authenticate against the VEBA endpoints (e.g. /bootstrap, /events, /top, etc.) +- Endpoint Password - Specify the password to authenticate against the VEBA endpoints. + +### vSphere (Required) + +- vCenter Server - This FQDN or IP Address of your vCenter Server that you wish to associate this VMware Event Broker Appliance to for Event subscription +- vCenter Username - The username to login to vCenter Server, as mentioned earlier, readOnly account is sufficient +- vCenter Password - The password to the vCenter Username +- vCenter Username to register VEBA UI (Optional) - Username to register VMware Event Broker UI to vCenter Server for Knative Processor +- vCenter Password to register VEBA UI (Optional) - Password to register VMware Event Broker UI to vCenter Server for Knative Processor +- Disable vCenter Server TLS Verification - If you have a self-signed SSL Certificate, you will need to check this box +- vCenter Checkpointing Age - Maximum allowed age (seconds) for replaying events determined by last successful event in checkpoint (default 300s) +- vCenter Checkpointing Period - Period (seconds) between saving checkpoints (default 10s) + +**Note:** The minimum vSphere Privileges that is required for proper VEBA UI functionality are: **Register Extension**, **Update Extension** (Installing Plugins) and **Manage Plugins** (Updating Plugins) + +**Note:** For more information about the Checkpointing feature, see here: [Event Delivery](./intro-tanzu-sources.md#event-provider-delivery-guarantees). + +### Horizon (Optional) + +- Enable Horizon Event Provider - Enable Horizon Event Provider +- Horizon Server - IP Address or Hostname of Horizon Server +- Horizon Domain Name - Active Directory Domain the username to login to the Horizon Server belongs to (e.g. corp) +- Horizon Username - Username to login to Horizon Server (UPN-style not allowed) +- Horizon Password - Password to login to Horizon Server +- Disable Horizon Server TLS Verification - Disable TLS Verification for Horizon Server (required for self-sign certificate) + +> **Note:** The minimum Horizon Role that is required to retrieve events is the `"Collect Operation Logs"` Role (located under Logs) + +### Webhook (Optional) + +- Enable Webhook Event Provider - Enable Webhook Event Provider +- Basic Auth Username (Optional) - Username to login to webhook endpoint +- Basic Auth Password (Optional) - Password to login to webhook endpoint + +### Custom TLS Certificate Configuration (Optional) + +- Custom VMware Event Broker Appliance TLS Certificate Private Key (Base64) - Base64 encoded custom TLS certificate (.PEM) for the VMware Event Broker Appliance +- Custom VMware Event Broker Appliance TLS Certificate Authority Certificate (Base64) - Base64 encoded custom TLS certificate (.CER) for the VMware Event Broker Appliance + +### Syslog Server Configuration (Optional) + +- Hostname or IP Address - Specify the Hostname (FQDN) or IP Address of the Syslog Server +- Port - Syslog Server Port +- Protocol - Choose the Transport Protocol (TCP, TLS or UDP) +- Format - Choose the Syslog Protocol Format (RFC5424 or RFC3164) + +### zAdvanced (Optional) + +- Debugging - When enabled, this will output a more verbose log file that can be used to troubleshoot failed deployments +- POD CIDR Network - Customize POD CIDR Network (Default 10.99.0.0/20). Must not overlap with the appliance IP address + +## Step 3 - Verification + +Power On the VMware Event Broker Appliance after successful deployment. Depending on your external network connectivity, it can take a few minutes while the system is being setup. You can open the VM Console to view the progress. Once everything is completed, you should see an updated login banner for the various endpoints: + +```code +Appliance Configuration + +Install Logs: https://[hostname]/bootstrap +Resource Utilization: https://[hostname]/top +Events: https://[hostname]/events +Webhook: https://[hostname]/webhook + +Appliance Provider Stats + +Webhook: https://[hostname]/stats/webhook +``` + +> NOTE: If you enable Debugging, the install logs endpoint will automatically contain the more verbose log entries. + +You can verify that everything was deployed correctly by opening a web browser and accessing one of the endpoints (`/bootstrap`, `/events`, `/top`, etc.) along with the associated admin password you had specified as part of the OVA deployment. diff --git a/docs/kb/intro-about.md b/docs/kb/intro-about.md index 79c4da64..552b3de3 100644 --- a/docs/kb/intro-about.md +++ b/docs/kb/intro-about.md @@ -8,12 +8,12 @@ cta: title: Getting Started description: Get started with VMware Event Broker Appliance and extend your vSphere SDDC in under 60 minutes actions: - - text: Install the [Appliance with Knative](install-knative) to extend your SDDC with our [community-sourced functions](/examples) + - text: Install the [Appliance](install-veba) to extend your SDDC with our [community-sourced functions](/examples) --- # VMware Event Broker Appliance -The [VMware Event Broker Appliance](https://flings.vmware.com/vmware-event-broker-appliance#summary) Fling enables customers to unlock the hidden potential of events in their SDDC to easily create [event-driven automation](https://octo.vmware.com/vsphere-power-event-driven-automation/). The VMware Event Broker Appliance includes support for vCenter Server and VMware Horizon events as well as any valid `CloudEvent` through the native webhook event provider. Easily triggering custom or prebuilt actions to deliver powerful integrations within your datacenter across public cloud has never been more easier before. A detailed list of use cases and possibilities with VMware Event Broker Appliance is available [here](https://vmweventbroker.io) +The [VMware Event Broker Appliance](https://vmwa.re/flings) Fling enables customers to unlock the hidden potential of events in their SDDC to easily create [event-driven automation](https://octo.vmware.com/vsphere-power-event-driven-automation/). The VMware Event Broker Appliance includes support for vCenter Server and VMware Horizon events as well as any valid `CloudEvent` through the native webhook event provider. Easily triggering custom or prebuilt actions to deliver powerful integrations within your datacenter across public cloud has never been more easier before. A detailed list of use cases and possibilities with VMware Event Broker Appliance is available [here](https://github.com/vmware-samples/vcenter-event-broker-appliance/blob/development/USECASES.md). VMware Event Broker Appliance is provided as a virtual appliance that can be deployed to any vSphere-based infrastructure, including an on-premises and/or any public cloud environment running on vSphere such as VMware Cloud on AWS or VMware Cloud on DellEMC. @@ -24,29 +24,35 @@ With this solution, end-users, partners and independent software vendors only ha VMware Event Broker Appliance enables customers to quickly get started with pre-built functions and enable the following use cases: ### Notification: + - Receive alerts and real time updates using your preferred communication channel such as SMS, Slack, Microsoft Teams, etc. - Real time updates for specific vSphere Inventory objects which matter to you and your organization - Monitor the health, availability & capacity of SDDC resources ### Automation: + - Apply configuration or customization changes based on specific VM or Host life cycle activities as an example within the SDDC (e.g. apply security settings to a VM or vSphere Tag to Host) - Scheduled jobs to validate health of an environment such as a long running snapshot on a VM ### Integration: + - Consume 2nd/3rd party solutions that provide remote APIs to associate with specific infrastructure events - Automated ticket creation using platforms such as Pager Duty, ServiceNow, Jira Service Desk, Salesforce based specific incidents such as workload and/or hardware failure as an example - Easily extend and consume public cloud services such as AWS EventBridge ### Remediation: + - Detect and automatically perform specific tasks based on certain types of events (e.g. add or request additional capacity) - Enables Operations and SRE teams to codify existing and well known run books for automated resolution ### Audit: + - Track all configuration changes for objects like a VM and automatically update a change management database (CMDB) - Forward all authentication and authorization events to your security team for compliance and/or intrusion detection - Replay configuration changes to aide in troubleshooting or debugging purposes ### Analytics: + - Reduce the number of connections and/or users to vCenter Server by providing access to events in an external system like CMDB or data warehouse solution - Enable teams to better understand workload and infrastructure behaviors by identifying trends observed in the events data including duration of events, users generating specific operations or the commonly used workflows diff --git a/docs/kb/intro-architecture.md b/docs/kb/intro-architecture.md index 2bfdcdd1..ba23776b 100644 --- a/docs/kb/intro-architecture.md +++ b/docs/kb/intro-architecture.md @@ -8,15 +8,15 @@ cta: title: Learn More description: Find more about what makes VMware Event Broker Appliance possible actions: - - text: Install the [Appliance with Knative](install-knative) to extend your SDDC with our [community-sourced functions](/examples) - - text: Learn more about the [VMware Event Router](event-router) and supported Event Sources and Processors + - text: Install the [Appliance](install-veba) to extend your SDDC with our [community-sourced functions](/examples) + - text: Learn more about the [VMware Tanzu Sources for Knative](Tanzu Sources for Knative) and supported Event Sources --- # Architecture The VMware Event Broker Appliance follows a highly modular approach, using Kubernetes and containers as an abstraction layer between the base operating system ([Photon OS](https://github.com/vmware/photon)) and the required application services. Currently the following components are used in the appliance: -- VMware Event Router ([Github](https://github.com/vmware-samples/vcenter-event-broker-appliance/tree/master/vmware-event-router){:target="_blank"}) +- Tanzu Sources for Knative ([Github](https://github.com/vmware-tanzu/sources-for-knative){:target="_blank"}) - Supported Event Stream Sources: - VMware vCenter ([Website](https://www.vmware.com/products/vcenter-server.html){:target="_blank"}) - VMware Horizon ([Website](https://www.vmware.com/products/horizon.html){:target="_blank"}) @@ -29,11 +29,11 @@ The VMware Event Broker Appliance follows a highly modular approach, using Kuber -**[VMware Event Router](event-router)** implements the core functionality of the VMware Event Broker Appliance, that is connecting to event `streams` ("sources") and processing the events with a configurable event `processor` such as Knative. +The **[Tanzu Sources for Knative](https://github.com/vmware-tanzu/sources-for-knative)** implements the core functionality of the VMware Event Broker Appliance, that is connecting to event producers and processing the events with a configurable event `processor` such as Knative. **Knative** is a Kubernetes-based platform to deploy and manage modern serverless workloads. Knative has two core building blocks, that is Serving (Knative Service) and Eventing (Broker, Channel, etc.). -The VMware Event Router can be configured to directly send events to any addressable Knative resource (“reference”), e.g. a Knative Broker or Service. Broker is the recommended deployment model for the VMware Event Router. Please see the Knative documentation on Eventing for details around brokers, triggers, event filtering, etc. -Alternatively, the router can send events to a URI, e.g. an external HTTP endpoint accepting CloudEvents. +The Tanzu Sources (`VSphereSource`, `HorizonSource`) can be configured to directly send events to any addressable Knative resource (`sink`), e.g. a Knative Broker or Service. Broker is the recommended deployment model for a Source. Please see the Knative documentation on Eventing for details around brokers, triggers, event filtering, etc. +Alternatively, a Source can send events to an URI, e.g. an external HTTP endpoint accepting CloudEvents. **Contour** is an ingress controller for Kubernetes that works by deploying the Envoy proxy as a reverse proxy and load balancer. Contour supports dynamic configuration updates out of the box while maintaining a lightweight profile. In the VMware Event Broker Appliance, Contour provides **TLS termination for the various HTTP(S) endpoints** served. @@ -41,14 +41,14 @@ Alternatively, the router can send events to a URI, e.g. an external HTTP endpoi **Photon OS™** is an open source Linux container host optimized for cloud-native applications, cloud platforms, and VMware infrastructure. Photon OS provides a **secure runtime environment for efficiently running containers** and out of the box support for Kubernetes. Photon OS is the foundation for many appliances built for the vSphere platform and its ecosystem and thus the first choice for building the VMware Event Broker Appliance. -# Architectural Considerations +## Architectural Considerations -Even though the VMware Event Broker Appliance is instantiated as a single running virtual machine, internally its components follow a [microservices architecture](#architecture) running on Kubernetes. The individual services communicate via TCP/IP network sockets. Most of the communication is performed internally in the appliance so the chance of losing network packets is reduced. +Even though the VMware Event Broker Appliance is instantiated as a single running virtual machine, internally its components follow a [microservices architecture](#architecture) running on Kubernetes. The individual services communicate via TCP/IP network sockets. Most of the communication is performed internally in the appliance so the chance of losing network packets is reduced. -However, in case of a component becoming unavailable (crash-loop, overloaded,or slow to respond), communication might be impacted and; it's important to understand the consequences for event delivery, i.e. function invocation. To avoid the risk of blocking remote calls, which could render the whole system unusable, sensible default timeouts are applied, which can be fine-tuned if needed. +However, in case of a component becoming unavailable (crash-loop, overloaded, or slow to respond), communication might be impacted. It's important to understand the consequences for event delivery, i.e. function invocation. To avoid the risk of blocking remote calls, which could render the whole system unusable, sensible default timeouts are applied, which can be fine-tuned if needed. Kubernetes is a great platform and foundation for building highly available distributed systems. Even though we currently don't make use of its multi-node clustering capabilities (i.e. scale out), Kubernetes provides a lot of benefits to developers and users. Its self-healing capabilities continuously watch the critical VMware Event Broker Appliance components and user-deployed functions and trigger restarts when necessary. -Kubernetes and its dependencies, such as the Docker, are deployed as systemd units. This addresses the "who watches the watcher" problem in case the Kubernetes node agent (kubelet) or Docker container runtime crashes. +Kubernetes and its dependencies, such as the containerd, are deployed as systemd units. This addresses the "who watches the watcher" problem in case the Kubernetes node agent (kubelet) or Docker container runtime crashes. > **Note:** We are considering to use Kubernetes' cluster capabilities in the future to provide increased resiliency (node crashes), scalability (scale out individual components to handle higher load) and durability (replication and persistency). The downside is the added complexity of deploying and managing a multi-node VMware Event Broker Appliance environment. \ No newline at end of file diff --git a/docs/kb/intro-event-router.md b/docs/kb/intro-event-router.md deleted file mode 100644 index 33509fee..00000000 --- a/docs/kb/intro-event-router.md +++ /dev/null @@ -1,974 +0,0 @@ ---- -layout: docs -toc_id: intro-event-router -title: VMware Event Router - Introduction -description: VMware Event Router Introduction -permalink: /kb/event-router -cta: - title: Get Started - description: Explore the capabilities that the VMware Event Router enables - actions: - - text: Install the [Appliance with Knative](install-knative) to extend your SDDC with our [community-sourced functions](/examples) - - text: Learn more about the [Events in vCenter](vcenter-events) and how to find the right event for your use case - - text: Learn more about Functions in this overview [here](functions). ---- - -# Introduction to VMware Event Router - -The VMware Event Router is used to connect to various VMware event `providers` -(i.e. "sources") and forward these events to different event `processors` (i.e. -"sinks"). This project is currently used by the [_VMware Event Broker -Appliance_](https://www.vmweventbroker.io/) as the core logic to forward -[CloudEvents](https://cloudevents.io/), e.g. from vSphere, to configurable event -`processors` (see below). - -**Supported Event `Providers`:** - -- [VMware vCenter Server](https://www.vmware.com/products/vcenter-server.html) -- [VMware Horizon](https://www.vmware.com/products/horizon.html) -- Generic [CloudEvents](https://cloudevents.io/) Webhook -- vCenter Simulator [vcsim](https://github.com/vmware/govmomi/tree/master/vcsim) - (deprecated, see note [below](#provider-type-vcsim)) - -**Supported Event `Processors`:** - -- [Knative](https://knative.dev/) -- [OpenFaaS](https://www.openfaas.com/) -- [AWS EventBridge](https://aws.amazon.com/eventbridge/?nc1=h_ls) - -The VMware Event Router uses the [CloudEvents](https://cloudevents.io/) standard -to normalize events from the supported event `providers`. See -[below](#example-event-structure) for an example. - -**Event `Provider` Delivery Guarantees:** - -- At-least-once event delivery - - with the [vCenter event provider](#provider-type-vcenter) option `checkpoint: true` -- At-most-once event delivery - - with the [vCenter event provider](#provider-type-vcenter) option `checkpoint: false` - - with the [Webhook event provider](#provider-type-webhook) - - with the [Horizon event provider](#provider-type-horizon) - - with the [vcsim event provider](#provider-type-vcsim) - -> **Note:** All implemented event `processors` use built-in retry mechanisms so -your function might still be involved multiple times depending on its response -code. However, if an event `provider` crashes before sending an event to the -configured `processor` or when the `processor` returns an error, the event is -not retried and discarded. - -**Current limitations:** - -- Only one event `provider` and one event `processor` can be configured at a - time (see note below) -- At-least-once event delivery semantics are not guaranteed if the event - router crashes **within seconds** right after startup and having received *n* events but before creating the - first valid checkpoint (current checkpoint interval is 5s) -- If an event cannot be successfully delivered (retried) by an event `processor` it is - logged and discarded, i.e. there is currently no support for [dead letter - queues](https://en.wikipedia.org/wiki/Dead_letter_queue) (see note below) -- Retries in the [OpenFaaS event processor](#processor-type-openfaas) are