andata
/
rancher-charts
mirror of https://git.rancher.io/charts
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

make charts && make validate

pull/3225/head
SamuZad 2023-12-10 00:38:09 +00:00
parent 3a699797bf
commit f149c9f184
138 changed files with 172 additions and 1583 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

BIN
assets/rancher-monitoring/rancher-monitoring-103.0.1+up45.31.1.tgz
View File

Binary file not shown.

4
charts/rancher-monitoring/103.0.1+up45.31.1/charts/hardenedKubelet/Chart.yaml
View File

@ -6,9 +6,9 @@ annotations:
catalog.rancher.io/namespace: cattle-monitoring-system
catalog.rancher.io/release-name: rancher-pushprox
apiVersion: v1
appVersion: 0.1.1
appVersion: 0.1.0
description: Sets up a deployment of the PushProx proxy and a DaemonSet of PushProx
clients.
name: hardenedKubelet
type: application
version: 103.0.0
version: 0.1.6

10
charts/rancher-monitoring/103.0.1+up45.31.1/charts/hardenedKubelet/README.md
View File

@ -55,15 +55,7 @@ The following tables list the configurable parameters of the rancher-pushprox ch
| `clients.proxyUrl` | Overrides the default proxyUrl setting of `http://pushprox-{{ .Values.component }}-proxy.{{ . Release.Namespace }}.svc.cluster.local:{{ .Values.proxy.port }}"` with the `proxyUrl` specified | `""` |
| `clients.useLocalhost` | Sets a flag on each client deployment to redirect scrapes directed to `HOST_IP` to `127.0.0.1` | `false` |
| `clients.https.enabled` | Enables scraping metrics via HTTPS using the provided TLS certs that exist on each host | `false` |
| `clients.https.forceHTTPSScheme` | Forces scraping metrics via HTTPS using the provided TLS certs that exist on each host | `false` |
| `clients.https.useServiceAccountCredentials` | If set to true, the client will create a service account with permissions to scrape `/metrics` endpoint of Kubernetes components. The client will use the service account token provided to make authorized scrape requests to the Kubernetes API | `false` |
| `clients.https.authenticationMethod.bearerTokenFile.enabled` | If set to true, the client will use service account credentials mounted at the configured path `clients.https.authenticationMethod.bearerTokenFile.bearerTokenFilePath`. This requires permissions to scrape `/metrics` endpoint of Kubernetes components. This method is deprecated by the prometheus operator and may be removed in a future release | `false` |
| `clients.https.authenticationMethod.bearerTokenFile.bearerTokenFilePath` | This is a volume mount on the pod with permissions to scrape `/metrics` endpoint of Kubernetes components | `"/var/run/secrets/kubernetes.io/serviceaccount/token"` |
| `clients.https.authenticationMethod.bearerTokenSecret.enabled` | If set to true, the client will use service account credentials to scrape `/metrics` endpoint of Kubernetes components. This method is deprecated by the prometheus operator and may be removed in a future release | `false` |
| `clients.https.authenticationMethod.authorization.enabled` | If set to true, the client will use service account credentials to scrape `/metrics` endpoint of Kubernetes components | `false` |
| `clients.https.authenticationMethod.authorization.type` | If set, the client will use this type of authorization in its client requests for metrics | `"bearer"` |
| `clients.https.authenticationMethod.authorization.credentials.key` | If set, the client will use this key in the secret created by `clients.https.useServiceAccountCredentials` for authorization in its client requests for metrics | `"token"` |
| `clients.https.authenticationMethod.authorization.credentials.optional` | If set to false, the client will fail if the key in the secret created by `clients.https.useServiceAccountCredentials` does not exist | `false` |
| `clients.https.insecureSkipVerify` | If set to true, the client will disable SSL security checks | `false` |
| `clients.https.certDir` | A `hostPath` where TLS certs can be found. This path is mounted as a volume on an `initContainer` which copies only the necessary files over to an EmptyDir volume used by each client. Required and only used if `clients.https.enabled` is set | `""` |
| `clients.https.certFile` | The path to the TLS cert file located within `clients.https.certDir`. Required and only used if `clients.https.enabled` is set | `""` |
@ -87,4 +79,4 @@ The following tables list the configurable parameters of the rancher-pushprox ch
*Tip: The filepaths set in `clients.https.<cert|key|caCert>File` can include wildcard characters*.
See [rancher-monitoring](https://github.com/rancher/charts/tree/gh-pages/packages/rancher-monitoring) for examples of how this chart can be used.
See [rancher-monitoring](https://github.com/rancher/charts/tree/gh-pages/packages/rancher-monitoring) for examples of how this chart can be used.

39
charts/rancher-monitoring/103.0.1+up45.31.1/charts/hardenedKubelet/templates/_helpers.tpl
View File

@ -68,10 +68,6 @@ provider: kubernetes
{{- printf "pushprox-%s-client" (required ".Values.component is required" .Values.component) -}}
{{- end -}}
{{- define "pushProxy.client.serviceAccountTokenName" -}}
{{- printf "pushprox-%s-client-service-account-token" (required ".Values.component is required" .Values.component) -}}
{{- end -}}
{{- define "pushProxy.client.labels" -}}
k8s-app: {{ template "pushProxy.client.name" . }}
{{ template "pushProxy.commonLabels" . }}
@ -102,11 +98,6 @@ app: {{ template "pushprox.serviceMonitor.name" . }}
{{- define "pushProxy.serviceMonitor.endpoints" -}}
{{- $proxyURL := (include "pushProxy.proxyUrl" .) -}}
{{- $useHTTPS := .Values.clients.https.enabled -}}
{{- $forceHTTPSScheme := .Values.clients.https.forceHTTPSScheme -}}
{{- $insecureSkipVerify := .Values.clients.https.insecureSkipVerify -}}
{{- $useServiceAccountCredentials := .Values.clients.https.useServiceAccountCredentials -}}
{{- $serviceAccountTokenName := (include "pushProxy.client.serviceAccountTokenName" . ) -}}
{{- $metricRelabelings := list }}
{{- $endpoints := .Values.serviceMonitor.endpoints }}
{{- range $endpoints }}
{{- if $.Values.proxy.enabled }}
@ -126,14 +117,8 @@ app: {{ template "pushprox.serviceMonitor.name" . }}
{{- $_ := set $clusterNameRelabel "targetLabel" "cluster_name" }}
{{- $_ := set $clusterNameRelabel "replacement" $.Values.global.cattle.clusterName }}
{{- end }}
{{- $metricRelabelings := gt (len (keys $clusterNameRelabel)) 0 | ternary (append ($metricRelabelings) ($clusterNameRelabel)) ($metricRelabelings) }}
{{- $metricRelabelings := gt (len (keys $clusterIdRelabel)) 0 | ternary (append ($metricRelabelings) ($clusterIdRelabel)) ($metricRelabelings) }}
{{- if not (empty $metricRelabelings) }}
{{- $metricRelabelings := append (list ($clusterNameRelabel)) ($clusterIdRelabel) }}
{{- $_ := set . "metricRelabelings" ($metricRelabelings)}}
{{- end }}
{{- if $forceHTTPSScheme -}}
{{- $_ := set . "scheme" "https" }}
{{- end -}}
{{- if $useHTTPS -}}
{{- if (hasKey . "params") }}
{{- $_ := set (get . "params") "_scheme" (list "https") }}
@ -141,26 +126,6 @@ app: {{ template "pushprox.serviceMonitor.name" . }}
{{- $_ := set . "params" (dict "_scheme" (list "https")) }}
{{- end }}
{{- end }}
{{- if (hasKey . "tlsConfig") }}
{{- $_ := set (get . "tlsConfig") "insecureSkipVerify" $insecureSkipVerify }}
{{- else }}
{{- $_ := set . "tlsConfig" (dict "insecureSkipVerify" $insecureSkipVerify) }}
{{- end }}
{{- if $.Values.clients.https.authenticationMethod.bearerTokenFile.enabled }}
{{- $_ := set . "bearerTokenFile" $.Values.clients.https.authenticationMethod.bearerTokenFile.bearerTokenFilePath }}
{{- end }}
{{- if $.Values.clients.https.authenticationMethod.bearerTokenSecret.enabled }}
{{- $_ := set . "bearerTokenSecret" $serviceAccountTokenName }}
{{- end }}
{{- if $.Values.clients.https.authenticationMethod.authorization.enabled }}
{{- if (hasKey . "authorization") }}
{{- $_ := set (get . "authorization") "type" $.Values.clients.https.authenticationMethod.authorization.type }}
{{- $_ := set (get . "authorization") "credentials" (dict "name" $serviceAccountTokenName "key" $.Values.clients.https.authenticationMethod.authorization.credentials.key "optional" $.Values.clients.https.authenticationMethod.authorization.credentials.optional) }}
{{- else }}
{{- $_ := set . "authorization" (dict "type" $.Values.clients.https.authenticationMethod.authorization.type) }}
{{- $_ := set . "authorization" (dict "credentials" (dict "name" $serviceAccountTokenName "key" $.Values.clients.https.authenticationMethod.authorization.credentials.key "optional" $.Values.clients.https.authenticationMethod.authorization.credentials.optional)) }}
{{- end }}
{{- end }}
{{- end }}
{{- toYaml $endpoints }}
{{- end -}}
{{- end -}}

14
charts/rancher-monitoring/103.0.1+up45.31.1/charts/hardenedKubelet/templates/pushprox-clients-rbac.yaml
View File

@ -42,18 +42,6 @@ metadata:
namespace: {{ include "pushprox.namespace" . }}
labels: {{ include "pushProxy.client.labels" . | nindent 4 }}
---
{{- if .Values.clients.https.useServiceAccountCredentials }}
apiVersion: v1
kind: Secret
type: kubernetes.io/service-account-token
metadata:
name: {{ template "pushProxy.client.serviceAccountTokenName" . }}
namespace: {{ include "pushprox.namespace" . }}
labels: {{ include "pushProxy.client.labels" . | nindent 4 }}
annotations:
kubernetes.io/service-account.name: {{ template "pushProxy.client.name" . }}
{{- end }}
---
{{- if .Values.global.cattle.psp.enabled }}
apiVersion: policy/v1beta1
kind: PodSecurityPolicy
@ -94,4 +82,4 @@ spec:
readOnly: true
{{- end }}
{{- end }}
{{- end }}{{- end }}
{{- end }}{{- end }}

6
charts/rancher-monitoring/103.0.1+up45.31.1/charts/hardenedKubelet/templates/pushprox-clients.yaml
View File

@ -35,10 +35,6 @@ spec:
hostNetwork: true
dnsPolicy: ClusterFirstWithHostNet
serviceAccountName: {{ template "pushProxy.client.name" . }}
{{- if .Values.global.imagePullSecretName }}
imagePullSecrets:
- name: {{ .Values.global.imagePullSecretName }}
{{- end }}
containers:
- name: pushprox-client
image: {{ template "system_default_registry" . }}{{ .Values.clients.image.repository }}:{{ .Values.clients.image.tag }}
@ -154,4 +150,4 @@ spec:
- name: metrics-cert-dir
emptyDir: {}
{{- end }}
{{- end }}{{- end }}
{{- end }}{{- end }}

6
charts/rancher-monitoring/103.0.1+up45.31.1/charts/hardenedKubelet/templates/pushprox-proxy.yaml
View File

@ -26,10 +26,6 @@ spec:
{{ toYaml .Values.proxy.tolerations | indent 8 }}
{{- end }}
serviceAccountName: {{ template "pushProxy.proxy.name" . }}
{{- if .Values.global.imagePullSecretName }}
imagePullSecrets:
- name: {{ .Values.global.imagePullSecretName }}
{{- end }}
containers:
- name: pushprox-proxy
image: {{ template "system_default_registry" . }}{{ .Values.proxy.image.repository }}:{{ .Values.proxy.image.tag }}
@ -54,4 +50,4 @@ spec:
protocol: TCP
targetPort: {{ .Values.proxy.port }}
selector: {{ include "pushProxy.proxy.labels" . | nindent 4 }}
{{- end }}{{- end }}
{{- end }}{{- end }}

2
charts/rancher-monitoring/103.0.1+up45.31.1/charts/hardenedKubelet/templates/pushprox-servicemonitor.yaml
View File

@ -42,4 +42,4 @@ spec:
protocol: TCP
targetPort: {{ .Values.metricsPort }}
selector: {{ default (include "pushProxy.client.labels" .) $selector | nindent 4 }}
{{- end }}{{- end }}
{{- end }}{{- end }}

22
charts/rancher-monitoring/103.0.1+up45.31.1/charts/hardenedKubelet/values.yaml
View File

@ -75,29 +75,9 @@ clients:
https:
# Does the client require https to access the metrics?
enabled: false
# Does the client require requests be sent to http or https?
forceHTTPSScheme: false
# If set to true, the client will create a service account with adequate permissions and set a flag
# on the client to use the service account token provided by it to make authorized scrape requests
useServiceAccountCredentials: false
# Configuration for authentication to metrics via https endpoint
authenticationMethod:
# Reads token from defined file in container
# This function is deprecated in the prometheus operator api and may be removed in a future version
bearerTokenFile:
enabled: false
bearerTokenFilePath: "/var/run/secrets/kubernetes.io/serviceaccount/token"
# Reads token from defined secret in namespace
# This function is deprecated in the prometheus operator api and may be removed in a future version
bearerTokenSecret:
enabled: false
# Reads token from defined secret in namespace
authorization:
enabled: false
type: "bearer"
credentials:
key: "token"
optional: false
# If set to true, the client will disable SSL security checks
insecureSkipVerify: false
# Directory on host where necessary TLS cert and key to scrape metrics can be found
@ -163,4 +143,4 @@ proxy:
image:
repository: rancher/pushprox-proxy
tag: v0.1.0-rancher2-proxy
command: ["pushprox-proxy"]
command: ["pushprox-proxy"]

4
charts/rancher-monitoring/103.0.1+up45.31.1/charts/hardenedNodeExporter/Chart.yaml
View File

@ -6,9 +6,9 @@ annotations:
catalog.rancher.io/namespace: cattle-monitoring-system
catalog.rancher.io/release-name: rancher-pushprox
apiVersion: v1
appVersion: 0.1.1
appVersion: 0.1.0
description: Sets up a deployment of the PushProx proxy and a DaemonSet of PushProx
clients.
name: hardenedNodeExporter
type: application
version: 103.0.0
version: 0.1.6

10
charts/rancher-monitoring/103.0.1+up45.31.1/charts/hardenedNodeExporter/README.md
View File

@ -55,15 +55,7 @@ The following tables list the configurable parameters of the rancher-pushprox ch
| `clients.proxyUrl` | Overrides the default proxyUrl setting of `http://pushprox-{{ .Values.component }}-proxy.{{ . Release.Namespace }}.svc.cluster.local:{{ .Values.proxy.port }}"` with the `proxyUrl` specified | `""` |
| `clients.useLocalhost` | Sets a flag on each client deployment to redirect scrapes directed to `HOST_IP` to `127.0.0.1` | `false` |
| `clients.https.enabled` | Enables scraping metrics via HTTPS using the provided TLS certs that exist on each host | `false` |
| `clients.https.forceHTTPSScheme` | Forces scraping metrics via HTTPS using the provided TLS certs that exist on each host | `false` |
| `clients.https.useServiceAccountCredentials` | If set to true, the client will create a service account with permissions to scrape `/metrics` endpoint of Kubernetes components. The client will use the service account token provided to make authorized scrape requests to the Kubernetes API | `false` |
| `clients.https.authenticationMethod.bearerTokenFile.enabled` | If set to true, the client will use service account credentials mounted at the configured path `clients.https.authenticationMethod.bearerTokenFile.bearerTokenFilePath`. This requires permissions to scrape `/metrics` endpoint of Kubernetes components. This method is deprecated by the prometheus operator and may be removed in a future release | `false` |
| `clients.https.authenticationMethod.bearerTokenFile.bearerTokenFilePath` | This is a volume mount on the pod with permissions to scrape `/metrics` endpoint of Kubernetes components | `"/var/run/secrets/kubernetes.io/serviceaccount/token"` |
| `clients.https.authenticationMethod.bearerTokenSecret.enabled` | If set to true, the client will use service account credentials to scrape `/metrics` endpoint of Kubernetes components. This method is deprecated by the prometheus operator and may be removed in a future release | `false` |
| `clients.https.authenticationMethod.authorization.enabled` | If set to true, the client will use service account credentials to scrape `/metrics` endpoint of Kubernetes components | `false` |
| `clients.https.authenticationMethod.authorization.type` | If set, the client will use this type of authorization in its client requests for metrics | `"bearer"` |
| `clients.https.authenticationMethod.authorization.credentials.key` | If set, the client will use this key in the secret created by `clients.https.useServiceAccountCredentials` for authorization in its client requests for metrics | `"token"` |
| `clients.https.authenticationMethod.authorization.credentials.optional` | If set to false, the client will fail if the key in the secret created by `clients.https.useServiceAccountCredentials` does not exist | `false` |
| `clients.https.insecureSkipVerify` | If set to true, the client will disable SSL security checks | `false` |
| `clients.https.certDir` | A `hostPath` where TLS certs can be found. This path is mounted as a volume on an `initContainer` which copies only the necessary files over to an EmptyDir volume used by each client. Required and only used if `clients.https.enabled` is set | `""` |
| `clients.https.certFile` | The path to the TLS cert file located within `clients.https.certDir`. Required and only used if `clients.https.enabled` is set | `""` |
@ -87,4 +79,4 @@ The following tables list the configurable parameters of the rancher-pushprox ch
*Tip: The filepaths set in `clients.https.<cert|key|caCert>File` can include wildcard characters*.
See [rancher-monitoring](https://github.com/rancher/charts/tree/gh-pages/packages/rancher-monitoring) for examples of how this chart can be used.
See [rancher-monitoring](https://github.com/rancher/charts/tree/gh-pages/packages/rancher-monitoring) for examples of how this chart can be used.

39
charts/rancher-monitoring/103.0.1+up45.31.1/charts/hardenedNodeExporter/templates/_helpers.tpl
View File

@ -68,10 +68,6 @@ provider: kubernetes
{{- printf "pushprox-%s-client" (required ".Values.component is required" .Values.component) -}}
{{- end -}}
{{- define "pushProxy.client.serviceAccountTokenName" -}}
{{- printf "pushprox-%s-client-service-account-token" (required ".Values.component is required" .Values.component) -}}
{{- end -}}
{{- define "pushProxy.client.labels" -}}
k8s-app: {{ template "pushProxy.client.name" . }}
{{ template "pushProxy.commonLabels" . }}
@ -102,11 +98,6 @@ app: {{ template "pushprox.serviceMonitor.name" . }}
{{- define "pushProxy.serviceMonitor.endpoints" -}}
{{- $proxyURL := (include "pushProxy.proxyUrl" .) -}}
{{- $useHTTPS := .Values.clients.https.enabled -}}
{{- $forceHTTPSScheme := .Values.clients.https.forceHTTPSScheme -}}
{{- $insecureSkipVerify := .Values.clients.https.insecureSkipVerify -}}
{{- $useServiceAccountCredentials := .Values.clients.https.useServiceAccountCredentials -}}
{{- $serviceAccountTokenName := (include "pushProxy.client.serviceAccountTokenName" . ) -}}
{{- $metricRelabelings := list }}
{{- $endpoints := .Values.serviceMonitor.endpoints }}
{{- range $endpoints }}
{{- if $.Values.proxy.enabled }}
@ -126,14 +117,8 @@ app: {{ template "pushprox.serviceMonitor.name" . }}
{{- $_ := set $clusterNameRelabel "targetLabel" "cluster_name" }}
{{- $_ := set $clusterNameRelabel "replacement" $.Values.global.cattle.clusterName }}
{{- end }}
{{- $metricRelabelings := gt (len (keys $clusterNameRelabel)) 0 | ternary (append ($metricRelabelings) ($clusterNameRelabel)) ($metricRelabelings) }}
{{- $metricRelabelings := gt (len (keys $clusterIdRelabel)) 0 | ternary (append ($metricRelabelings) ($clusterIdRelabel)) ($metricRelabelings) }}
{{- if not (empty $metricRelabelings) }}
{{- $metricRelabelings := append (list ($clusterNameRelabel)) ($clusterIdRelabel) }}
{{- $_ := set . "metricRelabelings" ($metricRelabelings)}}
{{- end }}
{{- if $forceHTTPSScheme -}}
{{- $_ := set . "scheme" "https" }}
{{- end -}}
{{- if $useHTTPS -}}
{{- if (hasKey . "params") }}
{{- $_ := set (get . "params") "_scheme" (list "https") }}
@ -141,26 +126,6 @@ app: {{ template "pushprox.serviceMonitor.name" . }}
{{- $_ := set . "params" (dict "_scheme" (list "https")) }}
{{- end }}
{{- end }}
{{- if (hasKey . "tlsConfig") }}
{{- $_ := set (get . "tlsConfig") "insecureSkipVerify" $insecureSkipVerify }}
{{- else }}
{{- $_ := set . "tlsConfig" (dict "insecureSkipVerify" $insecureSkipVerify) }}
{{- end }}
{{- if $.Values.clients.https.authenticationMethod.bearerTokenFile.enabled }}
{{- $_ := set . "bearerTokenFile" $.Values.clients.https.authenticationMethod.bearerTokenFile.bearerTokenFilePath }}
{{- end }}
{{- if $.Values.clients.https.authenticationMethod.bearerTokenSecret.enabled }}
{{- $_ := set . "bearerTokenSecret" $serviceAccountTokenName }}
{{- end }}
{{- if $.Values.clients.https.authenticationMethod.authorization.enabled }}
{{- if (hasKey . "authorization") }}
{{- $_ := set (get . "authorization") "type" $.Values.clients.https.authenticationMethod.authorization.type }}
{{- $_ := set (get . "authorization") "credentials" (dict "name" $serviceAccountTokenName "key" $.Values.clients.https.authenticationMethod.authorization.credentials.key "optional" $.Values.clients.https.authenticationMethod.authorization.credentials.optional) }}
{{- else }}
{{- $_ := set . "authorization" (dict "type" $.Values.clients.https.authenticationMethod.authorization.type) }}
{{- $_ := set . "authorization" (dict "credentials" (dict "name" $serviceAccountTokenName "key" $.Values.clients.https.authenticationMethod.authorization.credentials.key "optional" $.Values.clients.https.authenticationMethod.authorization.credentials.optional)) }}
{{- end }}
{{- end }}
{{- end }}
{{- toYaml $endpoints }}
{{- end -}}
{{- end -}}

