Skip to content

Commit b73fe2b

Browse files
moutonjeremymoutonjeremy
authored
Merge pull request #21 from ec2dream/master
helm chart and code enhancements
2 parents ec79f05 + 01e92e6 commit b73fe2b

File tree

15 files changed

+543
-54
lines changed

15 files changed

+543
-54
lines changed

‎README.md‎

Lines changed: 91 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -8,12 +8,21 @@ github-actions-exporter for prometheus
88
Container image : https://hub.docker.com/repository/docker/spendeskplatform/github-actions-exporter
99

1010
## Information
11-
If you want to monitor a public repository, you must put the public_repo option in the repo scope of your github token.
11+
If you want to monitor a public repository, you must put the public_repo option in the repo scope of your github token or Github App Authentication.
12+
13+
## Authentication
14+
15+
Authentication can either via a Github Token or the Github App Authentication 3 parameters. When installing via the Helm Chart the authentication is provided via a secret.
16+
17+
1218

1319
## Options
1420
| Name | Flag | Env vars | Default | Description |
1521
|---|---|---|---|---|
16-
| Github Token | github_token, gt | GITHUB_TOKEN | - | Personnal Access Token |
22+
| Github Token | github_token, gt | GITHUB_TOKEN | - | Personnel Access Token |
23+
| Github App Id | app_id, gai | GITHUB_APP_ID | | Github App Authentication App Id |
24+
| Github App Installation Id | app_installation_id, gii | GITHUB_APP_INSTALLATION_ID | - | Github App Authentication Installation Id |
25+
| Github App Private Key | app_private_key, gpk | GITHUB_APP_PRIVATE_KEY | - | Github App Authentication Private Key |
1726
| Github Refresh | github_refresh, gr | GITHUB_REFRESH | 30 | Refresh time Github Actions status in sec |
1827
| Github Organizations | github_orgas, go | GITHUB_ORGAS | - | List all organizations you want get informations. Format \<orga1>,\<orga2>,\<orga3> (like test1,test2) |
1928
| Github Repos | github_repos, grs | GITHUB_REPOS | - | List all repositories you want get informations. Format \<orga>/\<repo>,\<orga>/\<repo2>,\<orga>/\<repo3> (like test/test) |
@@ -166,8 +175,28 @@ Example:
166175
github_workflow_usage_seconds{id="2862037",name="Create Release",node_id="MDg6V29ya2Zsb3cyODYyMDM3",repo="xxx/xxx",state="active",os="UBUNTU"} 706.609
167176
```
168177

178+
## Setting up authentication with GitHub API
179+
180+
There are two ways for github-actions-exporter to authenticate with the GitHub API (only 1 can be configured at a time however):
181+
182+
1. Using a GitHub App (not supported when you use Github Enterprise )
183+
2. Using a Personal Access Token
184+
185+
Functionality wise, there isn't much of a difference between the 2 authentication methods. The primarily benefit of authenticating via a GitHub App is an [increased API quota](https://docs.github.com/en/developers/apps/rate-limits-for-github-apps).
186+
187+
If you are deploying the solution for a GitHub Enterprise Server environment you are able to [configure your rate limiting settings](https://docs.github.com/en/enterprise-server@3.0/admin/configuration/configuring-rate-limits) making the main benefit irrelevant. If you're deploying the solution for a GitHub Enterprise Cloud or regular GitHub environment and you run into rate limiting issues, consider deploying the solution using the GitHub App authentication method instead.
188+
189+
### Deploying using GitHub App Authentication
190+
191+
You can create a GitHub App for either your account or any organization. If you want to create a GitHub App for your account, open the following link to the creation page, enter any unique name in the "GitHub App name" field, and hit the "Create GitHub App" button at the bottom of the page.
192+
193+
- [Create GitHub Apps on your account](https://github.com/settings/apps/new?url=http://github.com/actions-runner-controller/actions-runner-controller&webhook_active=false&public=false&administration=write&actions=read)
194+
195+
If you want to create a GitHub App for your organization, replace the `:org` part of the following URL with your organization name before opening it. Then enter any unique name in the "GitHub App name" field, and hit the "Create GitHub App" button at the bottom of the page to create a GitHub App.
196+
197+
- [Create GitHub Apps on your organization](https://github.com/organizations/:org/settings/apps/new?url=http://github.com/actions-runner-controller/actions-runner-controller&webhook_active=false&public=false&administration=write&organization_self_hosted_runners=write&actions=read)
169198

170-
## Github Token configuration
199+
### Github Token configuration
171200

172201
Scopes needed configuration for the Github token
173202

@@ -181,3 +210,62 @@ admin:org
181210
- write:org
182211
- read:org
183212
```
213+
214+
### Authentication Errors
215+
216+
#### Invalid Github Token
217+
if token is invalid then `401 Bad credentials` will be returned on github API error and displayed in an error message.
218+
219+
#### Invalid Github App configuration
220+
if the app id or app installation id value is incorrect then messages like the following are displayed:
221+
```
222+
could not refresh installation id 12345678's token: request &{Method:POST URL:https://api.github.com/app/installations/12345678/access_tokens
223+
```
224+
225+
if the github_app_private_key is incorrect then errors like the following are displayed.
226+
```
227+
Error: Client creation failed.authentication failed: could not parse private key: Invalid Key: Key must be PEM encoded PKCS1 or PKCS8 private ke
228+
```
229+
230+
### Secret actions-exporter
231+
232+
In the kubernetes deployment authentication is passed via a kubernetes secret:
233+
234+
```
235+
kind: Secret
236+
apiVersion: v1
237+
metadata:
238+
name: actions-exporter
239+
namespace: github-actions-exporter
240+
type: Opaque
241+
data:
242+
github_token: AAAAAA
243+
# github_app_id: BBBBBB
244+
# github_app_installation_id: CCCCCCCCC
245+
# github_app_private_key: DDDDDDD
246+
```
247+
248+
Or more probably using an external secret manager. Here is an example of using External Secrets with the EKS Secret Manager to define the authentication in a secret:
249+
250+
```
251+
apiVersion: 'kubernetes-client.io/v1'
252+
kind: ExternalSecret
253+
metadata:
254+
name: actions-exporter
255+
namespace: github-actions-exporter
256+
spec:
257+
backendType: secretsManager
258+
data:
259+
# - key: MySecretManagerKey
260+
# name: github_token
261+
# property: github_token
262+
- key: MySecretManagerKey
263+
name: github_app_id
264+
property: github_app_id
265+
- key: MySecretManagerKey
266+
name: github_app_installation_id
267+
property: github_app_installation_id
268+
# separate plaintext aws secret needed for ssh key
269+
- key: MySecretManagerKeyPrivateKey
270+
name: github_app_private_key
271+
```