only - supported when running in synchronous mode, i.e. `async: false` (see this - OpenFaaS [issue](https://github.com/openfaas/nats-queue-worker/issues/84)) - -> **Note:** It is possible though to run **multiple instances** of the event -> router with different configurations to address multi-vCenter scenarios. This -> decision was made for scalability and resource/tenancy isolation purposes. - -> **Note:** Event Processors, like Knative, support Dead Letter Queues when -> using `Broker` mode. - - -## Table of Contents -- [Introduction to VMware Event Router](#introduction-to-vmware-event-router) -- [Configuration](#configuration) - - [Overview: Configuration File Structure (YAML)](#overview-configuration-file-structure-yaml) - - [JSON Schema Validation](#json-schema-validation) - - [API Version, Kind and Metadata](#api-version-kind-and-metadata) - - [The `eventProvider` section](#the-eventprovider-section) - - [Provider Type `vcenter`](#provider-type-vcenter) - - [Provider Type `horizon`](#provider-type-horizon) - - [Provider Type `webhook`](#provider-type-webhook) - - [Provider Type `vcsim`](#provider-type-vcsim) - - [The `eventProcessor` section](#the-eventprocessor-section) - - [Processor Type `knative`](#processor-type-knative) - - [Destination](#destination) - - [Processor Type `openfaas`](#processor-type-openfaas) - - [Processor Type `aws_event_bridge`](#processor-type-aws_event_bridge) - - [The `auth` section](#the-auth-section) - - [Type `basic_auth`](#type-basic_auth) - - [Type `aws_access_key`](#type-aws_access_key) - - [Type `aws_iam_role`](#type-aws_iam_role) - - [Type `active_directory`](#type-active_directory) - - [The `metricsProvider` section](#the-metricsprovider-section) - - [Provider Type `default`](#provider-type-default) -- [Deployment](#deployment) - - [Assisted Deployment](#assisted-deployment) - - [Helm Deployment](#helm-deployment) - - [Option 1: Configuration with Knative](#option-1-configuration-with-knative) - - [Option 2: Configuration with OpenFaaS](#option-2-configuration-with-openfaas) - - [Deploy the VMware Event Router Helm Chart](#deploy-the-vmware-event-router-helm-chart) - - [Creating/Updating the Chart](#creatingupdating-the-chart) - - [Manual Deployment](#manual-deployment) - - [Create Knative ClusterRoleBinding (skip if not using Knative)](#create-knative-clusterrolebinding-skip-if-not-using-knative) - - [Create the VMware Event Router Deployment](#create-the-vmware-event-router-deployment) - - [CLI Flags](#cli-flags) - -# Configuration - -The VMware Event Router can be run standalone (statically linked binary) or -deployed as a Docker container, e.g. in a Kubernetes environment. See -[deployment](#deployment) for further instructions. The configuration of event -`providers` and `processors` and other internal components (such as metrics) is -done via a YAML file passed in via the `-config` command line flag. - -``` - _ ____ ___ ______ __ ____ __ -| | / / |/ / ______ _________ / ____/ _____ ____ / /_ / __ \____ __ __/ /____ _____ -| | / / /|_/ / | /| / / __ / ___/ _ \ / __/ | | / / _ \/ __ \/ __/ / /_/ / __ \/ / / / __/ _ \/ ___/ -| |/ / / / /| |/ |/ / /_/ / / / __/ / /___ | |/ / __/ / / / /_ / _, _/ /_/ / /_/ / /_/ __/ / -|___/_/ /_/ |__/|__/\__,_/_/ \___/ /_____/ |___/\___/_/ /_/\__/ /_/ |_|\____/\__,_/\__/\___/_/ - - -Usage of ./vmware-event-router: - - -config string - path to configuration file (default "/etc/vmware-event-router/config") - -log-json - print JSON-formatted logs - -log-level string - set log level (debug,info,warn,error) (default "info") - -commit: -version: -``` - -The following sections describe the layout of the configuration file (YAML) and -specific options for the supported event `providers`, `processors` and `metrics` -endpoint. Configuration examples are provided [here](https://github.com/vmware-samples/vcenter-event-broker-appliance/tree/master/vmware-event-router/deploy). - -> **Note:** Currently only one event `provider` and one event `processor` can be -> configured at a time, e.g. one vCenter Server instance streaming events to -> OpenFaaS **or** AWS EventBridge. It is possible to run multiple instances of -> the event router with different configurations to address -> multi-provider/processor scenarios. - -## Overview: Configuration File Structure (YAML) - -The following file, using `vcenter` as the event `provider` and `knative` as -the `processor` shows an example of the configuration file syntax: - -```yaml -apiVersion: event-router.vmware.com/v1alpha1 -kind: RouterConfig -metadata: - name: router-config-openfaas - labels: - key: value -eventProvider: - type: vcenter - name: veba-demo-vc-01 - vcenter: - address: https://my-vcenter01.domain.local/sdk - insecureSSL: false - checkpoint: true - auth: - type: basic_auth - basicAuth: - username: administrator@vsphere.local - password: ReplaceMe -eventProcessor: - type: knative - name: veba-demo-knative - knative: - encoding: binary - insecureSSL: false - destination: - ref: - apiVersion: eventing.knative.dev/v1 - kind: Broker - name: rabbit - namespace: default -metricsProvider: - type: default - name: veba-demo-metrics - default: - bindAddress: "0.0.0.0:8082" -``` - -## JSON Schema Validation - -In order to simplify the configuration and validation of the YAML configuration -file a JSON schema [file](https://github.com/vmware-samples/vcenter-event-broker-appliance/blob/master/vmware-event-router/routerconfig.schema.json) is provided. Many editors/IDEs offer -support for registering a schema file, e.g. -[Jetbrains](https://www.jetbrains.com/help/rider/Settings_Languages_JSON_Schema.html) -and [VS -Code](https://code.visualstudio.com/docs/languages/json#_json-schemas-and-settings). - -> **Note:** The schema file can be downloaded and provided via a local file -> location or (recommended) via a direct URL, e.g. Github -> [raw](https://help.data.world/hc/en-us/articles/115006300048-GitHub-how-to-find-the-sharable-download-URL-for-files-on-GitHub) -> URL pointing to the aforementioned JSON schema file. - -## API Version, Kind and Metadata - -The following table lists allowed and required fields with their respective type -values and examples for these fields. - -| Field | Type | Description | Required | Example | -|-------------------|-------------------|-------------------------------------------------|----------|------------------------------------| -| `apiVersion` | String | API Version used for this configuration file | true | `event-router.vmware.com/v1alpha1` | -| `kind` | String | Type of this API resource | true | `RouterConfig` | -| `metadata` | Object | Additional metadata for this configuration file | true | | -| `metadata.name` | String | Name of this configuration file | true | `config-vc-openfaas-PROD` | -| `metadata.labels` | map[String]String | Optional key/value pairs | false | `env: PROD` | - -## The `eventProvider` section - -The following table lists allowed and required fields with their respective type -values and examples for these fields. - -| Field | Type | Description | Required | Example | -|-------------------|--------|----------------------------------------|----------|--------------------------------------------| -| `type` | String | Type of the event provider | true | `vcenter` | -| `name` | String | Name identifier for the event provider | true | `vc-01-PROD` | -| `` | Object | Provider specific configuration | true | (see specific provider type section below) | - -### Provider Type `vcenter` - -VMware vCenter Server is advanced server management software that provides a -centralized platform for controlling your VMware vSphere environments, allowing -you to automate and deliver a virtual infrastructure across the hybrid cloud -with confidence. Since VMware vCenter Server event types are environment specific (vSphere version, -extensions), a list of events for vCenter as an event source can be generated as -described in this [blog post](https://www.williamlam.com/2019/12/listing-all-events-for-vcenter-server.html). - -The following table lists allowed and required fields for connecting to a -vCenter Server and the respective type values and examples for these fields. - -| Field | Type | Description | Required | Example | -|-----------------|---------|-------------------------------------------------------------------------------------------------------|----------|----------------------------------| -| `address` | String | URI of the VMware vCenter Server | true | `https://10.0.0.1:443/sdk` | -| `insecureSSL` | Boolean | Skip TSL verification | true | `true` (i.e. ignore errors) | -| `checkpoint` | Boolean | Configure checkpointing via checkpoint file for event recovery/replay purposes | true | `true` | -| `checkpointDir` | Boolean | **Optional:** Configure an alternative location for persisting checkpoints (default: `./checkpoints`) | false | `/var/local/checkpoints` | -| `` | Object | vCenter credentials | true | (see `basic_auth` example below) | - -### Provider Type `horizon` - -VMware Horizon is a platform for delivering virtual desktops and apps -efficiently and securely across hybrid cloud for the best end-user digital -workspace experience. - -This provider supports all audit events (model `AuditEventSummary`) exposed -through the Horizon REST API starting with -[version](https://code.vmware.com/apis/1169/view-rest-api#/External/listAuditEvents) -`2106`. - -The following table lists allowed and required fields for connecting to the -Horizon REST API and the respective type values and examples for these fields. - -| Field | Type | Description | Required | Example | -|---------------|---------|-----------------------------|----------|----------------------------------------| -| `address` | String | URI of the Horizon REST API | true | `https://api.myhorizon.corp.local` | -| `insecureSSL` | Boolean | Skip TSL verification | true | `true` (i.e. ignore errors) | -| `` | Object | Horizon domain credentials | true | (see `active_directory` example below) | - -### Provider Type `webhook` - -The `webhook` event provider listens for incoming -[CloudEvents](https://cloudevents.io/) (binary or structured mode) on a -configurable HTTP server in the VMware Event Router. The HTTP method used to -send the CloudEvent must be `POST`. - -The following table lists allowed and required fields for setting up a webhook -server. - -| Field | Type | Description | Required | Example | -|---------------|--------|--------------------------------------------------------------------------------|----------|----------------------------------| -| `bindAddress` | String | TCP/IP socket and port to listen on (**do not** add any URI scheme or slashes) | true | `0.0.0.0:8080` | -| `path` | String | Webhook endpoint path (must not be `/`) | true | `/webhook` | -| `` | Object | Configure `basic_auth` for incoming requests | false | (see `basic_auth` example below) | - -**Note:** When the VMware Event Router log level is `DEBUG` incoming webhook -requests (method, path, headers, remote address) will be logged. - -### Provider Type `vcsim` - -⚠️ This provider is **deprecated** and will be removed in future versions. The -`vcenter` provider will work correctly against a `vcsim` instance. - -The following table lists allowed and required fields for connecting to the -govmomi vCenter Simulator -[vcsim](https://github.com/vmware/govmomi/tree/master/vcsim) and the respective -type values and examples for these fields. - -| Field | Type | Description | Required | Example | -|---------------|---------|---------------------------------------|----------|----------------------------------| -| `address` | String | URI of the govmomi vCenter simulator | true | `https://127.0.0.1:8989/sdk` | -| `insecureSSL` | Boolean | Skip TSL verification | true | `true` (i.e. ignore errors) | -| `` | Object | govmomi vCenter simulator credentials | true | (see `basic_auth` example below) | - -> **Note:** This event provider has some limitations and currently does not -> behave like a "real" vCenter Server event stream, e.g. see issue -> [#2134](https://github.com/vmware/govmomi/issues/2134). This provider is for -> prototyping/testing purposes only. - -## The `eventProcessor` section - -The following table lists allowed and required fields with their respective type -values and examples for these fields. - -| Field | Type | Description | Required | Example | -|--------------------|--------|-----------------------------------------|----------|---------------------------------------------| -| `type` | String | Type of the event processor | true | `knative`, `openfaas` or `aws_event_bridge` | -| `name` | String | Name identifier for the event processor | true | `knative-broker-PROD` | -| `` | Object | Processor specific configuration | true | (see specific processor type section below) | - -### Processor Type `knative` - -Knative is a Kubernetes-based platform to deploy and manage modern serverless -workloads. Knative has two core building blocks, that is Serving (Knative -`Service`) and Eventing (`Broker`, `Channel`, etc.). - -The VMware Event Router can be configured to directly send events to any -*addressable* Knative resource ("reference"), e.g. a Knative `Broker` or -`Service`. `Broker` is the recommended deployment model for the VMware Event -Router. Please see the Knative documentation on -[Eventing](https://knative.dev/docs/eventing/) for details around brokers, -triggers, event filtering, etc. - -Alternatively, the router can send events to a URI, e.g. an external HTTP endpoint accepting -CloudEvents. - -The following table lists allowed and optional fields for using Knative as an -event `processor`. - -| Field | Type | Description | Required | Example | -|-----------------|---------|------------------------------------------------------------------------------------------------------------------------------------------------------------|----------|-----------------------------------| -| `` | Object | Knative *addressable* Destination to send events to. | true | (see `destination` section below) | -| `encoding` | Boolean | Cloud Events message [encoding](https://github.com/cloudevents/spec/blob/v1.0/spec.md#message) | true | `structured` or `binary` | -| `insecureSSL` | Boolean | Skip TSL verification | true | `true` (i.e. ignore errors) | -| `` | Object | **Optional:** authentication data (see auth section below). Omit section if your Knative Service, URI (Ingress) or Broker does not enforce authentication. | false | (see `basic_auth` example below) | - -> **Note:** When sending events to a Knative `Broker`, the Knative broker will always -> send `binary` encoded cloud events to the Knative sinks, e.g. triggered `Service`. - -#### Destination - -Knative abstracts event receivers ("sinks") in a very flexible way via -*addressable* `Destinations`. The VMware Event Router technically supports all -Knative `Destinations`. However, Knative `Broker` or Knative `Services` are -likely the ones you will be using. - -> **Note:** We have not done any testing for Knative `Channels`, since -> request response style interactions are out of scope for the VMware Event -> Router. - -The following table lists the available destination types for the `destination` section in -the router configuration when targeting a URI. - -| Field | Type | Description | Required | Example | -|--------------|--------|----------------------------------------------------------------|-----------------------|-------------------------------| -| `` | Object | URI can be used to send events to an external HTTP(S) endpoint | one_of `uri` or `ref` | | -| `uri.scheme` | String | URI scheme | `true` | `http` or `https` | -| `uri.host` | String | URI target host | `true` | `gateway-external.corp.local` | - -The following table lists the available destination types for the `destination` section in -the router configuration when targeting a URI. - -| Field | Type | Description | Required | Example | -|------------------|--------|---------------------------------------------------------------------------------------|-----------------------|-------------------------------------------------------| -| `` | Object | Ref can be used to send events to a *addressable* Kubernetes or Knative target (sink) | one_of `uri` or `ref` | | -| `ref.apiVersion` | String | Kubernetes API version of the target | `true` | `eventing.knative.dev/v1` or `serving.knative.dev/v1` | -| `ref.kind` | String | Kubernetes Kind of the target | `true` | `Broker` or `Service` | -| `ref.name` | String | Kubernetes object name for the given `kind` and `apiVersion` | `true` | `mybroker` | -| `ref.namespace` | String | Kubernetes namespace for the given object reference | `true` | `default` | - - -> **Note:** Only one of `uri` or `ref` MUST be specified. The list of all -> available URI options is documented [here](https://pkg.go.dev/net/url#URL). - -> **Note:** A vanilla Kubernetes `Service` can also be specified when using -> `Ref` as the destination type. Use `v1` in the `apiVersion` section. - - -### Processor Type `openfaas` - -OpenFaaS functions can subscribe to the event stream via function `"topic"` -annotations in the function stack configuration (see OpenFaaS documentation for -details on authoring functions), e.g.: - -```yaml -annotations: - topic: "VmPoweredOnEvent,VmPoweredOffEvent" -``` - -> **Note:** One or more event categories can be specified, delimited via `","`. -> A list of event names (categories) and how to retrieve them can be found -> [here](https://github.com/lamw/vcenter-event-mapping/blob/master/vsphere-6.7-update-3.md). -> A simple "echo" function useful for testing is provided -> [here](https://github.com/embano1/of-echo/blob/master/echo.yml). - -The following table lists allowed and optional fields for using OpenFaaS as an -event `processor`. - -| Field | Type | Description | Required | Example | -|-----------|---------|-------------------------------------------------------------------------------------------------------------------|----------|--------------------------------------------------| -| `address` | String | URI of the OpenFaaS gateway | true | `http://gateway.openfaas:8080` | -| `async` | Boolean | Specify how to invoke functions (synchronously or asynchronously) | true | `false` (i.e. use sync function invocation mode) | -| `` | Object | **Optional:** authentication data (see auth section below). Omit section if OpenFaaS gateway auth is not enabled. | false | (see `basic_auth` example below) | - -### Processor Type `aws_event_bridge` - -Amazon EventBridge is a serverless event bus that makes it easy to connect -applications together using data from your own applications, integrated -Software-as-a-Service (SaaS) applications, and AWS services. In order to reduce -bandwidth and costs (number of events ingested, see -[pricing](https://aws.amazon.com/eventbridge/pricing/)), VMware Event Router -only forwards events configured in the associated `rule` of an event bus. Rules -in AWS EventBridge use pattern matching -([docs](https://docs.aws.amazon.com/eventbridge/latest/userguide/filtering-examples-structure.html)). -Upon start, VMware Event Router contacts EventBridge (using the given IAM role) -to parse the configured rule ARN (see configuration option below). - -The VMware Event Router uses the pattern match library which supports a subset -of the EventBridge pattern rules. You may only use these supported patterns in -your specified EventBridge rule. Refer to [this -page](https://github.com/timbray/quamina/blob/v0.2.0/PATTERNS.md) for the -currently supported