Skip to content

Commit bdda0de

Browse files
camilamacedo86camilamacedo86
committed
(doc): Add a doc as a guidance to help users know how to consume the metrics and integrate it with other solutions
1 parent 10f0f77 commit bdda0de

File tree

1 file changed

+281
-0
lines changed

1 file changed

+281
-0
lines changed

‎docs/helpers/consuming-metrics.md‎

Lines changed: 281 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,281 @@
1+
# Consuming Metrics
2+
3+
> The information provided here is intended as general guidance and does not constitute a guaranteed or officially supported solution.
4+
> Please note that integration with the Prometheus Operator or other third-party tools may have limitations and might not be fully supported.
5+
6+
Operator-Controller and CatalogD are configured to export metrics by default. The metrics are exposed on the `/metrics` endpoint of the respective services.
7+
8+
The metrics are protected by RBAC policies, and you need to have the appropriate permissions to access them. By default, the metrics are exposed over HTTPS, and you need to have the appropriate certificates to access them via other services such as Prometheus.
9+
10+
Below, you will learn how to enable the metrics, validate access, and integrate with [Prometheus Operator][prometheus-operator].
11+
12+
---
13+
14+
## Operator-Controller Metrics
15+
16+
### Step 1: Enable Access
17+
18+
To enable access to the Operator-Controller metrics, create a `ClusterRoleBinding` to allow the Operator-Controller service account to access the metrics.
19+
20+
```shell
21+
kubectl create clusterrolebinding operator-controller-metrics-binding \
22+
--clusterrole=operator-controller-metrics-reader \
23+
--serviceaccount=olmv1-system:operator-controller-controller-manager
24+
```
25+
26+
### Step 2: Validate Access Manually
27+
28+
#### Create a Token and Extract Certificates
29+
30+
Generate a token for the service account and extract the required certificates:
31+
32+
```shell
33+
TOKEN=$(kubectl create token operator-controller-controller-manager -n olmv1-system)
34+
echo $TOKEN
35+
```
36+
37+
#### Deploy a Pod to Consume Metrics
38+
39+
Ensure that the Pod is deployed in a namespace labeled to enforce restricted permissions. Apply the following:
40+
41+
```shell
42+
kubectl apply -f - <<EOF
43+
apiVersion: v1
44+
kind: Pod
45+
metadata:
46+
name: curl-metrics
47+
namespace: olmv1-system
48+
spec:
49+
serviceAccountName: operator-controller-controller-manager
50+
containers:
51+
- name: curl
52+
image: curlimages/curl:latest
53+
command:
54+
- sh
55+
- -c
56+
- sleep 3600
57+
securityContext:
58+
runAsNonRoot: true
59+
readOnlyRootFilesystem: true
60+
runAsUser: 1000
61+
runAsGroup: 1000
62+
allowPrivilegeEscalation: false
63+
capabilities:
64+
drop:
65+
- ALL
66+
volumeMounts:
67+
- mountPath: /tmp/cert
68+
name: olm-cert
69+
readOnly: true
70+
volumes:
71+
- name: olm-cert
72+
secret:
73+
secretName: olmv1-cert
74+
securityContext:
75+
runAsNonRoot: true
76+
restartPolicy: Never
77+
EOF
78+
```
79+
80+
#### Access the Pod and Test Metrics
81+
82+
Access the pod:
83+
84+
```shell
85+
kubectl exec -it curl-metrics -n olmv1-system -- sh
86+
```
87+
88+
From the shell use the `TOKEN` value obtained above to check the metrics:
89+
90+
```shell
91+
curl -v -k -H "Authorization: Bearer <TOKEN>" \
92+
https://operator-controller-controller-manager-metrics-service.olmv1-system.svc.cluster.local:8443/metrics
93+
```
94+
95+
Validate using certificates and token:
96+
97+
```shell
98+
curl -v --cacert /tmp/cert/ca.crt --cert /tmp/cert/tls.crt --key /tmp/cert/tls.key \
99+
-H "Authorization: Bearer <TOKEN>" \
100+
https://operator-controller-controller-manager-metrics-service.olmv1-system.svc.cluster.local:8443/metrics
101+
```
102+
103+
---
104+
105+
## CatalogD Metrics
106+
107+
### Step 1: Enable Access
108+
109+
To enable access to the CatalogD metrics, create a `ClusterRoleBinding` for the CatalogD service account:
110+
111+
```shell
112+
kubectl create clusterrolebinding catalogd-metrics-binding \
113+
--clusterrole=catalogd-metrics-reader \
114+
--serviceaccount=olmv1-system:catalogd-controller-manager
