Add service monitor (#554)

* Add service monitor Signed-off-by: QuentinBisson <[email protected]> * Update helm/cert-operator/values.yaml * Update helm/cert-operator/values.yaml Signed-off-by: QuentinBisson <[email protected]> --------- Signed-off-by: QuentinBisson <[email protected]>
giantswarm · Jul 11, 2023 · b6e0485 · b6e0485
1 parent 1061ae7
commit b6e0485
Show file tree

Hide file tree

Showing 7 changed files with 97 additions and 22 deletions.
diff --git a/.nancy-ignore b/.nancy-ignore
@@ -18,4 +18,4 @@ CVE-2023-26125
 CVE-2023-29401
 
 # golang/google.golang.org/[email protected]
-CVE-2023-32731 until=2023-07-30
+CVE-2023-32731 until=2023-07-30
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -10,6 +10,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 ### Added
 
 - Added the use of the runtime/default seccomp profile.
+- Added Service Monitor.
 - Added required values for pss policies.
 - Added pss exceptions for volumes.
 

diff --git a/helm/cert-operator/templates/_helpers.tpl b/helm/cert-operator/templates/_helpers.tpl
@@ -23,6 +23,8 @@ app.giantswarm.io/branch: {{ .Values.project.branch | quote }}
 app.giantswarm.io/commit: {{ .Values.project.commit | quote }}
 app.kubernetes.io/managed-by: {{ .Release.Service | quote }}
 app.kubernetes.io/version: "{{ .Chart.AppVersion }}{{- if eq $.Chart.Name $.Release.Name }}-unique{{ end }}"
+{{- $regexToFind := printf "- provider:\\s%s\n\\s*team:\\s(.+)" .Values.provider.kind }}
+application.giantswarm.io/team: {{ index .Chart.Annotations "application.giantswarm.io/owners" | regexFind $regexToFind | replace (printf "- provider: %s\n" .Values.provider.kind) "" | replace "team: " "" | nospace }}
 helm.sh/chart: {{ include "chart" . | quote }}
 {{- end -}}
 

diff --git a/helm/cert-operator/templates/service.yaml b/helm/cert-operator/templates/service.yaml
@@ -5,10 +5,11 @@ metadata:
   namespace: {{ include "resource.default.namespace" . }}
   labels:
     {{- include "labels.common" . | nindent 4 }}
-  annotations:
-    prometheus.io/scrape: "true"
 spec:
   ports:
-  - port: 8000
+  - name: http
+    port: 8000
+    protocol: TCP
+    targetPort: http
   selector:
     {{- include "labels.selector" . | nindent 4 }}
diff --git a/helm/cert-operator/templates/servicemonitor.yaml b/helm/cert-operator/templates/servicemonitor.yaml
@@ -0,0 +1,18 @@
+{{- if .Values.serviceMonitor.enabled }}
+apiVersion: monitoring.coreos.com/v1
+kind: ServiceMonitor
+metadata:
+  name: {{ include "resource.default.name" . }}
+  namespace: {{ include "resource.default.namespace" . }}
+  labels:
+    {{- include "labels.common" . | nindent 4 }}
+spec:
+  endpoints:
+    - interval: {{ .Values.serviceMonitor.interval }}
+      path: /metrics
+      port: http
+      scrapeTimeout: {{ .Values.serviceMonitor.scrapeTimeout }}
+  selector:
+    matchLabels:
+      {{- include "labels.selector" . | nindent 6 }}
+{{- end }}
diff --git a/helm/cert-operator/values.schema.json b/helm/cert-operator/values.schema.json
@@ -35,17 +35,16 @@
         "podSecurityContext": {
             "type": "object",
             "properties": {
+                "runAsNonRoot": {
+                    "type": "boolean"
+                },
                 "seccompProfile": {
                     "type": "object",
                     "properties": {
                         "type": {
                             "type": "string"
                         }
                     }
-                },
-                "runAsNonRoot": {
-                    "type": "boolean", 
-                    "default": true
                 }
             }
         },
@@ -60,6 +59,14 @@
                 }
             }
         },
+        "provider": {
+            "type": "object",
+            "properties": {
+                "kind": {
+                    "type": "string"
+                }
+            }
+        },
         "registry": {
             "type": "object",
             "properties": {
@@ -79,32 +86,68 @@
         "securityContext": {
             "type": "object",
             "properties": {
-                "allowPrivilegeEscalation": {
-                    "type": "boolean",
-                    "default": false
-                },
-                "seccompProfile": {
+                "default": {
                     "type": "object",
                     "properties": {
-                        "type": {
-                            "type": "string"
+                        "allowPrivilegeEscalation": {
+                            "type": "boolean"
+                        },
+                        "capabilities": {
+                            "type": "object",
+                            "properties": {
+                                "drop": {
+                                    "type": "array",
+                                    "items": {
+                                        "type": "string"
+                                    }
+                                }
+                            }
+                        },
+                        "seccompProfile": {
+                            "type": "object",
+                            "properties": {
+                                "type": {
+                                    "type": "string"
+                                }
+                            }
                         }
                     }
                 },
-                "capabilities":{
+                "initContainers": {
                     "type": "object",
                     "properties": {
-                        "drop": {
-                            "type": "array",
-                            "items": {
-                                "type": "string"
-                            },
-                            "default": ["ALL"]
+                        "allowPrivilegeEscalation": {
+                            "type": "boolean"
+                        },
+                        "capabilities": {
+                            "type": "object",
+                            "properties": {
+                                "drop": {
+                                    "type": "array",
+                                    "items": {
+                                        "type": "string"
+                                    }
+                                }
+                            }
                         }
                     }
                 }
             }
         },
+        "serviceMonitor": {
+            "type": "object",
+            "properties": {
+                "enabled": {
+                    "type": "boolean"
+                },
+                "interval": {
+                    "type": "string"
+                },
+                "scrapeTimeout": {
+                    "type": "string"
+                }
+            }
+        },
         "userID": {
             "type": "integer"
         },

diff --git a/helm/cert-operator/values.yaml b/helm/cert-operator/values.yaml
@@ -29,6 +29,9 @@ workloadCluster:
     api:
       endpointBase: ""
 
+provider:
+  kind: "aws"
+
 # Add seccomp to pod security context
 podSecurityContext:
   runAsNonRoot: true
@@ -49,3 +52,10 @@ securityContext:
     capabilities:
       drop:
       - ALL
+
+serviceMonitor:
+  enabled: true
+  # -- (duration) Prometheus scrape interval.
+  interval: "60s"
+  # -- (duration) Prometheus scrape timeout.
+  scrapeTimeout: "45s"