MON-2212: Expose the /federate endpoint of UWM Prometheus as a service #1601

arajkumar · 2022-03-21T07:48:48Z

Signed-off-by: Arunprasad Rajkumar [email protected]

I added CHANGELOG entry for this change.
No user facing changes, so no entry in CHANGELOG was needed.

arajkumar · 2022-03-21T15:00:06Z

/retest

arajkumar · 2022-03-21T15:08:03Z

/test

openshift-ci · 2022-03-21T15:08:05Z

@arajkumar: The /test command needs one or more targets.
The following commands are available to trigger required jobs:

/test e2e-agnostic
/test e2e-agnostic-operator
/test e2e-agnostic-upgrade
/test generate
/test go-fmt
/test images
/test jsonnet-fmt
/test rules
/test shellcheck
/test unit
/test vendor
/test verify

The following commands are available to trigger optional jobs:

/test e2e-aws-single-node
/test versions

Use /test all to run all jobs.

In response to this:

/test

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

arajkumar · 2022-03-21T15:08:16Z

/test all

arajkumar · 2022-03-22T07:57:09Z

/test all

arajkumar · 2022-03-22T07:58:12Z

/retest

arajkumar · 2022-03-23T08:00:42Z

Procedure to test

Launch a OCP cluster
Enable UWM and deploy an example app

oc apply -f https://gist.githubusercontent.com/arajkumar/7b3eaa8c21e6d74e8e0d7eaa7962af75/raw/8ff9dc4be8567183437e02170a245a1ee7a774ec/ocp-uwm.yaml

Bind cluster-monitoring-view RBAC to any service account or user to access /federate endpoint

oc apply -f https://gist.githubusercontent.com/arajkumar/605abfe388336b549b1555e82a6ba3f8/raw/56418ba20ee197b026048d0b887aeb77730c1279/federate-rbac.yaml

Access /federate endpoint

# get token
export TOKEN=$(oc sa get-token default -n ns1)

# port-forward
oc -n openshift-user-workload-monitoring port-forward service/prometheus-user-workload 9092:9092

curl -G -v -s -k -H "Authorization: Bearer ${TOKEN}" https://localhost:9092/federate --data-urlencode 'match[]=up'

arajkumar · 2022-03-23T11:26:03Z

/retest
/skip

arajkumar · 2022-03-24T07:36:49Z

/retest
/skip

Ping @juzhao for qe approval.
Ping @sferich888 for px approval.

raptorsun · 2022-03-28T13:21:32Z

Is it possible to share the same port & kube-rbac-proxy for metric and federate endpoints?
A suggestion:

We change the --allow-path argument to --allow-path=/metrics,federate
We include both RBAC settings in the config for kube-rbact-proxy as

"authorization":
  "resourceAttributes":
    "apiVersion": "v1"
    "resource": "namespaces"
    "verb": "get"
  "static":
    - "path": "/metrics"
      "resourceRequest": false
      "user":
        "name": "system:serviceaccount:openshift-monitoring:prometheus-k8s"
      "verb": "get"

arajkumar · 2022-03-30T07:42:07Z

Is it possible to share the same port & kube-rbac-proxy for metric and federate endpoints?

I don't think this would be good choice as the nature of access will be totally different. /metrics endpoint is meant for internal usage but /federate called from outside the cluster by providing oauth token.

@simonpasquier @jan--f need you input on this. Thanks.

jan--f · 2022-03-30T12:27:19Z

Is it possible to share the same port & kube-rbac-proxy for metric and federate endpoints?

I don't think this would be good choice as the nature of access will be totally different. /metrics endpoint is meant for internal usage but /federate called from outside the cluster by providing oauth token.

@simonpasquier @jan--f need you input on this. Thanks.

Yes I agree with you @arajkumar. No user should be interested in the metrics the UWM prometheus exports.

jan--f

/lgtm

jan--f · 2022-03-31T09:47:34Z

pkg/manifests/manifests.go

+		switch container.Name {
+		case "kube-rbac-proxy-metrics", "kube-rbac-proxy-federate", "kube-rbac-proxy-thanos":


juzhao · 2022-04-02T06:11:32Z

@lihongyan1 please help to review

Signed-off-by: Arunprasad Rajkumar <[email protected]>

arajkumar · 2022-04-06T05:41:22Z

Ping @Senthamilarasu-STA (for px-approval)

Senthamilarasu-STA · 2022-04-06T07:24:57Z

/label px-approved

openshift-ci · 2022-04-06T07:41:46Z

@arajkumar: all tests passed!

