Skip to content

Commit d9b33d1

Browse files
skopacz1skopacz1
authored
Merge pull request #75588 from eromanova97/OBSDOCS-702
OBSDOCS-702: Clarify available endpoint auth methods in user workload…
2 parents fd84e87 + 7214b71 commit d9b33d1

4 files changed

+169
-14
lines changed

‎modules/monitoring-example-remote-write-authentication-settings.adoc

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -183,12 +183,10 @@ metadata:
183183
stringData:
184184
id: <oauth2_id> <1>
185185
secret: <oauth2_secret> <2>
186-
token: <oauth2_authentication_token> <3>
187186
type: Opaque
188187
----
189188
<1> The Oauth 2.0 ID.
190189
<2> The OAuth 2.0 secret.
191-
<3> The OAuth 2.0 token.
192190
193191
The following shows an `oauth2` remote write authentication sample configuration that uses a `Secret` object named `oauth2-credentials` in the `{namespace-name}` namespace:
194192

‎modules/monitoring-example-service-endpoint-authentication-settings.adoc

Lines changed: 158 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,158 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * observability/monitoring/configuring-the-monitoring-stack.adoc
4+
5+
:_mod-docs-content-type: REFERENCE
6+
[id="example-service-endpoint-authentication-settings_{context}"]
7+
= Example service endpoint authentication settings
8+
9+
You can configure authentication for service endpoints for user-defined project monitoring by using `ServiceMonitor` and `PodMonitor` custom resource definitions (CRDs).
10+
11+
The following samples show different authentication settings for a `ServiceMonitor` resource.
12+
Each sample shows how to configure a corresponding `Secret` object that contains authentication credentials and other relevant settings.
13+
14+
== Sample YAML authentication with a bearer token
15+
16+
The following sample shows bearer token settings for a `Secret` object named `example-bearer-auth` in the `ns1` namespace:
17+
18+
.Example bearer token secret
19+
[source,yaml]
20+
----
21+
apiVersion: v1
22+
kind: Secret
23+
metadata:
24+
name: example-bearer-auth
25+
namespace: ns1
26+
stringData:
27+
token: <authentication_token> #<1>
28+
----
29+
<1> Specify an authentication token.
30+
31+
The following sample shows bearer token authentication settings for a `ServiceMonitor` CRD. The example uses a `Secret` object named `example-bearer-auth`:
32+
33+
[id="sample-yaml-bearer-token_{context}"]
34+
.Example bearer token authentication settings
35+
[source,yaml]
36+
----
37+
apiVersion: monitoring.coreos.com/v1
38+
kind: ServiceMonitor
39+
metadata:
40+
name: prometheus-example-monitor
41+
namespace: ns1
42+
spec:
43+
endpoints:
44+
- authorization:
45+
credentials:
46+
key: token #<1>
47+
name: example-bearer-auth #<2>
48+
port: web
49+
selector:
50+
matchLabels:
51+
app: prometheus-example-app
52+
----
53+
<1> The key that contains the authentication token in the specified `Secret` object.
54+
<2> The name of the `Secret` object that contains the authentication credentials.
55+
56+
[IMPORTANT]
57+
=====
58+
Do not use `bearerTokenFile` to configure bearer token. If you use the `bearerTokenFile` configuration, the `ServiceMonitor` resource is rejected.
59+
=====
60+
61+
[id="sample-yaml-basic-auth_{context}"]
62+
== Sample YAML for Basic authentication
63+
64+
The following sample shows Basic authentication settings for a `Secret` object named `example-basic-auth` in the `ns1` namespace:
65+
66+
.Example Basic authentication secret
67+
[source,yaml]
68+
----
69+
apiVersion: v1
70+
kind: Secret
71+
metadata:
72+
name: example-basic-auth
73+
namespace: ns1
74+
stringData:
75+
user: <basic_username> #<1>
76+
password: <basic_password> #<2>
77+
----
78+
<1> Specify a username for authentication.
79+
<2> Specify a password for authentication.
80+
81+
The following sample shows Basic authentication settings for a `ServiceMonitor` CRD. The example uses a `Secret` object named `example-basic-auth`:
82+
83+
.Example Basic authentication settings
84+
[source,yaml]
85+
----
86+
apiVersion: monitoring.coreos.com/v1
87+
kind: ServiceMonitor
88+
metadata:
89+
name: prometheus-example-monitor
90+
namespace: ns1
91+
spec:
92+
endpoints:
93+
- basicAuth:
94+
username:
95+
key: user #<1>
96+
name: example-basic-auth #<2>
97+
password:
98+
key: password #<3>
99+
name: example-basic-auth #<2>
100+
port: web
101+
selector:
102+
matchLabels:
103+
app: prometheus-example-app
104+
----
105+
<1> The key that contains the username in the specified `Secret` object.
106+
<2> The name of the `Secret` object that contains the Basic authentication.
107+
<3> The key that contains the password in the specified `Secret` object.
108+
109+
[id="sample-yaml-oauth-20_{context}"]
110+
== Sample YAML authentication with OAuth 2.0
111+
112+
The following sample shows OAuth 2.0 settings for a `Secret` object named `example-oauth2` in the `ns1` namespace:
113+
114+
.Example OAuth 2.0 secret
115+
[source,yaml]
116+
----
117+
apiVersion: v1
118+
kind: Secret
119+
metadata:
120+
name: example-oauth2
121+
namespace: ns1
122+
stringData:
123+
id: <oauth2_id> #<1>
124+
secret: <oauth2_secret> #<2>
125+
----
126+
<1> Specify an Oauth 2.0 ID.
127+
<2> Specify an Oauth 2.0 secret.
128+
129+
The following sample shows OAuth 2.0 authentication settings for a `ServiceMonitor` CRD. The example uses a `Secret` object named `example-oauth2`:
130+
131+
.Example OAuth 2.0 authentication settings
132+
[source,yaml]
133+
----
134+
apiVersion: monitoring.coreos.com/v1
135+
kind: ServiceMonitor
136+
metadata:
137+
name: prometheus-example-monitor
138+
namespace: ns1
139+
spec:
140+
endpoints:
141+
- oauth2:
142+
clientId:
143+
secret:
144+
key: id #<1>
145+
name: example-oauth2 #<2>
146+
clientSecret:
147+
key: secret #<3>
148+
name: example-oauth2 #<2>
149+
tokenUrl: https://example.com/oauth2/token #<4>
150+
port: web
151+
selector:
152+
matchLabels:
153+
app: prometheus-example-app
154+
----
155+
<1> The key that contains the OAuth 2.0 ID in the specified `Secret` object.
156+
<2> The name of the `Secret` object that contains the OAuth 2.0 credentials.
157+
<3> The key that contains the OAuth 2.0 secret in the specified `Secret` object.
158+
<4> The URL used to fetch a token with the specified `clientId` and `clientSecret`.

