Skip to content

NETOBSERV-2225 - Deploy static plugin at operator startup #1345

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 2 commits into from
Jul 24, 2025
+490 −130
Merged

NETOBSERV-2225 - Deploy static plugin at operator startup #1345

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
43c5e6c
always create console plugin
jpinsonneau Jul 15, 2025
9bb32d1
namespace env at the end of the list for CI
jpinsonneau Jul 18, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 2 additions & 1 deletion .mk/local.mk
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -50,7 +50,8 @@ local-deploy-operator:
go run ./main.go \
-ebpf-agent-image=quay.io/netobserv/netobserv-ebpf-agent:main \
-flowlogs-pipeline-image=quay.io/netobserv/flowlogs-pipeline:main \
-console-plugin-image=quay.io/netobserv/network-observability-console-plugin:main &
-console-plugin-image=quay.io/netobserv/network-observability-console-plugin:main \
-namespace=${NAMESPACE} &
@echo "====> Waiting for flowlogs-pipeline pod to be ready"
while : ; do kubectl get ds flowlogs-pipeline && break; sleep 1; done
kubectl wait --timeout=180s --for=condition=ready pod -l app=flowlogs-pipeline
Expand Down
3 changes: 2 additions & 1 deletion .mk/ocp.mk
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -35,7 +35,8 @@ ocp-deploy-operator: ## run flp from the operator
go run ./main.go \
-ebpf-agent-image=quay.io/netobserv/netobserv-ebpf-agent:main \
-flowlogs-pipeline-image=quay.io/netobserv/flowlogs-pipeline:main \
-console-plugin-image=quay.io/netobserv/network-observability-console-plugin:main
-console-plugin-image=quay.io/netobserv/network-observability-console-plugin:main \
-namespace=${NAMESPACE}

.PHONY: undeploy-operator
undeploy-operator: ## stop the operator locally
Expand Down
5 changes: 5 additions & 0 deletions bundle/manifests/netobserv-operator.clusterserviceversion.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1243,6 +1243,7 @@ spec:
- --flowlogs-pipeline-image=$(RELATED_IMAGE_FLOWLOGS_PIPELINE)
- --console-plugin-image=$(RELATED_IMAGE_CONSOLE_PLUGIN)
- --console-plugin-compat-image=$(RELATED_IMAGE_CONSOLE_PLUGIN_COMPAT)
- --namespace=$(NAMESPACE)
- --downstream-deployment=$(DOWNSTREAM_DEPLOYMENT)
- --profiling-bind-address=$(PROFILING_BIND_ADDRESS)
- --metrics-cert-file=/etc/tls/private/tls.crt
Expand All @@ -1258,6 +1259,10 @@ spec:
value: quay.io/netobserv/network-observability-console-plugin:v1.9.1-community
- name: RELATED_IMAGE_CONSOLE_PLUGIN_COMPAT
value: quay.io/netobserv/network-observability-console-plugin-pf4:v1.8.2-community
- name: NAMESPACE
valueFrom:
fieldRef:
fieldPath: metadata.namespace
Comment on lines +1265 to +1268
Copy link
Member

@memodi memodi Jul 16, 2025 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@jpinsonneau - can we append this env var instead of adding it in middle so that index # for the existing vars doesn't change? We have several scripts and CI steps where we patch csv which happens based on index of env var.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Sure, I cant put it in the end of the list if it help 😸

