jsonnet: unlock dependencies for 4.9 development cycle #1214

paulfantom · 2021-06-14T10:43:36Z

Unlocking all jsonnet deps. All relevant work was done in jsonnet/ directory. assets/ and manifests/ are generated.
Additional work to allow using latest libs:

thanos ruler and querier need targetGroups during mixin inclusion
kube-prometheus components need an explicit parameter for kube-rbac-proxy image
removed securityContext from thanos querier pods. It wasn't included earlier and with one provided by the upstream community, querier cannot start. This is due to OpenShift constraints.

Some jsonnet repositories changed place or default branch:

etcd migrated a long time ago to etcd-io/etcd
etcd default branch is now main
thanos default branch is now main
kube-thanos default branch is now main

I added CHANGELOG entry for this change.
No user facing changes, so no entry in CHANGELOG was needed.

@prashbnair please verify if this is also bringing in relevant changes from kubernetes-mixin

/cc @simonpasquier

prashbnair · 2021-06-14T13:01:48Z

@paulfantom My changes are in.

Signed-off-by: paulfantom <pawel@krupa.net.pl>

paulfantom · 2021-06-14T13:07:31Z

CI was filing due to securityContext set on thanos querier pods. The event for that was:

2m43s       Warning   FailedCreate             replicaset/thanos-querier-877fd4494                Error creating: pods "thanos-querier-877fd4494-" is forbidden: unable to validate against any security context constraint: [provider "anyuid": Forbidden: not usable by user or serviceaccount, provider restricted: .spec.securityContext.fsGroup: Invalid value: []int64{65534}: 65534 is not an allowed group, spec.containers[0].securityContext.runAsUser: Invalid value: 65534: must be in the ranges: [1000440000, 1000449999], spec.containers[1].securityContext.runAsUser: Invalid value: 65534: must be in the ranges: [1000440000, 1000449999], spec.containers[2].securityContext.runAsUser: Invalid value: 65534: must be in the ranges: [1000440000, 1000449999], spec.containers[3].securityContext.runAsUser: Invalid value: 65534: must be in the ranges: [1000440000, 1000449999], spec.containers[4].securityContext.runAsUser: Invalid value: 65534: must be in the ranges: [1000440000, 1000449999], provider "nonroot": Forbidden: not usable by user or serviceaccount, provider "hostmount-anyuid": Forbidden: not usable by user or serviceaccount, provider "machine-api-termination-handler": Forbidden: not usable by user or serviceaccount, provider "hostnetwork": Forbidden: not usable by user or serviceaccount, provider "hostaccess": Forbidden: not usable by user or serviceaccount, provider "node-exporter": Forbidden: not usable by user or serviceaccount, provider "privileged": Forbidden: not usable by user or serviceaccount]

simonpasquier · 2021-06-14T14:55:43Z

jsonnet/jsonnetfile.json

@@ -26,7 +26,7 @@
          "subdir": "jsonnet/prometheus-operator"
        }
      },
-      "version": "release-0.47"
+      "version": "master"


given that the jsonnet code generates the operator's CRDs, should we pin to a release branch?

CRDs and prometheus-operator alerts are coming from the same place and are locked with this version flag. Having this set to master allows us to test new alerts and ensure CRDs are really backward compatible as they should.

I agree that this should be set to particular released version of prometheus-operator when we lock all dependencies before releasing OpenShift.

ok thanks for the explanation. I'm fine with this approach :)

paulfantom · 2021-06-16T12:11:26Z

/retest

dgrisonnet · 2021-06-16T14:36:13Z

assets/thanos-querier/deployment.yaml

+      nodeSelector:
+        beta.kubernetes.io/os: linux


we most likely don't want that since we are platform agnostic

We are not platform agnostic. Thanos is built only for linux, same for prometheus, alertmanager, ksm, and all other components:

$ grep nodeSelector -A1 -R . ./alertmanager/alertmanager.yaml: nodeSelector: ./alertmanager/alertmanager.yaml- kubernetes.io/os: linux -- ./grafana/deployment.yaml: nodeSelector: ./grafana/deployment.yaml- beta.kubernetes.io/os: linux -- ./kube-state-metrics/deployment.yaml: nodeSelector: ./kube-state-metrics/deployment.yaml- kubernetes.io/os: linux -- ./node-exporter/daemonset.yaml: nodeSelector: ./node-exporter/daemonset.yaml- kubernetes.io/os: linux -- ./openshift-state-metrics/deployment.yaml: nodeSelector: ./openshift-state-metrics/deployment.yaml- kubernetes.io/os: linux -- ./prometheus-adapter/deployment.yaml: nodeSelector: ./prometheus-adapter/deployment.yaml- kubernetes.io/os: linux -- ./prometheus-k8s/prometheus.yaml: nodeSelector: ./prometheus-k8s/prometheus.yaml- kubernetes.io/os: linux -- ./prometheus-operator-user-workload/deployment.yaml: nodeSelector: ./prometheus-operator-user-workload/deployment.yaml- kubernetes.io/os: linux -- ./prometheus-operator/deployment.yaml: nodeSelector: ./prometheus-operator/deployment.yaml- kubernetes.io/os: linux -- ./prometheus-user-workload/prometheus.yaml: nodeSelector: ./prometheus-user-workload/prometheus.yaml- kubernetes.io/os: linux -- ./telemeter-client/deployment.yaml: nodeSelector: ./telemeter-client/deployment.yaml- beta.kubernetes.io/os: linux -- ./thanos-querier/deployment.yaml: nodeSelector: ./thanos-querier/deployment.yaml- beta.kubernetes.io/os: linux

Oh ok, I thought they could be scheduled on any nodes and the respective runtimes would handle the rest.

dgrisonnet · 2021-06-16T14:36:31Z

assets/thanos-querier/deployment.yaml

@@ -46,13 +46,19 @@ spec:
        - --query.replica-label=prometheus_replica
        - --query.replica-label=thanos_ruler_replica
        - --store=dnssrv+_grpc._tcp.prometheus-operated.openshift-monitoring.svc.cluster.local
+        - --query.auto-downsampling


any concerns regarding enabling auto-downsampling?

