Skip to content
Open
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
11 changes: 11 additions & 0 deletions Documentation/resources.adoc
Original file line number Diff line number Diff line change
Expand Up @@ -149,3 +149,14 @@ This also exposes the gRPC endpoints on port 10901. This port is for internal us

Expose the `/metrics` and `/validate-webhook` endpoints on port 8443. This port is for internal use, and no other usage is guaranteed.

[id="cmo-validatingwebhookconfigurations-resources"]
== CMO validatingwebhookconfigurations resources

=== /alertmanagerconfigs.openshift.io

Validating webhook for `AlertmanagerConfig` custom resources. Note that this webhook is a part of optional monitoring, and will only be deployed if the `OptionalMonitoring` capability is enabled.

=== /prometheusrules.openshift.io

Validating webhook for `PrometheusRule` custom resources.

10 changes: 10 additions & 0 deletions Documentation/resources.md
Original file line number Diff line number Diff line change
Expand Up @@ -165,3 +165,13 @@ This also exposes the gRPC endpoints on port 10901. This port is for internal us

Expose the `/metrics` and `/validate-webhook` endpoints on port 8443. This port is for internal use, and no other usage is guaranteed.

## ValidatingWebhookConfigurations

### /alertmanagerconfigs.openshift.io

Validating webhook for `AlertmanagerConfig` custom resources. Note that this webhook is a part of optional monitoring, and will only be deployed if the `OptionalMonitoring` capability is enabled.

### /prometheusrules.openshift.io

Validating webhook for `PrometheusRule` custom resources.

Original file line number Diff line number Diff line change
Expand Up @@ -2,6 +2,8 @@ apiVersion: admissionregistration.k8s.io/v1
kind: ValidatingWebhookConfiguration
metadata:
annotations:
capability.openshift.io/name: OptionalMonitoring
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

If the service is optional (*), shouldn't we apply the annotation to all admission-webhook resources?

(*) there could be an argument that we still want the admission webhook for PrometheusRule resources because of telemetry?

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yes that was my understanding as well, so I limited this to AM strictly.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Ah I didn't realize that this webhook configuration was specifically for AlertmanagerConfig resources. I would still recommend that we document the rationale for not having all admission-webhook resources marked as optional (not sure where it should happen though).

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Added a description annotation on the object.

