---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: newrelic
  namespace: default
automountServiceAccountToken: true
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: newrelic
rules:
- apiGroups: [""]
  resources:
    - "nodes"
    - "nodes/metrics"
    - "nodes/stats"
    - "nodes/proxy"
    - "pods"
    - "services"
  verbs: ["get", "list"]
- nonResourceURLs: ["/metrics"]
  verbs: ["get"]
## Notice that you need to uncomment this snipped of code if control plane monitoring is enabled and either ETCD_TLS_SECRET_NAMESPACE
## or ETCD_TLS_SECRET_NAME is set
#  ---
#  apiVersion: rbac.authorization.k8s.io/v1
#  kind: ClusterRole
#  metadata:
#    name: newrelic-secrets
#  rules:
#    - apiGroups: [""]
#      resources:
#        - "secrets"
#      verbs: ["get", "list"]
#  ---
#  apiVersion: rbac.authorization.k8s.io/v1
#  kind: RoleBinding
#  metadata:
#    name: newrelic-secrets-secrets
#    namespace: # default #CHANGE THIS VALUE FOR the content of ETCD_TLS_SECRET_NAMESPACE or set it to "default"
#  roleRef:
#    apiGroup: rbac.authorization.k8s.io
#    kind: ClusterRole
#    name: newrelic-secrets
#  subjects:
#    - kind: ServiceAccount
#      name: newrelic
#      namespace: default
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: newrelic
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: newrelic
subjects:
- kind: ServiceAccount
  name: newrelic
  namespace: default
---
apiVersion: apps/v1
kind: DaemonSet
metadata:
  name: newrelic-infra
  namespace: default
  labels:
    app: newrelic-infra
spec:
  selector:
    matchLabels:
      name: newrelic-infra
  updateStrategy:
      type: RollingUpdate
  template:
    metadata:
      labels:
        name: newrelic-infra
    spec:
      serviceAccountName: newrelic
      hostNetwork: true # This option is a requirement for the Infrastructure Agent to report the proper hostname in New Relic.
      dnsPolicy: ClusterFirstWithHostNet
      containers:
        - name: newrelic-infra
          image: newrelic/infrastructure-k8s:2.8.2
          securityContext:
            privileged: true
          resources:
            limits:
              memory: 300M
            requests:
              cpu: 100m
              memory: 150M
          volumeMounts:
            - mountPath: /host
              name: host-volume
              readOnly: true
            - mountPath: /var/run/docker.sock
              name: host-docker-socket
            - mountPath: /var/db/newrelic-infra/integrations.d/
              name: nri-default-integration-cfg-volume
            - mountPath: /etc/newrelic-infra/integrations.d/
              name: nri-integration-cfg-volume
          env:
            - name: "CLUSTER_NAME"
              value: "<YOUR_CLUSTER_NAME>"
            - name: "NRIA_LICENSE_KEY"
              value: "<YOUR_LICENSE_KEY>"
            - name: "NRIA_VERBOSE"
              value: "0"
           # - name: "KUBE_STATE_METRICS_POD_LABEL" # Enables discovery of the KSM pod via a label. The value of the label needs to be "true".
           #   value: "<YOUR_LABEL>" # Remember to replace this placeholder with the label name of your choice.
           # - name: "KUBE_STATE_METRICS_PORT" # If the KUBE_STATE_METRICS_POD_LABEL is present, it changes the port queried in the pod.
           #   value: "8080"
           # - name: "KUBE_STATE_METRICS_SCHEME" # If the KUBE_STATE_METRICS_POD_LABEL is present, it changes the scheme used to send to request to the pod.
           #   value: "http"
           # - name: "CADVISOR_PORT" # Enable direct connection to cAdvisor by specifying the port. Needed for Kubernetes versions prior to 1.7.6.
           #   value: "4194"
           # - name: "KUBE_STATE_METRICS_URL" # If this value is specified then discovery process for kube-state-metrics endpoint won't be triggered.
           #   value: "http://172.17.0.3:8080" # This is example value. Only HTTP request is accepted.
           # - name: "ETCD_TLS_SECRET_NAME" # Name of the secret containing the cacert, cert and key used for setting the mTLS config for retrieving metrics from ETCD. In case this is set uncomment the secret cluster role and the rolebinding.
           #   value: "newrelic-infra-etcd-tls-secret"
           # - name: "ETCD_TLS_SECRET_NAMESPACE" # Namespace where the the secret specified in ETCD_TLS_SECRET_NAME was created. In case this is set uncomment the secret cluster role and the rolebinding.
           #   value: "default"
           # Note: Usage of API_SERVER_SECURE_PORT has been deprecated in favor of API_SERVER_ENDPOINT_URL.
           # - name: API_SERVER_SECURE_PORT
           #   value: "6443"
           # - name: "SCHEDULER_ENDPOINT_URL"
           #   value: "https://localhost:10259"
           # - name: "ETCD_ENDPOINT_URL"
           #   value: "https://localhost:9979"
           # - name: "CONTROLLER_MANAGER_ENDPOINT_URL"
           #   value: "https://localhost:10257"
           # - name: "API_SERVER_ENDPOINT_URL"
           #   value: "https://localhost:6443"
            - name: "NRIA_DISPLAY_NAME"
              valueFrom:
                fieldRef:
                  apiVersion: "v1"
                  fieldPath: "spec.nodeName"
            - name: "NRK8S_NODE_NAME"
              valueFrom:
                fieldRef:
                  apiVersion: "v1"
                  fieldPath: "spec.nodeName"
            - name: "NRIA_CUSTOM_ATTRIBUTES"
              value: '{"clusterName":"$(CLUSTER_NAME)"}'
            - name: "NRIA_PASSTHROUGH_ENVIRONMENT"
              value: "KUBERNETES_SERVICE_HOST,KUBERNETES_SERVICE_PORT,CLUSTER_NAME,CADVISOR_PORT,NRK8S_NODE_NAME,KUBE_STATE_METRICS_URL,KUBE_STATE_METRICS_POD_LABEL,ETCD_TLS_SECRET_NAME,ETCD_TLS_SECRET_NAMESPACE,API_SERVER_SECURE_PORT,KUBE_STATE_METRICS_SCHEME,KUBE_STATE_METRICS_PORT,SCHEDULER_ENDPOINT_URL,ETCD_ENDPOINT_URL,CONTROLLER_MANAGER_ENDPOINT_URL,API_SERVER_ENDPOINT_URL,DISABLE_KUBE_STATE_METRICS,NETWORK_ROUTE_FILE"
      volumes:
        - name: host-volume
          hostPath:
            path: /
        - name: host-docker-socket
          hostPath:
            path: /var/run/docker.sock
        - name: nri-default-integration-cfg-volume
          configMap:
            name: nri-default-integration-cfg
        - name: nri-integration-cfg-volume
          configMap:
            name: nri-integration-cfg
      tolerations:
        - operator: "Exists"
          effect: "NoSchedule"
        - operator: "Exists"
          effect: "NoExecute"
---
apiVersion: v1
kind: ConfigMap
metadata:
  name: nri-default-integration-cfg # integrations config provided by default
  namespace: default
data:
  nri-kubernetes-config.yml: |
    integration_name: com.newrelic.kubernetes
    instances:
      - name: nri-kubernetes
        command: metrics
---
apiVersion: v1
kind: ConfigMap
metadata:
  name: nri-integration-cfg # aimed to be safely overridden by users
  namespace: default