14
charts/rancher-monitoring/103.0.1+up45.31.1/charts/hardenedNodeExporter/templates/pushprox-clients-rbac.yaml
View File

@ -42,18 +42,6 @@ metadata:
namespace: {{ include "pushprox.namespace" . }}
labels: {{ include "pushProxy.client.labels" . | nindent 4 }}
---
{{- if .Values.clients.https.useServiceAccountCredentials }}
apiVersion: v1
kind: Secret
type: kubernetes.io/service-account-token
metadata:
name: {{ template "pushProxy.client.serviceAccountTokenName" . }}
namespace: {{ include "pushprox.namespace" . }}
labels: {{ include "pushProxy.client.labels" . | nindent 4 }}
annotations:
kubernetes.io/service-account.name: {{ template "pushProxy.client.name" . }}
{{- end }}
---
{{- if .Values.global.cattle.psp.enabled }}
apiVersion: policy/v1beta1
kind: PodSecurityPolicy
@ -94,4 +82,4 @@ spec:
readOnly: true
{{- end }}
{{- end }}
{{- end }}{{- end }}
{{- end }}{{- end }}

6
charts/rancher-monitoring/103.0.1+up45.31.1/charts/hardenedNodeExporter/templates/pushprox-clients.yaml
View File

@ -35,10 +35,6 @@ spec:
hostNetwork: true
dnsPolicy: ClusterFirstWithHostNet
serviceAccountName: {{ template "pushProxy.client.name" . }}
{{- if .Values.global.imagePullSecretName }}
imagePullSecrets:
- name: {{ .Values.global.imagePullSecretName }}
{{- end }}
containers:
- name: pushprox-client
image: {{ template "system_default_registry" . }}{{ .Values.clients.image.repository }}:{{ .Values.clients.image.tag }}
@ -154,4 +150,4 @@ spec:
- name: metrics-cert-dir
emptyDir: {}
{{- end }}
{{- end }}{{- end }}
{{- end }}{{- end }}

6
charts/rancher-monitoring/103.0.1+up45.31.1/charts/hardenedNodeExporter/templates/pushprox-proxy.yaml
View File

@ -26,10 +26,6 @@ spec:
{{ toYaml .Values.proxy.tolerations | indent 8 }}
{{- end }}
serviceAccountName: {{ template "pushProxy.proxy.name" . }}
{{- if .Values.global.imagePullSecretName }}
imagePullSecrets:
- name: {{ .Values.global.imagePullSecretName }}
{{- end }}
containers:
- name: pushprox-proxy
image: {{ template "system_default_registry" . }}{{ .Values.proxy.image.repository }}:{{ .Values.proxy.image.tag }}
@ -54,4 +50,4 @@ spec:
protocol: TCP
targetPort: {{ .Values.proxy.port }}
selector: {{ include "pushProxy.proxy.labels" . | nindent 4 }}
{{- end }}{{- end }}
{{- end }}{{- end }}

2
charts/rancher-monitoring/103.0.1+up45.31.1/charts/hardenedNodeExporter/templates/pushprox-servicemonitor.yaml
View File

@ -42,4 +42,4 @@ spec:
protocol: TCP
targetPort: {{ .Values.metricsPort }}
selector: {{ default (include "pushProxy.client.labels" .) $selector | nindent 4 }}
{{- end }}{{- end }}
{{- end }}{{- end }}

22
charts/rancher-monitoring/103.0.1+up45.31.1/charts/hardenedNodeExporter/values.yaml
View File

@ -75,29 +75,9 @@ clients:
https:
# Does the client require https to access the metrics?
enabled: false
# Does the client require requests be sent to http or https?
forceHTTPSScheme: false
# If set to true, the client will create a service account with adequate permissions and set a flag
# on the client to use the service account token provided by it to make authorized scrape requests
useServiceAccountCredentials: false
# Configuration for authentication to metrics via https endpoint
authenticationMethod:
# Reads token from defined file in container
# This function is deprecated in the prometheus operator api and may be removed in a future version
bearerTokenFile:
enabled: false
bearerTokenFilePath: "/var/run/secrets/kubernetes.io/serviceaccount/token"
# Reads token from defined secret in namespace
# This function is deprecated in the prometheus operator api and may be removed in a future version
bearerTokenSecret:
enabled: false
# Reads token from defined secret in namespace
authorization:
enabled: false
type: "bearer"
credentials:
key: "token"
optional: false
# If set to true, the client will disable SSL security checks
insecureSkipVerify: false
# Directory on host where necessary TLS cert and key to scrape metrics can be found
@ -163,4 +143,4 @@ proxy:
image:
repository: rancher/pushprox-proxy
tag: v0.1.0-rancher2-proxy
command: ["pushprox-proxy"]
command: ["pushprox-proxy"]

4
charts/rancher-monitoring/103.0.1+up45.31.1/charts/k3sServer/Chart.yaml
View File

@ -6,9 +6,9 @@ annotations:
catalog.rancher.io/namespace: cattle-monitoring-system
catalog.rancher.io/release-name: rancher-pushprox
apiVersion: v1
appVersion: 0.1.1
appVersion: 0.1.0
description: Sets up a deployment of the PushProx proxy and a DaemonSet of PushProx
clients.
name: k3sServer
type: application
version: 103.0.0
version: 0.1.6

10
charts/rancher-monitoring/103.0.1+up45.31.1/charts/k3sServer/README.md
View File

@ -55,15 +55,7 @@ The following tables list the configurable parameters of the rancher-pushprox ch
| `clients.proxyUrl` | Overrides the default proxyUrl setting of `http://pushprox-{{ .Values.component }}-proxy.{{ . Release.Namespace }}.svc.cluster.local:{{ .Values.proxy.port }}"` with the `proxyUrl` specified | `""` |
| `clients.useLocalhost` | Sets a flag on each client deployment to redirect scrapes directed to `HOST_IP` to `127.0.0.1` | `false` |
| `clients.https.enabled` | Enables scraping metrics via HTTPS using the provided TLS certs that exist on each host | `false` |
| `clients.https.forceHTTPSScheme` | Forces scraping metrics via HTTPS using the provided TLS certs that exist on each host | `false` |
| `clients.https.useServiceAccountCredentials` | If set to true, the client will create a service account with permissions to scrape `/metrics` endpoint of Kubernetes components. The client will use the service account token provided to make authorized scrape requests to the Kubernetes API | `false` |
| `clients.https.authenticationMethod.bearerTokenFile.enabled` | If set to true, the client will use service account credentials mounted at the configured path `clients.https.authenticationMethod.bearerTokenFile.bearerTokenFilePath`. This requires permissions to scrape `/metrics` endpoint of Kubernetes components. This method is deprecated by the prometheus operator and may be removed in a future release | `false` |
| `clients.https.authenticationMethod.bearerTokenFile.bearerTokenFilePath` | This is a volume mount on the pod with permissions to scrape `/metrics` endpoint of Kubernetes components | `"/var/run/secrets/kubernetes.io/serviceaccount/token"` |
| `clients.https.authenticationMethod.bearerTokenSecret.enabled` | If set to true, the client will use service account credentials to scrape `/metrics` endpoint of Kubernetes components. This method is deprecated by the prometheus operator and may be removed in a future release | `false` |
| `clients.https.authenticationMethod.authorization.enabled` | If set to true, the client will use service account credentials to scrape `/metrics` endpoint of Kubernetes components | `false` |
| `clients.https.authenticationMethod.authorization.type` | If set, the client will use this type of authorization in its client requests for metrics | `"bearer"` |
| `clients.https.authenticationMethod.authorization.credentials.key` | If set, the client will use this key in the secret created by `clients.https.useServiceAccountCredentials` for authorization in its client requests for metrics | `"token"` |
| `clients.https.authenticationMethod.authorization.credentials.optional` | If set to false, the client will fail if the key in the secret created by `clients.https.useServiceAccountCredentials` does not exist | `false` |
| `clients.https.insecureSkipVerify` | If set to true, the client will disable SSL security checks | `false` |
| `clients.https.certDir` | A `hostPath` where TLS certs can be found. This path is mounted as a volume on an `initContainer` which copies only the necessary files over to an EmptyDir volume used by each client. Required and only used if `clients.https.enabled` is set | `""` |
| `clients.https.certFile` | The path to the TLS cert file located within `clients.https.certDir`. Required and only used if `clients.https.enabled` is set | `""` |
@ -87,4 +79,4 @@ The following tables list the configurable parameters of the rancher-pushprox ch
*Tip: The filepaths set in `clients.https.<cert|key|caCert>File` can include wildcard characters*.
See [rancher-monitoring](https://github.com/rancher/charts/tree/gh-pages/packages/rancher-monitoring) for examples of how this chart can be used.
See [rancher-monitoring](https://github.com/rancher/charts/tree/gh-pages/packages/rancher-monitoring) for examples of how this chart can be used.

39
charts/rancher-monitoring/103.0.1+up45.31.1/charts/k3sServer/templates/_helpers.tpl
View File

@ -68,10 +68,6 @@ provider: kubernetes
{{- printf "pushprox-%s-client" (required ".Values.component is required" .Values.component) -}}
{{- end -}}
{{- define "pushProxy.client.serviceAccountTokenName" -}}
{{- printf "pushprox-%s-client-service-account-token" (required ".Values.component is required" .Values.component) -}}
{{- end -}}
{{- define "pushProxy.client.labels" -}}
k8s-app: {{ template "pushProxy.client.name" . }}
{{ template "pushProxy.commonLabels" . }}
@ -102,11 +98,6 @@ app: {{ template "pushprox.serviceMonitor.name" . }}
{{- define "pushProxy.serviceMonitor.endpoints" -}}
{{- $proxyURL := (include "pushProxy.proxyUrl" .) -}}
{{- $useHTTPS := .Values.clients.https.enabled -}}
{{- $forceHTTPSScheme := .Values.clients.https.forceHTTPSScheme -}}
{{- $insecureSkipVerify := .Values.clients.https.insecureSkipVerify -}}
{{- $useServiceAccountCredentials := .Values.clients.https.useServiceAccountCredentials -}}
{{- $serviceAccountTokenName := (include "pushProxy.client.serviceAccountTokenName" . ) -}}
{{- $metricRelabelings := list }}
{{- $endpoints := .Values.serviceMonitor.endpoints }}
{{- range $endpoints }}
{{- if $.Values.proxy.enabled }}
@ -126,14 +117,8 @@ app: {{ template "pushprox.serviceMonitor.name" . }}
{{- $_ := set $clusterNameRelabel "targetLabel" "cluster_name" }}
{{- $_ := set $clusterNameRelabel "replacement" $.Values.global.cattle.clusterName }}
{{- end }}
{{- $metricRelabelings := gt (len (keys $clusterNameRelabel)) 0 | ternary (append ($metricRelabelings) ($clusterNameRelabel)) ($metricRelabelings) }}
{{- $metricRelabelings := gt (len (keys $clusterIdRelabel)) 0 | ternary (append ($metricRelabelings) ($clusterIdRelabel)) ($metricRelabelings) }}
{{- if not (empty $metricRelabelings) }}
{{- $metricRelabelings := append (list ($clusterNameRelabel)) ($clusterIdRelabel) }}
{{- $_ := set . "metricRelabelings" ($metricRelabelings)}}
{{- end }}
{{- if $forceHTTPSScheme -}}
{{- $_ := set . "scheme" "https" }}
{{- end -}}
{{- if $useHTTPS -}}
{{- if (hasKey . "params") }}
{{- $_ := set (get . "params") "_scheme" (list "https") }}
@ -141,26 +126,6 @@ app: {{ template "pushprox.serviceMonitor.name" . }}
{{- $_ := set . "params" (dict "_scheme" (list "https")) }}
{{- end }}
{{- end }}
{{- if (hasKey . "tlsConfig") }}
{{- $_ := set (get . "tlsConfig") "insecureSkipVerify" $insecureSkipVerify }}
{{- else }}
{{- $_ := set . "tlsConfig" (dict "insecureSkipVerify" $insecureSkipVerify) }}
{{- end }}
{{- if $.Values.clients.https.authenticationMethod.bearerTokenFile.enabled }}
{{- $_ := set . "bearerTokenFile" $.Values.clients.https.authenticationMethod.bearerTokenFile.bearerTokenFilePath }}
{{- end }}
{{- if $.Values.clients.https.authenticationMethod.bearerTokenSecret.enabled }}
{{- $_ := set . "bearerTokenSecret" $serviceAccountTokenName }}
{{- end }}
{{- if $.Values.clients.https.authenticationMethod.authorization.enabled }}
{{- if (hasKey . "authorization") }}
{{- $_ := set (get . "authorization") "type" $.Values.clients.https.authenticationMethod.authorization.type }}
{{- $_ := set (get . "authorization") "credentials" (dict "name" $serviceAccountTokenName "key" $.Values.clients.https.authenticationMethod.authorization.credentials.key "optional" $.Values.clients.https.authenticationMethod.authorization.credentials.optional) }}
{{- else }}
{{- $_ := set . "authorization" (dict "type" $.Values.clients.https.authenticationMethod.authorization.type) }}
{{- $_ := set . "authorization" (dict "credentials" (dict "name" $serviceAccountTokenName "key" $.Values.clients.https.authenticationMethod.authorization.credentials.key "optional" $.Values.clients.https.authenticationMethod.authorization.credentials.optional)) }}
{{- end }}
{{- end }}
{{- end }}
{{- toYaml $endpoints }}
{{- end -}}
{{- end -}}

14
charts/rancher-monitoring/103.0.1+up45.31.1/charts/k3sServer/templates/pushprox-clients-rbac.yaml
View File

@ -42,18 +42,6 @@ metadata:
namespace: {{ include "pushprox.namespace" . }}
labels: {{ include "pushProxy.client.labels" . | nindent 4 }}
---
{{- if .Values.clients.https.useServiceAccountCredentials }}
apiVersion: v1
kind: Secret
type: kubernetes.io/service-account-token
metadata:
name: {{ template "pushProxy.client.serviceAccountTokenName" . }}
namespace: {{ include "pushprox.namespace" . }}
labels: {{ include "pushProxy.client.labels" . | nindent 4 }}
annotations:
kubernetes.io/service-account.name: {{ template "pushProxy.client.name" . }}
{{- end }}
---
{{- if .Values.global.cattle.psp.enabled }}
apiVersion: policy/v1beta1
kind: PodSecurityPolicy
@ -94,4 +82,4 @@ spec:
readOnly: true
{{- end }}
{{- end }}
{{- end }}{{- end }}
{{- end }}{{- end }}

6
charts/rancher-monitoring/103.0.1+up45.31.1/charts/k3sServer/templates/pushprox-clients.yaml
View File

@ -35,10 +35,6 @@ spec:
hostNetwork: true
dnsPolicy: ClusterFirstWithHostNet
serviceAccountName: {{ template "pushProxy.client.name" . }}
{{- if .Values.global.imagePullSecretName }}
imagePullSecrets:
- name: {{ .Values.global.imagePullSecretName }}
{{- end }}
containers:
- name: pushprox-client
image: {{ template "system_default_registry" . }}{{ .Values.clients.image.repository }}:{{ .Values.clients.image.tag }}
@ -154,4 +150,4 @@ spec:
- name: metrics-cert-dir
emptyDir: {}
{{- end }}
{{- end }}{{- end }}
{{- end }}{{- end }}

6
charts/rancher-monitoring/103.0.1+up45.31.1/charts/k3sServer/templates/pushprox-proxy.yaml
View File

@ -26,10 +26,6 @@ spec:
{{ toYaml .Values.proxy.tolerations | indent 8 }}
{{- end }}
serviceAccountName: {{ template "pushProxy.proxy.name" . }}
{{- if .Values.global.imagePullSecretName }}
imagePullSecrets:
- name: {{ .Values.global.imagePullSecretName }}
{{- end }}
containers:
- name: pushprox-proxy
image: {{ template "system_default_registry" . }}{{ .Values.proxy.image.repository }}:{{ .Values.proxy.image.tag }}
@ -54,4 +50,4 @@ spec:
protocol: TCP
targetPort: {{ .Values.proxy.port }}
selector: {{ include "pushProxy.proxy.labels" . | nindent 4 }}
{{- end }}{{- end }}
{{- end }}{{- end }}

2
charts/rancher-monitoring/103.0.1+up45.31.1/charts/k3sServer/templates/pushprox-servicemonitor.yaml
View File

@ -42,4 +42,4 @@ spec:
protocol: TCP
targetPort: {{ .Values.metricsPort }}
selector: {{ default (include "pushProxy.client.labels" .) $selector | nindent 4 }}
{{- end }}{{- end }}
{{- end }}{{- end }}

22
charts/rancher-monitoring/103.0.1+up45.31.1/charts/k3sServer/values.yaml
View File

@ -75,29 +75,9 @@ clients:
https:
# Does the client require https to access the metrics?
enabled: false
# Does the client require requests be sent to http or https?
forceHTTPSScheme: false
# If set to true, the client will create a service account with adequate permissions and set a flag
# on the client to use the service account token provided by it to make authorized scrape requests
useServiceAccountCredentials: false
# Configuration for authentication to metrics via https endpoint
authenticationMethod:
# Reads token from defined file in container
# This function is deprecated in the prometheus operator api and may be removed in a future version
bearerTokenFile:
enabled: false
bearerTokenFilePath: "/var/run/secrets/kubernetes.io/serviceaccount/token"
# Reads token from defined secret in namespace
# This function is deprecated in the prometheus operator api and may be removed in a future version
bearerTokenSecret:
enabled: false
# Reads token from defined secret in namespace
authorization:
enabled: false
type: "bearer"
credentials:
key: "token"
optional: false
# If set to true, the client will disable SSL security checks
insecureSkipVerify: false
# Directory on host where necessary TLS cert and key to scrape metrics can be found
@ -163,4 +143,4 @@ proxy:
image:
repository: rancher/pushprox-proxy
tag: v0.1.0-rancher2-proxy
command: ["pushprox-proxy"]
command: ["pushprox-proxy"]

4
charts/rancher-monitoring/103.0.1+up45.31.1/charts/kubeAdmControllerManager/Chart.yaml
View File

@ -6,9 +6,9 @@ annotations:
catalog.rancher.io/namespace: cattle-monitoring-system
catalog.rancher.io/release-name: rancher-pushprox
apiVersion: v1
appVersion: 0.1.1
appVersion: 0.1.0
description: Sets up a deployment of the PushProx proxy and a DaemonSet of PushProx
clients.
name: kubeAdmControllerManager
type: application
version: 103.0.0
version: 0.1.6

10
charts/rancher-monitoring/103.0.1+up45.31.1/charts/kubeAdmControllerManager/README.md
View File

@ -55,15 +55,7 @@ The following tables list the configurable parameters of the rancher-pushprox ch
| `clients.proxyUrl` | Overrides the default proxyUrl setting of `http://pushprox-{{ .Values.component }}-proxy.{{ . Release.Namespace }}.svc.cluster.local:{{ .Values.proxy.port }}"` with the `proxyUrl` specified | `""` |
| `clients.useLocalhost` | Sets a flag on each client deployment to redirect scrapes directed to `HOST_IP` to `127.0.0.1` | `false` |
| `clients.https.enabled` | Enables scraping metrics via HTTPS using the provided TLS certs that exist on each host | `false` |
| `clients.https.forceHTTPSScheme` | Forces scraping metrics via HTTPS using the provided TLS certs that exist on each host | `false` |
| `clients.https.useServiceAccountCredentials` | If set to true, the client will create a service account with permissions to scrape `/metrics` endpoint of Kubernetes components. The client will use the service account token provided to make authorized scrape requests to the Kubernetes API | `false` |
| `clients.https.authenticationMethod.bearerTokenFile.enabled` | If set to true, the client will use service account credentials mounted at the configured path `clients.https.authenticationMethod.bearerTokenFile.bearerTokenFilePath`. This requires permissions to scrape `/metrics` endpoint of Kubernetes components. This method is deprecated by the prometheus operator and may be removed in a future release | `false` |
| `clients.https.authenticationMethod.bearerTokenFile.bearerTokenFilePath` | This is a volume mount on the pod with permissions to scrape `/metrics` endpoint of Kubernetes components | `"/var/run/secrets/kubernetes.io/serviceaccount/token"` |
| `clients.https.authenticationMethod.bearerTokenSecret.enabled` | If set to true, the client will use service account credentials to scrape `/metrics` endpoint of Kubernetes components. This method is deprecated by the prometheus operator and may be removed in a future release | `false` |
| `clients.https.authenticationMethod.authorization.enabled` | If set to true, the client will use service account credentials to scrape `/metrics` endpoint of Kubernetes components | `false` |
| `clients.https.authenticationMethod.authorization.type` | If set, the client will use this type of authorization in its client requests for metrics | `"bearer"` |
| `clients.https.authenticationMethod.authorization.credentials.key` | If set, the client will use this key in the secret created by `clients.https.useServiceAccountCredentials` for authorization in its client requests for metrics | `"token"` |
| `clients.https.authenticationMethod.authorization.credentials.optional` | If set to false, the client will fail if the key in the secret created by `clients.https.useServiceAccountCredentials` does not exist | `false` |
| `clients.https.insecureSkipVerify` | If set to true, the client will disable SSL security checks | `false` |
| `clients.https.certDir` | A `hostPath` where TLS certs can be found. This path is mounted as a volume on an `initContainer` which copies only the necessary files over to an EmptyDir volume used by each client. Required and only used if `clients.https.enabled` is set | `""` |
| `clients.https.certFile` | The path to the TLS cert file located within `clients.https.certDir`. Required and only used if `clients.https.enabled` is set | `""` |
@ -87,4 +79,4 @@ The following tables list the configurable parameters of the rancher-pushprox ch
*Tip: The filepaths set in `clients.https.<cert|key|caCert>File` can include wildcard characters*.
See [rancher-monitoring](https://github.com/rancher/charts/tree/gh-pages/packages/rancher-monitoring) for examples of how this chart can be used.
See [rancher-monitoring](https://github.com/rancher/charts/tree/gh-pages/packages/rancher-monitoring) for examples of how this chart can be used.

