
该操作员旨在在Kubernetes群集中启用K8SGPT。它将允许您创建一个定义托管K8SGPT工作负载的行为和范围的自定义资源。分析和输出也将是可配置的,以使集成到现有工作流程中。

helm repo add k8sgpt https://charts.k8sgpt.ai/
helm repo update
helm install release k8sgpt/k8sgpt-operator -n k8sgpt-operator-system --create-namespace
从安装部分安装操作员。
创建秘密:
kubectl create secret generic k8sgpt-sample-secret --from-literal=openai-api-key= $OPENAI_TOKEN -n k8sgpt-operator-systemkubectl apply -f - << EOF
apiVersion: core.k8sgpt.ai/v1alpha1
kind: K8sGPT
metadata:
name: k8sgpt-sample
namespace: k8sgpt-operator-system
spec:
ai:
enabled: true
model: gpt-3.5-turbo
backend: openai
secret:
name: k8sgpt-sample-secret
key: openai-api-key
# backOff:
# enabled: false
# maxRetries: 5
# anonymized: false
# language: english
# proxyEndpoint: https://10.255.30.150 # use proxyEndpoint to setup backend through an HTTP/HTTPS proxy
noCache: false
repository: ghcr.io/k8sgpt-ai/k8sgpt
version: v0.3.41
#integrations:
# trivy:
# enabled: true
# namespace: trivy-system
# filters:
# - Ingress
# sink:
# type: slack
# webhook: <webhook-url> # use the sink secret if you want to keep your webhook url private
# secret:
# name: slack-webhook
# key: url
#extraOptions:
# backstage:
# enabled: true
EOF❯ kubectl get results -o json | jq .
{
" apiVersion " : " v1 " ,
" items " : [
{
" apiVersion " : " core.k8sgpt.ai/v1alpha1 " ,
" kind " : " Result " ,
" spec " : {
" details " : " The error message means that the service in Kubernetes doesn't have any associated endpoints, which should have been labeled with " control-plane=controller-manager " . nnTo solve this issue, you need to add the " control-plane=controller-manager " label to the endpoint that matches the service. Once the endpoint is labeled correctly, Kubernetes can associate it with the service, and the error should be resolved. " ,k8sgpt.ai操作员允许通过提供kubeconfig值来监视多个群集。
如果您想采用平台工程,例如为多个利益相关者运行Kubernetes群集,此功能可能会令人着迷。专门为基于群集API的基础架构设计的k8sgpt.ai操作员将安装在同一集群API管理集群中:该群集负责根据种子簇的基础设施提供商来创建所需的群集。
根据命名公约${CLUSTERNAME}-kubeconfig提供基于群集API的群集,将在相同的命名空间中提供kubeconfig :常规的秘密数据密钥是value ,这可以用于指示k8sgpt.ai操作员在不安装任何资源的远程群集中,而无需安装任何资源的播种种子群集。
$: kubectl get clusters
NAME PHASE AGE VERSION
capi-quickstart Provisioned 8s v1.28.0
$: kubectl get secrets
NAME TYPE DATA AGE
capi-quickstart-kubeconfig Opaque 1 8s
安全问题
如果您的设置需要最低特权的方法,则必须提供不同的
kubeconfig,因为生成的群集API与具有clustr-admin权限的admin用户有限。
一旦拥有有效的kubeconfig ,就可以创建一个k8sgpt实例。
apiVersion : core.k8sgpt.ai/v1alpha1
kind : K8sGPT
metadata :
name : capi-quickstart
namespace : default
spec :
ai :
anonymized : true
backend : openai
language : english
model : gpt-3.5-turbo
secret :
key : api_key
name : my_openai_secret
kubeconfig :
key : value
name : capi-quickstart-kubeconfig应用后,应用k8sgpt.ai操作员将使用在字段/spec/kubeconfig中定义的种子群kubeconfig创建k8sgpt.ai部署。
结果Result对象将在部署k8sgpt.ai实例的同一名称空间中可用,因此用以下键标记为:
k8sgpts.k8sgpt.ai/name k8sgpt.ai名称k8sgpts.k8sgpt.ai/namespace实例名称k8sgpt.aik8sgpts.k8sgpt.ai/backend后端(如果指定)多亏了这些标签,可以根据指定的监视群集过滤结果,而无需用k8sgpt.ai CRD污染基础群集和消耗种子计算工作负载,并保持对AI后端驱动程序凭证的机密性。
如果缺少
/spec/kubeconfig字段,k8sgpt.ai操作员将跟踪已部署的群集:通过安装提供的ServiceAccount,这是可能的。
从安装部分安装操作员。
创建秘密:
kubectl create secret generic k8sgpt-sample-cache-secret --from-literal=azure_client_id= < AZURE_CLIENT_ID > --from-literal=azure_tenant_id= < AZURE_TENANT_ID > --from-literal=azure_client_secret= < AZURE_CLIENT_SECRET > -n k8sgpt-
operator-system kubectl apply -f - << EOF
apiVersion: core.k8sgpt.ai/v1alpha1
kind: K8sGPT
metadata:
name: k8sgpt-sample
