Skip to content

Commit ba373ca

Browse files
smarterclaytonsmarterclayton
committed
Add a standalone prometheus example
Can be used on many different clusters
1 parent 3287329 commit ba373ca

File tree

2 files changed

+283
-2
lines changed

2 files changed

+283
-2
lines changed

‎examples/prometheus/README.md

+36-2
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,10 @@
1-
# Prometheus Ops Metrics Example
1+
# Prometheus for OpenShift
22

3-
This template creates a Prometheus instance preconfigured to gather OpenShift and Kubernetes platform and node metrics and report them to admins. It is protected by an OAuth proxy that only allows access for users who have view access to the `kube-system` namespace.
3+
This directory contains example components for running either an operational Prometheus setup for your OpenShift cluster, or deploying a standalone secured Prometheus instance for configurating yourself.
4+
5+
## Prometheus for Operations
6+
7+
The `prometheus.yaml` template creates a Prometheus instance preconfigured to gather OpenShift and Kubernetes platform and node metrics and report them to admins. It is protected by an OAuth proxy that only allows access for users who have view access to the `kube-system` namespace.
48

59
To deploy, run:
610

@@ -20,6 +24,36 @@ $ oc create -f node-exporter.yaml -n kube-system
2024
$ oc adm policy add-scc-to-user -z prometheus-node-exporter -n kube-system hostaccess
2125
```
2226

27+
## Standalone Prometheus
28+
29+
The `prometheus-standalone.yaml` template creates a Prometheus instance without any configuration, intended for use when you have your own configuration. It expects two secrets to be created ahead of time:
30+
31+
* `prom` which should contain:
32+
* `prometheus.yml`: The Prometheus configuration
33+
* `*.rules`: Will be treated as recording or alerting rules
34+
* Any additional files referenced by `prometheus.yml`
35+
* `prom-alerts` which should contain:
36+
* `alertmanager.yml`: The Alert Manager configuration
37+
* Any additional files referenced by `alertmanager.yml`
38+
39+
The example uses secrets instead of config maps in case either config file needs to reference a secret.
40+
41+
Example creation steps:
42+
43+
```
44+
# Create the prom secret
45+
$ oc create secret generic prom --from-file=../prometheus.yml
46+
47+
# Create the prom-alerts secret
48+
$ oc create secret generic prom --from-file=../alertmanager.yml
49+
50+
# Create the prometheus instance
51+
$ oc process -f prometheus-standalone.yaml | oc apply -f -
52+
```
53+
54+
You can find the Prometheus route by invoking `oc get routes` and then browsing in your web console. Users who are granted `view` access on the namespace will have access to login to Prometheus.
55+
56+
2357
## Useful metrics queries
2458

2559
### Related to how much data is being gathered by Prometheus

‎examples/prometheus/prometheus-standalone.yaml

+247
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,247 @@
1+
apiVersion: template.openshift.io/v1
2+
kind: Template
3+
metadata:
4+
name: prometheus
5+
annotations:
6+
"openshift.io/display-name": Prometheus
7+
description: |
8+
A Prometheus deployment that can be customized to monitor components and dispatch alerts. It is secure by default and can be used to monitor arbitrary clients.
9+
iconClass: icon-cogs
10+
tags: "monitoring,prometheus,alertmanager,time-series"
