Skip to content

Commit 24a43fb

Browse files
openshift-merge-robotopenshift-merge-robot
authored
Merge pull request #1241 from bison/disable-grafana
operator: Allow disabling Grafana deployment
2 parents a1ce745 + 91de7fb commit 24a43fb

15 files changed

+470
-89
lines changed

Diff for: ‎CHANGELOG.md

+4
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,9 @@
11
# Note: This CHANGELOG is only for the monitoring team to track all monitoring related changes. Please see OpenShift release notes for official changes.
22

3+
## 4.9
4+
5+
- [#1241](https://github.com/openshift/cluster-monitoring-operator/pull/1241) Add config option to disable Grafana deployment.
6+
37
## 4.8
48

59
- [#1087](https://github.com/openshift/cluster-monitoring-operator/pull/1087) Decrease alert severity to "warning" for ThanosQueryHttpRequestQueryErrorRateHigh and ThanosQueryHttpRequestQueryRangeErrorRateHigh alerts.

Diff for: ‎assets/prometheus-k8s/prometheus.yaml

-4
Original file line numberDiff line numberDiff line change
@@ -45,7 +45,6 @@ spec:
4545
- -http-address=
4646
- -email-domain=*
4747
- -upstream=http://localhost:9090
48-
- -htpasswd-file=/etc/proxy/htpasswd/auth
4948
- -openshift-service-account=prometheus-k8s
5049
- '-openshift-sar={"resource": "namespaces", "verb": "get"}'
5150
- '-openshift-delegate-urls={"/": {"resource": "namespaces", "verb": "get"}}'
@@ -77,8 +76,6 @@ spec:
7776
name: secret-prometheus-k8s-tls
7877
- mountPath: /etc/proxy/secrets
7978
name: secret-prometheus-k8s-proxy
80-
- mountPath: /etc/proxy/htpasswd
81-
name: secret-prometheus-k8s-htpasswd
8279
- args:
8380
- --secure-listen-address=0.0.0.0:9092
8481
- --upstream=http://127.0.0.1:9095
@@ -199,7 +196,6 @@ spec:
199196
- kube-etcd-client-certs
200197
- prometheus-k8s-tls
201198
- prometheus-k8s-proxy
202-
- prometheus-k8s-htpasswd
203199
- prometheus-k8s-thanos-sidecar-tls
204200
- kube-rbac-proxy
205201
securityContext:

Diff for: ‎assets/thanos-querier/deployment.yaml

-6
Original file line numberDiff line numberDiff line change
@@ -94,7 +94,6 @@ spec:
9494
- -http-address=
9595
- -email-domain=*
9696
- -upstream=http://localhost:9090
97-
- -htpasswd-file=/etc/proxy/htpasswd/auth
9897
- -openshift-service-account=thanos-querier
9998
- '-openshift-sar={"resource": "namespaces", "verb": "get"}'
10099
- '-openshift-delegate-urls={"/": {"resource": "namespaces", "verb": "get"}}'
@@ -126,8 +125,6 @@ spec:
126125
name: secret-thanos-querier-tls
127126
- mountPath: /etc/proxy/secrets
128127
name: secret-thanos-querier-oauth-cookie
129-
- mountPath: /etc/proxy/htpasswd
130-
name: secret-thanos-querier-oauth-htpasswd
131128
- args:
132129
- --secure-listen-address=0.0.0.0:9092
133130
- --upstream=http://127.0.0.1:9095
@@ -199,9 +196,6 @@ spec:
199196
- name: secret-thanos-querier-oauth-cookie
200197
secret:
201198
secretName: thanos-querier-oauth-cookie
202-
- name: secret-thanos-querier-oauth-htpasswd
203-
secret:
204-
secretName: thanos-querier-oauth-htpasswd
205199
- name: secret-thanos-querier-kube-rbac-proxy
206200
secret:
207201
secretName: thanos-querier-kube-rbac-proxy