I don't have any, it should reduce the load in some situations.

dgrisonnet · 2021-06-17T08:58:29Z

/lgtm

openshift-bot · 2021-06-17T09:17:18Z

/retest

Please review the full test history for this PR and help us cut down flakes.

openshift-bot · 2021-06-17T09:30:19Z

/retest

Please review the full test history for this PR and help us cut down flakes.

simonpasquier

/lgtm

openshift-ci · 2021-06-17T10:27:54Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: dgrisonnet, paulfantom, simonpasquier

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

~~OWNERS~~ [dgrisonnet,paulfantom,simonpasquier]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

openshift-bot · 2021-06-17T11:01:20Z

/retest

Please review the full test history for this PR and help us cut down flakes.

openshift-ci · 2021-06-17T12:24:20Z

@paulfantom: The following test failed, say /retest to rerun all failed tests:

Test name	Commit	Details	Rerun command
ci/prow/e2e-aws-single-node	`d35eb8d`	link	`/test e2e-aws-single-node`

Full PR test history. Your PR dashboard.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

openshift-bot · 2021-06-17T13:04:18Z

/retest

Please review the full test history for this PR and help us cut down flakes.

openshift-ci bot requested a review from simonpasquier June 14, 2021 10:43

openshift-ci bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Jun 14, 2021

paulfantom mentioned this pull request Jun 14, 2021

*: improve discovery of currently used component versions #1195

Closed

2 tasks

paulfantom added 2 commits June 14, 2021 15:04

jsonnet: unlock dependencies for 4.9 development cycle

6f51fe8

Signed-off-by: paulfantom <pawel@krupa.net.pl>

assets,manifests: regenerate

d35eb8d

paulfantom force-pushed the jsonnet-unlock branch from b62a181 to d35eb8d Compare June 14, 2021 13:05

simonpasquier reviewed Jun 14, 2021

View reviewed changes

dgrisonnet reviewed Jun 16, 2021

View reviewed changes

openshift-ci bot assigned dgrisonnet Jun 17, 2021

openshift-ci bot added the lgtm Indicates that a PR is ready to be merged. label Jun 17, 2021

simonpasquier reviewed Jun 17, 2021

View reviewed changes

openshift-ci bot assigned simonpasquier Jun 17, 2021

openshift-merge-robot merged commit a594c35 into openshift:master Jun 17, 2021

paulfantom deleted the jsonnet-unlock branch June 17, 2021 16:44

simonpasquier mentioned this pull request Jul 23, 2021

Bug 1978091: fix node_exporter recording rules for cluster network dashboards #1296

Merged

2 tasks

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

jsonnet: unlock dependencies for 4.9 development cycle #1214

jsonnet: unlock dependencies for 4.9 development cycle #1214

paulfantom commented Jun 14, 2021 •

edited

Loading

prashbnair commented Jun 14, 2021

paulfantom commented Jun 14, 2021

simonpasquier Jun 14, 2021

paulfantom Jun 16, 2021

simonpasquier Jun 17, 2021

paulfantom commented Jun 16, 2021

dgrisonnet Jun 16, 2021 •

edited

Loading

paulfantom Jun 17, 2021

dgrisonnet Jun 17, 2021

dgrisonnet Jun 16, 2021

paulfantom Jun 17, 2021

dgrisonnet commented Jun 17, 2021

openshift-bot commented Jun 17, 2021

openshift-bot commented Jun 17, 2021

simonpasquier left a comment

openshift-ci bot commented Jun 17, 2021

openshift-bot commented Jun 17, 2021

openshift-ci bot commented Jun 17, 2021

openshift-bot commented Jun 17, 2021

jsonnet: unlock dependencies for 4.9 development cycle #1214

jsonnet: unlock dependencies for 4.9 development cycle #1214

Conversation

paulfantom commented Jun 14, 2021 • edited Loading

prashbnair commented Jun 14, 2021

paulfantom commented Jun 14, 2021

simonpasquier Jun 14, 2021

Choose a reason for hiding this comment

paulfantom Jun 16, 2021

Choose a reason for hiding this comment

simonpasquier Jun 17, 2021

Choose a reason for hiding this comment

paulfantom commented Jun 16, 2021

dgrisonnet Jun 16, 2021 • edited Loading

Choose a reason for hiding this comment

paulfantom Jun 17, 2021

Choose a reason for hiding this comment

dgrisonnet Jun 17, 2021

Choose a reason for hiding this comment

dgrisonnet Jun 16, 2021

Choose a reason for hiding this comment

paulfantom Jun 17, 2021

Choose a reason for hiding this comment

dgrisonnet commented Jun 17, 2021

openshift-bot commented Jun 17, 2021

openshift-bot commented Jun 17, 2021

simonpasquier left a comment

Choose a reason for hiding this comment

openshift-ci bot commented Jun 17, 2021

openshift-bot commented Jun 17, 2021

openshift-ci bot commented Jun 17, 2021

openshift-bot commented Jun 17, 2021

paulfantom commented Jun 14, 2021 •

edited

Loading

dgrisonnet Jun 16, 2021 •

edited

Loading