Ensure agent tries to download config after failure. Update OpenShift manifests

Author: poupas

contrib/openshift/README.md

@@ -0,0 +1,31 @@
+# Installing the Agent on an OpenShift Cluster
+
+1. Go to the [Scanning Agents](https://plus.probely.app/scanning-agents/) page.
+   Create an agent and take note of the **agent token**.
+2. Create the `probely` namespace
+   ```shell
+   oc create namespace probely
+   ```
+3. Create the `agent token` secret
+   ```shell
+   oc -n probely create secret generic farcaster-secrets \
+     --from-literal=token=<YOUR_AGENT_TOKEN>
+   ```
+4. Deploy the agent pod
+   ```shell
+   oc apply -f https://raw.githubusercontent.com/Probely/farcaster-onprem-agent/main/contrib/openshift/probely-agent-depl.yaml
+   ```
+5. Check that the agent is working properly
+   ```shell
+   oc -n probely logs -f farcaster-agent-<id>
+   ```
+   You should see output similar to:
+   ```
+   Starting local DNS resolver     ... done
+   Setting HTTP proxy rules        ... done
+   Connecting to Probely           ... done
+   Setting local gateway rules     ... done
+   Starting WireGuard gateway      ... done
+
+   Running...
+   ```

contrib/openshift/probely-agent-depl.yaml

@@ -2,6 +2,7 @@ apiVersion: apps/v1
 kind: Deployment
 metadata:
     name: farcaster-agent
+    namespace: probely
 spec:
   replicas: 1
   selector:
@@ -14,30 +15,26 @@ spec:
     spec:
       containers:
       - name: agent
-        privileged: true
         image: probely/farcaster-onprem-agent:v3
         imagePullPolicy: Always
+        env:
+        - name: FARCASTER_AGENT_TOKEN
+          valueFrom:
+            secretKeyRef:
+              name: farcaster-secrets
+              key: token
         resources:
           requests:
-            cpu: 250m
-            memory: 128Mi
+            cpu: "1"
+            memory: "128Mi"
         securityContext:
-          capabilities:
-            add:
-            - NET_ADMIN
+            allowPrivilegeEscalation: false
         volumeMounts:
-        - name: farcaster-secrets
-          mountPath: /secrets/farcaster/data
-          readOnly: true
-        - name: host-tun-dev
-          mountPath: /dev/net/tun
+        - name: run-tmpfs
+          mountPath: /run
       volumes:
-      - name: farcaster-secrets
-        projected:
-          sources:
-          - secret:
-              name: farcaster-tunnel-secrets
-          - secret:
-              name: farcaster-gateway-secrets
+      - name: run-tmpfs
+        emptyDir:
+          medium: Memory
       terminationGracePeriodSeconds: 3
   minReadySeconds: 2

contrib/openshift/probely-agent-scc.yaml

@@ -393,6 +393,8 @@ func (a *Agent) ConnectWait(maxTries int) error {
 			a.gwDev = nil
 			a.log.Debug("Gateway WireGuard device closed")
 		}
+
+		a.cfg = nil
 	}
 
 	forceTCP, _ := strconv.ParseBool(os.Getenv("FARCASTER_FORCE_TCP"))