Skip to content

Commit 5d22595

Browse files
tamalsahatamalsaha
authored
charts: use service-account token secret for ServiceMonitor auth (#50)
Signed-off-by: Tamal Saha <tamal@appscode.com>
1 parent b6519a5 commit 5d22595

25 files changed

+259
-39
lines changed

‎apis/installer/v1alpha1/aws_credential_manager_types.go‎

Lines changed: 7 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -77,13 +77,14 @@ type AwsCredentialManagerSpec struct {
7777
// +optional
7878
LivenessProbe *core.Probe `json:"livenessProbe"`
7979
// +optional
80-
ReadinessProbe *core.Probe `json:"readinessProbe"`
81-
Service ServiceSpec `json:"service"`
82-
ServiceAccount ServiceAccountSpec `json:"serviceAccount"`
83-
Volumes []core.Volume `json:"volumes"`
84-
VolumeMounts []core.VolumeMount `json:"volumeMounts"`
80+
ReadinessProbe *core.Probe `json:"readinessProbe"`
81+
Service ServiceSpec `json:"service"`
82+
ServiceAccount StaticServiceAccountSpec `json:"serviceAccount"`
83+
Volumes []core.Volume `json:"volumes"`
84+
VolumeMounts []core.VolumeMount `json:"volumeMounts"`
8585
// +optional
86-
Distro shared.DistroSpec `json:"distro"`
86+
Distro shared.DistroSpec `json:"distro"`
87+
Monitoring Monitoring `json:"monitoring"`
8788
// +optional
8889
Apiserver AwsCredentialManagerApiserver `json:"apiserver"`
8990
// +optional

‎apis/installer/v1alpha1/gcp_credential_manager_types.go‎

Lines changed: 7 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -77,13 +77,14 @@ type GcpCredentialManagerSpec struct {
7777
// +optional
7878
LivenessProbe *core.Probe `json:"livenessProbe"`
7979
// +optional
80-
ReadinessProbe *core.Probe `json:"readinessProbe"`
81-
Service ServiceSpec `json:"service"`
82-
ServiceAccount ServiceAccountSpec `json:"serviceAccount"`
83-
Volumes []core.Volume `json:"volumes"`
84-
VolumeMounts []core.VolumeMount `json:"volumeMounts"`
80+
ReadinessProbe *core.Probe `json:"readinessProbe"`
81+
Service ServiceSpec `json:"service"`
82+
ServiceAccount StaticServiceAccountSpec `json:"serviceAccount"`
83+
Volumes []core.Volume `json:"volumes"`
84+
VolumeMounts []core.VolumeMount `json:"volumeMounts"`
8585
// +optional
86-
Distro shared.DistroSpec `json:"distro"`
86+
Distro shared.DistroSpec `json:"distro"`
87+
Monitoring Monitoring `json:"monitoring"`
8788
// +optional
8889
Apiserver GcpCredentialManagerApiserver `json:"apiserver"`
8990
// +optional

‎apis/installer/v1alpha1/types.go‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -42,6 +42,12 @@ type ServiceAccountSpec struct {
4242
Annotations map[string]string `json:"annotations"`
4343
}
4444

45+
type StaticServiceAccountSpec struct {
46+
Create bool `json:"create"`
47+
//+optional
48+
Annotations map[string]string `json:"annotations"`
49+
}
50+
4551
// +kubebuilder:validation:Enum=prometheus.io;prometheus.io/operator;prometheus.io/builtin
4652
type MonitoringAgent string
4753

‎apis/installer/v1alpha1/zz_generated.deepcopy.go‎

Lines changed: 24 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎charts/aws-credential-manager/README.md‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -58,7 +58,6 @@ The following table lists the configurable parameters of the `aws-credential-man
5858
| fullnameOverride | | <code>""</code> |
5959
| serviceAccount.create | Specifies whether a service account should be created | <code>true</code> |
6060
| serviceAccount.annotations | Annotations to add to the service account | <code>{}</code> |
61-
| serviceAccount.name | The name of the service account to use. If not set and create is true, a name is generated using the fullname template | <code>""</code> |
6261
| podAnnotations | | <code>{}</code> |
6362
| podLabels | | <code>{}</code> |
6463
| podSecurityContext | | <code>{}</code> |
@@ -97,6 +96,8 @@ The following table lists the configurable parameters of the `aws-credential-man
9796
| apiserver.servingCerts.caCrt | CA certficate used by serving certificate of webhook server. | <code>""</code> |
9897
| apiserver.servingCerts.serverCrt | Serving certficate used by webhook server. | <code>""</code> |
9998
| apiserver.servingCerts.serverKey | Private key for the serving certificate used by webhook server. | <code>""</code> |
99+
| monitoring.agent | Name of monitoring agent (one of "prometheus.io", "prometheus.io/operator", "prometheus.io/builtin") | <code>""</code> |
100+
| monitoring.serviceMonitor.labels | Specify the labels for ServiceMonitor. Prometheus crd will select ServiceMonitor using these labels. Only usable when monitoring agent is `prometheus.io/operator`. | <code>{}</code> |
100101

