feat(helm): add a ServiceMonitor for the controller metrics endpoint - #2401
Open
younsl wants to merge 1 commit into
Open
feat(helm): add a ServiceMonitor for the controller metrics endpoint#2401younsl wants to merge 1 commit into
younsl wants to merge 1 commit into
Conversation
controller.metrics.enabled provisions the metrics Service and the ClusterRoles for authenticated scrapes, but stops short of the resource that makes Prometheus Operator actually scrape it, so every user running kube-prometheus-stack has to hand-write a ServiceMonitor outside the chart. The bundled kagent-tools subchart already ships one. Adds controller.metrics.serviceMonitor, off by default and gated on controller.metrics.enabled. Scrape settings (interval, scrapeTimeout, honorLabels, relabelings, metricRelabelings), extra labels/annotations and a namespace override are exposed; the endpoint defaults to https with the ServiceAccount token and insecureSkipVerify when secureServing is on, matching the self-signed certificate the controller serves, and both are overridable. The Service port name moves into a kagent.controller.metricsPortName helper shared with the ServiceMonitor endpoint so the two cannot drift when secureServing is flipped. Rendered output is unchanged. Signed-off-by: younsl <cysl@kakao.com>
github-actions
Bot
added
enhancement
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
This adds native ServiceMonitor support to the kagent Helm chart so controller metrics are collected by Prometheus Operator out of the box.
This is the follow up that #1803 deferred. That PR landed the metrics Service and the scrape RBAC and closed #1369, but left the ServiceMonitor out of scope. #1802 carried one and was closed as a duplicate of #1803, so the ServiceMonitor half of #1369 was never reviewed on its own and no template for it exists in the chart today. This PR is additive on top of what #1803 merged and changes none of it.
Today controller.metrics.enabled provisions the metrics Service and the ClusterRoles for authenticated scrapes, but not the resource that makes Prometheus actually scrape them. Every user running kube-prometheus-stack has to hand write a ServiceMonitor outside the chart and keep its port name and namespace in sync with the chart by hand. The bundled kagent-tools subchart already ships one, so this closes the gap for the controller.
New values live under controller.metrics.serviceMonitor, disabled by default and gated on controller.metrics.enabled. Interval, scrape timeout, honorLabels, relabelings, metric relabelings, extra labels, annotations and a namespace override are exposed. With secure serving on, the endpoint defaults to https with the ServiceAccount token and insecureSkipVerify, which matches the self signed certificate the controller serves, and both are overridable.
The metrics Service port name moved into a shared helper used by both the Service and the ServiceMonitor endpoint, so the two cannot drift when secure serving is flipped. Rendered output for existing installs is unchanged.
Changelog
Added an optional Prometheus Operator ServiceMonitor for the controller metrics endpoint, configurable under controller.metrics.serviceMonitor.
Testing
Additional Notes
Rendering the ServiceMonitor does not authorize the scrape on its own. With secure serving, the metrics reader ClusterRole still has to be bound to the Prometheus ServiceAccount, which the values comment calls out.
The chart does not gate on the monitoring.coreos.com API being present, matching what kagent-tools does. The explicit opt in flag is the gate, so a missing CRD fails loudly at install time instead of silently dropping the resource during helm template.