39
charts/rancher-monitoring/103.0.1+up45.31.1/charts/kubeAdmControllerManager/templates/_helpers.tpl
View File

@ -68,10 +68,6 @@ provider: kubernetes
{{- printf "pushprox-%s-client" (required ".Values.component is required" .Values.component) -}}
{{- end -}}
{{- define "pushProxy.client.serviceAccountTokenName" -}}
{{- printf "pushprox-%s-client-service-account-token" (required ".Values.component is required" .Values.component) -}}
{{- end -}}
{{- define "pushProxy.client.labels" -}}
k8s-app: {{ template "pushProxy.client.name" . }}
{{ template "pushProxy.commonLabels" . }}
@ -102,11 +98,6 @@ app: {{ template "pushprox.serviceMonitor.name" . }}
{{- define "pushProxy.serviceMonitor.endpoints" -}}
{{- $proxyURL := (include "pushProxy.proxyUrl" .) -}}
{{- $useHTTPS := .Values.clients.https.enabled -}}
{{- $forceHTTPSScheme := .Values.clients.https.forceHTTPSScheme -}}
{{- $insecureSkipVerify := .Values.clients.https.insecureSkipVerify -}}
{{- $useServiceAccountCredentials := .Values.clients.https.useServiceAccountCredentials -}}
{{- $serviceAccountTokenName := (include "pushProxy.client.serviceAccountTokenName" . ) -}}
{{- $metricRelabelings := list }}
{{- $endpoints := .Values.serviceMonitor.endpoints }}
{{- range $endpoints }}
{{- if $.Values.proxy.enabled }}
@ -126,14 +117,8 @@ app: {{ template "pushprox.serviceMonitor.name" . }}
{{- $_ := set $clusterNameRelabel "targetLabel" "cluster_name" }}
{{- $_ := set $clusterNameRelabel "replacement" $.Values.global.cattle.clusterName }}
{{- end }}
{{- $metricRelabelings := gt (len (keys $clusterNameRelabel)) 0 | ternary (append ($metricRelabelings) ($clusterNameRelabel)) ($metricRelabelings) }}
{{- $metricRelabelings := gt (len (keys $clusterIdRelabel)) 0 | ternary (append ($metricRelabelings) ($clusterIdRelabel)) ($metricRelabelings) }}
{{- if not (empty $metricRelabelings) }}
{{- $metricRelabelings := append (list ($clusterNameRelabel)) ($clusterIdRelabel) }}
{{- $_ := set . "metricRelabelings" ($metricRelabelings)}}
{{- end }}
{{- if $forceHTTPSScheme -}}
{{- $_ := set . "scheme" "https" }}
{{- end -}}
{{- if $useHTTPS -}}
{{- if (hasKey . "params") }}
{{- $_ := set (get . "params") "_scheme" (list "https") }}
@ -141,26 +126,6 @@ app: {{ template "pushprox.serviceMonitor.name" . }}
{{- $_ := set . "params" (dict "_scheme" (list "https")) }}
{{- end }}
{{- end }}
{{- if (hasKey . "tlsConfig") }}
{{- $_ := set (get . "tlsConfig") "insecureSkipVerify" $insecureSkipVerify }}
{{- else }}
{{- $_ := set . "tlsConfig" (dict "insecureSkipVerify" $insecureSkipVerify) }}
{{- end }}
{{- if $.Values.clients.https.authenticationMethod.bearerTokenFile.enabled }}
{{- $_ := set . "bearerTokenFile" $.Values.clients.https.authenticationMethod.bearerTokenFile.bearerTokenFilePath }}
{{- end }}
{{- if $.Values.clients.https.authenticationMethod.bearerTokenSecret.enabled }}
{{- $_ := set . "bearerTokenSecret" $serviceAccountTokenName }}
{{- end }}
{{- if $.Values.clients.https.authenticationMethod.authorization.enabled }}
{{- if (hasKey . "authorization") }}
{{- $_ := set (get . "authorization") "type" $.Values.clients.https.authenticationMethod.authorization.type }}
{{- $_ := set (get . "authorization") "credentials" (dict "name" $serviceAccountTokenName "key" $.Values.clients.https.authenticationMethod.authorization.credentials.key "optional" $.Values.clients.https.authenticationMethod.authorization.credentials.optional) }}
{{- else }}
{{- $_ := set . "authorization" (dict "type" $.Values.clients.https.authenticationMethod.authorization.type) }}
{{- $_ := set . "authorization" (dict "credentials" (dict "name" $serviceAccountTokenName "key" $.Values.clients.https.authenticationMethod.authorization.credentials.key "optional" $.Values.clients.https.authenticationMethod.authorization.credentials.optional)) }}
{{- end }}
{{- end }}
{{- end }}
{{- toYaml $endpoints }}
{{- end -}}
{{- end -}}

14
charts/rancher-monitoring/103.0.1+up45.31.1/charts/kubeAdmControllerManager/templates/pushprox-clients-rbac.yaml
View File

@ -42,18 +42,6 @@ metadata:
namespace: {{ include "pushprox.namespace" . }}
labels: {{ include "pushProxy.client.labels" . | nindent 4 }}
---
{{- if .Values.clients.https.useServiceAccountCredentials }}
apiVersion: v1
kind: Secret
type: kubernetes.io/service-account-token
metadata:
name: {{ template "pushProxy.client.serviceAccountTokenName" . }}
namespace: {{ include "pushprox.namespace" . }}
labels: {{ include "pushProxy.client.labels" . | nindent 4 }}
annotations:
kubernetes.io/service-account.name: {{ template "pushProxy.client.name" . }}
{{- end }}
---
{{- if .Values.global.cattle.psp.enabled }}
apiVersion: policy/v1beta1
kind: PodSecurityPolicy
@ -94,4 +82,4 @@ spec:
readOnly: true
{{- end }}
{{- end }}
{{- end }}{{- end }}
{{- end }}{{- end }}

6
charts/rancher-monitoring/103.0.1+up45.31.1/charts/kubeAdmControllerManager/templates/pushprox-clients.yaml
View File

@ -35,10 +35,6 @@ spec:
hostNetwork: true
dnsPolicy: ClusterFirstWithHostNet
serviceAccountName: {{ template "pushProxy.client.name" . }}
{{- if .Values.global.imagePullSecretName }}
imagePullSecrets:
- name: {{ .Values.global.imagePullSecretName }}
{{- end }}
containers:
- name: pushprox-client
image: {{ template "system_default_registry" . }}{{ .Values.clients.image.repository }}:{{ .Values.clients.image.tag }}
@ -154,4 +150,4 @@ spec:
- name: metrics-cert-dir
emptyDir: {}
{{- end }}
{{- end }}{{- end }}
{{- end }}{{- end }}

6
charts/rancher-monitoring/103.0.1+up45.31.1/charts/kubeAdmControllerManager/templates/pushprox-proxy.yaml
View File

@ -26,10 +26,6 @@ spec:
{{ toYaml .Values.proxy.tolerations | indent 8 }}
{{- end }}
serviceAccountName: {{ template "pushProxy.proxy.name" . }}
{{- if .Values.global.imagePullSecretName }}
imagePullSecrets:
- name: {{ .Values.global.imagePullSecretName }}
{{- end }}
containers:
- name: pushprox-proxy
image: {{ template "system_default_registry" . }}{{ .Values.proxy.image.repository }}:{{ .Values.proxy.image.tag }}
@ -54,4 +50,4 @@ spec:
protocol: TCP
targetPort: {{ .Values.proxy.port }}
selector: {{ include "pushProxy.proxy.labels" . | nindent 4 }}
{{- end }}{{- end }}
{{- end }}{{- end }}

2
charts/rancher-monitoring/103.0.1+up45.31.1/charts/kubeAdmControllerManager/templates/pushprox-servicemonitor.yaml
View File

@ -42,4 +42,4 @@ spec:
protocol: TCP
targetPort: {{ .Values.metricsPort }}
selector: {{ default (include "pushProxy.client.labels" .) $selector | nindent 4 }}
{{- end }}{{- end }}
{{- end }}{{- end }}

22
charts/rancher-monitoring/103.0.1+up45.31.1/charts/kubeAdmControllerManager/values.yaml
View File

@ -75,29 +75,9 @@ clients:
https:
# Does the client require https to access the metrics?
enabled: false
# Does the client require requests be sent to http or https?
forceHTTPSScheme: false
# If set to true, the client will create a service account with adequate permissions and set a flag
# on the client to use the service account token provided by it to make authorized scrape requests
useServiceAccountCredentials: false
# Configuration for authentication to metrics via https endpoint
authenticationMethod:
# Reads token from defined file in container
# This function is deprecated in the prometheus operator api and may be removed in a future version
bearerTokenFile:
enabled: false
bearerTokenFilePath: "/var/run/secrets/kubernetes.io/serviceaccount/token"
# Reads token from defined secret in namespace
# This function is deprecated in the prometheus operator api and may be removed in a future version
bearerTokenSecret:
enabled: false
# Reads token from defined secret in namespace
authorization:
enabled: false
type: "bearer"
credentials:
key: "token"
optional: false
# If set to true, the client will disable SSL security checks
insecureSkipVerify: false
# Directory on host where necessary TLS cert and key to scrape metrics can be found
@ -163,4 +143,4 @@ proxy:
image:
repository: rancher/pushprox-proxy
tag: v0.1.0-rancher2-proxy
command: ["pushprox-proxy"]
command: ["pushprox-proxy"]

4
charts/rancher-monitoring/103.0.1+up45.31.1/charts/kubeAdmEtcd/Chart.yaml
View File

@ -6,9 +6,9 @@ annotations:
catalog.rancher.io/namespace: cattle-monitoring-system
catalog.rancher.io/release-name: rancher-pushprox
apiVersion: v1
appVersion: 0.1.1
appVersion: 0.1.0
description: Sets up a deployment of the PushProx proxy and a DaemonSet of PushProx
clients.
name: kubeAdmEtcd
type: application
version: 103.0.0
version: 0.1.6

10
charts/rancher-monitoring/103.0.1+up45.31.1/charts/kubeAdmEtcd/README.md
View File

@ -55,15 +55,7 @@ The following tables list the configurable parameters of the rancher-pushprox ch
| `clients.proxyUrl` | Overrides the default proxyUrl setting of `http://pushprox-{{ .Values.component }}-proxy.{{ . Release.Namespace }}.svc.cluster.local:{{ .Values.proxy.port }}"` with the `proxyUrl` specified | `""` |
| `clients.useLocalhost` | Sets a flag on each client deployment to redirect scrapes directed to `HOST_IP` to `127.0.0.1` | `false` |
| `clients.https.enabled` | Enables scraping metrics via HTTPS using the provided TLS certs that exist on each host | `false` |
| `clients.https.forceHTTPSScheme` | Forces scraping metrics via HTTPS using the provided TLS certs that exist on each host | `false` |
| `clients.https.useServiceAccountCredentials` | If set to true, the client will create a service account with permissions to scrape `/metrics` endpoint of Kubernetes components. The client will use the service account token provided to make authorized scrape requests to the Kubernetes API | `false` |
| `clients.https.authenticationMethod.bearerTokenFile.enabled` | If set to true, the client will use service account credentials mounted at the configured path `clients.https.authenticationMethod.bearerTokenFile.bearerTokenFilePath`. This requires permissions to scrape `/metrics` endpoint of Kubernetes components. This method is deprecated by the prometheus operator and may be removed in a future release | `false` |
| `clients.https.authenticationMethod.bearerTokenFile.bearerTokenFilePath` | This is a volume mount on the pod with permissions to scrape `/metrics` endpoint of Kubernetes components | `"/var/run/secrets/kubernetes.io/serviceaccount/token"` |
| `clients.https.authenticationMethod.bearerTokenSecret.enabled` | If set to true, the client will use service account credentials to scrape `/metrics` endpoint of Kubernetes components. This method is deprecated by the prometheus operator and may be removed in a future release | `false` |
| `clients.https.authenticationMethod.authorization.enabled` | If set to true, the client will use service account credentials to scrape `/metrics` endpoint of Kubernetes components | `false` |
| `clients.https.authenticationMethod.authorization.type` | If set, the client will use this type of authorization in its client requests for metrics | `"bearer"` |
| `clients.https.authenticationMethod.authorization.credentials.key` | If set, the client will use this key in the secret created by `clients.https.useServiceAccountCredentials` for authorization in its client requests for metrics | `"token"` |
| `clients.https.authenticationMethod.authorization.credentials.optional` | If set to false, the client will fail if the key in the secret created by `clients.https.useServiceAccountCredentials` does not exist | `false` |
| `clients.https.insecureSkipVerify` | If set to true, the client will disable SSL security checks | `false` |
| `clients.https.certDir` | A `hostPath` where TLS certs can be found. This path is mounted as a volume on an `initContainer` which copies only the necessary files over to an EmptyDir volume used by each client. Required and only used if `clients.https.enabled` is set | `""` |
| `clients.https.certFile` | The path to the TLS cert file located within `clients.https.certDir`. Required and only used if `clients.https.enabled` is set | `""` |
@ -87,4 +79,4 @@ The following tables list the configurable parameters of the rancher-pushprox ch
*Tip: The filepaths set in `clients.https.<cert|key|caCert>File` can include wildcard characters*.
See [rancher-monitoring](https://github.com/rancher/charts/tree/gh-pages/packages/rancher-monitoring) for examples of how this chart can be used.
See [rancher-monitoring](https://github.com/rancher/charts/tree/gh-pages/packages/rancher-monitoring) for examples of how this chart can be used.

39
charts/rancher-monitoring/103.0.1+up45.31.1/charts/kubeAdmEtcd/templates/_helpers.tpl
View File

@ -68,10 +68,6 @@ provider: kubernetes
{{- printf "pushprox-%s-client" (required ".Values.component is required" .Values.component) -}}
{{- end -}}
{{- define "pushProxy.client.serviceAccountTokenName" -}}
{{- printf "pushprox-%s-client-service-account-token" (required ".Values.component is required" .Values.component) -}}
{{- end -}}
{{- define "pushProxy.client.labels" -}}
k8s-app: {{ template "pushProxy.client.name" . }}
{{ template "pushProxy.commonLabels" . }}
@ -102,11 +98,6 @@ app: {{ template "pushprox.serviceMonitor.name" . }}
{{- define "pushProxy.serviceMonitor.endpoints" -}}
{{- $proxyURL := (include "pushProxy.proxyUrl" .) -}}
{{- $useHTTPS := .Values.clients.https.enabled -}}
{{- $forceHTTPSScheme := .Values.clients.https.forceHTTPSScheme -}}
{{- $insecureSkipVerify := .Values.clients.https.insecureSkipVerify -}}
{{- $useServiceAccountCredentials := .Values.clients.https.useServiceAccountCredentials -}}
{{- $serviceAccountTokenName := (include "pushProxy.client.serviceAccountTokenName" . ) -}}
{{- $metricRelabelings := list }}
{{- $endpoints := .Values.serviceMonitor.endpoints }}
{{- range $endpoints }}
{{- if $.Values.proxy.enabled }}
@ -126,14 +117,8 @@ app: {{ template "pushprox.serviceMonitor.name" . }}
{{- $_ := set $clusterNameRelabel "targetLabel" "cluster_name" }}
{{- $_ := set $clusterNameRelabel "replacement" $.Values.global.cattle.clusterName }}
{{- end }}
{{- $metricRelabelings := gt (len (keys $clusterNameRelabel)) 0 | ternary (append ($metricRelabelings) ($clusterNameRelabel)) ($metricRelabelings) }}
{{- $metricRelabelings := gt (len (keys $clusterIdRelabel)) 0 | ternary (append ($metricRelabelings) ($clusterIdRelabel)) ($metricRelabelings) }}
{{- if not (empty $metricRelabelings) }}
{{- $metricRelabelings := append (list ($clusterNameRelabel)) ($clusterIdRelabel) }}
{{- $_ := set . "metricRelabelings" ($metricRelabelings)}}
{{- end }}
{{- if $forceHTTPSScheme -}}
{{- $_ := set . "scheme" "https" }}
{{- end -}}
{{- if $useHTTPS -}}
{{- if (hasKey . "params") }}
{{- $_ := set (get . "params") "_scheme" (list "https") }}
@ -141,26 +126,6 @@ app: {{ template "pushprox.serviceMonitor.name" . }}
{{- $_ := set . "params" (dict "_scheme" (list "https")) }}
{{- end }}
{{- end }}
{{- if (hasKey . "tlsConfig") }}
{{- $_ := set (get . "tlsConfig") "insecureSkipVerify" $insecureSkipVerify }}
{{- else }}
{{- $_ := set . "tlsConfig" (dict "insecureSkipVerify" $insecureSkipVerify) }}
{{- end }}
{{- if $.Values.clients.https.authenticationMethod.bearerTokenFile.enabled }}
{{- $_ := set . "bearerTokenFile" $.Values.clients.https.authenticationMethod.bearerTokenFile.bearerTokenFilePath }}
{{- end }}
{{- if $.Values.clients.https.authenticationMethod.bearerTokenSecret.enabled }}
{{- $_ := set . "bearerTokenSecret" $serviceAccountTokenName }}
{{- end }}
{{- if $.Values.clients.https.authenticationMethod.authorization.enabled }}
{{- if (hasKey . "authorization") }}
{{- $_ := set (get . "authorization") "type" $.Values.clients.https.authenticationMethod.authorization.type }}
{{- $_ := set (get . "authorization") "credentials" (dict "name" $serviceAccountTokenName "key" $.Values.clients.https.authenticationMethod.authorization.credentials.key "optional" $.Values.clients.https.authenticationMethod.authorization.credentials.optional) }}
{{- else }}
{{- $_ := set . "authorization" (dict "type" $.Values.clients.https.authenticationMethod.authorization.type) }}
{{- $_ := set . "authorization" (dict "credentials" (dict "name" $serviceAccountTokenName "key" $.Values.clients.https.authenticationMethod.authorization.credentials.key "optional" $.Values.clients.https.authenticationMethod.authorization.credentials.optional)) }}
{{- end }}
{{- end }}
{{- end }}
{{- toYaml $endpoints }}
{{- end -}}
{{- end -}}

14
charts/rancher-monitoring/103.0.1+up45.31.1/charts/kubeAdmEtcd/templates/pushprox-clients-rbac.yaml
View File

@ -42,18 +42,6 @@ metadata:
namespace: {{ include "pushprox.namespace" . }}
labels: {{ include "pushProxy.client.labels" . | nindent 4 }}
---
{{- if .Values.clients.https.useServiceAccountCredentials }}
apiVersion: v1
kind: Secret
type: kubernetes.io/service-account-token
metadata:
name: {{ template "pushProxy.client.serviceAccountTokenName" . }}
namespace: {{ include "pushprox.namespace" . }}
labels: {{ include "pushProxy.client.labels" . | nindent 4 }}
annotations:
kubernetes.io/service-account.name: {{ template "pushProxy.client.name" . }}
{{- end }}
---
{{- if .Values.global.cattle.psp.enabled }}
apiVersion: policy/v1beta1
kind: PodSecurityPolicy
@ -94,4 +82,4 @@ spec:
readOnly: true
{{- end }}
{{- end }}
{{- end }}{{- end }}
{{- end }}{{- end }}

