andata
/
rancher-charts
mirror of https://git.rancher.io/charts
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

add support for endpoint auth and image pull secrets

pull/3313/head
joshmeranda 2023-09-08 15:28:59 -04:00
parent 9837328945
commit 55ac4f9db6
8 changed files with 92 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
packages/rancher-monitoring/rancher-pushprox/charts/Chart.yaml
View File

@ -11,4 +11,4 @@ description: Sets up a deployment of the PushProx proxy and a DaemonSet of PushP
clients.
name: rancher-pushprox
type: application
version: 0.1.6
version: 102.0.2

10
packages/rancher-monitoring/rancher-pushprox/charts/README.md Executable file → Normal file
View File

@ -55,7 +55,15 @@ The following tables list the configurable parameters of the rancher-pushprox ch
| `clients.proxyUrl` | Overrides the default proxyUrl setting of `http://pushprox-{{ .Values.component }}-proxy.{{ . Release.Namespace }}.svc.cluster.local:{{ .Values.proxy.port }}"` with the `proxyUrl` specified | `""` |
| `clients.useLocalhost` | Sets a flag on each client deployment to redirect scrapes directed to `HOST_IP` to `127.0.0.1` | `false` |
| `clients.https.enabled` | Enables scraping metrics via HTTPS using the provided TLS certs that exist on each host | `false` |
| `clients.https.forceHTTPSScheme` | Forces scraping metrics via HTTPS using the provided TLS certs that exist on each host | `false` |
| `clients.https.useServiceAccountCredentials` | If set to true, the client will create a service account with permissions to scrape `/metrics` endpoint of Kubernetes components. The client will use the service account token provided to make authorized scrape requests to the Kubernetes API | `false` |
| `clients.https.authenticationMethod.bearerTokenFile.enabled` | If set to true, the client will use service account credentials mounted at the configured path `clients.https.authenticationMethod.bearerTokenFile.bearerTokenFilePath`. This requires permissions to scrape `/metrics` endpoint of Kubernetes components. This method is deprecated by the prometheus operator and may be removed in a future release | `false` |
| `clients.https.authenticationMethod.bearerTokenFile.bearerTokenFilePath` | This is a volume mount on the pod with permissions to scrape `/metrics` endpoint of Kubernetes components | `"/var/run/secrets/kubernetes.io/serviceaccount/token"` |
| `clients.https.authenticationMethod.bearerTokenSecret.enabled` | If set to true, the client will use service account credentials to scrape `/metrics` endpoint of Kubernetes components. This method is deprecated by the prometheus operator and may be removed in a future release | `false` |
| `clients.https.authenticationMethod.authorization.enabled` | If set to true, the client will use service account credentials to scrape `/metrics` endpoint of Kubernetes components | `false` |
| `clients.https.authenticationMethod.authorization.type` | If set, the client will use this type of authorization in its client requests for metrics | `"bearer"` |
| `clients.https.authenticationMethod.authorization.credentials.key` | If set, the client will use this key in the secret created by `clients.https.useServiceAccountCredentials` for authorization in its client requests for metrics | `"token"` |
| `clients.https.authenticationMethod.authorization.credentials.optional` | If set to false, the client will fail if the key in the secret created by `clients.https.useServiceAccountCredentials` does not exist | `false` |
| `clients.https.insecureSkipVerify` | If set to true, the client will disable SSL security checks | `false` |
| `clients.https.certDir` | A `hostPath` where TLS certs can be found. This path is mounted as a volume on an `initContainer` which copies only the necessary files over to an EmptyDir volume used by each client. Required and only used if `clients.https.enabled` is set | `""` |
| `clients.https.certFile` | The path to the TLS cert file located within `clients.https.certDir`. Required and only used if `clients.https.enabled` is set | `""` |
@ -79,4 +87,4 @@ The following tables list the configurable parameters of the rancher-pushprox ch
*Tip: The filepaths set in `clients.https.<cert|key|caCert>File` can include wildcard characters*.
See [rancher-monitoring](https://github.com/rancher/charts/tree/gh-pages/packages/rancher-monitoring) for examples of how this chart can be used.
See [rancher-monitoring](https://github.com/rancher/charts/tree/gh-pages/packages/rancher-monitoring) for examples of how this chart can be used.

