Attributes for Agent Features

FlexNet Manager Suite 2022 R1 (On-Premises)

The YAML file format allows you to configure specific features of the Flexera Kubernetes inventory agent using the settings described in this topic.

IBM License Service integration

Containerized IBM software requires the use of the IBM License Service to monitor license usage. The Flexera Kubernetes inventory agent integrates with the IBM License Service, and collects the IBM product(s) capacity usage data for that cluster through the IBM License Service API.

To consume the IBM License Service API, the Flexera Kubernetes inventory agent must first locate the API, and obtain the token used to authenticate. This requires the Flexera Kubernetes inventory agent to read several different resource types from the cluster that it would not otherwise need to read. Permissions to read these resources can be enabled during the installation process. It is also possible to avoid adding these permissions by providing the Flexera Kubernetes inventory agent with all the standard values it needs in the attributes within the YAML file. (This does not include the ones listed under Advanced Flexera Kubernetes inventory agent attributes.)

Note: The entire set of values must be provided. If the set is incomplete, the Flexera Kubernetes inventory agent attempts to discover those that are missing. Exceptions to this general statement are the enable and tlsVerify settings (which are required in all cases).

When enabled (as described next), the Flexera Kubernetes inventory agent first detects the presence of the IBM License Service in the Kubernetes cluster by looking for the CustomResourceDefinition:

ibmLicensings.operator.ibm.com

Tip: The plural ibmLicensings in this context is not a typo, but in line with the Kubernetes naming convention that uses the plural form when referring to a fully-qualified resource type.

It then loads any missing configuration values needed to locate and authenticate with the API by reading the ibmLicensing resource configuration, searching for services in the Kubernetes cluster using label selectors, and reading the secret that provides the authentication token.

Tip: If this process fails, or if the IBM License Service is not installed in the Kubernetes cluster, the Flexera Kubernetes inventory agent re-attempts the process every 5 minutes. This is because your settings in the YAML file specify that you want to enable the integration with the IBM License Service, and if this is deployed at some later time, the regular checks by the Flexera Kubernetes inventory agent cause the integration to begin working without further effort. If this is not what you require, simply change the setting (described next) back to false to turn off the integration, as this also turns off the checking process.

The Flexera Kubernetes inventory agent queries the IBM Licensing Service API either:

• Immediately on start-up
• Immediately after successfully discovering the service and configuration
• Every day at 1:00 AM (local time of the cluster).

The Flexera Kubernetes inventory agent requests a usage snapshot for the prior 180 days each time it queries the API.

Enable the integration

If this attribute is set to true, integration of the Flexera Kubernetes inventory agent with the IBM Licence Service is turned on.

Important: The default value is false, in which case the Flexera Kubernetes inventory agent does not interact with the IBM License Service. Be aware that use of the IBM License Service is mandatory for compliance with IBM licenses for products running in Kubernetes clusters. If you wish to import the license data collected by the IBM License Service for reporting within FlexNet Manager Suite, you must set this attribute to true.

Attribute	spec.ibmLicensing.enable
Type	Boolean
Example	true

With this setting, the relevant sections of the YAML file looks similar to this:

apiVersion: agents.flexera.com/v1
kind: KRM
metadata:
  name: instance
spec:
  ibmLicensing:
    enable: true
...

The IBM License Service namespace

If this attribute is omitted, the Flexera Kubernetes inventory agent automatically searches for the namespace used by the IBM License Service. Alternatively, you may explicitly specify that namespace in this attribute.

Attribute	spec.ibmLicensing.namespace
Type	String
Example	ibm-common-services

The service name

If this attribute is omitted, the Flexera Kubernetes inventory agent automatically searches for the name of the Service used to expose the IBM License Service API within the Kubernetes cluster. Alternatively, you may explicitly specify that name in this attribute.

Attribute	spec.ibmLicensing.serviceName
Type	String
Example	ibm-licensing-service-instance

The service port

If this attribute is omitted, the Flexera Kubernetes inventory agent automatically searches for the TCP port in the Service used to expose the IBM License Service API within the Kubernetes cluster. Alternatively, you may explicitly specify that port in this attribute.