6
charts/rancher-monitoring/103.0.1+up45.31.1/charts/kubeAdmEtcd/templates/pushprox-clients.yaml
View File

@ -35,10 +35,6 @@ spec:
hostNetwork: true
dnsPolicy: ClusterFirstWithHostNet
serviceAccountName: {{ template "pushProxy.client.name" . }}
{{- if .Values.global.imagePullSecretName }}
imagePullSecrets:
- name: {{ .Values.global.imagePullSecretName }}
{{- end }}
containers:
- name: pushprox-client
image: {{ template "system_default_registry" . }}{{ .Values.clients.image.repository }}:{{ .Values.clients.image.tag }}
@ -154,4 +150,4 @@ spec:
- name: metrics-cert-dir
emptyDir: {}
{{- end }}
{{- end }}{{- end }}
{{- end }}{{- end }}

6
charts/rancher-monitoring/103.0.1+up45.31.1/charts/kubeAdmEtcd/templates/pushprox-proxy.yaml
View File

@ -26,10 +26,6 @@ spec:
{{ toYaml .Values.proxy.tolerations | indent 8 }}
{{- end }}
serviceAccountName: {{ template "pushProxy.proxy.name" . }}
{{- if .Values.global.imagePullSecretName }}
imagePullSecrets:
- name: {{ .Values.global.imagePullSecretName }}
{{- end }}
containers:
- name: pushprox-proxy
image: {{ template "system_default_registry" . }}{{ .Values.proxy.image.repository }}:{{ .Values.proxy.image.tag }}
@ -54,4 +50,4 @@ spec:
protocol: TCP
targetPort: {{ .Values.proxy.port }}
selector: {{ include "pushProxy.proxy.labels" . | nindent 4 }}
{{- end }}{{- end }}
{{- end }}{{- end }}

2
charts/rancher-monitoring/103.0.1+up45.31.1/charts/kubeAdmEtcd/templates/pushprox-servicemonitor.yaml
View File

@ -42,4 +42,4 @@ spec:
protocol: TCP
targetPort: {{ .Values.metricsPort }}
selector: {{ default (include "pushProxy.client.labels" .) $selector | nindent 4 }}
{{- end }}{{- end }}
{{- end }}{{- end }}

22
charts/rancher-monitoring/103.0.1+up45.31.1/charts/kubeAdmEtcd/values.yaml
View File

@ -75,29 +75,9 @@ clients:
https:
# Does the client require https to access the metrics?
enabled: false
# Does the client require requests be sent to http or https?
forceHTTPSScheme: false
# If set to true, the client will create a service account with adequate permissions and set a flag
# on the client to use the service account token provided by it to make authorized scrape requests
useServiceAccountCredentials: false
# Configuration for authentication to metrics via https endpoint
authenticationMethod:
# Reads token from defined file in container
# This function is deprecated in the prometheus operator api and may be removed in a future version
bearerTokenFile:
enabled: false
bearerTokenFilePath: "/var/run/secrets/kubernetes.io/serviceaccount/token"
# Reads token from defined secret in namespace
# This function is deprecated in the prometheus operator api and may be removed in a future version
bearerTokenSecret:
enabled: false
# Reads token from defined secret in namespace
authorization:
enabled: false
type: "bearer"
credentials:
key: "token"
optional: false
# If set to true, the client will disable SSL security checks
insecureSkipVerify: false
# Directory on host where necessary TLS cert and key to scrape metrics can be found
@ -163,4 +143,4 @@ proxy:
image:
repository: rancher/pushprox-proxy
tag: v0.1.0-rancher2-proxy
command: ["pushprox-proxy"]
command: ["pushprox-proxy"]

4
charts/rancher-monitoring/103.0.1+up45.31.1/charts/kubeAdmProxy/Chart.yaml
View File

@ -6,9 +6,9 @@ annotations:
catalog.rancher.io/namespace: cattle-monitoring-system
catalog.rancher.io/release-name: rancher-pushprox
apiVersion: v1
appVersion: 0.1.1
appVersion: 0.1.0
description: Sets up a deployment of the PushProx proxy and a DaemonSet of PushProx
clients.
name: kubeAdmProxy
type: application
version: 103.0.0
version: 0.1.6

10
charts/rancher-monitoring/103.0.1+up45.31.1/charts/kubeAdmProxy/README.md
View File

@ -55,15 +55,7 @@ The following tables list the configurable parameters of the rancher-pushprox ch
| `clients.proxyUrl` | Overrides the default proxyUrl setting of `http://pushprox-{{ .Values.component }}-proxy.{{ . Release.Namespace }}.svc.cluster.local:{{ .Values.proxy.port }}"` with the `proxyUrl` specified | `""` |
| `clients.useLocalhost` | Sets a flag on each client deployment to redirect scrapes directed to `HOST_IP` to `127.0.0.1` | `false` |
| `clients.https.enabled` | Enables scraping metrics via HTTPS using the provided TLS certs that exist on each host | `false` |
| `clients.https.forceHTTPSScheme` | Forces scraping metrics via HTTPS using the provided TLS certs that exist on each host | `false` |
| `clients.https.useServiceAccountCredentials` | If set to true, the client will create a service account with permissions to scrape `/metrics` endpoint of Kubernetes components. The client will use the service account token provided to make authorized scrape requests to the Kubernetes API | `false` |
| `clients.https.authenticationMethod.bearerTokenFile.enabled` | If set to true, the client will use service account credentials mounted at the configured path `clients.https.authenticationMethod.bearerTokenFile.bearerTokenFilePath`. This requires permissions to scrape `/metrics` endpoint of Kubernetes components. This method is deprecated by the prometheus operator and may be removed in a future release | `false` |
| `clients.https.authenticationMethod.bearerTokenFile.bearerTokenFilePath` | This is a volume mount on the pod with permissions to scrape `/metrics` endpoint of Kubernetes components | `"/var/run/secrets/kubernetes.io/serviceaccount/token"` |
| `clients.https.authenticationMethod.bearerTokenSecret.enabled` | If set to true, the client will use service account credentials to scrape `/metrics` endpoint of Kubernetes components. This method is deprecated by the prometheus operator and may be removed in a future release | `false` |
| `clients.https.authenticationMethod.authorization.enabled` | If set to true, the client will use service account credentials to scrape `/metrics` endpoint of Kubernetes components | `false` |
| `clients.https.authenticationMethod.authorization.type` | If set, the client will use this type of authorization in its client requests for metrics | `"bearer"` |
| `clients.https.authenticationMethod.authorization.credentials.key` | If set, the client will use this key in the secret created by `clients.https.useServiceAccountCredentials` for authorization in its client requests for metrics | `"token"` |
| `clients.https.authenticationMethod.authorization.credentials.optional` | If set to false, the client will fail if the key in the secret created by `clients.https.useServiceAccountCredentials` does not exist | `false` |
| `clients.https.insecureSkipVerify` | If set to true, the client will disable SSL security checks | `false` |
| `clients.https.certDir` | A `hostPath` where TLS certs can be found. This path is mounted as a volume on an `initContainer` which copies only the necessary files over to an EmptyDir volume used by each client. Required and only used if `clients.https.enabled` is set | `""` |
| `clients.https.certFile` | The path to the TLS cert file located within `clients.https.certDir`. Required and only used if `clients.https.enabled` is set | `""` |
@ -87,4 +79,4 @@ The following tables list the configurable parameters of the rancher-pushprox ch
*Tip: The filepaths set in `clients.https.<cert|key|caCert>File` can include wildcard characters*.
See [rancher-monitoring](https://github.com/rancher/charts/tree/gh-pages/packages/rancher-monitoring) for examples of how this chart can be used.
See [rancher-monitoring](https://github.com/rancher/charts/tree/gh-pages/packages/rancher-monitoring) for examples of how this chart can be used.

39
charts/rancher-monitoring/103.0.1+up45.31.1/charts/kubeAdmProxy/templates/_helpers.tpl
View File

@ -68,10 +68,6 @@ provider: kubernetes
{{- printf "pushprox-%s-client" (required ".Values.component is required" .Values.component) -}}
{{- end -}}
{{- define "pushProxy.client.serviceAccountTokenName" -}}
{{- printf "pushprox-%s-client-service-account-token" (required ".Values.component is required" .Values.component) -}}
{{- end -}}
{{- define "pushProxy.client.labels" -}}
k8s-app: {{ template "pushProxy.client.name" . }}
{{ template "pushProxy.commonLabels" . }}
@ -102,11 +98,6 @@ app: {{ template "pushprox.serviceMonitor.name" . }}
{{- define "pushProxy.serviceMonitor.endpoints" -}}
{{- $proxyURL := (include "pushProxy.proxyUrl" .) -}}
{{- $useHTTPS := .Values.clients.https.enabled -}}
{{- $forceHTTPSScheme := .Values.clients.https.forceHTTPSScheme -}}
{{- $insecureSkipVerify := .Values.clients.https.insecureSkipVerify -}}
{{- $useServiceAccountCredentials := .Values.clients.https.useServiceAccountCredentials -}}
{{- $serviceAccountTokenName := (include "pushProxy.client.serviceAccountTokenName" . ) -}}
{{- $metricRelabelings := list }}
{{- $endpoints := .Values.serviceMonitor.endpoints }}
{{- range $endpoints }}
{{- if $.Values.proxy.enabled }}
@ -126,14 +117,8 @@ app: {{ template "pushprox.serviceMonitor.name" . }}
{{- $_ := set $clusterNameRelabel "targetLabel" "cluster_name" }}
{{- $_ := set $clusterNameRelabel "replacement" $.Values.global.cattle.clusterName }}
{{- end }}
{{- $metricRelabelings := gt (len (keys $clusterNameRelabel)) 0 | ternary (append ($metricRelabelings) ($clusterNameRelabel)) ($metricRelabelings) }}
{{- $metricRelabelings := gt (len (keys $clusterIdRelabel)) 0 | ternary (append ($metricRelabelings) ($clusterIdRelabel)) ($metricRelabelings) }}
{{- if not (empty $metricRelabelings) }}
{{- $metricRelabelings := append (list ($clusterNameRelabel)) ($clusterIdRelabel) }}
{{- $_ := set . "metricRelabelings" ($metricRelabelings)}}
{{- end }}
{{- if $forceHTTPSScheme -}}
{{- $_ := set . "scheme" "https" }}
{{- end -}}
{{- if $useHTTPS -}}
{{- if (hasKey . "params") }}
{{- $_ := set (get . "params") "_scheme" (list "https") }}
@ -141,26 +126,6 @@ app: {{ template "pushprox.serviceMonitor.name" . }}
{{- $_ := set . "params" (dict "_scheme" (list "https")) }}
{{- end }}
{{- end }}
{{- if (hasKey . "tlsConfig") }}
{{- $_ := set (get . "tlsConfig") "insecureSkipVerify" $insecureSkipVerify }}
{{- else }}
{{- $_ := set . "tlsConfig" (dict "insecureSkipVerify" $insecureSkipVerify) }}
{{- end }}
{{- if $.Values.clients.https.authenticationMethod.bearerTokenFile.enabled }}
{{- $_ := set . "bearerTokenFile" $.Values.clients.https.authenticationMethod.bearerTokenFile.bearerTokenFilePath }}
{{- end }}
{{- if $.Values.clients.https.authenticationMethod.bearerTokenSecret.enabled }}
{{- $_ := set . "bearerTokenSecret" $serviceAccountTokenName }}
{{- end }}
{{- if $.Values.clients.https.authenticationMethod.authorization.enabled }}
{{- if (hasKey . "authorization") }}
{{- $_ := set (get . "authorization") "type" $.Values.clients.https.authenticationMethod.authorization.type }}
{{- $_ := set (get . "authorization") "credentials" (dict "name" $serviceAccountTokenName "key" $.Values.clients.https.authenticationMethod.authorization.credentials.key "optional" $.Values.clients.https.authenticationMethod.authorization.credentials.optional) }}
{{- else }}
{{- $_ := set . "authorization" (dict "type" $.Values.clients.https.authenticationMethod.authorization.type) }}
{{- $_ := set . "authorization" (dict "credentials" (dict "name" $serviceAccountTokenName "key" $.Values.clients.https.authenticationMethod.authorization.credentials.key "optional" $.Values.clients.https.authenticationMethod.authorization.credentials.optional)) }}
{{- end }}
{{- end }}
{{- end }}
{{- toYaml $endpoints }}
{{- end -}}
{{- end -}}

14
charts/rancher-monitoring/103.0.1+up45.31.1/charts/kubeAdmProxy/templates/pushprox-clients-rbac.yaml
View File

@ -42,18 +42,6 @@ metadata:
namespace: {{ include "pushprox.namespace" . }}
labels: {{ include "pushProxy.client.labels" . | nindent 4 }}
---
{{- if .Values.clients.https.useServiceAccountCredentials }}
apiVersion: v1
kind: Secret
type: kubernetes.io/service-account-token
metadata:
name: {{ template "pushProxy.client.serviceAccountTokenName" . }}
namespace: {{ include "pushprox.namespace" . }}
labels: {{ include "pushProxy.client.labels" . | nindent 4 }}
annotations:
kubernetes.io/service-account.name: {{ template "pushProxy.client.name" . }}
{{- end }}
---
{{- if .Values.global.cattle.psp.enabled }}
apiVersion: policy/v1beta1
kind: PodSecurityPolicy
@ -94,4 +82,4 @@ spec:
readOnly: true
{{- end }}
{{- end }}
{{- end }}{{- end }}
{{- end }}{{- end }}

6
charts/rancher-monitoring/103.0.1+up45.31.1/charts/kubeAdmProxy/templates/pushprox-clients.yaml
View File

@ -35,10 +35,6 @@ spec:
hostNetwork: true
dnsPolicy: ClusterFirstWithHostNet
serviceAccountName: {{ template "pushProxy.client.name" . }}
{{- if .Values.global.imagePullSecretName }}
imagePullSecrets:
- name: {{ .Values.global.imagePullSecretName }}
{{- end }}
containers:
- name: pushprox-client
image: {{ template "system_default_registry" . }}{{ .Values.clients.image.repository }}:{{ .Values.clients.image.tag }}
@ -154,4 +150,4 @@ spec:
- name: metrics-cert-dir
emptyDir: {}
{{- end }}
{{- end }}{{- end }}
{{- end }}{{- end }}

6
charts/rancher-monitoring/103.0.1+up45.31.1/charts/kubeAdmProxy/templates/pushprox-proxy.yaml
View File

@ -26,10 +26,6 @@ spec:
{{ toYaml .Values.proxy.tolerations | indent 8 }}
{{- end }}
serviceAccountName: {{ template "pushProxy.proxy.name" . }}
{{- if .Values.global.imagePullSecretName }}
imagePullSecrets:
- name: {{ .Values.global.imagePullSecretName }}
{{- end }}
containers:
- name: pushprox-proxy
image: {{ template "system_default_registry" . }}{{ .Values.proxy.image.repository }}:{{ .Values.proxy.image.tag }}
@ -54,4 +50,4 @@ spec:
protocol: TCP
targetPort: {{ .Values.proxy.port }}
selector: {{ include "pushProxy.proxy.labels" . | nindent 4 }}
{{- end }}{{- end }}
{{- end }}{{- end }}

2
charts/rancher-monitoring/103.0.1+up45.31.1/charts/kubeAdmProxy/templates/pushprox-servicemonitor.yaml
View File

@ -42,4 +42,4 @@ spec:
protocol: TCP
targetPort: {{ .Values.metricsPort }}
selector: {{ default (include "pushProxy.client.labels" .) $selector | nindent 4 }}
{{- end }}{{- end }}
{{- end }}{{- end }}

22
charts/rancher-monitoring/103.0.1+up45.31.1/charts/kubeAdmProxy/values.yaml
View File

@ -75,29 +75,9 @@ clients:
https:
# Does the client require https to access the metrics?
enabled: false
# Does the client require requests be sent to http or https?
forceHTTPSScheme: false
# If set to true, the client will create a service account with adequate permissions and set a flag
# on the client to use the service account token provided by it to make authorized scrape requests
useServiceAccountCredentials: false
# Configuration for authentication to metrics via https endpoint
authenticationMethod:
# Reads token from defined file in container
# This function is deprecated in the prometheus operator api and may be removed in a future version
bearerTokenFile:
enabled: false
bearerTokenFilePath: "/var/run/secrets/kubernetes.io/serviceaccount/token"
# Reads token from defined secret in namespace
# This function is deprecated in the prometheus operator api and may be removed in a future version
bearerTokenSecret:
enabled: false
# Reads token from defined secret in namespace
authorization:
enabled: false
type: "bearer"
credentials:
key: "token"
optional: false
# If set to true, the client will disable SSL security checks
insecureSkipVerify: false
# Directory on host where necessary TLS cert and key to scrape metrics can be found
@ -163,4 +143,4 @@ proxy:
image:
repository: rancher/pushprox-proxy
tag: v0.1.0-rancher2-proxy
command: ["pushprox-proxy"]
command: ["pushprox-proxy"]

4
charts/rancher-monitoring/103.0.1+up45.31.1/charts/kubeAdmScheduler/Chart.yaml
View File

@ -6,9 +6,9 @@ annotations:
catalog.rancher.io/namespace: cattle-monitoring-system
catalog.rancher.io/release-name: rancher-pushprox
apiVersion: v1
appVersion: 0.1.1
appVersion: 0.1.0
description: Sets up a deployment of the PushProx proxy and a DaemonSet of PushProx
clients.
name: kubeAdmScheduler
type: application
version: 103.0.0
version: 0.1.6

10
charts/rancher-monitoring/103.0.1+up45.31.1/charts/kubeAdmScheduler/README.md
View File

@ -55,15 +55,7 @@ The following tables list the configurable parameters of the rancher-pushprox ch
| `clients.proxyUrl` | Overrides the default proxyUrl setting of `http://pushprox-{{ .Values.component }}-proxy.{{ . Release.Namespace }}.svc.cluster.local:{{ .Values.proxy.port }}"` with the `proxyUrl` specified | `""` |
| `clients.useLocalhost` | Sets a flag on each client deployment to redirect scrapes directed to `HOST_IP` to `127.0.0.1` | `false` |
| `clients.https.enabled` | Enables scraping metrics via HTTPS using the provided TLS certs that exist on each host | `false` |
| `clients.https.forceHTTPSScheme` | Forces scraping metrics via HTTPS using the provided TLS certs that exist on each host | `false` |
| `clients.https.useServiceAccountCredentials` | If set to true, the client will create a service account with permissions to scrape `/metrics` endpoint of Kubernetes components. The client will use the service account token provided to make authorized scrape requests to the Kubernetes API | `false` |
| `clients.https.authenticationMethod.bearerTokenFile.enabled` | If set to true, the client will use service account credentials mounted at the configured path `clients.https.authenticationMethod.bearerTokenFile.bearerTokenFilePath`. This requires permissions to scrape `/metrics` endpoint of Kubernetes components. This method is deprecated by the prometheus operator and may be removed in a future release | `false` |
| `clients.https.authenticationMethod.bearerTokenFile.bearerTokenFilePath` | This is a volume mount on the pod with permissions to scrape `/metrics` endpoint of Kubernetes components | `"/var/run/secrets/kubernetes.io/serviceaccount/token"` |
| `clients.https.authenticationMethod.bearerTokenSecret.enabled` | If set to true, the client will use service account credentials to scrape `/metrics` endpoint of Kubernetes components. This method is deprecated by the prometheus operator and may be removed in a future release | `false` |
| `clients.https.authenticationMethod.authorization.enabled` | If set to true, the client will use service account credentials to scrape `/metrics` endpoint of Kubernetes components | `false` |
| `clients.https.authenticationMethod.authorization.type` | If set, the client will use this type of authorization in its client requests for metrics | `"bearer"` |
| `clients.https.authenticationMethod.authorization.credentials.key` | If set, the client will use this key in the secret created by `clients.https.useServiceAccountCredentials` for authorization in its client requests for metrics | `"token"` |
| `clients.https.authenticationMethod.authorization.credentials.optional` | If set to false, the client will fail if the key in the secret created by `clients.https.useServiceAccountCredentials` does not exist | `false` |
| `clients.https.insecureSkipVerify` | If set to true, the client will disable SSL security checks | `false` |
| `clients.https.certDir` | A `hostPath` where TLS certs can be found. This path is mounted as a volume on an `initContainer` which copies only the necessary files over to an EmptyDir volume used by each client. Required and only used if `clients.https.enabled` is set | `""` |
| `clients.https.certFile` | The path to the TLS cert file located within `clients.https.certDir`. Required and only used if `clients.https.enabled` is set | `""` |
@ -87,4 +79,4 @@ The following tables list the configurable parameters of the rancher-pushprox ch
*Tip: The filepaths set in `clients.https.<cert|key|caCert>File` can include wildcard characters*.
See [rancher-monitoring](https://github.com/rancher/charts/tree/gh-pages/packages/rancher-monitoring) for examples of how this chart can be used.
See [rancher-monitoring](https://github.com/rancher/charts/tree/gh-pages/packages/rancher-monitoring) for examples of how this chart can be used.

