Skip to content

Commit 985c827

Browse files
jkremserCopilot
jkremser
and
Copilot
authored
Complex pipeline where evertything is TLS encrypted and certs are rotated (#157)
* Complex pipeline where evertything is TLS encrypted and certs are rotated Signed-off-by: Jirka Kremser <jiri.kremser@gmail.com> * Update examples/pipelines-tls/setup.sh Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * Update examples/vllm/setup.sh Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * Update examples/otel-operator/setup.sh Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> Signed-off-by: Jirka Kremser <jiri.kremser@gmail.com> * Update dashboard and add SSL comm betweek KEDA and OTel Scaler Signed-off-by: Jirka Kremser <jiri.kremser@gmail.com> --------- Signed-off-by: Jirka Kremser <jiri.kremser@gmail.com> Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
1 parent e0a9ff5 commit 985c827

23 files changed

+1451
-43
lines changed

‎examples/otel-operator/setup.sh‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,10 @@ DIR="${DIR:-$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )}"
44
#export PR_BRANCH=
55
#export GH_PAT=
66

7-
command -v figlet &> /dev/null && figlet -w155 OTel Operator + GitHub receiver
7+
command -v figlet &> /dev/null && {
8+
__wid=$(/usr/bin/tput cols) && _wid=$((__wid<155?__wid:155))
9+
figlet -w${_wid} OTel Operator + GitHub receiver
10+
}
811
[ -z "${PR_BRANCH}" ] && echo "Set PR_BRANCH env variable to a branch name from which a PR is opened against kedify/otel-add-on repo" && exit 1
912
[ -z "${GH_PAT}" ] && echo "Set GH_PAT env variable to a PAT token that has read permissions for content on kedify/otel-add-on repo" && exit 1
1013

‎examples/pipelines-tls/architecture-simple.mermaid‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
%% mermaid-ascii -f architecture-simple.mermaid -x 18 > architecture.ascii
2+
3+
graph LR
4+
classDef red color:#ff0000
5+
nginxN -->|OTLP/gRPC| router:::red
6+
router:::red -->|Remote-Write| Prometheus
7+
router:::red -->|OTLP/gRPC| KEDA-Scaler
8+
Prometheus -->|HTTP| Grafana
9+
KEDA-Scaler -->|gRPC| KEDA
10+
11+
OTelOperator

‎examples/pipelines-tls/architecture.ascii‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
┌──────────────┐ ┌───────────┐ ┌─────────────┐ ┌─────────┐
2+
│ │ │ │ │ │ │ │
3+
│ nginxN ├────OTLP/gRPC────►│ router ├──Remote-Write───►│ Prometheus ├──────HTTP───────►│ Grafana │
4+
│ │ │ │ │ │ │ │
5+
└──────────────┘ └─────┬─────┘ └─────────────┘ └─────────┘
6+
│
7+
│
8+
│
9+
OTLP/gRPC
10+
│
11+
┌──────────────┐ │ ┌─────────────┐ ┌─────────┐
12+
│ │ │ │ │ │ │
13+
│ OTelOperator │ └───────────────────────►│ KEDA-Scaler ├──────gRPC───────►│ KEDA │
14+
│ │ │ │ │ │
15+
└──────────────┘ └─────────────┘ └─────────┘
16+

‎examples/pipelines-tls/architecture.mermaid‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
%% mmdc -i architecture.mermaid -o architecture.svg
2+
3+
graph LR
4+
subgraph workloads
5+
1
6+
2
7+
3
8+
end
9+
1(nginx1) & 2(nginx2) & 3(nginxN) --OTLP/gRPC--> R{router}
10+
R --OTLP/gRPC--> KS(KEDA Scaler)
11+
KS <--gRPC--> K[KEDA]
12+
R --Remote-Write--> P[Prometheus]
13+
P ~~~ G[Grafana] <--HTTP--> P
14+
G ~~~ P

