panxiao81/helm-charts-hardened
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Add podmonitors (#165)

Browse Source 
Co-authored-by: Marco Franssen <[email protected]>
Signed-off-by: Marco Franssen <[email protected]>
This commit is contained in:
kfox1111
2023-04-04 09:55:35 +02:00
committed by GitHub
co-authored by Marco Franssen
parent 456075f843
commit 563e1f7920
15 changed files with 154 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
charts/spire/charts/spiffe-oidc-discovery-provider/README.md
+3
View File
@@ -68,6 +68,9 @@ A Helm chart to install the SPIFFE OIDC discovery provider.
| telemetry.prometheus.nginxExporter.image.repository | string | `"nginx/nginx-prometheus-exporter"` | |
| telemetry.prometheus.nginxExporter.image.version | string | `"0.11.0"` | |
| telemetry.prometheus.nginxExporter.resources | object | `{}` | |
| telemetry.prometheus.podMonitor.enabled | bool | `false` | |
| telemetry.prometheus.podMonitor.labels | object | `{}` | |
| telemetry.prometheus.podMonitor.namespace | string | `""` | Override where to install the podMonitor, if not set will use the same namespace as the spiffe-oidc-discovery-provider |
| telemetry.prometheus.port | int | `9988` | |
| tolerations | list | `[]` | |
| trustDomain | string | `"example.org"` | |
charts/spire/charts/spiffe-oidc-discovery-provider/templates/_helpers.tpl
+10
View File
@@ -34,6 +34,16 @@ Allow the release namespace to be overridden for multi-namespace deployments in
{{- end -}}
{{- end -}}
{{- define "spiffe-oidc-discovery-provider.podMonitor.namespace" -}}
{{- if ne (len .Values.telemetry.prometheus.podMonitor.namespace) 0 }}
{{- .Values.telemetry.prometheus.podMonitor.namespace }}
{{- else if ne (len (dig "telemetry" "prometheus" "podMonitor" "namespace" "" .Values.global)) 0 }}
{{- .Values.global.telemetry.prometheus.podMonitor.namespace }}
{{- else }}
{{- include "spiffe-oidc-discovery-provider.namespace" . }}
{{- end }}
{{- end -}}
{{/*
Create chart name and version as used by the chart label.
*/}}
charts/spire/charts/spiffe-oidc-discovery-provider/templates/podmonitor.yaml
+29
View File
@@ -0,0 +1,29 @@
{{- if .Values.insecureScheme.enabled }}
{{- if (dig "telemetry" "prometheus" "podMonitor" "enabled" .Values.telemetry.prometheus.podMonitor.enabled .Values.global) }}
{{- $namespace := include "spiffe-oidc-discovery-provider.podMonitor.namespace" . }}
{{- $podNamespace := ( include "spiffe-oidc-discovery-provider.namespace" . ) }}
apiVersion: monitoring.coreos.com/v1
kind: PodMonitor
metadata:
name: {{ include "spire-agent.fullname" . }}
namespace: {{ $namespace }}
labels:
{{- include "spire-agent.labels" . | nindent 4 }}
{{- if ne (len (dig "telemetry" "prometheus" "podMonitor" "labels" (dict) .Values.global)) 0 }}
{{- .Values.global.telemetry.prometheus.podMonitor.labels | toYaml | nindent 4 }}
{{- end }}
{{- with .Values.telemetry.prometheus.podMonitor.labels }}
{{- toYaml . | nindent 4 }}
{{- end }}
spec:
selector:
matchLabels:
{{- include "spire-agent.selectorLabels" . | nindent 6 }}
podMetricsEndpoints:
- port: prom
{{- if ne $namespace $podNamespace }}
namespaceSelector:
kubernetes.io/metadata.name: {{ $podNamespace }}
{{- end }}
{{- end }}
{{- end }}
charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml
+5
View File
@@ -120,6 +120,11 @@ telemetry:
prometheus:
enabled: false
port: 9988
podMonitor:
enabled: false
# -- Override where to install the podMonitor, if not set will use the same namespace as the spiffe-oidc-discovery-provider
namespace: ""
labels: {}
nginxExporter:
image:
charts/spire/charts/spire-agent/README.md
+3
View File
@@ -44,6 +44,9 @@ A Helm chart to install the SPIRE agent.
| serviceAccount.name | string | `""` | |
| socketPath | string | `"/run/spire/agent-sockets/spire-agent.sock"` | |
| telemetry.prometheus.enabled | bool | `false` | |
| telemetry.prometheus.podMonitor.enabled | bool | `false` | |
| telemetry.prometheus.podMonitor.labels | object | `{}` | |
| telemetry.prometheus.podMonitor.namespace | string | `""` | Override where to install the podMonitor, if not set will use the same namespace as the spire-agent |
| telemetry.prometheus.port | int | `9988` | |
| trustDomain | string | `"example.org"` | |
| waitForIt.image.pullPolicy | string | `"IfNotPresent"` | |
charts/spire/charts/spire-agent/templates/_helpers.tpl
+10
View File
@@ -42,6 +42,16 @@ Allow the release namespace to be overridden for multi-namespace deployments in
{{- end -}}
{{- end -}}
{{- define "spire-agent.podMonitor.namespace" -}}
{{- if ne (len .Values.telemetry.prometheus.podMonitor.namespace) 0 }}
{{- .Values.telemetry.prometheus.podMonitor.namespace }}
{{- else if ne (len (dig "telemetry" "prometheus" "podMonitor" "namespace" "" .Values.global)) 0 }}
{{- .Values.global.telemetry.prometheus.podMonitor.namespace }}
{{- else }}
{{- include "spire-agent.namespace" . }}
{{- end }}
{{- end -}}
{{/*
Create chart name and version as used by the chart label.