115+
```
116+
117+
### Step 2: Validate Access Manually
118+
119+
#### Create a Token and Extract Certificates
120+
121+
Generate a token and get the required certificates:
122+
123+
```shell
124+
TOKEN=$(kubectl create token catalogd-controller-manager -n olmv1-system)
125+
echo $TOKEN
126+
```
127+
128+
#### Deploy a Pod to Consume Metrics
129+
130+
From the shell use the `TOKEN` value obtained above to check the metrics:
131+
132+
```shell
133+
OLM_SECRET=$(kubectl get secret -n olmv1-system -o jsonpath="{.items[?(@.metadata.name | startswith('catalogd-service-cert'))].metadata.name}")
134+
```
135+
136+
```shell
137+
kubectl apply -f - <<EOF
138+
apiVersion: v1
139+
kind: Pod
140+
metadata:
141+
name: curl-metrics
142+
namespace: olmv1-system
143+
spec:
144+
serviceAccountName: catalogd-controller-manager
145+
containers:
146+
- name: curl
147+
image: curlimages/curl:latest
148+
command:
149+
- sh
150+
- -c
151+
- sleep 3600
152+
securityContext:
153+
runAsNonRoot: true
154+
readOnlyRootFilesystem: true
155+
runAsUser: 1000
156+
runAsGroup: 1000
157+
allowPrivilegeEscalation: false
158+
capabilities:
159+
drop:
160+
- ALL
161+
volumeMounts:
162+
- mountPath: /tmp/cert
163+
name: catalogd-cert
164+
readOnly: true
165+
volumes:
166+
- name: catalogd-cert
167+
secret:
168+
secretName: $OLM_SECRET
169+
securityContext:
170+
runAsNonRoot: true
171+
restartPolicy: Never
172+
EOF
173+
```
174+
175+
#### Access the Pod and Test Metrics
176+
177+
Access the pod:
178+
179+
```shell
180+
kubectl exec -it curl-metrics -n olmv1-system -- sh
181+
```
182+
183+
From the shell use the `TOKEN` value obtained above to check the metrics:
184+
185+
```shell
186+
curl -v -k -H "Authorization: Bearer <TOKEN>" \
187+
https://catalogd-service.olmv1-system.svc.cluster.local:7443/metrics
188+
```
189+
190+
Validate using certificates and token:
191+
192+
```shell
193+
curl -v --cacert /tmp/cert/ca.crt --cert /tmp/cert/tls.crt --key /tmp/cert/tls.key \
194+
-H "Authorization: Bearer <TOKEN>" \
195+
https://catalogd-service.olmv1-system.svc.cluster.local:7443/metrics
196+
```
197+
198+
---
199+
200+
## Enabling Integration with Prometheus
201+
202+
If using [Prometheus Operator][prometheus-operator], create a `ServiceMonitor` to scrape metrics:
203+
204+
### For Operator-Controller
205+
206+
```shell
207+
kubectl apply -f - <<EOF
208+
apiVersion: monitoring.coreos.com/v1
209+
kind: ServiceMonitor
210+
metadata:
211+
labels:
212+
control-plane: operator-controller-controller-manager
213+
name: controller-manager-metrics-monitor
214+
namespace: system
215+
spec:
216+
endpoints:
217+
- path: /metrics
218+
port: https
219+
scheme: https
220+
bearerTokenFile: /var/run/secrets/kubernetes.io/serviceaccount/token
221+
tlsConfig:
222+
insecureSkipVerify: false
223+
ca:
224+
secret:
225+
name: olmv1-cert
226+
key: ca.crt
227+
cert:
228+
secret:
229+
name: olmv1-cert
230+
key: tls.crt
231+
keySecret:
232+
name: olmv1-cert
233+
key: tls.key
234+
selector:
235+
matchLabels:
236+
control-plane: operator-controller-controller-manager
237+
EOF
238+
```
239+
240+
### For CatalogD
241+
242+
243+
```shell
244+
OLM_SECRET=$(kubectl get secret -n olmv1-system -o jsonpath="{.items[?(@.metadata.name | startswith('catalogd-service-cert'))].metadata.name}")
245+
```
246+
247+
```shell
248+
kubectl apply -f - <<EOF
249+
apiVersion: monitoring.coreos.com/v1
250+
kind: ServiceMonitor
251+
metadata:
252+
labels:
253+
control-plane: catalogd-controller-manager
254+
name: catalogd-metrics-monitor
255+
namespace: system
256+
spec:
257+
endpoints:
258+
- path: /metrics
259+
port: https
260+
scheme: https
261+
bearerTokenFile: /var/run/secrets/kubernetes.io/serviceaccount/token
262+
tlsConfig:
263+
insecureSkipVerify: false
264+
ca:
265+
secret:
266+
name: $OLM_SECRET
267+
key: ca.crt
268+
cert:
269+
secret:
270+
name: $OLM_SECRET
271+
key: tls.crt
272+
keySecret:
273+
name: $OLM_SECRET
274+
key: tls.key
275+
selector:
276+
matchLabels:
277+
control-plane: catalogd-controller-manager
278+
EOF
279+
```
280+
281+
[prometheus-operator]: https://github.com/prometheus-operator/prometheus-operator

0 commit comments

Comments
 (0)