Skip to content

Commit 12c810a

Browse files
ajanikowajanikow
authored
[Feature] Allow to disable HTTP in exporter (#607)
1 parent 96b1c86 commit 12c810a

File tree

7 files changed

+176
-11
lines changed

7 files changed

+176
-11
lines changed

‎CHANGELOG.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,7 @@
22

33
## [master](https://github.com/arangodb/kube-arangodb/tree/master) (N/A)
44
- Add Labels and Annotations to ServiceMonitor
5+
- Allow to expose Exporter in HTTP with secured Deployments
56

67
## [1.0.4](https://github.com/arangodb/kube-arangodb/tree/1.0.4) (2020-07-28)
78
- Add Encryption Key rotation feature for ArangoDB EE 3.7+

‎pkg/apis/deployment/v1/metrics_spec.go‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -72,10 +72,19 @@ type MetricsSpec struct {
7272
Authentication MetricsAuthenticationSpec `json:"authentication,omitempty"`
7373
Resources v1.ResourceRequirements `json:"resources,omitempty"`
7474
Mode *MetricsMode `json:"mode,omitempty"`
75+
TLS *bool `json:"tls,omitempty"`
7576

7677
Port *uint16 `json:"port,omitempty"`
7778
}
7879

80+
func (s *MetricsSpec) IsTLS() bool {
81+
if s == nil || s.TLS == nil {
82+
return true
83+
}
84+
85+
return *s.TLS
86+
}
87+
7988
func (s *MetricsSpec) GetPort() uint16 {
8089
if s == nil || s.Port == nil {
8190
return k8sutil.ArangoExporterPort

‎pkg/apis/deployment/v1/zz_generated.deepcopy.go‎

Lines changed: 5 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎pkg/deployment/deployment_metrics_test.go‎