‎examples/pipelines-tls/architecture.svg‎

Lines changed: 1 addition & 0 deletions
Loading

‎examples/pipelines-tls/certs.yaml‎

Lines changed: 169 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,169 @@
1+
apiVersion: cert-manager.io/v1
2+
kind: ClusterIssuer
3+
metadata:
4+
name: keda-otel-root-ca-issuer-selfsigned
5+
spec:
6+
selfSigned: {}
7+
---
8+
# kubectl get secret keda-otel-root-ca-secret -n cert-manager -o jsonpath='{.data.tls\.crt}' | base64 --decode | openssl x509 -noout -text
9+
apiVersion: cert-manager.io/v1
10+
kind: Certificate
11+
metadata:
12+
name: keda-otel-root-ca-cert
13+
namespace: cert-manager
14+
spec:
15+
isCA: true
16+
commonName: keda-otel-root-ca
17+
secretName: keda-otel-root-ca-secret
18+
duration: 87600h # 10y
19+
renewBefore: 78840h # 9y
20+
privateKey:
21+
rotationPolicy: Always
22+
algorithm: ECDSA
23+
size: 256
24+
issuerRef:
25+
name: keda-otel-root-ca-issuer-selfsigned
26+
kind: ClusterIssuer
27+
group: cert-manager.io
28+
---
29+
apiVersion: cert-manager.io/v1
30+
kind: ClusterIssuer
31+
metadata:
32+
name: keda-otel-ca-issuer
33+
spec:
34+
ca:
35+
secretName: keda-otel-root-ca-secret
36+
---
37+
# this CR will make sure the CA cert is available in all k8s namespaces
38+
# if we don't want to expose the root CA directly, we would create an intermediate CA signed by root CA and expose
39+
# this one to a sub set of services
40+
apiVersion: trust.cert-manager.io/v1alpha1
41+
kind: Bundle
42+
metadata:
43+
name: keda-otel-root-ca-bundle
44+
namespace: cert-manager
45+
spec:
46+
sources:
47+
- useDefaultCAs: false
48+
- secret:
49+
name: keda-otel-root-ca-secret
50+
key: "tls.crt"
51+
target:
52+
secret:
53+
key: "rootCA.crt"
54+
---
55+
# CERTS:
56+
apiVersion: cert-manager.io/v1
57+
kind: Certificate
58+
metadata:
59+
name: router-collector-cert
60+
namespace: observability
61+
spec:
62+
secretName: router-collector-cert-secret
63+
duration: 1h
64+
renewBefore: 45m
65+
privateKey:
66+
rotationPolicy: Always
67+
usages:
68+
- server auth
69+
- client auth
70+
dnsNames:
71+
- "router-collector.observability.svc.cluster.local"
72+
- "router-collector.observability.svc"
73+
- "router-collector"
74+
issuerRef:
75+
name: keda-otel-root-ca-issuer-selfsigned
76+
kind: ClusterIssuer
77+
group: cert-manager.io
78+
---
79+
apiVersion: cert-manager.io/v1
80+
kind: Certificate
81+
metadata:
82+
name: sidecar-collector-cert
83+
namespace: app
84+
spec:
85+
secretName: sidecar-collector-cert-secret
86+
duration: 1h
87+
renewBefore: 45m
88+
privateKey:
89+
rotationPolicy: Always
90+
usages:
91+
- server auth
92+
- client auth
93+
dnsNames:
94+
- "nginx.app.svc.cluster.local"
95+
- "nginx.app.svc"
96+
- "nginx"
97+
issuerRef:
98+
name: keda-otel-root-ca-issuer-selfsigned
99+
kind: ClusterIssuer
100+
group: cert-manager.io
101+
---
102+
apiVersion: cert-manager.io/v1
103+
kind: Certificate
104+
metadata:
105+
name: keda-otel-scaler-cert
106+
namespace: keda
107+
spec:
108+
secretName: keda-otel-scaler-cert-secret
109+
duration: 1h
110+
renewBefore: 45m
111+
privateKey:
112+
rotationPolicy: Always
113+
usages:
114+
- server auth
115+
- client auth
116+
dnsNames:
117+
- "keda-otel-scaler.keda.svc.cluster.local"
118+
- "keda-otel-scaler.keda.svc"
119+
- "keda-otel-scaler"
120+
issuerRef:
121+
name: keda-otel-root-ca-issuer-selfsigned
122+
kind: ClusterIssuer
123+
group: cert-manager.io
124+
---
125+
apiVersion: cert-manager.io/v1
126+
kind: Certificate
127+
metadata:
128+
name: prometheus-cert
129+
namespace: observability
130+
spec:
131+
secretName: prometheus-cert-secret
132+
duration: 1h
133+
renewBefore: 45m
134+
privateKey:
135+
rotationPolicy: Always
136+
usages:
137+
- server auth
138+
- client auth
139+
dnsNames:
140+
- "prometheus.observability.svc.cluster.local"
141+
- "prometheus.observability.svc"
142+
- "prometheus"
143+
issuerRef:
144+
name: keda-otel-root-ca-issuer-selfsigned
145+
kind: ClusterIssuer
146+
group: cert-manager.io
147+
---
148+
apiVersion: cert-manager.io/v1
149+
kind: Certificate
150+
metadata:
151+
name: grafana-cert
152+
namespace: observability
153+
spec:
154+
secretName: grafana-cert-secret
155+
duration: 1h
156+
renewBefore: 45m
157+
privateKey:
158+
rotationPolicy: Always
159+
usages:
160+
- server auth
161+
- client auth
162+
dnsNames:
163+
- "grafana.observability.svc.cluster.local"
164+
- "grafana.observability.svc"
165+
- "grafana"
166+
issuerRef:
167+
name: keda-otel-root-ca-issuer-selfsigned
168+
kind: ClusterIssuer
169+
group: cert-manager.io

0 commit comments

Comments
 (0)