How to configure DD_DOGSTATSD_MAPPER_PROFILES in datadog airflow integration? - airflow
I installed datadog-agent using helm upgrade/install and provided the -f datadog.yaml parameter. The datadog.yaml contains this entry:
...
agents:
enabled: true
useConfigMap: true
customAgentConfig:
# Autodiscovery for Kubernetes
listeners:
- name: kubelet
config_providers:
- name: kubelet
polling: true
- name: docker
polling: true
apm_config:
enabled: false
apm_non_local_traffic: true
dogstatsd_mapper_profiles:
- name: airflow
prefix: "airflow."
mappings:
- match: "airflow.*_start"
name: "airflow.job.start"
tags:
job_name: "$1"
- match: "airflow.*_end"
name: "airflow.job.end"
tags:
job_name: "$1"
- match: "airflow.operator_failures_*"
...
But I don't see DD_DOGSTATSD_MAPPER_PROFILES env variable in the datadog-agent pod.
How can I inject this env variable to the datadog-agents?
Update 2/24/2022: I do see it's been added as a ConfigMap but it does not look like it is being mounted to the datadog-agent pod.
Update 3/4/2022: This yaml is working and I see the metrics in datadog dashboard. I do see it got mounted on the datadog-agent pod as config-map.
Use this in your datadog's helm chart:
datadog.env:
- name: DD_DOGSTATSD_MAPPER_PROFILES
value: >
[{"prefix":"airflow.","name":"airflow","mappings":[{"name":"airflow.job.start","match":"airflow.*_start","tags":{"job_name":"$1"}},{"name":"airflow.job.end","match":"airflow.*_end","tags":{"job_name":"$1"}},{"name":"airflow.job.heartbeat.failure","match":"airflow.*_heartbeat_failure","tags":{"job_name":"$1"}},{"name":"airflow.operator_failures","match":"airflow.operator_failures_*","tags":{"operator_name":"$1"}},{"name":"airflow.operator_successes","match":"airflow.operator_successes_*","tags":{"operator_name":"$1"}},{"match_type":"regex","name":"airflow.dag_processing.last_runtime","match":"airflow\\.dag_processing\\.last_runtime\\.(.*)","tags":{"dag_file":"$1"}},{"match_type":"regex","name":"airflow.dag_processing.last_run.seconds_ago","match":"airflow\\.dag_processing\\.last_run\\.seconds_ago\\.(.*)","tags":{"dag_file":"$1"}},{"match_type":"regex","name":"airflow.dag.loading_duration","match":"airflow\\.dag\\.loading-duration\\.(.*)","tags":{"dag_file":"$1"}},{"name":"airflow.dagrun.first_task_scheduling_delay","match":"airflow.dagrun.*.first_task_scheduling_delay","tags":{"dag_id":"$1"}},{"name":"airflow.pool.open_slots","match":"airflow.pool.open_slots.*","tags":{"pool_name":"$1"}},{"name":"airflow.pool.queued_slots","match":"pool.queued_slots.*","tags":{"pool_name":"$1"}},{"name":"airflow.pool.running_slots","match":"pool.running_slots.*","tags":{"pool_name":"$1"}},{"name":"airflow.pool.used_slots","match":"airflow.pool.used_slots.*","tags":{"pool_name":"$1"}},{"name":"airflow.pool.starving_tasks","match":"airflow.pool.starving_tasks.*","tags":{"pool_name":"$1"}},{"match_type":"regex","name":"airflow.dagrun.dependency_check","match":"airflow\\.dagrun\\.dependency-check\\.(.*)","tags":{"dag_id":"$1"}},{"match_type":"regex","name":"airflow.dag.task.duration","match":"airflow\\.dag\\.(.*)\\.([^.]*)\\.duration","tags":{"dag_id":"$1","task_id":"$2"}},{"match_type":"regex","name":"airflow.dag_processing.last_duration","match":"airflow\\.dag_processing\\.last_duration\\.(.*)","tags":{"dag_file":"$1"}},{"match_type":"regex","name":"airflow.dagrun.duration.success","match":"airflow\\.dagrun\\.duration\\.success\\.(.*)","tags":{"dag_id":"$1"}},{"match_type":"regex","name":"airflow.dagrun.duration.failed","match":"airflow\\.dagrun\\.duration\\.failed\\.(.*)","tags":{"dag_id":"$1"}},{"match_type":"regex","name":"airflow.dagrun.schedule_delay","match":"airflow\\.dagrun\\.schedule_delay\\.(.*)","tags":{"dag_id":"$1"}},{"name":"airflow.scheduler.tasks.running","match":"scheduler.tasks.running"},{"name":"airflow.scheduler.tasks.starving","match":"scheduler.tasks.starving"},{"name":"airflow.sla_email_notification_failure","match":"sla_email_notification_failure"},{"match_type":"regex","name":"airflow.dag.task_removed","match":"airflow\\.task_removed_from_dag\\.(.*)","tags":{"dag_id":"$1"}},{"match_type":"regex","name":"airflow.dag.task_restored","match":"airflow\\.task_restored_to_dag\\.(.*)","tags":{"dag_id":"$1"}},{"name":"airflow.task.instance_created","match":"airflow.task_instance_created-*","tags":{"task_class":"$1"}},{"name":"airflow.ti.start","match":"ti.start.*.*","tags":{"dagid":"$1","taskid":"$2"}},{"name":"airflow.ti.finish","match":"ti.finish.*.*.*","tags":{"dagid":"$1","state":"$3","taskid":"$2"}}]}]
Related
How can I create a public single-user jupyter notebook-server?
