Add podmonitors (#165)

Co-authored-by: Marco Franssen <[email protected]>
Signed-off-by: Marco Franssen <[email protected]>

.github/tests/prometheus/pre-install.sh

@@ -0,0 +1,3 @@
+#!/usr/bin/env bash
+
+helm install kube-prometheus-stack kube-prometheus-stack --version 45.7.1 --repo https://prometheus-community.github.io/helm-charts -n "$scenario" --wait

.github/tests/prometheus/values.yaml

@@ -2,3 +2,12 @@ global:
   telemetry:
     prometheus:
       enabled: true
+      podMonitor:
+        enabled: true
+        labels:
+          release: kube-prometheus-stack
+
+spiffe-oidc-discovery-provider:
+  enabled: true
+  insecureScheme:
+    enabled: true

charts/spire/charts/spiffe-oidc-discovery-provider/README.md

@@ -68,6 +68,9 @@ A Helm chart to install the SPIFFE OIDC discovery provider.
 | telemetry.prometheus.nginxExporter.image.repository | string | `"nginx/nginx-prometheus-exporter"` |  |
 | telemetry.prometheus.nginxExporter.image.version | string | `"0.11.0"` |  |
 | telemetry.prometheus.nginxExporter.resources | object | `{}` |  |
+| telemetry.prometheus.podMonitor.enabled | bool | `false` |  |
+| telemetry.prometheus.podMonitor.labels | object | `{}` |  |
+| telemetry.prometheus.podMonitor.namespace | string | `""` | Override where to install the podMonitor, if not set will use the same namespace as the spiffe-oidc-discovery-provider |
 | telemetry.prometheus.port | int | `9988` |  |
 | tolerations | list | `[]` |  |
 | trustDomain | string | `"example.org"` |  |

charts/spire/charts/spiffe-oidc-discovery-provider/templates/_helpers.tpl

@@ -34,6 +34,16 @@ Allow the release namespace to be overridden for multi-namespace deployments in
   {{- end -}}
 {{- end -}}
 
+{{- define "spiffe-oidc-discovery-provider.podMonitor.namespace" -}}
+  {{- if ne (len .Values.telemetry.prometheus.podMonitor.namespace) 0 }}
+    {{- .Values.telemetry.prometheus.podMonitor.namespace }}
+  {{- else if ne (len (dig "telemetry" "prometheus" "podMonitor" "namespace" "" .Values.global)) 0 }}
+    {{- .Values.global.telemetry.prometheus.podMonitor.namespace }}
+  {{- else }}
+    {{- include "spiffe-oidc-discovery-provider.namespace" . }}
+  {{- end }}
+{{- end -}}
+
 {{/*
 Create chart name and version as used by the chart label.
 */}}

charts/spire/charts/spiffe-oidc-discovery-provider/templates/podmonitor.yaml

@@ -0,0 +1,29 @@
+{{- if .Values.insecureScheme.enabled }}
+{{- if (dig "telemetry" "prometheus" "podMonitor" "enabled" .Values.telemetry.prometheus.podMonitor.enabled .Values.global) }}
+{{- $namespace := include "spiffe-oidc-discovery-provider.podMonitor.namespace" . }}
+{{- $podNamespace := ( include "spiffe-oidc-discovery-provider.namespace" . ) }}
+apiVersion: monitoring.coreos.com/v1
+kind: PodMonitor
+metadata:
+  name: {{ include "spire-agent.fullname" . }}
+  namespace: {{ $namespace }}
+  labels:
+    {{- include "spire-agent.labels" . | nindent 4 }}
+    {{- if ne (len (dig "telemetry" "prometheus" "podMonitor" "labels" (dict) .Values.global)) 0 }}
+    {{- .Values.global.telemetry.prometheus.podMonitor.labels | toYaml | nindent 4 }}
+    {{- end }}
+    {{- with .Values.telemetry.prometheus.podMonitor.labels }}
+    {{- toYaml . | nindent 4 }}
+    {{- end }}
+spec:
+  selector:
+    matchLabels:
+      {{- include "spire-agent.selectorLabels" . | nindent 6 }}
+  podMetricsEndpoints:
+    - port: prom
+  {{- if ne $namespace $podNamespace }}
+  namespaceSelector:
+    kubernetes.io/metadata.name: {{ $podNamespace }}
+  {{- end }}  
+{{- end }}
+{{- end }}

charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml

@@ -120,6 +120,11 @@ telemetry:
   prometheus:
     enabled: false
     port: 9988
+    podMonitor:
+      enabled: false
+      # -- Override where to install the podMonitor, if not set will use the same namespace as the spiffe-oidc-discovery-provider
+      namespace: ""
+      labels: {}
 
     nginxExporter:
       image:

charts/spire/charts/spire-agent/README.md

@@ -44,6 +44,9 @@ A Helm chart to install the SPIRE agent.
 | serviceAccount.name | string | `""` |  |
 | socketPath | string | `"/run/spire/agent-sockets/spire-agent.sock"` |  |
 | telemetry.prometheus.enabled | bool | `false` |  |
+| telemetry.prometheus.podMonitor.enabled | bool | `false` |  |
+| telemetry.prometheus.podMonitor.labels | object | `{}` |  |
+| telemetry.prometheus.podMonitor.namespace | string | `""` | Override where to install the podMonitor, if not set will use the same namespace as the spire-agent |
 | telemetry.prometheus.port | int | `9988` |  |
 | trustDomain | string | `"example.org"` |  |
 | waitForIt.image.pullPolicy | string | `"IfNotPresent"` |  |

charts/spire/charts/spire-agent/templates/_helpers.tpl

@@ -42,6 +42,16 @@ Allow the release namespace to be overridden for multi-namespace deployments in
   {{- end -}}
 {{- end -}}
 
+{{- define "spire-agent.podMonitor.namespace" -}}
+  {{- if ne (len .Values.telemetry.prometheus.podMonitor.namespace) 0 }}
+    {{- .Values.telemetry.prometheus.podMonitor.namespace }}
+  {{- else if ne (len (dig "telemetry" "prometheus" "podMonitor" "namespace" "" .Values.global)) 0 }}
+    {{- .Values.global.telemetry.prometheus.podMonitor.namespace }}
+  {{- else }}
+    {{- include "spire-agent.namespace" . }}
+  {{- end }}
+{{- end -}}
+
 {{/*
 Create chart name and version as used by the chart label.
 */}}

charts/spire/charts/spire-agent/templates/podmonitor.yaml

@@ -0,0 +1,27 @@
+{{- if (dig "telemetry" "prometheus" "podMonitor" "enabled" .Values.telemetry.prometheus.podMonitor.enabled .Values.global) }}
+{{- $namespace := include "spiffe-oidc-discovery-provider.podMonitor.namespace" . }}
+{{- $podNamespace := ( include "spiffe-oidc-discovery-provider.namespace" . ) }}
+apiVersion: monitoring.coreos.com/v1
+kind: PodMonitor
+metadata:
+  name: {{ include "spiffe-oidc-discovery-provider.fullname" . }}
+  namespace: {{ $namespace }}
+  labels:
+    {{- include "spiffe-oidc-discovery-provider.labels" . | nindent 4 }}
+    {{- if ne (len (dig "telemetry" "prometheus" "podMonitor" "labels" (dict) .Values.global)) 0 }}
+    {{- .Values.global.telemetry.prometheus.podMonitor.labels | toYaml | nindent 4 }}
+    {{- end }}
+    {{- with .Values.telemetry.prometheus.podMonitor.labels }}
+    {{- toYaml . | nindent 4 }}
+    {{- end }}
+spec:
+  selector:
+    matchLabels:
+      {{- include "spiffe-oidc-discovery-provider.selectorLabels" . | nindent 6 }}
+  podMetricsEndpoints:
+    - port: prom
+  {{- if ne $namespace $podNamespace }}
+  namespaceSelector:
+    kubernetes.io/metadata.name: {{ $podNamespace }}
+  {{- end }}  
+{{- end }}

charts/spire/charts/spire-agent/values.yaml

@@ -86,6 +86,11 @@ telemetry:
   prometheus:
     enabled: false
     port: 9988
+    podMonitor:
+      enabled: false
+      # -- Override where to install the podMonitor, if not set will use the same namespace as the spire-agent
+      namespace: ""
+      labels: {}
 
