Skip to content

Commit e2338dc

Browse files
openshift-merge-robotopenshift-merge-robot
authored
Merge pull request #551 from stevekuznetsov/skuznets/psm-gomemlimit
OCPBUGS-17157: manifests: add $GOMEMLIMIT to PSM
2 parents 417a2be + 592327a commit e2338dc

8 files changed

+200
-4
lines changed

‎cmd/package-server-manager/main.go

+5-1
Original file line numberDiff line numberDiff line change
@@ -67,6 +67,10 @@ func run(cmd *cobra.Command, args []string) error {
6767
if err != nil {
6868
return err
6969
}
70+
metricsAddr, err := cmd.Flags().GetString("metrics")
71+
if err != nil {
72+
return err
73+
}
7074

7175
ctrl.SetLogger(zap.New(zap.UseDevMode(true)))
7276
setupLog := ctrl.Log.WithName("setup")
@@ -78,7 +82,7 @@ func run(cmd *cobra.Command, args []string) error {
7882
mgr, err := ctrl.NewManager(restConfig, manager.Options{
7983
Scheme: setupScheme(),
8084
Namespace: namespace,
81-
MetricsBindAddress: defaultMetricsPort,
85+
MetricsBindAddress: metricsAddr,
8286
LeaderElection: !disableLeaderElection,
8387
LeaderElectionNamespace: namespace,
8488
LeaderElectionID: leaderElectionConfigmapName,

‎cmd/package-server-manager/start.go

+1
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,7 @@ func newStartCmd() *cobra.Command {
1717
cmd.Flags().String("health", defaultHealthCheckPort, "configures the health check port that the kubelet is configured to probe")
1818
cmd.Flags().String("pprof", defaultPprofPort, "configures the pprof port that the process exposes")
1919
cmd.Flags().String("interval", defaultInterval, "configures the wakeup interval for the packageserver csc resource")
20+
cmd.Flags().String("metrics", defaultMetricsPort, "configures the metrics port that the process exposes")
2021
cmd.Flags().Bool("disable-leader-election", false, "configures whether leader election will be disabled")
2122

2223
return cmd

‎manifests/0000_50_olm_06-psm-operator.deployment.ibm-cloud-managed.yaml

+34-1
Original file line numberDiff line numberDiff line change
@@ -28,6 +28,32 @@ spec:
2828
serviceAccountName: olm-operator-serviceaccount
2929
priorityClassName: "system-cluster-critical"
3030
containers:
31+
- args:
32+
- --secure-listen-address=0.0.0.0:8443
33+
- --upstream=http://127.0.0.1:9090/
34+
- --tls-cert-file=/etc/tls/private/tls.crt
35+
- --tls-private-key-file=/etc/tls/private/tls.key
36+
- --logtostderr=true
37+
image: quay.io/openshift/origin-kube-rbac-proxy:latest
38+
imagePullPolicy: IfNotPresent
39+
name: kube-rbac-proxy
40+
securityContext:
41+
allowPrivilegeEscalation: false
42+
capabilities:
43+
drop: ["ALL"]
44+
ports:
45+
- containerPort: 8443
46+
name: metrics
47+
protocol: TCP
48+
resources:
49+
requests:
50+
memory: 20Mi
51+
cpu: 10m
52+
terminationMessagePath: /dev/termination-log
53+
terminationMessagePolicy: File
54+
volumeMounts:
55+
- mountPath: /etc/tls/private
56+
name: package-server-manager-serving-cert
3157
- name: package-server-manager
3258
securityContext:
3359
allowPrivilegeEscalation: false
@@ -43,6 +69,7 @@ spec:
4369
- $(PACKAGESERVER_NAMESPACE)
4470
- --interval
4571
- $(PACKAGESERVER_INTERVAL)
72+
- "--metrics=:9090"
4673
image: quay.io/operator-framework/olm@sha256:de396b540b82219812061d0d753440d5655250c621c753ed1dc67d6154741607
4774
imagePullPolicy: IfNotPresent
4875
env:
@@ -58,10 +85,12 @@ spec:
5885
value: 5m
5986
- name: RELEASE_VERSION
6087
value: "0.0.1-snapshot"
88+
- name: GOMEMLIMIT
89+
value: "5MiB"
6190
resources:
6291
requests:
6392
cpu: 10m
64-
memory: 50Mi
93+
memory: 10Mi
6594
livenessProbe:
6695
httpGet:
6796
path: /healthz
@@ -87,3 +116,7 @@ spec:
87116
key: node.kubernetes.io/not-ready
88117
operator: Exists
89118
tolerationSeconds: 120
119+
volumes:
120+
- name: package-server-manager-serving-cert
121+
secret:
122+
secretName: package-server-manager-serving-cert