39
charts/rancher-monitoring/103.0.1+up45.31.1/charts/kubeAdmScheduler/templates/_helpers.tpl
View File

@ -68,10 +68,6 @@ provider: kubernetes
{{- printf "pushprox-%s-client" (required ".Values.component is required" .Values.component) -}}
{{- end -}}
{{- define "pushProxy.client.serviceAccountTokenName" -}}
{{- printf "pushprox-%s-client-service-account-token" (required ".Values.component is required" .Values.component) -}}
{{- end -}}
{{- define "pushProxy.client.labels" -}}
k8s-app: {{ template "pushProxy.client.name" . }}
{{ template "pushProxy.commonLabels" . }}
@ -102,11 +98,6 @@ app: {{ template "pushprox.serviceMonitor.name" . }}
{{- define "pushProxy.serviceMonitor.endpoints" -}}
{{- $proxyURL := (include "pushProxy.proxyUrl" .) -}}
{{- $useHTTPS := .Values.clients.https.enabled -}}
{{- $forceHTTPSScheme := .Values.clients.https.forceHTTPSScheme -}}
{{- $insecureSkipVerify := .Values.clients.https.insecureSkipVerify -}}
{{- $useServiceAccountCredentials := .Values.clients.https.useServiceAccountCredentials -}}
{{- $serviceAccountTokenName := (include "pushProxy.client.serviceAccountTokenName" . ) -}}
{{- $metricRelabelings := list }}
{{- $endpoints := .Values.serviceMonitor.endpoints }}
{{- range $endpoints }}
{{- if $.Values.proxy.enabled }}
@ -126,14 +117,8 @@ app: {{ template "pushprox.serviceMonitor.name" . }}
{{- $_ := set $clusterNameRelabel "targetLabel" "cluster_name" }}
{{- $_ := set $clusterNameRelabel "replacement" $.Values.global.cattle.clusterName }}
{{- end }}
{{- $metricRelabelings := gt (len (keys $clusterNameRelabel)) 0 | ternary (append ($metricRelabelings) ($clusterNameRelabel)) ($metricRelabelings) }}
{{- $metricRelabelings := gt (len (keys $clusterIdRelabel)) 0 | ternary (append ($metricRelabelings) ($clusterIdRelabel)) ($metricRelabelings) }}
{{- if not (empty $metricRelabelings) }}
{{- $metricRelabelings := append (list ($clusterNameRelabel)) ($clusterIdRelabel) }}
{{- $_ := set . "metricRelabelings" ($metricRelabelings)}}
{{- end }}
{{- if $forceHTTPSScheme -}}
{{- $_ := set . "scheme" "https" }}
{{- end -}}
{{- if $useHTTPS -}}
{{- if (hasKey . "params") }}
{{- $_ := set (get . "params") "_scheme" (list "https") }}
@ -141,26 +126,6 @@ app: {{ template "pushprox.serviceMonitor.name" . }}
{{- $_ := set . "params" (dict "_scheme" (list "https")) }}
{{- end }}
{{- end }}
{{- if (hasKey . "tlsConfig") }}
{{- $_ := set (get . "tlsConfig") "insecureSkipVerify" $insecureSkipVerify }}
{{- else }}
{{- $_ := set . "tlsConfig" (dict "insecureSkipVerify" $insecureSkipVerify) }}
{{- end }}
{{- if $.Values.clients.https.authenticationMethod.bearerTokenFile.enabled }}
{{- $_ := set . "bearerTokenFile" $.Values.clients.https.authenticationMethod.bearerTokenFile.bearerTokenFilePath }}
{{- end }}
{{- if $.Values.clients.https.authenticationMethod.bearerTokenSecret.enabled }}
{{- $_ := set . "bearerTokenSecret" $serviceAccountTokenName }}
{{- end }}
{{- if $.Values.clients.https.authenticationMethod.authorization.enabled }}
{{- if (hasKey . "authorization") }}
{{- $_ := set (get . "authorization") "type" $.Values.clients.https.authenticationMethod.authorization.type }}
{{- $_ := set (get . "authorization") "credentials" (dict "name" $serviceAccountTokenName "key" $.Values.clients.https.authenticationMethod.authorization.credentials.key "optional" $.Values.clients.https.authenticationMethod.authorization.credentials.optional) }}
{{- else }}
{{- $_ := set . "authorization" (dict "type" $.Values.clients.https.authenticationMethod.authorization.type) }}
{{- $_ := set . "authorization" (dict "credentials" (dict "name" $serviceAccountTokenName "key" $.Values.clients.https.authenticationMethod.authorization.credentials.key "optional" $.Values.clients.https.authenticationMethod.authorization.credentials.optional)) }}
{{- end }}
{{- end }}
{{- end }}
{{- toYaml $endpoints }}
{{- end -}}
{{- end -}}

14
charts/rancher-monitoring/103.0.1+up45.31.1/charts/kubeAdmScheduler/templates/pushprox-clients-rbac.yaml
View File

@ -42,18 +42,6 @@ metadata:
namespace: {{ include "pushprox.namespace" . }}
labels: {{ include "pushProxy.client.labels" . | nindent 4 }}
---
{{- if .Values.clients.https.useServiceAccountCredentials }}
apiVersion: v1
kind: Secret
type: kubernetes.io/service-account-token
metadata:
name: {{ template "pushProxy.client.serviceAccountTokenName" . }}
namespace: {{ include "pushprox.namespace" . }}
labels: {{ include "pushProxy.client.labels" . | nindent 4 }}
annotations:
kubernetes.io/service-account.name: {{ template "pushProxy.client.name" . }}
{{- end }}
---
{{- if .Values.global.cattle.psp.enabled }}
apiVersion: policy/v1beta1
kind: PodSecurityPolicy
@ -94,4 +82,4 @@ spec:
readOnly: true
{{- end }}
{{- end }}
{{- end }}{{- end }}
{{- end }}{{- end }}

6
charts/rancher-monitoring/103.0.1+up45.31.1/charts/kubeAdmScheduler/templates/pushprox-clients.yaml
View File

@ -35,10 +35,6 @@ spec:
hostNetwork: true
dnsPolicy: ClusterFirstWithHostNet
serviceAccountName: {{ template "pushProxy.client.name" . }}
{{- if .Values.global.imagePullSecretName }}
imagePullSecrets:
- name: {{ .Values.global.imagePullSecretName }}
{{- end }}
containers:
- name: pushprox-client
image: {{ template "system_default_registry" . }}{{ .Values.clients.image.repository }}:{{ .Values.clients.image.tag }}
@ -154,4 +150,4 @@ spec:
- name: metrics-cert-dir
emptyDir: {}
{{- end }}
{{- end }}{{- end }}
{{- end }}{{- end }}

6
charts/rancher-monitoring/103.0.1+up45.31.1/charts/kubeAdmScheduler/templates/pushprox-proxy.yaml
View File

@ -26,10 +26,6 @@ spec:
{{ toYaml .Values.proxy.tolerations | indent 8 }}
{{- end }}
serviceAccountName: {{ template "pushProxy.proxy.name" . }}
{{- if .Values.global.imagePullSecretName }}
imagePullSecrets:
- name: {{ .Values.global.imagePullSecretName }}
{{- end }}
containers:
- name: pushprox-proxy
image: {{ template "system_default_registry" . }}{{ .Values.proxy.image.repository }}:{{ .Values.proxy.image.tag }}
@ -54,4 +50,4 @@ spec:
protocol: TCP
targetPort: {{ .Values.proxy.port }}
selector: {{ include "pushProxy.proxy.labels" . | nindent 4 }}
{{- end }}{{- end }}
{{- end }}{{- end }}

2
charts/rancher-monitoring/103.0.1+up45.31.1/charts/kubeAdmScheduler/templates/pushprox-servicemonitor.yaml
View File

@ -42,4 +42,4 @@ spec:
protocol: TCP
targetPort: {{ .Values.metricsPort }}
selector: {{ default (include "pushProxy.client.labels" .) $selector | nindent 4 }}
{{- end }}{{- end }}
{{- end }}{{- end }}

22
charts/rancher-monitoring/103.0.1+up45.31.1/charts/kubeAdmScheduler/values.yaml
View File

@ -75,29 +75,9 @@ clients:
https:
# Does the client require https to access the metrics?
enabled: false
# Does the client require requests be sent to http or https?
forceHTTPSScheme: false
# If set to true, the client will create a service account with adequate permissions and set a flag
# on the client to use the service account token provided by it to make authorized scrape requests
useServiceAccountCredentials: false
# Configuration for authentication to metrics via https endpoint
authenticationMethod:
# Reads token from defined file in container
# This function is deprecated in the prometheus operator api and may be removed in a future version
bearerTokenFile:
enabled: false
bearerTokenFilePath: "/var/run/secrets/kubernetes.io/serviceaccount/token"
# Reads token from defined secret in namespace
# This function is deprecated in the prometheus operator api and may be removed in a future version
bearerTokenSecret:
enabled: false
# Reads token from defined secret in namespace
authorization:
enabled: false
type: "bearer"
credentials:
key: "token"
optional: false
# If set to true, the client will disable SSL security checks
insecureSkipVerify: false
# Directory on host where necessary TLS cert and key to scrape metrics can be found
@ -163,4 +143,4 @@ proxy:
image:
repository: rancher/pushprox-proxy
tag: v0.1.0-rancher2-proxy
command: ["pushprox-proxy"]
command: ["pushprox-proxy"]

4
charts/rancher-monitoring/103.0.1+up45.31.1/charts/rke2ControllerManager/Chart.yaml
View File

@ -6,9 +6,9 @@ annotations:
catalog.rancher.io/namespace: cattle-monitoring-system
catalog.rancher.io/release-name: rancher-pushprox
apiVersion: v1
appVersion: 0.1.1
appVersion: 0.1.0
description: Sets up a deployment of the PushProx proxy and a DaemonSet of PushProx
clients.
name: rke2ControllerManager
type: application
version: 103.0.0
version: 0.1.6

10
charts/rancher-monitoring/103.0.1+up45.31.1/charts/rke2ControllerManager/README.md
View File

@ -55,15 +55,7 @@ The following tables list the configurable parameters of the rancher-pushprox ch
| `clients.proxyUrl` | Overrides the default proxyUrl setting of `http://pushprox-{{ .Values.component }}-proxy.{{ . Release.Namespace }}.svc.cluster.local:{{ .Values.proxy.port }}"` with the `proxyUrl` specified | `""` |
| `clients.useLocalhost` | Sets a flag on each client deployment to redirect scrapes directed to `HOST_IP` to `127.0.0.1` | `false` |
| `clients.https.enabled` | Enables scraping metrics via HTTPS using the provided TLS certs that exist on each host | `false` |
| `clients.https.forceHTTPSScheme` | Forces scraping metrics via HTTPS using the provided TLS certs that exist on each host | `false` |
| `clients.https.useServiceAccountCredentials` | If set to true, the client will create a service account with permissions to scrape `/metrics` endpoint of Kubernetes components. The client will use the service account token provided to make authorized scrape requests to the Kubernetes API | `false` |
| `clients.https.authenticationMethod.bearerTokenFile.enabled` | If set to true, the client will use service account credentials mounted at the configured path `clients.https.authenticationMethod.bearerTokenFile.bearerTokenFilePath`. This requires permissions to scrape `/metrics` endpoint of Kubernetes components. This method is deprecated by the prometheus operator and may be removed in a future release | `false` |
| `clients.https.authenticationMethod.bearerTokenFile.bearerTokenFilePath` | This is a volume mount on the pod with permissions to scrape `/metrics` endpoint of Kubernetes components | `"/var/run/secrets/kubernetes.io/serviceaccount/token"` |
| `clients.https.authenticationMethod.bearerTokenSecret.enabled` | If set to true, the client will use service account credentials to scrape `/metrics` endpoint of Kubernetes components. This method is deprecated by the prometheus operator and may be removed in a future release | `false` |
| `clients.https.authenticationMethod.authorization.enabled` | If set to true, the client will use service account credentials to scrape `/metrics` endpoint of Kubernetes components | `false` |
| `clients.https.authenticationMethod.authorization.type` | If set, the client will use this type of authorization in its client requests for metrics | `"bearer"` |
| `clients.https.authenticationMethod.authorization.credentials.key` | If set, the client will use this key in the secret created by `clients.https.useServiceAccountCredentials` for authorization in its client requests for metrics | `"token"` |
| `clients.https.authenticationMethod.authorization.credentials.optional` | If set to false, the client will fail if the key in the secret created by `clients.https.useServiceAccountCredentials` does not exist | `false` |
| `clients.https.insecureSkipVerify` | If set to true, the client will disable SSL security checks | `false` |
| `clients.https.certDir` | A `hostPath` where TLS certs can be found. This path is mounted as a volume on an `initContainer` which copies only the necessary files over to an EmptyDir volume used by each client. Required and only used if `clients.https.enabled` is set | `""` |
| `clients.https.certFile` | The path to the TLS cert file located within `clients.https.certDir`. Required and only used if `clients.https.enabled` is set | `""` |
@ -87,4 +79,4 @@ The following tables list the configurable parameters of the rancher-pushprox ch
*Tip: The filepaths set in `clients.https.<cert|key|caCert>File` can include wildcard characters*.
See [rancher-monitoring](https://github.com/rancher/charts/tree/gh-pages/packages/rancher-monitoring) for examples of how this chart can be used.
See [rancher-monitoring](https://github.com/rancher/charts/tree/gh-pages/packages/rancher-monitoring) for examples of how this chart can be used.

39
charts/rancher-monitoring/103.0.1+up45.31.1/charts/rke2ControllerManager/templates/_helpers.tpl
View File

@ -68,10 +68,6 @@ provider: kubernetes
{{- printf "pushprox-%s-client" (required ".Values.component is required" .Values.component) -}}
{{- end -}}
{{- define "pushProxy.client.serviceAccountTokenName" -}}
{{- printf "pushprox-%s-client-service-account-token" (required ".Values.component is required" .Values.component) -}}
{{- end -}}
{{- define "pushProxy.client.labels" -}}
k8s-app: {{ template "pushProxy.client.name" . }}
{{ template "pushProxy.commonLabels" . }}
@ -102,11 +98,6 @@ app: {{ template "pushprox.serviceMonitor.name" . }}
{{- define "pushProxy.serviceMonitor.endpoints" -}}
{{- $proxyURL := (include "pushProxy.proxyUrl" .) -}}
{{- $useHTTPS := .Values.clients.https.enabled -}}
{{- $forceHTTPSScheme := .Values.clients.https.forceHTTPSScheme -}}
{{- $insecureSkipVerify := .Values.clients.https.insecureSkipVerify -}}
{{- $useServiceAccountCredentials := .Values.clients.https.useServiceAccountCredentials -}}
{{- $serviceAccountTokenName := (include "pushProxy.client.serviceAccountTokenName" . ) -}}
{{- $metricRelabelings := list }}
{{- $endpoints := .Values.serviceMonitor.endpoints }}
{{- range $endpoints }}
{{- if $.Values.proxy.enabled }}
@ -126,14 +117,8 @@ app: {{ template "pushprox.serviceMonitor.name" . }}
{{- $_ := set $clusterNameRelabel "targetLabel" "cluster_name" }}
{{- $_ := set $clusterNameRelabel "replacement" $.Values.global.cattle.clusterName }}
{{- end }}
{{- $metricRelabelings := gt (len (keys $clusterNameRelabel)) 0 | ternary (append ($metricRelabelings) ($clusterNameRelabel)) ($metricRelabelings) }}
{{- $metricRelabelings := gt (len (keys $clusterIdRelabel)) 0 | ternary (append ($metricRelabelings) ($clusterIdRelabel)) ($metricRelabelings) }}
{{- if not (empty $metricRelabelings) }}
{{- $metricRelabelings := append (list ($clusterNameRelabel)) ($clusterIdRelabel) }}
{{- $_ := set . "metricRelabelings" ($metricRelabelings)}}
{{- end }}
{{- if $forceHTTPSScheme -}}
{{- $_ := set . "scheme" "https" }}
{{- end -}}
{{- if $useHTTPS -}}
{{- if (hasKey . "params") }}
{{- $_ := set (get . "params") "_scheme" (list "https") }}
@ -141,26 +126,6 @@ app: {{ template "pushprox.serviceMonitor.name" . }}
{{- $_ := set . "params" (dict "_scheme" (list "https")) }}
{{- end }}
{{- end }}
{{- if (hasKey . "tlsConfig") }}
{{- $_ := set (get . "tlsConfig") "insecureSkipVerify" $insecureSkipVerify }}
{{- else }}
{{- $_ := set . "tlsConfig" (dict "insecureSkipVerify" $insecureSkipVerify) }}
{{- end }}
{{- if $.Values.clients.https.authenticationMethod.bearerTokenFile.enabled }}
{{- $_ := set . "bearerTokenFile" $.Values.clients.https.authenticationMethod.bearerTokenFile.bearerTokenFilePath }}
{{- end }}
{{- if $.Values.clients.https.authenticationMethod.bearerTokenSecret.enabled }}
{{- $_ := set . "bearerTokenSecret" $serviceAccountTokenName }}
{{- end }}
{{- if $.Values.clients.https.authenticationMethod.authorization.enabled }}
{{- if (hasKey . "authorization") }}
{{- $_ := set (get . "authorization") "type" $.Values.clients.https.authenticationMethod.authorization.type }}
{{- $_ := set (get . "authorization") "credentials" (dict "name" $serviceAccountTokenName "key" $.Values.clients.https.authenticationMethod.authorization.credentials.key "optional" $.Values.clients.https.authenticationMethod.authorization.credentials.optional) }}
{{- else }}
{{- $_ := set . "authorization" (dict "type" $.Values.clients.https.authenticationMethod.authorization.type) }}
{{- $_ := set . "authorization" (dict "credentials" (dict "name" $serviceAccountTokenName "key" $.Values.clients.https.authenticationMethod.authorization.credentials.key "optional" $.Values.clients.https.authenticationMethod.authorization.credentials.optional)) }}
{{- end }}
{{- end }}
{{- end }}
{{- toYaml $endpoints }}
{{- end -}}
{{- end -}}

14
charts/rancher-monitoring/103.0.1+up45.31.1/charts/rke2ControllerManager/templates/pushprox-clients-rbac.yaml
View File

@ -42,18 +42,6 @@ metadata:
namespace: {{ include "pushprox.namespace" . }}
labels: {{ include "pushProxy.client.labels" . | nindent 4 }}
---
{{- if .Values.clients.https.useServiceAccountCredentials }}
apiVersion: v1
kind: Secret
type: kubernetes.io/service-account-token
metadata:
name: {{ template "pushProxy.client.serviceAccountTokenName" . }}
namespace: {{ include "pushprox.namespace" . }}
labels: {{ include "pushProxy.client.labels" . | nindent 4 }}
annotations:
kubernetes.io/service-account.name: {{ template "pushProxy.client.name" . }}
{{- end }}
---
{{- if .Values.global.cattle.psp.enabled }}
apiVersion: policy/v1beta1
kind: PodSecurityPolicy
@ -94,4 +82,4 @@ spec:
readOnly: true
{{- end }}
{{- end }}
{{- end }}{{- end }}
{{- end }}{{- end }}

6
charts/rancher-monitoring/103.0.1+up45.31.1/charts/rke2ControllerManager/templates/pushprox-clients.yaml
View File

@ -35,10 +35,6 @@ spec:
hostNetwork: true
dnsPolicy: ClusterFirstWithHostNet
serviceAccountName: {{ template "pushProxy.client.name" . }}
{{- if .Values.global.imagePullSecretName }}
imagePullSecrets:
- name: {{ .Values.global.imagePullSecretName }}
{{- end }}
containers:
- name: pushprox-client
image: {{ template "system_default_registry" . }}{{ .Values.clients.image.repository }}:{{ .Values.clients.image.tag }}
@ -154,4 +150,4 @@ spec:
- name: metrics-cert-dir
emptyDir: {}
{{- end }}
{{- end }}{{- end }}
{{- end }}{{- end }}

6
charts/rancher-monitoring/103.0.1+up45.31.1/charts/rke2ControllerManager/templates/pushprox-proxy.yaml
View File

@ -26,10 +26,6 @@ spec:
{{ toYaml .Values.proxy.tolerations | indent 8 }}
{{- end }}
serviceAccountName: {{ template "pushProxy.proxy.name" . }}
{{- if .Values.global.imagePullSecretName }}
imagePullSecrets:
- name: {{ .Values.global.imagePullSecretName }}
{{- end }}
containers:
- name: pushprox-proxy
image: {{ template "system_default_registry" . }}{{ .Values.proxy.image.repository }}:{{ .Values.proxy.image.tag }}
@ -54,4 +50,4 @@ spec:
protocol: TCP
targetPort: {{ .Values.proxy.port }}
selector: {{ include "pushProxy.proxy.labels" . | nindent 4 }}
{{- end }}{{- end }}
{{- end }}{{- end }}

2
charts/rancher-monitoring/103.0.1+up45.31.1/charts/rke2ControllerManager/templates/pushprox-servicemonitor.yaml
View File

@ -42,4 +42,4 @@ spec:
protocol: TCP
targetPort: {{ .Values.metricsPort }}
selector: {{ default (include "pushProxy.client.labels" .) $selector | nindent 4 }}
{{- end }}{{- end }}
{{- end }}{{- end }}