I have setup a Jupyterhub running on K8s It authenticates and launches private user notebook-servers (pods) in the K8s But these pods are private to K8s networking, and I want to connect to it from Local VSCode via its Remote Kernel Connection I tried to find resources, but there isn't much available that matches my setup, can anyone help me redirect to the setup. Also attaching the jupyterhub-config.yaml I am using currently to create single user pods as a notebook-server. singleuser: extraContainers: - name: "somename" image: "{{ jupyter_notebook_image_name }}:{{ jupyter_notebook_tag }}" command: ["/usr/local/bin/main.sh"] securityContext: runAsUser: 0 lifecycle: postStart: exec: command: ["/bin/sh", "-c", "cp copy.json copy.json"] env: - name: JUPYTERHUB_USER value: '{unescaped_username}' volumeMounts: - name: projects mountPath: /.sols/ - name: home-projects-dir mountPath: /home/jovyan/projects/ - name: kernels-path mountPath: /usr/local/share/jupyter/kernels/ lifecycleHooks: postStart: exec: command: ["/bin/sh", "-c", "cp copy.json copy.json"] uid: 0 storage: capacity: 1Gi homeMountPath: /home/jovyan/{username} extraVolumes: - name: projects persistentVolumeClaim: claimName: projects--hub-pvc - name: home-projects-dir - name: kernels-path extraVolumeMounts: - name: projects mountPath: /.sols/ - name: home-projects-dir mountPath: /home/jovyan/projects/ - name: kernels-path mountPath: /usr/local/share/jupyter/kernels/ dynamic: storageClassName: jupyter pvcNameTemplate: '{username}--hub-pvc' volumeNameTemplate: '{username}--hub-pv' storageAccessModes: [ReadWriteMany] image: name: {{ jupyter_notebook_image_name }} tag: {{ jupyter_notebook_tag }} pullSecrets: xxxkey
Couldn't find message bus pubsub.jetstream/v1 Dapr
I'm trying to connect dapr with nats with jetstream functionality enabled. I want to start everything with docker-compose. Nats service is started and when I run nats-cli with command nats -s "nats://localhost:4222" server check jetstream, I get OK JetStream | memory=0B memory_pct=0%;75;90 storage=0B storage_pct=0%;75;90 streams=0 streams_pct=0% consumers=0 consumers_pct=0% indicating nats with jetstream is working ok. Unfortunately, dapr returns first warning then error warning: error creating pub sub %!s(*string=0xc0000ca020) (pubsub.jetstream/v1): couldn't find message bus pubsub.jetstream/v1" app_id=conversation-api1 instance=50b51af8e9a8 scope=dapr.runtime type=log ver=1.3.0 error: process component conversation-pubsub error: couldn't find message bus pubsub.jetstream/v1" app_id=conversation-api1 instance=50b51af8e9a8 scope=dapr.runtime type=log ver=1.3.0 I followed instructions on official site. docker-compose.yaml version: '3.4' services: conversation-api1: image: ${DOCKER_REGISTRY-}conversationapi1 build: context: . dockerfile: Conversation.Api1/Dockerfile ports: - "5010:80" conversation-api1-dapr: container_name: conversation-api1-dapr image: "daprio/daprd:latest" command: [ "./daprd", "--log-level", "debug", "-app-id", "conversation-api1", "-app-port", "80", "--components-path", "/components", "-config", "/configuration/conversation-config.yaml" ] volumes: - "./dapr/components/:/components" - "./dapr/configuration/:/configuration" depends_on: - conversation-api1 - redis - nats network_mode: "service:conversation-api1" nats: container_name: "Nats" image: nats command: [ "-js", "-m", "8222" ] ports: - "4222:4222" - "8222:8222" - "6222:6222" # OTHER SERVICES... conversation-pubsub.yaml apiVersion: dapr.io/v1alpha1 kind: Component metadata: name: conversation-pubsub namespace: default spec: type: pubsub.jetstream version: v1 metadata: - name: natsURL value: "nats://host.docker.internal:4222" # already tried with nats for host - name: name value: "conversation" - name: durableName value: "conversation-durable" - name: queueGroupName value: "conversation-group" - name: startSequence value: 1 - name: startTime # in Unix format value: 1630349391 - name: deliverAll value: false - name: flowControl value: false conversation-config.yaml apiVersion: dapr.io/v1alpha1 kind: Configuration metadata: name: config namespace: default spec: tracing: samplingRate: "1" zipkin: endpointAddress: "http://zipkin:9411/api/v2/spans"
