[release-4.21] OCPBUGS-75884: feat(updates): enable CVO metrics access with RHOBS monitoring flag#7632
Conversation
When --rhobs-monitoring=true is set (for ROSA HCP), enable CVO access to RHOBS Prometheus for conditional update risk evaluation. Add --cvo-prometheus-url flag to allow overriding the default Prometheus endpoint. This provides flexibility for future changes (e.g., if ROSA changes the service name) or for platforms with different monitoring architectures (e.g., ARO HCP's self-managed Prometheus). When not specified, platform-appropriate defaults are used. The CVO deployment logic routes to different metrics endpoints based on the monitoring stack: - RHOBS stack (ROSA HCP): http://hypershift-monitoring-stack-prometheus.openshift-observability-operator.svc:9090 - CoreOS stack (Self-managed HyperShift on OpenShift): https://thanos-querier.openshift-monitoring.svc:9092 For RHOBS (ROSA HCP), we always pass --metrics-ca-bundle-file and --metrics-token-file from the service account. CVO only uses these files if they exist, so passing them is safe even for HTTP endpoints that don't require TLS or authentication. This approach allows switching to a TLS-authenticated endpoint in the future by just changing the URL, without requiring code changes. Key changes: - CVO deployment enables metrics access when either --rhobs-monitoring (for ROSA HCP) or --enable-cvo-management-cluster-metrics-access (for self-managed HyperShift on OpenShift) is set - Add --cvo-prometheus-url flag to configure CVO Prometheus endpoint - Network policies updated to allow egress to the appropriate monitoring endpoint based on stack configuration
|
Important Review skippedAuto reviews are limited based on label configuration. 🚫 Review skipped — only excluded labels are configured. (1)
Please check the settings in the CodeRabbit UI or the You can disable this status message by setting the
✨ Finishing touches🧪 Generate unit tests (beta)
Comment |
|
@openshift-cherrypick-robot: Jira Issue OCPBUGS-69447 has been cloned as Jira Issue OCPBUGS-75884. Will retitle bug to link to clone. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
openshift-ci
bot
changed the title
openshift-ci-robot
added
jira/severity-important
|
@openshift-cherrypick-robot: This pull request references Jira Issue OCPBUGS-75884, which is invalid:
Comment The bug has been updated to refer to the pull request using the external bug tracker. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: openshift-cherrypick-robot The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
openshift-ci
bot
added
area/control-plane-operator
|
@openshift-cherrypick-robot: all tests passed! Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
4 participants
This is an automated cherry-pick of #7399
/assign celebdor
/cherrypick release-4.20