Agents Deployed on Kubernetes using Admission Controller

How to resolve common issues with Agents deployed on Kubernetes using the Seeker admission controller.

Summary

  • Category: Agent
  • Environment: Kubernetes
  • Severity/Impact: Critical
  • Status: Known issue

Symptoms

You have deployed an Agent according to the instructions in Deploy Agents Automatically Using Admission Controller, but the Agent doesn't work.

Causes and Resolutions

Even though you followed the instructions correctly, the Agent might not actually have been deployed. And if it got deployed, certain misconfigurations might prevent it from performing some of its functions.

Cause Resolution
The Seeker admission controller has been installed, but the Agent doesn't appear to be deployed. Capture some more information in the logs by setting SEEKER_LOG_LEVEL to TRACE in the webhook.yaml file.
Try the following:
  1. Run $ kubectl --namespace seeker-agent-injector get pods

    If no output is displayed, this means the admission controller has not been deployed.

    The output displays the information about the seeker-k8s-agent-injector pod. Check that its status is Running.

  2. Run kubectl --namespace seeker-agent-injector logs <pod name>, supplying the running pod name from the previous output.
  3. Check the output for errors. If you don't see any, this means the admission controller itself is in place, so proceed to check the logs for your application pods for error messages related to the Agent.
  4. Run kubectl --namespace <your namespace> <pod> to view the logs for the default container in the pod and search for Black Duck and Seeker in the Agent's output.
  5. Run kubectl --namespace <your namespace> <pod>-c download-seeker-agent to view the logs of the init container responsible for downloading the Agent from the Seeker server.
When deploying the Agent, the admission controller could not automatically download it from the server due to a lack of network connection to the server. Perform the optional deployment step to build and publish a Docker image containing the supported Agents using your private Docker registry.
The Agent connects to the server initially, but fails to create new regular projects within a composite project because automatic project creation is not enabled. Enable automatic project creation, as described in Configure Automatic Project Creation in Composite Projects.
The Agent connects to the Seeker server but does not function, although the application is running normally. This can happen because the key of a regular project within a composite project is rejected for its length. Try one of the following:
  • Ensure that the total number of characters in the composite project key combined with the regular project key, for example, mycomposite_project1 does not exceed 32.
  • In webhook.yaml, set the SEEKER_AUTO_PREFIX_PROJECT_KEY_WITH_COMPOSITE variable to false to prevent Seeker from prefixing regular project keys with composite project keys. However, doing so might result in non-unique project keys across multiple composite projects, so the first option is preferable.