Attribute	spec.ibmLicensing.servicePort
Type	Integer
Example	8080

The service token

If this attribute is omitted, the Flexera Kubernetes inventory agent automatically searches for the token used to authenticate with the IBM License Service API within the Kubernetes cluster. Alternatively, you may explicitly specify that token in this attribute.

Attribute	spec.ibmLicensing.token
Type	String
Example	VoOMWJijBWuCxSxwgON11w7z

The service protocol

If this attribute is omitted, the Flexera Kubernetes inventory agent automatically searches the configuration to determine whether the IBM License Service API is served over HTTPS. Alternatively, you may explicitly specify that protocol in this attribute.

Attribute	spec.ibmLicensing.https
Type	Boolean
Example	true

The service certificate

If the IBM License Service API serves over HTTPS using an untrusted certificate, this setting can be set to false (or left unspecified, since the default value is false).

• When this value is false (or unspecified), the Flexera Kubernetes inventory agent does not attempt to verify authenticity of the certificate.
• When this value is set to true, the Flexera Kubernetes inventory agent verifies the certificate. Connection with the IBM License Service fails if either:
  • The certificate is not valid
  • The certificate is signed by an unknown issuer.

Attribute	spec.ibmLicensing.tlsVerify
Type	Boolean
Example	false

Advanced Flexera Kubernetes inventory agent attributes

FlexNet Manager Suite 2022 R1 (On-Premises)

The following attributes control minor aspects of the behavior of the Flexera Kubernetes inventory agent. All have sensible defaults, so that there is no strong reason to modify these attributes unless you need detailed configuration control in your environment.

Inventory interval

Specifies the time interval on which the Flexera Kubernetes inventory agent collects and uploads inventory. The Flexera Kubernetes inventory agent caches the most up-to-date information about each cluster resource it is interested in observing, and retains resources in its cache (even if they have been deleted in the cluster) until it can upload its next inventory. The interval setting is a trade-off between the data volume retained in cache and uploadable in a given inventory versus the number of inventories being uploaded and imported. The default value is 24h, so that the Flexera Kubernetes inventory agent collects and uploads its specified inventory once each day.

The value of this setting is a string using the convention established by Kubernetes and the Go programming language. It consists of an integer followed by a unit suffix such as "s" for seconds, "m" for minutes, or "h" for hours, for example 12h for twelve hours.

Attribute	spec.monitor.interval
Type	Duration
Example	6h

Agent self-updates and policy updates

The downloadFromBeacon attribute controls whether the Flexera Kubernetes inventory agent allows any data flows down from its inventory beacon, which includes three important kinds of communication that impact the FlexNet inventory agent when it is triggered to collect software inventory within the container:

• Updates to agent policy, made available through inventory beacons as new versions of the config.ini file distributed from the central application server
• Further extensions to inventory-gathering functionality, distributed as updated versions of InventorySettings.xml
• Updated versions of the FlexNet inventory agent itself.

The default value of this attribute is true, on the assumption that you may expect to collect software inventory from your containers with optimum, fully-updated functionality:

• If downloadFromBeacon is set to true or unspecified, the Flexera Kubernetes inventory agent runs the policy component of FlexNet inventory agent to check for, and if necessary to download, the latest agent policy (config.ini), updates to the zero-footprint inventory component (ndtrack.sh), and latest version of the InventorySettings.xml file of extension capabilities.
• If downloadFromBeacon is false, Flexera Kubernetes inventory agent does not permit these updates. Instead, it uses the version of ndtrack.sh that shipped in the container image, and does not use any copy of InventorySettings.xml. It also uses the config.ini file that shipped in the container image, although this may be updated with local patches for the cluster (see Patching config.ini through Flexera Kubernetes Inventory Agent). While setting downloadFromBeacon to false is the recommended approach for situations where the container must remain immutable at runtime, it may impact the completeness of the inventory produced for container images in the cluster, particularly for software from vendors like Oracle and Microsoft.