The problem was in old Dapr version. I used version 1.3.0, Jetstream support is introduced in 1.4.0+. Pulling latest version of daprio/daprd fixed my problem. Also no need for nats://host.docker.internal:4222, nats://nats:4222 works as expected.
Basic auth is not working for Traefik v2.1
my issue is that I cannot set the basic authentication for my frontend app throught traefik This is how I have configured my traefik traefik.yml global: checkNewVersion: true sendAnonymousUsage: false entryPoints: https: address: :443 http: address: :80 traefik: address: :8080 tls: options: foo: minVersion: VersionTLS12 cipherSuites: - "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256" - "TLS_RSA_WITH_AES_256_GCM_SHA384" providers: providersThrottleDuration: 2s docker: watch: true endpoint: unix:///var/run/docker.sock exposedByDefault: false network: web api: insecure: true dashboard: true log: level: INFO certificatesResolvers: default: acme: storage: /acme.json httpChallenge: entryPoint: http docker-compose.yml version: '3' services: traefik: image: traefik:v2.0 restart: always ports: - "80:80" - "443:443" - "8080:8080" volumes: - "/var/run/docker.sock:/var/run/docker.sock" - "/srv/traefik/traefik.yml:/etc/traefik/traefik.yml" - "/srv/traefik/acme.json:/acme.json" networks: - web networks: web: external: true And here is where I have my frontend app running as a traefik provider and where I have my basic auth label version: '3.7' services: frontend: image: git.xxxx.com:7000/dockerregistry/registry/xxxx restart: "always" networks: - web volumes: - "/srv/config/api.js:/var/www/htdocs/api.js" - "/srv/efs/workspace:/var/www/htdocs/stock" labels: - traefik.enable=true - traefik.http.routers.frontend-http.rule=Host(`test.xxxx.com`) - traefik.http.routers.frontend-http.service=frontend - traefik.http.routers.frontend-http.entrypoints=http - traefik.http.routers.frontend.tls=true - traefik.http.routers.frontend.tls.certresolver=default - traefik.http.routers.frontend.entrypoints=http - traefik.http.routers.frontend.rule=Host(`test.xxxx.com`) - traefik.http.routers.frontend.service=frontend - traefik.http.middlewares.frontend.basicAuth.users=test:$$2y$$05$$c45HvbP0Sq9EzcfaXiGNsuuWMfPhyoFZVYgiTylpMMLtJY2nP1P6m - traefik.http.services.frontend.loadbalancer.server.port=8080 networks: web: external: true I cannot get the login prompt, so Im wondering if I missing some container label for this. Thanks in advance! Joaquin
firstly , the labels should be in quotation marks like this "" secondly, I think you are missing a label in the frontend app . when using basic auth it takes two steps and should look like this : - "traefik.http.routers.frontend.middlewares=frontend-auth" - "traefik.http.middlewares.frontend-auth.basicauth.users=test:$$2y$$05$$c45HvbP0Sq9EzcfaXiGNsuuWMfPhyoFZVYgiTylpMMLtJY2nP1P6m"
In your Docker Compose file don't add the "middlewares" label for traefik, instead do it using a traefik.yml file passing the providers.file option, where you should define the routers, services, middlewares, etc. In that "providers file" you should set middlewares under http.routes.traefik – This may sound super confuse at the beginning but is not that hard, trust me. Let's do a YAML case (you can convert it to "TOML" here). This example assumes you have a Docker Compose file specifically for Traefik – I haven't tried using the same Docker Compose file with any other services in it (like Wordpress, databases or whatever) since I already have a different path for those files. docker-compose.yml version: '3.1' services: reverse-proxy: image: traefik:v2.4 [ ... ] volumes: - /var/run/docker.sock:/var/run/docker.sock:ro # Map the dynamic conf into the container - ./traefik/config.yml:/etc/traefik/config.yml:ro # Map the static conf into the container - ./traefik/traefik.yml:/etc/traefik/traefik.yml:ro # Note you don't use "traefik.http.routers.