openshift.io/description: Validating webhook for `AlertmanagerConfig` custom resources. Note that this webhook is a part of optional monitoring, and will only be deployed if the `OptionalMonitoring` capability is enabled.
service.beta.openshift.io/inject-cabundle: "true"
labels:
app.kubernetes.io/component: controller
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -2,6 +2,7 @@ apiVersion: admissionregistration.k8s.io/v1
kind: ValidatingWebhookConfiguration
metadata:
annotations:
openshift.io/description: Validating webhook for `PrometheusRule` custom resources.
service.beta.openshift.io/inject-cabundle: "true"
labels:
app.kubernetes.io/component: controller
Expand Down
1 change: 1 addition & 0 deletions assets/alertmanager-user-workload/alertmanager.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -2,6 +2,7 @@ apiVersion: monitoring.coreos.com/v1
kind: Alertmanager
metadata:
annotations:
capability.openshift.io/name: OptionalMonitoring
operator.prometheus.io/controller-id: openshift-user-workload-monitoring/prometheus-operator
labels:
app.kubernetes.io/component: alert-router
Expand Down
2 changes: 2 additions & 0 deletions assets/alertmanager-user-workload/cluster-role-binding.yaml
Original file line number Diff line number Diff line change
@@ -1,6 +1,8 @@
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
annotations:
capability.openshift.io/name: OptionalMonitoring
labels:
app.kubernetes.io/managed-by: cluster-monitoring-operator
app.kubernetes.io/part-of: openshift-monitoring
Expand Down
2 changes: 2 additions & 0 deletions assets/alertmanager-user-workload/cluster-role.yaml
Original file line number Diff line number Diff line change
@@ -1,6 +1,8 @@
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
annotations:
capability.openshift.io/name: OptionalMonitoring
labels:
app.kubernetes.io/managed-by: cluster-monitoring-operator
app.kubernetes.io/part-of: openshift-monitoring
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -2,6 +2,8 @@ apiVersion: v1
data: {}
kind: Secret
metadata:
annotations:
capability.openshift.io/name: OptionalMonitoring
labels:
app.kubernetes.io/managed-by: cluster-monitoring-operator
app.kubernetes.io/name: alertmanager-user-workload
Expand Down
2 changes: 2 additions & 0 deletions assets/alertmanager-user-workload/kube-rbac-proxy-secret.yaml
Original file line number Diff line number Diff line change
@@ -1,6 +1,8 @@
apiVersion: v1
kind: Secret
metadata:
annotations:
capability.openshift.io/name: OptionalMonitoring
labels:
app.kubernetes.io/managed-by: cluster-monitoring-operator
app.kubernetes.io/name: alertmanager-user-workload
Expand Down
Original file line number Diff line number Diff line change
@@ -1,6 +1,8 @@
apiVersion: v1
kind: Secret
metadata:
annotations:
capability.openshift.io/name: OptionalMonitoring
labels:
app.kubernetes.io/managed-by: cluster-monitoring-operator
app.kubernetes.io/name: alertmanager-user-workload
Expand Down
2 changes: 2 additions & 0 deletions assets/alertmanager-user-workload/pod-disruption-budget.yaml
Original file line number Diff line number Diff line change
@@ -1,6 +1,8 @@
apiVersion: policy/v1
kind: PodDisruptionBudget
metadata:
annotations:
capability.openshift.io/name: OptionalMonitoring
labels:
app.kubernetes.io/component: alert-router
app.kubernetes.io/instance: user-workload
Expand Down
2 changes: 2 additions & 0 deletions assets/alertmanager-user-workload/secret.yaml
Original file line number Diff line number Diff line change
@@ -1,6 +1,8 @@
apiVersion: v1
kind: Secret
metadata:
annotations:
capability.openshift.io/name: OptionalMonitoring
labels:
app.kubernetes.io/component: alert-router
app.kubernetes.io/instance: user-workload
Expand Down
2 changes: 2 additions & 0 deletions assets/alertmanager-user-workload/service-account.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -2,6 +2,8 @@ apiVersion: v1
automountServiceAccountToken: false
kind: ServiceAccount
metadata:
annotations:
capability.openshift.io/name: OptionalMonitoring
labels:
app.kubernetes.io/component: alert-router
app.kubernetes.io/instance: user-workload
Expand Down
2 changes: 2 additions & 0 deletions assets/alertmanager-user-workload/service-monitor.yaml
Original file line number Diff line number Diff line change
@@ -1,6 +1,8 @@
apiVersion: monitoring.coreos.com/v1
kind: ServiceMonitor
metadata:
annotations:
capability.openshift.io/name: OptionalMonitoring
labels:
app.kubernetes.io/component: alert-router
app.kubernetes.io/instance: user-workload
Expand Down