Full PR test history. Your PR dashboard.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

lihongyan1 · 2022-04-07T03:24:44Z

/label qe-approved

jan--f · 2022-04-07T11:15:07Z

/lgtm

openshift-ci · 2022-04-07T11:15:42Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: arajkumar, jan--f

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

~~OWNERS~~ [arajkumar,jan--f]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

Successor of openshift#1601 to expose UWM federate service as a Openshift Route. Signed-off-by: Arunprasad Rajkumar <[email protected]>

Successor of openshift#1601 to expose UWM federate service as a Openshift Route. Signed-off-by: Arunprasad Rajkumar <[email protected]> (cherry picked from commit b647559)

openshift-ci bot requested review from raptorsun and slashpai March 21, 2022 07:49

openshift-ci bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Mar 21, 2022

arajkumar force-pushed the expose-uwm-federate-endpoint branch from e245913 to 3edadfd Compare March 21, 2022 07:49

arajkumar marked this pull request as draft March 21, 2022 12:55

openshift-ci bot added the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Mar 21, 2022

arajkumar force-pushed the expose-uwm-federate-endpoint branch from 3edadfd to 06fff51 Compare March 21, 2022 14:59

arajkumar force-pushed the expose-uwm-federate-endpoint branch from 06fff51 to 3dbee1d Compare March 22, 2022 07:57

arajkumar force-pushed the expose-uwm-federate-endpoint branch from 3dbee1d to e190bbe Compare March 23, 2022 07:49

arajkumar marked this pull request as ready for review March 23, 2022 07:50

openshift-ci bot removed the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Mar 23, 2022

openshift-ci bot requested a review from bison March 23, 2022 07:53

arajkumar force-pushed the expose-uwm-federate-endpoint branch 2 times, most recently from 68b95f4 to a7bd931 Compare March 28, 2022 13:00

arajkumar force-pushed the expose-uwm-federate-endpoint branch from a7bd931 to f380a2a Compare March 31, 2022 07:38

jan--f approved these changes Mar 31, 2022

View reviewed changes

openshift-ci bot assigned jan--f Mar 31, 2022

openshift-ci bot added the lgtm Indicates that a PR is ready to be merged. label Mar 31, 2022

openshift-ci bot added the docs-approved Signifies that Docs has signed off on this PR label Mar 31, 2022

openshift-ci bot added the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Apr 2, 2022

arajkumar added 2 commits April 6, 2022 11:08

MON-2212: Expose the /federate endpoint of UWM Prometheus as a service

7051f4b

Signed-off-by: Arunprasad Rajkumar <[email protected]>

test: Add e2e tests for UWM federate service

f1863aa

Signed-off-by: Arunprasad Rajkumar <[email protected]>

arajkumar force-pushed the expose-uwm-federate-endpoint branch from f380a2a to f1863aa Compare April 6, 2022 05:39

openshift-ci bot removed lgtm Indicates that a PR is ready to be merged. needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. labels Apr 6, 2022

openshift-ci bot added the px-approved Signifies that Product Support has signed off on this PR label Apr 6, 2022

openshift-ci bot added the qe-approved Signifies that QE has signed off on this PR label Apr 7, 2022

openshift-ci bot added the lgtm Indicates that a PR is ready to be merged. label Apr 7, 2022

openshift-merge-robot merged commit d7ba4ed into openshift:master Apr 7, 2022

arajkumar mentioned this pull request Apr 12, 2022

MON-2213: Expose the /federate endpoint of UWM Prometheus as a route #1633

Merged

2 tasks

arajkumar mentioned this pull request May 4, 2022

Bug 2090602: Federation for UWM metrics #1657

Merged

2 tasks

		switch container.Name {
		case "kube-rbac-proxy-metrics", "kube-rbac-proxy-federate", "kube-rbac-proxy-thanos":

MON-2212: Expose the /federate endpoint of UWM Prometheus as a service #1601

MON-2212: Expose the /federate endpoint of UWM Prometheus as a service #1601

Uh oh!

Conversation

arajkumar commented Mar 21, 2022

Uh oh!

arajkumar commented Mar 21, 2022

Uh oh!

arajkumar commented Mar 21, 2022

Uh oh!

openshift-ci bot commented Mar 21, 2022

Uh oh!

arajkumar commented Mar 21, 2022

Uh oh!

arajkumar commented Mar 22, 2022

Uh oh!

arajkumar commented Mar 22, 2022

Uh oh!

arajkumar commented Mar 23, 2022 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Procedure to test

Uh oh!

arajkumar commented Mar 23, 2022

Uh oh!

arajkumar commented Mar 24, 2022

Uh oh!

raptorsun commented Mar 28, 2022

Uh oh!

arajkumar commented Mar 30, 2022

Uh oh!

jan--f commented Mar 30, 2022

Uh oh!

jan--f left a comment

Choose a reason for hiding this comment

Uh oh!

jan--f Mar 31, 2022

Choose a reason for hiding this comment

Uh oh!

juzhao commented Apr 2, 2022

Uh oh!

arajkumar commented Apr 6, 2022

Uh oh!

Senthamilarasu-STA commented Apr 6, 2022

Uh oh!

openshift-ci bot commented Apr 6, 2022

Uh oh!

lihongyan1 commented Apr 7, 2022

Uh oh!

jan--f commented Apr 7, 2022

Uh oh!

openshift-ci bot commented Apr 7, 2022

Uh oh!

Uh oh!

arajkumar commented Mar 23, 2022 •

edited

Loading