*/}}
charts/spire/charts/spire-agent/templates/podmonitor.yaml
+27
View File
@@ -0,0 +1,27 @@
{{- if (dig "telemetry" "prometheus" "podMonitor" "enabled" .Values.telemetry.prometheus.podMonitor.enabled .Values.global) }}
{{- $namespace := include "spiffe-oidc-discovery-provider.podMonitor.namespace" . }}
{{- $podNamespace := ( include "spiffe-oidc-discovery-provider.namespace" . ) }}
apiVersion: monitoring.coreos.com/v1
kind: PodMonitor
metadata:
name: {{ include "spiffe-oidc-discovery-provider.fullname" . }}
namespace: {{ $namespace }}
labels:
{{- include "spiffe-oidc-discovery-provider.labels" . | nindent 4 }}
{{- if ne (len (dig "telemetry" "prometheus" "podMonitor" "labels" (dict) .Values.global)) 0 }}
{{- .Values.global.telemetry.prometheus.podMonitor.labels | toYaml | nindent 4 }}
{{- end }}
{{- with .Values.telemetry.prometheus.podMonitor.labels }}
{{- toYaml . | nindent 4 }}
{{- end }}
spec:
selector:
matchLabels:
{{- include "spiffe-oidc-discovery-provider.selectorLabels" . | nindent 6 }}
podMetricsEndpoints:
- port: prom
{{- if ne $namespace $podNamespace }}
namespaceSelector:
kubernetes.io/metadata.name: {{ $podNamespace }}
{{- end }}
{{- end }}
charts/spire/charts/spire-agent/values.yaml
+5
View File
@@ -86,6 +86,11 @@ telemetry:
prometheus:
enabled: false
port: 9988
podMonitor:
enabled: false
# -- Override where to install the podMonitor, if not set will use the same namespace as the spire-agent
namespace: ""
labels: {}
socketPath: /run/spire/agent-sockets/spire-agent.sock
charts/spire/charts/spire-server/README.md
+3
View File
@@ -92,6 +92,9 @@ A Helm chart to install the SPIRE server.
| serviceAccount.create | bool | `true` | |
| serviceAccount.name | string | `""` | |
| telemetry.prometheus.enabled | bool | `false` | |
| telemetry.prometheus.podMonitor.enabled | bool | `false` | |
| telemetry.prometheus.podMonitor.labels | object | `{}` | |
| telemetry.prometheus.podMonitor.namespace | string | `""` | Override where to install the podMonitor, if not set will use the same namespace as the spire-server |
| tolerations | list | `[]` | |
| topologySpreadConstraints | list | `[]` | |
| trustDomain | string | `"example.org"` | |
charts/spire/charts/spire-server/templates/_helpers.tpl
+10
View File
@@ -34,6 +34,16 @@ Allow the release namespace to be overridden for multi-namespace deployments in
{{- end -}}
{{- end -}}
{{- define "spire-server.podMonitor.namespace" -}}
{{- if ne (len .Values.telemetry.prometheus.podMonitor.namespace) 0 }}
{{- .Values.telemetry.prometheus.podMonitor.namespace }}
{{- else if ne (len (dig "telemetry" "prometheus" "podMonitor" "namespace" "" .Values.global)) 0 }}
{{- .Values.global.telemetry.prometheus.podMonitor.namespace }}
{{- else }}
{{- include "spire-server.namespace" . }}
{{- end }}
{{- end -}}
{{/*
Create chart name and version as used by the chart label.
*/}}
charts/spire/charts/spire-server/templates/podmonitor.yaml
+27
View File
@@ -0,0 +1,27 @@
{{- if (dig "telemetry" "prometheus" "podMonitor" "enabled" .Values.telemetry.prometheus.podMonitor.enabled .Values.global) }}
{{- $namespace := include "spire-server.podMonitor.namespace" . }}
{{- $podNamespace := ( include "spire-server.namespace" . ) }}
apiVersion: monitoring.coreos.com/v1
kind: PodMonitor
metadata:
name: {{ include "spire-server.fullname" . }}
namespace: {{ $namespace }}
labels:
{{- include "spire-server.labels" . | nindent 4 }}
{{- if ne (len (dig "telemetry" "prometheus" "podMonitor" "labels" (dict) .Values.global)) 0 }}
{{- .Values.global.telemetry.prometheus.podMonitor.labels | toYaml | nindent 4 }}
{{- end }}
{{- with .Values.telemetry.prometheus.podMonitor.labels }}
{{- toYaml . | nindent 4 }}
{{- end }}
spec:
selector:
matchLabels:
{{- include "spire-server.selectorLabels" . | nindent 6 }}
podMetricsEndpoints:
- port: prom
{{- if ne $namespace $podNamespace }}
namespaceSelector:
kubernetes.io/metadata.name: {{ $podNamespace }}
{{- end }}
{{- end }}
charts/spire/charts/spire-server/values.yaml
+5
View File
@@ -195,6 +195,11 @@ controllerManager:
telemetry:
prometheus:
enabled: false
podMonitor:
enabled: false
# -- Override where to install the podMonitor, if not set will use the same namespace as the spire-server
namespace: ""
labels: {}
extraVolumes: []
extraVolumeMounts: []
charts/spire/values.yaml
+5
View File
@@ -14,6 +14,11 @@ global:
# telemetry:
# prometheus:
# enabled: true
# podMonitor:
# enabled: true
# # -- Allows to install the PodMonitor in another namespace then the spire components are installed into.
# namespace: "kube-prometheus-system"
# labels: {}
nameOverride: ""
fullnameOverride: ""