101102

102103
Specify each parameter using the `--set key=value[,key=value]` argument to `helm upgrade -i`. For example:

‎charts/aws-credential-manager/templates/_helpers.tpl‎

Lines changed: 1 addition & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -54,11 +54,7 @@ app.kubernetes.io/instance: {{ .Release.Name }}
5454
Create the name of the service account to use
5555
*/}}
5656
{{- define "aws-credential-manager.serviceAccountName" -}}
57-
{{- if .Values.serviceAccount.create }}
58-
{{- default (include "aws-credential-manager.fullname" .) .Values.serviceAccount.name }}
59-
{{- else }}
60-
{{- default "default" .Values.serviceAccount.name }}
61-
{{- end }}
57+
aws-credential-manager
6258
{{- end }}
6359

6460
{{/*

‎charts/aws-credential-manager/templates/metrics-token-secret.yaml‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
{{- if eq .Values.monitoring.agent "prometheus.io/operator" }}
2+
apiVersion: v1
3+
kind: Secret
4+
metadata:
5+
name: {{ include "aws-credential-manager.fullname" . }}-metrics-token
6+
namespace: {{ .Release.Namespace }}
7+
labels:
8+
{{- include "aws-credential-manager.labels" . | nindent 4 }}
9+
annotations:
10+
kubernetes.io/service-account.name: {{ include "aws-credential-manager.serviceAccountName" . }}
11+
type: kubernetes.io/service-account-token
12+
{{- end }}

‎charts/aws-credential-manager/templates/serviceaccount.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
apiVersion: v1
33
kind: ServiceAccount
44
metadata:
5-
name: aws-credential-manager
5+
name: {{ include "aws-credential-manager.serviceAccountName" . }}
66
namespace: {{ .Release.Namespace }}
77
labels:
88
{{- include "aws-credential-manager.labels" . | nindent 4 }}

‎charts/aws-credential-manager/templates/servicemonitor.yaml‎

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,37 @@
1+
{{- if eq .Values.monitoring.agent "prometheus.io/operator" }}
2+
apiVersion: monitoring.coreos.com/v1
3+
kind: ServiceMonitor
4+
metadata:
5+
name: {{ include "aws-credential-manager.fullname" . }}
6+
namespace: {{ .Release.Namespace }}
7+
labels:
8+
{{- if .Values.monitoring.serviceMonitor.labels }}
9+
{{- range $key, $val := .Values.monitoring.serviceMonitor.labels }}
10+
{{ $key }}: {{ $val }}
11+
{{- end }}
12+
{{- else }}
13+
{{- include "aws-credential-manager.selectorLabels" . | nindent 4 }}
14+
{{- end }}
15+
spec:
16+
namespaceSelector:
17+
matchNames:
18+
- {{ .Release.Namespace }}
19+
selector:
20+
matchLabels:
21+
{{- include "aws-credential-manager.selectorLabels" . | nindent 6 }}
22+
endpoints:
23+
- targetPort: 9443
24+
authorization:
25+
credentials:
26+
key: token
27+
name: {{ include "aws-credential-manager.fullname" . }}-metrics-token
28+
type: Bearer
29+
path: /metrics
30+
scheme: https
31+
tlsConfig:
32+
ca:
33+
secret:
34+
name: {{ include "aws-credential-manager.fullname" . }}-apiserver-cert
35+
key: ca.crt
36+
serverName: "{{ include "aws-credential-manager.webhookServiceName" . }}.{{ .Release.Namespace }}.svc"
37+
{{- end }}

‎charts/aws-credential-manager/values.openapiv3_schema.yaml‎

Lines changed: 20 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -610,6 +610,25 @@ properties:
610610
format: int32
611611
type: integer
612612
type: object
613+
monitoring:
614+
properties:
615+
agent:
616+
enum:
617+
- prometheus.io
618+
- prometheus.io/operator
619+
- prometheus.io/builtin
620+
type: string
621+
serviceMonitor:
622+
properties:
623+
labels:
624+
additionalProperties:
625+
type: string
626+
type: object
627+
type: object
628+
required:
629+
- agent
630+
- serviceMonitor
631+
type: object
613632
nameOverride:
614633
type: string
615634
nodeSelector:
@@ -912,8 +931,6 @@ properties:
912931
type: object
913932
create:
914933
type: boolean
915-
name:
916-
type: string
917934
required:
918935
- create
919936
type: object
@@ -1774,6 +1791,7 @@ properties:
17741791
type: array
17751792
required:
17761793
- image
1794+
- monitoring
17771795
- replicaCount
17781796
- service
17791797
- serviceAccount

0 commit comments

Comments
 (0)