22
charts/rancher-monitoring/103.0.1+up45.31.1/charts/rke2ControllerManager/values.yaml
View File

@ -75,29 +75,9 @@ clients:
https:
# Does the client require https to access the metrics?
enabled: false
# Does the client require requests be sent to http or https?
forceHTTPSScheme: false
# If set to true, the client will create a service account with adequate permissions and set a flag
# on the client to use the service account token provided by it to make authorized scrape requests
useServiceAccountCredentials: false
# Configuration for authentication to metrics via https endpoint
authenticationMethod:
# Reads token from defined file in container
# This function is deprecated in the prometheus operator api and may be removed in a future version
bearerTokenFile:
enabled: false
bearerTokenFilePath: "/var/run/secrets/kubernetes.io/serviceaccount/token"
# Reads token from defined secret in namespace
# This function is deprecated in the prometheus operator api and may be removed in a future version
bearerTokenSecret:
enabled: false
# Reads token from defined secret in namespace
authorization:
enabled: false
type: "bearer"
credentials:
key: "token"
optional: false
# If set to true, the client will disable SSL security checks
insecureSkipVerify: false
# Directory on host where necessary TLS cert and key to scrape metrics can be found
@ -163,4 +143,4 @@ proxy:
image:
repository: rancher/pushprox-proxy
tag: v0.1.0-rancher2-proxy
command: ["pushprox-proxy"]
command: ["pushprox-proxy"]

4
charts/rancher-monitoring/103.0.1+up45.31.1/charts/rke2Etcd/Chart.yaml
View File

@ -6,9 +6,9 @@ annotations:
catalog.rancher.io/namespace: cattle-monitoring-system
catalog.rancher.io/release-name: rancher-pushprox
apiVersion: v1
appVersion: 0.1.1
appVersion: 0.1.0
description: Sets up a deployment of the PushProx proxy and a DaemonSet of PushProx
clients.
name: rke2Etcd
type: application
version: 103.0.0
version: 0.1.6

10
charts/rancher-monitoring/103.0.1+up45.31.1/charts/rke2Etcd/README.md
View File

@ -55,15 +55,7 @@ The following tables list the configurable parameters of the rancher-pushprox ch
| `clients.proxyUrl` | Overrides the default proxyUrl setting of `http://pushprox-{{ .Values.component }}-proxy.{{ . Release.Namespace }}.svc.cluster.local:{{ .Values.proxy.port }}"` with the `proxyUrl` specified | `""` |
| `clients.useLocalhost` | Sets a flag on each client deployment to redirect scrapes directed to `HOST_IP` to `127.0.0.1` | `false` |
| `clients.https.enabled` | Enables scraping metrics via HTTPS using the provided TLS certs that exist on each host | `false` |
| `clients.https.forceHTTPSScheme` | Forces scraping metrics via HTTPS using the provided TLS certs that exist on each host | `false` |
| `clients.https.useServiceAccountCredentials` | If set to true, the client will create a service account with permissions to scrape `/metrics` endpoint of Kubernetes components. The client will use the service account token provided to make authorized scrape requests to the Kubernetes API | `false` |
| `clients.https.authenticationMethod.bearerTokenFile.enabled` | If set to true, the client will use service account credentials mounted at the configured path `clients.https.authenticationMethod.bearerTokenFile.bearerTokenFilePath`. This requires permissions to scrape `/metrics` endpoint of Kubernetes components. This method is deprecated by the prometheus operator and may be removed in a future release | `false` |
| `clients.https.authenticationMethod.bearerTokenFile.bearerTokenFilePath` | This is a volume mount on the pod with permissions to scrape `/metrics` endpoint of Kubernetes components | `"/var/run/secrets/kubernetes.io/serviceaccount/token"` |
| `clients.https.authenticationMethod.bearerTokenSecret.enabled` | If set to true, the client will use service account credentials to scrape `/metrics` endpoint of Kubernetes components. This method is deprecated by the prometheus operator and may be removed in a future release | `false` |
| `clients.https.authenticationMethod.authorization.enabled` | If set to true, the client will use service account credentials to scrape `/metrics` endpoint of Kubernetes components | `false` |
| `clients.https.authenticationMethod.authorization.type` | If set, the client will use this type of authorization in its client requests for metrics | `"bearer"` |
| `clients.https.authenticationMethod.authorization.credentials.key` | If set, the client will use this key in the secret created by `clients.https.useServiceAccountCredentials` for authorization in its client requests for metrics | `"token"` |
| `clients.https.authenticationMethod.authorization.credentials.optional` | If set to false, the client will fail if the key in the secret created by `clients.https.useServiceAccountCredentials` does not exist | `false` |
| `clients.https.insecureSkipVerify` | If set to true, the client will disable SSL security checks | `false` |
| `clients.https.certDir` | A `hostPath` where TLS certs can be found. This path is mounted as a volume on an `initContainer` which copies only the necessary files over to an EmptyDir volume used by each client. Required and only used if `clients.https.enabled` is set | `""` |
| `clients.https.certFile` | The path to the TLS cert file located within `clients.https.certDir`. Required and only used if `clients.https.enabled` is set | `""` |
@ -87,4 +79,4 @@ The following tables list the configurable parameters of the rancher-pushprox ch
*Tip: The filepaths set in `clients.https.<cert|key|caCert>File` can include wildcard characters*.
See [rancher-monitoring](https://github.com/rancher/charts/tree/gh-pages/packages/rancher-monitoring) for examples of how this chart can be used.
See [rancher-monitoring](https://github.com/rancher/charts/tree/gh-pages/packages/rancher-monitoring) for examples of how this chart can be used.

39
charts/rancher-monitoring/103.0.1+up45.31.1/charts/rke2Etcd/templates/_helpers.tpl
View File

@ -68,10 +68,6 @@ provider: kubernetes
{{- printf "pushprox-%s-client" (required ".Values.component is required" .Values.component) -}}
{{- end -}}
{{- define "pushProxy.client.serviceAccountTokenName" -}}
{{- printf "pushprox-%s-client-service-account-token" (required ".Values.component is required" .Values.component) -}}
{{- end -}}
{{- define "pushProxy.client.labels" -}}
k8s-app: {{ template "pushProxy.client.name" . }}
{{ template "pushProxy.commonLabels" . }}
@ -102,11 +98,6 @@ app: {{ template "pushprox.serviceMonitor.name" . }}
{{- define "pushProxy.serviceMonitor.endpoints" -}}
{{- $proxyURL := (include "pushProxy.proxyUrl" .) -}}
{{- $useHTTPS := .Values.clients.https.enabled -}}
{{- $forceHTTPSScheme := .Values.clients.https.forceHTTPSScheme -}}
{{- $insecureSkipVerify := .Values.clients.https.insecureSkipVerify -}}
{{- $useServiceAccountCredentials := .Values.clients.https.useServiceAccountCredentials -}}
{{- $serviceAccountTokenName := (include "pushProxy.client.serviceAccountTokenName" . ) -}}
{{- $metricRelabelings := list }}
{{- $endpoints := .Values.serviceMonitor.endpoints }}
{{- range $endpoints }}
{{- if $.Values.proxy.enabled }}
@ -126,14 +117,8 @@ app: {{ template "pushprox.serviceMonitor.name" . }}
{{- $_ := set $clusterNameRelabel "targetLabel" "cluster_name" }}
{{- $_ := set $clusterNameRelabel "replacement" $.Values.global.cattle.clusterName }}
{{- end }}
{{- $metricRelabelings := gt (len (keys $clusterNameRelabel)) 0 | ternary (append ($metricRelabelings) ($clusterNameRelabel)) ($metricRelabelings) }}
{{- $metricRelabelings := gt (len (keys $clusterIdRelabel)) 0 | ternary (append ($metricRelabelings) ($clusterIdRelabel)) ($metricRelabelings) }}
{{- if not (empty $metricRelabelings) }}
{{- $metricRelabelings := append (list ($clusterNameRelabel)) ($clusterIdRelabel) }}
{{- $_ := set . "metricRelabelings" ($metricRelabelings)}}
{{- end }}
{{- if $forceHTTPSScheme -}}
{{- $_ := set . "scheme" "https" }}
{{- end -}}
{{- if $useHTTPS -}}
{{- if (hasKey . "params") }}
{{- $_ := set (get . "params") "_scheme" (list "https") }}
@ -141,26 +126,6 @@ app: {{ template "pushprox.serviceMonitor.name" . }}
{{- $_ := set . "params" (dict "_scheme" (list "https")) }}
{{- end }}
{{- end }}
{{- if (hasKey . "tlsConfig") }}
{{- $_ := set (get . "tlsConfig") "insecureSkipVerify" $insecureSkipVerify }}
{{- else }}
{{- $_ := set . "tlsConfig" (dict "insecureSkipVerify" $insecureSkipVerify) }}
{{- end }}
{{- if $.Values.clients.https.authenticationMethod.bearerTokenFile.enabled }}
{{- $_ := set . "bearerTokenFile" $.Values.clients.https.authenticationMethod.bearerTokenFile.bearerTokenFilePath }}
{{- end }}
{{- if $.Values.clients.https.authenticationMethod.bearerTokenSecret.enabled }}
{{- $_ := set . "bearerTokenSecret" $serviceAccountTokenName }}
{{- end }}
{{- if $.Values.clients.https.authenticationMethod.authorization.enabled }}
{{- if (hasKey . "authorization") }}
{{- $_ := set (get . "authorization") "type" $.Values.clients.https.authenticationMethod.authorization.type }}
{{- $_ := set (get . "authorization") "credentials" (dict "name" $serviceAccountTokenName "key" $.Values.clients.https.authenticationMethod.authorization.credentials.key "optional" $.Values.clients.https.authenticationMethod.authorization.credentials.optional) }}
{{- else }}
{{- $_ := set . "authorization" (dict "type" $.Values.clients.https.authenticationMethod.authorization.type) }}
{{- $_ := set . "authorization" (dict "credentials" (dict "name" $serviceAccountTokenName "key" $.Values.clients.https.authenticationMethod.authorization.credentials.key "optional" $.Values.clients.https.authenticationMethod.authorization.credentials.optional)) }}
{{- end }}
{{- end }}
{{- end }}
{{- toYaml $endpoints }}
{{- end -}}
{{- end -}}

14
charts/rancher-monitoring/103.0.1+up45.31.1/charts/rke2Etcd/templates/pushprox-clients-rbac.yaml
View File

@ -42,18 +42,6 @@ metadata:
namespace: {{ include "pushprox.namespace" . }}
labels: {{ include "pushProxy.client.labels" . | nindent 4 }}
---
{{- if .Values.clients.https.useServiceAccountCredentials }}
apiVersion: v1
kind: Secret
type: kubernetes.io/service-account-token
metadata:
name: {{ template "pushProxy.client.serviceAccountTokenName" . }}
namespace: {{ include "pushprox.namespace" . }}
labels: {{ include "pushProxy.client.labels" . | nindent 4 }}
annotations:
kubernetes.io/service-account.name: {{ template "pushProxy.client.name" . }}
{{- end }}
---
{{- if .Values.global.cattle.psp.enabled }}
apiVersion: policy/v1beta1
kind: PodSecurityPolicy
@ -94,4 +82,4 @@ spec:
readOnly: true
{{- end }}
{{- end }}
{{- end }}{{- end }}
{{- end }}{{- end }}

6
charts/rancher-monitoring/103.0.1+up45.31.1/charts/rke2Etcd/templates/pushprox-clients.yaml
View File

@ -35,10 +35,6 @@ spec:
hostNetwork: true
dnsPolicy: ClusterFirstWithHostNet
serviceAccountName: {{ template "pushProxy.client.name" . }}
{{- if .Values.global.imagePullSecretName }}
imagePullSecrets:
- name: {{ .Values.global.imagePullSecretName }}
{{- end }}
containers:
- name: pushprox-client
image: {{ template "system_default_registry" . }}{{ .Values.clients.image.repository }}:{{ .Values.clients.image.tag }}
@ -154,4 +150,4 @@ spec:
- name: metrics-cert-dir
emptyDir: {}
{{- end }}
{{- end }}{{- end }}
{{- end }}{{- end }}

6
charts/rancher-monitoring/103.0.1+up45.31.1/charts/rke2Etcd/templates/pushprox-proxy.yaml
View File

@ -26,10 +26,6 @@ spec:
{{ toYaml .Values.proxy.tolerations | indent 8 }}
{{- end }}
serviceAccountName: {{ template "pushProxy.proxy.name" . }}
{{- if .Values.global.imagePullSecretName }}
imagePullSecrets:
- name: {{ .Values.global.imagePullSecretName }}
{{- end }}
containers:
- name: pushprox-proxy
image: {{ template "system_default_registry" . }}{{ .Values.proxy.image.repository }}:{{ .Values.proxy.image.tag }}
@ -54,4 +50,4 @@ spec:
protocol: TCP
targetPort: {{ .Values.proxy.port }}
selector: {{ include "pushProxy.proxy.labels" . | nindent 4 }}
{{- end }}{{- end }}
{{- end }}{{- end }}

2
charts/rancher-monitoring/103.0.1+up45.31.1/charts/rke2Etcd/templates/pushprox-servicemonitor.yaml
View File

@ -42,4 +42,4 @@ spec:
protocol: TCP
targetPort: {{ .Values.metricsPort }}
selector: {{ default (include "pushProxy.client.labels" .) $selector | nindent 4 }}
{{- end }}{{- end }}
{{- end }}{{- end }}

22
charts/rancher-monitoring/103.0.1+up45.31.1/charts/rke2Etcd/values.yaml
View File

@ -75,29 +75,9 @@ clients:
https:
# Does the client require https to access the metrics?
enabled: false
# Does the client require requests be sent to http or https?
forceHTTPSScheme: false
# If set to true, the client will create a service account with adequate permissions and set a flag
# on the client to use the service account token provided by it to make authorized scrape requests
useServiceAccountCredentials: false
# Configuration for authentication to metrics via https endpoint
authenticationMethod:
# Reads token from defined file in container
# This function is deprecated in the prometheus operator api and may be removed in a future version
bearerTokenFile:
enabled: false
bearerTokenFilePath: "/var/run/secrets/kubernetes.io/serviceaccount/token"
# Reads token from defined secret in namespace
# This function is deprecated in the prometheus operator api and may be removed in a future version
bearerTokenSecret:
enabled: false
# Reads token from defined secret in namespace
authorization:
enabled: false
type: "bearer"
credentials:
key: "token"
optional: false
# If set to true, the client will disable SSL security checks
insecureSkipVerify: false
# Directory on host where necessary TLS cert and key to scrape metrics can be found
@ -163,4 +143,4 @@ proxy:
image:
repository: rancher/pushprox-proxy
tag: v0.1.0-rancher2-proxy
command: ["pushprox-proxy"]
command: ["pushprox-proxy"]

4
charts/rancher-monitoring/103.0.1+up45.31.1/charts/rke2IngressNginx/Chart.yaml
View File

@ -6,9 +6,9 @@ annotations:
catalog.rancher.io/namespace: cattle-monitoring-system
catalog.rancher.io/release-name: rancher-pushprox
apiVersion: v1
appVersion: 0.1.1
appVersion: 0.1.0
description: Sets up a deployment of the PushProx proxy and a DaemonSet of PushProx
clients.
name: rke2IngressNginx
type: application
version: 103.0.0
version: 0.1.6

10
charts/rancher-monitoring/103.0.1+up45.31.1/charts/rke2IngressNginx/README.md
View File

@ -55,15 +55,7 @@ The following tables list the configurable parameters of the rancher-pushprox ch
| `clients.proxyUrl` | Overrides the default proxyUrl setting of `http://pushprox-{{ .Values.component }}-proxy.{{ . Release.Namespace }}.svc.cluster.local:{{ .Values.proxy.port }}"` with the `proxyUrl` specified | `""` |
| `clients.useLocalhost` | Sets a flag on each client deployment to redirect scrapes directed to `HOST_IP` to `127.0.0.1` | `false` |
| `clients.https.enabled` | Enables scraping metrics via HTTPS using the provided TLS certs that exist on each host | `false` |
| `clients.https.forceHTTPSScheme` | Forces scraping metrics via HTTPS using the provided TLS certs that exist on each host | `false` |
| `clients.https.useServiceAccountCredentials` | If set to true, the client will create a service account with permissions to scrape `/metrics` endpoint of Kubernetes components. The client will use the service account token provided to make authorized scrape requests to the Kubernetes API | `false` |
| `clients.https.authenticationMethod.bearerTokenFile.enabled` | If set to true, the client will use service account credentials mounted at the configured path `clients.https.authenticationMethod.bearerTokenFile.bearerTokenFilePath`. This requires permissions to scrape `/metrics` endpoint of Kubernetes components. This method is deprecated by the prometheus operator and may be removed in a future release | `false` |
| `clients.https.authenticationMethod.bearerTokenFile.bearerTokenFilePath` | This is a volume mount on the pod with permissions to scrape `/metrics` endpoint of Kubernetes components | `"/var/run/secrets/kubernetes.io/serviceaccount/token"` |
| `clients.https.authenticationMethod.bearerTokenSecret.enabled` | If set to true, the client will use service account credentials to scrape `/metrics` endpoint of Kubernetes components. This method is deprecated by the prometheus operator and may be removed in a future release | `false` |
| `clients.https.authenticationMethod.authorization.enabled` | If set to true, the client will use service account credentials to scrape `/metrics` endpoint of Kubernetes components | `false` |
| `clients.https.authenticationMethod.authorization.type` | If set, the client will use this type of authorization in its client requests for metrics | `"bearer"` |
| `clients.https.authenticationMethod.authorization.credentials.key` | If set, the client will use this key in the secret created by `clients.https.useServiceAccountCredentials` for authorization in its client requests for metrics | `"token"` |
| `clients.https.authenticationMethod.authorization.credentials.optional` | If set to false, the client will fail if the key in the secret created by `clients.https.useServiceAccountCredentials` does not exist | `false` |
| `clients.https.insecureSkipVerify` | If set to true, the client will disable SSL security checks | `false` |
| `clients.https.certDir` | A `hostPath` where TLS certs can be found. This path is mounted as a volume on an `initContainer` which copies only the necessary files over to an EmptyDir volume used by each client. Required and only used if `clients.https.enabled` is set | `""` |
| `clients.https.certFile` | The path to the TLS cert file located within `clients.https.certDir`. Required and only used if `clients.https.enabled` is set | `""` |
@ -87,4 +79,4 @@ The following tables list the configurable parameters of the rancher-pushprox ch
*Tip: The filepaths set in `clients.https.<cert|key|caCert>File` can include wildcard characters*.
See [rancher-monitoring](https://github.com/rancher/charts/tree/gh-pages/packages/rancher-monitoring) for examples of how this chart can be used.
See [rancher-monitoring](https://github.com/rancher/charts/tree/gh-pages/packages/rancher-monitoring) for examples of how this chart can be used.

