Skip to content

Commit cbdc3a7

Browse files
camilamacedo86camilamacedo86
committed
doc: add guide for consuming metrics endpoints
This documentation provides detailed steps for enabling, validating, and integrating metrics exposed by Operator-Controller and CatalogD services. It includes: - RBAC configuration to grant access to metrics endpoints. - Manual validation using and tokens. - Integration setup with Prometheus Operator using .
1 parent be70128 commit cbdc3a7

File tree

1 file changed

+254
-0
lines changed

1 file changed

+254
-0
lines changed

‎docs/howto/how-to-consume-metrics.md‎

Lines changed: 254 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,254 @@
1+
# Consuming Metrics
2+
3+
Operator-Controller and CatalogD are configured to export metrics by default. The metrics are exposed on the `/metrics` endpoint of the respective services.
4+
5+
The metrics are protected by RBAC policies, and you need to have the appropriate permissions to access them.
6+
By default, the metrics are exposed over HTTPS, and you need to have the appropriate certificates to access them via other services such as Prometheus.
7+
8+
Below, you will learn how to enable the metrics, validate access, and integrate with [Prometheus Operator][prometheus-operator].
9+
10+
---
11+
12+
## Operator-Controller Metrics
13+
14+
### Step 1: Enable Access
15+
16+
To enable access to the Operator-Controller metrics, create a `ClusterRoleBinding` to allow the Operator-Controller service account to access the metrics.
17+
18+
```shell
19+
kubectl create clusterrolebinding operator-controller-metrics-binding \
20+
--clusterrole=operator-controller-metrics-reader \
21+
--serviceaccount=olmv1-system:operator-controller-controller-manager
22+
```
23+
24+
### Step 2: Validate Access Manually
25+
26+
#### Create a Token and Extract Certificates
27+
28+
Generate a token for the service account:
29+
30+
```shell
31+
TOKEN=$(kubectl create token operator-controller-controller-manager -n olmv1-system)
32+
echo $TOKEN
33+
```
34+
35+
#### Deploy a Pod to Consume Metrics
36+
37+
```shell
38+
kubectl apply -f - <<EOF
39+
apiVersion: v1
40+
kind: Pod
41+
metadata:
42+
name: curl-metrics
43+
namespace: olmv1-system
44+
labels:
45+
access: restricted
46+
spec:
47+
serviceAccountName: operator-controller-controller-manager
48+
containers:
49+
- name: curl
50+
image: curlimages/curl:7.87.0
51+
command:
52+
- sh
53+
- -c
54+
- sleep 3600
55+
securityContext:
56+
runAsNonRoot: true
57+
readOnlyRootFilesystem: true
58+
volumeMounts:
59+
- mountPath: /tmp/cert
60+
name: olm-cert
61+
readOnly: true
62+
volumes:
63+
- name: olm-cert
64+
secret:
65+
secretName: olmv1-cert
66+
restartPolicy: Never
67+
EOF
68+
```
69+
70+
#### Access the Pod and Test Metrics
71+
72+
Access the pod:
73+
74+
```shell
75+
kubectl exec -it curl-metrics -n olmv1-system -- sh
76+
```
77+
78+
From the shell:
79+
80+
```shell
81+
curl -v -k -H "Authorization: Bearer $TOKEN" \
82+
https://operator-controller-controller-manager-metrics-service.olmv1-system.svc.cluster.local:8443/metrics
83+
```
84+
85+
Validate using certificates and token:
86+
87+
```shell
88+
curl -v --cacert /tmp/cert/ca.crt --cert /tmp/cert/tls.crt --key /tmp/cert/tls.key \
89+
-H "Authorization: Bearer $TOKEN" \
90+
https://operator-controller-controller-manager-metrics-service.olmv1-system.svc.cluster.local:8443/metrics
91+
```
92+
93+
---
94+
95+
## CatalogD Metrics
96+
97+
### Step 1: Enable Access
98+
99+
To enable access to the CatalogD metrics, create a `ClusterRoleBinding` for the CatalogD service account:
100+
101+
```shell
102+
kubectl create clusterrolebinding catalogd-metrics-binding \
103+
--clusterrole=catalogd-metrics-reader \
104+
--serviceaccount=olmv1-system:catalogd-controller-manager
105+
```
106+
107+
### Step 2: Validate Access Manually
108+
109+
#### Create a Token and Extract Certificates
110+
