[charts/csm-authorization] Add metrics support for proxy-server

charts/csm-authorization-v2.0/templates/_helpers.tpl

@@ -7,3 +7,18 @@ By default this is not set so the helm release namespace will be used
 {{- define "custom.namespace" -}}
 	{{ .Values.namespace | default .Release.Namespace }}
 {{- end -}}
+
+{{/*
+Return true if proxy-server metrics is enabled
+*/}}
+{{- define "csm-authorization.isMetricsEnabled" -}}
+{{- if hasKey .Values.authorization "metrics" -}}
+  {{- if (eq .Values.authorization.metrics.enabled true) -}}
+      {{- true -}}
+  {{- else -}}
+      {{- false -}}
+  {{- end -}}
+{{- else -}}
+  {{- false -}}
+{{- end -}}
+{{- end -}}

charts/csm-authorization-v2.0/templates/metrics-service.yaml

@@ -0,0 +1,21 @@
+{{- if eq (include "csm-authorization.isMetricsEnabled" .) "true" }}
+---
+# Service exposing the proxy-server Prometheus metrics endpoint for scraping.
+# Created when authorization.metrics.enabled is true.
+apiVersion: v1
+kind: Service
+metadata:
+  name: proxy-server-metrics
+  namespace: {{ include "custom.namespace" . }}
+  labels:
+    app: proxy-server
+spec:
+  selector:
+    app: proxy-server
+  ports:
+    - name: metrics
+      port: {{ .Values.authorization.metrics.port | default 2112 }}
+      targetPort: {{ .Values.authorization.metrics.port | default 2112 }}
+      protocol: TCP
+  type: ClusterIP
+{{- end }}

charts/csm-authorization-v2.0/templates/proxy-server.yaml

@@ -157,6 +157,18 @@ spec:
               secretKeyRef:
                 name: {{ $redisSecretName | default "redis-csm-secret" }}
                 key: {{ $redisSecretProviderClass.redisPasswordKey | default "password" }}
+          {{- if eq (include "csm-authorization.isMetricsEnabled" .) "true" }}
+          - name: X_CSI_METRICS_ENABLED
+            value: "true"
+          - name: X_CSI_METRICS_PORT
+            value: ":{{ .Values.authorization.metrics.port | default 2112 }}"
+          {{- if .Values.authorization.metrics.tlsCertSecret }}
+          - name: X_CSI_METRICS_TLS_CERT_FILE
+            value: "/etc/metrics-tls/tls.crt"
+          - name: X_CSI_METRICS_TLS_KEY_FILE
+            value: "/etc/metrics-tls/tls.key"
+          {{- end }}
+          {{- end }}
         args:
           - "--redis-sentinel={{ $str }}"
           - "--redis-password=$(REDIS_PASSWORD)"
@@ -165,6 +177,11 @@ spec:
           - "--storage-service=storage-service.{{ .Release.Namespace }}.svc.cluster.local:50051"
         ports:
         - containerPort: 8080
+        {{- if eq (include "csm-authorization.isMetricsEnabled" .) "true" }}
+        - name: metrics
+          containerPort: {{ .Values.authorization.metrics.port | default 2112 }}
+          protocol: TCP
+        {{- end }}
         volumeMounts:
         - name: config-volume
           mountPath: /etc/karavi-authorization/config
@@ -176,6 +193,11 @@ spec:
           mountPath: /etc/csm-authorization/{{ $name }}
           readOnly: true
         {{- end }}
+        {{- if and (eq (include "csm-authorization.isMetricsEnabled" .) "true") .Values.authorization.metrics.tlsCertSecret }}
+        - name: metrics-tls
+          mountPath: /etc/metrics-tls
+          readOnly: true
+        {{- end }}
       - name: opa
         image: {{ required "Must provide the openpolicyagent image." .Values.authorization.images.opa.image }}
         imagePullPolicy: IfNotPresent
@@ -209,6 +231,11 @@ spec:
           volumeAttributes:
             secretProviderClass: "{{ $name }}"
       {{- end }}
+      {{- if and (eq (include "csm-authorization.isMetricsEnabled" .) "true") .Values.authorization.metrics.tlsCertSecret }}
+      - name: metrics-tls
+        secret:
+          secretName: {{ .Values.authorization.metrics.tlsCertSecret }}
+      {{- end }}
 ---
 apiVersion: v1
 kind: Service

