Skip to content

Commit 5e67291

Browse files
ardagucluardaguclu
committed
Inject certs for metrics endpoint when cert-manager is enabled
1 parent 370b869 commit 5e67291

File tree

9 files changed

+192
-1
lines changed

9 files changed

+192
-1
lines changed

Diff for: ‎charts/lws/templates/certmanager/certificatemetrics.yaml

+18
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
{{- if .Values.enableCertManager }}
2+
apiVersion: cert-manager.io/v1
3+
kind: Certificate
4+
metadata:
5+
labels:
6+
app.kubernetes.io/instance: serving-cert
7+
{{- include "lws.labels" . | nindent 4 }}
8+
name: lws-metrics-cert
9+
namespace: {{ .Release.Namespace }}
10+
spec:
11+
dnsNames:
12+
- {{ include "lws.fullname" . }}-controller-manager-metrics-service.{{ .Release.Namespace }}.svc
13+
- {{ include "lws.fullname" . }}-controller-manager-metrics-service.{{ .Release.Namespace }}.svc.cluster.local
14+
issuerRef:
15+
kind: Issuer
16+
name: lws-selfsigned-issuer
17+
secretName: lws-metrics-server-cert
18+
{{- end }}

Diff for: ‎charts/lws/templates/manager/deployment.yaml

+18
Original file line numberDiff line numberDiff line change
@@ -71,6 +71,11 @@ spec:
7171
- mountPath: /tmp/k8s-webhook-server/serving-certs
7272
name: cert
7373
readOnly: true
74+
{{- if .Values.enableCertManager }}
75+
- mountPath: /tmp/k8s-metrics-server/serving-certs
76+
name: metrics-cert
77+
readOnly: true
78+
{{- end }}
7479
{{- with .Values.nodeSelector }}
7580
nodeSelector:
7681
{{- toYaml . | nindent 8 }}
@@ -88,3 +93,16 @@ spec:
8893
secret:
8994
defaultMode: 420
9095
secretName: lws-webhook-server-cert
96+
{{- if .Values.enableCertManager }}
97+
- name: metrics-cert
98+
secret:
99+
secretName: lws-metrics-server-cert
100+
optional: false
101+
items:
102+
- key: ca.crt
103+
path: ca.crt
104+
- key: tls.crt
105+
path: tls.crt
106+
- key: tls.key
107+
path: tls.key
108+
{{- end }}

Diff for: ‎charts/lws/templates/prometheus/monitor.yaml

+17-1
Original file line numberDiff line numberDiff line change
@@ -14,8 +14,24 @@ spec:
1414
path: /metrics
1515
port: https
1616
scheme: https
17+
{{- if .Values.enableCertManager }}
1718
tlsConfig:
18-
insecureSkipVerify: true
19+
serverName: {{ include "lws.fullname" . }}-controller-manager-metrics-service.{{ .Release.Namespace }}.svc
20+
insecureSkipVerify: false
21+
ca:
22+
secret:
23+
name: lws-metrics-server-cert
24+
key: ca.crt
25+
cert:
26+
secret:
27+
name: lws-metrics-server-cert
28+
key: tls.crt
29+
keySecret:
30+
name: lws-metrics-server-cert
31+
key: tls.key
32+
{{- else }}
33+
insecureSkipVerify: false
34+
{{- end }}
1935
selector:
2036
matchLabels:
2137
control-plane: controller-manager

Diff for: ‎config/certmanager/certificate-metrics.yaml

+17
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
# The following manifests contain a metrics certificate CR.
2+
# More document can be found at https://docs.cert-manager.io
3+
apiVersion: cert-manager.io/v1
4+
kind: Certificate
5+
metadata:
6+
name: metrics-cert # this name should match the one appeared in kustomizeconfig.yaml
7+
namespace: system
8+
spec:
9+
dnsNames:
10+
# SERVICE_NAME and SERVICE_NAMESPACE will be substituted by kustomize
11+
# replacements in the config/default/kustomization.yaml file.
12+
- SERVICE_NAME.SERVICE_NAMESPACE.svc
13+
- SERVICE_NAME.SERVICE_NAMESPACE.svc.cluster.local
14+
issuerRef:
15+
kind: Issuer
16+
name: selfsigned-issuer
17+
secretName: metrics-server-cert

Diff for: ‎config/certmanager/kustomization.yaml

+1
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,6 @@
11
resources:
22
- certificate.yaml
3+
- certificate-metrics.yaml
34

45
configurations:
56
- kustomizeconfig.yaml

Diff for: ‎config/components/prometheus/kustomization.yaml

+8
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,11 @@
11
resources:
22
- monitor.yaml
33
- role.yaml
4+
# [PROMETHEUS-WITH-CERTS] The following patch configures the ServiceMonitor in ../prometheus
5+
# to securely reference certificates created and managed by cert-manager.
6+
# Additionally, ensure that you uncomment the [METRICS WITH CERTMANAGER] patch under config/default/kustomization.yaml
7+
# to mount the "metrics-server-cert" secret in the Manager Deployment.
8+
#patches:
9+
#- path: monitor_tls_patch.yaml
10+
# target:
11+
# kind: ServiceMonitor