‎manifests/0000_50_olm_06-psm-operator.deployment.yaml

+34-1
Original file line numberDiff line numberDiff line change
@@ -28,6 +28,32 @@ spec:
2828
serviceAccountName: olm-operator-serviceaccount
2929
priorityClassName: "system-cluster-critical"
3030
containers:
31+
- args:
32+
- --secure-listen-address=0.0.0.0:8443
33+
- --upstream=http://127.0.0.1:9090/
34+
- --tls-cert-file=/etc/tls/private/tls.crt
35+
- --tls-private-key-file=/etc/tls/private/tls.key
36+
- --logtostderr=true
37+
image: quay.io/openshift/origin-kube-rbac-proxy:latest
38+
imagePullPolicy: IfNotPresent
39+
name: kube-rbac-proxy
40+
securityContext:
41+
allowPrivilegeEscalation: false
42+
capabilities:
43+
drop: ["ALL"]
44+
ports:
45+
- containerPort: 8443
46+
name: metrics
47+
protocol: TCP
48+
resources:
49+
requests:
50+
memory: 20Mi
51+
cpu: 10m
52+
terminationMessagePath: /dev/termination-log
53+
terminationMessagePolicy: File
54+
volumeMounts:
55+
- mountPath: /etc/tls/private
56+
name: package-server-manager-serving-cert
3157
- name: package-server-manager
3258
securityContext:
3359
allowPrivilegeEscalation: false
@@ -43,6 +69,7 @@ spec:
4369
- $(PACKAGESERVER_NAMESPACE)
4470
- --interval
4571
- $(PACKAGESERVER_INTERVAL)
72+
- "--metrics=:9090"
4673
image: quay.io/operator-framework/olm@sha256:de396b540b82219812061d0d753440d5655250c621c753ed1dc67d6154741607
4774
imagePullPolicy: IfNotPresent
4875
env:
@@ -58,10 +85,12 @@ spec:
5885
value: 5m
5986
- name: RELEASE_VERSION
6087
value: "0.0.1-snapshot"
88+
- name: GOMEMLIMIT
89+
value: "5MiB"
6190
resources:
6291
requests:
6392
cpu: 10m
64-
memory: 50Mi
93+
memory: 10Mi
6594
livenessProbe:
6695
httpGet:
6796
path: /healthz
@@ -88,3 +117,7 @@ spec:
88117
key: node.kubernetes.io/not-ready
89118
operator: Exists
90119
tolerationSeconds: 120
120+
volumes:
121+
- name: package-server-manager-serving-cert
122+
secret:
123+
secretName: package-server-manager-serving-cert

‎manifests/0000_50_olm_06-psm-operator.service.yaml

+19
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
apiVersion: v1
2+
kind: Service
3+
metadata:
4+
annotations:
5+
include.release.openshift.io/self-managed-high-availability: "true"
6+
service.alpha.openshift.io/serving-cert-secret-name: package-server-manager-serving-cert
7+
include.release.openshift.io/ibm-cloud-managed: "true"
8+
name: package-server-manager-metrics
9+
namespace: openshift-operator-lifecycle-manager
10+
spec:
11+
ports:
12+
- name: metrics
13+
port: 8443
14+
protocol: TCP
15+
targetPort: metrics
16+
selector:
17+
app: package-server-manager
18+
sessionAffinity: None
19+
type: ClusterIP

‎manifests/0000_50_olm_06-psm-operator.servicemonitor.yaml

+21
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
apiVersion: monitoring.coreos.com/v1
2+
kind: ServiceMonitor
3+
metadata:
4+
name: package-server-manager-metrics
5+
namespace: openshift-operator-lifecycle-manager
6+
annotations:
7+
include.release.openshift.io/self-managed-high-availability: "true"
8+
include.release.openshift.io/ibm-cloud-managed: "true"
9+
spec:
10+
endpoints:
11+
- bearerTokenFile: /var/run/secrets/kubernetes.io/serviceaccount/token
12+
interval: 30s
13+
port: metrics
14+
scheme: https
15+
tlsConfig:
16+
caFile: /etc/prometheus/configmaps/serving-certs-ca-bundle/service-ca.crt
17+
serverName: package-server-manager-metrics.openshift-operator-lifecycle-manager.svc
18+
namespaceSelector:
19+
matchNames:
20+
- openshift-operator-lifecycle-manager
21+
selector: {}

‎manifests/image-references

+4
Original file line numberDiff line numberDiff line change
@@ -10,3 +10,7 @@ spec:
1010
from:
1111
kind: DockerImage
1212
name: quay.io/operator-framework/configmap-operator-registry:latest
13+
- name: kube-rbac-proxy
14+
from:
15+
kind: DockerImage
16+
name: quay.io/openshift/origin-kube-rbac-proxy:latest