Diff for: ‎jsonnet/prometheus.libsonnet

+16-6
Original file line numberDiff line numberDiff line change
@@ -272,6 +272,13 @@ function(params)
272272
// These patches inject the oauth proxy as a sidecar and configures it with
273273
// TLS. Additionally as the Alertmanager is protected with TLS, authN and
274274
// authZ it requires some additonal configuration.
275+
//
276+
// Note that Grafana is enabled by default, but may be explicitly disabled
277+
// by the user. We need to inject an htpasswd file for the oauth-proxy when
278+
// it is enabled, so by default the operator also adds a few things at
279+
// runtime: a volume and volume-mount for the secret, and an argument to the
280+
// proxy container pointing to the mounted htpasswd file. If Grafana is
281+
// disabled, these things are not injected.
275282
prometheus+: {
276283
spec+: {
277284
alerting+: {
@@ -301,10 +308,11 @@ function(params)
301308
runAsUser: 65534,
302309
},
303310
secrets+: [
311+
// NOTE: The following is injected at runtime if Grafana is enabled:
312+
// 'prometheus-k8s-htpasswd'
304313
'kube-etcd-client-certs', //TODO(paulfantom): move it to etcd addon
305314
'prometheus-k8s-tls',
306315
'prometheus-k8s-proxy',
307-
'prometheus-k8s-htpasswd',
308316
'prometheus-k8s-thanos-sidecar-tls',
309317
'kube-rbac-proxy',
310318
],
@@ -348,12 +356,13 @@ function(params)
348356
},
349357
],
350358
args: [
359+
// NOTE: The following is injected at runtime if Grafana is enabled:
360+
// '-htpasswd-file=/etc/proxy/htpasswd/auth'
351361
'-provider=openshift',
352362
'-https-address=:9091',
353363
'-http-address=',
354364
'-email-domain=*',
355365
'-upstream=http://localhost:9090',
356-
'-htpasswd-file=/etc/proxy/htpasswd/auth',
357366
'-openshift-service-account=prometheus-k8s',
358367
'-openshift-sar={"resource": "namespaces", "verb": "get"}',
359368
'-openshift-delegate-urls={"/": {"resource": "namespaces", "verb": "get"}}',
@@ -366,6 +375,11 @@ function(params)
366375
],
367376
terminationMessagePolicy: 'FallbackToLogsOnError',
368377
volumeMounts: [
378+
// NOTE: The following is injected at runtime if Grafana is enabled:
379+
// {
380+
// mountPath: '/etc/proxy/htpasswd',
381+
// name: 'secret-prometheus-k8s-htpasswd',
382+
// },
369383
{
370384
mountPath: '/etc/tls/private',
371385
name: 'secret-prometheus-k8s-tls',
@@ -374,10 +388,6 @@ function(params)
374388
mountPath: '/etc/proxy/secrets',
375389
name: 'secret-prometheus-k8s-proxy',
376390
},
377-
{
378-
mountPath: '/etc/proxy/htpasswd',
379-
name: 'secret-prometheus-k8s-htpasswd',
380-
},
381391
],
382392
},
383393
{

Diff for: ‎jsonnet/thanos-querier.libsonnet

+20-11
Original file line numberDiff line numberDiff line change
@@ -265,6 +265,12 @@ function(params)
265265
},
266266
},
267267

268+
// Note that Grafana is enabled by default, but may be explicitly disabled
269+
// by the user. We need to inject an htpasswd file for the oauth-proxy when
270+
// it is enabled, so by default the operator also adds a few things at
271+
// runtime: a volume and volume-mount for the secret, and an argument to the
272+
// proxy container pointing to the mounted htpasswd file. If Grafana is
273+
// disabled, these things are not injected.
268274
deployment+: {
269275
spec+: {
270276
strategy+: {
@@ -291,6 +297,13 @@ function(params)
291297
},
292298
},
293299
volumes+: [
300+
// NOTE: If Grafana is enabled, the following is injected at runtime:
301+
// {
302+
// name: 'secret-thanos-querier-oauth-htpasswd',
303+
// secret: {
304+
// secretName: 'thanos-querier-oauth-htpasswd',
305+
// },
306+
// },
294307
{
295308
name: 'secret-thanos-querier-tls',
296309
secret: {
@@ -303,12 +316,6 @@ function(params)
303316
secretName: 'thanos-querier-oauth-cookie',
304317
},
305318
},
306-
{
307-
name: 'secret-thanos-querier-oauth-htpasswd',
308-
secret: {
309-
secretName: 'thanos-querier-oauth-htpasswd',
310-
},
311-
},
312319
{
313320
name: 'secret-thanos-querier-kube-rbac-proxy',
314321
secret: {
@@ -394,12 +401,13 @@ function(params)
394401
{ name: 'NO_PROXY', value: '' },
395402
],
396403
args: [
404+
// NOTE: The following is injected at runtime if Grafana is enabled:
405+
// '-htpasswd-file=/etc/proxy/htpasswd/auth'
397406
'-provider=openshift',
398407
'-https-address=:9091',
399408
'-http-address=',
400409
'-email-domain=*',
401410
'-upstream=http://localhost:9090',
402-
'-htpasswd-file=/etc/proxy/htpasswd/auth',
403411
'-openshift-service-account=thanos-querier',
404412
'-openshift-sar={"resource": "namespaces", "verb": "get"}',
405413
'-openshift-delegate-urls={"/": {"resource": "namespaces", "verb": "get"}}',
@@ -412,6 +420,11 @@ function(params)
412420
],
413421
terminationMessagePolicy: 'FallbackToLogsOnError',
414422
volumeMounts: [
423+
// NOTE: The following is injected at runtime if Grafana is enabled:
424+
// {
425+
// mountPath: '/etc/proxy/htpasswd',
426+
// name: 'secret-thanos-querier-oauth-htpasswd',
427+
// },
415428
{
416429
mountPath: '/etc/tls/private',
417430
name: 'secret-thanos-querier-tls',
@@ -420,10 +433,6 @@ function(params)
420433
mountPath: '/etc/proxy/secrets',
421434
name: 'secret-thanos-querier-oauth-cookie',
422435
},
423-
{
424-
mountPath: '/etc/proxy/htpasswd',
425-
name: 'secret-thanos-querier-oauth-htpasswd',
426-
},
427436
],
428437
},
429438
{

