Add an option to expose prometheus metrics securely via kube-rbac-proxy#1545
Merged
Conversation
fedepaol
requested review from
gclawes,
johananl,
oribon,
rata and
russellb
as code owners
fedepaol
force-pushed
the
metrics/addsecuremetrics
branch
5 times, most recently
from
11c044a to
b27fa01
Compare
oribon
reviewed
Aug 1, 2022
| template: | ||
| metadata: | ||
| annotations: | ||
| prometheus.io/port: "7472" |
Member
There was a problem hiding this comment.
weird, that shouldn't have been here? remember removing it on the initial frr exporter pr for the reason in the previous comment - when no port is defined it should look for all monitoring ports 😄
fedepaol
force-pushed
the
metrics/addsecuremetrics
branch
6 times, most recently
from
bc62af6 to
616c8ad
Compare
fedepaol
force-pushed
the
metrics/addsecuremetrics
branch
9 times, most recently
from
f352c16 to
5e1fbea
Compare
Changing the overlays to add a layer for exposing metrics to the prometheus operator via servicemonitors. Signed-off-by: Federico Paolinelli <fpaoline@redhat.com>
Adding options to deploy prometheus and run metrics tests against it passing the namespace it's deployed to. We add a local configuration of prometheus stripped down of unnecessary items, deploying only the operator and prometheus itself. Signed-off-by: Federico Paolinelli <fpaoline@redhat.com>
Testing the metrics exposed by the pods doesn't cover the full e2e solution, and eventual issues in the integration with prometheus won't appear. Here we add the option to the e2e tests to check the metrics on prometheus too, if deployed on the cluster. Signed-off-by: Federico Paolinelli <fpaoline@redhat.com>
fedepaol
force-pushed
the
metrics/addsecuremetrics
branch
2 times, most recently
from
4374eee to
65ee24e
Compare
Adding an option to add kube-rbac-proxy to the pods, exposing the metrics via a secure channel, and adding an option to use servicemonitors in order to consume those securely exposed metrics. Signed-off-by: Federico Paolinelli <fpaoline@redhat.com>
Regenerating the manifests and adding two variants for prometheus enabled. Signed-off-by: Federico Paolinelli <fpaoline@redhat.com>
Deploying prometheus to be able to run prometheus tests. Also, add lanes with no prometheus. We want to make sure the deployment works also with no prometheus, so add a few helm / manifest lanes without it. Signed-off-by: Federico Paolinelli <fpaoline@redhat.com>
Extending the docs accordingly. Signed-off-by: Federico Paolinelli <fpaoline@redhat.com>
fedepaol
force-pushed
the
metrics/addsecuremetrics
branch
from
65ee24e to
ed73248
Compare
The prometheus tests add test duration time. Raising the timeout to accomodate them. Signed-off-by: Federico Paolinelli <fpaoline@redhat.com>
fedepaol
force-pushed
the
metrics/addsecuremetrics
branch
from
ed73248 to
e075f57
Compare
6 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Here we adjust the manifests and the helm chart to optionally set a kube-rbac-proxy sidecar to interact with prometheus, in order to expose the metrics securely.
At the same time, we change CI to deploy the prometheus k8s stack and validate the metrics against the real prometheus instance (as opposed to validating that the pods are exposing the metrics). This will give us more confidence in the fact that the integration with prometheus is really working.