‎scripts/generate_crds_manifests.sh

+82-1
Original file line numberDiff line numberDiff line change
@@ -106,6 +106,10 @@ spec:
106106
from:
107107
kind: DockerImage
108108
name: quay.io/operator-framework/configmap-operator-registry:latest
109+
- name: kube-rbac-proxy
110+
from:
111+
kind: DockerImage
112+
name: quay.io/openshift/origin-kube-rbac-proxy:latest
109113
EOF
110114

111115
cat << EOF > manifests/0000_50_olm_06-psm-operator.deployment.yaml
@@ -138,6 +142,32 @@ spec:
138142
serviceAccountName: olm-operator-serviceaccount
139143
priorityClassName: "system-cluster-critical"
140144
containers:
145+
- args:
146+
- --secure-listen-address=0.0.0.0:8443
147+
- --upstream=http://127.0.0.1:9090/
148+
- --tls-cert-file=/etc/tls/private/tls.crt
149+
- --tls-private-key-file=/etc/tls/private/tls.key
150+
- --logtostderr=true
151+
image: quay.io/openshift/origin-kube-rbac-proxy:latest
152+
imagePullPolicy: IfNotPresent
153+
name: kube-rbac-proxy
154+
securityContext:
155+
allowPrivilegeEscalation: false
156+
capabilities:
157+
drop: ["ALL"]
158+
ports:
159+
- containerPort: 8443
160+
name: metrics
161+
protocol: TCP
162+
resources:
163+
requests:
164+
memory: 20Mi
165+
cpu: 10m
166+
terminationMessagePath: /dev/termination-log
167+
terminationMessagePolicy: File
168+
volumeMounts:
169+
- mountPath: /etc/tls/private
170+
name: package-server-manager-serving-cert
141171
- name: package-server-manager
142172
securityContext:
143173
allowPrivilegeEscalation: false
@@ -153,6 +183,7 @@ spec:
153183
- \$(PACKAGESERVER_NAMESPACE)
154184
- --interval
155185
- \$(PACKAGESERVER_INTERVAL)
186+
- "--metrics=:9090"
156187
image: quay.io/operator-framework/olm@sha256:de396b540b82219812061d0d753440d5655250c621c753ed1dc67d6154741607
157188
imagePullPolicy: IfNotPresent
158189
env:
@@ -168,10 +199,12 @@ spec:
168199
value: 5m
169200
- name: RELEASE_VERSION
170201
value: "0.0.1-snapshot"
202+
- name: GOMEMLIMIT
203+
value: "5MiB"
171204
resources:
172205
requests:
173206
cpu: 10m
174-
memory: 50Mi
207+
memory: 10Mi
175208
livenessProbe:
176209
httpGet:
177210
path: /healthz
@@ -198,6 +231,54 @@ spec:
198231
key: node.kubernetes.io/not-ready
199232
operator: Exists
200233
tolerationSeconds: 120
234+
volumes:
235+
- name: package-server-manager-serving-cert
236+
secret:
237+
secretName: package-server-manager-serving-cert
238+
EOF
239+
240+
cat << EOF > manifests/0000_50_olm_06-psm-operator.service.yaml
241+
apiVersion: v1
242+
kind: Service
243+
metadata:
244+
annotations:
245+
include.release.openshift.io/self-managed-high-availability: "true"
246+
service.alpha.openshift.io/serving-cert-secret-name: package-server-manager-serving-cert
247+
name: package-server-manager-metrics
248+
namespace: openshift-operator-lifecycle-manager
249+
spec:
250+
ports:
251+
- name: metrics
252+
port: 8443
253+
protocol: TCP
254+
targetPort: metrics
255+
selector:
256+
app: package-server-manager
257+
sessionAffinity: None
258+
type: ClusterIP
259+
EOF
260+
261+
cat << EOF > manifests/0000_50_olm_06-psm-operator.servicemonitor.yaml
262+
apiVersion: monitoring.coreos.com/v1
263+
kind: ServiceMonitor
264+
metadata:
265+
name: package-server-manager-metrics
266+
namespace: openshift-operator-lifecycle-manager
267+
annotations:
268+
include.release.openshift.io/self-managed-high-availability: "true"
269+
spec:
270+
endpoints:
271+
- bearerTokenFile: /var/run/secrets/kubernetes.io/serviceaccount/token
272+
interval: 30s
273+
port: metrics
274+
scheme: https
275+
tlsConfig:
276+
caFile: /etc/prometheus/configmaps/serving-certs-ca-bundle/service-ca.crt
277+
serverName: package-server-manager-metrics.openshift-operator-lifecycle-manager.svc
278+
namespaceSelector:
279+
matchNames:
280+
- openshift-operator-lifecycle-manager
281+
selector: {}
201282
EOF
202283

203284
cat << EOF > manifests/0000_50_olm_00-pprof-config.yaml

0 commit comments

Comments
 (0)