1 change: 1 addition & 0 deletions assets/alertmanager-user-workload/service.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -2,6 +2,7 @@ apiVersion: v1
kind: Service
metadata:
annotations:
capability.openshift.io/name: OptionalMonitoring
openshift.io/description: |-
Expose the user-defined Alertmanager web server within the cluster on the following ports:
* Port 9095 provides access to the Alertmanager endpoints. Granting access requires binding a user to the `monitoring-alertmanager-api-reader` role (for read-only operations) or `monitoring-alertmanager-api-writer` role in the `openshift-user-workload-monitoring` project.
Expand Down
1 change: 1 addition & 0 deletions assets/alertmanager-user-workload/trusted-ca-bundle.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -3,6 +3,7 @@ data: {}
kind: ConfigMap
metadata:
annotations:
capability.openshift.io/name: OptionalMonitoring
openshift.io/owning-component: Monitoring
labels:
app.kubernetes.io/managed-by: cluster-monitoring-operator
Expand Down
1 change: 1 addition & 0 deletions assets/alertmanager/alertmanager.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -2,6 +2,7 @@ apiVersion: monitoring.coreos.com/v1
kind: Alertmanager
metadata:
annotations:
capability.openshift.io/name: OptionalMonitoring
operator.prometheus.io/controller-id: openshift-monitoring/prometheus-operator
labels:
app.kubernetes.io/component: alert-router
Expand Down
2 changes: 2 additions & 0 deletions assets/alertmanager/cluster-role-binding.yaml
Original file line number Diff line number Diff line change
@@ -1,6 +1,8 @@
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
annotations:
capability.openshift.io/name: OptionalMonitoring
labels:
app.kubernetes.io/managed-by: cluster-monitoring-operator
app.kubernetes.io/part-of: openshift-monitoring
Expand Down
2 changes: 2 additions & 0 deletions assets/alertmanager/cluster-role.yaml
Original file line number Diff line number Diff line change
@@ -1,6 +1,8 @@
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
annotations:
capability.openshift.io/name: OptionalMonitoring
labels:
app.kubernetes.io/managed-by: cluster-monitoring-operator
app.kubernetes.io/part-of: openshift-monitoring
Expand Down
2 changes: 2 additions & 0 deletions assets/alertmanager/kube-rbac-proxy-metric-secret.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -2,6 +2,8 @@ apiVersion: v1
data: {}
kind: Secret
metadata:
annotations:
capability.openshift.io/name: OptionalMonitoring
labels:
app.kubernetes.io/managed-by: cluster-monitoring-operator
app.kubernetes.io/name: alertmanager-main
Expand Down
2 changes: 2 additions & 0 deletions assets/alertmanager/kube-rbac-proxy-secret.yaml
Original file line number Diff line number Diff line change
@@ -1,6 +1,8 @@
apiVersion: v1
kind: Secret
metadata:
annotations:
capability.openshift.io/name: OptionalMonitoring
labels:
app.kubernetes.io/managed-by: cluster-monitoring-operator
app.kubernetes.io/name: alertmanager-main
Expand Down
2 changes: 2 additions & 0 deletions assets/alertmanager/kube-rbac-proxy-web-secret.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -2,6 +2,8 @@ apiVersion: v1
data: {}
kind: Secret
metadata:
annotations:
capability.openshift.io/name: OptionalMonitoring
labels:
app.kubernetes.io/managed-by: cluster-monitoring-operator
app.kubernetes.io/part-of: openshift-monitoring
Expand Down
2 changes: 2 additions & 0 deletions assets/alertmanager/pod-disruption-budget.yaml
Original file line number Diff line number Diff line change
@@ -1,6 +1,8 @@
apiVersion: policy/v1
kind: PodDisruptionBudget
metadata:
annotations:
capability.openshift.io/name: OptionalMonitoring
labels:
app.kubernetes.io/component: alert-router
app.kubernetes.io/instance: main
Expand Down
2 changes: 2 additions & 0 deletions assets/alertmanager/prometheus-rule.yaml
Original file line number Diff line number Diff line change
@@ -1,6 +1,8 @@
apiVersion: monitoring.coreos.com/v1
kind: PrometheusRule
metadata:
annotations:
capability.openshift.io/name: OptionalMonitoring
labels:
app.kubernetes.io/component: alert-router
app.kubernetes.io/instance: main
Expand Down
1 change: 1 addition & 0 deletions assets/alertmanager/route.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -2,6 +2,7 @@ apiVersion: v1
kind: Route
metadata:
annotations:
capability.openshift.io/name: OptionalMonitoring
openshift.io/description: Expose the `/api` endpoints of the `alertmanager-main` service via a router.
labels:
app.kubernetes.io/managed-by: cluster-monitoring-operator
Expand Down
2 changes: 2 additions & 0 deletions assets/alertmanager/secret.yaml
