jsonnet,test: enable /api/v1/series on Thanos tenancy port

Author: simonpasquier

CHANGELOG.md

@@ -3,7 +3,8 @@
 ## 4.10
 
 - [#1509](https://github.com/openshift/cluster-monitoring-operator/pull/1509) add NLB usage metrics for network edge
-- [#1299](https://github.com/openshift/cluster-monitoring-operator/pull/1299) Expose expose /api/v1/labels endpoint for Thanos query.
+- [#1299](https://github.com/openshift/cluster-monitoring-operator/pull/1299) Expose /api/v1/labels and /api/v1/labels/*/values endpoint on the Thanos query tenancy port.
+- [#1529](https://github.com/openshift/cluster-monitoring-operator/pull/1299) Expose /api/v1/series endpoint on the Thanos query tenancy port.
 - [#1402](https://github.com/openshift/cluster-monitoring-operator/pull/1402) Drop pod-centric cAdvisor metrics that are available at slice level.
 - [#1399](https://github.com/openshift/cluster-monitoring-operator/pull/1399) Rename ThanosSidecarUnhealthy to ThanosSidecarNoConnectionToStartedPrometheus and make it resilient to WAL replays.
 - [#1446](https://github.com/openshift/cluster-monitoring-operator/pull/1446) Bump Grafana version to 7.5.11

jsonnet/components/thanos-querier.libsonnet

@@ -504,7 +504,13 @@ function(params)
                   '--tls-private-key-file=/etc/tls/private/tls.key',
                   '--tls-cipher-suites=' + cfg.tlsCipherSuites,
                   '--logtostderr=true',
-                  '--allow-paths=/api/v1/query,/api/v1/query_range,/api/v1/labels,/api/v1/label/*/values',
+                  '--allow-paths=' + std.join(',', [
+                    '/api/v1/query',
+                    '/api/v1/query_range',
+                    '/api/v1/labels',
+                    '/api/v1/label/*/values',
+                    '/api/v1/series',
+                  ]),
                 ],
                 terminationMessagePolicy: 'FallbackToLogsOnError',
                 volumeMounts: [

test/e2e/framework/client.go

@@ -216,7 +216,7 @@ func (c *PrometheusClient) PrometheusRules() ([]byte, error) {
 	return body, nil
 }
 
-// PrometheusRules runs an HTTP GET request against the Prometheus label API and returns
+// PrometheusLabel runs an HTTP GET request against the Prometheus label API and returns
 // the response body.
 func (c *PrometheusClient) PrometheusLabel(label string) ([]byte, error) {
 	resp, err := c.Do("GET", fmt.Sprintf("/api/v1/label/%s/values", url.QueryEscape(label)), nil)

test/e2e/user_workload_monitoring_test.go

@@ -20,6 +20,7 @@ import (
 	"io/ioutil"
 	"net"
 	"net/http"
+	"net/url"
 	"reflect"
 	"strings"
 	"testing"
@@ -88,8 +89,8 @@ func TestUserWorkloadMonitoringMetrics(t *testing.T) {
 			f:    assertTenancyForMetrics,
 		},
 		{
-			name: "assert tenancy model is enforced for labels",
-			f:    assertTenancyForLabels,
+			name: "assert tenancy model is enforced for series metadata",
+			f:    assertTenancyForSeriesMetadata,
 		},
 		{
 			name: "assert prometheus is not deployed in user namespace",
@@ -891,7 +892,7 @@ func assertTenancyForRules(t *testing.T) {
 	}
 }
 
-func assertTenancyForLabels(t *testing.T) {
+func assertTenancyForSeriesMetadata(t *testing.T) {
 	const testAccount = "test-labels"
 
 	err := framework.Poll(2*time.Second, 10*time.Second, func() error {
@@ -974,7 +975,61 @@ func assertTenancyForLabels(t *testing.T) {
 		t.Fatalf("failed to query labels from Thanos querier: %v", err)
 	}
 
-	// Check that /api/v1/label/namespace/values returns a single value.
+	// Check the /api/v1/series endpoint.
+	err = framework.Poll(5*time.Second, time.Minute, func() error {
+		// The tenancy port (9092) is only exposed in-cluster so we need to use
+		// port forwarding to access kube-rbac-proxy.
+		host, cleanUp, err := f.ForwardPort(t, "thanos-querier", 9092)
+		if err != nil {
+			return err
+		}
+		defer cleanUp()
+
+		client := framework.NewPrometheusClient(
+			host,
+			token,
+			&framework.QueryParameterInjector{
+				Name:  "namespace",
+				Value: userWorkloadTestNs,
+			},
+		)
+
+		resp, err := client.Do("GET", "/api/v1/series?"+url.QueryEscape("match[]=up"), nil)
+		if err != nil {
+			return err
+		}
+		defer resp.Body.Close()
+
+		b, err := ioutil.ReadAll(resp.Body)
+		if err != nil {
+			return err
+		}
+
+		if resp.StatusCode != http.StatusOK {
+			return fmt.Errorf("unexpected status code response, want %d, got %d (%s)", http.StatusOK, resp.StatusCode, framework.ClampMax(b))
+		}
+
+		res, err := gabs.ParseJSON(b)
+		if err != nil {
+			return err
+		}
+
+		series, err := res.Path("data").Children()
+		if err != nil {
+			return err
+		}
+
+		if len(series) != 1 {
+			return errors.Errorf("expecting a series list with one item, got %d (%s)", len(series), framework.ClampMax(b))
+		}
+
+		return nil
+	})
+	if err != nil {
+		t.Fatalf("failed to query series from Thanos querier: %v", err)
+	}
+
+	// Check that /api/v1/label/{namespace}/values returns a single value.
 	err = framework.Poll(5*time.Second, time.Minute, func() error {
 		// The tenancy port (9092) is only exposed in-cluster so we need to use
 		// port forwarding to access kube-rbac-proxy.