 socketPath: /run/spire/agent-sockets/spire-agent.sock
 

charts/spire/charts/spire-server/README.md

@@ -92,6 +92,9 @@ A Helm chart to install the SPIRE server.
 | serviceAccount.create | bool | `true` |  |
 | serviceAccount.name | string | `""` |  |
 | telemetry.prometheus.enabled | bool | `false` |  |
+| telemetry.prometheus.podMonitor.enabled | bool | `false` |  |
+| telemetry.prometheus.podMonitor.labels | object | `{}` |  |
+| telemetry.prometheus.podMonitor.namespace | string | `""` | Override where to install the podMonitor, if not set will use the same namespace as the spire-server |
 | tolerations | list | `[]` |  |
 | topologySpreadConstraints | list | `[]` |  |
 | trustDomain | string | `"example.org"` |  |

charts/spire/charts/spire-server/templates/_helpers.tpl

@@ -34,6 +34,16 @@ Allow the release namespace to be overridden for multi-namespace deployments in
   {{- end -}}
 {{- end -}}
 
+{{- define "spire-server.podMonitor.namespace" -}}
+  {{- if ne (len .Values.telemetry.prometheus.podMonitor.namespace) 0 }}
+    {{- .Values.telemetry.prometheus.podMonitor.namespace }}
+  {{- else if ne (len (dig "telemetry" "prometheus" "podMonitor" "namespace" "" .Values.global)) 0 }}
+    {{- .Values.global.telemetry.prometheus.podMonitor.namespace }}
+  {{- else }}
+    {{- include "spire-server.namespace" . }}
+  {{- end }}
+{{- end -}}
+
 {{/*
 Create chart name and version as used by the chart label.
 */}}

charts/spire/charts/spire-server/templates/podmonitor.yaml

@@ -0,0 +1,27 @@
+{{- if (dig "telemetry" "prometheus" "podMonitor" "enabled" .Values.telemetry.prometheus.podMonitor.enabled .Values.global) }}
+{{- $namespace := include "spire-server.podMonitor.namespace" . }}
+{{- $podNamespace := ( include "spire-server.namespace" . ) }}
+apiVersion: monitoring.coreos.com/v1
+kind: PodMonitor
+metadata:
+  name: {{ include "spire-server.fullname" . }}
+  namespace: {{ $namespace }}
+  labels:
+    {{- include "spire-server.labels" . | nindent 4 }}
+    {{- if ne (len (dig "telemetry" "prometheus" "podMonitor" "labels" (dict) .Values.global)) 0 }}
+    {{- .Values.global.telemetry.prometheus.podMonitor.labels | toYaml | nindent 4 }}
+    {{- end }}
+    {{- with .Values.telemetry.prometheus.podMonitor.labels }}
+    {{- toYaml . | nindent 4 }}
+    {{- end }}
+spec:
+  selector:
+    matchLabels:
+      {{- include "spire-server.selectorLabels" . | nindent 6 }}
+  podMetricsEndpoints:
+    - port: prom
+  {{- if ne $namespace $podNamespace }}
+  namespaceSelector:
+    kubernetes.io/metadata.name: {{ $podNamespace }}
+  {{- end }}  
+{{- end }}

charts/spire/charts/spire-server/values.yaml

@@ -195,6 +195,11 @@ controllerManager:
 telemetry:
   prometheus:
     enabled: false
+    podMonitor:
+      enabled: false
+      # -- Override where to install the podMonitor, if not set will use the same namespace as the spire-server
+      namespace: ""
+      labels: {}
 
 extraVolumes: []
 extraVolumeMounts: []

charts/spire/values.yaml

@@ -14,6 +14,11 @@ global:
 #  telemetry:
 #    prometheus:
 #      enabled: true
+#      podMonitor:
+#        enabled: true
+#        # -- Allows to install the PodMonitor in another namespace then the spire components are installed into.
+#        namespace: "kube-prometheus-system"
+#        labels: {}
 
 nameOverride: ""
 fullnameOverride: ""