‎deploy/helm-chart/github-actions-exporter/.helmignore‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
# Patterns to ignore when building packages.
2+
# This supports shell glob matching, relative path matching, and
3+
# negation (prefixed with !). Only one pattern per line.
4+
.DS_Store
5+
# Common VCS dirs
6+
.git/
7+
.gitignore
8+
.bzr/
9+
.bzrignore
10+
.hg/
11+
.hgignore
12+
.svn/
13+
# Common backup files
14+
*.swp
15+
*.bak
16+
*.tmp
17+
*.orig
18+
*~
19+
# Various IDEs
20+
.project
21+
.idea/
22+
*.tmproj
23+
.vscode/

‎deploy/helm-chart/github-actions-exporter/Chart.yaml‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
apiVersion: v2
2+
name: github-actions-exporter
3+
description: github-actions exporter for prometheus
4+
type: application
5+
6+
# This is the chart version. This version number should be incremented each time you make changes
7+
# to the chart and its templates, including the app version.
8+
# Versions are expected to follow Semantic Versioning (https://semver.org/)
9+
version: 0.1.4
10+
11+
# This is the version number of the application being deployed. This version number should be
12+
# incremented each time you make changes to the application. Versions are not expected to
13+
# follow Semantic Versioning. They should reflect the version the application is using.
14+
appVersion: 1.8.0

‎deploy/helm-chart/github-actions-exporter/templates/NOTES.txt‎

Whitespace-only changes.