Diff for: ‎config/components/prometheus/monitor_tls_patch.yaml

+19
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
# Patch for Prometheus ServiceMonitor to enable secure TLS configuration
2+
# using certificates managed by cert-manager
3+
- op: replace
4+
path: /spec/endpoints/0/tlsConfig
5+
value:
6+
# SERVICE_NAME and SERVICE_NAMESPACE will be substituted by kustomize
7+
serverName: SERVICE_NAME.SERVICE_NAMESPACE.svc
8+
insecureSkipVerify: false
9+
ca:
10+
secret:
11+
name: metrics-server-cert
12+
key: ca.crt
13+
cert:
14+
secret:
15+
name: metrics-server-cert
16+
key: tls.crt
17+
keySecret:
18+
name: metrics-server-cert
19+
key: tls.key

Diff for: ‎config/default/cert_metrics_manager_patch.yaml

+25
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
# This patch adds the args, volumes, and ports to allow the manager to use the metrics-server certs.
2+
3+
# Add the volumeMount for the metrics-server certs
4+
- op: add
5+
path: /spec/template/spec/containers/0/volumeMounts/-
6+
value:
7+
mountPath: /tmp/k8s-metrics-server/serving-certs
8+
name: metrics-cert
9+
readOnly: true
10+
11+
# Add the metrics-server certs volume configuration
12+
- op: add
13+
path: /spec/template/spec/volumes/-
14+
value:
15+
name: metrics-cert
16+
secret:
17+
secretName: metrics-server-cert
18+
optional: false
19+
items:
20+
- key: ca.crt
21+
path: ca.crt
22+
- key: tls.crt
23+
path: tls.crt
24+
- key: tls.key
25+
path: tls.key

Diff for: ‎config/default/kustomization.yaml

+69
Original file line numberDiff line numberDiff line change
@@ -23,6 +23,7 @@ resources:
2323
- ../webhook
2424
# [CERTMANAGER] To enable cert-manager, uncomment all sections with 'CERTMANAGER'. 'WEBHOOK' components are required.
2525
- ../internalcert
26+
#- ../certmanager
2627
# [PROMETHEUS] To enable prometheus monitor, uncomment all sections with 'PROMETHEUS'.
2728
#- ../prometheus
2829
# [METRICS] Expose the controller manager metrics service.
@@ -43,6 +44,13 @@ patches:
4344
# 'CERTMANAGER' needs to be enabled to use ca injection
4445
#- path: webhookcainjection_patch.yaml
4546

47+
# Uncomment the patches line if you enable Metrics and CertManager
48+
# [CERTMANAGER] To enable metrics protected with certManager, uncomment the following line.
49+
# This patch will protect the metrics with certManager self-signed certs.
50+
# - path: cert_metrics_manager_patch.yaml
51+
# target:
52+
# kind: Deployment
53+
4654
# [CERTMANAGER] To enable cert-manager, uncomment all sections with 'CERTMANAGER' prefix.
4755
# Uncomment the following replacements to add the cert-manager CA injection annotations
4856
#replacements:
@@ -118,6 +126,7 @@ patches:
118126
# kind: Certificate
119127
# group: cert-manager.io
120128
# version: v1
129+
# name: serving-cert
121130
# fieldPaths:
122131
# - .spec.dnsNames.0
123132
# - .spec.dnsNames.1
@@ -135,10 +144,70 @@ patches:
135144
# kind: Certificate
136145
# group: cert-manager.io
137146
# version: v1
147+
# name: serving-cert
138148
# fieldPaths:
139149
# - .spec.dnsNames.0
140150
# - .spec.dnsNames.1
141151
# options:
142152
# delimiter: '.'
143153
# index: 1
144154
# create: true
155+
# - source: # Add cert-manager annotation to the webhook Service
156+
# kind: Service
157+
# version: v1
158+
# name: controller-manager-metrics-service
159+
# fieldPath: .metadata.name # name of the service
160+
# targets:
161+
# - select:
162+
# kind: Certificate
163+
# group: cert-manager.io
164+
# version: v1
165+
# name: lws-metrics-cert
166+
# fieldPaths:
167+
# - .spec.dnsNames.0
168+
# - .spec.dnsNames.1
169+
# options:
170+
# delimiter: '.'
171+
# index: 0
172+
# create: true
173+
# - select:
174+
# kind: ServiceMonitor
175+
# group: monitoring.coreos.com
176+
# version: v1
177+
# name: controller-manager-metrics-monitor
178+
# fieldPaths:
179+
# - spec.endpoints.0.tlsConfig.serverName
180+
# options:
181+
# delimiter: '.'
182+
# index: 0
183+
# create: true
184+
# - source:
185+
# kind: Service
186+
# version: v1
187+
# name: controller-manager-metrics-service
188+
# fieldPath: .metadata.namespace # namespace of the service
189+
# targets:
190+
# - select:
191+
# kind: Certificate
192+
# group: cert-manager.io
193+
# version: v1
194+
# name: lws-metrics-cert
195+
# fieldPaths:
196+
# - .spec.dnsNames.0
197+
# - .spec.dnsNames.1
198+
# options:
199+
# delimiter: '.'
200+
# index: 1
201+
# create: true
202+
# - select:
203+
# kind: ServiceMonitor
204+
# group: monitoring.coreos.com
205+
# version: v1
206+
# name: controller-manager-metrics-monitor
207+
# fieldPaths:
208+
# - spec.endpoints.0.tlsConfig.serverName
209+
# options:
210+
# delimiter: '.'
211+
# index: 1
212+
# create: true
213+

0 commit comments

Comments
 (0)