Skip to content

Commit f524a98

Browse files
author
ZOHARGO
committed
Add Kubernetes secret RBAC support to Helm chart
Add Role and RoleBinding templates for reading Kubernetes secrets. Bump Helm chart version to 0.16.1. Fix service account name resolution in _helpers.tpl. Made-with: Cursor
1 parent fa1cd1a commit f524a98

File tree

4 files changed

+79
-43
lines changed

4 files changed

+79
-43
lines changed

‎helm/Chart.yaml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2,8 +2,8 @@ apiVersion: v2
22
name: sql-exporter
33
description: Database-agnostic SQL exporter for Prometheus
44
type: application
5-
version: 0.16.0
6-
appVersion: 0.20.0
5+
version: 0.17.0
6+
appVersion: 0.21.0
77
keywords:
88
- exporter
99
- servicemonitor

‎helm/README.md‎

Lines changed: 46 additions & 40 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,8 @@
11
# sql-exporter
22

3-
![Version: 0.16.0](https://img.shields.io/badge/Version-0.16.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 0.20.0](https://img.shields.io/badge/AppVersion-0.20.0-informational?style=flat-square)
3+
4+
5+
![Version: 0.17.0](https://img.shields.io/badge/Version-0.17.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 0.21.0](https://img.shields.io/badge/AppVersion-0.21.0-informational?style=flat-square)
46

57
Database-agnostic SQL exporter for Prometheus
68

@@ -14,6 +16,9 @@ Database-agnostic SQL exporter for Prometheus
1416
| ---- | ------ | --- |
1517
| Nikolai Rodionov | <allanger@zohomail.com> | <https://badhouseplants.net> |
1618

19+
20+
21+
1722
## Installing the Chart
1823

1924
To install the chart with the release name `sql-exporter`:
@@ -61,70 +66,71 @@ See the [examples directory](../examples/) for complete configuration examples:
6166

