-
Notifications
You must be signed in to change notification settings - Fork 363
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
MON-2807: Use bearer token file for remote write authentication with telemeter #1733
Changes from all commits
File filter
Filter by extension
Conversations
Jump to
Diff view
Diff view
There are no files selected for viewing
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,9 @@ | ||
apiVersion: v1 | ||
data: {} | ||
kind: Secret | ||
metadata: | ||
labels: | ||
app.kubernetes.io/name: prometheus-k8s | ||
name: telemetry-server | ||
namespace: openshift-monitoring | ||
type: Opaque |
Original file line number | Diff line number | Diff line change |
---|---|---|
|
@@ -62,6 +62,8 @@ const ( | |
|
||
platformAlertmanagerService = "alertmanager-main" | ||
userWorkloadAlertmanagerService = "alertmanager-user-workload" | ||
|
||
telemetryTokenSecretKey = "token" | ||
) | ||
|
||
var ( | ||
|
@@ -145,6 +147,7 @@ var ( | |
PrometheusK8sThanosSidecarServiceMonitor = "prometheus-k8s/service-monitor-thanos-sidecar.yaml" | ||
PrometheusK8sTAlertmanagerRoleBinding = "prometheus-k8s/alertmanager-role-binding.yaml" | ||
PrometheusK8sPodDisruptionBudget = "prometheus-k8s/pod-disruption-budget.yaml" | ||
PrometheusK8sTelemetry = "prometheus-k8s/telemetry-secret.yaml" | ||
|
||
PrometheusUserWorkloadServingCertsCABundle = "prometheus-user-workload/serving-certs-ca-bundle.yaml" | ||
PrometheusUserWorkloadServiceAccount = "prometheus-user-workload/service-account.yaml" | ||
|
@@ -1567,7 +1570,29 @@ func (f *Factory) NewPrometheusK8s() (*monv1.Prometheus, error) { | |
return f.NewPrometheus(f.assets.MustNewAssetReader(PrometheusK8s)) | ||
} | ||
|
||
func (f *Factory) PrometheusK8s(grpcTLS *v1.Secret, trustedCABundleCM *v1.ConfigMap) (*monv1.Prometheus, error) { | ||
func (f *Factory) PrometheusK8sTelemetrySecret() (*v1.Secret, error) { | ||
s, err := f.NewSecret(f.assets.MustNewAssetReader(PrometheusK8sTelemetry)) | ||
if err != nil { | ||
return nil, err | ||
} | ||
compositeToken, err := json.Marshal(map[string]string{ | ||
"cluster_id": f.config.ClusterMonitoringConfiguration.TelemeterClientConfig.ClusterID, | ||
"authorization_token": f.config.ClusterMonitoringConfiguration.TelemeterClientConfig.Token, | ||
}) | ||
if err != nil { | ||
return nil, err | ||
} | ||
|
||
b := make([]byte, base64.StdEncoding.EncodedLen(len(compositeToken))) | ||
base64.StdEncoding.Encode(b, compositeToken) | ||
s.Data = map[string][]byte{ | ||
telemetryTokenSecretKey: b, | ||
} | ||
|
||
return s, nil | ||
} | ||
|
||
func (f *Factory) PrometheusK8s(grpcTLS *v1.Secret, trustedCABundleCM *v1.ConfigMap, telemetrySecret *v1.Secret) (*monv1.Prometheus, error) { | ||
p, err := f.NewPrometheusK8s() | ||
if err != nil { | ||
return nil, err | ||
|
@@ -1625,23 +1650,18 @@ func (f *Factory) PrometheusK8s(grpcTLS *v1.Secret, trustedCABundleCM *v1.Config | |
return nil, err | ||
} | ||
|
||
telemetryEnabled := f.config.ClusterMonitoringConfiguration.TelemeterClientConfig.IsEnabled() | ||
clusterID := f.config.ClusterMonitoringConfiguration.TelemeterClientConfig.ClusterID | ||
if telemetryEnabled && f.config.RemoteWrite { | ||
|
||
if f.config.ClusterMonitoringConfiguration.TelemeterClientConfig.IsEnabled() && f.config.RemoteWrite { | ||
selectorRelabelConfig, err := promqlgen.LabelSelectorsToRelabelConfig(f.config.ClusterMonitoringConfiguration.PrometheusK8sConfig.TelemetryMatches) | ||
if err != nil { | ||
return nil, errors.Wrap(err, "generate label selector relabel config") | ||
} | ||
|
||
compositeToken, err := json.Marshal(map[string]string{ | ||
"cluster_id": clusterID, | ||
"authorization_token": f.config.ClusterMonitoringConfiguration.TelemeterClientConfig.Token, | ||
}) | ||
p.Spec.Secrets = append(p.Spec.Secrets, telemetrySecret.GetName()) | ||
|
||
spec := monv1.RemoteWriteSpec{ | ||
URL: f.config.ClusterMonitoringConfiguration.TelemeterClientConfig.TelemeterServerURL, | ||
BearerToken: base64.StdEncoding.EncodeToString(compositeToken), | ||
URL: f.config.ClusterMonitoringConfiguration.TelemeterClientConfig.TelemeterServerURL, | ||
BearerTokenFile: fmt.Sprintf("/etc/prometheus/secrets/%s/%s", telemetrySecret.GetName(), telemetryTokenSecretKey), | ||
QueueConfig: &monv1.QueueConfig{ | ||
// Amount of samples to load from the WAL into the in-memory | ||
// buffer before waiting for samples to be sent successfully | ||
|
@@ -1678,13 +1698,12 @@ func (f *Factory) PrometheusK8s(grpcTLS *v1.Secret, trustedCABundleCM *v1.Config | |
Replacement: "alerts", | ||
}, | ||
}, | ||
MetadataConfig: &monv1.MetadataConfig{ | ||
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. This change seems to not be related, was it intentional? There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Yes but it should be commented. Basically we don't want/need to forward metadata information to the telemeter server. It comes from #1416 which was the previous PR that exercised the receive path of telemeter. There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Yes, Telemeter forwards rw requests to Thanos, and Thanos doesn't have metadata ingestion yet. We can still send it, but it would just be dropped. 🙂 There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Did you still want to add a comment for this @simonpasquier ? |
||
Send: false, | ||
}, | ||
} | ||
|
||
p.Spec.RemoteWrite = []monv1.RemoteWriteSpec{spec} | ||
|
||
} | ||
if !telemetryEnabled { | ||
p.Spec.RemoteWrite = nil | ||
} | ||
|
||
if len(f.config.ClusterMonitoringConfiguration.PrometheusK8sConfig.RemoteWrite) > 0 { | ||
|
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Discussed separately: Future readers of this code would benefit from checking the actual config condition here (
if telemetryEnabled && f.config.RemoteWrite
) and assuming the secret was created instead of coupling this to the secret creating.