Skip to content

Commit 2989425

Browse files
iam-veeramallaiam-veeramalla
authored
Merge pull request #554 from jaideepr97/operator-metrics-2
feat: expose gitops operator metrics to openshift-monitoring stack
2 parents 4e53510 + ea5e579 commit 2989425

12 files changed

+188
-18
lines changed

‎bundle/manifests/gitops-operator.clusterserviceversion.yaml

+40-2
Original file line numberDiff line numberDiff line change
@@ -869,7 +869,9 @@ spec:
869869
- create
870870
serviceAccountName: openshift-gitops-operator-controller-manager
871871
deployments:
872-
- name: openshift-gitops-operator-controller-manager
872+
- label:
873+
control-plane: gitops-operator
874+
name: openshift-gitops-operator-controller-manager
873875
spec:
874876
replicas: 1
875877
selector:
@@ -882,7 +884,39 @@ spec:
882884
control-plane: gitops-operator
883885
spec:
884886
containers:
885-
- command:
887+
- args:
888+
- --secure-listen-address=0.0.0.0:8443
889+
- --upstream=http://127.0.0.1:8080
890+
- --tls-cert-file=/etc/tls/private/tls.crt
891+
- --tls-private-key-file=/etc/tls/private/tls.key
892+
- --logtostderr=true
893+
- --allow-paths=/metrics
894+
image: registry.redhat.io/openshift4/ose-kube-rbac-proxy@sha256:da5d5061dbc2ec5082cf14b6c600fb5400b83cf91d7ccebfa80680a238d275db
895+
name: kube-rbac-proxy
896+
ports:
897+
- containerPort: 8443
898+
name: metrics
899+
resources:
900+
limits:
901+
cpu: 500m
902+
memory: 128Mi
903+
requests:
904+
cpu: 1m
905+
memory: 15Mi
906+
securityContext:
907+
allowPrivilegeEscalation: false
908+
capabilities:
909+
drop:
910+
- ALL
911+
volumeMounts:
912+
- mountPath: /etc/tls/private
913+
name: kube-rbac-proxy-tls
914+
readOnly: true
915+
- args:
916+
- --health-probe-bind-address=:8081
917+
- --metrics-bind-address=127.0.0.1:8080
918+
- --leader-elect
919+
command:
886920
- /usr/local/bin/manager
887921
env:
888922
- name: ARGOCD_CLUSTER_CONFIG_NAMESPACES
@@ -915,6 +949,10 @@ spec:
915949
runAsNonRoot: true
916950
serviceAccountName: openshift-gitops-operator-controller-manager
917951
terminationGracePeriodSeconds: 10
952+
volumes:
953+
- name: kube-rbac-proxy-tls
954+
secret:
955+
secretName: kube-rbac-proxy-tls
918956
permissions:
919957
- rules:
920958
- apiGroups:

‎bundle/manifests/openshift-gitops-operator-metrics-monitor_monitoring.coreos.com_v1_servicemonitor.yaml

+19
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
apiVersion: monitoring.coreos.com/v1
2+
kind: ServiceMonitor
3+
metadata:
4+
labels:
5+
control-plane: gitops-operator
6+
name: openshift-gitops-operator-metrics-monitor
7+
spec:
8+
endpoints:
9+
- bearerTokenFile: /var/run/secrets/kubernetes.io/serviceaccount/token
10+
interval: 30s
11+
path: /metrics
12+
port: metrics
13+
scheme: https
14+
tlsConfig:
15+
caFile: /etc/prometheus/configmaps/serving-certs-ca-bundle/service-ca.crt
16+
serverName: openshift-gitops-operator-metrics-service.openshift-gitops-operator.svc
17+
selector:
18+
matchLabels:
19+
control-plane: gitops-operator

‎bundle/manifests/openshift-gitops-operator-metrics-service_v1_service.yaml

+19
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
apiVersion: v1
2+
kind: Service
3+
metadata:
4+
annotations:
5+
service.beta.openshift.io/serving-cert-secret-name: kube-rbac-proxy-tls
6+
creationTimestamp: null
7+
labels:
8+
control-plane: gitops-operator
9+
name: openshift-gitops-operator-metrics-service
10+
spec:
11+
ports:
12+
- name: metrics
13+
port: 8443
14+
targetPort: metrics
15+
selector:
16+
control-plane: gitops-operator
17+
type: ClusterIP
18+
status:
19+
loadBalancer: {}

‎bundle/manifests/openshift-gitops-operator-prometheus_rbac.authorization.k8s.io_v1_role.yaml

+16
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
apiVersion: rbac.authorization.k8s.io/v1
2+
kind: Role
3+
metadata:
4+
creationTimestamp: null
5+
name: openshift-gitops-operator-prometheus
6+
rules:
7+
- apiGroups:
8+
- ""
9+
resources:
10+
- services
11+
- endpoints
12+
- pods
13+
verbs:
14+
- get
15+
- list
16+
- watch

‎bundle/manifests/openshift-gitops-operator-prometheus_rbac.authorization.k8s.io_v1_rolebinding.yaml

+13
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
apiVersion: rbac.authorization.k8s.io/v1
2+
kind: RoleBinding
3+
metadata:
4+
creationTimestamp: null
5+
name: openshift-gitops-operator-prometheus
6+
roleRef:
7+
apiGroup: rbac.authorization.k8s.io
8+
kind: Role
9+
name: openshift-gitops-operator-prometheus
10+
subjects:
11+
- kind: ServiceAccount
12+
name: prometheus-k8s
13+
namespace: openshift-monitoring

‎config/default/kustomization.yaml

+2-2
Original file line numberDiff line numberDiff line change
@@ -22,13 +22,13 @@ bases:
2222
# [CERTMANAGER] To enable cert-manager, uncomment all sections with 'CERTMANAGER'. 'WEBHOOK' components are required.
2323
#- ../certmanager
2424
# [PROMETHEUS] To enable prometheus monitor, uncomment all sections with 'PROMETHEUS'.
25-
#- ../prometheus
25+
- ../prometheus
2626

2727
patchesStrategicMerge:
2828
# Protect the /metrics endpoint by putting it behind auth.
2929
# If you want your controller-manager to expose the /metrics
3030
# endpoint w/o any authn/z, please comment the following line.
31-
#- manager_auth_proxy_patch.yaml
31+
- manager_auth_proxy_patch.yaml
3232

3333
# Mount the controller config file for loading manager configurations
3434
# through a ComponentConfig type

‎config/default/manager_auth_proxy_patch.yaml

+35-6
Original file line numberDiff line numberDiff line change
@@ -6,21 +6,50 @@ metadata:
66
name: controller-manager
77
namespace: system
88
spec:
9+
selector:
10+
matchLabels:
11+
control-plane: gitops-operator
912
template:
1013
spec:
1114
containers:
1215
- name: kube-rbac-proxy
13-
image: gcr.io/kubebuilder/kube-rbac-proxy:v0.8.0
16+
image: registry.redhat.io/openshift4/ose-kube-rbac-proxy@sha256:da5d5061dbc2ec5082cf14b6c600fb5400b83cf91d7ccebfa80680a238d275db
1417
args:
15-
- "--secure-listen-address=0.0.0.0:8443"
16-
- "--upstream=http://127.0.0.1:8080/"
17-
- "--logtostderr=true"
18-
- "--v=10"
18+
- --secure-listen-address=0.0.0.0:8443
19+
- --upstream=http://127.0.0.1:8080
20+
- --tls-cert-file=/etc/tls/private/tls.crt
21+
- --tls-private-key-file=/etc/tls/private/tls.key
22+
- --logtostderr=true
23+
- --allow-paths=/metrics
1924
ports:
2025
- containerPort: 8443
21-
name: https
26+
name: metrics
27+
resources:
28+
limits:
29+
cpu: 500m
30+
memory: 128Mi
31+
requests:
32+
cpu: 1m
33+
memory: 15Mi
34+
securityContext:
35+
allowPrivilegeEscalation: false
36+
capabilities:
37+
drop:
38+
- ALL
39+
volumeMounts:
40+
- mountPath: /etc/tls/private
41+
name: kube-rbac-proxy-tls
42+
readOnly: true
2243
- name: manager
2344
args:
2445
- "--health-probe-bind-address=:8081"
2546
- "--metrics-bind-address=127.0.0.1:8080"
2647
- "--leader-elect"
48+
volumes:
49+
# Secret created by the service CA operator.
50+
# We assume that the Kubernetes service exposing the application's pods has the
51+
# "service.beta.openshift.io/serving-cert-secret-name: kube-rbac-proxy-tls"
52+
# annotation.
53+
- name: kube-rbac-proxy-tls
54+
secret:
55+
secretName: kube-rbac-proxy-tls