‎modules/monitoring-specifying-how-a-service-is-monitored.adoc

Lines changed: 10 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,6 @@
66
[id="specifying-how-a-service-is-monitored_{context}"]
77
= Specifying how a service is monitored
88

9-
[role="_abstract"]
109
To use the metrics exposed by your service, you must configure {product-title} monitoring to scrape metrics from the `/metrics` endpoint. You can do this using a `ServiceMonitor` custom resource definition (CRD) that specifies how a service should be monitored, or a `PodMonitor` CRD that specifies how a pod should be monitored. The former requires a `Service` object, while the latter does not, allowing Prometheus to directly scrape metrics from the metrics endpoint exposed by a pod.
1110

1211
This procedure shows you how to create a `ServiceMonitor` resource for a service in a user-defined project.
@@ -29,30 +28,29 @@ The `prometheus-example-app` sample service does not support TLS authentication.
2928

3029
.Procedure
3130

32-
. Create a YAML file for the `ServiceMonitor` resource configuration. In this example, the file is called `example-app-service-monitor.yaml`.
31+
. Create a new YAML configuration file named `example-app-service-monitor.yaml`.
3332

34-
. Add the following `ServiceMonitor` resource configuration details:
33+
. Add a `ServiceMonitor` resource to the YAML file. The following example creates a service monitor named `prometheus-example-monitor` to scrape metrics exposed by the `prometheus-example-app` service in the `ns1` namespace:
3534
+
3635
[source,yaml]
3736
----
3837
apiVersion: monitoring.coreos.com/v1
3938
kind: ServiceMonitor
4039
metadata:
41-
labels:
42-
k8s-app: prometheus-example-monitor
4340
name: prometheus-example-monitor
44-
namespace: ns1
41+
namespace: ns1 #<1>
4542
spec:
4643
endpoints:
4744
- interval: 30s
48-
port: web
45+
port: web #<2>
4946
scheme: http
50-
selector:
47+
selector: #<3>
5148
matchLabels:
5249
app: prometheus-example-app
5350
----
54-
+
55-
This defines a `ServiceMonitor` resource that scrapes the metrics exposed by the `prometheus-example-app` sample service, which includes the `version` metric.
51+
<1> Specify a user-defined namespace where your service runs.
52+
<2> Specify endpoint ports to be scraped by Prometheus.
53+
<3> Configure a selector to match your service based on its metadata labels.
5654
+
5755
[NOTE]
5856
====
@@ -68,11 +66,11 @@ $ oc apply -f example-app-service-monitor.yaml
6866
+
6967
It takes some time to deploy the `ServiceMonitor` resource.
7068

71-
. You can check that the `ServiceMonitor` resource is running:
69+
. Verify that the `ServiceMonitor` resource is running:
7270
+
7371
[source,terminal]
7472
----
75-
$ oc -n ns1 get servicemonitor
73+
$ oc -n <namespace> get servicemonitor
7674
----
7775
+
7876
.Example output

‎observability/monitoring/managing-metrics.adoc

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,7 @@ include::modules/monitoring-understanding-metrics.adoc[leveloffset=+1]
2121
include::modules/monitoring-setting-up-metrics-collection-for-user-defined-projects.adoc[leveloffset=+1]
2222
include::modules/monitoring-deploying-a-sample-service.adoc[leveloffset=+2]
2323
include::modules/monitoring-specifying-how-a-service-is-monitored.adoc[leveloffset=+2]
24+
include::modules/monitoring-example-service-endpoint-authentication-settings.adoc[leveloffset=+2]
2425

2526
[role="_additional-resources"]
2627
.Additional resources

0 commit comments

Comments
 (0)