namespace: k8sgpt-operator-system
spec:
ai:
model: gpt-3.5-turbo
backend: openai
enabled: true
secret:
name: k8sgpt-sample-secret
key: openai-api-key
noCache: false
repository: ghcr.io/k8sgpt-ai/k8sgpt
version: v0.3.41
remoteCache:
credentials:
name: k8sgpt-sample-cache-secret
azure:
# Storage account must already exist
storageAccount: "account_name"
containerName: "container_name"
EOF
从安装部分安装操作员。
创建秘密:
kubectl create secret generic k8sgpt-sample-cache-secret --from-literal=aws_access_key_id= < AWS_ACCESS_KEY_ID > --from-literal=aws_secret_access_key= < AWS_SECRET_ACCESS_KEY > -n k8sgpt-
operator-system kubectl apply -f - << EOF
apiVersion: core.k8sgpt.ai/v1alpha1
kind: K8sGPT
metadata:
name: k8sgpt-sample
namespace: k8sgpt-operator-system
spec:
ai:
model: gpt-3.5-turbo
backend: openai
enabled: true
secret:
name: k8sgpt-sample-secret
key: openai-api-key
noCache: false
repository: ghcr.io/k8sgpt-ai/k8sgpt
version: v0.3.41
remoteCache:
credentials:
name: k8sgpt-sample-cache-secret
s3:
bucketName: foo
region: us-west-1
EOF
从安装部分安装操作员。
创建秘密:
kubectl create secret generic k8sgpt-sample-secret --from-literal=azure-api-key= $AZURE_TOKEN -n k8sgpt-operator-system kubectl apply -f - << EOF
apiVersion: core.k8sgpt.ai/v1alpha1
kind: K8sGPT
metadata:
name: k8sgpt-sample
namespace: k8sgpt-operator-system
spec:
ai:
enabled: true
secret:
name: k8sgpt-sample-secret
key: azure-api-key
model: gpt-35-turbo
backend: azureopenai
baseUrl: https://k8sgpt.openai.azure.com/
engine: llm
noCache: false
repository: ghcr.io/k8sgpt-ai/k8sgpt
version: v0.3.41
EOF
从安装部分安装操作员。
在AWS上运行时,您有多种方法可以允许托管的K8SGPT工作负载来访问Amazon Bedrock。
要使用Kubernetes服务帐户授予基岩的访问权限,请使用基岩权限创建IAM角色。下面包括一个示例策略:
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"bedrock:InvokeModel",
"bedrock:InvokeModelWithResponseStream"
],
"Resource": "*"
}
]
}
要使用Kubernetes秘密中的AWS凭据授予访问基岩的访问权限,您可以创建一个秘密:
kubectl create secret generic bedrock-sample-secret --from-literal=AWS_ACCESS_KEY_ID= " $( echo $AWS_ACCESS_KEY_ID ) " --from-literal=AWS_SECRET_ACCESS_KEY= " $( echo $AWS_SECRET_ACCESS_KEY ) " -n k8sgpt-operator-system kubectl apply -f - << EOF
apiVersion: core.k8sgpt.ai/v1alpha1
kind: K8sGPT
metadata:
name: k8sgpt-sample
namespace: k8sgpt-operator-system
spec:
ai:
enabled: true
secret:
name: bedrock-sample-secret
model: anthropic.claude-v2
region: eu-central-1
backend: amazonbedrock
noCache: false
repository: ghcr.io/k8sgpt-ai/k8sgpt
version: v0.3.41
EOF
从安装部分安装操作员。
遵循Localai安装指南安装Localai。 (使用Localai时不需要开放式秘密)。
应用K8SGPT配置对象:
kubectl apply -f - << EOF
apiVersion: core.k8sgpt.ai/v1alpha1
kind: K8sGPT
metadata:
name: k8sgpt-local-ai
namespace: default
spec:
ai:
enabled: true
model: ggml-gpt4all-j
backend: localai
baseUrl: http://local-ai.local-ai.svc.cluster.local:8080/v1
noCache: false
repository: ghcr.io/k8sgpt-ai/k8sgpt
version: v0.3.41
EOF注意:确保baseUrl的值是局部服务的正确构建的DNS名称。它应采取表格: http://local-ai.<namespace_local_ai_was_installed_in>.svc.cluster.local:8080/v1
kubectl apply -f - << EOF
apiVersion: core.k8sgpt.ai/v1alpha1
kind: K8sGPT
metadata:
name: k8sgpt-sample
namespace: k8sgpt-operator-system
spec:
ai:
enabled: true
model: gpt-3.5-turbo
backend: openai
secret:
name: k8sgpt-sample-secret
key: openai-api-key
noCache: false
repository: sample.repository/k8sgpt
version: sample-tag
imagePullSecrets:
- name: sample-secret
EOF可选参数可用于接收器。
('type','webhook'是必需的参数。)
| 工具 | 渠道 | icon_url | 用户名 |
|---|---|---|---|
| 松弛 | |||
| 最重要 | ✔️ | ✔️ | ✔️ |
有关详细信息,请参阅此处