pkg,jsonnet: scrape master kubelets

assets/prometheus-k8s/csr-controller-ca-bundle.yaml → assets/prometheus-k8s/kubelet-serving-ca-bundle.yaml

@@ -3,5 +3,5 @@ data:
   ca-bundle.crt: ""
 kind: ConfigMap
 metadata:
-  name: csr-controller-ca-bundle
+  name: kubelet-serving-ca-bundle
   namespace: openshift-monitoring

assets/prometheus-k8s/prometheus.yaml

@@ -33,7 +33,7 @@ spec:
   baseImage: openshift/prometheus
   configMaps:
   - serving-certs-ca-bundle
-  - csr-controller-ca-bundle
+  - kubelet-serving-ca-bundle
   containers:
   - args:
     - -provider=openshift

assets/prometheus-k8s/service-monitor-kubelet.yaml

@@ -13,7 +13,7 @@ spec:
     port: https-metrics
     scheme: https
     tlsConfig:
-      caFile: /etc/prometheus/configmaps/csr-controller-ca-bundle/ca-bundle.crt
+      caFile: /etc/prometheus/configmaps/kubelet-serving-ca-bundle/ca-bundle.crt
       insecureSkipVerify: false
   - bearerTokenFile: /var/run/secrets/kubernetes.io/serviceaccount/token
     honorLabels: true
@@ -32,7 +32,7 @@ spec:
     port: https-metrics
     scheme: https
     tlsConfig:
-      caFile: /etc/prometheus/configmaps/csr-controller-ca-bundle/ca-bundle.crt
+      caFile: /etc/prometheus/configmaps/kubelet-serving-ca-bundle/ca-bundle.crt
       insecureSkipVerify: false
   - interval: 30s
     port: https-metrics

jsonnet/prometheus.jsonnet

@@ -99,8 +99,8 @@ local namespacesRole =
     // controller, there is no need to add a ConfigMap reloader to
     // the Prometheus Pods because Prometheus automatically reloads
     // its cert pool every 5 seconds.
-    csrControllerCaBundle+:
-      configmap.new('csr-controller-ca-bundle', { 'ca-bundle.crt': '' }) +
+    kubeletServingCaBundle+:
+      configmap.new('kubelet-serving-ca-bundle', { 'ca-bundle.crt': '' }) +
       configmap.mixin.metadata.withNamespace($._config.namespace),
 
     // As Prometheus is protected by the oauth proxy it requires the
@@ -189,7 +189,7 @@ local namespacesRole =
               function(e)
                 e {
                   tlsConfig+: {
-                    caFile: '/etc/prometheus/configmaps/csr-controller-ca-bundle/ca-bundle.crt',
+                    caFile: '/etc/prometheus/configmaps/kubelet-serving-ca-bundle/ca-bundle.crt',
                     insecureSkipVerify: false,
                   },
                 },
@@ -405,7 +405,7 @@ local namespacesRole =
             'prometheus-k8s-htpasswd',
             'kube-rbac-proxy',
           ],
-          configMaps: ['serving-certs-ca-bundle', 'csr-controller-ca-bundle'],
+          configMaps: ['serving-certs-ca-bundle', 'kubelet-serving-ca-bundle'],
           serviceMonitorSelector: {},
           serviceMonitorNamespaceSelector: {},
           listenLocal: true,

pkg/manifests/manifests.go

@@ -89,7 +89,7 @@ var (
 	PrometheusK8sHtpasswd                             = "assets/prometheus-k8s/htpasswd-secret.yaml"
 	PrometheusK8sEtcdServiceMonitor                   = "assets/prometheus-k8s/service-monitor-etcd.yaml"
 	PrometheusK8sServingCertsCABundle                 = "assets/prometheus-k8s/serving-certs-ca-bundle.yaml"
-	PrometheusK8sCSRControllerCABundle                = "assets/prometheus-k8s/csr-controller-ca-bundle.yaml"
+	PrometheusK8sKubeletServingCABundle               = "assets/prometheus-k8s/kubelet-serving-ca-bundle.yaml"
 
 	PrometheusAdapterAPIService                  = "assets/prometheus-adapter/api-service.yaml"
 	PrometheusAdapterClusterRole                 = "assets/prometheus-adapter/cluster-role.yaml"
@@ -613,8 +613,8 @@ func (f *Factory) PrometheusK8sServingCertsCABundle() (*v1.ConfigMap, error) {
 	return c, nil
 }
 
-func (f *Factory) PrometheusK8sCSRControllerCABundle(data map[string]string) (*v1.ConfigMap, error) {
-	c, err := f.NewConfigMap(MustAssetReader(PrometheusK8sCSRControllerCABundle))
+func (f *Factory) PrometheusK8sKubeletServingCABundle(data map[string]string) (*v1.ConfigMap, error) {
+	c, err := f.NewConfigMap(MustAssetReader(PrometheusK8sKubeletServingCABundle))
 	if err != nil {
 		return nil, err
 	}

pkg/operator/operator.go

@@ -44,7 +44,7 @@ const (
 
 	// see https://github.com/kubernetes/apiserver/blob/b571c70e6e823fd78910c3f5b9be895a756f4cbb/pkg/server/options/authentication.go#L239
 	apiAuthenticationConfigMap = "kube-system/extension-apiserver-authentication"
-	csrControllerCAConfigMap   = "openshift-config-managed/csr-controller-ca"
+	kubeletServingCAConfigMap  = "openshift-config-managed/kubelet-serving-ca"
 )
 
 type Operator struct {
@@ -210,7 +210,7 @@ func (o *Operator) handleEvent(obj interface{}) {
 	switch key {
 	case cmoConfigMap:
 	case apiAuthenticationConfigMap:
-	case csrControllerCAConfigMap:
+	case kubeletServingCAConfigMap:
 	default:
 		glog.V(4).Infof("ConfigMap (%s) not triggering an update.", key)
 		return

pkg/tasks/prometheus.go

@@ -49,19 +49,19 @@ func (t *PrometheusTask) Run() error {
 		return errors.Wrap(err, "creating serving certs CA Bundle ConfigMap failed")
 	}
 
-	csrcm, err := t.client.GetConfigmap("openshift-config-managed", "csr-controller-ca")
+	kscm, err := t.client.GetConfigmap("openshift-config-managed", "kubelet-serving-ca")
 	if err != nil {
-		return errors.Wrap(err, "openshift-config-managed/csr-controller-ca")
+		return errors.Wrap(err, "openshift-config-managed/kubelet-serving-ca")
 	}
 
-	cacm, err = t.factory.PrometheusK8sCSRControllerCABundle(csrcm.Data)
+	cacm, err = t.factory.PrometheusK8sKubeletServingCABundle(kscm.Data)
 	if err != nil {
-		return errors.Wrap(err, "initializing CSR controller CA Bundle ConfigMap failed")
+		return errors.Wrap(err, "initializing kubelet serving CA Bundle ConfigMap failed")
 	}
 
 	err = t.client.CreateIfNotExistConfigMap(cacm)
 	if err != nil {
-		return errors.Wrap(err, "creating CSR controller CA Bundle ConfigMap failed")
+		return errors.Wrap(err, "creating kubelet serving CA Bundle ConfigMap failed")
 	}
 
 	r, err := t.factory.PrometheusK8sRoute()