pkg/manifests: Add EnforcedTargetLimit for user-workload monitoring

This adds support for configuring the EnforcedTargetLimit for the
user-workload Prometheus instance.  This lets admins set an overall
limit on the number of targets scraped.

Author: bison

CHANGELOG.md

@@ -3,6 +3,7 @@
 ## 4.9
 
 - [#1241](https://github.com/openshift/cluster-monitoring-operator/pull/1241) Add config option to disable Grafana deployment.
+- [#1278](https://github.com/openshift/cluster-monitoring-operator/pull/1278) Add EnforcedTargetLimit option for user-workload Prometheus.
 
 ## 4.8
 

pkg/manifests/config.go

@@ -403,6 +403,7 @@ type PrometheusRestrictedConfig struct {
 	VolumeClaimTemplate *monv1.EmbeddedPersistentVolumeClaim `json:"volumeClaimTemplate"`
 	RemoteWrite         []monv1.RemoteWriteSpec              `json:"remoteWrite"`
 	EnforcedSampleLimit *uint64                              `json:"enforcedSampleLimit"`
+	EnforcedTargetLimit *uint64                              `json:"enforcedTargetLimit"`
 }
 
 func (u *UserWorkloadConfiguration) applyDefaults() {

pkg/manifests/manifests.go

@@ -1592,6 +1592,10 @@ func (f *Factory) PrometheusUserWorkload(grpcTLS *v1.Secret) (*monv1.Prometheus,
 		p.Spec.EnforcedSampleLimit = f.config.UserWorkloadConfiguration.Prometheus.EnforcedSampleLimit
 	}
 
+	if f.config.UserWorkloadConfiguration.Prometheus.EnforcedTargetLimit != nil {
+		p.Spec.EnforcedTargetLimit = f.config.UserWorkloadConfiguration.Prometheus.EnforcedTargetLimit
+	}
+
 	// end removal
 	if f.config.Images.Thanos != "" {
 		p.Spec.Thanos.Image = &f.config.Images.Thanos

test/e2e/user_workload_monitoring_test.go

@@ -60,6 +60,7 @@ func TestUserWorkloadMonitoring(t *testing.T) {
 		},
 		Data: map[string]string{
 			"config.yaml": `prometheus:
+  enforcedTargetLimit: 10
   volumeClaimTemplate:
     spec:
       resources:
@@ -92,6 +93,7 @@ func TestUserWorkloadMonitoring(t *testing.T) {
 		{"assert tenancy model is enforced for rules", assertTenancyForRules},
 		{"assert prometheus and alertmanager is not deployed in user namespace", assertPrometheusAlertmanagerInUserNamespace},
 		{"assert grpc tls rotation", assertGRPCTLSRotation},
+		{"assert enforced target limit is configured", assertEnforcedTargetLimit(10)},
 		{"enable user workload monitoring, assert prometheus rollout", createUserWorkloadAssets(cm)},
 		{"set VolumeClaimTemplate for prometheus CR, assert that it is created", assertVolumeClaimsConfigAndRollout(rolloutParams{
 			namespace:       f.UserWorkloadMonitoringNs,
@@ -983,3 +985,26 @@ func assertDeletedUserWorkloadAssets(cm *v1.ConfigMap) func(*testing.T) {
 		}
 	}
 }
+
+func assertEnforcedTargetLimit(limit uint64) func(*testing.T) {
+	return func(t *testing.T) {
+		err := framework.Poll(time.Second, 5*time.Minute, func() error {
+			prom, err := f.MonitoringClient.Prometheuses(f.UserWorkloadMonitoringNs).Get(f.Ctx, "user-workload", metav1.GetOptions{})
+			if err != nil {
+				return err
+			}
+
+			if prom.Spec.EnforcedTargetLimit == nil {
+				return errors.New("EnforcedTargetLimit not set")
+			} else if *prom.Spec.EnforcedTargetLimit != limit {
+				return fmt.Errorf("expected EnforcedTargetLimit to be %d, but got %d", limit, *prom.Spec.EnforcedTargetLimit)
+			}
+
+			return nil
+		})
+
+		if err != nil {
+			t.Fatalf("Timed out waiting for EnforcedTargetLimit configuration: %v", err)
+		}
+	}
+}