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

9bb32d1

- name: DOWNSTREAM_DEPLOYMENT
value: "false"
- name: PROFILING_BIND_ADDRESS
Expand Down
5 changes: 5 additions & 0 deletions config/manager/manager.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -28,6 +28,7 @@ spec:
- --flowlogs-pipeline-image=$(RELATED_IMAGE_FLOWLOGS_PIPELINE)
- --console-plugin-image=$(RELATED_IMAGE_CONSOLE_PLUGIN)
- --console-plugin-compat-image=$(RELATED_IMAGE_CONSOLE_PLUGIN_COMPAT)
- --namespace=$(NAMESPACE)
- --downstream-deployment=$(DOWNSTREAM_DEPLOYMENT)
- --profiling-bind-address=$(PROFILING_BIND_ADDRESS)
env:
Expand All @@ -39,6 +40,10 @@ spec:
value: quay.io/netobserv/network-observability-console-plugin:v1.9.1-community
- name: RELATED_IMAGE_CONSOLE_PLUGIN_COMPAT
value: quay.io/netobserv/network-observability-console-plugin-pf4:v1.8.2-community
- name: NAMESPACE
valueFrom:
fieldRef:
fieldPath: metadata.namespace
- name: DOWNSTREAM_DEPLOYMENT
value: "false"
- name: PROFILING_BIND_ADDRESS
Expand Down
5 changes: 5 additions & 0 deletions helm/templates/deployment.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -27,6 +27,7 @@ spec:
- --flowlogs-pipeline-image=$(RELATED_IMAGE_FLOWLOGS_PIPELINE)
- --console-plugin-image=$(RELATED_IMAGE_CONSOLE_PLUGIN)
- --console-plugin-compat-image=$(RELATED_IMAGE_CONSOLE_PLUGIN_COMPAT)
- --namespace=$(NAMESPACE)
- --downstream-deployment=$(DOWNSTREAM_DEPLOYMENT)
- --profiling-bind-address=$(PROFILING_BIND_ADDRESS)
- --metrics-cert-file=/etc/tls/private/tls.crt
Expand All @@ -40,6 +41,10 @@ spec:
value: '{{ .Values.flowlogsPipeline.image }}:{{ .Values.flowlogsPipeline.version }}'
- name: RELATED_IMAGE_CONSOLE_PLUGIN
value: '{{ if .Values.standaloneConsole.enable }}{{ .Values.standaloneConsole.image }}:{{ .Values.standaloneConsole.version }}{{ else }}{{ .Values.consolePlugin.image }}:{{ .Values.consolePlugin.version }}{{ end }}'
- name: NAMESPACE
valueFrom:
fieldRef:
fieldPath: metadata.namespace
- name: DOWNSTREAM_DEPLOYMENT
value: "false"
- name: PROFILING_BIND_ADDRESS
Expand Down
87 changes: 45 additions & 42 deletions internal/controller/consoleplugin/consoleplugin_objects.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -31,8 +31,6 @@ import (
"github.com/netobserv/network-observability-operator/internal/pkg/volumes"
)

const secretName = "console-serving-cert"
const displayName = "NetObserv plugin"
const proxyAlias = "backend"

const configMapName = "console-plugin-config"
Expand All @@ -53,7 +51,7 @@ type builder struct {
volumes volumes.Builder
}

func newBuilder(info *reconcilers.Instance, desired *flowslatest.FlowCollectorSpec) builder {
func newBuilder(info *reconcilers.Instance, desired *flowslatest.FlowCollectorSpec, name string) builder {
imageToUse := reconcilers.MainImage
needsPF4, err := info.ClusterInfo.IsOpenShiftVersionLessThan("4.15.0")
if err == nil && needsPF4 {
Expand All @@ -66,28 +64,28 @@ func newBuilder(info *reconcilers.Instance, desired *flowslatest.FlowCollectorSp
info: info,
imageRef: imageToUse,
labels: map[string]string{
"app": constants.PluginName,
"app": name,
"version": helper.MaxLabelLength(version),
},
selector: map[string]string{
"app": constants.PluginName,
"app": name,
},
desired: desired,
advanced: &advanced,
}
}

func (b *builder) consolePlugin() *osv1.ConsolePlugin {
func (b *builder) consolePlugin(name, displayName string) *osv1.ConsolePlugin {
return &osv1.ConsolePlugin{
ObjectMeta: metav1.ObjectMeta{
Name: constants.PluginName,
Name: name,
},
Spec: osv1.ConsolePluginSpec{
DisplayName: displayName,
Backend: osv1.ConsolePluginBackend{
Type: osv1.Service,
Service: &osv1.ConsolePluginService{
Name: constants.PluginName,
Name: name,
Namespace: b.info.Namespace,
Port: *b.advanced.Port,
BasePath: "/"},
Expand All @@ -97,7 +95,7 @@ func (b *builder) consolePlugin() *osv1.ConsolePlugin {
Endpoint: osv1.ConsolePluginProxyEndpoint{
Type: osv1.ProxyTypeService,
Service: &osv1.ConsolePluginProxyServiceConfig{
Name: constants.PluginName,
Name: name,
Namespace: b.info.Namespace,
Port: *b.advanced.Port}},
Alias: proxyAlias,
Expand Down Expand Up @@ -139,14 +137,14 @@ func (b *builder) serviceMonitor() *monitoringv1.ServiceMonitor {
Cert: monitoringv1.SecretOrConfigMap{
Secret: &corev1.SecretKeySelector{
LocalObjectReference: corev1.LocalObjectReference{
Name: secretName,
Name: fmt.Sprintf("%s-cert", constants.PluginName),
},
Key: "tls.crt",
},
},
KeySecret: &corev1.SecretKeySelector{
LocalObjectReference: corev1.LocalObjectReference{
Name: secretName,
Name: fmt.Sprintf("%s-cert", constants.PluginName),
},
Key: "tls.key",
},
Expand All @@ -168,10 +166,10 @@ func (b *builder) serviceMonitor() *monitoringv1.ServiceMonitor {
}
}

