Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

feat: add --as CLI argument #5906

Merged
merged 1 commit into from
Sep 13, 2023
Merged

feat: add --as CLI argument #5906

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
2 changes: 2 additions & 0 deletions Documentation/operator.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -27,6 +27,8 @@ Usage of ./operator:
Annotations to be add to all resources created by the operator
-apiserver string
API Server addr, e.g. ' - NOT RECOMMENDED FOR PRODUCTION - http://127.0.0.1:8080'. Omit parameter to run in on-cluster mode and utilize the service account token.
-as string
Username to impersonate. User could be a regular user or a service account in a namespace.
-ca-file string
- NOT RECOMMENDED FOR PRODUCTION - Path to TLS CA file.
-cert-file string
Expand Down
20 changes: 15 additions & 5 deletions cmd/operator/main.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -157,10 +157,13 @@ func init() {
" Values are from tls package constants (https://golang.org/pkg/crypto/tls/#pkg-constants)."+
"If omitted, the default Go cipher suites will be used."+
"Note that TLS 1.3 ciphersuites are not configurable.")

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Is this blank needed?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I added it to have a better separation between server settings and k8s config settings.

flagset.StringVar(&cfg.ImpersonateUser, "as", "", "Username to impersonate. User could be a regular user or a service account in a namespace.")
flagset.StringVar(&cfg.Host, "apiserver", "", "API Server addr, e.g. ' - NOT RECOMMENDED FOR PRODUCTION - http://127.0.0.1:8080'. Omit parameter to run in on-cluster mode and utilize the service account token.")
flagset.StringVar(&cfg.TLSConfig.CertFile, "cert-file", "", " - NOT RECOMMENDED FOR PRODUCTION - Path to public TLS certificate file.")
flagset.StringVar(&cfg.TLSConfig.KeyFile, "key-file", "", "- NOT RECOMMENDED FOR PRODUCTION - Path to private TLS certificate file.")
flagset.StringVar(&cfg.TLSConfig.CAFile, "ca-file", "", "- NOT RECOMMENDED FOR PRODUCTION - Path to TLS CA file.")

flagset.StringVar(&cfg.KubeletObject, "kubelet-service", "", "Service/Endpoints object to write kubelets into in format \"namespace/name\"")
flagset.StringVar(&cfg.KubeletSelector, "kubelet-selector", "", "Label selector to filter nodes.")
flagset.BoolVar(&cfg.TLSInsecure, "tls-insecure", false, "- NOT RECOMMENDED FOR PRODUCTION - Don't verify API server's CA certificate.")
Expand Down Expand Up @@ -264,7 +267,14 @@ func run() int {

allowedNamespaces := namespaces(cfg.Namespaces.AllowList).asSlice()

cc, err := k8sutil.NewCRDChecker(cfg.Host, cfg.TLSInsecure, &cfg.TLSConfig)
restConfig, err := k8sutil.NewClusterConfig(cfg.Host, cfg.TLSInsecure, &cfg.TLSConfig, cfg.ImpersonateUser)
if err != nil {
level.Error(logger).Log("msg", "failed to create Kubernetes client configuration", "err", err)
cancel()
return 1
}

cc, err := k8sutil.NewCRDChecker(restConfig)
if err != nil {
level.Error(logger).Log("msg", "failed to create new CRDChecker object ", "err", err)
cancel()
Expand All @@ -288,7 +298,7 @@ func run() int {
return 1
}

po, err := prometheuscontroller.New(ctx, cfg, log.With(logger, "component", "prometheusoperator"), r, scrapeConfigSupported)
po, err := prometheuscontroller.New(ctx, restConfig, cfg, log.With(logger, "component", "prometheusoperator"), r, scrapeConfigSupported)
if err != nil {
fmt.Fprintln(os.Stderr, "instantiating prometheus controller failed: ", err)
cancel()
Expand All @@ -314,22 +324,22 @@ func run() int {

var pao *prometheusagentcontroller.Operator
if prometheusAgentSupported {
pao, err = prometheusagentcontroller.New(ctx, cfg, log.With(logger, "component", "prometheusagentoperator"), r, scrapeConfigSupported)
pao, err = prometheusagentcontroller.New(ctx, restConfig, cfg, log.With(logger, "component", "prometheusagentoperator"), r, scrapeConfigSupported)
if err != nil {
level.Error(logger).Log("msg", "instantiating prometheus-agent controller failed", "err", err)
cancel()
return 1
}
}

ao, err := alertmanagercontroller.New(ctx, cfg, log.With(logger, "component", "alertmanageroperator"), r)
ao, err := alertmanagercontroller.New(ctx, restConfig, cfg, log.With(logger, "component", "alertmanageroperator"), r)
if err != nil {
fmt.Fprintln(os.Stderr, "instantiating alertmanager controller failed: ", err)
cancel()
return 1
}

to, err := thanoscontroller.New(ctx, cfg, log.With(logger, "component", "thanosoperator"), r)
to, err := thanoscontroller.New(ctx, restConfig, cfg, log.With(logger, "component", "thanosoperator"), r)
if err != nil {
fmt.Fprintln(os.Stderr, "instantiating thanos controller failed: ", err)
cancel()
Expand Down
14 changes: 5 additions & 9 deletions pkg/alertmanager/operator.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -37,6 +37,7 @@ import (
"k8s.io/apimachinery/pkg/labels"
"k8s.io/client-go/kubernetes"
"k8s.io/client-go/metadata"
"k8s.io/client-go/rest"
"k8s.io/client-go/tools/cache"

