diff --git a/.github/tests/prometheus/pre-install.sh b/.github/tests/prometheus/pre-install.sh new file mode 100755 index 0000000..5959a16 --- /dev/null +++ b/.github/tests/prometheus/pre-install.sh @@ -0,0 +1,3 @@ +#!/usr/bin/env bash + +helm install kube-prometheus-stack kube-prometheus-stack --version 45.7.1 --repo https://prometheus-community.github.io/helm-charts -n "$scenario" --wait diff --git a/.github/tests/prometheus/values.yaml b/.github/tests/prometheus/values.yaml index b66af8d..a0886e4 100644 --- a/.github/tests/prometheus/values.yaml +++ b/.github/tests/prometheus/values.yaml @@ -2,3 +2,12 @@ global: telemetry: prometheus: enabled: true + podMonitor: + enabled: true + labels: + release: kube-prometheus-stack + +spiffe-oidc-discovery-provider: + enabled: true + insecureScheme: + enabled: true diff --git a/charts/spire/charts/spiffe-oidc-discovery-provider/README.md b/charts/spire/charts/spiffe-oidc-discovery-provider/README.md index 9ba5d0b..3504e7f 100644 --- a/charts/spire/charts/spiffe-oidc-discovery-provider/README.md +++ b/charts/spire/charts/spiffe-oidc-discovery-provider/README.md @@ -68,6 +68,9 @@ A Helm chart to install the SPIFFE OIDC discovery provider. | telemetry.prometheus.nginxExporter.image.repository | string | `"nginx/nginx-prometheus-exporter"` | | | telemetry.prometheus.nginxExporter.image.version | string | `"0.11.0"` | | | telemetry.prometheus.nginxExporter.resources | object | `{}` | | +| telemetry.prometheus.podMonitor.enabled | bool | `false` | | +| telemetry.prometheus.podMonitor.labels | object | `{}` | | +| telemetry.prometheus.podMonitor.namespace | string | `""` | Override where to install the podMonitor, if not set will use the same namespace as the spiffe-oidc-discovery-provider | | telemetry.prometheus.port | int | `9988` | | | tolerations | list | `[]` | | | trustDomain | string | `"example.org"` | | diff --git a/charts/spire/charts/spiffe-oidc-discovery-provider/templates/_helpers.tpl b/charts/spire/charts/spiffe-oidc-discovery-provider/templates/_helpers.tpl index fbe6f33..139e151 100644 --- a/charts/spire/charts/spiffe-oidc-discovery-provider/templates/_helpers.tpl +++ b/charts/spire/charts/spiffe-oidc-discovery-provider/templates/_helpers.tpl @@ -34,6 +34,16 @@ Allow the release namespace to be overridden for multi-namespace deployments in {{- end -}} {{- end -}} +{{- define "spiffe-oidc-discovery-provider.podMonitor.namespace" -}} + {{- if ne (len .Values.telemetry.prometheus.podMonitor.namespace) 0 }} + {{- .Values.telemetry.prometheus.podMonitor.namespace }} + {{- else if ne (len (dig "telemetry" "prometheus" "podMonitor" "namespace" "" .Values.global)) 0 }} + {{- .Values.global.telemetry.prometheus.podMonitor.namespace }} + {{- else }} + {{- include "spiffe-oidc-discovery-provider.namespace" . }} + {{- end }} +{{- end -}} + {{/* Create chart name and version as used by the chart label. */}} diff --git a/charts/spire/charts/spiffe-oidc-discovery-provider/templates/podmonitor.yaml b/charts/spire/charts/spiffe-oidc-discovery-provider/templates/podmonitor.yaml new file mode 100644 index 0000000..dec060f --- /dev/null +++ b/charts/spire/charts/spiffe-oidc-discovery-provider/templates/podmonitor.yaml @@ -0,0 +1,29 @@ +{{- if .Values.insecureScheme.enabled }} +{{- if (dig "telemetry" "prometheus" "podMonitor" "enabled" .Values.telemetry.prometheus.podMonitor.enabled .Values.global) }} +{{- $namespace := include "spiffe-oidc-discovery-provider.podMonitor.namespace" . }} +{{- $podNamespace := ( include "spiffe-oidc-discovery-provider.namespace" . ) }} +apiVersion: monitoring.coreos.com/v1 +kind: PodMonitor +metadata: + name: {{ include "spire-agent.fullname" . }} + namespace: {{ $namespace }} + labels: + {{- include "spire-agent.labels" . | nindent 4 }} + {{- if ne (len (dig "telemetry" "prometheus" "podMonitor" "labels" (dict) .Values.global)) 0 }} + {{- .Values.global.telemetry.prometheus.podMonitor.labels | toYaml | nindent 4 }} + {{- end }} + {{- with .Values.telemetry.prometheus.podMonitor.labels }} + {{- toYaml . | nindent 4 }} + {{- end }} +spec: + selector: + matchLabels: + {{- include "spire-agent.selectorLabels" . | nindent 6 }} + podMetricsEndpoints: + - port: prom + {{- if ne $namespace $podNamespace }} + namespaceSelector: + kubernetes.io/metadata.name: {{ $podNamespace }} + {{- end }} +{{- end }} +{{- end }} diff --git a/charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml b/charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml index e4871fb..1424301 100644 --- a/charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml +++ b/charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml @@ -120,6 +120,11 @@ telemetry: prometheus: enabled: false port: 9988 + podMonitor: + enabled: false + # -- Override where to install the podMonitor, if not set will use the same namespace as the spiffe-oidc-discovery-provider + namespace: "" + labels: {} nginxExporter: image: diff --git a/charts/spire/charts/spire-agent/README.md b/charts/spire/charts/spire-agent/README.md index e8a9665..035c857 100644 --- a/charts/spire/charts/spire-agent/README.md +++ b/charts/spire/charts/spire-agent/README.md @@ -44,6 +44,9 @@ A Helm chart to install the SPIRE agent. | serviceAccount.name | string | `""` | | | socketPath | string | `"/run/spire/agent-sockets/spire-agent.sock"` | | | telemetry.prometheus.enabled | bool | `false` | | +| telemetry.prometheus.podMonitor.enabled | bool | `false` | | +| telemetry.prometheus.podMonitor.labels | object | `{}` | | +| telemetry.prometheus.podMonitor.namespace | string | `""` | Override where to install the podMonitor, if not set will use the same namespace as the spire-agent | | telemetry.prometheus.port | int | `9988` | | | trustDomain | string | `"example.org"` | | | waitForIt.image.pullPolicy | string | `"IfNotPresent"` | | diff --git a/charts/spire/charts/spire-agent/templates/_helpers.tpl b/charts/spire/charts/spire-agent/templates/_helpers.tpl index 065f6ed..ff43724 100644 --- a/charts/spire/charts/spire-agent/templates/_helpers.tpl +++ b/charts/spire/charts/spire-agent/templates/_helpers.tpl @@ -42,6 +42,16 @@ Allow the release namespace to be overridden for multi-namespace deployments in {{- end -}} {{- end -}} +{{- define "spire-agent.podMonitor.namespace" -}} + {{- if ne (len .Values.telemetry.prometheus.podMonitor.namespace) 0 }} + {{- .Values.telemetry.prometheus.podMonitor.namespace }} + {{- else if ne (len (dig "telemetry" "prometheus" "podMonitor" "namespace" "" .Values.global)) 0 }} + {{- .Values.global.telemetry.prometheus.podMonitor.namespace }} + {{- else }} + {{- include "spire-agent.namespace" . }} + {{- end }} +{{- end -}} + {{/* Create chart name and version as used by the chart label. */}} diff --git a/charts/spire/charts/spire-agent/templates/podmonitor.yaml b/charts/spire/charts/spire-agent/templates/podmonitor.yaml new file mode 100644 index 0000000..92fd0e3 --- /dev/null +++ b/charts/spire/charts/spire-agent/templates/podmonitor.yaml @@ -0,0 +1,27 @@ +{{- if (dig "telemetry" "prometheus" "podMonitor" "enabled" .Values.telemetry.prometheus.podMonitor.enabled .Values.global) }} +{{- $namespace := include "spiffe-oidc-discovery-provider.podMonitor.namespace" . }} +{{- $podNamespace := ( include "spiffe-oidc-discovery-provider.namespace" . ) }} +apiVersion: monitoring.coreos.com/v1 +kind: PodMonitor +metadata: + name: {{ include "spiffe-oidc-discovery-provider.fullname" . }} + namespace: {{ $namespace }} + labels: + {{- include "spiffe-oidc-discovery-provider.labels" . | nindent 4 }} + {{- if ne (len (dig "telemetry" "prometheus" "podMonitor" "labels" (dict) .Values.global)) 0 }} + {{- .Values.global.telemetry.prometheus.podMonitor.labels | toYaml | nindent 4 }} + {{- end }} + {{- with .Values.telemetry.prometheus.podMonitor.labels }} + {{- toYaml . | nindent 4 }} + {{- end }} +spec: + selector: + matchLabels: + {{- include "spiffe-oidc-discovery-provider.selectorLabels" . | nindent 6 }} + podMetricsEndpoints: + - port: prom + {{- if ne $namespace $podNamespace }} + namespaceSelector: + kubernetes.io/metadata.name: {{ $podNamespace }} + {{- end }} +{{- end }} diff --git a/charts/spire/charts/spire-agent/values.yaml b/charts/spire/charts/spire-agent/values.yaml index a2b47db..e5bca41 100644 --- a/charts/spire/charts/spire-agent/values.yaml +++ b/charts/spire/charts/spire-agent/values.yaml @@ -86,6 +86,11 @@ telemetry: prometheus: enabled: false port: 9988 + podMonitor: + enabled: false + # -- Override where to install the podMonitor, if not set will use the same namespace as the spire-agent + namespace: "" + labels: {} socketPath: /run/spire/agent-sockets/spire-agent.sock diff --git a/charts/spire/charts/spire-server/README.md b/charts/spire/charts/spire-server/README.md index 6574da3..8a6abd7 100644 --- a/charts/spire/charts/spire-server/README.md +++ b/charts/spire/charts/spire-server/README.md @@ -92,6 +92,9 @@ A Helm chart to install the SPIRE server. | serviceAccount.create | bool | `true` | | | serviceAccount.name | string | `""` | | | telemetry.prometheus.enabled | bool | `false` | | +| telemetry.prometheus.podMonitor.enabled | bool | `false` | | +| telemetry.prometheus.podMonitor.labels | object | `{}` | | +| telemetry.prometheus.podMonitor.namespace | string | `""` | Override where to install the podMonitor, if not set will use the same namespace as the spire-server | | tolerations | list | `[]` | | | topologySpreadConstraints | list | `[]` | | | trustDomain | string | `"example.org"` | | diff --git a/charts/spire/charts/spire-server/templates/_helpers.tpl b/charts/spire/charts/spire-server/templates/_helpers.tpl index 786ef07..809aeb3 100644 --- a/charts/spire/charts/spire-server/templates/_helpers.tpl +++ b/charts/spire/charts/spire-server/templates/_helpers.tpl @@ -34,6 +34,16 @@ Allow the release namespace to be overridden for multi-namespace deployments in {{- end -}} {{- end -}} +{{- define "spire-server.podMonitor.namespace" -}} + {{- if ne (len .Values.telemetry.prometheus.podMonitor.namespace) 0 }} + {{- .Values.telemetry.prometheus.podMonitor.namespace }} + {{- else if ne (len (dig "telemetry" "prometheus" "podMonitor" "namespace" "" .Values.global)) 0 }} + {{- .Values.global.telemetry.prometheus.podMonitor.namespace }} + {{- else }} + {{- include "spire-server.namespace" . }} + {{- end }} +{{- end -}} + {{/* Create chart name and version as used by the chart label. */}} diff --git a/charts/spire/charts/spire-server/templates/podmonitor.yaml b/charts/spire/charts/spire-server/templates/podmonitor.yaml new file mode 100644 index 0000000..878a4ba --- /dev/null +++ b/charts/spire/charts/spire-server/templates/podmonitor.yaml @@ -0,0 +1,27 @@ +{{- if (dig "telemetry" "prometheus" "podMonitor" "enabled" .Values.telemetry.prometheus.podMonitor.enabled .Values.global) }} +{{- $namespace := include "spire-server.podMonitor.namespace" . }} +{{- $podNamespace := ( include "spire-server.namespace" . ) }} +apiVersion: monitoring.coreos.com/v1 +kind: PodMonitor +metadata: + name: {{ include "spire-server.fullname" . }} + namespace: {{ $namespace }} + labels: + {{- include "spire-server.labels" . | nindent 4 }} + {{- if ne (len (dig "telemetry" "prometheus" "podMonitor" "labels" (dict) .Values.global)) 0 }} + {{- .Values.global.telemetry.prometheus.podMonitor.labels | toYaml | nindent 4 }} + {{- end }} + {{- with .Values.telemetry.prometheus.podMonitor.labels }} + {{- toYaml . | nindent 4 }} + {{- end }} +spec: + selector: + matchLabels: + {{- include "spire-server.selectorLabels" . | nindent 6 }} + podMetricsEndpoints: + - port: prom + {{- if ne $namespace $podNamespace }} + namespaceSelector: + kubernetes.io/metadata.name: {{ $podNamespace }} + {{- end }} +{{- end }} diff --git a/charts/spire/charts/spire-server/values.yaml b/charts/spire/charts/spire-server/values.yaml index 76274fd..4206c66 100644 --- a/charts/spire/charts/spire-server/values.yaml +++ b/charts/spire/charts/spire-server/values.yaml @@ -195,6 +195,11 @@ controllerManager: telemetry: prometheus: enabled: false + podMonitor: + enabled: false + # -- Override where to install the podMonitor, if not set will use the same namespace as the spire-server + namespace: "" + labels: {} extraVolumes: [] extraVolumeMounts: [] diff --git a/charts/spire/values.yaml b/charts/spire/values.yaml index e34b928..72e07e1 100644 --- a/charts/spire/values.yaml +++ b/charts/spire/values.yaml @@ -14,6 +14,11 @@ global: # telemetry: # prometheus: # enabled: true +# podMonitor: +# enabled: true +# # -- Allows to install the PodMonitor in another namespace then the spire components are installed into. +# namespace: "kube-prometheus-system" +# labels: {} nameOverride: "" fullnameOverride: ""