39
packages/rancher-monitoring/rancher-pushprox/charts/templates/_helpers.tpl
View File

@ -68,6 +68,10 @@ provider: kubernetes
{{- printf "pushprox-%s-client" (required ".Values.component is required" .Values.component) -}}
{{- end -}}
{{- define "pushProxy.client.serviceAccountTokenName" -}}
{{- printf "pushprox-%s-client-service-account-token" (required ".Values.component is required" .Values.component) -}}
{{- end -}}
{{- define "pushProxy.client.labels" -}}
k8s-app: {{ template "pushProxy.client.name" . }}
{{ template "pushProxy.commonLabels" . }}
@ -98,6 +102,11 @@ app: {{ template "pushprox.serviceMonitor.name" . }}
{{- define "pushProxy.serviceMonitor.endpoints" -}}
{{- $proxyURL := (include "pushProxy.proxyUrl" .) -}}
{{- $useHTTPS := .Values.clients.https.enabled -}}
{{- $setHTTPSScheme := .Values.clients.https.forceHTTPSScheme -}}
{{- $insecureSkipVerify := .Values.clients.https.insecureSkipVerify -}}
{{- $useServiceAccountCredentials := .Values.clients.https.useServiceAccountCredentials -}}
{{- $serviceAccountTokenName := (include "pushProxy.client.serviceAccountTokenName" . ) -}}
{{- $metricRelabelings := list }}
{{- $endpoints := .Values.serviceMonitor.endpoints }}
{{- range $endpoints }}
{{- if $.Values.proxy.enabled }}
@ -117,8 +126,14 @@ app: {{ template "pushprox.serviceMonitor.name" . }}
{{- $_ := set $clusterNameRelabel "targetLabel" "cluster_name" }}
{{- $_ := set $clusterNameRelabel "replacement" $.Values.global.cattle.clusterName }}
{{- end }}
{{- $metricRelabelings := append (list ($clusterNameRelabel)) ($clusterIdRelabel) }}
{{- $metricRelabelings := gt (len (keys $clusterNameRelabel)) 0 | ternary (append ($metricRelabelings) ($clusterNameRelabel)) ($metricRelabelings) }}
{{- $metricRelabelings := gt (len (keys $clusterIdRelabel)) 0 | ternary (append ($metricRelabelings) ($clusterIdRelabel)) ($metricRelabelings) }}
{{- if not (empty $metricRelabelings) }}
{{- $_ := set . "metricRelabelings" ($metricRelabelings)}}
{{- end }}
{{- if $forceHTTPSScheme -}}
{{- $_ := set . "scheme" "https" }}
{{- end -}}
{{- if $useHTTPS -}}
{{- if (hasKey . "params") }}
{{- $_ := set (get . "params") "_scheme" (list "https") }}
@ -126,6 +141,26 @@ app: {{ template "pushprox.serviceMonitor.name" . }}
{{- $_ := set . "params" (dict "_scheme" (list "https")) }}
{{- end }}
{{- end }}
{{- if (hasKey . "tlsConfig") }}
{{- $_ := set (get . "tlsConfig") "insecureSkipVerify" $insecureSkipVerify }}
{{- else }}
{{- $_ := set . "tlsConfig" (dict "insecureSkipVerify" $insecureSkipVerify) }}
{{- end }}
{{- if $.Values.clients.https.authenticationMethod.bearerTokenFile.enabled }}
{{- $_ := set . "bearerTokenFile" $.Values.clients.https.authenticationMethod.bearerTokenFile.bearerTokenFilePath }}
{{- end }}
{{- if $.Values.clients.https.authenticationMethod.bearerTokenSecret.enabled }}
{{- $_ := set . "bearerTokenSecret" $serviceAccountTokenName }}
{{- end }}
{{- if $.Values.clients.https.authenticationMethod.authorization.enabled }}
{{- if (hasKey . "authorization") }}
{{- $_ := set (get . "authorization") "type" $.Values.clients.https.authenticationMethod.authorization.type }}
{{- $_ := set (get . "authorization") "credentials" (dict "name" $serviceAccountTokenName "key" $.Values.clients.https.authenticationMethod.authorization.credentials.key "optional" $.Values.clients.https.authenticationMethod.authorization.credentials.optional) }}
{{- else }}
{{- $_ := set . "authorization" (dict "type" $.Values.clients.https.authenticationMethod.authorization.type) }}
{{- $_ := set . "authorization" (dict "credentials" (dict "name" $serviceAccountTokenName "key" $.Values.clients.https.authenticationMethod.authorization.credentials.key "optional" $.Values.clients.https.authenticationMethod.authorization.credentials.optional)) }}
{{- end }}
{{- end }}
{{- end }}
{{- toYaml $endpoints }}
{{- end -}}
{{- end -}}

