diff --git a/bundle/manifests/aws-load-balancer-operator-cabundle_v1_configmap.yaml b/bundle/manifests/aws-load-balancer-operator-cabundle_v1_configmap.yaml new file mode 100644 index 000000000..25670b3aa --- /dev/null +++ b/bundle/manifests/aws-load-balancer-operator-cabundle_v1_configmap.yaml @@ -0,0 +1,6 @@ +apiVersion: v1 +kind: ConfigMap +metadata: + annotations: + service.beta.openshift.io/inject-cabundle: "true" + name: aws-load-balancer-operator-cabundle diff --git a/bundle/manifests/aws-load-balancer-operator-controller-manager-metrics-monitor_monitoring.coreos.com_v1_servicemonitor.yaml b/bundle/manifests/aws-load-balancer-operator-controller-manager-metrics-monitor_monitoring.coreos.com_v1_servicemonitor.yaml new file mode 100644 index 000000000..4b58d4a5b --- /dev/null +++ b/bundle/manifests/aws-load-balancer-operator-controller-manager-metrics-monitor_monitoring.coreos.com_v1_servicemonitor.yaml @@ -0,0 +1,24 @@ +apiVersion: monitoring.coreos.com/v1 +kind: ServiceMonitor +metadata: + labels: + control-plane: controller-manager + name: aws-load-balancer-operator-controller-manager-metrics-monitor +spec: + endpoints: + - authorization: + credentials: + key: token + name: aws-load-balancer-operator-metrics-scraper-token + path: /metrics + port: https + scheme: https + tlsConfig: + ca: + configMap: + key: service-ca.crt + name: aws-load-balancer-operator-cabundle + serverName: aws-load-balancer-operator-controller-manager-metrics-service.aws-load-balancer-operator.svc + selector: + matchLabels: + control-plane: controller-manager diff --git a/bundle/manifests/aws-load-balancer-operator-controller-manager-metrics-service_v1_service.yaml b/bundle/manifests/aws-load-balancer-operator-controller-manager-metrics-service_v1_service.yaml index 94059ee43..4b8706f23 100644 --- a/bundle/manifests/aws-load-balancer-operator-controller-manager-metrics-service_v1_service.yaml +++ b/bundle/manifests/aws-load-balancer-operator-controller-manager-metrics-service_v1_service.yaml @@ -1,6 +1,8 @@ apiVersion: v1 kind: Service metadata: + annotations: + service.beta.openshift.io/serving-cert-secret-name: aws-load-balancer-operator-metrics-tls creationTimestamp: null labels: control-plane: controller-manager diff --git a/bundle/manifests/aws-load-balancer-operator-metrics-scraper-token_v1_secret.yaml b/bundle/manifests/aws-load-balancer-operator-metrics-scraper-token_v1_secret.yaml new file mode 100644 index 000000000..256e947bb --- /dev/null +++ b/bundle/manifests/aws-load-balancer-operator-metrics-scraper-token_v1_secret.yaml @@ -0,0 +1,7 @@ +apiVersion: v1 +kind: Secret +metadata: + annotations: + kubernetes.io/service-account.name: aws-load-balancer-operator-metrics-scraper + name: aws-load-balancer-operator-metrics-scraper-token +type: kubernetes.io/service-account-token diff --git a/bundle/manifests/aws-load-balancer-operator-metrics-scraper_rbac.authorization.k8s.io_v1_clusterrolebinding.yaml b/bundle/manifests/aws-load-balancer-operator-metrics-scraper_rbac.authorization.k8s.io_v1_clusterrolebinding.yaml new file mode 100644 index 000000000..2c70283c5 --- /dev/null +++ b/bundle/manifests/aws-load-balancer-operator-metrics-scraper_rbac.authorization.k8s.io_v1_clusterrolebinding.yaml @@ -0,0 +1,13 @@ +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + creationTimestamp: null + name: aws-load-balancer-operator-metrics-scraper +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: aws-load-balancer-operator-metrics-reader +subjects: +- kind: ServiceAccount + name: aws-load-balancer-operator-metrics-scraper + namespace: aws-load-balancer-operator diff --git a/bundle/manifests/aws-load-balancer-operator-metrics-scraper_v1_serviceaccount.yaml