Lines changed: 146 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -429,6 +429,152 @@ func TestEnsurePod_Metrics(t *testing.T) {
429429
},
430430
},
431431
},
432+
{
433+
Name: "Agency Pod with sidecar metrics exporter and port override, with enabled deployment tls",
434+
ArangoDeployment: &api.ArangoDeployment{
435+
Spec: api.DeploymentSpec{
436+
Image: util.NewString(testImage),
437+
Authentication: noAuthentication,
438+
TLS: tlsSpec,
439+
Metrics: func() api.MetricsSpec {
440+
m := metricsSpec.DeepCopy()
441+
442+
m.Port = util.NewUInt16(9999)
443+
444+
m.Mode = api.MetricsModeSidecar.New()
445+
446+
return *m
447+
}(),
448+
},
449+
},
450+
Helper: func(t *testing.T, deployment *Deployment, testCase *testCaseStruct) {
451+
deployment.status.last = api.DeploymentStatus{
452+
Members: api.DeploymentStatusMembers{
453+
Agents: api.MemberStatusList{
454+
firstAgentStatus,
455+
},
456+
},
457+
Images: createTestImages(false),
458+
}
459+
460+
testCase.createTestPodData(deployment, api.ServerGroupAgents, firstAgentStatus)
461+
testCase.ExpectedPod.ObjectMeta.Labels[k8sutil.LabelKeyArangoExporter] = testYes
462+
},
463+
ExpectedEvent: "member agent is created",
464+
ExpectedPod: core.Pod{
465+
Spec: core.PodSpec{
466+
Volumes: []core.Volume{
467+
k8sutil.CreateVolumeEmptyDir(k8sutil.ArangodVolumeName),
468+
createTestTLSVolume(api.ServerGroupAgentsString, firstAgentStatus.ID),
469+
k8sutil.CreateVolumeWithSecret(k8sutil.ExporterJWTVolumeName, testExporterToken),
470+
},
471+
Containers: []core.Container{
472+
{
473+
Name: k8sutil.ServerContainerName,
474+
Image: testImage,
475+
Command: createTestCommandForAgent(firstAgentStatus.ID, true, false, false),
476+
Ports: createTestPorts(),
477+
VolumeMounts: []core.VolumeMount{
478+
k8sutil.ArangodVolumeMount(),
479+
k8sutil.TlsKeyfileVolumeMount(),
480+
},
481+
Resources: emptyResources,
482+
LivenessProbe: createTestLivenessProbe(httpProbe, true, "", k8sutil.ArangoPort),
483+
ImagePullPolicy: core.PullIfNotPresent,
484+
SecurityContext: securityContext.NewSecurityContext(),
485+
},
486+
func() core.Container {
487+
z := testCreateExporterContainerWithPortAndSecureEndpoint(true, true, emptyResources, 9999)
488+
489+
z.VolumeMounts = append(z.VolumeMounts, k8sutil.TlsKeyfileVolumeMount())
490+
491+
z.Command = append(z.Command, "--mode=passthru")
492+
return z
493+
}(),
494+
},
495+
RestartPolicy: core.RestartPolicyNever,
496+
TerminationGracePeriodSeconds: &defaultAgentTerminationTimeout,
497+
Hostname: testDeploymentName + "-" + api.ServerGroupAgentsString + "-" + firstAgentStatus.ID,
498+
Subdomain: testDeploymentName + "-int",
499+
Affinity: k8sutil.CreateAffinity(testDeploymentName, api.ServerGroupAgentsString,
500+
false, ""),
501+
},
502+
},
503+
},
504+
{
505+
Name: "Agency Pod with sidecar metrics exporter and port override, with enabled deployment tls but disabled metrics tls",
506+
ArangoDeployment: &api.ArangoDeployment{
507+
Spec: api.DeploymentSpec{
508+
Image: util.NewString(testImage),
509+
Authentication: noAuthentication,
510+
TLS: tlsSpec,
511+
Metrics: func() api.MetricsSpec {
512+
m := metricsSpec.DeepCopy()
513+
514+
m.Port = util.NewUInt16(9999)
515+
516+
m.Mode = api.MetricsModeSidecar.New()
517+
518+
m.TLS = util.NewBool(false)
519+
520+
return *m
521+
}(),
522+
},
523+
},
524+
Helper: func(t *testing.T, deployment *Deployment, testCase *testCaseStruct) {
525+
deployment.status.last = api.DeploymentStatus{
526+
Members: api.DeploymentStatusMembers{
527+
Agents: api.MemberStatusList{
528+
firstAgentStatus,
529+
},
530+
},
531+
Images: createTestImages(false),
532+
}
533+
534+
testCase.createTestPodData(deployment, api.ServerGroupAgents, firstAgentStatus)
535+
testCase.ExpectedPod.ObjectMeta.Labels[k8sutil.LabelKeyArangoExporter] = testYes
536+
},
537+
ExpectedEvent: "member agent is created",
538+
ExpectedPod: core.Pod{
539+
Spec: core.PodSpec{
540+
Volumes: []core.Volume{
541+
k8sutil.CreateVolumeEmptyDir(k8sutil.ArangodVolumeName),
542+
createTestTLSVolume(api.ServerGroupAgentsString, firstAgentStatus.ID),
543+
k8sutil.CreateVolumeWithSecret(k8sutil.ExporterJWTVolumeName, testExporterToken),
544+
},
545+
Containers: []core.Container{
546+
{
547+
Name: k8sutil.ServerContainerName,
548+
Image: testImage,
549+
Command: createTestCommandForAgent(firstAgentStatus.ID, true, false, false),
550+
Ports: createTestPorts(),
551+
VolumeMounts: []core.VolumeMount{
552+
k8sutil.ArangodVolumeMount(),
553+
k8sutil.TlsKeyfileVolumeMount(),
554+
},
555+
Resources: emptyResources,
556+
LivenessProbe: createTestLivenessProbe(httpProbe, true, "", k8sutil.ArangoPort),
557+
ImagePullPolicy: core.PullIfNotPresent,
558+
SecurityContext: securityContext.NewSecurityContext(),
559+
},
560+
func() core.Container {
561+
z := testCreateExporterContainerWithPortAndSecureEndpoint(true, false, emptyResources, 9999)
562+
563+
z.VolumeMounts = append(z.VolumeMounts, k8sutil.TlsKeyfileVolumeMount())
564+
565+
z.Command = append(z.Command, "--mode=passthru")
566+
return z
567+
}(),
568+
},
569+
RestartPolicy: core.RestartPolicyNever,
570+
TerminationGracePeriodSeconds: &defaultAgentTerminationTimeout,
571+
Hostname: testDeploymentName + "-" + api.ServerGroupAgentsString + "-" + firstAgentStatus.ID,
572+
Subdomain: testDeploymentName + "-int",
573+
Affinity: k8sutil.CreateAffinity(testDeploymentName, api.ServerGroupAgentsString,
574+
false, ""),
575+
},
576+
},
577+
},
432578
}
433579

434580
runTestCases(t, testCases...)