patterns in `Quamina`. - -> **Note:** EventBridge wraps each VMware Event Router event (CloudEvent) into -> an EventBridge message envelop. The `detail` field contains the JSON -> representation of the full CloudEvent as produced by the VMware Event Router. - -The following examples show supported and useful patterns. - -Example: Forward all CloudEvents containing one of the specified `subjects`: - -```json -{ - "detail": { - "subject": ["VmPoweredOnEvent", "VmPoweredOffEvent", "DrsVmPoweredOnEvent"] - } -} -``` - -Example: Forward all CloudEvents containing a `subject` with the prefix `Vm`: - -```json -{ - "detail": { - "subject": [{ - "shellstyle": "Vm*" - }] - } -} -``` - -Example: Forward all CloudEvents containing virtual machines with the prefix -`Linux`: - -```json -{ - "detail": { - "data": { - "Vm": { - "Name": [{ - "shellstyle": "Linux*" - }] - } - } - } -} -``` - -> **Note:** A list of event names (categories) and how to retrieve them can be -> found -> [here](https://github.com/lamw/vcenter-event-mapping/blob/master/vsphere-6.7-update-3.md). - -The following table lists allowed and optional fields for using AWS EventBridge -as an event `processor`. - -| Field | Type | Description | Required | Example | -|------------|--------|-----------------------------------------------------------------------------------------------------------------------------------------|----------|------------------------------------------------------------------------| -| `region` | String | AWS region to use, see [regions doc](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/Concepts.RegionsAndAvailabilityZones.html). | true | `us-west-1` | -| `eventBus` | String | Name of the event bus to use | true | `default` or `arn:aws:events:us-west-1:1234567890:event-bus/customBus` | -| `ruleARN` | String | Rule ARN to use for event pattern matching | true | `arn:aws:events:us-west-1:1234567890:rule/vmware-event-router` | -| `` | Object | AWS IAM role credentials | true | (see `aws_access_key` and `aws_iam_role` examples below) | - -## The `auth` section - -The following table lists allowed and required fields with their respective type -values and examples for these fields. Since the various `processors` and -`providers` use different authentication mechanisms (or none at all) this -section describes the various options. - -### Type `basic_auth` - -Supported providers/processors: - -- `vcenter` (required: `true`) -- `vcsim` (required: `true`) -- `openfaas` (required: `false`, i.e. optional) -- `default` metrics server (see below) (required: `false`, i.e. optional) - -| Field | Type | Description | Required | Example | -|----------------------|--------|-----------------------------------------|----------|--------------| -| `type` | String | Authentication method to use | true | `basic_auth` | -| `basicAuth` | Object | Use when `basic_auth` type is specified | true | | -| `basicAuth.username` | String | Username | true | `admin` | -| `basicAuth.password` | String | Password | true | `P@ssw0rd` | - -### Type `aws_access_key` - -Use an AWS IAM role with the provided access key ID and secret access key for -authentication. - -Supported providers/processors: - -- `aws_event_bridge` - -| Field | Type | Description | Required | Example | -|------------------------------|--------|---------------------------------------------|----------|------------------| -| `type` | String | Authentication method to use | true | `aws_access_key` | -| `awsAccessKeyAuth` | Object | Use when `aws_access_key` type is specified | true | | -| `awsAccessKeyAuth.accessKey` | String | Access Key ID for the IAM role used | true | `ABCDEFGHIJK` | -| `awsAccessKeyAuth.secretKey` | String | Secret Access Key for the IAM role used | true | `ZYXWVUTSRQPO` | - -> **Note:** Please follow the EventBridge IAM [user -> guide](https://docs.aws.amazon.com/eventbridge/latest/userguide/getting-set-up-eventbridge.html) -> before deploying the event router. Further information can also be found in -> the -> [authentication](https://docs.aws.amazon.com/eventbridge/latest/userguide/auth-and-access-control-eventbridge.html#authentication-eventbridge) -> section. - -In addition to the recommendation in the AWS EventBridge user guide you might -want to lock down the IAM role for the VMware Event Router and scope it to these -permissions ("Action"): - -```json -{ - "Version": "2012-10-17", - "Statement": [ - { - "Sid": "VisualEditor0", - "Effect": "Allow", - "Action": [ - "events:PutEvents", - "events:ListRules", - "events:TestEventPattern" - ], - "Resource": "*" - } - ] -} -``` - -### Type `aws_iam_role` - -Use an AWS IAM role configured from the shared credentials file. - -Supported providers/processors: - -- `aws_event_bridge` - -| Field | Type | Description | Required | Example | -|--------|--------|------------------------------|----------|----------------| -| `type` | String | Authentication method to use | true | `aws_iam_role` | - -> **Note:** Please follow the EventBridge IAM [user -> guide](https://docs.aws.amazon.com/eventbridge/latest/userguide/getting-set-up-eventbridge.html) -> before deploying the event router. Further information can also be found in -> the -> [authentication](https://docs.aws.amazon.com/eventbridge/latest/userguide/auth-and-access-control-eventbridge.html#authentication-eventbridge) -> section. - -In addition to the recommendation in the AWS EventBridge user guide you might -want to lock down the IAM role for the VMware Event Router and scope it to these -permissions ("Action"): - -```json -{ - "Version": "2012-10-17", - "Statement": [ - { - "Sid": "VisualEditor0", - "Effect": "Allow", - "Action": [ - "events:PutEvents", - "events:ListRules", - "events:TestEventPattern" - ], - "Resource": "*" - } - ] -} -``` - -### Type `active_directory` - -Supported providers/processors: - -- `horizon` (required: `true`) - -| Field | Type | Description | Required | Example | -|--------------------------------|--------|-----------------------------------------------|----------|--------------------| -| `type` | String | Authentication method to use | true | `active_directory` | -| `activeDirectoryAuth` | Object | Use when `active_directory` type is specified | true | | -| `activeDirectoryAuth.domain` | String | Domain | true | `corp` | -| `activeDirectoryAuth.username` | String | Username | true | `administrator` | -| `activeDirectoryAuth.password` | String | Password | true | `P@ssw0rd` | - -> **Note:** UPN authentication, e.g. `administrator@corp.local` as `username`, -> is not supported. - -## The `metricsProvider` section - -The VMware Event Router currently only exposes a default ("internal" or "embedded") metrics -endpoint. In the future, support for more providers is planned, e.g. Wavefront, -Prometheus, etc. - -| Field | Type | Description | Required | Example | -|-------------------|--------|---------------------------------|----------|-----------------------------------------| -| `type` | String | Type of the metrics provider | true | `default` | -| `name` | String | Name of the metrics provider | true | `metrics-server-veba` | -| `` | Object | Provider specific configuration | true | See metrics provider type section below | - -### Provider Type `default` - -The VMware Event Router exposes metrics in JSON format on a configurable HTTP -listener, e.g. `http:///stats`. The following table lists allowed -and optional fields for configuring the `default` metrics server. - -| Field | Type | Description | Required | Example | -|---------------|--------|---------------------------------------------------------------------------------------------|----------|----------------------------| -| `bindAddress` | String | TCP/IP socket and port to listen on (**do not** add any URI scheme or slashes) | true | `"0.0.0.0:8082"` | -| `` | Object | **Optional:** authentication data (see auth section). Omit section if auth is not required. | false | (see `basic_auth` example) | - -# Deployment - -VMware Event Router can be deployed and run as standalone binary (see -[below](#build-from-source)). However, it is designed (and recommended) to be -run in a Kubernetes cluster for increased availability and ease of scaling out. - -> **Note:** Docker images are available -> [here](https://hub.docker.com/r/vmware/veba-event-router). - -## Assisted Deployment - -For your convenience we provide a Helm Chart which can be used to easily install -the VMware Event Router into an **existing** Knative or OpenFaaS ("faas-netes") -environment. - -⚠️ The OpenFaaS deployment method is unmaintained in the VEBA project and -will be deprecated in a future release. The recommended deployment method is -using the Knative backend. - -### Helm Deployment - -The Helm files are located in the [chart](https://github.com/vmware-samples/vcenter-event-broker-appliance/tree/master/vmware-event-router/chart) directory. The `values.yaml` -file contains the allowed parameters and parameter descriptions which map to the -VMware Event Router [configuration](#overview-configuration-file-structure-yaml) -file. - -#### Option 1: Configuration with Knative - -If you don't have a working Knative installation, follow the steps described in -the [official](https://knative.dev/docs/install/prerequisites/) documentation to -deploy Knative Serving **and** Eventing. - -Now create a Helm `override.yaml` file with your environment specific settings, -e.g.: - -```yaml -eventrouter: - config: - logLevel: debug - vcenter: - address: https://vcenter.corp.local - username: administrator@vsphere.local - password: replaceMe - insecure: true # if required ignore TLS certs - eventProcessor: knative - knative: - destination: # follows Knative convention for ref/uri - ref: - apiVersion: eventing.knative.dev/v1 - kind: Broker - name: default - namespace: default -``` - -> **Note:** Please ensure the correct formatting/indentation which follows the -> Helm `values.yaml` file. - -#### Option 2: Configuration with OpenFaaS - -The following steps can be used to quickly install OpenFaaS as a requirement for -the Helm installation instructions of the VMware Event Router below. Skip this -part if you already have an OpenFaaS environment set up. - -```console -kubectl create ns openfaas && kubectl create ns openfaas-fn - -helm repo add openfaas https://openfaas.github.io/faas-netes && \ - helm repo update \ - && helm upgrade openfaas --install openfaas/openfaas \ - --namespace openfaas \ - --set functionNamespace=openfaas-fn \ - --set generateBasicAuth=true - -OF_PASS=$(echo $(kubectl -n openfaas get secret basic-auth -o jsonpath="{.data.basic-auth-password}" | base64 --decode)) -``` - -Now create a Helm `override.yaml` file with your environment specific settings, -e.g.: - -```yaml -eventrouter: - config: - logLevel: debug - vcenter: - address: https://vcenter.corp.local - username: administrator@vsphere.local - password: replaceMe - insecure: true # if required ignore TLS certs - eventProcessor: openfaas - openfaas: - address: http://gateway.openfaas:8080 - basicAuth: true - username: admin - password: ${OF_PASS} # variable from previous section - -``` - -> **Note:** Please ensure the correct formatting/indentation which follows the -> Helm `values.yaml` file. - -#### Deploy the VMware Event Router Helm Chart - -Add the VMware Event Router Helm release to your Helm repository: - -```console -# adds the veba chartrepo to the list of local registries with the repo name "veba" -$ helm repo add vmware-veba https://projects.registry.vmware.com/chartrepo/veba -``` - -To ensure new releases are pulled/updated and reflected locally update the repo index: - -```console -$ helm repo update -Hang tight while we grab the latest from your chart repositories... -...Successfully got an update from the "vmware-veba" chart repository -Update Complete. ⎈ Happy Helming!⎈ -``` - -The chart should now show up in the search: - -```console -$ helm search repo event-router -NAME CHART VERSION APP VERSION DESCRIPTION -vmware-veba/event-router v0.7.0 v0.7.0 The VMware Event Router is used to connect to v... -[snip] -``` - -> **Note:** To list/install development releases add the `--devel` flag to the Helm CLI. - -Now install the chart using a Helm release name of your choice, e.g. `veba`, -using the configuration override file created above. The following command will -create a release from the chart in the namespace `vmware`, which will be -automatically created if it does not exist: - -```console -$ helm install -n vmware --create-namespace veba vmware-veba/event-router -f override.yaml -NAME: veba -LAST DEPLOYED: Mon Jun 28 16:27:27 2020 -NAMESPACE: vmware -STATUS: deployed -REVISION: 1 -TEST SUITE: None -``` - -Check the logs of the VMware Event Router to validate it is operating correctly: - -```console -$ kubectl -n vmware logs deploy/router -f -``` - -If you run into issues, the logs should give you a hint, e.g.: - -- configuration file not found -> file naming issue -- connection to vCenter/OpenFaaS cannot be established -> check values, - credentials (if any) in the configuration file -- deployment/pod will not even come up -> check for resource issues, docker pull - issues and other potential causes using the standard `kubectl` troubleshooting - ways - -To uninstall the release run: - -```console -$ helm -n vmware uninstall veba -``` - -#### Creating/Updating the Chart - -Before running the following commands make the appropriate changes to the chart, -e.g. bumping up `version` and/or `appVersion` in `Chart.yaml`. - -```console -$ cd chart -$ helm package -d releases . -``` - -Then upload the created `.tgz` file inside `releases/` to your Helm chart repo. - -### Manual Deployment - -Create a namespace where the VMware Event Router will be deployed to: - -```console -$ kubectl create namespace vmware -``` - -Use one of the configuration files provided [here](https://github.com/vmware-samples/vcenter-event-broker-appliance/tree/master/vmware-event-router/deploy) to configure the -router with **one** VMware vCenter Server `eventProvider` and **one** OpenFaaS -**or** AWS EventBridge `eventProcessor`. Change the values to match your -environment. The following example will use the OpenFaaS config sample. - -> **Note:** Before continuing, make sure your environment is up and running, -> including Kubernetes and the configured event `processor`. - -After you made your changes to the configuration file, save it as -`"event-router-config.yaml` in your current Git working directory. - -> **Note:** If you have changed the port of the metrics server in the -> configuration file (default: 8080) make sure to also change that value in the -> YAML manifest (under the Kubernetes service entry). - -Now, from your current Git working directory create a Kubernetes -[secret](https://kubernetes.io/docs/concepts/configuration/secret/) with the -configuration file as input: - -```console -$ kubectl -n vmware create secret generic event-router-config --from-file=event-router-config.yaml -``` - -> **Note:** You might want to delete the (local) configuration file to not leave -> behind sensitive information on your local machine. - -If you have configured `knative` as your event `processor` you must also create -a `ClusterRoleBinding` for the VMware Event Router so it can lookup Knative -`destinations`. - -#### Create Knative ClusterRoleBinding (skip if not using Knative) - -The following commands creates the `ClusterRoleBinding` assuming the VMware -Event Router will be deployed into the `vmware` namespace using the predefined -service account (deployment manifest). This requires a properly configured -Knative environment with `Serving` and `Eventing` CRDs installed. - -```console -# only for Knative-based deployments -$ kubectl create clusterrolebinding veba-addressable-resolver --clusterrole=knative-serving-aggregated-addressable-resolver --serviceaccount=vmware:vmware-event-router -``` - -```console -$ kubectl describe clusterrole addressable-resolver -Name: knative-serving-aggregated-addressable-resolver -Labels: serving.knative.dev/release=v0.23.0 -Annotations: -PolicyRule: - Resources Non-Resource URLs Resource Names Verbs - --------- ----------------- -------------- ----- - services [] [] [get list watch] - brokers.eventing.knative.dev/status [] [] [get list watch] - brokers.eventing.knative.dev [] [] [get list watch] - parallels.flows.knative.dev/status [] [] [get list watch] - parallels.flows.knative.dev [] [] [get list watch] - sequences.flows.knative.dev/status [] [] [get list watch] - sequences.flows.knative.dev [] [] [get list watch] - channels.messaging.knative.dev/status [] [] [get list watch] - channels.messaging.knative.dev [] [] [get list watch] - inmemorychannels.messaging.knative.dev/status [] [] [get list watch] - inmemorychannels.messaging.knative.dev [] [] [get list watch] - parallels.messaging.knative.dev/status [] [] [get list watch] - parallels.messaging.knative.dev [] [] [get list watch] - sequences.messaging.knative.dev/status [] [] [get list watch] - sequences.messaging.knative.dev [] [] [get list watch] - routes.serving.knative.dev/status [] [] [get list watch] - routes.serving.knative.dev [] [] [get list watch] - services.serving.knative.dev/status [] [] [get list watch] - services.serving.knative.dev [] [] [get list watch] - channels.messaging.knative.dev/finalizers [] [] [update] -``` - -#### Create the VMware Event Router Deployment - -Now we can deploy the VMware Event Router. - -Download the latest deployment manifest (release.yaml) file from the Github -[release](https://github.com/vmware-samples/vcenter-event-broker-appliance/releases) -page. Then save the file under the same name (to follow along with the -commands). - -Example Download with `curl`: - -```console -curl -L -O https://github.com/vmware-samples/vcenter-event-broker-appliance/releases/latest/download/release.yaml -``` - -Deploy the VMware Event Router: - -```console -$ kubectl -n vmware create -f release.yaml -``` - -Check the logs of the VMware Event Router to validate it started correctly: - -```console -$ kubectl -n vmware logs deploy/vmware-event-router -f -``` - -If you run into issues, the logs should give you a hint, e.g.: - -- configuration file not found -> file naming issue -- connection to vCenter/OpenFaaS cannot be established -> check values, - credentials (if any) in the configuration file -- deployment/pod will not even come up -> check for resource issues, docker pull - issues and other potential causes using the standard `kubectl` troubleshooting - ways - -To delete the deployment and secret simply delete the namespace we created -earlier: - -```console -$ kubectl delete namespace vmware -``` - -## CLI Flags - -By default the VMware Event Router binary will look for a YAML configuration -file named `/etc/vmware-event-router/config`. The default log level is `info` -and human readable colored console logs will be printed. This behavior can be -overridden via `log-json` to generate JSON logs and `log-level` to change the -log level. Stack traces are only generated in level `error` or higher. - -```console -$ ./vmware-event-router -h - - _ ____ ___ ______ __ ____ __ -| | / / |/ / ______ _________ / ____/ _____ ____ / /_ / __ \____ __ __/ /____ _____ -| | / / /|_/ / | /| / / __ / ___/ _ \ / __/ | | / / _ \/ __ \/ __/ / /_/ / __ \/ / / / __/ _ \/ ___/ -| |/ / / / /| |/ |/ / /_/ / / / __/ / /___ | |/ / __/ / / / /_ / _, _/ /_/ / /_/ / /_/ __/ / -|___/_/ /_/ |__/|__/\__,_/_/ \___/ /_____/ |___/\___/_/ /_/\__/ /_/ |_|\____/\__,_/\__/\___/_/ - -Usage of dist/vmware-event-router: - - -config string - path to configuration file (default "/etc/vmware-event-router/config") - -log-json - print JSON-formatted logs - -log-level string - set log level (debug,info,warn,error) (default "info") - -``` \ No newline at end of file diff --git a/docs/kb/intro-functions.md b/docs/kb/intro-functions.md index 211ed829..ca07bc68 100644 --- a/docs/kb/intro-functions.md +++ b/docs/kb/intro-functions.md @@ -8,23 +8,26 @@ cta: title: Get Started description: Extend your vCenter seamlessly with our pre-built functions actions: - - text: Install the [Appliance with Knative](install-knative) to extend your SDDC with our [community-sourced functions](/examples) + - text: Install the [Appliance](install-veba) to extend your SDDC with our [community-sourced functions](/examples) - text: Learn more about the [Events in vCenter](vcenter-events) and the [Event Specification](eventspec) used to send the events to a Function - text: Find steps to deploy a function - [instructions](use-functions). --- # Functions -The VMware Event Broker Appliance can be deployed using the Knative event processor to provide customers with a Function-as-a-Service (FaaS) platform. +The VMware Event Broker Appliance will be deployed with Knative being the event processor to provide customers with a Function-as-a-Service (FaaS) platform. ## Table of Contents -- [Knative](#knative) - - [Knative Naming and Version Control](#knative-naming-and-version-control) + +- [Functions](#functions) + - [Table of Contents](#table-of-contents) + - [Knative](#knative) + - [Knative Naming and Version Control](#knative-naming-and-version-control) - [Knative Service](#knative-service) - - [Knative Trigger](#knative-trigger) - - [Knative Combined Service and Trigger](#knative-combined-service-and-trigger) - - [Knative Secrets](#knative-secrets) - - [Knative Environment Variables](#knative-environment-variables) + - [Knative Trigger](#knative-trigger) + - [Knative Combined Service and Trigger](#knative-combined-service-and-trigger) + - [Knative Secrets](#knative-secrets) + - [Knative Environment Variables](#knative-environment-variables) ## Knative @@ -38,19 +41,22 @@ When it comes to authoring functions, it's important to understand the different A Knative Service `kn-service.yaml` defines the container image that will be executed upon invocation. -``` +```yaml apiVersion: serving.knative.dev/v1 kind: Service metadata: - name: kn-ps-echo - namespace: vmware-functions - labels: - app: veba-ui + name: kn-ps-echo + labels: + app: veba-ui spec: - template: - spec: - containers: - - image: projects.registry.vmware.com/veba/kn-ps-echo:1.0 + template: + metadata: + annotations: + autoscaling.knative.dev/maxScale: "1" + autoscaling.knative.dev/minScale: "1" + spec: + containers: + - image: ghcr.io/vmware-samples/vcenter-event-broker-appliance/kn-ps-echo:1.6 ``` `kn-ps-echo`: The name of the Knative Service. @@ -83,11 +89,11 @@ The value of this field: A Knative Trigger `kn-trigger.yaml` defines the vCenter Server events to subscribe from a given broker. By default, all events are subscribed to as shown in the example below. -``` +```yaml apiVersion: eventing.knative.dev/v1 kind: Trigger metadata: - name: veba-ps-echo-trigger + name: kn-ps-echo-trigger labels: app: veba-ui spec: @@ -99,7 +105,7 @@ spec: name: kn-ps-echo ``` -`veba-ps-echo-trigger`: The name of the Knative trigger +`kn-ps-echo-trigger`: The name of the Knative trigger The value of this field: @@ -115,7 +121,7 @@ The value of this field: To subscribe to a specific vCenter Server event, we can apply a filtering to our Knative Trigger like the example below: -``` +```yaml apiVersion: eventing.knative.dev/v1 kind: Trigger metadata: @@ -126,8 +132,7 @@ spec: broker: default filter: attributes: - type: com.vmware.event.router/event - subject: VmPoweredOffEvent + type: com.vmware.vsphere.VmPoweredOffEvent.v0 subscriber: ref: apiVersion: serving.knative.dev/v1 @@ -147,14 +152,15 @@ The value of this field: `default`: The name of Knative broker. For VEBA with Embedded Knative Broker, the value will be `default` -`VmPoweredOffEvent`: The name of the vCenter Server event Id. Please refer to [vCenter Events](vcenter-events) for list of supported events. +`com.vmware.vsphere.VmPoweredOffEvent.v0`: The name of the vCenter Server event Id. Please refer to [vCenter Events](vcenter-events) for list of supported events. `kn-ps-echo`: The name of the Knative Service -Today, a single Knative Trigger can only filter on one vCenter Server event. To associate multiple vCenter Server events to a given Knative Service, you simply create a Knative Trigger for each event as shown in the two examples below, one for `VmPoweredOffEvent` and `DrsVmPoweredOnEvent` vCenter Events respectively: +Today, a single Knative Trigger can only filter on one vCenter Server event. To associate multiple vCenter Server events to a given Knative Service, you simply create a Knative Trigger for each event as shown in the two examples below, one for `com.vmware.vsphere.VmPoweredOffEvent.v0` and `com.vmware.vsphere.VmPoweredOnEvent.v0` vCenter Events respectively: `kn-trigger-1.yaml` -``` + +```yaml apiVersion: eventing.knative.dev/v1 kind: Trigger metadata: @@ -165,8 +171,7 @@ spec: broker: default filter: attributes: - type: com.vmware.event.router/event - subject: VmPoweredOffEvent + type: com.vmware.vsphere.VmPoweredOffEvent.v0 subscriber: ref: apiVersion: serving.knative.dev/v1 @@ -175,7 +180,8 @@ spec: ``` `kn-trigger-2.yaml` -``` + +```yaml apiVersion: eventing.knative.dev/v1 kind: Trigger metadata: @@ -186,8 +192,7 @@ spec: broker: default filter: attributes: - type: com.vmware.event.router/event - subject: DrsVmPoweredOnEvent + type: com.vmware.vsphere.VmPoweredOnEvent.v0 subscriber: ref: apiVersion: serving.knative.dev/v1 @@ -199,18 +204,22 @@ spec: To simplify Knative function deployment, we can also combine the multiple manifest files into a single file. In the example below, the `function.yaml` contains both the Knative Service and Trigger definition. -``` +```yaml apiVersion: serving.knative.dev/v1 kind: Service metadata: - name: kn-ps-echo - labels: - app: veba-ui + name: kn-ps-echo + labels: + app: veba-ui spec: - template: - spec: - containers: - - image: projects.registry.vmware.com/veba/kn-ps-echo:1.0 + template: + metadata: + annotations: + autoscaling.knative.dev/maxScale: "1" + autoscaling.knative.dev/minScale: "1" + spec: + containers: + - image: ghcr.io/vmware-samples/vcenter-event-broker-appliance/kn-ps-echo:1.6 --- apiVersion: eventing.knative.dev/v1 kind: Trigger @@ -222,8 +231,7 @@ spec: broker: default filter: attributes: - type: com.vmware.event.router/event - subject: VmPoweredOffEvent + type: com.vmware.vsphere.VmPoweredOffEvent.v0 subscriber: ref: apiVersion: serving.knative.dev/v1 @@ -274,7 +282,7 @@ kubectl -n vmware-functions label secret slack-secret app=veba-ui To use the newly created Kubernetes secret, we will need to add a new section to our Knative Service called `envFrom` as shown in the example below. -``` +```yaml apiVersion: serving.knative.dev/v1 kind: Service metadata: @@ -284,9 +292,12 @@ metadata: spec: template: metadata: + annotations: + autoscaling.knative.dev/maxScale: "1" + autoscaling.knative.dev/minScale: "1" spec: containers: - - image: projects.registry.vmware.com/veba/kn-ps-slack:1.0 + - image: ghcr.io/vmware-samples/vcenter-event-broker-appliance/kn-ps-slack:1.7 envFrom: - secretRef: name: slack-secret @@ -301,8 +312,7 @@ spec: broker: default filter: attributes: - type: com.vmware.event.router/event - subject: VmPoweredOffEvent + type: com.vmware.vsphere.VmPoweredOffEvent.v0 subscriber: ref: apiVersion: serving.knative.dev/v1 @@ -326,41 +336,43 @@ Knative functions also support defining additional environment variables that ca From within your function handler, you can now access the environment variable called `FUNCTION_DEBUG`. Using additional variables can be useful for debugging/troubleshooting purposes and can easily be changed by updating your Knative function deployment. -``` +```yaml apiVersion: serving.knative.dev/v1 kind: Service metadata: - name: kn-ps-slack - labels: - app: veba-ui + name: kn-ps-slack + labels: + app: veba-ui spec: - template: - metadata: - spec: - containers: - - image: projects.registry.vmware.com/veba/kn-ps-echo:1.0 - envFrom: - - secretRef: - name: slack-secret - env: - - name: FUNCTION_DEBUG - value: "true" + template: + metadata: + annotations: + autoscaling.knative.dev/maxScale: "1" + autoscaling.knative.dev/minScale: "1" + spec: + containers: + - image: ghcr.io/vmware-samples/vcenter-event-broker-appliance/kn-ps-slack:1.7 + envFrom: + - secretRef: + name: slack-secret + env: + - name: FUNCTION_DEBUG + value: "false" --- apiVersion: eventing.knative.dev/v1 kind: Trigger metadata: - name: veba-ps-echo-trigger + name: veba-ps-slack-trigger labels: app: veba-ui spec: broker: default filter: attributes: - type: com.vmware.event.router/event - subject: VmPoweredOffEvent + type: com.vmware.vsphere.VmPoweredOffEvent.v0 subscriber: ref: apiVersion: serving.knative.dev/v1 kind: Service name: kn-ps-slack -``` \ No newline at end of file +``` diff --git a/docs/kb/intro-tanzu-sources.md b/docs/kb/intro-tanzu-sources.md new file mode 100644 index 00000000..c4047fdb --- /dev/null +++ b/docs/kb/intro-tanzu-sources.md @@ -0,0 +1,654 @@ +--- +layout: docs +toc_id: tanzu-sources +title: VMware Tanzu Sources for Knative - Introduction +description: VMware Tanzu Sources for Knative Introduction +permalink: /kb/tanzu-sources +cta: + title: Get Started + description: Explore the capabilities that the VMware Tanzu Sources for Knative enables + actions: + - text: Install the [Appliance](install-veba) to extend your SDDC with our [community-sourced functions](/examples) + - text: Learn more about the [Events in vCenter](vcenter-events) and how to find the right event for your use case + - text: Learn more about Functions in this overview [here](functions). +--- + +# Introduction to VMware Tanzu Sources for Knative + +VMware [Tanzu Sources for +Knative](https://github.com/vmware-tanzu/sources-for-knative) are designed to +facilitate event-driven architectures and streamline the development of event +sources for Knative. +At its core, Tanzu Sources for Knative aims to simplify the connection between +event producers and the Knative Eventing ecosystem. + +The Tanzu Sources are the successor of the [VMware Event Router](https://github.com/vmware-samples/vcenter-event-broker-appliance/tree/development/vmware-event-router) +which originally got used by the VMware Event Broker Appliance project +as the core logic to forward [CloudEvents](https://cloudevents.io/), +e.g. from vSphere, to configurable event processors. + +The VMware Tanzu Sources are also using the CloudEvents +standard to normalize events from the supported event `providers`. + +This open-source project is officially maintained by VMware and used by the +VMware Event Broker Appliance as the core logic to source non-CloudEvent +conformant event-payloads from e.g. vSphere (`VSphereSource`) or +Horizon (`HorizonSource`) and to ultimately forward these +CloudEvent conformant to a configurable Knative +[Sink](https://knative.dev/docs/eventing/sinks/) (addressable destination). + +## Technical Components + +- **Source CRDs** (Custom Resource Definitions)**:** Tanzu Sources for Knative + leverages Kubernetes CRDs to define custom `sources`, making them a native part + of the Kubernetes API. +- **Controllers:** For each `source` type, there is a corresponding controller + responsible for managing the lifecycle of that `source` and ensuring the + delivery of events. +- **Event Delivery:** It uses Knative Eventing's robust delivery mechanisms, + such as brokers, channels and subscriptions, to deliver events to the + appropriate destinations. + + +## Table of Contents + +- [Introduction to VMware Tanzu Sources for Knative](#introduction-to-vmware-tanzu-sources-for-knative) + - [Technical Components](#technical-components) + - [Available `Sources`](#available-sources) + - [Event Delivery](#event-delivery) + - [Event `Provider` Delivery Guarantees](#event-provider-delivery-guarantees) + - [At-least-once Event Delivery](#at-least-once-event-delivery) + - [At-most-once Event Delivery](#at-most-once-event-delivery) + - [Current Limitations](#current-limitations) + - [Installation Tanzu Sources for Knative](#installation-tanzu-sources-for-knative) + - [Prerequisites](#prerequisites) + - [Configuration Source Type VSphereSource](#configuration-source-type-vspheresource) + - [Event Provider Type vCenter Server](#event-provider-type-vcenter-server) + - [Create a new VSphereSource via CLI](#create-a-new-vspheresource-via-cli) + - [Create a new VSphereSource via Manifest File](#create-a-new-vspheresource-via-manifest-file) + - [Configuration Source Type HorizonSource](#configuration-source-type-horizonsource) + - [Event Provider Type Horizon](#event-provider-type-horizon) + - [Event Viewer Application Sockeye](#event-viewer-application-sockeye) + - [Troubleshooting](#troubleshooting) + - [Delete a VSphereSource](#delete-a-vspheresource) + - [Delete a HorizonSource](#delete-a-horizonsource) + +## Available `Sources` + +- [VMware vCenter Server](https://www.vmware.com/products/vcenter-server.html) + - VMware vCenter Server is an advanced server management software that provides a +centralized platform for controlling your VMware vSphere environments. +- [VMware Horizon](https://www.vmware.com/products/horizon.html) + - VMware Horizon is a platform for delivering virtual desktops and apps +efficiently and securely across hybrid clouds. + +## Event Delivery + +Knative abstracts event receivers ([Sinks](https://knative.dev/docs/eventing/sinks/)) in a very flexible way via +*addressable* `Destinations`. The VMware Tanzu Sources for Knative technically +supports all Knative `Destinations`. However, Knative `Broker` or Knative +`Services` are likely the ones you will be using. + +> **Note:** We have not done any testing for Knative `Channels`, since request +> response style interactions are out of scope for the Tanzu Sources. + +### Event `Provider` Delivery Guarantees + +#### At-least-once Event Delivery + +- with the [vCenter event provider](#provider-type-vcenter) option `checkpoint: + true` +- with the [Horizon event provider](#provider-type-horizon) option `checkpoint: + true` + +The `Source` controller will periodically checkpoint its progress in the vCenter +event stream ("history") by using a Kubernetes `ConfigMap` as storage backend. +The name of the `ConfigMap` is `-configmap` (see example below). +By default, checkpoints will be created every `10 seconds`. The minimum +checkpoint frequency is `1s` but be aware of potential load on the Kubernetes +API this might cause. + +Checkpointing is useful to guarantee **at-least-once** event delivery semantics, +e.g. to guard against lost events due to controller downtime (maintenance, +crash, etc.). + +To influence the checkpointing logic, read up on the corresponding section on +Github - [Configuring Checkpoint and Event +Replay](https://github.com/vmware-tanzu/sources-for-knative#configuring-checkpoint-and-event-replay). + +#### At-most-once Event Delivery + +Checkpointing itself cannot be disabled and there will be exactly zero or one +checkpoint per controller. If **at-most-once** event delivery is desired, i.e. +no event replay upon controller start, simply set `maxAgeSeconds: 0`. + +- with the [vCenter event provider](#provider-type-vcenter) option `maxAgeSeconds: 0` +- with the [Horizon event provider](#provider-type-horizon) option `maxAgeSeconds: 0` + +> **Note:** Knative's built-in retry mechanisms is used so your function might +still be involved multiple times depending on its response code. However, if an +event `provider` crashes before sending an event to Knative or when the Knative +returns an error, the event is not retried and discarded. + +### Current Limitations + +- During the deployment of the VMware Event Broker Appliance (VM) to vSphere, + only one vSphere source and one Horizon source can be configured at a time + (see note below) +- At-least-once event delivery semantics are not guaranteed if a source crashes + **within seconds** right after startup and having received *n* events but + before creating the first valid checkpoint (current checkpoint interval is + 10s) +- If an event cannot be successfully delivered (retried) by Knative it is logged + and discarded, i.e. there is currently no support for [dead letter + queues](https://en.wikipedia.org/wiki/Dead_letter_queue) (see note below) + +> **Note:** It is possible though to run **multiple instances** of a source +> (e.g. `VSphereSource`) with different configurations to address multi-vCenter +> scenarios. This decision was made for scalability and resource/tenancy +> isolation purposes. + +> **Note:** Knative supports Dead Letter Queues when using `Broker` mode. + +For more detailed information check the official [VMware Tanzu Sources for +Knative](https://github.com/vmware-tanzu/sources-for-knative) repository on +Github. + +## Installation Tanzu Sources for Knative + +Installing Tanzu Sources for Knative is a straightforward process that enables +you to integrate VMware event sources into your Knative environment. + +### Prerequisites + +The following prerequisites must be in place: +- A running Kubernetes cluster (> v1.26.0) +- Access to a Kubernetes cluster and the ability to execute `kubectl` commands +- A running [Knative installation](https://knative.dev/docs/install/) (Serving and Eventing) +- Knative CLI installed - [Installing the Knative + CLI](https://knative.dev/docs/client/install-kn/) +- Knative CLI Plugin `knative-vsphere` installed + - Download the binary for your OS from the [Tanzu Sources page](https://github.com/vmware-tanzu/sources-for-knative/releases/) on Github + - `mv` the `kn-vsphere` binary into e.g. `/usr/local/bin/` + +Install Tanzu Sources for Knative by applying the YAML manifest provided by +VMware. This manifest defines the necessary Kubernetes resources for Knative +event sources. + +Use the `kubectl apply` command: + +```console +kubectl apply -f https://github.com/vmware-tanzu/sources-for-knative/releases/latest/download/release.yaml +``` + +```console +namespace/vmware-sources created +serviceaccount/horizon-source-controller created +serviceaccount/horizon-source-webhook created +clusterrole.rbac.authorization.k8s.io/vsphere-receive-adapter-cm created +clusterrole.rbac.authorization.k8s.io/vmware-sources-admin created +clusterrole.rbac.authorization.k8s.io/vmware-sources-core created +clusterrole.rbac.authorization.k8s.io/podspecable-binding configured +clusterrole.rbac.authorization.k8s.io/builtin-podspecable-binding configured +serviceaccount/vsphere-controller created +clusterrole.rbac.authorization.k8s.io/horizon-source-controller created +clusterrole.rbac.authorization.k8s.io/horizon-source-observer created +clusterrolebinding.rbac.authorization.k8s.io/vmware-sources-controller-admin created +clusterrolebinding.rbac.authorization.k8s.io/vmware-sources-webhook-podspecable-binding created +clusterrolebinding.rbac.authorization.k8s.io/vmware-sources-webhook-addressable-resolver-binding created +clusterrolebinding.rbac.authorization.k8s.io/horizon-source-controller-rolebinding created +clusterrolebinding.rbac.authorization.k8s.io/horizon-source-webhook-rolebinding created +clusterrolebinding.rbac.authorization.k8s.io/horizon-source-controller-addressable-resolver created +clusterrole.rbac.authorization.k8s.io/horizon-source-webhook created +customresourcedefinition.apiextensions.k8s.io/horizonsources.sources.tanzu.vmware.com created +customresourcedefinition.apiextensions.k8s.io/vspherebindings.sources.tanzu.vmware.com created +customresourcedefinition.apiextensions.k8s.io/vspheresources.sources.tanzu.vmware.com created +service/horizon-source-controller-manager created +service/horizon-source-webhook created +service/vsphere-source-webhook created +deployment.apps/horizon-source-controller created +mutatingwebhookconfiguration.admissionregistration.k8s.io/defaulting.webhook.horizon.sources.tanzu.vmware.com created +validatingwebhookconfiguration.admissionregistration.k8s.io/validation.webhook.horizon.sources.tanzu.vmware.com created +validatingwebhookconfiguration.admissionregistration.k8s.io/config.webhook.horizon.sources.tanzu.vmware.com created +secret/webhook-certs created +deployment.apps/horizon-source-webhook created +mutatingwebhookconfiguration.admissionregistration.k8s.io/defaulting.webhook.vsphere.sources.tanzu.vmware.com created +validatingwebhookconfiguration.admissionregistration.k8s.io/validation.webhook.vsphere.sources.tanzu.vmware.com created +validatingwebhookconfiguration.admissionregistration.k8s.io/config.webhook.vsphere.sources.tanzu.vmware.com created +secret/vsphere-webhook-certs created +mutatingwebhookconfiguration.admissionregistration.k8s.io/vspherebindings.webhook.vsphere.sources.tanzu.vmware.com created +deployment.apps/vsphere-source-webhook created +configmap/config-logging created +configmap/config-observability created +``` + +## Configuration Source Type VSphereSource + +The `VSphereSource` provides a simple mechanism to enable users to react to +vSphere events. + +### Event Provider Type vCenter Server + +VMware vCenter Server is an advanced server management software that provides a +centralized platform for controlling your VMware vSphere environments, allowing +you to automate and deliver a virtual infrastructure across the hybrid cloud +with confidence. + +Since VMware vCenter Server event types are environment +specific (vSphere version, extensions), a list of events for vCenter as an event +source can be found on the following Github repository - [William Lam - +vcenter-event-mapping](https://github.com/lamw/vcenter-event-mapping). + +A new `VSphereSource` can be configured in two ways: +1. Using the above mentioned `kn-vsphere` plugin +2. Applying a `VSphereSource` manifest file (yaml) using `kubectl` + +### Create a new VSphereSource via CLI + +The creation of a Kubernetes `basic-auth` secret is required in order to create +a new `VSphereSource`. + +```console +export VCENTER_USERNAME='read-only-user@vsphere.local' \ +export VCENTER_PASSWORD='my-secret-pwd' \ +export VCENTER_HOSTNAME='vcsa.mydomain.com' +``` + +The new `kn-vsphere` plugin for the Knative CLI (`kn`) can be used for this +task. + +Creating the new secret in the namespace `vmware-system`: + +```console +kn vsphere auth create \ +--namespace vmware-system \ +--username $VCENTER_USERNAME \ +--password $VCENTER_PASSWORD \ +--name vcsa-ro-creds \ +--verify-url https://$VCENTER_HOSTNAME \ +--verify-insecure +``` + +The created secret stores your sensible data: + +```console +kubectl -n vmware-system get secret vcsa-ro-creds -oyaml +``` + +```yaml +apiVersion: v1 +data: + password: + username: +kind: Secret +metadata: + name: vcsa-ro-creds + namespace: vmware-system +type: kubernetes.io/basic-auth +``` + +Create the new `VSphereSource` by also using the `kn-vsphere` plugin. Make sure +to not only provide valid vCenter data but also the correct Knative Sink data. +If the Sink is a Broker, retrieve the correct URI via `kn broker list -A`: + +```console +kn broker list -A + +NAMESPACE NAME URL AGE CONDITIONS READY REASON +vmware-functions default http://default-broker-ingress.vmware-functions.svc.cluster.local 167d 8 OK / 8 True +``` + +Create the new `VSphereSource` in the `vmware-system` namespace as well: + +```console +kn vsphere source create \ +--namespace vmware-system \ +--name vcsa-source \ +--vc-address https://$VCENTER_HOSTNAME \ +--skip-tls-verify \ +--secret-ref vcsa-ro-creds \ +--sink-uri http://default-broker-ingress.vmware-functions.svc.cluster.local \ +--encoding json + +Created source +``` + +First indications of its functionality can be validated by checking the logs: + +```console +kubectl -n vmware-system logs vcsa-source-adapter-58c744d8db-ttddd + +{"level":"info","ts":"2023-12-01T10:28:30.955Z","logger":"vsphere-source-adapter","caller":"vsphere/adapter.go:312","msg":"setting begin of event stream","commit":"8fda92a-dirty","beginTimestamp":"2023-12-01 10:28:30.950583 +0000 UTC"} +{"level":"info","ts":"2023-12-01T10:33:30.920Z","logger":"vsphere-source-adapter","caller":"vsphere/client.go:115","msg":"Executing SOAP keep-alive handler","commit":"8fda92a-dirty","rpc":"keepalive"} +{"level":"info","ts":"2023-12-01T10:33:30.939Z","logger":"vsphere-source-adapter","caller":"vsphere/client.go:121","msg":"vCenter current time: 2023-12-01 10:33:30.930277 +0000 UTC","commit":"8fda92a-dirty","rpc":"keepalive"} +{"level":"info","ts":"2023-12-01T10:38:30.940Z","logger":"vsphere-source-adapter","caller":"vsphere/client.go:115","msg":"Executing SOAP keep-alive handler","commit":"8fda92a-dirty","rpc":"keepalive"} +{"level":"info","ts":"2023-12-01T10:38:30.968Z","logger":"vsphere-source-adapter","caller":"vsphere/client.go:121","msg":"vCenter current time: 2023-12-01 10:38:30.965905 +0000 UTC","commit":"8fda92a-dirty","rpc":"keepalive"} +``` + +### Create a new VSphereSource via Manifest File + +The following table lists allowed and required fields for connecting to a +vCenter Server and the respective type values and examples for these fields. + +| Field | Type | Description | Required | Example | +|-----------------|---------|-------------------------------------------------------------------------------------------------------|----------|----------------------------------| +| `address` | String | URI of the VMware vCenter Server | true | `https://$VCENTER_HOSTNAME` | +| `skipTLSVerify` | Boolean | Skip TSL verification | true | `true` (i.e. ignore errors) | +| `checkpointConfig` | String | Configure checkpointing using options `maxAgeSeconds` and `periodSeconds`. | true | Defaults are `maxAgeSeconds: 300` and `periodSeconds: 10` | +| `payloadEncoding` | String | Set the CloudEvent data encoding scheme to e.g. `json` or `xml` | true | `payloadEncoding: application/json` | +| `secretRef` | Object | `secretRef` holds the name of the Kubernetes secret which is used by the source to authenticate against it. | true | see section [Authentication with vSphere](https://github.com/vmware-tanzu/sources-for-knative/tree/main#authenticating-with-vsphere) | +| `sink` | Object | Where to send the events. | true | Default for VEBA is the adress of the RabbitMQ broker: `http://default-broker-ingress.vmware-functions.svc.cluster.local` | + +The following `vspheresource.yaml` sample shows the configuration of the `VSphereSource` which got created above using the `kn vsphere` cli. + +```yaml +apiVersion: sources.tanzu.vmware.com/v1alpha1 +kind: VSphereSource +metadata: + name: vcsa-source + namespace: vmware-system +spec: + address: https://vcsa.mydomain.com + checkpointConfig: + maxAgeSeconds: 300 + periodSeconds: 10 + payloadEncoding: application/json + secretRef: + name: vcsa-ro-creds + sink: + uri: http://default-broker-ingress.vmware-functions.svc.cluster.local + skipTLSVerify: true +``` + +## Configuration Source Type HorizonSource + +The `HorizonSource` provides a simple mechanism to enable users to react to +Horizon events. + +### Event Provider Type Horizon + +VMware Horizon is a platform for delivering virtual desktops and apps +efficiently and securely across hybrid cloud for the best end-user digital +workspace experience. + +This provider supports all audit events (model `AuditEventSummary`) exposed +through the Horizon REST API starting with +[version](https://code.vmware.com/apis/1169/view-rest-api#/External/listAuditEvents) +`2106`. + +The following table lists allowed and required fields for connecting to the +Horizon REST API and the respective type values and examples for these fields. + +| Field | Type | Description | Required | Example | +|---------------|---------|-----------------------------|----------|----------------------------------------| +| `address` | String | URI of the Horizon REST API | true | `https://myhorizon.corp.local` | +| `skipTLSVerify` | Boolean | Skip TSL verification | true | `true` (i.e. ignore errors) | +| `secretRef` | Object | secretRef holds the name of the Kubernetes secret which is used by the source to authenticate against it. | true | See `secret` example below. | +| `sink` | Object | Where to send the events. | true | Default for VEBA is the adress of the RabbitMQ broker: `http://default-broker-ingress.vmware-functions.svc.cluster.local` | + +Create a Kubernetes `Secret` as per the name under `secretRef` in the +`HorizonSource` above which holds the required Horizon credentials. `domain`, +`username` and `password` are required fields. Replace the field values +accordingly. + +```shell +kubectl create secret generic horizon-credentials --from-literal=domain="example.com" --from-literal=username="horizon-source-account" --from-literal=password='ReplaceMe' +``` + +Modify the `HorizonSource` example according to your environment. + +`address` is the HTTPs endpoint of the Horizon API server. To skip TLS and +certificate verification, set `skipTLSVerify` to `true`. + +Change the values under `sink` to match your Knative Eventing environment. + +```yaml +apiVersion: sources.tanzu.vmware.com/v1alpha1 +kind: HorizonSource +metadata: + name: horizon-example +spec: + sink: + ref: + apiVersion: eventing.knative.dev/v1 + kind: Broker + name: example-broker + namespace: default + address: https://horizon.server.example.com + skipTLSVerify: false + secretRef: + name: horizon-credentials + serviceAccountName: horizon-source-sa +``` + +If the specified `serviceAccountName` does not exist, it will be created +automatically. + +```console +kubectl get serviceaccount + +NAME SECRETS AGE +default 0 5h7m +horizon-source-sa 0 152m +``` + +Verify the new created `HorizonSource`: + +```console +kn source list + +NAME TYPE RESOURCE SINK READY +horizon-example HorizonSource horizonsources.sources.tanzu.vmware.com broker:in-mem-broker True +``` + +```console +kubectl get horizonsources + +NAME SOURCE SINK READY REASON +horizon-example https://horizon.server.example.com http://broker-ingress.knative-eventing.svc.cluster.local/default/in-mem-broker True +``` + +The following example shows a Horizon `userloggedin` event displayed via the +event viewer application Sockeye (default in project VEBA). + +```json +[...] + + specversion: 1.0 + type: com.vmware.horizon.vlsi_userloggedin_rest.v0 + source: https://horizon.server.example.com + id: 3405990 + time: 2023-12-06T13:48:05Z + datacontenttype: application/json +Extensions, + knativearrivaltime: 2023-12-06T13:48:06.324666167Z +Data, +2023/12/06 13:48:06 Broadasting to 0 clients: {"data":{"id":3405990,"machine_dns_name":"horizon.server.example.com","message":"User example.com\\horizonedge has logged in to Horizon REST API","module":"Vlsi","severity":"AUDIT_SUCCESS","time":1701870485733,"type":"VLSI_USERLOGGEDIN_REST","user_id":"S-1-5-21-2404106297-684390199-568881881-4197"},"datacontenttype":"application/json","id":"3405990","knativearrivaltime":"2023-12-06T13:48:06.324666167Z","source":"https://horizon.server.example.com","specversion":"1.0","time":"2023-12-06T13:48:05Z","type":"com.vmware.horizon.vlsi_userloggedin_rest.v0"} + { + "id": 3405990, + "machine_dns_name": "horizon.server.example.com", + "message": "User example.com\\horizonedge has logged in to Horizon REST API", + "module": "Vlsi", + "severity": "AUDIT_SUCCESS", + "time": 1701870485733, + "type": "VLSI_USERLOGGEDIN_REST", + "user_id": "S-1-5-21-2404106297-684390199-568881881-4197" + } + +[...] +``` + +## Event Viewer Application Sockeye + +In order to provide users with the ability to display incoming events from a +source, the VEBA project is using the open-source event viewer application +[Sockeye](https://github.com/n3wscott/sockeye). When using the appliance +form factor the event viewer is accessible via `https://veba-fqdn/events`. + +The manual installation of Sockeye will be explained in section [Deploy Tanzu Sources to KinD](./deploy-tanzu-sources-kind.md). + + +The following example shows a vSphere `DrsVmPoweredOn` event displayed via Sockeye. + +```json +[...] +Context Attributes, + specversion: 1.0 + type: com.vmware.vsphere.DrsVmPoweredOnEvent.v0 + source: https://vcsa.mydomain.com/sdk + id: 16957152 + time: 2023-11-27T10:00:08.715999Z + datacontenttype: application/json +Extensions, + eventclass: event + knativearrivaltime: 2023-11-27T10:00:12.697365304Z + vsphereapiversion: 8.0.2.0 +Data, + { + "Key": 16957152, + "ChainId": 16957145, + "CreatedTime": "2023-11-27T10:00:08.715999Z", + "UserName": "mydomain.com\\Administrator", + "Datacenter": { + "Name": "DC1", + "Datacenter": { + "Type": "Datacenter", + "Value": "datacenter-1" + } + }, + "ComputeResource": { + "Name": "Cluster1", + "ComputeResource": { + "Type": "ClusterComputeResource", + "Value": "domain-c8" + } + }, + "Host": { + "Name": "esx01.mydomain.com", + "Host": { + "Type": "HostSystem", + "Value": "host-15" + } + }, + "Vm": { + "Name": "vm1", + "Vm": { + "Type": "VirtualMachine", + "Value": "vm-81" + } + }, + "Ds": null, + "Net": null, + "Dvs": null, + "FullFormattedMessage": "DRS powered on vm1 on esx01.mydomain.com in DC1", + "ChangeTag": "", + "Template": false + } +[...] +``` + +## Troubleshooting + +All components follow the Knative logging convention. +The log level (`debug`, `info`, `error`, etc. is configurable per component, +e.g. `vsphere-source-webhook`, `VSphereSource` adapter, etc. + +The default logging level is `info`. + +The log level for adapters, e.g. a particular `VSphereSource` `deployment` can +be changed at runtime via the `config-logging` `ConfigMap` which is created +when deploying the Tanzu Sources for Knative. + +⚠️ **Note:** These settings will affect **all adapter** (created sources) deployments. +Changes to a particular adapter deployment are currently not possible. + +```console +kubectl -n vmware-sources edit cm config-logging +``` + +An interactive editor opens. Change the settings in the JSON object under the +`zap-logger-config` key. For example, to change the log level from `info` to +`debug` use this configuration in the editor: + +```yaml +apiVersion: v1 +data: + # details omitted + zap-logger-config: | + { + "level": "debug" + "development": false, + "outputPaths": ["stdout"], + "errorOutputPaths": ["stderr"], + "encoding": "json", + "encoderConfig": { + "timeKey": "ts", + "levelKey": "level", + "nameKey": "logger", + "callerKey": "caller", + "messageKey": "msg", + "stacktraceKey": "stacktrace", + "lineEnding": "", + "levelEncoder": "", + "timeEncoder": "iso8601", + "durationEncoder": "", + "callerEncoder": "" + } + } +``` + +Save and leave the interactive editor to apply the `ConfigMap` changes. +Kubernetes will validate and confirm the changes: + +```console +configmap/config-logging edited +``` + +To verify that the `Source` adapter owners (e.g. `vsphere-source-webhook` for a +`VSphereSource`) have noticed the desired change, inspect the log messages of +the owner (here: `vsphere-source-webhook`) `Pod`: + +```console +vsphere-source-webhook-f7d8ffbc9-4xfwl vsphere-source-webhook {"level":"info","ts":"2022-03-29T12:25:20.622Z","logger":"vsphere-source-webhook","caller":"vspheresource/vsphere.go:250","msg":"update from logging ConfigMap{snip...} +``` + +⚠️ **Note:** To avoid unwanted disruption during event retrieval/delivery, the +changes are **not applied** automatically to deployed adapters, i.e. +`VSphereSource` adapter, etc. The operator is in full control over the lifecycle +(downtime) of the affected `Deployment(s)`. + +To make the changes take affect for existing adapter `Deployment`, an operator +needs to manually perform a rolling upgrade. The existing adapter `Pod` will be +terminated and a new instanced created with the desired log level changes. + +```console +kubectl get vspheresource + +NAME SOURCE SINK READY REASON +example-vc-source https://my-vc.corp.local http://broker-ingress.knative-eventing.svc.cluster.local/default/example-broker True +``` + +```console +kubectl rollout restart deployment/example-vc-source-adapter + +deployment.apps/example-vc-source-adapter restarted +``` + +⚠️ **Note:** To avoid losing events due to this (brief) downtime, consider +enabling the [Checkpointing](#configuring-checkpoint-and-event-replay) +capability. + + +More details can be found at the Tanzu Sources for Knative repository on Github - [Changing Log Levels](https://github.com/vmware-tanzu/sources-for-knative/tree/main#changing-log-levels). + +## Delete a VSphereSource + +```console +kn vsphere source delete --name vcsim-source --namespace ns-vcsim +``` + +## Delete a HorizonSource + +```console +kn source delete --name horizon-example --namespace vmware-system +``` diff --git a/docs/kb/private-registry.md b/docs/kb/private-registry.md index 36cd4335..5d50be15 100644 --- a/docs/kb/private-registry.md +++ b/docs/kb/private-registry.md @@ -8,7 +8,7 @@ cta: description: Using private container registry with the VMware Event Broker Appliance. --- -## Using private container registry with VEBA +## Using private Container Registry with VEBA By default, the VMware Event Broker Appliance can integrate with any Open Container Initiative (OCI) compliant container registry for hosting and deploying container images that uses a TLS certificate from a trusted authority such as [Docker Hub](https://hub.docker.com/) or [Amazon Elastic Container Registry (ECR)](https://aws.amazon.com/ecr/) as an example. @@ -16,7 +16,7 @@ For organizations that require the use of a private container registry and uses ### Assumptions -* VMware Event Broker Appliance v0.7.2 or later +* VMware Event Broker Appliance v0.7.5 or later * Root CA Certificates from a trusted authority has been pre-downloaded onto your local desktop * Un-deploy any functions that has been attempted using private registry prior to instructions below @@ -26,19 +26,19 @@ For organizations that require the use of a private container registry and uses In this example, the root CA certificate key file is named `ca.crt` and is located in `/root` -1. Copy the root CA certificate from your private registry to VMware Event Broker Appliance Appliance. If SSH has not been enabled, go ahead and start it up by logging into the VM Console and running the following command: +- **Step 1:** Copy the root CA certificate from your private registry to VMware Event Broker Appliance Appliance. If SSH has not been enabled, go ahead and start it up by logging into the VM Console and running the following command: ```console systemctl start sshd ``` -1. SSH to the VMware Event Broker Appliance and make a backup of the original containerd configuration file +- **Step 2:** SSH to the VMware Event Broker Appliance and make a backup of the original containerd configuration file ```console cp /etc/containerd/config.toml /etc/containerd/config.toml.bak ``` -1. Edit the '/etc/containerd/config.toml' file using VI and locate the following section `[plugins."io.containerd.grpc.v1.cri".registry.mirrors]` within the configuration file. +- **Step 3:** Edit