func (b *builder) deployment(cmDigest string) *appsv1.Deployment {
func (b *builder) deployment(name, cmDigest string) *appsv1.Deployment {
return &appsv1.Deployment{
ObjectMeta: metav1.ObjectMeta{
Name: constants.PluginName,
Name: name,
Namespace: b.info.Namespace,
Labels: b.labels,
},
Expand All @@ -180,14 +178,27 @@ func (b *builder) deployment(cmDigest string) *appsv1.Deployment {
Selector: &metav1.LabelSelector{
MatchLabels: b.selector,
},
Template: *b.podTemplate(cmDigest),
Template: *b.podTemplate(name, cmDigest),
},
}
}

func (b *builder) podTemplate(cmDigest string) *corev1.PodTemplateSpec {
volumes := []corev1.Volume{
{
func (b *builder) podTemplate(name, cmDigest string) *corev1.PodTemplateSpec {
var sa string
annotations := map[string]string{}
args := []string{
"-loglevel", b.desired.ConsolePlugin.LogLevel,
}
volumes := []corev1.Volume{}
volumeMounts := []corev1.VolumeMount{}

if cmDigest != "" {
sa = name
annotations[constants.PodConfigurationDigest] = cmDigest

args = append(args, "-config", filepath.Join(configPath, configFile))

volumes = append(volumes, corev1.Volume{
Name: configVolume,
VolumeSource: corev1.VolumeSource{
ConfigMap: &corev1.ConfigMapVolumeSource{
Expand All @@ -196,57 +207,49 @@ func (b *builder) podTemplate(cmDigest string) *corev1.PodTemplateSpec {
},
},
},
},
}
})

volumeMounts := []corev1.VolumeMount{
{
volumeMounts = append(volumeMounts, corev1.VolumeMount{
Name: configVolume,
MountPath: configPath,
ReadOnly: true,
},
})
}

if !helper.UseTestConsolePlugin(b.desired) {
volumes = append(volumes, corev1.Volume{
Name: secretName,
Name: fmt.Sprintf("%s-cert", name),
VolumeSource: corev1.VolumeSource{
Secret: &corev1.SecretVolumeSource{
SecretName: secretName,
SecretName: fmt.Sprintf("%s-cert", name),
},
},
})
volumeMounts = append(volumeMounts, corev1.VolumeMount{
Name: secretName,
Name: fmt.Sprintf("%s-cert", name),
MountPath: "/var/serving-cert",
ReadOnly: true,
})
}

return &corev1.PodTemplateSpec{
ObjectMeta: metav1.ObjectMeta{
Labels: b.labels,
Annotations: map[string]string{
constants.PodConfigurationDigest: cmDigest,
},
Labels: b.labels,
Annotations: annotations,
},
Spec: corev1.PodSpec{
Containers: []corev1.Container{{
Name: constants.PluginName,
Name: name,
Image: b.info.Images[b.imageRef],
ImagePullPolicy: corev1.PullPolicy(b.desired.ConsolePlugin.ImagePullPolicy),
Resources: *b.desired.ConsolePlugin.Resources.DeepCopy(),
VolumeMounts: b.volumes.AppendMounts(volumeMounts),
Env: []corev1.EnvVar{constants.EnvNoHTTP2},
Args: []string{

"-loglevel", b.desired.ConsolePlugin.LogLevel,
"-config", filepath.Join(configPath, configFile),
},
Args: args,
SecurityContext: helper.ContainerDefaultSecurityContext(),
}},
Volumes: b.volumes.AppendVolumes(volumes),
ServiceAccountName: constants.PluginName,
ServiceAccountName: sa,
NodeSelector: b.advanced.Scheduling.NodeSelector,
Tolerations: b.advanced.Scheduling.Tolerations,
Affinity: b.advanced.Scheduling.Affinity,
Expand Down Expand Up @@ -275,14 +278,14 @@ func (b *builder) autoScaler() *ascv2.HorizontalPodAutoscaler {
}
}

func (b *builder) mainService() *corev1.Service {
func (b *builder) mainService(name string) *corev1.Service {
return &corev1.Service{
ObjectMeta: metav1.ObjectMeta{
Name: constants.PluginName,
Name: name,
Namespace: b.info.Namespace,
Labels: b.labels,
Annotations: map[string]string{
constants.OpenShiftCertificateAnnotation: "console-serving-cert",
constants.OpenShiftCertificateAnnotation: fmt.Sprintf("%s-cert", name),
},
},
Spec: corev1.ServiceSpec{
Expand Down Expand Up @@ -550,13 +553,13 @@ func (b *builder) configMap(ctx context.Context) (*corev1.ConfigMap, string, err
return &configMap, digest, nil
}

func (b *builder) serviceAccount() *corev1.ServiceAccount {
func (b *builder) serviceAccount(name string) *corev1.ServiceAccount {
return &corev1.ServiceAccount{
ObjectMeta: metav1.ObjectMeta{
Name: constants.PluginName,
Name: name,
Namespace: b.info.Namespace,
Labels: map[string]string{
"app": constants.PluginName,
"app": name,
},
},
}
Expand Down
Loading