6267
| Key | Type | Default | Description |
6368
|-----|------|---------|-------------|
64-
| commonAnnotations | object | `{}` | Common annotations to add to all the deployed resources |
65-
| commonLabels | object | `{}` | Common labels to add to all deployed resources |
66-
| createConfig | bool | `true` | Set to true to create a config as a part of the helm chart |
67-
| extraContainers | object | `{}` | Arbitrary sidecar containers list |
68-
| extraManifests | list | `[]` | Arbitrary manifests list |
69+
| nameOverride | string | `""` | Provide a name in place of `sql-exporter` |
6970
| fullnameOverride | string | `""` | String to fully override "sql-exporter.fullname" |
70-
| image.pullPolicy | string | `"IfNotPresent"` | Image pull policy |
71+
| commonLabels | object | `{}` | Common labels to add to all deployed resources |
72+
| commonAnnotations | object | `{}` | Common annotations to add to all the deployed resources |
7173
| image.repository | string | `"burningalchemist/sql_exporter"` | Image repository |
74+
| image.pullPolicy | string | `"IfNotPresent"` | Image pull policy |
7275
| image.tag | string | `appVersion` value from `Chart.yaml` | Image tag |
7376
| imagePullSecrets | list | `[]` | Secrets with credentials to pull images from a private registry |
74-
| ingress.annotations | object | `{}` | Ingress annotations |
77+
| service.type | string | `"ClusterIP"` | Service type |
78+
| service.labels | object | `{}` | Service labels |
79+
| service.annotations | object | `{}` | Service annotations |
7580
| ingress.enabled | bool | `false` | |
76-
| ingress.host | string | `""` | Ingress host |
77-
| ingress.ingressClassName | string | `""` | Ingress class name |
7881
| ingress.labels | object | `{}` | Ingress labels |
82+
| ingress.annotations | object | `{}` | Ingress annotations |
83+
| ingress.ingressClassName | string | `""` | Ingress class name |
84+
| ingress.host | string | `""` | Ingress host |
7985
| ingress.path | string | `"/"` | Ingress path |
8086
| ingress.tls | object | `{"crt":"","enabled":false,"key":"","secretName":""}` | Ingress TLS, can be defined by cert secret, or by key and cert. |
87+
| ingress.tls.secretName | string | `""` | Ingress tls secret if already exists. |
8188
| ingress.tls.crt | string | `""` | Ingress tls.crt, required if you don't have secret name. |
8289
| ingress.tls.key | string | `""` | Ingress tls.key, required if you don't have secret name. |
83-
| ingress.tls.secretName | string | `""` | Ingress tls secret if already exists. |
90+
| extraContainers | object | `{}` | Arbitrary sidecar containers list |
8491
| initContainers | object | `{}` | Arbitrary sidecar containers list for 1.29+ kubernetes |
85-
| logFormat | string | `"logfmt"` | Set log format (logfmt if unset) |
86-
| logLevel | string | `"info"` | Set log level (info if unset) |
87-
| nameOverride | string | `""` | Provide a name in place of `sql-exporter` |
88-
| podAnnotations | object | `{}` | Pod annotations |
92+
| extraManifests | list | `[]` | Arbitrary manifests list |
93+
| serviceAccount.create | bool | `true` | Specifies whether a Service Account should be created, creates "sql-exporter" service account if true, unless overriden. Otherwise, set to `default` if false, and custom service account name is not provided. Check all the available parameters. |
94+
| serviceAccount.annotations | object | `{}` | Annotations to add to the Service Account |
95+
| resources | object | `{}` | Resource limits and requests for the application controller pods |
8996
| podLabels | object | `{}` | Pod labels |
97+
| podAnnotations | object | `{}` | Pod annotations |
9098
| podSecurityContext | object | `{}` | Pod security context |
91-
| reloadEnabled | bool | `false` | Enable reload collector data handler (endpoint /reload) |
92-
| resources | object | `{}` | Resource limits and requests for the application controller pods |
93-
| service.annotations | object | `{}` | Service annotations |
94-
| service.labels | object | `{}` | Service labels |
95-
| service.type | string | `"ClusterIP"` | Service type |
96-
| serviceAccount.annotations | object | `{}` | Annotations to add to the Service Account |
97-
| serviceAccount.create | bool | `true` | Specifies whether a Service Account should be created, creates "sql-exporter" service account if true, unless overriden. Otherwise, set to `default` if false, and custom service account name is not provided. Check all the available parameters. |
99+
| createConfig | bool | `true` | Set to true to create a config as a part of the helm chart |
100+
| logLevel | string | `"info"` | Set log level (info if unset) |
101+
| logFormat | string | `"logfmt"` | Set log format (logfmt if unset) |
98102