Original file line number Diff line number Diff line change
@@ -1,6 +1,8 @@
apiVersion: v1
kind: Secret
metadata:
annotations:
capability.openshift.io/name: OptionalMonitoring
labels:
app.kubernetes.io/component: alert-router
app.kubernetes.io/instance: main
Expand Down
2 changes: 2 additions & 0 deletions assets/alertmanager/service-account.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -2,6 +2,8 @@ apiVersion: v1
automountServiceAccountToken: false
kind: ServiceAccount
metadata:
annotations:
capability.openshift.io/name: OptionalMonitoring
labels:
app.kubernetes.io/component: alert-router
app.kubernetes.io/instance: main
Expand Down
2 changes: 2 additions & 0 deletions assets/alertmanager/service-monitor.yaml
Original file line number Diff line number Diff line change
@@ -1,6 +1,8 @@
apiVersion: monitoring.coreos.com/v1
kind: ServiceMonitor
metadata:
annotations:
capability.openshift.io/name: OptionalMonitoring
labels:
app.kubernetes.io/component: alert-router
app.kubernetes.io/instance: main
Expand Down
1 change: 1 addition & 0 deletions assets/alertmanager/service.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -2,6 +2,7 @@ apiVersion: v1
kind: Service
metadata:
annotations:
capability.openshift.io/name: OptionalMonitoring
openshift.io/description: |-
Expose the Alertmanager web server within the cluster on the following ports:
* Port 9094 provides access to all the Alertmanager endpoints. Granting access requires binding a user to the `monitoring-alertmanager-view` role (for read-only operations) or `monitoring-alertmanager-edit` role in the `openshift-monitoring` project.
Expand Down
1 change: 1 addition & 0 deletions assets/alertmanager/trusted-ca-bundle.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -3,6 +3,7 @@ data: {}
kind: ConfigMap
metadata:
annotations:
capability.openshift.io/name: OptionalMonitoring
openshift.io/owning-component: Monitoring
labels:
app.kubernetes.io/managed-by: cluster-monitoring-operator
Expand Down
Original file line number Diff line number Diff line change
@@ -1,6 +1,8 @@
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
annotations:
capability.openshift.io/name: OptionalMonitoring
labels:
app.kubernetes.io/managed-by: cluster-monitoring-operator
app.kubernetes.io/part-of: openshift-monitoring
Expand Down
Original file line number Diff line number Diff line change
@@ -1,6 +1,8 @@
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
annotations:
capability.openshift.io/name: OptionalMonitoring
labels:
app.kubernetes.io/managed-by: cluster-monitoring-operator
app.kubernetes.io/part-of: openshift-monitoring
Expand Down
Original file line number Diff line number Diff line change
@@ -1,6 +1,8 @@
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
annotations:
capability.openshift.io/name: OptionalMonitoring
labels:
app.kubernetes.io/managed-by: cluster-monitoring-operator
app.kubernetes.io/part-of: openshift-monitoring
Expand Down
Original file line number Diff line number Diff line change
@@ -1,6 +1,8 @@
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
annotations:
capability.openshift.io/name: OptionalMonitoring
labels:
app.kubernetes.io/managed-by: cluster-monitoring-operator
app.kubernetes.io/part-of: openshift-monitoring
Expand Down
Original file line number Diff line number Diff line change
@@ -1,6 +1,8 @@
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
annotations:
capability.openshift.io/name: OptionalMonitoring
labels:
app.kubernetes.io/managed-by: cluster-monitoring-operator
app.kubernetes.io/part-of: openshift-monitoring
Expand Down
Original file line number Diff line number Diff line change
@@ -1,6 +1,8 @@
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
annotations:
capability.openshift.io/name: OptionalMonitoring
labels:
app.kubernetes.io/managed-by: cluster-monitoring-operator
app.kubernetes.io/part-of: openshift-monitoring
Expand Down
2 changes: 2 additions & 0 deletions assets/monitoring-plugin/console-plugin.yaml
Original file line number Diff line number Diff line change
@@ -1,6 +1,8 @@
apiVersion: console.openshift.io/v1
kind: ConsolePlugin
metadata:
annotations:
capability.openshift.io/name: Console
labels:
app.kubernetes.io/component: monitoring-plugin
app.kubernetes.io/managed-by: cluster-monitoring-operator
Expand Down
2 changes: 2 additions & 0 deletions assets/monitoring-plugin/deployment.yaml
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Not directly related to this change but if the console is disabled, wouldn't it be logical to avoid deploying the monitoring plugin resources?