111+
Generate a token:
112+
113+
```shell
114+
TOKEN=$(kubectl create token catalogd-controller-manager -n olmv1-system)
115+
echo $TOKEN
116+
```
117+
118+
#### Deploy a Pod to Consume Metrics
119+
120+
```shell
121+
kubectl apply -f - <<EOF
122+
apiVersion: v1
123+
kind: Pod
124+
metadata:
125+
name: curl-metrics
126+
namespace: olmv1-system
127+
labels:
128+
access: restricted
129+
spec:
130+
serviceAccountName: catalogd-controller-manager
131+
containers:
132+
- name: curl
133+
image: curlimages/curl:7.87.0
134+
command:
135+
- sh
136+
- -c
137+
- sleep 3600
138+
securityContext:
139+
runAsNonRoot: true
140+
readOnlyRootFilesystem: true
141+
volumeMounts:
142+
- mountPath: /tmp/cert
143+
name: catalogd-cert
144+
readOnly: true
145+
volumes:
146+
- name: catalogd-cert
147+
secret:
148+
secretName: $(kubectl get secret -n olmv1-system -o jsonpath="{.items[?(@.metadata.name | startswith('catalogd-service-cert'))].metadata.name}")
149+
restartPolicy: Never
150+
EOF
151+
```
152+
153+
#### Access the Pod and Test Metrics
154+
155+
Access the pod:
156+
157+
```shell
158+
kubectl exec -it curl-metrics -n olmv1-system -- sh
159+
```
160+
161+
From the shell:
162+
163+
```shell
164+
curl -v -k -H "Authorization: Bearer $TOKEN" \
165+
https://catalogd-service.olmv1-system.svc.cluster.local:7443/metrics
166+
```
167+
168+
Validate using certificates and token:
169+
170+
```shell
171+
curl -v --cacert /tmp/cert/ca.crt --cert /tmp/cert/tls.crt --key /tmp/cert/tls.key \
172+
-H "Authorization: Bearer $TOKEN" \
173+
https://catalogd-service.olmv1-system.svc.cluster.local:7443/metrics
174+
```
175+
176+
---
177+
178+
## Enabling Integration with Prometheus
179+
180+
If using [Prometheus Operator][prometheus-operator], create a `ServiceMonitor` to scrape metrics:
181+
182+
### For Operator-Controller
183+
184+
```shell
185+
kubectl apply -f - <<EOF
186+
apiVersion: monitoring.coreos.com/v1
187+
kind: ServiceMonitor
188+
metadata:
189+
labels:
190+
control-plane: operator-controller-controller-manager
191+
name: controller-manager-metrics-monitor
192+
namespace: system
193+
spec:
194+
endpoints:
195+
- path: /metrics
196+
port: https
197+
scheme: https
198+
bearerTokenFile: /var/run/secrets/kubernetes.io/serviceaccount/token
199+
tlsConfig:
200+
insecureSkipVerify: false
201+
ca:
202+
secret:
203+
name: olmv1-cert
204+
key: ca.crt
205+
cert:
206+
secret:
207+
name: olmv1-cert
208+
key: tls.crt
209+
keySecret:
210+
name: olmv1-cert
211+
key: tls.key
212+
selector:
213+
matchLabels:
214+
control-plane: operator-controller-controller-manager
215+
EOF
216+
```
217+
218+
### For CatalogD
219+
220+
```shell
221+
kubectl apply -f - <<EOF
222+
apiVersion: monitoring.coreos.com/v1
223+
kind: ServiceMonitor
224+
metadata:
225+
labels:
226+
control-plane: catalogd-controller-manager
227+
name: catalogd-metrics-monitor
228+
namespace: system
229+
spec:
230+
endpoints:
231+
- path: /metrics
232+
port: https
233+
scheme: https
234+
bearerTokenFile: /var/run/secrets/kubernetes.io/serviceaccount/token
235+
tlsConfig:
236+
insecureSkipVerify: false
237+
ca:
238+
secret:
239+
name: $(kubectl get secret -n olmv1-system -o jsonpath="{.items[?(@.metadata.name | startswith('catalogd-service-cert'))].metadata.name}")
240+
key: ca.crt
241+
cert:
242+
secret:
243+
name: $(kubectl get secret -n olmv1-system -o jsonpath="{.items[?(@.metadata.name | startswith('catalogd-service-cert'))].metadata.name}")
244+
key: tls.crt
245+
keySecret:
246+
name: $(kubectl get secret -n olmv1-system -o jsonpath="{.items[?(@.metadata.name | startswith('catalogd-service-cert'))].metadata.name}")
247+
key: tls.key
248+
selector:
249+
matchLabels:
250+
control-plane: catalogd-controller-manager
251+
EOF
252+
```
253+
254+
[prometheus-operator]: https://github.com/prometheus-operator/prometheus-operator

0 commit comments

Comments
 (0)