"github.com/prometheus-operator/prometheus-operator/pkg/alertmanager/validation"
Expand Down Expand Up @@ -102,23 +103,18 @@ type Config struct {
}

// New creates a new controller.
func New(ctx context.Context, c operator.Config, logger log.Logger, r prometheus.Registerer) (*Operator, error) {
cfg, err := k8sutil.NewClusterConfig(c.Host, c.TLSInsecure, &c.TLSConfig)
if err != nil {
return nil, errors.Wrap(err, "instantiating cluster config failed")
}

client, err := kubernetes.NewForConfig(cfg)
func New(ctx context.Context, restConfig *rest.Config, c operator.Config, logger log.Logger, r prometheus.Registerer) (*Operator, error) {
client, err := kubernetes.NewForConfig(restConfig)
if err != nil {
return nil, errors.Wrap(err, "instantiating kubernetes client failed")
}

mdClient, err := metadata.NewForConfig(cfg)
mdClient, err := metadata.NewForConfig(restConfig)
if err != nil {
return nil, errors.Wrap(err, "instantiating kubernetes client failed")
}

mclient, err := monitoringclient.NewForConfig(cfg)
mclient, err := monitoringclient.NewForConfig(restConfig)
if err != nil {
return nil, errors.Wrap(err, "instantiating monitoring client failed")
}
Expand Down
11 changes: 4 additions & 7 deletions pkg/k8sutil/k8sutil.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -66,16 +66,12 @@ type CRDChecker struct {
kclient kubernetes.Interface
}

func NewCRDChecker(host string, tlsInsecure bool, tlsConfig *rest.TLSClientConfig) (*CRDChecker, error) {
cfg, err := NewClusterConfig(host, tlsInsecure, tlsConfig)
if err != nil {
return nil, errors.Wrap(err, "instantiating cluster config failed")
}

func NewCRDChecker(cfg *rest.Config) (*CRDChecker, error) {
kclient, err := kubernetes.NewForConfig(cfg)
if err != nil {
return nil, errors.Wrap(err, "instantiating kubernetes client failed")
}

return &CRDChecker{kclient: kclient}, nil
}

Expand All @@ -97,7 +93,7 @@ func PodRunningAndReady(pod v1.Pod) (bool, error) {
return false, nil
}

func NewClusterConfig(host string, tlsInsecure bool, tlsConfig *rest.TLSClientConfig) (*rest.Config, error) {
func NewClusterConfig(host string, tlsInsecure bool, tlsConfig *rest.TLSClientConfig, asUser string) (*rest.Config, error) {
var cfg *rest.Config
var err error

Expand Down Expand Up @@ -132,6 +128,7 @@ func NewClusterConfig(host string, tlsInsecure bool, tlsConfig *rest.TLSClientCo
cfg.Burst = 100

cfg.UserAgent = fmt.Sprintf("PrometheusOperator/%s", promversion.Version)
cfg.Impersonate.UserName = asUser

return cfg, nil
}
Expand Down
9 changes: 6 additions & 3 deletions pkg/operator/config.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -29,13 +29,16 @@ import (

// Config defines configuration parameters for the Operator.
type Config struct {
Host string
// Kubernetes client configuration.
Host string
TLSInsecure bool
TLSConfig rest.TLSClientConfig
ImpersonateUser string

ClusterDomain string
KubeletObject string
KubeletSelector string
ListenAddress string
TLSInsecure bool
TLSConfig rest.TLSClientConfig
ServerTLSConfig server.TLSServerConfig
ReloaderConfig ContainerConfig
AlertmanagerDefaultBaseImage string
Expand Down
12 changes: 4 additions & 8 deletions pkg/prometheus/agent/operator.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -32,6 +32,7 @@ import (
"k8s.io/apimachinery/pkg/fields"
"k8s.io/apimachinery/pkg/labels"
"k8s.io/client-go/kubernetes"
"k8s.io/client-go/rest"
"k8s.io/client-go/tools/cache"
"k8s.io/utils/ptr"