| webConfig | object | `{"basicAuth":{"bcryptCost":12,"enabled":false,"initFromSecret":{"enabled":false,"image":"httpd:alpine","imagePullPolicy":"IfNotPresent","secretKey":"password","secretName":""},"username":"prometheus","users":{}},"enabled":false,"template":"","tls":{"certFile":"tls.crt","certKey":"tls.crt","keyFile":"tls.key","keyKey":"tls.key","secretName":""}}` | Enable and configure Prometheus web config file support web-config.yml is automatically placed at /etc/sql_exporter/web-config.yml |
103+
| webConfig.template | string | `""` | Template for web-config content (Exporter Toolkit format). Set to empty string to use default template (defined in _helpers.tpl) Default: TLS 1.3 with AES-GCM cipher suites, uses cert from webConfig.tls.secretName You can override with your own YAML string here if needed |
104+
| webConfig.tls | object | `{"certFile":"tls.crt","certKey":"tls.crt","keyFile":"tls.key","keyKey":"tls.key","secretName":""}` | TLS configuration for web-config |
105+
| webConfig.tls.secretName | string | `""` | Optional secret that holds tls.crt/tls.key. When set, it is mounted and used by web-config. |
106+
| webConfig.tls.certKey | string | `"tls.crt"` | Key name within the secret for certificate |
107+
| webConfig.tls.keyKey | string | `"tls.key"` | Key name within the secret for key |
108+
| webConfig.tls.certFile | string | `"tls.crt"` | Filename to project the certificate into the container |
109+
| webConfig.tls.keyFile | string | `"tls.key"` | Filename to project the key into the container |
99110
| webConfig.basicAuth | object | `{"bcryptCost":12,"enabled":false,"initFromSecret":{"enabled":false,"image":"httpd:alpine","imagePullPolicy":"IfNotPresent","secretKey":"password","secretName":""},"username":"prometheus","users":{}}` | Basic authentication configuration for web-config |
100-
| webConfig.basicAuth.bcryptCost | int | `12` | Bcrypt cost used when hashing via initFromSecret |
101111
| webConfig.basicAuth.enabled | bool | `false` | Enable basic auth in web-config; passwords must be bcrypt hashes |
112+
| webConfig.basicAuth.username | string | `"prometheus"` | Username to protect /metrics |
113+
| webConfig.basicAuth.bcryptCost | int | `12` | Bcrypt cost used when hashing via initFromSecret |
114+
| webConfig.basicAuth.users | object | `{}` | Map of username: bcryptHash (when not using initFromSecret) |
102115
| webConfig.basicAuth.initFromSecret | object | `{"enabled":false,"image":"httpd:alpine","imagePullPolicy":"IfNotPresent","secretKey":"password","secretName":""}` | Initialize basic auth from plaintext secret using bcrypt |
103116
| webConfig.basicAuth.initFromSecret.enabled | bool | `false` | Use an initContainer to read plaintext from a secret and bcrypt it into web-config |
117+
| webConfig.basicAuth.initFromSecret.secretName | string | `""` | Secret name containing plaintext password |
118+
| webConfig.basicAuth.initFromSecret.secretKey | string | `"password"` | Key in the secret that contains plaintext password |
104119
| webConfig.basicAuth.initFromSecret.image | string | `"httpd:alpine"` | Image used for bcrypt hashing (httpd:alpine has htpasswd at /usr/local/apache2/bin/htpasswd) |
105120
| webConfig.basicAuth.initFromSecret.imagePullPolicy | string | `"IfNotPresent"` | Image pull policy for bcrypt hashing image |
106-
| webConfig.basicAuth.initFromSecret.secretKey | string | `"password"` | Key in the secret that contains plaintext password |
107-
| webConfig.basicAuth.initFromSecret.secretName | string | `""` | Secret name containing plaintext password |
108-
| webConfig.basicAuth.username | string | `"prometheus"` | Username to protect /metrics |
109-
| webConfig.basicAuth.users | object | `{}` | Map of username: bcryptHash (when not using initFromSecret) |
110-
| webConfig.template | string | `""` | Template for web-config content (Exporter Toolkit format). Set to empty string to use default template (defined in _helpers.tpl) Default: TLS 1.3 with AES-GCM cipher suites, uses cert from webConfig.tls.secretName You can override with your own YAML string here if needed |
111-
| webConfig.tls | object | `{"certFile":"tls.crt","certKey":"tls.crt","keyFile":"tls.key","keyKey":"tls.key","secretName":""}` | TLS configuration for web-config |
112-
| webConfig.tls.certFile | string | `"tls.crt"` | Filename to project the certificate into the container |
113-
| webConfig.tls.certKey | string | `"tls.crt"` | Key name within the secret for certificate |
114-
| webConfig.tls.keyFile | string | `"tls.key"` | Filename to project the key into the container |
115-
| webConfig.tls.keyKey | string | `"tls.key"` | Key name within the secret for key |
116-
| webConfig.tls.secretName | string | `""` | Optional secret that holds tls.crt/tls.key. When set, it is mounted and used by web-config. |
121+
| reloadEnabled | bool | `false` | Enable reload collector data handler (endpoint /reload) |
122+
117123