b/bundle/manifests/aws-load-balancer-operator-metrics-scraper_v1_serviceaccount.yaml new file mode 100644 index 000000000..87e8e7699 --- /dev/null +++ b/bundle/manifests/aws-load-balancer-operator-metrics-scraper_v1_serviceaccount.yaml @@ -0,0 +1,5 @@ +apiVersion: v1 +kind: ServiceAccount +metadata: + creationTimestamp: null + name: aws-load-balancer-operator-metrics-scraper diff --git a/bundle/manifests/aws-load-balancer-operator.clusterserviceversion.yaml b/bundle/manifests/aws-load-balancer-operator.clusterserviceversion.yaml index c80ac7225..14b32a268 100644 --- a/bundle/manifests/aws-load-balancer-operator.clusterserviceversion.yaml +++ b/bundle/manifests/aws-load-balancer-operator.clusterserviceversion.yaml @@ -258,6 +258,7 @@ spec: - --image=$(RELATED_IMAGE_CONTROLLER) - --namespace=$(TARGET_NAMESPACE) - --trusted-ca-configmap=$(TRUSTED_CA_CONFIGMAP_NAME) + - --metrics-tls-cert-dir=/var/run/secrets/serving-cert - --webhook-disable-http2 command: - /manager @@ -318,6 +319,9 @@ spec: - mountPath: /etc/pki/tls/certs/albo-tls-ca-bundle.crt name: trusted-cabundle subPath: ca-bundle.crt + - mountPath: /var/run/secrets/serving-cert + name: metrics-cert + readOnly: true securityContext: runAsNonRoot: true seccompProfile: @@ -337,6 +341,10 @@ spec: defaultMode: 420 name: aws-load-balancer-operator-trusted-cabundle name: trusted-cabundle + - name: metrics-cert + secret: + defaultMode: 420 + secretName: aws-load-balancer-operator-metrics-tls permissions: - rules: - apiGroups: diff --git a/config/default/kustomization.yaml b/config/default/kustomization.yaml index 494040527..29bdc26e6 100644 --- a/config/default/kustomization.yaml +++ b/config/default/kustomization.yaml @@ -22,7 +22,7 @@ bases: # [CERTMANAGER] To enable cert-manager, uncomment all sections with 'CERTMANAGER'. 'WEBHOOK' components are required. #- ../certmanager # [PROMETHEUS] To enable prometheus monitor, uncomment all sections with 'PROMETHEUS'. -#- ../prometheus +- ../prometheus patchesStrategicMerge: # Mount the controller config file for loading manager configurations diff --git a/config/manager/kustomization.yaml b/config/manager/kustomization.yaml index 00d43b51e..0c8b271d0 100644 --- a/config/manager/kustomization.yaml +++ b/config/manager/kustomization.yaml @@ -12,6 +12,10 @@ configMapGenerator: options: labels: config.openshift.io/inject-trusted-cabundle: "true" +- name: cabundle + options: + annotations: + service.beta.openshift.io/inject-cabundle: "true" apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization images: diff --git a/config/manager/manager.yaml b/config/manager/manager.yaml index c32fd3d66..74e2004fa 100644 --- a/config/manager/manager.yaml +++ b/config/manager/manager.yaml @@ -37,6 +37,7 @@ spec: - "--image=$(RELATED_IMAGE_CONTROLLER)" - "--namespace=$(TARGET_NAMESPACE)" - "--trusted-ca-configmap=$(TRUSTED_CA_CONFIGMAP_NAME)" + - "--metrics-tls-cert-dir=/var/run/secrets/serving-cert" - "--webhook-disable-http2" image: controller:latest name: manager @@ -97,6 +98,9 @@ spec: - mountPath: /etc/pki/tls/certs/albo-tls-ca-bundle.crt name: trusted-cabundle subPath: ca-bundle.crt + - mountPath: /var/run/secrets/serving-cert + name: metrics-cert + readOnly: true serviceAccountName: controller-manager terminationGracePeriodSeconds: 10 volumes: @@ -112,3 +116,7 @@ spec: configMap: defaultMode: 420 name: aws-load-balancer-operator-trusted-cabundle + - name: metrics-cert + secret: + defaultMode: 420 + secretName: aws-load-balancer-operator-metrics-tls diff --git a/config/prometheus/monitor.yaml b/config/prometheus/monitor.yaml index d19136ae7..cb08867e0 100644 --- a/config/prometheus/monitor.yaml +++ b/config/prometheus/monitor.yaml @@ -12,9 +12,16 @@ spec: - path: /metrics port: https scheme: https - bearerTokenFile: /var/run/secrets/kubernetes.io/serviceaccount/token + authorization: + credentials: + key: token + name: aws-load-balancer-operator-metrics-scraper-token tlsConfig: - insecureSkipVerify: true + ca: + configMap: + key: service-ca.crt + name: aws-load-balancer-operator-cabundle + serverName: aws-load-balancer-operator-controller-manager-metrics-service.aws-load-balancer-operator.svc selector: matchLabels: control-plane: controller-manager diff --git a/config/rbac/auth_proxy_service.yaml b/config/rbac/auth_proxy_service.yaml index 71f179727..02ac960c8 100644 --- a/config/rbac/auth_proxy_service.yaml +++ b/config/rbac/auth_proxy_service.yaml @@ -3,6 +3,8 @@ kind: Service metadata: labels: control-plane: controller-manager + annotations: + service.beta.openshift.io/serving-cert-secret-name: aws-load-balancer-operator-metrics-tls name: controller-manager-metrics-service namespace: system spec: diff --git a/config/rbac/kustomization.yaml b/config/rbac/kustomization.yaml index 098e99635..a3f744741 100644 --- a/config/rbac/kustomization.yaml +++ b/config/rbac/kustomization.yaml @@ -17,3 +17,6 @@ resources: - auth_proxy_role.yaml - auth_proxy_role_binding.yaml - auth_proxy_client_clusterrole.yaml +- metrics_scraper_service_account.yaml +- metrics_scraper_secret.yaml +- metrics_scraper_clusterrolebinding.yaml diff --git a/config/rbac/metrics_scraper_clusterrolebinding.yaml b/config/rbac/metrics_scraper_clusterrolebinding.yaml new file mode 100644 index 000000000..1c5f2132f --- /dev/null +++ b/config/rbac/metrics_scraper_clusterrolebinding.yaml @@ -0,0 +1,12 @@ +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: metrics-scraper +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: metrics-reader +subjects: +- kind: ServiceAccount + name: metrics-scraper + namespace: system diff --git a/config/rbac/metrics_scraper_secret.yaml b/config/rbac/metrics_scraper_secret.yaml new file mode 100644 index 000000000..f600f6816 --- /dev/null +++ b/config/rbac/metrics_scraper_secret.yaml @@ -0,0 +1,8 @@ +apiVersion: v1 +kind: Secret +metadata: + name: metrics-scraper-token + namespace: system + annotations: + kubernetes.io/service-account.name: aws-load-balancer-operator-metrics-scraper +type: kubernetes.io/service-account-token diff --git a/config/rbac/metrics_scraper_service_account.yaml b/config/rbac/metrics_scraper_service_account.yaml new file mode 100644 index 000000000..a034eda92 --- /dev/null +++ b/config/rbac/metrics_scraper_service_account.yaml @@ -0,0 +1,5 @@ +apiVersion: v1 +kind: ServiceAccount +metadata: + name: metrics-scraper + namespace: system diff --git a/main.go b/main.go index d38c55156..3f9a5fdce 100644 --- a/main.go +++ b/main.go @@ -90,6 +90,7 @@ func init() { func main() { var ( metricsAddr string + metricsTLSCertDir string enableLeaderElection bool probeAddr string namespace string @@ -98,6 +99,7 @@ func main() { webhookDisableHTTP2 bool ) flag.StringVar(&metricsAddr, "metrics-bind-address", ":8443", "The address the metric endpoint binds to.") + flag.StringVar(&metricsTLSCertDir, "metrics-tls-cert-dir", "", "The directory containing TLS certificates for the metrics endpoint.") flag.StringVar(&probeAddr, "health-probe-bind-address", ":8081", "The address the probe endpoint binds to.") flag.BoolVar(&enableLeaderElection, "leader-elect", false, "Enable leader election for controller manager. "+ @@ -138,6 +140,7 @@ func main() { Metrics: metrics.Options{ BindAddress: metricsAddr, SecureServing: true, + CertDir: metricsTLSCertDir, FilterProvider: filters.WithAuthenticationAndAuthorization, TLSOpts: []func(*tls.Config){ func(config *tls.Config) {