11+
parameters:
12+
- description: The location of the proxy image
13+
name: IMAGE_PROXY
14+
value: openshift/oauth-proxy:v1.0.0
15+
- description: The location of the prometheus image
16+
name: IMAGE_PROMETHEUS
17+
value: openshift/prometheus:v2.0.0
18+
- description: The location of the alertmanager image
19+
name: IMAGE_ALERTMANAGER
20+
value: openshift/prometheus-alertmanager:v0.9.1
21+
- description: The location of alert-buffer image
22+
name: IMAGE_ALERT_BUFFER
23+
value: openshift/prometheus-alert-buffer:v0.0.2
24+
- description: The session secret for the proxy
25+
name: SESSION_SECRET
26+
generate: expression
27+
from: "[a-zA-Z0-9]{43}"
28+
29+
objects:
30+
- apiVersion: v1
31+
kind: ServiceAccount
32+
metadata:
33+
name: prom
34+
annotations:
35+
serviceaccounts.openshift.io/oauth-redirectreference.prom: '{"kind":"OAuthRedirectReference","apiVersion":"v1","reference":{"kind":"Route","name":"prom"}}'
36+
serviceaccounts.openshift.io/oauth-redirectreference.alerts: '{"kind":"OAuthRedirectReference","apiVersion":"v1","reference":{"kind":"Route","name":"prom-alerts"}}'
37+
38+
# Create a fully end-to-end TLS connection to the prometheus proxy
39+
- apiVersion: route.openshift.io/v1
40+
kind: Route
41+
metadata:
42+
name: prom
43+
spec:
44+
to:
45+
name: prom
46+
tls:
47+
termination: Reencrypt
48+
insecureEdgeTerminationPolicy: Redirect
49+
- apiVersion: v1
50+
kind: Service
51+
metadata:
52+
annotations:
53+
prometheus.io/scrape: "true"
54+
prometheus.io/scheme: https
55+
service.alpha.openshift.io/serving-cert-secret-name: prom-tls
56+
labels:
57+
name: prom
58+
name: prom
59+
spec:
60+
ports:
61+
- name: prometheus
62+
port: 443
63+
protocol: TCP
64+
targetPort: 8443
65+
selector:
66+
app: prom
67+
- apiVersion: v1
68+
kind: Secret
69+
metadata:
70+
name: prom-proxy
71+
stringData:
72+
session_secret: "${SESSION_SECRET}="
73+
- apiVersion: apps/v1beta1
74+
kind: StatefulSet
75+
metadata:
76+
labels:
77+
app: prom
78+
name: prom
79+
spec:
80+
updateStrategy:
81+
type: RollingUpdate
82+
podManagementPolicy: Parallel
83+
selector:
84+
matchLabels:
85+
app: prom
86+
template:
87+
metadata:
88+
labels:
89+
app: prom
90+
name: prom
91+
spec:
92+
serviceAccountName: prom
93+
containers:
94+
# Deploy Prometheus behind an oauth proxy
95+
- name: prom-proxy
96+
image: ${IMAGE_PROXY}
97+
imagePullPolicy: IfNotPresent
98+
ports:
99+
- containerPort: 8443
100+
name: web
101+
env:
102+
- name: NAMESPACE
103+
valueFrom:
104+
fieldRef:
105+
fieldPath: metadata.namespace
106+
args:
107+
- -provider=openshift
108+
- -https-address=:8443
109+
- -http-address=
110+
- -email-domain=*
111+
- -upstream=http://localhost:9090
112+
- -client-id=system:serviceaccount:$(NAMESPACE):prom
113+
- -openshift-ca=/etc/pki/tls/cert.pem
114+
- -openshift-ca=/var/run/secrets/kubernetes.io/serviceaccount/ca.crt
115+
- '-openshift-sar={"resource": "namespaces", "verb": "get", "resourceName": "$(NAMESPACE)", "namespace": "$(NAMESPACE)"}'
116+
- -tls-cert=/etc/tls/private/tls.crt
117+
- -tls-key=/etc/tls/private/tls.key
118+
- -client-secret-file=/var/run/secrets/kubernetes.io/serviceaccount/token
119+
- -cookie-secret-file=/etc/proxy/secrets/session_secret
120+
- -skip-auth-regex=^/metrics
121+
volumeMounts:
122+
- mountPath: /etc/tls/private
123+
name: prometheus-tls
124+
- mountPath: /etc/proxy/secrets
125+
name: prometheus-secrets
126+
- mountPath: /prometheus
127+
name: prometheus-data
128+
129+
- name: prometheus
130+
args:
131+
- --storage.tsdb.retention=6h
132+
- --storage.tsdb.min-block-duration=2m
133+
- --config.file=/etc/prometheus/prometheus.yml
134+
- --web.listen-address=localhost:9090
135+
image: ${IMAGE_PROMETHEUS}
136+
imagePullPolicy: IfNotPresent
137+
volumeMounts:
138+
- mountPath: /etc/prometheus
139+
name: prometheus-config
140+
- mountPath: /prometheus
141+
name: prometheus-data
142+
143+
# Deploy alertmanager behind an oauth proxy
144+
# use http port=4190 and https port=9943 to differ from prom-proxy
145+
- name: alerts-proxy
146+
image: ${IMAGE_PROXY}
147+
imagePullPolicy: IfNotPresent
148+
ports:
149+
- containerPort: 9443
150+
name: web
151+
env:
152+
- name: NAMESPACE
153+
valueFrom:
154+
fieldRef:
155+
fieldPath: metadata.namespace
156+
args:
157+
- -provider=openshift
158+
- -https-address=:9443
159+
- -http-address=
160+
- -email-domain=*
161+
- -upstream=http://localhost:9099
162+
- -client-id=system:serviceaccount:$(NAMESPACE):prom
163+
- -openshift-ca=/etc/pki/tls/cert.pem
164+
- -openshift-ca=/var/run/secrets/kubernetes.io/serviceaccount/ca.crt
165+
- '-openshift-sar={"resource": "namespaces", "verb": "get", "resourceName": "$(NAMESPACE)", "namespace": "$(NAMESPACE)"}'
166+
- -tls-cert=/etc/tls/private/tls.crt
167+
- -tls-key=/etc/tls/private/tls.key
168+
- -client-secret-file=/var/run/secrets/kubernetes.io/serviceaccount/token
169+
- -cookie-secret-file=/etc/proxy/secrets/session_secret
170+
volumeMounts:
171+
- mountPath: /etc/tls/private
172+
name: alerts-tls
173+
- mountPath: /etc/proxy/secrets
174+
name: alerts-secrets
175+
176+
- name: alertmanager
177+
args:
178+
- -config.file=/etc/alertmanager/alertmanager.yml
179+
image: ${IMAGE_ALERTMANAGER}
180+
imagePullPolicy: IfNotPresent
181+
ports:
182+
- containerPort: 9093
183+
name: web
184+
volumeMounts:
185+
- mountPath: /etc/alertmanager
186+
name: alertmanager-config
187+
- mountPath: /alertmanager
188+
name: alertmanager-data
189+
190+
restartPolicy: Always
191+
volumes:
192+
- name: prometheus-config
193+
secret:
194+
secretName: prom
195+
- name: prometheus-secrets
196+
secret:
197+
secretName: prom-proxy
198+
- name: prometheus-tls
199+
secret:
200+
secretName: prom-tls
201+
- name: prometheus-data
202+
emptyDir: {}
203+
- name: alertmanager-config
204+
secret:
205+
secretName: prom-alerts
206+
- name: alerts-secrets
207+
secret:
208+
secretName: prom-alerts-proxy
209+
- name: alerts-tls
210+
secret:
211+
secretName: prom-alerts-tls
212+
- name: alertmanager-data
213+
emptyDir: {}
214+
215+
# Create a fully end-to-end TLS connection to the alert proxy
216+
- apiVersion: route.openshift.io/v1
217+
kind: Route
218+
metadata:
219+
name: prom-alerts
220+
spec:
221+
to:
222+
name: prom-alerts
223+
tls:
224+
termination: Reencrypt
225+
insecureEdgeTerminationPolicy: Redirect
226+
- apiVersion: v1
227+
kind: Service
228+
metadata:
229+
annotations:
230+
service.alpha.openshift.io/serving-cert-secret-name: prom-alerts-tls
231+
labels:
232+
name: prom-alerts
233+
name: prom-alerts
234+
spec:
235+
ports:
236+
- name: alerts
237+
port: 443
238+
protocol: TCP
239+
targetPort: 9443
240+
selector:
241+
app: prom
242+
- apiVersion: v1
243+
kind: Secret
244+
metadata:
245+
name: prom-alerts-proxy
246+
stringData:
247+
session_secret: "${SESSION_SECRET}="

0 commit comments

Comments
 (0)