the '/etc/containerd/config.toml' file using VI and locate the following section `[plugins."io.containerd.grpc.v1.cri".registry.mirrors]` within the configuration file. Append the following two lines below this section and replace the **REPLACE_ME_FQDN** value with FQDN of the private registry and **REPLACE_ME_PATH_TO_ROOT_CA_CERT** value the full path to the root CA certificate located on the VMware Event Broker Appliance @@ -48,13 +48,13 @@ Append the following two lines below this section and replace the **REPLACE_ME_F ca_file = "REPLACE_ME_PATH_TO_ROOT_CA_CERT" ``` -1. Restart the containerd service for the change to go into effect/. +- **Step 4:** Restart the containerd service for the change to go into effect/. ```console systemctl restart containderd ``` -1. Verify containerd is successfully running before proceeding to the next step +- **Step 5:** Verify containerd is successfully running before proceeding to the next step ```console systemctl status containerd @@ -70,19 +70,19 @@ systemctl status containerd CGroup: /system.slice/containerd.service ``` -1. Create a kubernetes secret in the `knative-serving` namespace that points to full path of the root CA certificate of private registry which should reside within the VMware Event Broker Appliance +- **Step 6:** Create a kubernetes secret in the `knative-serving` namespace that points to full path of the root CA certificate of private registry which should reside within the VMware Event Broker Appliance ```console kubectl -n knative-serving create secret generic customca --from-file=ca.crt=/root/ca.crt ``` -1. Retrieve the current Knative Serving controller deployment and save it to a file named `knative-serving-controller.yaml` +- **Step 7:** Retrieve the current Knative Serving controller deployment and save it to a file named `knative-serving-controller.yaml` ```console kubectl -n knative-serving get deploy/controller -o yaml > knative-serving-controller.yaml ``` -1. Create the following YTT overlay which will be used to patch the Knative Serving controller to reference the root CA certificate from the private registry +- **Step 8:** Create the following YTT overlay which will be used to patch the Knative Serving controller to reference the root CA certificate from the private registry ```console cat > overlay.yaml < new-knative-serving-controller.yaml ``` -1. Apply the new Knative Serving controller configuration +- **Step 10:** Apply the new Knative Serving controller configuration ```console kubectl apply -f new-knative-serving-controller.yaml diff --git a/docs/kb/troubleshoot-appliance.md b/docs/kb/troubleshoot-appliance.md index 17194da9..f4a93f81 100644 --- a/docs/kb/troubleshoot-appliance.md +++ b/docs/kb/troubleshoot-appliance.md @@ -6,15 +6,28 @@ description: Troubleshooting guide for general appliance issues permalink: /kb/troubleshoot-appliance cta: title: Still having trouble? - description: Please submit bug reports and feature requests by using our GitHub [Issues](https://github.com/vmware-samples/vcenter-event-broker-appliance/issues){:target="_blank"} page or Join us on slack [#vcenter-event-broker-appliance](https://vmwarecode.slack.com/archives/CQLT9B5AA){:target="_blank"} on vmwarecode.slack.com. + description: Please submit bug reports and feature requests by using our GitHub [Issues](https://github.com/vmware-samples/vcenter-event-broker-appliance/issues){:target="_blank"} page. --- -# VMware Event Broker Appliance - Troubleshooting + +# Troubleshooting VEBA + + +## Table of Contents + +- [Troubleshooting VEBA](#troubleshooting-veba) + - [Requirements](#requirements) + - [Troubleshooting an initial deployment](#troubleshooting-an-initial-deployment) + - [Recovering from a crashing vcsa-source-adapter pod](#recovering-from-a-crashing-vcsa-source-adapter-pod) + - [Check for completed installation](#check-for-completed-installation) + - [Examine log files](#examine-log-files) + - [Changing the vCenter service account](#changing-the-vcenter-service-account) + - [Troubleshooting VMware Event Broker Appliance vSphere UI](#troubleshooting-vmware-event-broker-appliance-vsphere-ui) ## Requirements You must log on to the VMware Event Broker appliance as root. If you did not enable SSH as part of the initial VMware Event Broker Appliance deployment, you can perform this operation at the console. To enable SSH access, execute the following command: -```bash +```console systemctl start sshd ``` @@ -22,157 +35,163 @@ This turns on the SSH daemon but does not enable it to start on appliance boot. If you wish to disable the SSH daemon when you are done troubleshooting, execute the following command: -```bash +```console systemctl stop sshd ``` + ## Troubleshooting an initial deployment If the appliance is not working immediately after deployment, the first thing to do is check your Kubernetes pods. -```bash +```console kubectl get pods -A ``` Here is the command output: -``` -k get pods -A -NAMESPACE NAME READY STATUS RESTARTS AGE -contour-external contour-5869594b-bmccv 1/1 Running 0 6h37m -contour-external contour-5869594b-jr4k8 1/1 Running 0 6h37m -contour-external contour-certgen-v1.10.0-btmlp 0/1 Completed 0 6h37m -contour-external envoy-hzhnz 2/2 Running 0 6h37m -contour-internal contour-5d47766fd8-5shp2 1/1 Running 0 6h37m -contour-internal contour-5d47766fd8-hv9zl 1/1 Running 0 6h37m -contour-internal contour-certgen-v1.10.0-szssj 0/1 Completed 0 6h37m -contour-internal envoy-hpch5 2/2 Running 0 6h37m -knative-eventing eventing-controller-658f454d9d-pfs5d 1/1 Running 0 6h37m -knative-eventing eventing-webhook-69fdcdf8d4-fdtmp 1/1 Running 0 6h37m -knative-eventing rabbitmq-broker-controller-88fc96b44-6jb82 1/1 Running 0 6h37m -knative-serving activator-85cd6f6f9-7l9q5 1/1 Running 0 6h38m -knative-serving autoscaler-7959969587-kzdrj 1/1 Running 0 6h38m -knative-serving contour-ingress-controller-6d5777577c-sb6vr 1/1 Running 0 6h37m -knative-serving controller-577558f799-fmfgq 1/1 Running 0 6h38m -knative-serving webhook-78f446786-zj9n4 1/1 Running 0 6h38m -kube-system antrea-agent-xgn24 2/2 Running 0 6h38m -kube-system antrea-controller-849fff8c5d-h5tjb 1/1 Running 0 6h38m -kube-system coredns-74ff55c5b-kpfxz 1/1 Running 0 6h38m -kube-system coredns-74ff55c5b-wrjp4 1/1 Running 0 6h38m -kube-system etcd-veba.primp-industries.local 1/1 Running 0 6h38m -kube-system kube-apiserver-veba.primp-industries.local 1/1 Running 0 6h38m -kube-system kube-controller-manager-veba.primp-industries.local 1/1 Running 0 6h38m -kube-system kube-proxy-gs59c 1/1 Running 0 6h38m -kube-system kube-scheduler-veba.primp-industries.local 1/1 Running 0 6h38m -local-path-storage local-path-provisioner-5696dbb894-sf457 1/1 Running 0 6h38m -rabbitmq-system rabbitmq-cluster-operator-7bbbb8d559-sw4kt 1/1 Running 0 6h37m -vmware-functions default-broker-ingress-5c98bf68bc-nl5m7 1/1 Running 0 6h36m -vmware-system tinywww-dd88dc7db-f74br 1/1 Running 0 6h36m -vmware-system veba-rabbit-server-0 1/1 Running 0 6h36m -vmware-system veba-ui-677b77dfcf-q9t84 1/1 Running 0 6h36m -vmware-system vmware-event-router-5dd9c8f858-5c9mh 0/1 CrashLoopBackoff 6 4d13h +```console +kubectl get pods -A + +NAMESPACE NAME READY STATUS RESTARTS AGE +cert-manager cert-manager-99bb69456-8xxlz 1/1 Running 1 (3h23m ago) 2d16h +cert-manager cert-manager-cainjector-ffb4747bb-fzclq 1/1 Running 1 (3h23m ago) 2d16h +cert-manager cert-manager-webhook-545bd5d7d8-6rnk8 1/1 Running 1 (3h23m ago) 2d16h +contour-external contour-685f87dc74-fcjrj 1/1 Running 1 (3h23m ago) 2d16h +contour-external contour-685f87dc74-mwt7d 1/1 Running 1 (3h23m ago) 2d16h +contour-external contour-certgen-v1.22.0-6gkj6 0/1 Completed 0 2d16h +contour-external envoy-fbc7g 2/2 Running 2 (3h23m ago) 2d16h +contour-internal contour-c4478d89b-bdt59 1/1 Running 1 (3h23m ago) 2d16h +contour-internal contour-c4478d89b-bwb99 1/1 Running 1 (3h23m ago) 2d16h +contour-internal contour-certgen-v1.22.0-m49zj 0/1 Completed 0 2d16h +contour-internal envoy-5pgjr 2/2 Running 2 (3h23m ago) 2d16h +knative-eventing eventing-controller-fdc4dd6bb-5hgl8 1/1 Running 1 (3h23m ago) 2d16h +knative-eventing eventing-webhook-676dfb6c4f-rg6fd 1/1 Running 1 (3h23m ago) 2d16h +knative-eventing rabbitmq-broker-controller-54c85d4f98-gqjdx 1/1 Running 1 (3h23m ago) 2d16h +knative-eventing rabbitmq-broker-webhook-877b8d7df-d2pzp 1/1 Running 1 (3h23m ago) 2d16h +knative-serving activator-7cbbfbc85-v8lmv 1/1 Running 1 (3h23m ago) 2d16h +knative-serving autoscaler-8f986cff-z4wfw 1/1 Running 1 (3h23m ago) 2d16h +knative-serving controller-58dfb45d74-d2fwk 1/1 Running 1 (3h23m ago) 2d16h +knative-serving domain-mapping-5d8db49bf6-x5cwx 1/1 Running 1 (3h23m ago) 2d16h +knative-serving domainmapping-webhook-584476fd67-rqt2k 1/1 Running 1 (3h23m ago) 2d16h +knative-serving net-contour-controller-6768758c67-jfxrt 1/1 Running 1 (3h23m ago) 2d16h +knative-serving webhook-6d5c55fd8c-6n4xd 1/1 Running 1 (3h23m ago) 2d16h +kube-system antrea-agent-vhjmk 2/2 Running 2 (3h23m ago) 2d16h +kube-system antrea-controller-6db8bb65cf-6xbvl 1/1 Running 1 (3h23m ago) 2d16h +kube-system coredns-565d847f94-mxtzz 1/1 Running 1 (3h23m ago) 2d16h +kube-system coredns-565d847f94-rlm9d 1/1 Running 1 (3h23m ago) 2d16h +kube-system etcd-veba.jarvis.lab 1/1 Running 1 (3h23m ago) 2d16h +kube-system kube-apiserver-veba.jarvis.lab 1/1 Running 1 (3h23m ago) 2d16h +kube-system kube-controller-manager-veba.jarvis.lab 1/1 Running 1 (3h23m ago) 2d16h +kube-system kube-proxy-fj7s9 1/1 Running 1 (3h23m ago) 2d16h +kube-system kube-scheduler-veba.jarvis.lab 1/1 Running 1 (3h23m ago) 2d16h +local-path-storage local-path-provisioner-5646477f4b-r87xl 1/1 Running 1 (3h23m ago) 2d16h +rabbitmq-system messaging-topology-operator-74c896bb55-qhdqk 1/1 Running 1 (3h23m ago) 2d16h +rabbitmq-system rabbitmq-cluster-operator-586b7547f8-ngh6x 1/1 Running 1 (3h23m ago) 2d16h +vmware-functions default-broker-ingress-78b9f88599-2vwwn 1/1 Running 1 (3h23m ago) 2d16h +vmware-functions sockeye-79b7fc7c55-klcnh 1/1 Running 1 (3h23m ago) 2d16h +vmware-functions sockeye-trigger-dispatcher-84cf59c5d9-wdfqj 1/1 Running 1 (3h23m ago) 2d16h +vmware-functions vcsa-source-adapter-5c8f5f58-dpspf 0/1 CrashLoopBackoff 0 153m +vmware-sources horizon-source-controller-8b9cfbfcc-vb9kd 1/1 Running 1 (3h23m ago) 2d16h +vmware-sources horizon-source-webhook-7db5777d-9f24n 1/1 Running 1 (3h23m ago) 2d16h +vmware-sources vsphere-source-webhook-6dfb9bfc5c-ctcvw 1/1 Running 1 (3h23m ago) 2d16h +vmware-system cadvisor-p26cg 1/1 Running 1 (3h23m ago) 2d16h +vmware-system tinywww-5b795ddd75-sn5vf 1/1 Running 1 (3h23m ago) 2d16h +vmware-system veba-rabbit-server-0 1/1 Running 1 (3h23m ago) 2d16h +vmware-system veba-ui-5cf5d5db4-tn76g 1/1 Running 1 (3h23m ago) 2d16h +vmware-system vmware-event-router-webhook-6bfb8cc946-8wlsd 1/1 Running 1 (3h23m ago) 2d16h ``` -> **Note:** The status ```Completed``` of the container ```contour-certgen-v1.10.0-btmlp``` is expected after successful appliance deployment. +> **Note:** The status `Completed` of the container `contour-certgen-v1.10.0-btmlp` is expected after successful appliance deployment. One of the first things to look for is whether a pod is in a crash state. -### Recovering from a crashing event router pod -In the above case, the vmware-event-router pod is crashing. We need to look at the logs with this command: +### Recovering from a crashing vcsa-source-adapter pod -```bash -kubectl -n vmware-system logs vmware-event-router-5dd9c8f858-5c9mh +In the above case, the vcsa-source-adapter pod is crashing. We need to look at the logs with this command: + +```console +kubectl -n vmware-functions logs vcsa-source-adapter-5c8f5f58-dpspf ``` -> **Note:** The pod suffix ```-5dd9c8f858-5c9mh``` will be different in each environment +> **Note:** The pod suffix `-5c8f5f58-dpspf` will be different in each environment. Here is the command output: +```console +{"level":"fatal","ts":"2024-01-15T15:00:50.580Z","logger":"vsphere-source-adapter","caller":"vsphere/adapter.go:73","msg":"unable to create vSphere client: ServerFaultCode: Cannot complete login due to an incorrect user name or password.","commit":"053feda-dirty","stacktrace":"github.com/vmware-tanzu/sources-for-knative/pkg/vsphere.NewAdapter\n\tgithub.com/vmware-tanzu/sources-for-knative/pkg/vsphere/adapter.go:73\nknative.dev/eventing/pkg/adapter/v2.MainWithInformers\n\tknative.dev/eventing@v0.37.1-0.20230502055954-cd50d2786189/pkg/adapter/v2/main.go:230\nknative.dev/eventing/pkg/adapter/v2.MainWithEnv\n\tknative.dev/eventing@v0.37.1-0.20230502055954-cd50d2786189/pkg/adapter/v2/main.go:158\nknative.dev/eventing/pkg/adapter/v2.MainWithContext\n\tknative.dev/eventing@v0.37.1-0.20230502055954-cd50d2786189/pkg/adapter/v2/main.go:133\nmain.main\n\tgithub.com/vmware-tanzu/sources-for-knative/cmd/vsphere-adapter/main.go:31\nruntime.main\n\truntime/proc.go:250"} ``` - _ ____ ___ ______ __ ____ __ -| | / / |/ / ______ _________ / ____/ _____ ____ / /_ / __ \____ __ __/ /____ _____ -| | / / /|_/ / | /| / / __ / ___/ _ \ / __/ | | / / _ \/ __ \/ __/ / /_/ / __ \/ / / / __/ _ \/ ___/ -| |/ / / / /| |/ |/ / /_/ / / / __/ / /___ | |/ / __/ / / / /_ / _, _/ /_/ / /_/ / /_/ __/ / -|___/_/ /_/ |__/|__/\__,_/_/ \___/ /_____/ |___/\___/_/ /_/\__/ /_/ |_|\____/\__,_/\__/\___/_/ +The error message shows us that we made a mistake when we configured our username or password. The created `VSphereSource` is using a Kubernetes Secret for the authentication with the vCenter Server. Therefore, the secret named `vsphere-creds` should be validated first. -[VMware Event Router] 2020/03/10 18:59:47 connecting to vCenter https://vc01.labad.int/sdk -[VMware Event Router] 2020/03/10 18:59:52 could not connect to vCenter: could not create vCenter client: ServerFaultCode: Cannot complete login due to an incorrect user name or password. +```console +kubectl -n vmware-functions get secret vsphere-creds -o yaml + +apiVersion: v1 +data: + password: ITFlcmF3TVY= + username: YWRtaW5pc3RyYXRvckB2c3BoZXJlLmxvY2Fs +kind: Secret +metadata: + creationTimestamp: "2024-01-15T14:51:24Z" + name: vsphere-creds + namespace: vmware-functions + resourceVersion: "2098905" + uid: 17e07583-a78d-4909-9edd-7d810637b159 +type: Opaque ``` -The error message shows us that we made a mistake when we configured our username or password. We must now edit the Event Router JSON configuration file to fix the mistake. +The `value`s for the `key`s password and username are `base64` encoded and can be decoded for validation. -```bash -vi /root/config/event-router/vmware-event-router-config-vcenter.yaml -``` +```console +echo 'ITFlcmF3TVY=' | base64 -d -Here is some of the YAML from the config file - you can see the mistake in the credentials. Fix the credentials and save the file. - -```yaml -eventProvider: - name: veba-vc-01 - type: vcenter - vcenter: - address: https://vc01.labad.int/sdk - auth: - basicAuth: - password: "wrongPassword" - username: "veba@vsphere.local" - type: basic_auth - insecureSSL: true - checkpoint: false +!1erawMV ``` -We now fix the Kubernetes configuration with 3 commands - delete and recreate the secret file, then delete the broken pod. Kubernetes will automatically spin up a new pod with the new configuration. We need to do this because the YAML configuration file is not directly referenced by the event router. The YAML file is mounted into the event router pod as a Kubernetes secret. +The decoded value shows a wrong configured password. Fixing the issue can be done by deleting the incorrect secret and by recreating it. -``` -kubectl -n vmware-system delete secret event-router-config -kubectl -n vmware-system create secret generic event-router-config --from-file=event-router-config.yaml -kubectl -n vmware-system delete pod vmware-event-router-5dd9c8f858-5c9mh +```console +kubectl -n vmware-functions delete secret vsphere-creds ``` -We get a pod list again to determine the name of the new pod. +Recreate the secret with correct values: -``` -kubectl -n vmware-system get pods +```console +kubectl -n vmware-functions create secret generic vsphere-creds --from-literal=username='administrator@vsphere.local' --from-literal=password='VMware1!' ``` -Here is the command output: -``` -NAME READY STATUS RESTARTS AGE -tinywww-dd88dc7db-f74br 1/1 Running 0 6h39m -veba-rabbit-server-0 1/1 Running 0 6h40m -veba-ui-677b77dfcf-q9t84 1/1 Running 0 6h39m -vmware-event-router-5dd9c8f858-5c9mh 0/1 Terminating 3 6h40m -vmware-event-router-5dd9c8f858-wt64s 1/1 Running 0 28s +In order to pick up the new created secret, the `vcsa-source-adapter` pod has to be recreated as well. This will be done by simply deleting the pod. + +```console +kubectl -n vmware-functions delete pod vcsa-source-adapter-5c8f5f58-dpspf ``` -Now view the event router logs. +Ultimately, validate the state of the pod once again. -```bash -kubectl -n vmware-system logs vmware-event-router-5dd9c8f858-wt64s -``` +```console +kubectl -n vmware-functions get pods -Here is the command output: -``` - _ ____ ___ ______ __ ____ __ -| | / / |/ / ______ _________ / ____/ _____ ____ / /_ / __ \____ __ __/ /____ _____ -| | / / /|_/ / | /| / / __ / ___/ _ \ / __/ | | / / _ \/ __ \/ __/ / /_/ / __ \/ / / / __/ _ \/ ___/ -| |/ / / / /| |/ |/ / /_/ / / / __/ / /___ | |/ / __/ / / / /_ / _, _/ /_/ / /_/ / /_/ __/ / -|___/_/ /_/ |__/|__/\__,_/_/ \___/ /_____/ |___/\___/_/ /_/\__/ /_/ |_|\____/\__,_/\__/\___/_/ - -2021-04-04T14:30:16.589Z ESC[34mINFOESC[0m [MAIN] router/main.go:111 connecting to vCenter {"address": "https://vc01.labad.int/sdk"} -2021-04-04T14:30:16.589Z ESC[34mINFOESC[0m [KNATIVE] injection/injection.go:61 Starting informers... -2021-04-04T14:30:16.699Z ESC[34mINFOESC[0m [MAIN] router/main.go:149 created Knative processor {"sink": "http://default-broker-ingress.vmware-functions.svc.cluster.local"} -2021-04-04T14:30:16.699Z ESC[33mWARNESC[0m [METRICS] metrics/server.go:59 no credentials found, disabling authentication for metrics server -2021-04-04T14:30:16.700Z ESC[34mINFOESC[0m [METRICS] metrics/server.go:131 starting metrics server {"address": "http://0.0.0.0:8082/stats"} -2021-04-04T14:30:16.703Z ESC[34mINFOESC[0m [VCENTER] vcenter/vcenter.go:174 checkpointing disabled, setting begin of event stream {"beginTimestamp": "2021-04-04 14:30:16.70642 +0000 UTC"} +NAME READY STATUS RESTARTS AGE +default-broker-ingress-78b9f88599-2vwwn 1/1 Running 1 (29h ago) 3d19h +sockeye-79b7fc7c55-klcnh 1/1 Running 1 (29h ago) 3d19h +sockeye-trigger-dispatcher-84cf59c5d9-wdfqj 1/1 Running 1 (29h ago) 3d19h +vcsa-source-adapter-9984f787-h7bth 1/1 Running 0 11m ``` -We now see that the Event Router came online, connected to vCenter, and successfully received an event. +Checking the logs will proof a working `VSphereSource`. + +The default logging level for a Tanzu Source is `info`. -### Check for completed installation +The log level for adapters, e.g. a particular `VSphereSource` `deployment` can +be changed at runtime via the `config-logging` `ConfigMap` which is created +when deploying the Tanzu Sources for Knative. + +See [Troubleshooting Source](./intro-tanzu-sources.md#troubleshooting). + +## Check for completed installation If the pods appear to be up without a crash status, check to make sure the installation completed. The file `/root/ran_customzation` gets created when installation completes successfully. If this file is missing, you can turn to the installation logs to find out why. + ```bash root@veba [ ~ ]# ls -al /root/ran_customization -rw-r--r-- 1 root root 0 Oct 1 2021 /root/ran_customization @@ -181,9 +200,10 @@ root@veba [ ~ ]# ls -al /root/ran_customization ### Examine log files The appliance installation log file is found in `/var/log/bootstrap.log`. If enabled at install time, a debug log is available in `/var/log/bootstrap-debug.log`. The logs should point you toward the source of the issue. Don't hesitate to [reach out](#bottom) to the team if you need help. + ## Changing the vCenter service account -If you need to change the account the appliance uses to connect to vCenter, the procedure above can be used. +If you need to change the account the appliance uses to connect to vCenter, [the procedure above](#recovering-from-a-crashing-vcsa-source-adapter-pod) (recreating the secret `vsphere-creds`) can be used. ## Troubleshooting VMware Event Broker Appliance vSphere UI @@ -195,7 +215,7 @@ There are several areas which may prevent the VMware Event Broker Appliance vSph Ensure that the VMware Event Broker Appliance UI container is running: -```bash +```console kubectl -n vmware-system get deployments/veba-ui ``` @@ -204,13 +224,14 @@ Here is the command output: ```console kubectl -n vmware-system get deployments/veba-ui + NAME READY UP-TO-DATE AVAILABLE AGE veba-ui 1/1 1 1 6h50m ``` Ensure there are no errors in the logs for the VMware Event Broker Appliance UI container. Incorrect credentials or credentials without the correct permissions will prevent the registration with vCenter Server and the logs should give you some additional insights. -```bash +```console kubectl -n vmware-system logs deployments/veba-ui ``` @@ -250,7 +271,7 @@ curl -L -k https://[VEBA_FQDN_OR_IP_ADDRESS]/veba-ui/plugin.json Here is the command output: -```console +```json { "manifestVersion": "1.0.0", "requirements": { @@ -271,7 +292,7 @@ Here is the command output: }, "definitions": { "iconSpriteSheet": { - "uri": "assets/images/veba_otto_the_orca.png", + "uri": "assets/images/veba_icon_only.png", "definitions": { "main": { "x": 0, @@ -280,7 +301,7 @@ Here is the command output: }, "themeOverrides": { "dark": { - "uri": "assets/images/veba_otto_the_orca.png", + "uri": "assets/images/veba_icon_only.png", "definitions": { "main": { "x": 0, @@ -307,4 +328,5 @@ Here is the command output: } } ``` - \ No newline at end of file + + diff --git a/docs/kb/troubleshoot-functions.md b/docs/kb/troubleshoot-functions.md index 956a7655..a8ba7061 100644 --- a/docs/kb/troubleshoot-functions.md +++ b/docs/kb/troubleshoot-functions.md @@ -6,112 +6,202 @@ description: Troubleshooting guide for general function issues permalink: /kb/troubleshoot-functions cta: title: Still having trouble? - description: Please submit bug reports and feature requests by using our GitHub [Issues](https://github.com/vmware-samples/vcenter-event-broker-appliance/issues){:target="_blank"} page or Join us on slack [#vcenter-event-broker-appliance](https://vmwarecode.slack.com/archives/CQLT9B5AA){:target="_blank"} on vmwarecode.slack.com. + description: Please submit bug reports and feature requests by using our GitHub [Issues](https://github.com/vmware-samples/vcenter-event-broker-appliance/issues){:target="_blank"} page. --- -## Knative Function Troubleshooting +# Troubleshooting Functions -If a function is not behaving as expected, you can look at the logs to troubleshoot. You can either perform this operation remotely by copying the `/root/.kube/config` onto your local desktop and you can interact with VEBA using your local kubectl client or SSH to the appliance using the local kubectl client. +If a function is not behaving as expected, you can look at the logs to troubleshoot. You can either perform this operation remotely by copying the `/root/.kube/config` onto your local desktop and you can interact with VEBA using your local `kubectl` client or `ssh` to the appliance using the local `kubectl` client. -List out the pods. +List out the pods within the `vmware-functions` namespace. -```bash -kubectl get pods -A +```console +kubectl -n vmware-functions get pods ``` This is an example output: ``` -NAMESPACE NAME READY STATUS RESTARTS AGE -contour-external contour-5869594b-b5tqk 1/1 Running 0 22h -contour-external contour-5869594b-q94vd 1/1 Running 0 22h -contour-external contour-certgen-v1.10.0-hm65q 0/1 Completed 0 22h -contour-external envoy-6p2bv 2/2 Running 0 22h -contour-internal contour-5d47766fd8-5skt7 1/1 Running 0 22h -contour-internal contour-5d47766fd8-6r5g4 1/1 Running 0 22h -contour-internal contour-certgen-v1.10.0-rdd6z 0/1 Completed 0 22h -contour-internal envoy-wwxct 2/2 Running 0 22h -knative-eventing eventing-controller-658f454d9d-mnqjb 1/1 Running 0 22h -knative-eventing eventing-webhook-69fdcdf8d4-mljtb 1/1 Running 0 22h -knative-eventing rabbitmq-broker-controller-88fc96b44-bbvnb 1/1 Running 0 22h -knative-serving activator-85cd6f6f9-wl7rf 1/1 Running 0 22h -knative-serving autoscaler-7959969587-z9rtq 1/1 Running 0 22h -knative-serving contour-ingress-controller-6d5777577c-f5qzn 1/1 Running 0 22h -knative-serving controller-577558f799-mdjpt 1/1 Running 0 22h -knative-serving webhook-78f446786-bn7xm 1/1 Running 0 22h -kube-system antrea-agent-vbr5d 2/2 Running 0 22h -kube-system antrea-controller-85c944dc84-jc28b 1/1 Running 0 22h -kube-system coredns-74ff55c5b-rqm7c 1/1 Running 0 22h -kube-system coredns-74ff55c5b-vq827 1/1 Running 0 22h -kube-system etcd-sjc-veba-01.tshirts.inc 1/1 Running 0 22h -kube-system kube-apiserver-sjc-veba-01.tshirts.inc 1/1 Running 0 22h -kube-system kube-controller-manager-sjc-veba-01.tshirts.inc 1/1 Running 0 22h -kube-system kube-proxy-mwpxs 1/1 Running 0 22h -kube-system kube-scheduler-sjc-veba-01.tshirts.inc 1/1 Running 0 22h -local-path-storage local-path-provisioner-5696dbb894-7x626 1/1 Running 0 22h -rabbitmq-system rabbitmq-cluster-operator-7bbbb8d559-dqd85 1/1 Running 0 22h -vmware-functions default-broker-ingress-5c98bf68bc-2zpc6 1/1 Running 0 22h -vmware-functions kn-pcli-tag-00001-deployment-c845447d4-lnmrq 2/2 Running 0 7h41m -vmware-functions sockeye-65697bdfc4-cmfxc 1/1 Running 0 22h -vmware-functions sockeye-trigger-dispatcher-7f4dbd7f78-n589p 1/1 Running 0 22h -vmware-functions veba-pcli-tag-trigger-dispatcher-7b477dd84d-zl2vm 1/1 Running 0 7h41m -vmware-system cadvisor-sk4j9 1/1 Running 0 22h -vmware-system tinywww-dd88dc7db-dqnnc 1/1 Running 0 22h -vmware-system veba-rabbit-server-0 1/1 Running 0 22h -vmware-system veba-ui-54967b4bf4-lpjrn 1/1 Running 0 22h -vmware-system vmware-event-router-vcenter-6b76959df5-6mrb4 1/1 Running 3 22h -vmware-system vmware-event-router-webhook-6b48cc5b8c-sjzx8 1/1 Running 0 22h +default-broker-ingress-78b9f88599-2vwwn 1/1 Running 1 (2d ago) 4d13h +kn-pcli-tag-00001-deployment-6d6db78495-bdz8j 2/2 Running 0 8m8s +sockeye-79b7fc7c55-klcnh 1/1 Running 1 (2d ago) 4d13h +sockeye-trigger-dispatcher-84cf59c5d9-wdfqj 1/1 Running 1 (2d ago) 4d13h +vcsa-source-adapter-9984f787-h7bth 1/1 Running 0 18h +veba-pcli-tag-trigger-dispatcher-796895df-4fx2c 1/1 Running 0 6m57s ``` -First, we want to see if the event router is capturing events and forwarding them on to a function. +First, we want to see if the event-viewer application Sockeye is receiving events from the configured `VSphereSource`. -Use this command to follow the live Event Router log. +Use this command to follow the logs. -```bash -kubectl logs -n vmware-system deploy/vmware-event-router-vcenter +```console +kubectl logs -n vmware-functions deployment/sockeye -f ``` -For this sample troubleshooting, we have the sample [PowerCLI Tagging function](https://github.com/vmware-samples/vcenter-event-broker-appliance/tree/master/examples/knative/powercli/kn-pcli-tag) running which will react to a VM powered on Event (`DrsVmPoweredOnEvent`). To see if the appliance is properly handling the event, create a test VM and power it on before proceeding with the next steps. - -When we look at the log output, we see various entries regarding `DrsVmPoweredOnEvent`, ending with the following: - -``` -2021-09-24T13:57:05.015Z INFO [KNATIVE] knative/knative.go:181 sending event {"eventID": "c6d61d55-8100-459e-a1e7-7a936bac6e43", "subject": "DrsVmPoweredOnEvent"} -2021-09-24T13:57:05.015Z INFO [KNATIVE] knative/knative.go:193 successfully sent event {"eventID": "c6d61d55-8100-459e-a1e7-7a936bac6e43"} -2021-09-24T13:57:06.017Z INFO [VCENTER] vcenter/vcenter.go:343 invoking processor {"eventID": "87af3e86-6516-4377-9a9b-86c4c9b00b05"} +You should continuously see event payloads on your terminal. + +The same can be done by browsing the VEBA events endpoint `https://[veba-fqdn]/events`. + +For this sample troubleshooting, we have the sample [PowerCLI Tagging function](https://github.com/vmware-samples/vcenter-event-broker-appliance/blob/development/examples/knative/powercli/kn-pcli-tag) running which will react to a VM powered on Event `com.vmware.vsphere.DrsVmPoweredOnEvent.v0`. To see if the appliance is properly handling the event, create a test VM and power it on before proceeding with the next steps. + +When we look at the log output, we should see an entry similar to the following: + +```console +Context Attributes, + specversion: 1.0 + type: com.vmware.vsphere.DrsVmPoweredOnEvent.v0 + source: https://vcsa.jarvis.lab/sdk + id: 280034 + time: 2024-01-17T13:02:05.426999Z + datacontenttype: application/json +Extensions, + eventclass: event + vsphereapiversion: 8.0.2.0 +Data, + { + "Key": 280034, + "ChainId": 280032, + "CreatedTime": "2024-01-17T13:02:05.426999Z", + "UserName": "VSPHERE.LOCAL\\Administrator", + "Datacenter": { + "Name": "jarvis-lab", + "Datacenter": { + "Type": "Datacenter", + "Value": "datacenter-1001" + } + }, + "ComputeResource": { + "Name": "mk-1", + "ComputeResource": { + "Type": "ClusterComputeResource", + "Value": "domain-c1015" + } + }, + "Host": { + "Name": "esxi02.jarvis.lab", + "Host": { + "Type": "HostSystem", + "Value": "host-1012" + } + }, + "Vm": { + "Name": "workload1", + "Vm": { + "Type": "VirtualMachine", + "Value": "vm-2073" + } + }, + "Ds": null, + "Net": null, + "Dvs": null, + "FullFormattedMessage": "DRS powered on workload1 on esxi02.jarvis.lab in jarvis-lab", + "ChangeTag": "", + "Template": false + } ``` -This lets us know that the function was invoked. If we still don't see the expected result, we need to look at the function logs. +Similar in Sockeye: -Each Knative function will have its own pod running in the vmware-functions namespace. If you have deployed the provided tagging function example from the VEBA examples, you can examine the logs with the following command. + +Each Knative function will have its own pod running in the `vmware-functions` namespace. If you have deployed the provided tagging function example from the [VEBA function examples](https://github.com/vmware-samples/vcenter-event-broker-appliance/tree/development/examples/knative), you can examine the logs with the following command: -```bash +```console kubectl logs -n vmware-functions deployment/kn-pcli-tag-00001-deployment user-container ``` > **Note:** Replace the name of the deployment in the examples with the name within your environment. -We don't need the `--follow` switch because we are just trying to look at recent logs, but `--follow` would work too. +First indications of a working function can be obtained directly after deploying a function. For example if a function is successfully connected to a system. The Tagging function for example establishes a connection to the specified vCenter Server system. Here's a log output sample: + +```console +kubectl -n vmware-functions logs kn-pcli-tag-00001-deployment-6d6db78495-bdz8j + +Defaulted container "user-container" out of: user-container, queue-proxy +01/17/2024 10:34:57 - PowerShell HTTP server start listening on 'http://*:8080/' +01/17/2024 10:34:57 - Processing Init + +01/17/2024 10:34:57 - Configuring PowerCLI Configuration Settings + + +DefaultVIServerMode : Multiple +ProxyPolicy : UseSystemProxy +ParticipateInCEIP : True +CEIPDataTransferProxyPolicy : UseSystemProxy +DisplayDeprecationWarnings : True +InvalidCertificateAction : Ignore +WebOperationTimeoutSeconds : 300 +VMConsoleWindowBrowser : +Scope : Session +PythonPath : /usr/local/bin/python3 + +DefaultVIServerMode : +ProxyPolicy : +ParticipateInCEIP : True +CEIPDataTransferProxyPolicy : +DisplayDeprecationWarnings : +InvalidCertificateAction : Ignore +WebOperationTimeoutSeconds : +VMConsoleWindowBrowser : +Scope : User +PythonPath : + +DefaultVIServerMode : +ProxyPolicy : +ParticipateInCEIP : +CEIPDataTransferProxyPolicy : +DisplayDeprecationWarnings : +InvalidCertificateAction : +WebOperationTimeoutSeconds : +VMConsoleWindowBrowser : +Scope : AllUsers +PythonPath : /usr/local/bin/python3 + +01/17/2024 10:35:02 - Connecting to vCenter Server vcsa.jarvis.lab + +IsConnected : True +Id : /VIServer=vsphere.local\administrator@vcsa.jarvis.lab:443/ +ServiceUri : https://vcsa.jarvis.lab/sdk +SessionSecret : "a58cfe1ebd168aff2345ab80c0a1343ae4414c3d" +Name : vcsa.jarvis.lab +Port : 443 +SessionId : "a58cfe1ebd168aff2345ab80c0a1343ae4414c3d" +User : VSPHERE.LOCAL\Administrator +Uid : /VIServer=vsphere.local\administrator@vcsa.jarvis.lab:443/ +Version : 8.0.2 +Build : 22617221 +ProductLine : vpx +InstanceUuid : 60b82abd-ba3b-4114-825b-d48c1bdd5dea +RefCount : 1 +ExtensionData : VMware.Vim.ServiceInstance + +01/17/2024 10:35:07 - Successfully connected to vcsa.jarvis.lab + +01/17/2024 10:35:07 - Init Processing Completed + +01/17/2024 10:35:07 - Starting HTTP CloudEvent listener +``` + +If a function got correctly invoked can be seen via the logs as well after the specified event occured. This command will show you the last 5 minutes worth of logs. -```bash -kubectl logs -n vmware-functions deployment/kn-pcli-tag-00001-deployment user-container --since=5m +```console +kubectl -n vmware-functions logs deployment/kn-pcli-tag-00001-deployment user-container --since=5m ``` This command will show you the last 20 lines of logs. -```bash -kubectl logs -n vmware-functions deployment/kn-pcli-tag-00001-deployment user-container --tail=20 +```console +kubectl -n vmware-functions logs deployment/kn-pcli-tag-00001-deployment user-container --tail=20 ``` Log output showing a successful function invocation: -``` -09/24/2021 13:57:05 - Applying vSphere Tag "VEBA" to My-VEBA-Test-VM ... +```console +01/17/2024 10:37:41 - Applying vSphere Tag "backup-sla" to workload1 ... -09/24/2021 13:57:09 - vSphere Tag Operation complete ... +01/17/2024 10:37:51 - vSphere Tag Operation complete ... -09/24/2021 13:57:09 - Handler Processing Completed ... +01/17/2024 10:37:51 - Handler Processing Completed ... ``` diff --git a/docs/kb/use-eventspec.md b/docs/kb/use-eventspec.md index 1f29a9f1..12939435 100644 --- a/docs/kb/use-eventspec.md +++ b/docs/kb/use-eventspec.md @@ -16,7 +16,7 @@ cta: The event payload structure used by the VMware Event Broker Appliance uses the [CloudEvents](https://cloudevents.io/){:target="_blank"} v1 specification for -cross-cloud portability. +cross-cloud portability. Events produced by the supported event `providers`, e.g. `vcenter` and `horizon` are JSON-encoded and injected into the CloudEvents `data` attribute. The current @@ -33,6 +33,15 @@ the event `provider`, e.g. `vcenter`. Please use one of the provided CloudEvents [SDKs](https://cloudevents.io/) to ease the consumption and handling of these events. + +## Table of Contents + +- [The Event Specification](#the-event-specification) + - [Example](#example) + - [HTTP Headers](#http-headers) + - [Description](#description) + - [HTTP Body](#http-body) + ## Example The following example shows a converted CloudEvent published by the `vcenter` @@ -48,9 +57,8 @@ Key HTTP headers used: "Ce-Id": "08179137-b8e0-4973-b05f-8f212bf5003b", "Ce-Source": "https://vcenter-01:443/sdk", "Ce-Specversion": "1.0", - "Ce-Subject": "VmPoweredOnEvent", "Ce-Time": "2021-09-27T19:02:54.063Z", - "Ce-Type": "com.vmware.event.router/event", + "Ce-Type": "com.vmware.vsphere..v0", "Content-Type": "application/json", } ``` @@ -60,8 +68,7 @@ Key HTTP headers used: - `id:` The unique ID ([UUID v4](https://tools.ietf.org/html/rfc4122){:target="_blank"}) of the event - `source:` The vCenter emitting the embedded vSphere event (FQDN resolved when available) - `specversion:` The CloudEvent specification the used -- `subject:` The vCenter event name (CamelCase) -- `type:` The canonical name of the event class in "." dot notation +- `type:` The canonical name of the event class in "." dot notation - `time:` Timestamp when this event was produced by the event `provider` (`vcenter`) - `content-type:` Data (payload) encoding scheme used (JSON) @@ -71,42 +78,42 @@ The event as emitted by vCenter: ```json { - "Key": 23192, - "ChainId": 23182, - "CreatedTime": "2021-09-27T19:02:54.063Z", + "Key": 280034, + "ChainId": 280032, + "CreatedTime": "2024-01-17T13:02:05.426999Z", "UserName": "VSPHERE.LOCAL\\Administrator", "Datacenter": { - "Name": "vcqaDC", + "Name": "jarvis-lab", "Datacenter": { "Type": "Datacenter", - "Value": "datacenter-2" + "Value": "datacenter-1001" } }, "ComputeResource": { - "Name": "cls", + "Name": "mk-1", "ComputeResource": { "Type": "ClusterComputeResource", - "Value": "domain-c7" + "Value": "domain-c1015" } }, "Host": { - "Name": "10.78.209.131", + "Name": "esxi02.jarvis.lab", "Host": { "Type": "HostSystem", - "Value": "host-33" + "Value": "host-1012" } }, "Vm": { - "Name": "test-vm-1", + "Name": "workload1", "Vm": { "Type": "VirtualMachine", - "Value": "vm-45" + "Value": "vm-2073" } }, "Ds": null, "Net": null, "Dvs": null, - "FullFormattedMessage": "test-vm-1 on 10.78.209.131 in vcqaDC is powered on", + "FullFormattedMessage": "DRS powered on workload1 on esxi02.jarvis.lab in jarvis-lab", "ChangeTag": "", "Template": false } diff --git a/docs/kb/use-functions.md b/docs/kb/use-functions.md index 6c285ffc..66fb2cd7 100644 --- a/docs/kb/use-functions.md +++ b/docs/kb/use-functions.md @@ -11,131 +11,141 @@ cta: - text: See our complete list of prebuilt functions - [here](/examples) - text: Learn how to write your own function - [here](contribute-functions). --- + # Getting started with using functions The steps below describe a generalized deployment step of a function on the VMware Event Broker Appliance. For customers looking to get started quickly, please look at deploying from our growing list of [Prebuilt Functions](/examples). The functions are organized by the language that they are written in and have well-documented README.md files with detailed deployment steps. Deployment or development of functions can require the use of the following development tools: `git`, `docker`, and `kubectl`. If you would like some help in how to setup your workstation to use those tools, an in-depth tutorial is available that shows how to do that and to modify and deploy the [kn-ps-slack](https://github.com/vmware-samples/vcenter-event-broker-appliance/tree/master/examples/knative/powershell/kn-ps-slack) function (Knative powershell slack notification function) as an example. The tutorial can be found here: [in-depth function tutorial](function-tutorial-intro). -### Deployment Prerequisites + +## Table of Contents + +- [Getting started with using functions](#getting-started-with-using-functions) + - [Deployment Prerequisites](#deployment-prerequisites) + - [Knative Function Deployment using kubectl](#knative-function-deployment-using-kubectl) + - [Knative Function Deployment using vSphere UI](#knative-function-deployment-using-vsphere-ui) + - [Function Deployment with Kubernetes Secrets](#function-deployment-with-kubernetes-secrets) + - [Kubernetes Secrets - Command Line](#kubernetes-secrets---command-line) + - [Kubernetes Secrets - vCenter UI](#kubernetes-secrets---vcenter-ui) + +## Deployment Prerequisites Before proceeding to deploy a function, you must have VMware Event Broker Appliance deployed and be able to SSH to the appliance or have access to the kubernetes configuration file (`/root/.kube/config`) locally on your desktop to authenticate. -### Knative Function Deployment using kubectl -Step 1 - Clone repo -``` +## Knative Function Deployment using kubectl + +- **Step 1:** Clone repo + +```console git clone https://github.com/vmware-samples/vcenter-event-broker-appliance cd vcenter-event-broker-appliance/examples/knative/powershell/kn-ps-echo git checkout master ``` -Step 2 - Edit the configuration files +- **Step 2:** Edit the configuration files -* Edit `function.yml` to update `subject:` with the specific vCenter Event. All available events can be reviewed in the [vCenter Event Mapping](https://github.com/lamw/vcenter-event-mapping){:target="_blank"} document. +Edit `function.yml` to update `subject:` with the specific vCenter Event. All available events can be reviewed in the [vCenter Event Mapping](https://github.com/lamw/vcenter-event-mapping) document. ```yaml apiVersion: serving.knative.dev/v1 kind: Service metadata: - name: kn-ps-echo + name: kn-py-echo labels: app: veba-ui spec: template: + metadata: + annotations: + autoscaling.knative.dev/maxScale: "1" + autoscaling.knative.dev/minScale: "1" spec: containers: - - image: projects.registry.vmware.com/veba/kn-ps-echo:1.0 + - image: ghcr.io/vmware-samples/vcenter-event-broker-appliance/kn-py-echo:1.2 --- apiVersion: eventing.knative.dev/v1 kind: Trigger metadata: - name: veba-ps-echo-trigger + name: veba-py-echo-trigger labels: app: veba-ui spec: broker: default filter: attributes: - type: com.vmware.event.router/event - subject: DrsVmPoweredOnEvent + type: com.vmware.vsphere.VmPoweredOffEvent.v0 subscriber: ref: apiVersion: serving.knative.dev/v1 kind: Service - name: kn-ps-echo + name: kn-py-echo ``` -Step 3 - Deploy function to VMware Event Broker Appliance +- **Step 3:** Deploy a function -``` +```console kubectl -n vmware-functions apply -f function.yaml ``` -Step 4 - Test your functions - -* Your function is now deployed and available for the VMware Event Router to invoke when it sees a matching event - -### Knative Function Deployment using vSphere UI - -Step 1 - Login to the vSphere UI and navigate to the VMware Event Broker Appliance UI by going to `Menu->VMware Event Broker`. - -Step 2 (Optional) - If a secret is required for a function. Select the `Secrets` tab and then click Add to create a new Kubernetes secret. +- **Step 4:** Test your functions -Step 3 - Under the `Events` tab, search and filter for the specific vSphere Event to deploy a function. One an event has been identified, click on the `>>` icon to expand and click on Deploy button to begin the guided wizard. +Your function is now deployed and available for the VMware Event Router to invoke when it sees a matching event. -Step 4 - In the `Function` section of the wizard, users will need to provide the following required parameters: +## Knative Function Deployment using vSphere UI -* `Function name` - A name for the function to be deployed +- **Step 1:** Login to the vSphere UI and navigate to the VMware Event Broker Appliance UI by going to `Menu->VMware Event Broker`. -* `Docker Image` - The Docker image that contains the function logic +- **Step 2 (optional):** If a secret is required for a function. Select the `Secrets` tab and then click Add to create a new Kubernetes secret. -Step 5 - (optional) In the `Configuration` section of the wizard, users can control the concurrency and scale bounds for the function: +- **Step 3:** Under the `Events` tab, search and filter for the specific vSphere Event to deploy a function. One an event has been identified, click on the `>>` icon to expand and click on Deploy button to begin the guided wizard. -* `Container concurrency:` - Specifies the maximum allowed in-flight (concurrent) requests per container of the Revision. Defaults to 0 which means concurrency to the application is not limited, and the system decides the target concurrency for the autoscaler. +- **Step 4:** In the `Function` section of the wizard, users will need to provide the following required parameters: + - `Function name` - A name for the function to be deployed + - `Docker Image` - The Docker image that contains the function logic -* `Minimum scale:` - Controls the minimum number of replicas that each Revision should have. Knative will attempt to never have less than this number of replicas at any one point in time. Defaults to 0 which means scale to zero. +- **Step 5 (optional):** In the `Configuration` section of the wizard, users can control the concurrency and scale bounds for the function: + - `Container concurrency:` - Specifies the maximum allowed in-flight (concurrent) requests per container of the Revision. Defaults to 0 which means concurrency to the application is not limited, and the system decides the target concurrency for the autoscaler. + - `Minimum scale:` - Controls the minimum number of replicas that each Revision should have. Knative will attempt to never have less than this number of replicas at any one point in time. Defaults to 0 which means scale to zero. + - `Maximum scale:` - Controls the maximum number of replicas that each revision should have. Knative will attempt to never have more than this number of replicas running, or in the process of being created, at any one point in time. Defaults to 0 which means unlimited scale. -* `Maximum scale:` - Controls the maximum number of replicas that each revision should have. Knative will attempt to never have more than this number of replicas running, or in the process of being created, at any one point in time. Defaults to 0 which means unlimited scale. +- **Step 6 (optional):** In the `Configure Variables` section of the wizard, users can define new environment variables that can be used within their function + - `Name` - The name should begin with an uppercase letter and contain only uppercase letters(A-Z), numbers(0-9) and underscores(_) + - `Value` - The value for the environment variable -Step 6 - (optional) In the `Configure Variables` section of the wizard, users can define new environment variables that can be used within their function +- **Step 7 (optional):** In the `4 Configure Secrets` section of the wizard, users can select specific Kubernetes Secrets that were created earlier in Step 2 for use within their function -* `Name` - The name should begin with an uppercase letter and contain only uppercase letters(A-Z), numbers(0-9) and underscores(_) - -* `Value` - The value for the environment variable - -Step 7 - (optional) In the `4 Configure Secrets` section of the wizard, users can select specific Kubernetes Secrets that were created earlier in Step 2 for use within their function - -Step 8 - Finally, review the summary for the function deployment and click `Finish` to begin the function deployment. +- **Step 8:** Finally, review the summary for the function deployment and click `Finish` to begin the function deployment. To verify the function deployment was successful, click on the `Functions` tab and ensure the function status `True` for the following: + - `ConfigurationsReady` : True + - `Ready` : True + - `RoutesReady` : True -* `ConfigurationsReady` : True - -* `Ready` : True - -* `RoutesReady` : True +- **Step 9:** Test and Invoke your functions -Step 9 - Test and Invoke your functions +Your function is now deployed and available for VMware Event Router to invoke when it sees a matching event -* Your function is now deployed and available for VMware Event Router to invoke when it sees a matching event - -### Function Deployment with Kubernetes Secrets +## Function Deployment with Kubernetes Secrets Although the previous examples using the `kn-ps-echo` function did not require configuration parameters, most functions do require parameters to work correctly. A function author can hard code parameter values inside the function. However, any changes to the configuration parameters means the function's container image must be rebuilt. By using configuration parameters stored in a Kubernetes secret, a function can be reconfigured by simply changing the secret. This walk-through uses the [`kn-ps-email`](/examples) function from the examples folder to demonstrate working with secrets. You can verify whether a function requires a secret by looking at the function's `function.yaml`. Below is part of the `function.yaml` for `kn-ps-email`. Note the `secretRef:` section specifying the name of the secret the function expects. + ```yaml +[...] containers: - - image: ghcr.io/vmware-samples/vcenter-event-broker-appliance/kn-ps-email:1.4 + - image: ghcr.io/vmware-samples/vcenter-event-broker-appliance/kn-ps-email:1.5 envFrom: - secretRef: name: email-secret env: - name: FUNCTION_DEBUG value: "false" +[...] ``` -The `kn-ps-email` function uses several configuration parameters. The secrets file for `kn-ps-email` is named `email_secrets.json`. +The `kn-ps-email` function uses several configuration parameters. The secrets file for `kn-ps-email` is named `email_secrets.json`. ```json { @@ -148,16 +158,18 @@ The `kn-ps-email` function uses several configuration parameters. The secrets fi "EMAIL_FROM" : "notification-do-not-reply@primp-industries.com" } ``` + ### Kubernetes Secrets - Command Line To create the Kubernetes secret via the command line, modify the secrets file with configuration data specific to your environment. Then run this command: -```bash + +```console kubectl -n vmware-functions create secret generic email-secret --from-file=EMAIL_SECRET=email_secret.json ``` -`email-secret`, the argument just before `--from-file=`, is the name that Kubernetes uses to refer to the secret. This name must match the `secretRef` in `function.yaml`. +`email-secret`, the argument just before `--from-file=`, is the name that Kubernetes uses to refer to the secret. This name must match the `secretRef` in `function.yaml`. -`EMAIL_SECRET`, the value just after `--from-file=`, is the function environment variable that the secret gets loaded into. You can find the environment variable the function expects by looking at `handler.ps1`. +`EMAIL_SECRET`, the value just after `--from-file=`, is the function environment variable that the secret gets loaded into. You can find the environment variable the function expects by looking at `handler.ps1`. ```powershell try { @@ -168,6 +180,7 @@ try { ``` ### Kubernetes Secrets - vCenter UI + If you deployed VEBA with the vCenter UI option, you can create the secret by clicking on the `Secrets` section, then clicking `Add`. The `Secret Name` must match the `secretRef` in `function.yaml`. The `Secret Key` must match the environment variable the function expects, as shown in `handler.ps1` above. The `Secret Value` is the JSON copied from `email_secret.json`, modified with configuration data specific to your environment. Once all fields are filled out, click `Add Secret`. ![Adding a secret](img/veba-secret-ui-1.png) diff --git a/docs/site/community.md b/docs/site/community.md index e4dce81e..c5eaf2d3 100644 --- a/docs/site/community.md +++ b/docs/site/community.md @@ -17,15 +17,9 @@ links: - description: "Follow us at " url: "https://github.com/vmware-samples/vcenter-event-broker-appliance" label: vcenter-event-broker-appliance -- title: Slack - image: /assets/img/icons/slack.svg - items: - - description: "Join us at" - url: "https://vmwarecode.slack.com/archives/CQLT9B5AA" - label: "#vcenter-event-broker-appliance" - title: Email image: /assets/img/icons/email.svg - items: + items: - description: "Email us at " url: "mailto:dl-veba@vmwarem.com" label: dl-veba@vmware.com diff --git a/docs/site/evolutions.md b/docs/site/evolutions.md index 71184ef7..0b284bc6 100644 --- a/docs/site/evolutions.md +++ b/docs/site/evolutions.md @@ -6,6 +6,21 @@ permalink: /evolution limit: 3 entry: +- title: VEBA [v0.8.0](https://github.com/vmware-samples/vcenter-event-broker-appliance/releases/tag/v0.8.0) + type: feature + date: Feb 2024 + id: vzeroeightzero + detail: + subtitle: Features + text: + - Replaced VMware Event Router with VMware Tanzu Sources for Knative + - All VEBA endpoints now protected with basic authentication + - New Google Chat notification function + - Migrated function container images from Google (GCR) to Github (GHCR) + - Updated all Powershell/PowerCLI functions with the latest PS/PCLI base images + - Improved website documentation + - Various Bug Fixes and Code Improvements + - title: VEBA [v0.7.5](https://github.com/vmware-samples/vcenter-event-broker-appliance/releases/tag/v0.7.5) type: feature date: Mar 2023 diff --git a/docs/site/examples.md b/docs/site/examples.md index d6f544e9..1d6825f1 100644 --- a/docs/site/examples.md +++ b/docs/site/examples.md @@ -272,6 +272,17 @@ examples: links: - language: powershell url: "/tree/master/examples/knative/powershell/kn-ps-harbor-slack" + + - title: Google Chat Notification + usecases: + - item: integration + - item: notification + id: kn-ps-google-chat-function + description: Function to send a Google Chat notification. + links: + - language: powershell + url: "/tree/master/examples/knative/powershell/kn-ps-google-chat" + --- A complete and updated list of ready to use functions curated by the VMware Event Broker community is listed below. @@ -280,7 +291,7 @@ A complete and updated list of ready to use functions curated by the VMware Even These functions are prebuilt, available in ready to deploy container and `function.yaml` files for you to deploy as is. Should you need to modify the functions to fit your needs, the `README.md` files provided within each function folder will provide all the information you need to customize, build and deploy the function on your VMware Event Broker appliance. -> **Note:** These functions are provided and tested to be used with the VMware Event Broker Appliance deployed with [Knative](/kb/install-knative) as the event stream processor. +> **Note:** These functions are provided and tested to be used with the VMware Event Broker Appliance deployed with [Knative](/kb/install-veba) as the event stream processor.
diff --git a/docs/site/faq.md b/docs/site/faq.md index 1999025c..af20d004 100644 --- a/docs/site/faq.md +++ b/docs/site/faq.md @@ -10,30 +10,30 @@ faqs: items: - Q: Can I connect to more than one vCenter per Appliance deployment? A: > - No. The Appliance is currently designed to support one vCenter as the event source. Customers that are familiar with deploying the components on Kubernetes can deploy multiple instances of the VMware Event Router container. + No. During the deployment of the VMware Event Broker Appliance to vSphere, only one vSphere source and one Horizon source can be configured at a time. - > **Note:** It is possible though to run **multiple instances** of the event router with different configurations to address multi-vCenter scenarios. + > **Note:** It is possible though to run multiple instances of a source (e.g. `VSphereSource`) with different configurations to address multi-vCenter scenarios. This decision was made for scalability and resource/tenancy isolation purposes. - Q: Can the default TLS certificates that are being used on the Appliance be updated? A: Yes! Follow the steps provided [here](/kb/advanced-certificates). - Q: What happens if vCenter Server and VMware Event Broker connectivity is lost? A: > - VMware [Event Router](https://vmweventbroker.io/kb/event-router) streams vCenter events as they get generated and being stateless, does not persist any event information. To provide a certain level of reliability, the following Event Delivery Guarantees exists:
- - At-least-once event delivery semantics for the vCenter event provider by checkpointing the event stream into a file. In case of disconnection, the Event Router will replay all vCenter events of the last 10 minutes (10m reiteration) after a successful reconnection.
- - At-least-once event delivery semantics are not guaranteed if the event router crashes within seconds right after startup and having received *n* events but before creating the first valid checkpoint (current checkpoint interval is 5s).
+ A configured VMware [Tanzu Source](https://vmweventbroker.io/kb/tanzu-sources) streams vCenter events as they get generated and being stateless, does not persist any event information. To provide a certain level of reliability, the following Event Delivery Guarantees exists:
+ - **At-least-once event delivery** semantics for the vCenter event provider by checkpointing the event stream into a file. In case of disconnection, the Event Router will replay all vCenter events of the last 5 minutes (5m reiteration) after a successful reconnection.
+ - **At-least-once event delivery** semantics are not guaranteed if the source-adapter (pod) crashes within seconds right after startup and having received *n* events but before creating the first valid checkpoint (current checkpoint interval is 10s).
- Q: How long does it take for the functions to be invoked upon an event being generated? A: Instantaneous to a few seconds! The function execution itself is not considered in this answer since that is dependent on the logic that is being implemented. - Q: Can I setup the VMware Event Broker Appliance components on Kubernetes? - A: Yes! Follow the steps provided [here](/kb/event-router#deployment). + A: Yes! Follow the steps provided [here](/kb/tanzu-sources#installation-tanzu-sources-for-knative). - Q: Can I use a private registry like e.g. [Harbor](https://goharbor.io/) to have a source of truth for my functions (images)? A: Yes! Follow the steps provided [here](https://vmweventbroker.io/kb/private-registry). - Q: How can I monitor the Appliance, the Kubernetes components as well as the functions (pods) in terms of utilization, performance and state? - A: vRealize Operations Manager provides these capabilities as described [here](https://rguske.github.io/post/monitoring-the-vmware-event-broker-appliance-with-vrealize-operations-manager/). + A: VMware Aria Operations provides these capabilities as described [here](https://docs.vmware.com/en/VMware-vRealize-Operations-Management-Pack-for-Kubernetes/1.8/management-pack-for-kubernetes/GUID-4ED07321-A5C9-46D6-8EB0-2661D853C0E9.html). - title: Common Questions - Functions id: function items: - Q: How do I obtain the Events in the function? A: > - Events are made available as stdin argument for the language that you are writing the function on. For example,
+ Events are made available as `stdin` argument for the language that you are writing the function on. For example,
- In Powershell the event is made available using the `$args` variable as shown here `$json = $args | ConvertFrom-Json`
- In Python the event is made available with the `req` variable as shown here `cevent = json.loads(req)` - Q: How do I obtain the config file within the function? @@ -73,6 +73,5 @@ Find answers to the frequently asked questions about VMware Event Broker Applian - Explore our [documentation](/kb) - Feel free to reach out - Email us at [dl-veba@vmware.com](mailto:dl-veba@vmware.com){:target="_blank"} - - Join us on slack [#vcenter-event-broker-appliance](https://vmwarecode.slack.com/archives/CQLT9B5AA){:target="_blank"} on vmwarecode.slack.com - Tweet at us [@VMWEventBroker](https://twitter.com/VMWEventBroker){:target="_blank"} - Explore our Github repository [here](https://github.com/vmware-samples/vcenter-event-broker-appliance){:target="_blank"} \ No newline at end of file