charts/csm-authorization-v2.0/templates/servicemonitor.yaml

@@ -0,0 +1,33 @@
+{{- if eq (include "csm-authorization.isMetricsEnabled" .) "true" }}
+{{- if hasKey .Values.authorization.metrics "serviceMonitor" }}
+{{- if eq .Values.authorization.metrics.serviceMonitor.enabled true }}
+---
+# ServiceMonitor for Prometheus Operator integration with the proxy-server Deployment.
+# Created when authorization.metrics.enabled AND authorization.metrics.serviceMonitor.enabled are true.
+# Requires the Prometheus Operator CRDs to be installed in the cluster.
+apiVersion: monitoring.coreos.com/v1
+kind: ServiceMonitor
+metadata:
+  name: proxy-server-metrics-monitor
+  namespace: {{ include "custom.namespace" . }}
+  labels:
+    app: proxy-server
+spec:
+  selector:
+    matchLabels:
+      app: proxy-server
+  endpoints:
+    - port: metrics
+      interval: {{ .Values.authorization.metrics.serviceMonitor.interval | default "30s" }}
+      {{- if .Values.authorization.metrics.serviceMonitor.scrapeTimeout }}
+      scrapeTimeout: {{ .Values.authorization.metrics.serviceMonitor.scrapeTimeout }}
+      {{- end }}
+      path: /metrics
+      {{- if .Values.authorization.metrics.tlsCertSecret }}
+      scheme: https
+      tlsConfig:
+        insecureSkipVerify: {{ .Values.authorization.metrics.serviceMonitor.insecureSkipVerify | default false }}
+      {{- end }}
+{{- end }}
+{{- end }}
+{{- end }}

charts/csm-authorization-v2.0/values.yaml

@@ -77,6 +77,46 @@ authorization:
   # storage capacity poll interval
   storageCapacityPollInterval: 30m
 
+  # metrics: configuration for proxy-server Prometheus metrics
+  metrics:
+    # enabled: Enable/Disable the Prometheus metrics HTTP server on the proxy-server.
+    # When true, the proxy-server receives X_CSI_METRICS_ENABLED=true,
+    # X_CSI_METRICS_PORT, and a metrics Service is created.
+    # Default value: false
+    enabled: false
+
+    # port: Port on which the proxy-server metrics endpoint is exposed.
+    # Passed as X_CSI_METRICS_PORT (formatted as ":port") to the proxy-server container
+    # and used as targetPort in the metrics Service.
+    # Default value: 2112
+    port: 2112
+
+    # tlsCertSecret: Name of a Kubernetes TLS Secret (tls.crt / tls.key) used to
+    # serve the metrics endpoint over HTTPS instead of plain HTTP.
+    # When set, X_CSI_METRICS_TLS_CERT_FILE and X_CSI_METRICS_TLS_KEY_FILE are
+    # injected into the proxy-server container.
+    # Leave empty (default) to use plain HTTP.
+    # Default value: "" (disabled - plain HTTP)
+    tlsCertSecret: ""
+
+    # serviceMonitor: Controls optional Prometheus Operator ServiceMonitor creation.
+    serviceMonitor:
+      # enabled: When true, a ServiceMonitor CR is created for automatic Prometheus
+      # Operator integration targeting the proxy-server pods.
+      # Requires the Prometheus Operator CRDs to be installed in the cluster.
+      # Default value: false
+      enabled: false
+      # interval: Prometheus scrape interval for the metrics endpoint.
+      # Default value: "30s"
+      interval: "30s"
+      # scrapeTimeout: Prometheus scrape timeout for the metrics endpoint.
+      # Default value: "" (unset)
+      scrapeTimeout: ""
+      # insecureSkipVerify: Controls TLS certificate verification when scraping.
+      # Only used when metrics.tlsCertSecret is set (HTTPS endpoint).
+      # Default value: false
+      insecureSkipVerify: false
+
 redis:
   name: redis-csm
   # Redis credentials are required and can be provided in one of two ways: