Skip to content

Commit f7b802c

Browse files
k8s-ci-robotk8s-ci-robot
authored
Merge pull request #4558 from camilamacedo86/fix-prometheus
🐛 (go/v4,ksutomize/v2,helm/v1-alpha): Fix prometheus integration with TLS check
2 parents 45d5140 + 7c4b6c9 commit f7b802c

File tree

24 files changed

+345
-150
lines changed

24 files changed

+345
-150
lines changed

‎.github/workflows/test-e2e-samples.yml

Lines changed: 11 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -43,8 +43,8 @@ jobs:
4343
sed -i '25s/^#//' $KUSTOMIZATION_FILE_PATH
4444
sed -i '47,49s/^#//' $KUSTOMIZATION_FILE_PATH
4545
# Uncomment all cert-manager injections
46-
sed -i '59,212s/^#//' $KUSTOMIZATION_FILE_PATH
47-
sed -i '214,229s/^#//' $KUSTOMIZATION_FILE_PATH
46+
sed -i '59,234s/^#//' $KUSTOMIZATION_FILE_PATH
47+
sed -i '236,251s/^#//' $KUSTOMIZATION_FILE_PATH
4848
cd testdata/project-v4/
4949
go mod tidy
5050
@@ -86,10 +86,12 @@ jobs:
8686
# Uncomment only ValidatingWebhookConfiguration
8787
# from cert-manager replaces; we are leaving defaulting uncommented
8888
# since this sample has no defaulting webhooks
89-
sed -i '59,164s/^#//' $KUSTOMIZATION_FILE_PATH
89+
sed -i '59,77s/^#//' $KUSTOMIZATION_FILE_PATH
90+
sed -i '90,107s/^#//' $KUSTOMIZATION_FILE_PATH
91+
sed -i '120,186s/^#//' $KUSTOMIZATION_FILE_PATH
9092
# Uncomment only --conversion webhooks CA injection
91-
sed -i '197,212s/^#//' $KUSTOMIZATION_FILE_PATH
92-
sed -i '214,229s/^#//' $KUSTOMIZATION_FILE_PATH
93+
sed -i '219,234s/^#//' $KUSTOMIZATION_FILE_PATH
94+
sed -i '236,251s/^#//' $KUSTOMIZATION_FILE_PATH
9395
cd testdata/project-v4-with-plugins/
9496
go mod tidy
9597
@@ -129,9 +131,10 @@ jobs:
129131
KUSTOMIZATION_FILE_PATH="testdata/project-v4-multigroup/config/default/kustomization.yaml"
130132
sed -i '25s/^#//' $KUSTOMIZATION_FILE_PATH
131133
# Uncomment all cert-manager injections for webhooks only
132-
sed -i '59,59s/^#//' $KUSTOMIZATION_FILE_PATH
133-
sed -i '98,212s/^#//' $KUSTOMIZATION_FILE_PATH
134-
sed -i '214,229s/^#//' $KUSTOMIZATION_FILE_PATH
134+
sed -i '59,77s/^#//' $KUSTOMIZATION_FILE_PATH
135+
sed -i '90,107s/^#//' $KUSTOMIZATION_FILE_PATH
136+
sed -i '120,234s/^#//' $KUSTOMIZATION_FILE_PATH
137+
sed -i '236,251s/^#//' $KUSTOMIZATION_FILE_PATH
135138
cd testdata/project-v4-multigroup
136139
go mod tidy
137140

‎docs/book/src/cronjob-tutorial/testdata/project/config/default/kustomization.yaml

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -75,6 +75,17 @@ replacements:
7575
delimiter: '.'
7676
index: 0
7777
create: true
78+
- select: # Uncomment the following to set the Service name for TLS config in Prometheus ServiceMonitor
79+
kind: ServiceMonitor
80+
group: monitoring.coreos.com
81+
version: v1
82+
name: controller-manager-metrics-monitor
83+
fieldPaths:
84+
- spec.endpoints.0.tlsConfig.serverName
85+
options:
86+
delimiter: '.'
87+
index: 0
88+
create: true
7889

7990
- source:
8091
kind: Service
@@ -94,6 +105,17 @@ replacements:
94105
delimiter: '.'
95106
index: 1
96107
create: true
108+
- select: # Uncomment the following to set the Service namespace for TLS in Prometheus ServiceMonitor
109+
kind: ServiceMonitor
110+
group: monitoring.coreos.com
111+
version: v1
112+
name: controller-manager-metrics-monitor
113+
fieldPaths:
114+
- spec.endpoints.0.tlsConfig.serverName
115+
options:
116+
delimiter: '.'
117+
index: 1
118+
create: true
97119

98120
- source: # Uncomment the following block if you have any webhook
99121
kind: Service

‎docs/book/src/cronjob-tutorial/testdata/project/config/prometheus/monitor_tls_patch.yaml

Lines changed: 17 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -1,22 +1,19 @@
11
# Patch for Prometheus ServiceMonitor to enable secure TLS configuration
22
# using certificates managed by cert-manager
3-
apiVersion: monitoring.coreos.com/v1
4-
kind: ServiceMonitor
5-
metadata:
6-
name: controller-manager-metrics-monitor
7-
namespace: system
8-
spec:
9-
endpoints:
10-
- tlsConfig:
11-
insecureSkipVerify: false
12-
ca:
13-
secret:
14-
name: metrics-server-cert
15-
key: ca.crt
16-
cert:
17-
secret:
18-
name: metrics-server-cert
19-
key: tls.crt
20-
keySecret:
21-
name: metrics-server-cert
22-
key: tls.key
3+
- op: replace
4+
path: /spec/endpoints/0/tlsConfig
5+
value:
6+
# SERVICE_NAME and SERVICE_NAMESPACE will be substituted by kustomize
7+
serverName: SERVICE_NAME.SERVICE_NAMESPACE.svc
8+
insecureSkipVerify: false
9+
ca:
10+
secret:
11+
name: metrics-server-cert
12+
key: ca.crt
13+
cert:
14+
secret:
15+
name: metrics-server-cert
16+
key: tls.crt
17+
keySecret:
18+
name: metrics-server-cert
19+
key: tls.key

‎docs/book/src/cronjob-tutorial/testdata/project/dist/chart/templates/prometheus/monitor.yaml

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,7 @@ spec:
1515
bearerTokenFile: /var/run/secrets/kubernetes.io/serviceaccount/token
1616
tlsConfig:
1717
{{- if .Values.certmanager.enable }}
18+
serverName: project-controller-manager-metrics-service.{{ .Release.Namespace }}.svc
1819
# Apply secure TLS configuration with cert-manager
1920
insecureSkipVerify: false
2021
ca:

‎docs/book/src/cronjob-tutorial/testdata/project/dist/install.yaml

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4276,7 +4276,11 @@ metadata:
42764276
namespace: project-system
42774277
spec:
42784278
endpoints:
4279-
- tlsConfig:
4279+
- bearerTokenFile: /var/run/secrets/kubernetes.io/serviceaccount/token
4280+
path: /metrics
4281+
port: https
4282+
scheme: https
4283+
tlsConfig:
42804284
ca:
42814285
secret:
42824286
key: ca.crt
@@ -4289,6 +4293,7 @@ spec:
42894293
keySecret:
42904294
key: tls.key
42914295
name: metrics-server-cert
4296+
serverName: project-controller-manager-metrics-service.project-system.svc
42924297
selector:
42934298
matchLabels:
42944299
app.kubernetes.io/name: project

‎docs/book/src/getting-started/testdata/project/config/default/kustomization.yaml

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -75,6 +75,17 @@ patches:
7575
# delimiter: '.'
7676
# index: 0
7777
# create: true
78+
# - select: # Uncomment the following to set the Service name for TLS config in Prometheus ServiceMonitor
79+
# kind: ServiceMonitor
80+
# group: monitoring.coreos.com
81+
# version: v1
82+
# name: controller-manager-metrics-monitor
83+
# fieldPaths:
84+
# - spec.endpoints.0.tlsConfig.serverName
85+
# options:
86+
# delimiter: '.'
87+
# index: 0
88+
# create: true
7889
#
7990
# - source:
8091
# kind: Service
@@ -94,6 +105,17 @@ patches:
94105
# delimiter: '.'
95106
# index: 1
96107
# create: true
108+
# - select: # Uncomment the following to set the Service namespace for TLS in Prometheus ServiceMonitor
109+
# kind: ServiceMonitor
110+
# group: monitoring.coreos.com
111+
# version: v1
112+
# name: controller-manager-metrics-monitor
113+
# fieldPaths:
114+
# - spec.endpoints.0.tlsConfig.serverName
115+
# options:
116+
# delimiter: '.'
117+
# index: 1
118+
# create: true
97119
#
98120
# - source: # Uncomment the following block if you have any webhook
99121
# kind: Service

‎docs/book/src/getting-started/testdata/project/config/prometheus/monitor_tls_patch.yaml

Lines changed: 17 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -1,22 +1,19 @@
11
# Patch for Prometheus ServiceMonitor to enable secure TLS configuration
22
# using certificates managed by cert-manager
3-
apiVersion: monitoring.coreos.com/v1
4-
kind: ServiceMonitor
5-
metadata:
6-
name: controller-manager-metrics-monitor
7-
namespace: system
8-
spec:
9-
endpoints:
10-
- tlsConfig:
11-
insecureSkipVerify: false
12-
ca:
13-
secret:
14-
name: metrics-server-cert
15-
key: ca.crt
16-
cert:
17-
secret:
18-
name: metrics-server-cert
19-
key: tls.crt
20-
keySecret:
21-
name: metrics-server-cert
22-
key: tls.key
3+
- op: replace
4+
path: /spec/endpoints/0/tlsConfig
5+
value:
6+
# SERVICE_NAME and SERVICE_NAMESPACE will be substituted by kustomize
7+
serverName: SERVICE_NAME.SERVICE_NAMESPACE.svc
8+
insecureSkipVerify: false
9+
ca:
10+
secret:
11+
name: metrics-server-cert
12+
key: ca.crt
13+
cert:
14+
secret:
15+
name: metrics-server-cert
16+
key: tls.crt
17+
keySecret:
18+
name: metrics-server-cert
19+
key: tls.key

‎docs/book/src/getting-started/testdata/project/dist/chart/templates/prometheus/monitor.yaml

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,7 @@ spec:
1515
bearerTokenFile: /var/run/secrets/kubernetes.io/serviceaccount/token
1616
tlsConfig:
1717
{{- if .Values.certmanager.enable }}
18+
serverName: project-controller-manager-metrics-service.{{ .Release.Namespace }}.svc
1819
# Apply secure TLS configuration with cert-manager
1920
insecureSkipVerify: false
2021
ca:

‎docs/book/src/multiversion-tutorial/testdata/project/config/default/kustomization.yaml

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -75,6 +75,17 @@ replacements:
7575
delimiter: '.'
7676
index: 0
7777
create: true
78+
- select: # Uncomment the following to set the Service name for TLS config in Prometheus ServiceMonitor
79+
kind: ServiceMonitor
80+
group: monitoring.coreos.com
81+
version: v1
82+
name: controller-manager-metrics-monitor
83+
fieldPaths:
84+
- spec.endpoints.0.tlsConfig.serverName
85+
options:
86+
delimiter: '.'
87+
index: 0
88+
create: true
7889

7990
- source:
8091
kind: Service
@@ -94,6 +105,17 @@ replacements:
94105
delimiter: '.'
95106
index: 1
96107
create: true
108+
- select: # Uncomment the following to set the Service namespace for TLS in Prometheus ServiceMonitor
109+
kind: ServiceMonitor
110+
group: monitoring.coreos.com
111+
version: v1
112+
name: controller-manager-metrics-monitor
113+
fieldPaths:
114+
- spec.endpoints.0.tlsConfig.serverName
115+
options:
116+
delimiter: '.'
117+
index: 1
118+
create: true
97119

98120
- source: # Uncomment the following block if you have any webhook
99121
kind: Service

‎docs/book/src/multiversion-tutorial/testdata/project/config/prometheus/monitor_tls_patch.yaml

Lines changed: 17 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -1,22 +1,19 @@
11
# Patch for Prometheus ServiceMonitor to enable secure TLS configuration
22
# using certificates managed by cert-manager
3-
apiVersion: monitoring.coreos.com/v1
4-
kind: ServiceMonitor
5-
metadata:
6-
name: controller-manager-metrics-monitor
7-
namespace: system
8-
spec:
9-
endpoints:
10-
- tlsConfig:
11-
insecureSkipVerify: false
12-
ca:
13-
secret:
14-
name: metrics-server-cert
15-
key: ca.crt
16-
cert:
17-
secret:
18-
name: metrics-server-cert
19-
key: tls.crt
20-
keySecret:
21-
name: metrics-server-cert
22-
key: tls.key
3+
- op: replace
4+
path: /spec/endpoints/0/tlsConfig
5+
value:
6+
# SERVICE_NAME and SERVICE_NAMESPACE will be substituted by kustomize
7+
serverName: SERVICE_NAME.SERVICE_NAMESPACE.svc
8+
insecureSkipVerify: false
9+
ca:
10+
secret:
11+
name: metrics-server-cert
12+
key: ca.crt
13+
cert:
14+
secret:
15+
name: metrics-server-cert
16+
key: tls.crt
17+
keySecret:
18+
name: metrics-server-cert
19+
key: tls.key

0 commit comments

Comments
 (0)