39
charts/rancher-monitoring/103.0.1+up45.31.1/charts/rke2IngressNginx/templates/_helpers.tpl
View File

@ -68,10 +68,6 @@ provider: kubernetes
{{- printf "pushprox-%s-client" (required ".Values.component is required" .Values.component) -}}
{{- end -}}
{{- define "pushProxy.client.serviceAccountTokenName" -}}
{{- printf "pushprox-%s-client-service-account-token" (required ".Values.component is required" .Values.component) -}}
{{- end -}}
{{- define "pushProxy.client.labels" -}}
k8s-app: {{ template "pushProxy.client.name" . }}
{{ template "pushProxy.commonLabels" . }}
@ -102,11 +98,6 @@ app: {{ template "pushprox.serviceMonitor.name" . }}
{{- define "pushProxy.serviceMonitor.endpoints" -}}
{{- $proxyURL := (include "pushProxy.proxyUrl" .) -}}
{{- $useHTTPS := .Values.clients.https.enabled -}}
{{- $forceHTTPSScheme := .Values.clients.https.forceHTTPSScheme -}}
{{- $insecureSkipVerify := .Values.clients.https.insecureSkipVerify -}}
{{- $useServiceAccountCredentials := .Values.clients.https.useServiceAccountCredentials -}}
{{- $serviceAccountTokenName := (include "pushProxy.client.serviceAccountTokenName" . ) -}}
{{- $metricRelabelings := list }}
{{- $endpoints := .Values.serviceMonitor.endpoints }}
{{- range $endpoints }}
{{- if $.Values.proxy.enabled }}
@ -126,14 +117,8 @@ app: {{ template "pushprox.serviceMonitor.name" . }}
{{- $_ := set $clusterNameRelabel "targetLabel" "cluster_name" }}
{{- $_ := set $clusterNameRelabel "replacement" $.Values.global.cattle.clusterName }}
{{- end }}
{{- $metricRelabelings := gt (len (keys $clusterNameRelabel)) 0 | ternary (append ($metricRelabelings) ($clusterNameRelabel)) ($metricRelabelings) }}
{{- $metricRelabelings := gt (len (keys $clusterIdRelabel)) 0 | ternary (append ($metricRelabelings) ($clusterIdRelabel)) ($metricRelabelings) }}
{{- if not (empty $metricRelabelings) }}
{{- $metricRelabelings := append (list ($clusterNameRelabel)) ($clusterIdRelabel) }}
{{- $_ := set . "metricRelabelings" ($metricRelabelings)}}
{{- end }}
{{- if $forceHTTPSScheme -}}
{{- $_ := set . "scheme" "https" }}
{{- end -}}
{{- if $useHTTPS -}}
{{- if (hasKey . "params") }}
{{- $_ := set (get . "params") "_scheme" (list "https") }}
@ -141,26 +126,6 @@ app: {{ template "pushprox.serviceMonitor.name" . }}
{{- $_ := set . "params" (dict "_scheme" (list "https")) }}
{{- end }}
{{- end }}
{{- if (hasKey . "tlsConfig") }}
{{- $_ := set (get . "tlsConfig") "insecureSkipVerify" $insecureSkipVerify }}
{{- else }}
{{- $_ := set . "tlsConfig" (dict "insecureSkipVerify" $insecureSkipVerify) }}
{{- end }}
{{- if $.Values.clients.https.authenticationMethod.bearerTokenFile.enabled }}
{{- $_ := set . "bearerTokenFile" $.Values.clients.https.authenticationMethod.bearerTokenFile.bearerTokenFilePath }}
{{- end }}
{{- if $.Values.clients.https.authenticationMethod.bearerTokenSecret.enabled }}
{{- $_ := set . "bearerTokenSecret" $serviceAccountTokenName }}
{{- end }}
{{- if $.Values.clients.https.authenticationMethod.authorization.enabled }}
{{- if (hasKey . "authorization") }}
{{- $_ := set (get . "authorization") "type" $.Values.clients.https.authenticationMethod.authorization.type }}
{{- $_ := set (get . "authorization") "credentials" (dict "name" $serviceAccountTokenName "key" $.Values.clients.https.authenticationMethod.authorization.credentials.key "optional" $.Values.clients.https.authenticationMethod.authorization.credentials.optional) }}
{{- else }}
{{- $_ := set . "authorization" (dict "type" $.Values.clients.https.authenticationMethod.authorization.type) }}
{{- $_ := set . "authorization" (dict "credentials" (dict "name" $serviceAccountTokenName "key" $.Values.clients.https.authenticationMethod.authorization.credentials.key "optional" $.Values.clients.https.authenticationMethod.authorization.credentials.optional)) }}
{{- end }}
{{- end }}
{{- end }}
{{- toYaml $endpoints }}
{{- end -}}
{{- end -}}

14
charts/rancher-monitoring/103.0.1+up45.31.1/charts/rke2IngressNginx/templates/pushprox-clients-rbac.yaml
View File

@ -42,18 +42,6 @@ metadata:
namespace: {{ include "pushprox.namespace" . }}
labels: {{ include "pushProxy.client.labels" . | nindent 4 }}
---
{{- if .Values.clients.https.useServiceAccountCredentials }}
apiVersion: v1
kind: Secret
type: kubernetes.io/service-account-token
metadata:
name: {{ template "pushProxy.client.serviceAccountTokenName" . }}
namespace: {{ include "pushprox.namespace" . }}
labels: {{ include "pushProxy.client.labels" . | nindent 4 }}
annotations:
kubernetes.io/service-account.name: {{ template "pushProxy.client.name" . }}
{{- end }}
---
{{- if .Values.global.cattle.psp.enabled }}
apiVersion: policy/v1beta1
kind: PodSecurityPolicy
@ -94,4 +82,4 @@ spec:
readOnly: true
{{- end }}
{{- end }}
{{- end }}{{- end }}
{{- end }}{{- end }}

6
charts/rancher-monitoring/103.0.1+up45.31.1/charts/rke2IngressNginx/templates/pushprox-clients.yaml
View File

@ -35,10 +35,6 @@ spec:
hostNetwork: true
dnsPolicy: ClusterFirstWithHostNet
serviceAccountName: {{ template "pushProxy.client.name" . }}
{{- if .Values.global.imagePullSecretName }}
imagePullSecrets:
- name: {{ .Values.global.imagePullSecretName }}
{{- end }}
containers:
- name: pushprox-client
image: {{ template "system_default_registry" . }}{{ .Values.clients.image.repository }}:{{ .Values.clients.image.tag }}
@ -154,4 +150,4 @@ spec:
- name: metrics-cert-dir
emptyDir: {}
{{- end }}
{{- end }}{{- end }}
{{- end }}{{- end }}

6
charts/rancher-monitoring/103.0.1+up45.31.1/charts/rke2IngressNginx/templates/pushprox-proxy.yaml
View File

@ -26,10 +26,6 @@ spec:
{{ toYaml .Values.proxy.tolerations | indent 8 }}
{{- end }}
serviceAccountName: {{ template "pushProxy.proxy.name" . }}
{{- if .Values.global.imagePullSecretName }}
imagePullSecrets:
- name: {{ .Values.global.imagePullSecretName }}
{{- end }}
containers:
- name: pushprox-proxy
image: {{ template "system_default_registry" . }}{{ .Values.proxy.image.repository }}:{{ .Values.proxy.image.tag }}
@ -54,4 +50,4 @@ spec:
protocol: TCP
targetPort: {{ .Values.proxy.port }}
selector: {{ include "pushProxy.proxy.labels" . | nindent 4 }}
{{- end }}{{- end }}
{{- end }}{{- end }}

2
charts/rancher-monitoring/103.0.1+up45.31.1/charts/rke2IngressNginx/templates/pushprox-servicemonitor.yaml
View File

@ -42,4 +42,4 @@ spec:
protocol: TCP
targetPort: {{ .Values.metricsPort }}
selector: {{ default (include "pushProxy.client.labels" .) $selector | nindent 4 }}
{{- end }}{{- end }}
{{- end }}{{- end }}

22
charts/rancher-monitoring/103.0.1+up45.31.1/charts/rke2IngressNginx/values.yaml
View File

@ -75,29 +75,9 @@ clients:
https:
# Does the client require https to access the metrics?
enabled: false
# Does the client require requests be sent to http or https?
forceHTTPSScheme: false
# If set to true, the client will create a service account with adequate permissions and set a flag
# on the client to use the service account token provided by it to make authorized scrape requests
useServiceAccountCredentials: false
# Configuration for authentication to metrics via https endpoint
authenticationMethod:
# Reads token from defined file in container
# This function is deprecated in the prometheus operator api and may be removed in a future version
bearerTokenFile:
enabled: false
bearerTokenFilePath: "/var/run/secrets/kubernetes.io/serviceaccount/token"
# Reads token from defined secret in namespace
# This function is deprecated in the prometheus operator api and may be removed in a future version
bearerTokenSecret:
enabled: false
# Reads token from defined secret in namespace
authorization:
enabled: false
type: "bearer"
credentials:
key: "token"
optional: false
# If set to true, the client will disable SSL security checks
insecureSkipVerify: false
# Directory on host where necessary TLS cert and key to scrape metrics can be found
@ -163,4 +143,4 @@ proxy:
image:
repository: rancher/pushprox-proxy
tag: v0.1.0-rancher2-proxy
command: ["pushprox-proxy"]
command: ["pushprox-proxy"]

4
charts/rancher-monitoring/103.0.1+up45.31.1/charts/rke2Proxy/Chart.yaml
View File

@ -6,9 +6,9 @@ annotations:
catalog.rancher.io/namespace: cattle-monitoring-system
catalog.rancher.io/release-name: rancher-pushprox
apiVersion: v1
appVersion: 0.1.1
appVersion: 0.1.0
description: Sets up a deployment of the PushProx proxy and a DaemonSet of PushProx
clients.
name: rke2Proxy
type: application
version: 103.0.0
version: 0.1.6

10
charts/rancher-monitoring/103.0.1+up45.31.1/charts/rke2Proxy/README.md
View File

@ -55,15 +55,7 @@ The following tables list the configurable parameters of the rancher-pushprox ch
| `clients.proxyUrl` | Overrides the default proxyUrl setting of `http://pushprox-{{ .Values.component }}-proxy.{{ . Release.Namespace }}.svc.cluster.local:{{ .Values.proxy.port }}"` with the `proxyUrl` specified | `""` |
| `clients.useLocalhost` | Sets a flag on each client deployment to redirect scrapes directed to `HOST_IP` to `127.0.0.1` | `false` |
| `clients.https.enabled` | Enables scraping metrics via HTTPS using the provided TLS certs that exist on each host | `false` |
| `clients.https.forceHTTPSScheme` | Forces scraping metrics via HTTPS using the provided TLS certs that exist on each host | `false` |
| `clients.https.useServiceAccountCredentials` | If set to true, the client will create a service account with permissions to scrape `/metrics` endpoint of Kubernetes components. The client will use the service account token provided to make authorized scrape requests to the Kubernetes API | `false` |
| `clients.https.authenticationMethod.bearerTokenFile.enabled` | If set to true, the client will use service account credentials mounted at the configured path `clients.https.authenticationMethod.bearerTokenFile.bearerTokenFilePath`. This requires permissions to scrape `/metrics` endpoint of Kubernetes components. This method is deprecated by the prometheus operator and may be removed in a future release | `false` |
| `clients.https.authenticationMethod.bearerTokenFile.bearerTokenFilePath` | This is a volume mount on the pod with permissions to scrape `/metrics` endpoint of Kubernetes components | `"/var/run/secrets/kubernetes.io/serviceaccount/token"` |
| `clients.https.authenticationMethod.bearerTokenSecret.enabled` | If set to true, the client will use service account credentials to scrape `/metrics` endpoint of Kubernetes components. This method is deprecated by the prometheus operator and may be removed in a future release | `false` |
| `clients.https.authenticationMethod.authorization.enabled` | If set to true, the client will use service account credentials to scrape `/metrics` endpoint of Kubernetes components | `false` |
| `clients.https.authenticationMethod.authorization.type` | If set, the client will use this type of authorization in its client requests for metrics | `"bearer"` |
| `clients.https.authenticationMethod.authorization.credentials.key` | If set, the client will use this key in the secret created by `clients.https.useServiceAccountCredentials` for authorization in its client requests for metrics | `"token"` |
| `clients.https.authenticationMethod.authorization.credentials.optional` | If set to false, the client will fail if the key in the secret created by `clients.https.useServiceAccountCredentials` does not exist | `false` |
| `clients.https.insecureSkipVerify` | If set to true, the client will disable SSL security checks | `false` |
| `clients.https.certDir` | A `hostPath` where TLS certs can be found. This path is mounted as a volume on an `initContainer` which copies only the necessary files over to an EmptyDir volume used by each client. Required and only used if `clients.https.enabled` is set | `""` |
| `clients.https.certFile` | The path to the TLS cert file located within `clients.https.certDir`. Required and only used if `clients.https.enabled` is set | `""` |
@ -87,4 +79,4 @@ The following tables list the configurable parameters of the rancher-pushprox ch
*Tip: The filepaths set in `clients.https.<cert|key|caCert>File` can include wildcard characters*.
See [rancher-monitoring](https://github.com/rancher/charts/tree/gh-pages/packages/rancher-monitoring) for examples of how this chart can be used.
See [rancher-monitoring](https://github.com/rancher/charts/tree/gh-pages/packages/rancher-monitoring) for examples of how this chart can be used.

39
charts/rancher-monitoring/103.0.1+up45.31.1/charts/rke2Proxy/templates/_helpers.tpl
View File

@ -68,10 +68,6 @@ provider: kubernetes
{{- printf "pushprox-%s-client" (required ".Values.component is required" .Values.component) -}}
{{- end -}}
{{- define "pushProxy.client.serviceAccountTokenName" -}}
{{- printf "pushprox-%s-client-service-account-token" (required ".Values.component is required" .Values.component) -}}
{{- end -}}
{{- define "pushProxy.client.labels" -}}
k8s-app: {{ template "pushProxy.client.name" . }}
{{ template "pushProxy.commonLabels" . }}
@ -102,11 +98,6 @@ app: {{ template "pushprox.serviceMonitor.name" . }}
{{- define "pushProxy.serviceMonitor.endpoints" -}}
{{- $proxyURL := (include "pushProxy.proxyUrl" .) -}}
{{- $useHTTPS := .Values.clients.https.enabled -}}
{{- $forceHTTPSScheme := .Values.clients.https.forceHTTPSScheme -}}
{{- $insecureSkipVerify := .Values.clients.https.insecureSkipVerify -}}
{{- $useServiceAccountCredentials := .Values.clients.https.useServiceAccountCredentials -}}
{{- $serviceAccountTokenName := (include "pushProxy.client.serviceAccountTokenName" . ) -}}
{{- $metricRelabelings := list }}
{{- $endpoints := .Values.serviceMonitor.endpoints }}
{{- range $endpoints }}
{{- if $.Values.proxy.enabled }}
@ -126,14 +117,8 @@ app: {{ template "pushprox.serviceMonitor.name" . }}
{{- $_ := set $clusterNameRelabel "targetLabel" "cluster_name" }}
{{- $_ := set $clusterNameRelabel "replacement" $.Values.global.cattle.clusterName }}
{{- end }}
{{- $metricRelabelings := gt (len (keys $clusterNameRelabel)) 0 | ternary (append ($metricRelabelings) ($clusterNameRelabel)) ($metricRelabelings) }}
{{- $metricRelabelings := gt (len (keys $clusterIdRelabel)) 0 | ternary (append ($metricRelabelings) ($clusterIdRelabel)) ($metricRelabelings) }}
{{- if not (empty $metricRelabelings) }}
{{- $metricRelabelings := append (list ($clusterNameRelabel)) ($clusterIdRelabel) }}
{{- $_ := set . "metricRelabelings" ($metricRelabelings)}}
{{- end }}
{{- if $forceHTTPSScheme -}}
{{- $_ := set . "scheme" "https" }}
{{- end -}}
{{- if $useHTTPS -}}
{{- if (hasKey . "params") }}
{{- $_ := set (get . "params") "_scheme" (list "https") }}
@ -141,26 +126,6 @@ app: {{ template "pushprox.serviceMonitor.name" . }}
{{- $_ := set . "params" (dict "_scheme" (list "https")) }}
{{- end }}
{{- end }}
{{- if (hasKey . "tlsConfig") }}
{{- $_ := set (get . "tlsConfig") "insecureSkipVerify" $insecureSkipVerify }}
{{- else }}
{{- $_ := set . "tlsConfig" (dict "insecureSkipVerify" $insecureSkipVerify) }}
{{- end }}
{{- if $.Values.clients.https.authenticationMethod.bearerTokenFile.enabled }}
{{- $_ := set . "bearerTokenFile" $.Values.clients.https.authenticationMethod.bearerTokenFile.bearerTokenFilePath }}
{{- end }}
{{- if $.Values.clients.https.authenticationMethod.bearerTokenSecret.enabled }}
{{- $_ := set . "bearerTokenSecret" $serviceAccountTokenName }}
{{- end }}
{{- if $.Values.clients.https.authenticationMethod.authorization.enabled }}
{{- if (hasKey . "authorization") }}
{{- $_ := set (get . "authorization") "type" $.Values.clients.https.authenticationMethod.authorization.type }}
{{- $_ := set (get . "authorization") "credentials" (dict "name" $serviceAccountTokenName "key" $.Values.clients.https.authenticationMethod.authorization.credentials.key "optional" $.Values.clients.https.authenticationMethod.authorization.credentials.optional) }}
{{- else }}
{{- $_ := set . "authorization" (dict "type" $.Values.clients.https.authenticationMethod.authorization.type) }}
{{- $_ := set . "authorization" (dict "credentials" (dict "name" $serviceAccountTokenName "key" $.Values.clients.https.authenticationMethod.authorization.credentials.key "optional" $.Values.clients.https.authenticationMethod.authorization.credentials.optional)) }}
{{- end }}
{{- end }}
{{- end }}
{{- toYaml $endpoints }}
{{- end -}}
{{- end -}}

14
charts/rancher-monitoring/103.0.1+up45.31.1/charts/rke2Proxy/templates/pushprox-clients-rbac.yaml
View File

@ -42,18 +42,6 @@ metadata:
namespace: {{ include "pushprox.namespace" . }}
labels: {{ include "pushProxy.client.labels" . | nindent 4 }}
---
{{- if .Values.clients.https.useServiceAccountCredentials }}
apiVersion: v1
kind: Secret
type: kubernetes.io/service-account-token
metadata:
name: {{ template "pushProxy.client.serviceAccountTokenName" . }}
namespace: {{ include "pushprox.namespace" . }}
labels: {{ include "pushProxy.client.labels" . | nindent 4 }}
annotations:
kubernetes.io/service-account.name: {{ template "pushProxy.client.name" . }}
{{- end }}
---
{{- if .Values.global.cattle.psp.enabled }}
apiVersion: policy/v1beta1
kind: PodSecurityPolicy
@ -94,4 +82,4 @@ spec:
readOnly: true
{{- end }}
{{- end }}
{{- end }}{{- end }}
{{- end }}{{- end }}

6
charts/rancher-monitoring/103.0.1+up45.31.1/charts/rke2Proxy/templates/pushprox-clients.yaml
View File

@ -35,10 +35,6 @@ spec:
hostNetwork: true
dnsPolicy: ClusterFirstWithHostNet
serviceAccountName: {{ template "pushProxy.client.name" . }}
{{- if .Values.global.imagePullSecretName }}
imagePullSecrets:
- name: {{ .Values.global.imagePullSecretName }}
{{- end }}
containers:
- name: pushprox-client
image: {{ template "system_default_registry" . }}{{ .Values.clients.image.repository }}:{{ .Values.clients.image.tag }}
@ -154,4 +150,4 @@ spec:
- name: metrics-cert-dir
emptyDir: {}
{{- end }}
{{- end }}{{- end }}
{{- end }}{{- end }}

6
charts/rancher-monitoring/103.0.1+up45.31.1/charts/rke2Proxy/templates/pushprox-proxy.yaml
View File

@ -26,10 +26,6 @@ spec:
{{ toYaml .Values.proxy.tolerations | indent 8 }}
{{- end }}
serviceAccountName: {{ template "pushProxy.proxy.name" . }}
{{- if .Values.global.imagePullSecretName }}
imagePullSecrets:
- name: {{ .Values.global.imagePullSecretName }}
{{- end }}
containers:
- name: pushprox-proxy
image: {{ template "system_default_registry" . }}{{ .Values.proxy.image.repository }}:{{ .Values.proxy.image.tag }}
@ -54,4 +50,4 @@ spec:
protocol: TCP
targetPort: {{ .Values.proxy.port }}
selector: {{ include "pushProxy.proxy.labels" . | nindent 4 }}
{{- end }}{{- end }}
{{- end }}{{- end }}

2
charts/rancher-monitoring/103.0.1+up45.31.1/charts/rke2Proxy/templates/pushprox-servicemonitor.yaml
View File

@ -42,4 +42,4 @@ spec:
protocol: TCP
targetPort: {{ .Values.metricsPort }}
selector: {{ default (include "pushProxy.client.labels" .) $selector | nindent 4 }}
{{- end }}{{- end }}
{{- end }}{{- end }}

22
charts/rancher-monitoring/103.0.1+up45.31.1/charts/rke2Proxy/values.yaml
View File

@ -75,29 +75,9 @@ clients:
https:
# Does the client require https to access the metrics?
enabled: false
# Does the client require requests be sent to http or https?
forceHTTPSScheme: false
# If set to true, the client will create a service account with adequate permissions and set a flag
# on the client to use the service account token provided by it to make authorized scrape requests
useServiceAccountCredentials: false
# Configuration for authentication to metrics via https endpoint
authenticationMethod:
# Reads token from defined file in container
# This function is deprecated in the prometheus operator api and may be removed in a future version
bearerTokenFile:
enabled: false
bearerTokenFilePath: "/var/run/secrets/kubernetes.io/serviceaccount/token"
# Reads token from defined secret in namespace
# This function is deprecated in the prometheus operator api and may be removed in a future version
bearerTokenSecret:
enabled: false
# Reads token from defined secret in namespace
authorization:
enabled: false
type: "bearer"
credentials:
key: "token"
optional: false
# If set to true, the client will disable SSL security checks
insecureSkipVerify: false
# Directory on host where necessary TLS cert and key to scrape metrics can be found
@ -163,4 +143,4 @@ proxy:
image:
repository: rancher/pushprox-proxy
tag: v0.1.0-rancher2-proxy
command: ["pushprox-proxy"]
command: ["pushprox-proxy"]

4
charts/rancher-monitoring/103.0.1+up45.31.1/charts/rke2Scheduler/Chart.yaml
View File

@ -6,9 +6,9 @@ annotations:
catalog.rancher.io/namespace: cattle-monitoring-system
catalog.rancher.io/release-name: rancher-pushprox
apiVersion: v1
appVersion: 0.1.1
appVersion: 0.1.0
description: Sets up a deployment of the PushProx proxy and a DaemonSet of PushProx
clients.
name: rke2Scheduler
type: application
version: 103.0.0
version: 0.1.6

10
charts/rancher-monitoring/103.0.1+up45.31.1/charts/rke2Scheduler/README.md
View File

@ -55,15 +55,7 @@ The following tables list the configurable parameters of the rancher-pushprox ch
| `clients.proxyUrl` | Overrides the default proxyUrl setting of `http://pushprox-{{ .Values.component }}-proxy.{{ . Release.Namespace }}.svc.cluster.local:{{ .Values.proxy.port }}"` with the `proxyUrl` specified | `""` |
| `clients.useLocalhost` | Sets a flag on each client deployment to redirect scrapes directed to `HOST_IP` to `127.0.0.1` | `false` |
| `clients.https.enabled` | Enables scraping metrics via HTTPS using the provided TLS certs that exist on each host | `false` |
| `clients.https.forceHTTPSScheme` | Forces scraping metrics via HTTPS using the provided TLS certs that exist on each host | `false` |
| `clients.https.useServiceAccountCredentials` | If set to true, the client will create a service account with permissions to scrape `/metrics` endpoint of Kubernetes components. The client will use the service account token provided to make authorized scrape requests to the Kubernetes API | `false` |
| `clients.https.authenticationMethod.bearerTokenFile.enabled` | If set to true, the client will use service account credentials mounted at the configured path `clients.https.authenticationMethod.bearerTokenFile.bearerTokenFilePath`. This requires permissions to scrape `/metrics` endpoint of Kubernetes components. This method is deprecated by the prometheus operator and may be removed in a future release | `false` |
| `clients.https.authenticationMethod.bearerTokenFile.bearerTokenFilePath` | This is a volume mount on the pod with permissions to scrape `/metrics` endpoint of Kubernetes components | `"/var/run/secrets/kubernetes.io/serviceaccount/token"` |
| `clients.https.authenticationMethod.bearerTokenSecret.enabled` | If set to true, the client will use service account credentials to scrape `/metrics` endpoint of Kubernetes components. This method is deprecated by the prometheus operator and may be removed in a future release | `false` |
| `clients.https.authenticationMethod.authorization.enabled` | If set to true, the client will use service account credentials to scrape `/metrics` endpoint of Kubernetes components | `false` |
| `clients.https.authenticationMethod.authorization.type` | If set, the client will use this type of authorization in its client requests for metrics | `"bearer"` |
| `clients.https.authenticationMethod.authorization.credentials.key` | If set, the client will use this key in the secret created by `clients.https.useServiceAccountCredentials` for authorization in its client requests for metrics | `"token"` |
| `clients.https.authenticationMethod.authorization.credentials.optional` | If set to false, the client will fail if the key in the secret created by `clients.https.useServiceAccountCredentials` does not exist | `false` |
| `clients.https.insecureSkipVerify` | If set to true, the client will disable SSL security checks | `false` |
| `clients.https.certDir` | A `hostPath` where TLS certs can be found. This path is mounted as a volume on an `initContainer` which copies only the necessary files over to an EmptyDir volume used by each client. Required and only used if `clients.https.enabled` is set | `""` |
| `clients.https.certFile` | The path to the TLS cert file located within `clients.https.certDir`. Required and only used if `clients.https.enabled` is set | `""` |
@ -87,4 +79,4 @@ The following tables list the configurable parameters of the rancher-pushprox ch
*Tip: The filepaths set in `clients.https.<cert|key|caCert>File` can include wildcard characters*.
See [rancher-monitoring](https://github.com/rancher/charts/tree/gh-pages/packages/rancher-monitoring) for examples of how this chart can be used.
See [rancher-monitoring](https://github.com/rancher/charts/tree/gh-pages/packages/rancher-monitoring) for examples of how this chart can be used.