‎pkg/deployment/deployment_suite_test.go‎

Lines changed: 13 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -486,7 +486,7 @@ func createTestExporterPorts(port uint16) []core.ContainerPort {
486486
}
487487
}
488488

489-
func createTestExporterCommand(secure bool, port uint16) []string {
489+
func createTestExporterCommand(secure, exporterSecure bool, port uint16) []string {
490490
command := []string{
491491
"/app/arangodb-exporter",
492492
}
@@ -499,14 +499,14 @@ func createTestExporterCommand(secure bool, port uint16) []string {
499499

500500
command = append(command, "--arangodb.jwt-file=/secrets/exporter/jwt/token")
501501

502-
if secure {
503-
command = append(command, "--ssl.keyfile=/secrets/tls/tls.keyfile")
504-
}
505-
506502
if port != k8sutil.ArangoExporterPort {
507503
command = append(command, fmt.Sprintf("--server.address=:%d", port))
508504
}
509505

506+
if exporterSecure {
507+
command = append(command, "--ssl.keyfile=/secrets/tls/tls.keyfile")
508+
}
509+
510510
return command
511511
}
512512

@@ -561,24 +561,28 @@ func (testCase *testCaseStruct) createTestPodData(deployment *Deployment, group
561561
testCase.ExpectedPod.Spec.Tolerations = deployment.resources.CreatePodTolerations(group, groupSpec)
562562
}
563563

564-
func testCreateExporterContainerWithPort(secure bool, resources core.ResourceRequirements, port uint16) core.Container {
564+
func testCreateExporterContainerWithPortAndSecureEndpoint(secure, exporterSecure bool, resources core.ResourceRequirements, port uint16) core.Container {
565565
var securityContext api.ServerGroupSpecSecurityContext
566566

567567
return core.Container{
568568
Name: k8sutil.ExporterContainerName,
569569
Image: testExporterImage,
570-
Command: createTestExporterCommand(secure, port),
570+
Command: createTestExporterCommand(secure, exporterSecure, port),
571571
Ports: createTestExporterPorts(port),
572572
VolumeMounts: []core.VolumeMount{
573573
k8sutil.ExporterJWTVolumeMount(),
574574
},
575575
Resources: k8sutil.ExtractPodResourceRequirement(resources),
576-
LivenessProbe: createTestExporterLivenessProbe(secure),
576+
LivenessProbe: createTestExporterLivenessProbe(exporterSecure),
577577
ImagePullPolicy: core.PullIfNotPresent,
578578
SecurityContext: securityContext.NewSecurityContext(),
579579
}
580580
}
581581

582+
func testCreateExporterContainerWithPort(secure bool, resources core.ResourceRequirements, port uint16) core.Container {
583+
return testCreateExporterContainerWithPortAndSecureEndpoint(secure, secure, resources, port)
584+
}
585+
582586
func testCreateExporterContainer(secure bool, resources core.ResourceRequirements) core.Container {
583-
return testCreateExporterContainerWithPort(secure, resources, k8sutil.ArangoExporterPort)
587+
return testCreateExporterContainerWithPortAndSecureEndpoint(secure, secure, resources, k8sutil.ArangoExporterPort)
584588
}

‎pkg/deployment/resources/exporter.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -75,7 +75,7 @@ func createExporterArgs(spec api.DeploymentSpec) []string {
7575
k8sutil.OptionPair{Key: "--arangodb.endpoint", Value: scheme + "://localhost:" + strconv.Itoa(k8sutil.ArangoPort)},
7676
)
7777
keyPath := filepath.Join(k8sutil.TLSKeyfileVolumeMountDir, constants.SecretTLSKeyfile)
78-
if spec.IsSecure() {
78+
if spec.IsSecure() && spec.Metrics.IsTLS() {
7979
options = append(options,
8080
k8sutil.OptionPair{Key: "--ssl.keyfile", Value: keyPath},
8181
)

‎pkg/deployment/resources/pod_creator_arangod.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -446,7 +446,7 @@ func (m *MemberArangoDPod) createMetricsExporterSidecar() *core.Container {
446446
}
447447

448448
c := ArangodbExporterContainer(image, args,
449-
createExporterLivenessProbe(m.spec.IsSecure()), m.spec.Metrics.Resources,
449+
createExporterLivenessProbe(m.spec.IsSecure() && m.spec.Metrics.IsTLS()), m.spec.Metrics.Resources,
450450
m.groupSpec.SecurityContext.NewSecurityContext(),
451451
m.spec)
452452

0 commit comments

Comments
 (0)