diff --git a/charts/csm-authorization-v2.0/templates/_helpers.tpl b/charts/csm-authorization-v2.0/templates/_helpers.tpl index 918bda1e..ab538b23 100644 --- a/charts/csm-authorization-v2.0/templates/_helpers.tpl +++ b/charts/csm-authorization-v2.0/templates/_helpers.tpl @@ -7,3 +7,18 @@ By default this is not set so the helm release namespace will be used {{- define "custom.namespace" -}} {{ .Values.namespace | default .Release.Namespace }} {{- end -}} + +{{/* +Return true if proxy-server metrics is enabled +*/}} +{{- define "csm-authorization.isMetricsEnabled" -}} +{{- if hasKey .Values.authorization "metrics" -}} + {{- if (eq .Values.authorization.metrics.enabled true) -}} + {{- true -}} + {{- else -}} + {{- false -}} + {{- end -}} +{{- else -}} + {{- false -}} +{{- end -}} +{{- end -}} diff --git a/charts/csm-authorization-v2.0/templates/metrics-service.yaml b/charts/csm-authorization-v2.0/templates/metrics-service.yaml new file mode 100644 index 00000000..0609d34f --- /dev/null +++ b/charts/csm-authorization-v2.0/templates/metrics-service.yaml @@ -0,0 +1,21 @@ +{{- if eq (include "csm-authorization.isMetricsEnabled" .) "true" }} +--- +# Service exposing the proxy-server Prometheus metrics endpoint for scraping. +# Created when authorization.metrics.enabled is true. +apiVersion: v1 +kind: Service +metadata: + name: proxy-server-metrics + namespace: {{ include "custom.namespace" . }} + labels: + app: proxy-server +spec: + selector: + app: proxy-server + ports: + - name: metrics + port: {{ .Values.authorization.metrics.port | default 2112 }} + targetPort: {{ .Values.authorization.metrics.port | default 2112 }} + protocol: TCP + type: ClusterIP +{{- end }} diff --git a/charts/csm-authorization-v2.0/templates/proxy-server.yaml b/charts/csm-authorization-v2.0/templates/proxy-server.yaml index a16755dc..bb1ccbc2 100644 --- a/charts/csm-authorization-v2.0/templates/proxy-server.yaml +++ b/charts/csm-authorization-v2.0/templates/proxy-server.yaml @@ -157,6 +157,18 @@ spec: secretKeyRef: name: {{ $redisSecretName | default "redis-csm-secret" }} key: {{ $redisSecretProviderClass.redisPasswordKey | default "password" }} + {{- if eq (include "csm-authorization.isMetricsEnabled" .) "true" }} + - name: X_CSI_METRICS_ENABLED + value: "true" + - name: X_CSI_METRICS_PORT + value: ":{{ .Values.authorization.metrics.port | default 2112 }}" + {{- if .Values.authorization.metrics.tlsCertSecret }} + - name: X_CSI_METRICS_TLS_CERT_FILE + value: "/etc/metrics-tls/tls.crt" + - name: X_CSI_METRICS_TLS_KEY_FILE + value: "/etc/metrics-tls/tls.key" + {{- end }} + {{- end }} args: - "--redis-sentinel={{ $str }}" - "--redis-password=$(REDIS_PASSWORD)" @@ -165,6 +177,11 @@ spec: - "--storage-service=storage-service.{{ .Release.Namespace }}.svc.cluster.local:50051" ports: - containerPort: 8080 + {{- if eq (include "csm-authorization.isMetricsEnabled" .) "true" }} + - name: metrics + containerPort: {{ .Values.authorization.metrics.port | default 2112 }} + protocol: TCP + {{- end }} volumeMounts: - name: config-volume mountPath: /etc/karavi-authorization/config @@ -176,6 +193,11 @@ spec: mountPath: /etc/csm-authorization/{{ $name }} readOnly: true {{- end }} + {{- if and (eq (include "csm-authorization.isMetricsEnabled" .) "true") .Values.authorization.metrics.tlsCertSecret }} + - name: metrics-tls + mountPath: /etc/metrics-tls + readOnly: true + {{- end }} - name: opa image: {{ required "Must provide the openpolicyagent image." .Values.authorization.images.opa.image }} imagePullPolicy: IfNotPresent @@ -209,6 +231,11 @@ spec: volumeAttributes: secretProviderClass: "{{ $name }}" {{- end }} + {{- if and (eq (include "csm-authorization.isMetricsEnabled" .) "true") .Values.authorization.metrics.tlsCertSecret }} + - name: metrics-tls + secret: + secretName: {{ .Values.authorization.metrics.tlsCertSecret }} + {{- end }} --- apiVersion: v1 kind: Service diff --git a/charts/csm-authorization-v2.0/templates/servicemonitor.yaml b/charts/csm-authorization-v2.0/templates/servicemonitor.yaml new file mode 100644 index 00000000..a5b699d3 --- /dev/null +++ b/charts/csm-authorization-v2.0/templates/servicemonitor.yaml @@ -0,0 +1,33 @@ +{{- if eq (include "csm-authorization.isMetricsEnabled" .) "true" }} +{{- if hasKey .Values.authorization.metrics "serviceMonitor" }} +{{- if eq .Values.authorization.metrics.serviceMonitor.enabled true }} +--- +# ServiceMonitor for Prometheus Operator integration with the proxy-server Deployment. +# Created when authorization.metrics.enabled AND authorization.metrics.serviceMonitor.enabled are true. +# Requires the Prometheus Operator CRDs to be installed in the cluster. +apiVersion: monitoring.coreos.com/v1 +kind: ServiceMonitor +metadata: + name: proxy-server-metrics-monitor + namespace: {{ include "custom.namespace" . }} + labels: + app: proxy-server +spec: + selector: + matchLabels: + app: proxy-server + endpoints: + - port: metrics + interval: {{ .Values.authorization.metrics.serviceMonitor.interval | default "30s" }} + {{- if .Values.authorization.metrics.serviceMonitor.scrapeTimeout }} + scrapeTimeout: {{ .Values.authorization.metrics.serviceMonitor.scrapeTimeout }} + {{- end }} + path: /metrics + {{- if .Values.authorization.metrics.tlsCertSecret }} + scheme: https + tlsConfig: + insecureSkipVerify: {{ .Values.authorization.metrics.serviceMonitor.insecureSkipVerify | default false }} + {{- end }} +{{- end }} +{{- end }} +{{- end }} diff --git a/charts/csm-authorization-v2.0/values.yaml b/charts/csm-authorization-v2.0/values.yaml index c0faad0f..375ee81a 100644 --- a/charts/csm-authorization-v2.0/values.yaml +++ b/charts/csm-authorization-v2.0/values.yaml @@ -77,6 +77,46 @@ authorization: # storage capacity poll interval storageCapacityPollInterval: 30m + # metrics: configuration for proxy-server Prometheus metrics + metrics: + # enabled: Enable/Disable the Prometheus metrics HTTP server on the proxy-server. + # When true, the proxy-server receives X_CSI_METRICS_ENABLED=true, + # X_CSI_METRICS_PORT, and a metrics Service is created. + # Default value: false + enabled: false + + # port: Port on which the proxy-server metrics endpoint is exposed. + # Passed as X_CSI_METRICS_PORT (formatted as ":port") to the proxy-server container + # and used as targetPort in the metrics Service. + # Default value: 2112 + port: 2112 + + # tlsCertSecret: Name of a Kubernetes TLS Secret (tls.crt / tls.key) used to + # serve the metrics endpoint over HTTPS instead of plain HTTP. + # When set, X_CSI_METRICS_TLS_CERT_FILE and X_CSI_METRICS_TLS_KEY_FILE are + # injected into the proxy-server container. + # Leave empty (default) to use plain HTTP. + # Default value: "" (disabled - plain HTTP) + tlsCertSecret: "" + + # serviceMonitor: Controls optional Prometheus Operator ServiceMonitor creation. + serviceMonitor: + # enabled: When true, a ServiceMonitor CR is created for automatic Prometheus + # Operator integration targeting the proxy-server pods. + # Requires the Prometheus Operator CRDs to be installed in the cluster. + # Default value: false + enabled: false + # interval: Prometheus scrape interval for the metrics endpoint. + # Default value: "30s" + interval: "30s" + # scrapeTimeout: Prometheus scrape timeout for the metrics endpoint. + # Default value: "" (unset) + scrapeTimeout: "" + # insecureSkipVerify: Controls TLS certificate verification when scraping. + # Only used when metrics.tlsCertSecret is set (HTTPS endpoint). + # Default value: false + insecureSkipVerify: false + redis: name: redis-csm # Redis credentials are required and can be provided in one of two ways: