DaemonSet mirroring

Traceable provides you with an option to mirror the traffic for Kubernetes pods by running the Traceable agent in a daemonSet. As shown in the diagram below, each worker node has a Traceable Platform agent pod running. The Traceable agent pod has two containers, Traceable Platform agent container and the mirroring container.

Before You Begin

Keep the TA_REFRESH_TOKEN handy. It will be required while installing the Traceable Platform Agent. To fetch the token, log into Traceable Platform and navigate to Administration () >  Account > Access Token.

Download

There is no download required for DaemonSet agentless traffic mirroring. The installation is completed using Helm chart or Terraform template.

Installation

The installation process consists of the the following steps:

1. Create traceableai namespace
2. Install Platform Agent
3. Enable mirroring
4. [optional] Set mirroring mode

Step 1 - Create traceableai namespace

Create a traceableai namespace. Enter the following command: 

kubectl create namespace traceableai

Step 2 - Install Platform agent

You can install Traceable platform agent in Kubernetes environment using either Helm chart or Terraform template.

Install using Helm chart

1. Create a values.yamlfile with the following content:
   YAML

   token: <ACESS_TOKEN>
   environment: <ENVIRONMENT_NAME>
   runAsDaemonSet: true
   daemonSetMirroringEnabled: true

2. Enter the following commands to install Traceable Platform Agent into your Kubernetes cluster:
   ActionScript

   helm repo add traceableai https://helm.traceable.ai
   helm repo update
   helm install --namespace traceableai traceable-agent traceableai/traceable-agent --values values.yaml

Install using Terraform

1. Create a main.tf file with the following content:
   ActionScript

   module "traceable-agent" {
     source                       = "https://downloads.traceable.ai/install/traceable-agent/terraform/kubernetes/latest/traceable-agent-tf-k8s.tar.gz"
     token                        = ""
     environment                  = ""
     run_as_daemon_set            = true
     daemon_set_mirroring_enabled = true
   }

2. Initialize the module by entering the following command:
   ActionScript

   terraform init

3. Review the setup that will be installed by entering the following command:
   ActionScript
   ActionScript

   terraform plan

4. Apply the module by entering the following command:
   ActionScript
   ActionScript

   terraform apply

   Terraform creates a terraform.tfstate file. The file stores the current state of the infrastructure. It is recommended to keep track of this file.

Step 3 - Enable mirroring

To configure mirroring, go through the following points:

• Enable mirroring for all namespaces - Mirroring is disabled by default. To enable mirroring for all namespaces, use the following configuration:
  • If you are using Helm, then in values.yaml, set - daemonSetMirrorAllNamespaces: true 
  • If you are using Terraform, then in main.tf, set - daemon_set_mirror_all_namespaces = true
• Enable mirroring for a namespace - set the namespace label traceableai-mirror to enabled.
• Disable mirroring for a namespace - set the namespace label traceableai-mirror to disabled.
• Disable mirroring for a pod - set the pod annotation mirror.traceable.ai/enabled to false.

Step 4 [optional] - Set mirroring mode

The default mirroring mode for a pod is ingress. To capture the egress traffic instead: 

• Pod - For a specific pod, set the annotation mirror.traceable.ai/mode to egress
  ActionScript
  ActionScript

  kubectl annotate pod <POD> mirror.traceable.ai/mode=egress

• Namespace- For a <NAMESPACE>, set the annotation mirror.traceable.ai/defaultMode to egress
  ActionScript

  kubectl annotate namespace <NAMESPACE> mirror.traceable.ai/defaultMode=egress