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

True, I've moved the plugin to be independent of the OptionalMonitoring capability and instead made it dependent on the Console one, which is in-line with its task's behavior, PTAL at commit: 55d6da0.

Original file line number Diff line number Diff line change
@@ -1,6 +1,8 @@
apiVersion: apps/v1
kind: Deployment
metadata:
annotations:
capability.openshift.io/name: Console
labels:
app.kubernetes.io/component: monitoring-plugin
app.kubernetes.io/managed-by: cluster-monitoring-operator
Expand Down
2 changes: 2 additions & 0 deletions assets/monitoring-plugin/pod-disruption-budget.yaml
Original file line number Diff line number Diff line change
@@ -1,6 +1,8 @@
apiVersion: policy/v1
kind: PodDisruptionBudget
metadata:
annotations:
capability.openshift.io/name: Console
labels:
app.kubernetes.io/component: monitoring-plugin
app.kubernetes.io/managed-by: cluster-monitoring-operator
Expand Down
2 changes: 2 additions & 0 deletions assets/monitoring-plugin/service-account.yaml
Original file line number Diff line number Diff line change
@@ -1,6 +1,8 @@
apiVersion: v1
kind: ServiceAccount
metadata:
annotations:
capability.openshift.io/name: Console
labels:
app.kubernetes.io/component: monitoring-plugin
app.kubernetes.io/managed-by: cluster-monitoring-operator
Expand Down
1 change: 1 addition & 0 deletions assets/monitoring-plugin/service.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -2,6 +2,7 @@ apiVersion: v1
kind: Service
metadata:
annotations:
capability.openshift.io/name: Console
openshift.io/description: Expose the monitoring plugin service on port 9443. This port is for internal use, and no other usage is guaranteed.
service.beta.openshift.io/serving-cert-secret-name: monitoring-plugin-cert
labels:
Expand Down
Original file line number Diff line number Diff line change
@@ -1,6 +1,8 @@
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
annotations:
capability.openshift.io/name: OptionalMonitoring
labels:
app.kubernetes.io/component: controller
app.kubernetes.io/managed-by: cluster-monitoring-operator
Expand Down
2 changes: 2 additions & 0 deletions assets/prometheus-operator-user-workload/cluster-role.yaml
Original file line number Diff line number Diff line change
@@ -1,6 +1,8 @@
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
annotations:
capability.openshift.io/name: OptionalMonitoring
labels:
app.kubernetes.io/component: controller
app.kubernetes.io/managed-by: cluster-monitoring-operator
Expand Down
2 changes: 2 additions & 0 deletions assets/prometheus-operator-user-workload/deployment.yaml
Original file line number Diff line number Diff line change
@@ -1,6 +1,8 @@
apiVersion: apps/v1
kind: Deployment
metadata:
annotations:
capability.openshift.io/name: OptionalMonitoring
labels:
app.kubernetes.io/component: controller
app.kubernetes.io/managed-by: cluster-monitoring-operator
Expand Down
Loading