14
packages/rancher-monitoring/rancher-pushprox/charts/templates/pushprox-clients-rbac.yaml
View File

@ -42,6 +42,18 @@ metadata:
namespace: {{ include "pushprox.namespace" . }}
labels: {{ include "pushProxy.client.labels" . | nindent 4 }}
---
{{- if .Values.clients.https.useServiceAccountCredentials }}
apiVersion: v1
kind: Secret
type: kubernetes.io/service-account-token
metadata:
name: {{ template "pushProxy.client.serviceAccountTokenName" . }}
namespace: {{ include "pushprox.namespace" . }}
labels: {{ include "pushProxy.client.labels" . | nindent 4 }}
annotations:
kubernetes.io/service-account.name: {{ template "pushProxy.client.name" . }}
{{- end }}
---
{{- if .Values.global.cattle.psp.enabled }}
apiVersion: policy/v1beta1
kind: PodSecurityPolicy
@ -82,4 +94,4 @@ spec:
readOnly: true
{{- end }}
{{- end }}
{{- end }}{{- end }}
{{- end }}{{- end }}

6
packages/rancher-monitoring/rancher-pushprox/charts/templates/pushprox-clients.yaml
View File

@ -35,6 +35,10 @@ spec:
hostNetwork: true
dnsPolicy: ClusterFirstWithHostNet
serviceAccountName: {{ template "pushProxy.client.name" . }}
{{- if .Values.global.imagePullSecretName }}
imagePullSecrets:
- name: {{ .Values.global.imagePullSecretName }}
{{- end }}
containers:
- name: pushprox-client
image: {{ template "system_default_registry" . }}{{ .Values.clients.image.repository }}:{{ .Values.clients.image.tag }}
@ -150,4 +154,4 @@ spec:
- name: metrics-cert-dir
emptyDir: {}
{{- end }}
{{- end }}{{- end }}
{{- end }}{{- end }}

6
packages/rancher-monitoring/rancher-pushprox/charts/templates/pushprox-proxy.yaml
View File

@ -26,6 +26,10 @@ spec:
{{ toYaml .Values.proxy.tolerations | indent 8 }}
{{- end }}
serviceAccountName: {{ template "pushProxy.proxy.name" . }}
{{- if .Values.global.imagePullSecretName }}
imagePullSecrets:
- name: {{ .Values.global.imagePullSecretName }}
{{- end }}
containers:
- name: pushprox-proxy
image: {{ template "system_default_registry" . }}{{ .Values.proxy.image.repository }}:{{ .Values.proxy.image.tag }}
@ -50,4 +54,4 @@ spec:
protocol: TCP
targetPort: {{ .Values.proxy.port }}
selector: {{ include "pushProxy.proxy.labels" . | nindent 4 }}
{{- end }}{{- end }}
{{- end }}{{- end }}

2
packages/rancher-monitoring/rancher-pushprox/charts/templates/pushprox-servicemonitor.yaml
View File

@ -42,4 +42,4 @@ spec:
protocol: TCP
targetPort: {{ .Values.metricsPort }}
selector: {{ default (include "pushProxy.client.labels" .) $selector | nindent 4 }}
{{- end }}{{- end }}
{{- end }}{{- end }}

22
packages/rancher-monitoring/rancher-pushprox/charts/values.yaml
View File

@ -75,9 +75,29 @@ clients:
https:
# Does the client require https to access the metrics?
enabled: false
# Does the client require requests be sent to http or https?
forceHTTPSScheme: false
# If set to true, the client will create a service account with adequate permissions and set a flag
# on the client to use the service account token provided by it to make authorized scrape requests
useServiceAccountCredentials: false
# Configuration for authentication to metrics via https endpoint
authenticationMethod:
# Reads token from defined file in container
# This function is deprecated in the prometheus operator api and may be removed in a future version
bearerTokenFile:
enabled: false
bearerTokenFilePath: "/var/run/secrets/kubernetes.io/serviceaccount/token"
# Reads token from defined secret in namespace
# This function is deprecated in the prometheus operator api and may be removed in a future version
bearerTokenSecret:
enabled: false
# Reads token from defined secret in namespace
authorization:
enabled: false
type: "bearer"
credentials:
key: "token"
optional: false
# If set to true, the client will disable SSL security checks
insecureSkipVerify: false
# Directory on host where necessary TLS cert and key to scrape metrics can be found
@ -143,4 +163,4 @@ proxy:
image:
repository: rancher/pushprox-proxy
tag: v0.1.0-rancher2-proxy
command: ["pushprox-proxy"]
command: ["pushprox-proxy"]