‎deploy/helm-chart/github-actions-exporter/templates/_helpers.tpl‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
{{/* vim: set filetype=mustache: */}}
2+
{{/*
3+
Expand the name of the chart.
4+
*/}}
5+
{{- define "github-actions-exporter.name" -}}
6+
{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
7+
{{- end }}
8+
9+
{{/*
10+
Create a default fully qualified app name.
11+
We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
12+
If release name contains chart name it will be used as a full name.
13+
*/}}
14+
{{- define "github-actions-exporter.fullname" -}}
15+
{{- if .Values.fullnameOverride }}
16+
{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }}
17+
{{- else }}
18+
{{- $name := default .Chart.Name .Values.nameOverride }}
19+
{{- if contains $name .Release.Name }}
20+
{{- .Release.Name | trunc 63 | trimSuffix "-" }}
21+
{{- else }}
22+
{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }}
23+
{{- end }}
24+
{{- end }}
25+
{{- end }}
26+
27+
{{/*
28+
Create chart name and version as used by the chart label.
29+
*/}}
30+
{{- define "github-actions-exporter.chart" -}}
31+
{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
32+
{{- end }}
33+
34+
{{/*
35+
Common labels
36+
*/}}
37+
{{- define "github-actions-exporter.labels" -}}
38+
helm.sh/chart: {{ include "github-actions-exporter.chart" . }}
39+
{{ include "github-actions-exporter.selectorLabels" . }}
40+
{{- if .Chart.AppVersion }}
41+
app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
42+
{{- end }}
43+
app.kubernetes.io/managed-by: {{ .Release.Service }}
44+
{{- end }}
45+
46+
{{/*
47+
Selector labels
48+
*/}}
49+
{{- define "github-actions-exporter.selectorLabels" -}}
50+
app.kubernetes.io/name: {{ include "github-actions-exporter.name" . }}
51+
app.kubernetes.io/instance: {{ .Release.Name }}
52+
{{- end }}

‎deploy/helm-chart/github-actions-exporter/templates/deployment.yaml‎

Lines changed: 89 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,89 @@
1+
apiVersion: apps/v1
2+
kind: Deployment
3+
metadata:
4+
name: {{ include "github-actions-exporter.fullname" . }}
5+
labels:
6+
{{ include "github-actions-exporter.labels" . | nindent 4 }}
7+
spec:
8+
replicas: 1
9+
strategy:
10+
type: Recreate
11+
selector:
12+
matchLabels:
13+
{{ include "github-actions-exporter.selectorLabels" . | nindent 6 }}
14+
template:
15+
metadata:
16+
{{- with .Values.podAnnotations }}
17+
annotations:
18+
{{- toYaml . | nindent 8 }}
19+
{{- end }}
20+
labels:
21+
app: {{ template "github-actions-exporter.name" . }}
22+
release: {{ .Release.Name }}
23+
{{ include "github-actions-exporter.selectorLabels" . | nindent 8 }}
24+
spec:
25+
{{- with .Values.imagePullSecrets }}
26+
imagePullSecrets:
27+
{{- toYaml . | nindent 8 }}
28+
{{- end }}
29+
securityContext:
30+
{{- toYaml .Values.podSecurityContext | nindent 8 }}
31+
containers:
32+
- name: {{ .Chart.Name }}
33+
securityContext:
34+
{{- toYaml .Values.securityContext | nindent 12 }}
35+
imagePullPolicy: {{ .Values.image.pullPolicy }}
36+
image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
37+
env:
38+
{{- range $name, $value := .Values.env }}
39+
{{- if not (empty $value) }}
40+
- name: {{ $name | quote }}
41+
value: {{ $value | quote }}
42+
{{- end }}
43+
{{- end }}
44+
- name: GITHUB_TOKEN
45+
valueFrom:
46+
secretKeyRef:
47+
name: {{ .Values.secret.name }}
48+
key: github_token
49+
optional: true
50+
- name: GITHUB_APP_ID
51+
valueFrom:
52+
secretKeyRef:
53+
name: {{ .Values.secret.name }}
54+
key: github_app_id
55+
optional: true
56+
- name: GITHUB_APP_INSTALLATION_ID
57+
valueFrom:
58+
secretKeyRef:
59+
name: {{ .Values.secret.name }}
60+
key: github_app_installation_id
61+
optional: true
62+
- name: GITHUB_APP_PRIVATE_KEY
63+
value: /etc/actions-exporter/github_app_private_key
64+
volumeMounts:
65+
- name: actions-exporter
66+
mountPath: "/etc/actions-exporter"
67+
readOnly: true
68+
ports:
69+
- name: http
70+
containerPort: {{ .Values.env.PORT }}
71+
protocol: TCP
72+
resources:
73+
{{- toYaml .Values.resources | nindent 12 }}
74+
volumes:
75+
- name: actions-exporter
76+
secret:
77+
secretName: {{ .Values.secret.name }}
78+
{{- with .Values.nodeSelector }}
79+
nodeSelector:
80+
{{- toYaml . | nindent 8 }}
81+
{{- end }}
82+
{{- with .Values.affinity }}
83+
affinity:
84+
{{- toYaml . | nindent 8 }}
85+
{{- end }}
86+
{{- with .Values.tolerations }}
87+
tolerations:
88+
{{- toYaml . | nindent 8 }}
89+
{{- end }}

