Expose metric endpoint on https #368
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,85 @@ | ||
| --- | ||
| apiVersion: apps/v1beta2 | ||
| kind: Deployment | ||
| metadata: | ||
| name: machine-api-operator | ||
| namespace: openshift-machine-api | ||
| labels: | ||
| k8s-app: machine-api-operator | ||
| spec: | ||
| replicas: 1 | ||
| selector: | ||
| matchLabels: | ||
| k8s-app: machine-api-operator | ||
| template: | ||
| metadata: | ||
| labels: | ||
| k8s-app: machine-api-operator | ||
| spec: | ||
| priorityClassName: system-node-critical | ||
| serviceAccountName: machine-api-operator | ||
| containers: | ||
| - name: kube-rbac-proxy | ||
| image: quay.io/openshift/origin-kube-rbac-proxy:4.2.0 | ||
|
|
||
| args: | ||
| - "--secure-listen-address=0.0.0.0:8443" | ||
|
There was a problem hiding this comment. this will use an at startup generated self-signed cert, is that intended? There was a problem hiding this comment. |
||
| - "--upstream=http://localhost:8080/" | ||
| - "--config-file=/etc/kube-rbac-proxy/config-file.yaml" | ||
| - "--logtostderr=true" | ||
| - "--v=10" | ||
| ports: | ||
| - containerPort: 8443 | ||
| name: https | ||
| volumeMounts: | ||
| - name: config | ||
| mountPath: /etc/kube-rbac-proxy | ||
| - name: machine-api-operator | ||
| image: docker.io/openshift/origin-machine-api-operator:v4.0.0 | ||
|
There was a problem hiding this comment. This image refers to v4.0 whereas the kube-rbac-proxy refers to 4.2.0. Is this intentional? There was a problem hiding this comment. mao image version is same as it is today in https://github.com/openshift/machine-api-operator/blob/master/install/0000_30_machine-api-operator_11_deployment.yaml#L22 kube-rbac-proxy image 4.2.0 is taken just to be latest. Not sure if these two should be same. I see both image streams 4.0.0 and 4.2.0 in the install/image-references, so chose to follow the same pattern and use 4.2.0 |
||
| command: | ||
| - "/machine-api-operator" | ||
| args: | ||
| - "start" | ||
| - "--images-json=/etc/machine-api-operator-config/images/images.json" | ||
| - "--alsologtostderr" | ||
| - "--v=3" | ||
| env: | ||
| - name: RELEASE_VERSION | ||
| value: "0.0.1-snapshot" | ||
| - name: COMPONENT_NAMESPACE | ||
| valueFrom: | ||
| fieldRef: | ||
| fieldPath: metadata.namespace | ||
| - name: METRICS_PORT | ||
| value: "8080" | ||
| resources: | ||
| requests: | ||
| cpu: 10m | ||
| memory: 50Mi | ||
| volumeMounts: | ||
| - name: images | ||
| mountPath: /etc/machine-api-operator-config/images | ||
| nodeSelector: | ||
| node-role.kubernetes.io/master: "" | ||
| restartPolicy: Always | ||
| securityContext: | ||
| runAsNonRoot: true | ||
| runAsUser: 65534 | ||
| tolerations: | ||
| - key: "node-role.kubernetes.io/master" | ||
| operator: "Exists" | ||
| effect: "NoSchedule" | ||
| - key: "node.kubernetes.io/unreachable" | ||
| operator: "Exists" | ||
| effect: "NoExecute" | ||
| tolerationSeconds: 120 | ||
| - key: "node.kubernetes.io/not-ready" | ||
| operator: "Exists" | ||
| effect: "NoExecute" | ||
| tolerationSeconds: 120 | ||
| volumes: | ||
| - name: config | ||
| configMap: | ||
| name: kube-rbac-proxy | ||
| - name: images | ||
| configMap: | ||
| name: machine-api-operator-images | ||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,14 @@ | ||
| apiVersion: v1 | ||
| kind: ConfigMap | ||
| metadata: | ||
| name: kube-rbac-proxy | ||
| namespace: openshift-machine-api | ||
| data: | ||
| config-file.yaml: |+ | ||
| authorization: | ||
| resourceAttributes: | ||
| apiVersion: v1 | ||
| resource: namespace | ||
| subresource: metrics | ||
| namespace: openshift-machine-api | ||
|
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
can you elaborate why we need this file?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
This is required for the k8s-e2e ci job which runs test against the k8s. In the original deployment, we are mounting a secret into the pod. Based on the annotation in the mao metrics service object, this
secretwill get created automatically in the openshift cluster. With the minikube cluster, this secret will not be there and thus deployment will fail. To workaround this, in the k8s-e2e tests this deployment will be used which is not mounting secrets.