‎config/prometheus/kustomization.yaml

+2
Original file line numberDiff line numberDiff line change
@@ -1,2 +1,4 @@
11
resources:
22
- monitor.yaml
3+
- role.yaml
4+
- rolebinding.yaml

‎config/prometheus/monitor.yaml

+7-5
Original file line numberDiff line numberDiff line change
@@ -5,16 +5,18 @@ kind: ServiceMonitor
55
metadata:
66
labels:
77
control-plane: gitops-operator
8-
name: controller-manager-metrics-monitor
8+
name: metrics-monitor
99
namespace: system
1010
spec:
1111
endpoints:
12-
- path: /metrics
13-
port: https
12+
- bearerTokenFile: /var/run/secrets/kubernetes.io/serviceaccount/token
13+
path: /metrics
14+
interval: 30s
15+
port: metrics
1416
scheme: https
15-
bearerTokenFile: /var/run/secrets/kubernetes.io/serviceaccount/token
1617
tlsConfig:
17-
insecureSkipVerify: true
18+
caFile: /etc/prometheus/configmaps/serving-certs-ca-bundle/service-ca.crt
19+
serverName: openshift-gitops-operator-metrics-service.openshift-gitops-operator.svc
1820
selector:
1921
matchLabels:
2022
control-plane: gitops-operator

‎config/prometheus/role.yaml

+16
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
apiVersion: rbac.authorization.k8s.io/v1
2+
kind: Role
3+
metadata:
4+
name: prometheus
5+
namespace: openshift-gitops-operator
6+
rules:
7+
- apiGroups:
8+
- ""
9+
resources:
10+
- services
11+
- endpoints
12+
- pods
13+
verbs:
14+
- get
15+
- list
16+
- watch

‎config/prometheus/rolebinding.yaml

+13
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
apiVersion: rbac.authorization.k8s.io/v1
2+
kind: RoleBinding
3+
metadata:
4+
name: prometheus
5+
namespace: openshift-gitops-operator
6+
roleRef:
7+
apiGroup: rbac.authorization.k8s.io
8+
kind: Role
9+
name: openshift-gitops-operator-prometheus
10+
subjects:
11+
- kind: ServiceAccount
12+
name: prometheus-k8s
13+
namespace: openshift-monitoring

‎config/rbac/auth_proxy_service.yaml

+6-3
Original file line numberDiff line numberDiff line change
@@ -1,14 +1,17 @@
11
apiVersion: v1
22
kind: Service
33
metadata:
4+
annotations:
5+
service.beta.openshift.io/serving-cert-secret-name: kube-rbac-proxy-tls
46
labels:
57
control-plane: gitops-operator
6-
name: controller-manager-metrics-service
8+
name: metrics-service
79
namespace: system
810
spec:
911
ports:
10-
- name: https
12+
- name: metrics
1113
port: 8443
12-
targetPort: https
14+
targetPort: metrics
1315
selector:
1416
control-plane: gitops-operator
17+
type: ClusterIP

0 commit comments

Comments
 (0)