Attribute	spec.monitor.downloadFromBeacon
Type	Boolean
Example	false

Collect software inventory

The imageInventory attribute controls collection of software inventory from OCI container images:

• When set to true (the default) or unspecified, the Flexera Kubernetes inventory agent injects the inventory component of FlexNet inventory agent (ndtrack.sh) into containers in the cluster to obtain software inventories of their content. Thereafter, the tracker is removed again, completing a process of zero footprint inventory collection.
• When set to false, the Flexera Kubernetes inventory agent disables this behavior. This means that the Flexera Kubernetes inventory agent cannot report software inventory from any containers in the cluster.
  Important: Unless some other inventory source replaces this software inventory from containers, a license position cannot be correctly resolved, and you may be exposed in a future compliance audit. Keep in mind that the IBM License Service only monitors software from IBM. Consider the requirement to monitor license consumption for other software companies.

Attribute	spec.monitor.imageInventory
Type	Boolean
Example	true

Node component

The enable attribute within the node block of the YAML file determines whether the node-monitoring component of the Flexera Kubernetes inventory agent is deployed:

• When true (the default) or unspecified, normal operations are enabled.
• If set to false, the node component of the Flexera Kubernetes inventory agent is not deployed. This means that hardware inventory of the worker nodes cannot be collected.

Warning: While the option to disable the node component is currently available in the Flexera Kubernetes inventory agent, it is not yet supported by the rest of FlexNet Manager Suite. Do not disable the node component until a later release removes this warning.

Attribute	spec.node.enable
Type	Boolean
Example	true

Node inventory interval

The interval attribute within the node block of the YAML file determines how often (at what time interval) hardware inventory is collected for the worker nodes in the cluster(s). In general, this can be left unspecified, even when:

• You hold a license modification that authorizes use of FlexNet Manager Suite to assess sub-capacity consumption of IBM PVU licenses (when the terms of this modification require assessing the underlying hardware and reporting its inventory every 30 minutes); and
• You have IBM product(s) running on one or more worker nodes that are licensed with IBM PVU licenses and are eligible for sub-capacity consumption calculations.

This is because the default value is already 30m, so that leaving it without further specification already complies with the IBM requirements for sub-capacity PVU points reporting.

Attribute	spec.node.interval
Type	Duration
Example	30m

Node inventory privilege

The privileged attribute within the node block of the YAML file determines whether the node component of the Flexera Kubernetes inventory agent can collect complete hardware information from worker nodes, in particular data from the BIOS. To allow this, the containers deployed as part of the node component of the Flexera Kubernetes inventory agent must have the privileged attribute set in their security context.

• When true (the default) or unspecified, normal operations are enabled.
• When the setting is false, the node component containers do not have the privileged attribute, and therefore are unable to report the corresponding data.

Attribute	spec.node.privileged
Type	Boolean
Example	true

Force control nodes

In Kubernetes, the node-role.kubernetes.io/master taint can be used to repel pods from being scheduled on the control-plane nodes.

• If forceControlPlane is true, the node component pods are created with a corresponding toleration to force them to be scheduled onto the control-plane nodes as well as the worker nodes.
• If this value is false (the default) or unspecified, the toleration is not applied to the node component pods. Inventory is then collected only from worker nodes.

Attribute	spec.node.forceControlPlane
Type	Boolean
Example	true

Node connection retries

These attributes rarely need to be set. Together, they specify the behavior of the node component while it is waiting for the monitor component to start:

1. When it starts, a node component pod attempts to connect to the monitor component.
2. If the connection fails, it will wait for readyWait seconds and then retry the connection.
3. It repeats the attempts until, after readyRetries attempts, it gives up, and the pod fails.
4. The node component DaemonSet automatically restarts the pod.

Attribute	spec.node.readyWait
Type	Duration
Example	10s

Attribute	spec.node.readyRetries
Type	Integer
Example	20

Node upload failure

This attribute rarely needs to be set. The default is false, in which case a failure of an inventory upload leave its pod running, and it can re-attempt the inventory upload later. If it is set to true, any inventory upload attempt that fails causes the node component pod to fail.

Attribute	spec.node.mustUpload
Type	Boolean
Example	true