39
charts/rancher-monitoring/103.0.1+up45.31.1/charts/rke2Scheduler/templates/_helpers.tpl
View File

@ -68,10 +68,6 @@ provider: kubernetes
{{- printf "pushprox-%s-client" (required ".Values.component is required" .Values.component) -}}
{{- end -}}
{{- define "pushProxy.client.serviceAccountTokenName" -}}
{{- printf "pushprox-%s-client-service-account-token" (required ".Values.component is required" .Values.component) -}}
{{- end -}}
{{- define "pushProxy.client.labels" -}}
k8s-app: {{ template "pushProxy.client.name" . }}
{{ template "pushProxy.commonLabels" . }}
@ -102,11 +98,6 @@ app: {{ template "pushprox.serviceMonitor.name" . }}
{{- define "pushProxy.serviceMonitor.endpoints" -}}
{{- $proxyURL := (include "pushProxy.proxyUrl" .) -}}
{{- $useHTTPS := .Values.clients.https.enabled -}}
{{- $forceHTTPSScheme := .Values.clients.https.forceHTTPSScheme -}}
{{- $insecureSkipVerify := .Values.clients.https.insecureSkipVerify -}}
{{- $useServiceAccountCredentials := .Values.clients.https.useServiceAccountCredentials -}}
{{- $serviceAccountTokenName := (include "pushProxy.client.serviceAccountTokenName" . ) -}}
{{- $metricRelabelings := list }}
{{- $endpoints := .Values.serviceMonitor.endpoints }}
{{- range $endpoints }}
{{- if $.Values.proxy.enabled }}
@ -126,14 +117,8 @@ app: {{ template "pushprox.serviceMonitor.name" . }}
{{- $_ := set $clusterNameRelabel "targetLabel" "cluster_name" }}
{{- $_ := set $clusterNameRelabel "replacement" $.Values.global.cattle.clusterName }}
{{- end }}
{{- $metricRelabelings := gt (len (keys $clusterNameRelabel)) 0 | ternary (append ($metricRelabelings) ($clusterNameRelabel)) ($metricRelabelings) }}
{{- $metricRelabelings := gt (len (keys $clusterIdRelabel)) 0 | ternary (append ($metricRelabelings) ($clusterIdRelabel)) ($metricRelabelings) }}
{{- if not (empty $metricRelabelings) }}
{{- $metricRelabelings := append (list ($clusterNameRelabel)) ($clusterIdRelabel) }}
{{- $_ := set . "metricRelabelings" ($metricRelabelings)}}
{{- end }}
{{- if $forceHTTPSScheme -}}
{{- $_ := set . "scheme" "https" }}
{{- end -}}
{{- if $useHTTPS -}}
{{- if (hasKey . "params") }}
{{- $_ := set (get . "params") "_scheme" (list "https") }}
@ -141,26 +126,6 @@ app: {{ template "pushprox.serviceMonitor.name" . }}
{{- $_ := set . "params" (dict "_scheme" (list "https")) }}
{{- end }}
{{- end }}
{{- if (hasKey . "tlsConfig") }}
{{- $_ := set (get . "tlsConfig") "insecureSkipVerify" $insecureSkipVerify }}
{{- else }}
{{- $_ := set . "tlsConfig" (dict "insecureSkipVerify" $insecureSkipVerify) }}
{{- end }}
{{- if $.Values.clients.https.authenticationMethod.bearerTokenFile.enabled }}
{{- $_ := set . "bearerTokenFile" $.Values.clients.https.authenticationMethod.bearerTokenFile.bearerTokenFilePath }}
{{- end }}
{{- if $.Values.clients.https.authenticationMethod.bearerTokenSecret.enabled }}
{{- $_ := set . "bearerTokenSecret" $serviceAccountTokenName }}
{{- end }}
{{- if $.Values.clients.https.authenticationMethod.authorization.enabled }}
{{- if (hasKey . "authorization") }}
{{- $_ := set (get . "authorization") "type" $.Values.clients.https.authenticationMethod.authorization.type }}
{{- $_ := set (get . "authorization") "credentials" (dict "name" $serviceAccountTokenName "key" $.Values.clients.https.authenticationMethod.authorization.credentials.key "optional" $.Values.clients.https.authenticationMethod.authorization.credentials.optional) }}
{{- else }}
{{- $_ := set . "authorization" (dict "type" $.Values.clients.https.authenticationMethod.authorization.type) }}
{{- $_ := set . "authorization" (dict "credentials" (dict "name" $serviceAccountTokenName "key" $.Values.clients.https.authenticationMethod.authorization.credentials.key "optional" $.Values.clients.https.authenticationMethod.authorization.credentials.optional)) }}
{{- end }}
{{- end }}
{{- end }}
{{- toYaml $endpoints }}
{{- end -}}
{{- end -}}

14
charts/rancher-monitoring/103.0.1+up45.31.1/charts/rke2Scheduler/templates/pushprox-clients-rbac.yaml
View File

@ -42,18 +42,6 @@ metadata:
namespace: {{ include "pushprox.namespace" . }}
labels: {{ include "pushProxy.client.labels" . | nindent 4 }}
---
{{- if .Values.clients.https.useServiceAccountCredentials }}
apiVersion: v1
kind: Secret
type: kubernetes.io/service-account-token
metadata:
name: {{ template "pushProxy.client.serviceAccountTokenName" . }}
namespace: {{ include "pushprox.namespace" . }}
labels: {{ include "pushProxy.client.labels" . | nindent 4 }}
annotations:
kubernetes.io/service-account.name: {{ template "pushProxy.client.name" . }}
{{- end }}
---
{{- if .Values.global.cattle.psp.enabled }}
apiVersion: policy/v1beta1
kind: PodSecurityPolicy
@ -94,4 +82,4 @@ spec:
readOnly: true
{{- end }}
{{- end }}
{{- end }}{{- end }}
{{- end }}{{- end }}

6
charts/rancher-monitoring/103.0.1+up45.31.1/charts/rke2Scheduler/templates/pushprox-clients.yaml
View File

@ -35,10 +35,6 @@ spec:
hostNetwork: true
dnsPolicy: ClusterFirstWithHostNet
serviceAccountName: {{ template "pushProxy.client.name" . }}
{{- if .Values.global.imagePullSecretName }}
imagePullSecrets:
- name: {{ .Values.global.imagePullSecretName }}
{{- end }}
containers:
- name: pushprox-client
image: {{ template "system_default_registry" . }}{{ .Values.clients.image.repository }}:{{ .Values.clients.image.tag }}
@ -154,4 +150,4 @@ spec:
- name: metrics-cert-dir
emptyDir: {}
{{- end }}
{{- end }}{{- end }}
{{- end }}{{- end }}

6
charts/rancher-monitoring/103.0.1+up45.31.1/charts/rke2Scheduler/templates/pushprox-proxy.yaml
View File

@ -26,10 +26,6 @@ spec:
{{ toYaml .Values.proxy.tolerations | indent 8 }}
{{- end }}
serviceAccountName: {{ template "pushProxy.proxy.name" . }}
{{- if .Values.global.imagePullSecretName }}
imagePullSecrets:
- name: {{ .Values.global.imagePullSecretName }}
{{- end }}
containers:
- name: pushprox-proxy
image: {{ template "system_default_registry" . }}{{ .Values.proxy.image.repository }}:{{ .Values.proxy.image.tag }}
@ -54,4 +50,4 @@ spec:
protocol: TCP
targetPort: {{ .Values.proxy.port }}
selector: {{ include "pushProxy.proxy.labels" . | nindent 4 }}
{{- end }}{{- end }}
{{- end }}{{- end }}

2
charts/rancher-monitoring/103.0.1+up45.31.1/charts/rke2Scheduler/templates/pushprox-servicemonitor.yaml
View File

@ -42,4 +42,4 @@ spec:
protocol: TCP
targetPort: {{ .Values.metricsPort }}
selector: {{ default (include "pushProxy.client.labels" .) $selector | nindent 4 }}
{{- end }}{{- end }}
{{- end }}{{- end }}

22
charts/rancher-monitoring/103.0.1+up45.31.1/charts/rke2Scheduler/values.yaml
View File

@ -75,29 +75,9 @@ clients:
https:
# Does the client require https to access the metrics?
enabled: false
# Does the client require requests be sent to http or https?
forceHTTPSScheme: false
# If set to true, the client will create a service account with adequate permissions and set a flag
# on the client to use the service account token provided by it to make authorized scrape requests
useServiceAccountCredentials: false
# Configuration for authentication to metrics via https endpoint
authenticationMethod:
# Reads token from defined file in container
# This function is deprecated in the prometheus operator api and may be removed in a future version
bearerTokenFile:
enabled: false
bearerTokenFilePath: "/var/run/secrets/kubernetes.io/serviceaccount/token"
# Reads token from defined secret in namespace
# This function is deprecated in the prometheus operator api and may be removed in a future version
bearerTokenSecret:
enabled: false
# Reads token from defined secret in namespace
authorization:
enabled: false
type: "bearer"
credentials:
key: "token"
optional: false
# If set to true, the client will disable SSL security checks
insecureSkipVerify: false
# Directory on host where necessary TLS cert and key to scrape metrics can be found
@ -163,4 +143,4 @@ proxy:
image:
repository: rancher/pushprox-proxy
tag: v0.1.0-rancher2-proxy
command: ["pushprox-proxy"]
command: ["pushprox-proxy"]

4
charts/rancher-monitoring/103.0.1+up45.31.1/charts/rkeControllerManager/Chart.yaml
View File

@ -6,9 +6,9 @@ annotations:
catalog.rancher.io/namespace: cattle-monitoring-system
catalog.rancher.io/release-name: rancher-pushprox
apiVersion: v1
appVersion: 0.1.1
appVersion: 0.1.0
description: Sets up a deployment of the PushProx proxy and a DaemonSet of PushProx
clients.
name: rkeControllerManager
type: application
version: 103.0.0
version: 0.1.6

10
charts/rancher-monitoring/103.0.1+up45.31.1/charts/rkeControllerManager/README.md
View File

@ -55,15 +55,7 @@ The following tables list the configurable parameters of the rancher-pushprox ch
| `clients.proxyUrl` | Overrides the default proxyUrl setting of `http://pushprox-{{ .Values.component }}-proxy.{{ . Release.Namespace }}.svc.cluster.local:{{ .Values.proxy.port }}"` with the `proxyUrl` specified | `""` |
| `clients.useLocalhost` | Sets a flag on each client deployment to redirect scrapes directed to `HOST_IP` to `127.0.0.1` | `false` |
| `clients.https.enabled` | Enables scraping metrics via HTTPS using the provided TLS certs that exist on each host | `false` |
| `clients.https.forceHTTPSScheme` | Forces scraping metrics via HTTPS using the provided TLS certs that exist on each host | `false` |
| `clients.https.useServiceAccountCredentials` | If set to true, the client will create a service account with permissions to scrape `/metrics` endpoint of Kubernetes components. The client will use the service account token provided to make authorized scrape requests to the Kubernetes API | `false` |
| `clients.https.authenticationMethod.bearerTokenFile.enabled` | If set to true, the client will use service account credentials mounted at the configured path `clients.https.authenticationMethod.bearerTokenFile.bearerTokenFilePath`. This requires permissions to scrape `/metrics` endpoint of Kubernetes components. This method is deprecated by the prometheus operator and may be removed in a future release | `false` |
| `clients.https.authenticationMethod.bearerTokenFile.bearerTokenFilePath` | This is a volume mount on the pod with permissions to scrape `/metrics` endpoint of Kubernetes components | `"/var/run/secrets/kubernetes.io/serviceaccount/token"` |
| `clients.https.authenticationMethod.bearerTokenSecret.enabled` | If set to true, the client will use service account credentials to scrape `/metrics` endpoint of Kubernetes components. This method is deprecated by the prometheus operator and may be removed in a future release | `false` |
| `clients.https.authenticationMethod.authorization.enabled` | If set to true, the client will use service account credentials to scrape `/metrics` endpoint of Kubernetes components | `false` |
| `clients.https.authenticationMethod.authorization.type` | If set, the client will use this type of authorization in its client requests for metrics | `"bearer"` |
| `clients.https.authenticationMethod.authorization.credentials.key` | If set, the client will use this key in the secret created by `clients.https.useServiceAccountCredentials` for authorization in its client requests for metrics | `"token"` |
| `clients.https.authenticationMethod.authorization.credentials.optional` | If set to false, the client will fail if the key in the secret created by `clients.https.useServiceAccountCredentials` does not exist | `false` |
| `clients.https.insecureSkipVerify` | If set to true, the client will disable SSL security checks | `false` |
| `clients.https.certDir` | A `hostPath` where TLS certs can be found. This path is mounted as a volume on an `initContainer` which copies only the necessary files over to an EmptyDir volume used by each client. Required and only used if `clients.https.enabled` is set | `""` |
| `clients.https.certFile` | The path to the TLS cert file located within `clients.https.certDir`. Required and only used if `clients.https.enabled` is set | `""` |
@ -87,4 +79,4 @@ The following tables list the configurable parameters of the rancher-pushprox ch
*Tip: The filepaths set in `clients.https.<cert|key|caCert>File` can include wildcard characters*.
See [rancher-monitoring](https://github.com/rancher/charts/tree/gh-pages/packages/rancher-monitoring) for examples of how this chart can be used.
See [rancher-monitoring](https://github.com/rancher/charts/tree/gh-pages/packages/rancher-monitoring) for examples of how this chart can be used.

39
charts/rancher-monitoring/103.0.1+up45.31.1/charts/rkeControllerManager/templates/_helpers.tpl
View File

@ -68,10 +68,6 @@ provider: kubernetes
{{- printf "pushprox-%s-client" (required ".Values.component is required" .Values.component) -}}
{{- end -}}
{{- define "pushProxy.client.serviceAccountTokenName" -}}
{{- printf "pushprox-%s-client-service-account-token" (required ".Values.component is required" .Values.component) -}}
{{- end -}}
{{- define "pushProxy.client.labels" -}}
k8s-app: {{ template "pushProxy.client.name" . }}
{{ template "pushProxy.commonLabels" . }}
@ -102,11 +98,6 @@ app: {{ template "pushprox.serviceMonitor.name" . }}
{{- define "pushProxy.serviceMonitor.endpoints" -}}
{{- $proxyURL := (include "pushProxy.proxyUrl" .) -}}
{{- $useHTTPS := .Values.clients.https.enabled -}}
{{- $forceHTTPSScheme := .Values.clients.https.forceHTTPSScheme -}}
{{- $insecureSkipVerify := .Values.clients.https.insecureSkipVerify -}}
{{- $useServiceAccountCredentials := .Values.clients.https.useServiceAccountCredentials -}}
{{- $serviceAccountTokenName := (include "pushProxy.client.serviceAccountTokenName" . ) -}}
{{- $metricRelabelings := list }}
{{- $endpoints := .Values.serviceMonitor.endpoints }}
{{- range $endpoints }}
{{- if $.Values.proxy.enabled }}
@ -126,14 +117,8 @@ app: {{ template "pushprox.serviceMonitor.name" . }}
{{- $_ := set $clusterNameRelabel "targetLabel" "cluster_name" }}
{{- $_ := set $clusterNameRelabel "replacement" $.Values.global.cattle.clusterName }}
{{- end }}
{{- $metricRelabelings := gt (len (keys $clusterNameRelabel)) 0 | ternary (append ($metricRelabelings) ($clusterNameRelabel)) ($metricRelabelings) }}
{{- $metricRelabelings := gt (len (keys $clusterIdRelabel)) 0 | ternary (append ($metricRelabelings) ($clusterIdRelabel)) ($metricRelabelings) }}
{{- if not (empty $metricRelabelings) }}
{{- $metricRelabelings := append (list ($clusterNameRelabel)) ($clusterIdRelabel) }}
{{- $_ := set . "metricRelabelings" ($metricRelabelings)}}
{{- end }}
{{- if $forceHTTPSScheme -}}
{{- $_ := set . "scheme" "https" }}
{{- end -}}
{{- if $useHTTPS -}}
{{- if (hasKey . "params") }}
{{- $_ := set (get . "params") "_scheme" (list "https") }}
@ -141,26 +126,6 @@ app: {{ template "pushprox.serviceMonitor.name" . }}
{{- $_ := set . "params" (dict "_scheme" (list "https")) }}
{{- end }}
{{- end }}
{{- if (hasKey . "tlsConfig") }}
{{- $_ := set (get . "tlsConfig") "insecureSkipVerify" $insecureSkipVerify }}
{{- else }}
{{- $_ := set . "tlsConfig" (dict "insecureSkipVerify" $insecureSkipVerify) }}
{{- end }}
{{- if $.Values.clients.https.authenticationMethod.bearerTokenFile.enabled }}
{{- $_ := set . "bearerTokenFile" $.Values.clients.https.authenticationMethod.bearerTokenFile.bearerTokenFilePath }}
{{- end }}
{{- if $.Values.clients.https.authenticationMethod.bearerTokenSecret.enabled }}
{{- $_ := set . "bearerTokenSecret" $serviceAccountTokenName }}
{{- end }}
{{- if $.Values.clients.https.authenticationMethod.authorization.enabled }}
{{- if (hasKey . "authorization") }}
{{- $_ := set (get . "authorization") "type" $.Values.clients.https.authenticationMethod.authorization.type }}
{{- $_ := set (get . "authorization") "credentials" (dict "name" $serviceAccountTokenName "key" $.Values.clients.https.authenticationMethod.authorization.credentials.key "optional" $.Values.clients.https.authenticationMethod.authorization.credentials.optional) }}
{{- else }}
{{- $_ := set . "authorization" (dict "type" $.Values.clients.https.authenticationMethod.authorization.type) }}
{{- $_ := set . "authorization" (dict "credentials" (dict "name" $serviceAccountTokenName "key" $.Values.clients.https.authenticationMethod.authorization.credentials.key "optional" $.Values.clients.https.authenticationMethod.authorization.credentials.optional)) }}
{{- end }}
{{- end }}
{{- end }}
{{- toYaml $endpoints }}
{{- end -}}
{{- end -}}

Some files were not shown because too many files have changed in this diff Show More