Diff for: ‎pkg/client/client.go

+10
Original file line numberDiff line numberDiff line change
@@ -1024,6 +1024,16 @@ func (c *Client) CreateOrUpdateConfigMapList(cml *v1.ConfigMapList) error {
10241024
return nil
10251025
}
10261026

1027+
func (c *Client) DeleteConfigMapList(cml *v1.ConfigMapList) error {
1028+
for _, cm := range cml.Items {
1029+
err := c.DeleteConfigMap(&cm)
1030+
if err != nil {
1031+
return err
1032+
}
1033+
}
1034+
return nil
1035+
}
1036+
10271037
func (c *Client) CreateOrUpdateConfigMap(cm *v1.ConfigMap) error {
10281038
cmClient := c.kclient.CoreV1().ConfigMaps(cm.GetNamespace())
10291039
existing, err := cmClient.Get(context.TODO(), cm.GetName(), metav1.GetOptions{})

Diff for: ‎pkg/manifests/config.go

+11
Original file line numberDiff line numberDiff line change
@@ -151,10 +151,21 @@ type ThanosQuerierConfig struct {
151151
}
152152

153153
type GrafanaConfig struct {
154+
Enabled *bool `json:"enabled"`
154155
NodeSelector map[string]string `json:"nodeSelector"`
155156
Tolerations []v1.Toleration `json:"tolerations"`
156157
}
157158

159+
// IsEnabled returns the underlying value of the `Enabled` boolean pointer. It
160+
// defaults to TRUE if the pointer is nil because Grafana should be enabled by
161+
// default.
162+
func (g *GrafanaConfig) IsEnabled() bool {
163+
if g.Enabled == nil {
164+
return true
165+
}
166+
return *g.Enabled
167+
}
168+
158169
type KubeStateMetricsConfig struct {
159170
NodeSelector map[string]string `json:"nodeSelector"`
160171
Tolerations []v1.Toleration `json:"tolerations"`

Diff for: ‎pkg/manifests/config_test.go

+43
Original file line numberDiff line numberDiff line change
@@ -234,3 +234,46 @@ func TestHttpProxyConfig(t *testing.T) {
234234
}
235235
}
236236
}
237+
238+
func TestGrafanaDefaultsToEnabled(t *testing.T) {
239+
for _, tt := range []struct {
240+
name string
241+
config string
242+
expectEnabled bool
243+
}{
244+
{
245+
name: "empty config",
246+
config: "",
247+
expectEnabled: true,
248+
},
249+
{
250+
name: "empty grafana config",
251+
config: `{"grafana":{}}`,
252+
expectEnabled: true,
253+
},
254+
{
255+
name: "grafana explicitly enabled",
256+
config: `{"grafana":{"enabled": true}}`,
257+
expectEnabled: true,
258+
},
259+
{
260+
name: "grafana disabled",
261+
config: `{"grafana":{"enabled": false}}`,
262+
expectEnabled: false,
263+
},
264+
} {
265+
t.Run(tt.name, func(t *testing.T) {
266+
c, err := NewConfigFromString(tt.config)
267+
if err != nil {
268+
t.Fatal(err)
269+
}
270+
271+
enabled := c.ClusterMonitoringConfiguration.GrafanaConfig.IsEnabled()
272+
273+
if enabled != tt.expectEnabled {
274+
t.Fatalf("GrafanaConfig.IsEnabled() returned %t, expected %t",
275+
enabled, tt.expectEnabled)
276+
}
277+
})
278+
}
279+
}

0 commit comments

Comments
 (0)