<service>.middlewares etc." here [ ... ] In this case I set/get the config files for Traefik in ./traefik (relative to the docker-compose.yml file). ./traefik/config.yml http: routers: traefik: middlewares: "basicauth" [ ... ] middlewares: basicauth: basicAuth: removeHeader: true users: - <user>:<password> # password should be generated using `htpasswd` (md5, sha1 or bcrypt) [ ... ] Here you can set the basicauth name as you wish (since that's the middleware name you'll see in the Dashboard), so you could do: http: routers: traefik: middlewares: "super-dashboard-auth" [ ... ] middlewares: super-dashboard-auth: basicAuth: removeHeader: true users: - <user>:<password> # password should be generated using `htpasswd` (md5, sha1 or bcrypt) [ ... ] Note that basicAuth must remain as is. Also, here you don't need to use the "double dollar method" to scape it (as in the label approach), so after creating the user password you should enter it exactly like htpasswd created it. # BAD user:$$2y$$10$$nRLqyZT.64JI/CD/ym65UGDn8HaY0D6CBTxhe6JXf9u4wi5bEMdh. # GOOD user:$2y$10$nRLqyZT.64JI/CD/ym65UGDn8HaY0D6CBTxhe6JXf9u4wi5bEMdh. Of course you may want to get this data from an .env file and not hardcode those strings, in that case you need to pass the environmental variable from the docker-compose.yml using environment like this: services: reverse-proxy: image: traefik:v2.4 container_name: traefik [ ... ] environment: TRAEFIK_DASHBOARD_USER: "${TRAEFIK_DASHBOARD_USER}" TRAEFIK_DASHBOARD_PWD: "${TRAEFIK_DASHBOARD_PWD}" # And any other env. var. you may need [ ... ] and use it like this in you traefik/config.yml file: [ ... ] middlewares: super-dashboard-auth: basicAuth: removeHeader: true users: - "{{env "TRAEFIK_DASHBOARD_USER"}}:{{env "TRAEFIK_DASHBOARD_PWD"}}" [ ... ] After that include the previous file in the providers.file.filename ./traefik/traefik.yml [ ... ] api: dashboard: true insecure: false providers: docker: endpoint: "unix:///var/run/docker.sock" [ ... ] file: filename: /etc/traefik/config.yml watch: true [ ... ] And then simply docker-compose up -d
I configure it this way: generate password by apache2-utils e.g. htpasswd -nb admin secure_password setup traefik.toml [entryPoints] [entryPoints.web] address = ":80" [entryPoints.web.http.redirections.entryPoint] to = "websecure" scheme = "https" [entryPoints.websecure] address = ":443" [api] dashboard = true [certificatesResolvers.lets-encrypt.acme] email = "your_email#your_domain" storage = "acme.json" [certificatesResolvers.lets-encrypt.acme.tlsChallenge] [providers.docker] watch = true network = "web" [providers.file] filename = "traefik_dynamic.toml" setup traefik_dynamic.toml [http.middlewares.simpleAuth.basicAuth] users = [ "admin:$apr1$ruca84Hq$mbjdMZBAG.KWn7vfN/SNK/" ] [http.routers.api] rule = "Host(`monitor.your_domain`)" entrypoints = ["websecure"] middlewares = ["simpleAuth"] service = "api#internal" [http.routers.api.tls] certResolver = "lets-encrypt" setup traefik service services: reverse-proxy: image: traefik:v2.3 restart: always command: - --api.insecure=true - --providers.docker ports: - "80:80" - "443:443" networks: - web volumes: - /var/run/docker.sock:/var/run/docker.sock - ./traefik.toml:/traefik.toml - ./traefik_dynamic.toml:/traefik_dynamic.toml - ./acme.json:/acme.json
Regarding this part of the documentation. If you are using Docker scripts for settings. Configure as the following. For example: labels: - "traefik.http.middlewares.foo-add-prefix.addprefix.prefix=/foo" - "traefik.http.routers.router1.middlewares=foo-add-prefix#docker" I had same issue and I was missing namespace name #docker in the middleware name.