118124
### Prometheus ServiceMonitor
119125

120126
| Key | Type | Default | Description |
121127
|-----|------|---------|-------------|
122128
| serviceMonitor.enabled | bool | `true` | Enable ServiceMonitor |
123129
| serviceMonitor.interval | string | `"15s"` | ServiceMonitor interval |
124-
| serviceMonitor.metricRelabelings | object | `{}` | ServiceMonitor metric relabelings |
125-
| serviceMonitor.namespace | string | `nil` | ServiceMonitor namespace override (default is .Release.Namespace) |
126130
| serviceMonitor.path | string | `"/metrics"` | ServiceMonitor path |
131+
| serviceMonitor.metricRelabelings | object | `{}` | ServiceMonitor metric relabelings |
127132
| serviceMonitor.relabelings | object | `{}` | ServiceMonitor relabelings |
133+
| serviceMonitor.namespace | string | `nil` | ServiceMonitor namespace override (default is .Release.Namespace) |
128134
| serviceMonitor.selector | object | `{}` | Additional labels for ServiceMonitor (for Prometheus serviceMonitorSelector matching) Example: selector: { monitored: dox-prometheus } |
129135
| serviceMonitor.scrapeTimeout | string | `nil` | ServiceMonitor scrape timeout |
130136

@@ -133,13 +139,13 @@ See the [examples directory](../examples/) for complete configuration examples:
133139
| Key | Type | Default | Description |
134140
|-----|------|---------|-------------|
135141
| config | object | `{"global":{"max_connections":3,"max_idle_connections":3,"min_interval":"0s","scrape_error_drop_interval":"0s","scrape_timeout":"10s","scrape_timeout_offset":"500ms","warmup_delay":"0s"}}` | SQL Exporter configuration, can be a dictionary, or a template yaml string. |
136-
| config.global.max_connections | int | `3` | Number of open connections. |
137-
| config.global.max_idle_connections | int | `3` | Number of idle connections. |
138-
| config.global.min_interval | string | `"0s"` | Minimum interval between collector runs. |
139-
| config.global.scrape_error_drop_interval | string | `"0s"` | Interval between dropping scrape_errors_total metric: by default the metric is persistent. |
140142
| config.global.scrape_timeout | string | `"10s"` | Scrape timeout |
141143
| config.global.scrape_timeout_offset | string | `"500ms"` | Scrape timeout offset. Must be strictly positive. |
144+
| config.global.scrape_error_drop_interval | string | `"0s"` | Interval between dropping scrape_errors_total metric: by default the metric is persistent. |
145+
| config.global.min_interval | string | `"0s"` | Minimum interval between collector runs. |
142146
| config.global.warmup_delay | string | `"0s"` | Delay between collector scrapes during the startup cache warmup. Disabled by default. |
147+
| config.global.max_connections | int | `3` | Number of open connections. |
148+
| config.global.max_idle_connections | int | `3` | Number of idle connections. |
143149
| target | object | `nil` | Check documentation. Mutually exclusive with `jobs` |
144150
| jobs | list | `nil` | Check documentation. Mutually exclusive with `target` |
145151
| collector_files | list | `[]` | Check documentation |

‎helm/templates/_helpers.tpl‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -77,7 +77,11 @@ Common annotations
7777
Create the name of the service account to use
7878
*/}}
7979
{{- define "sql-exporter.serviceAccountName" -}}
80-
{{- dig "serviceAccount" "name" "default" .Values }}
80+
{{- if .Values.serviceAccount.create -}}
81+
{{ default (include "sql-exporter.fullname" .) .Values.serviceAccount.name }}
82+
{{- else -}}
83+
{{ default "default" .Values.serviceAccount.name }}
84+
{{- end -}}
8185
{{- end }}
8286

8387
{{- define "sql-exporter.volumes" -}}

‎helm/templates/serviceaccount.yaml‎

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -14,4 +14,30 @@ metadata:
1414
{{- toYaml . | nindent 4 }}
1515
{{- end }}
1616
automountServiceAccountToken: {{ default "false" .Values.serviceAccount.automountServiceAccountToken }}
17+
---
18+
apiVersion: rbac.authorization.k8s.io/v1
19+
kind: Role
20+
metadata:
21+
name: {{ template "sql-exporter.fullname" . }}-secret-reader
22+
labels:
23+
{{- include "sql-exporter.labels" . | nindent 4 }}
24+
rules:
25+
- apiGroups: [""]
26+
resources: ["secrets"]
27+
verbs: ["get"]
28+
---
29+
apiVersion: rbac.authorization.k8s.io/v1
30+
kind: RoleBinding
31+
metadata:
32+
name: {{ template "sql-exporter.fullname" . }}-secret-reader
33+
labels:
34+
{{- include "sql-exporter.labels" . | nindent 4 }}
35+
roleRef:
36+
apiGroup: rbac.authorization.k8s.io
37+
kind: Role
38+
name: {{ template "sql-exporter.fullname" . }}-secret-reader
39+
subjects:
40+
- kind: ServiceAccount
41+
name: {{ template "sql-exporter.fullname" . }}
42+
namespace: {{ .Release.Namespace }}
1743
{{- end }}

0 commit comments

Comments
 (0)