‎deploy/helm-chart/github-actions-exporter/templates/service.yaml‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
apiVersion: v1
2+
kind: Service
3+
metadata:
4+
name: {{ include "github-actions-exporter.fullname" . }}
5+
labels:
6+
app: {{ template "github-actions-exporter.name" . }}
7+
release: {{ .Release.Name }}
8+
{{- include "github-actions-exporter.labels" . | nindent 4 }}
9+
spec:
10+
type: {{ .Values.service.type }}
11+
ports:
12+
- port: {{ .Values.env.PORT }}
13+
targetPort: http
14+
protocol: TCP
15+
name: http
16+
selector:
17+
{{- include "github-actions-exporter.selectorLabels" . | nindent 4 }}

‎deploy/helm-chart/github-actions-exporter/templates/serviceMonitor.yaml‎

Lines changed: 43 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,43 @@
1+
{{- if $.Values.serviceMonitor }}
2+
{{- if and ( .Capabilities.APIVersions.Has "monitoring.coreos.com/v1" ) ( .Values.serviceMonitor.enabled ) }}
3+
apiVersion: monitoring.coreos.com/v1
4+
kind: ServiceMonitor
5+
metadata:
6+
{{- if .Values.serviceMonitor.labels }}
7+
labels:
8+
{{ toYaml .Values.serviceMonitor.labels | indent 4}}
9+
{{- end }}
10+
name: {{ template "github-actions-exporter.fullname" . }}
11+
{{- if .Values.serviceMonitor.namespace }}
12+
namespace: {{ .Values.serviceMonitor.namespace }}
13+
{{- end }}
14+
spec:
15+
endpoints:
16+
- targetPort: {{ .Values.service.port }}
17+
{{- if .Values.serviceMonitor.interval }}
18+
interval: {{ .Values.serviceMonitor.interval }}
19+
{{- end }}
20+
path: /metrics
21+
{{- if .Values.serviceMonitor.timeout }}
22+
scrapeTimeout: {{ .Values.serviceMonitor.timeout }}
23+
{{- end }}
24+
{{- if .Values.serviceMonitor.metricRelabelings }}
25+
metricRelabelings:
26+
{{ toYaml .Values.serviceMonitor.metricRelabelings | indent 4 }}
27+
{{- end }}
28+
jobLabel: {{ template "github-actions-exporter.fullname" . }}
29+
namespaceSelector:
30+
matchNames:
31+
- {{ .Release.Namespace }}
32+
selector:
33+
matchLabels:
34+
app: {{ template "github-actions-exporter.name" . }}
35+
release: {{ .Release.Name }}
36+
{{- if .Values.serviceMonitor.targetLabels }}
37+
targetLabels:
38+
{{- range .Values.serviceMonitor.targetLabels }}
39+
- {{ . }}
40+
{{- end }}
41+
{{- end }}
42+
{{- end }}
43+
{{- end }}

0 commit comments

Comments
 (0)