Argo artifacts gives error "http: server gave HTTP response to HTTPS client"
I was setting up Argo in my k8s cluster in Argo namespace. I also Installed MinIO as an Artifact repository (https://github.com/argoproj/argo-workflows/blob/master/docs/configure-artifact-repository.md). I am configuring a workflow which tries to access that Non-Default Artifact Repository as: apiVersion: argoproj.io/v1alpha1 kind: Workflow metadata: generateName: artifact-passing- spec: entrypoint: artifact-example templates: - name: artifact-example steps: - - name: generate-artifact template: whalesay - - name: consume-artifact template: print-message arguments: artifacts: # bind message to the hello-art artifact # generated by the generate-artifact step - name: message from: "{{steps.generate-artifact.outputs.artifacts.hello-art}}" - name: whalesay container: image: docker/whalesay:latest command: [sh, -c] args: ["cowsay hello world | tee /tmp/hello_world.txt"] outputs: artifacts: # generate hello-art artifact from /tmp/hello_world.txt # artifacts can be directories as well as files - name: hello-art path: /tmp/hello_world.txt s3: endpoint: argo-artifacts-minio.argo:9000 bucket: my-bucket key: /my-output-artifact.tgz accessKeySecret: name: argo-artifacts-minio key: accesskey secretKeySecret: name: argo-artifacts-minio key: secretkey - name: print-message inputs: artifacts: # unpack the message input artifact # and put it at /tmp/message - name: message path: /tmp/message s3: endpoint: argo-artifacts-minio.argo:9000 bucket: my-bucket accessKeySecret: name: argo-artifacts-minio key: accesskey secretKeySecret: name: argo-artifacts-minio key: secretkey container: image: alpine:latest command: [sh, -c] args: ["cat /tmp/message"] I created the workflow in argo namespace by: argo submit --watch artifact-passing-nondefault-new.yaml -n argo But the workflow fails with an error: STEP PODNAME DURATION MESSAGE ✖ artifact-passing-z9g64 child 'artifact-passing-z9g64-150231068' failed └---⚠ generate-artifact artifact-passing-z9g64-150231068 12s failed to save outputs: Get https://argo-artifacts-minio.argo:9000/my-bucket/?location=: http: server gave HTTP response to HTTPS client Can someone help me to solve this error?
Since the minio setup runs without TLS configured, the workflow should specify that it should connect to an insecure artifact repository. Including a field insecure: true in the s3 definition section of the workflow solves the issue. s3: endpoint: argo-artifacts-minio.argo:9000 insecure: true bucket: my-bucket key: /my-output-artifact.tgz accessKeySecret: name: argo-artifacts-minio key: accesskey secretKeySecret: name: argo-artifacts-minio key: secretkey
Metricbeat failing autodiscover on Kubernetes
Autodiscover not working for metricbeat 6.4.0 in kubernetes 1.9.6. Nginx module in this use case, uwsgi also tried. Declaring the module and giving an nginx ip outside of autodiscover works. below is the configmap being used. Any ideas on some additional ways to set this up or problems that would stop the autodiscover from working. apiVersion: v1 kind: ConfigMap metadata: name: metricbeat-deployment-config namespace: kube-system labels: k8s-app: metricbeat data: metricbeat.yml: |- metricbeat.config.modules: # Mounted `metricbeat-daemonset-modules` configmap: path: ${path.config}/modules.d/*.yml # Reload module configs as they change: reload.enabled: false processors: - add_cloud_metadata: output.elasticsearch: hosts: ['${ELASTICSEARCH_HOST:elasticsearch}:${ELASTICSEARCH_PORT:9200}'] --- apiVersion: v1 kind: ConfigMap metadata: name: metricbeat-deployment-modules namespace: kube-system labels: k8s-app: metricbeat data: autodiscover.yml: |- metricbeat.autodiscover: providers: - type: kubernetes host: ${HOSTNAME} #hints.enabled: true templates: - condition: contains: kubernetes.container.name: nginx config: - module: nginx metricsets: ["stubstatus"] enable: true period: 10s hosts: ["${data.host}:80"] server_status_path: "nginx_status" kubernetes.yml: |- - module: kubernetes metricsets: - state_node - state_deployment - state_replicaset - state_pod - state_container period: 10s host: ${NODE_NAME} hosts: ["kube-state-metrics.monitoring.svc:8080"]