Expand Down Expand Up @@ -84,18 +85,13 @@ type Operator struct {
}

// New creates a new controller.
func New(ctx context.Context, conf operator.Config, logger log.Logger, r prometheus.Registerer, scrapeConfigSupported bool) (*Operator, error) {
cfg, err := k8sutil.NewClusterConfig(conf.Host, conf.TLSInsecure, &conf.TLSConfig)
if err != nil {
return nil, errors.Wrap(err, "instantiating cluster config failed")
}

client, err := kubernetes.NewForConfig(cfg)
func New(ctx context.Context, restConfig *rest.Config, conf operator.Config, logger log.Logger, r prometheus.Registerer, scrapeConfigSupported bool) (*Operator, error) {
client, err := kubernetes.NewForConfig(restConfig)
if err != nil {
return nil, errors.Wrap(err, "instantiating kubernetes client failed")
}

mclient, err := monitoringclient.NewForConfig(cfg)
mclient, err := monitoringclient.NewForConfig(restConfig)
if err != nil {
return nil, errors.Wrap(err, "instantiating monitoring client failed")
}
Expand Down
14 changes: 5 additions & 9 deletions pkg/prometheus/server/operator.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -33,6 +33,7 @@ import (
"k8s.io/apimachinery/pkg/labels"
"k8s.io/client-go/kubernetes"
"k8s.io/client-go/metadata"
"k8s.io/client-go/rest"
"k8s.io/client-go/tools/cache"
"k8s.io/utils/ptr"

Expand Down Expand Up @@ -94,23 +95,18 @@ type Operator struct {
}

// New creates a new controller.
func New(ctx context.Context, conf operator.Config, logger log.Logger, r prometheus.Registerer, scrapeConfigSupported bool) (*Operator, error) {
cfg, err := k8sutil.NewClusterConfig(conf.Host, conf.TLSInsecure, &conf.TLSConfig)
if err != nil {
return nil, errors.Wrap(err, "instantiating cluster config failed")
}

client, err := kubernetes.NewForConfig(cfg)
func New(ctx context.Context, restConfig *rest.Config, conf operator.Config, logger log.Logger, r prometheus.Registerer, scrapeConfigSupported bool) (*Operator, error) {
client, err := kubernetes.NewForConfig(restConfig)
if err != nil {
return nil, errors.Wrap(err, "instantiating kubernetes client failed")
}

mdClient, err := metadata.NewForConfig(cfg)
mdClient, err := metadata.NewForConfig(restConfig)
if err != nil {
return nil, errors.Wrap(err, "instantiating metadata client failed")
}

mclient, err := monitoringclient.NewForConfig(cfg)
mclient, err := monitoringclient.NewForConfig(restConfig)
if err != nil {
return nil, errors.Wrap(err, "instantiating monitoring client failed")
}
Expand Down
14 changes: 5 additions & 9 deletions pkg/thanos/operator.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -33,6 +33,7 @@ import (
"k8s.io/apimachinery/pkg/labels"
"k8s.io/client-go/kubernetes"
"k8s.io/client-go/metadata"
"k8s.io/client-go/rest"
"k8s.io/client-go/tools/cache"

monitoringv1 "github.com/prometheus-operator/prometheus-operator/pkg/apis/monitoring/v1"
Expand Down Expand Up @@ -87,23 +88,18 @@ type Config struct {
}

// New creates a new controller.
func New(ctx context.Context, conf operator.Config, logger log.Logger, r prometheus.Registerer) (*Operator, error) {
cfg, err := k8sutil.NewClusterConfig(conf.Host, conf.TLSInsecure, &conf.TLSConfig)
if err != nil {
return nil, errors.Wrap(err, "instantiating cluster config failed")
}

client, err := kubernetes.NewForConfig(cfg)
func New(ctx context.Context, restConfig *rest.Config, conf operator.Config, logger log.Logger, r prometheus.Registerer) (*Operator, error) {
client, err := kubernetes.NewForConfig(restConfig)
if err != nil {
return nil, errors.Wrap(err, "instantiating kubernetes client failed")
}

mdClient, err := metadata.NewForConfig(cfg)
mdClient, err := metadata.NewForConfig(restConfig)
if err != nil {
return nil, errors.Wrap(err, "instantiating metadata client failed")
}

mclient, err := monitoringclient.NewForConfig(cfg)
mclient, err := monitoringclient.NewForConfig(restConfig)
if err != nil {
return nil, errors.Wrap(err, "instantiating monitoring client failed")
}
Expand Down
2 changes: 2 additions & 0 deletions scripts/run-external.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,6 +13,7 @@ declare SHOW_USAGE=false
declare SKIP_OPERATOR_RUN_CHECK=false
declare USE_DEFAULT_CONTEXT=false
declare API_SERVER=""
declare IMPERSONATE_USER=""

# tmp operator files that needs to be cleaned up
declare -r CA_FILE="tmp/CA_FILE"
Expand Down Expand Up @@ -131,6 +132,7 @@ run_operator() {
echo "──────────────────────────────────────────────────────────────────"

run ./operator \
--as="$IMPERSONATE_USER" \
--apiserver="$API_SERVER" \
--ca-file="$CA_FILE" \
--cert-file="$CERT_FILE" \
Expand Down