From e09577a16a05df0b8c30deecddfb651c4ffde4aa Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Manuel=20R=C3=BCger?= Date: Wed, 28 Oct 2020 17:59:04 +0100 Subject: [PATCH] [kube-prometheus-stack] Support native TLS in prometheus-operator (#206) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Manuel Rüger Co-authored-by: Bismarck Paliz Co-authored-by: Bismarck Paliz --- charts/kube-prometheus-stack/Chart.yaml | 2 +- charts/kube-prometheus-stack/README.md | 4 ++++ .../prometheus-operator/deployment.yaml | 18 +++++++++++++++++- .../templates/prometheus-operator/service.yaml | 4 +++- .../prometheus-operator/servicemonitor.yaml | 12 ++++++++++++ charts/kube-prometheus-stack/values.yaml | 5 +++++ 6 files changed, 42 insertions(+), 3 deletions(-) diff --git a/charts/kube-prometheus-stack/Chart.yaml b/charts/kube-prometheus-stack/Chart.yaml index 353ca2c8..653eb8ab 100644 --- a/charts/kube-prometheus-stack/Chart.yaml +++ b/charts/kube-prometheus-stack/Chart.yaml @@ -17,7 +17,7 @@ name: kube-prometheus-stack sources: - https://github.com/prometheus-community/helm-charts - https://github.com/prometheus-operator/kube-prometheus -version: 10.2.0 +version: 10.3.1 appVersion: 0.42.1 tillerVersion: ">=2.12.0" kubeVersion: ">=1.16.0-0" diff --git a/charts/kube-prometheus-stack/README.md b/charts/kube-prometheus-stack/README.md index cf044109..b99903dc 100644 --- a/charts/kube-prometheus-stack/README.md +++ b/charts/kube-prometheus-stack/README.md @@ -86,6 +86,10 @@ _See [helm upgrade](https://helm.sh/docs/helm/helm_upgrade/) for command documen A major chart version change (like v1.2.3 -> v2.0.0) indicates that there is an incompatible breaking change needing manual actions. +### From 10.x to 11.x + +Version 11 will remove the deprecated tlsProxy via ghostunnel in favor of native TLS support the prometheus-operator has gained with v0.39.0. + ### From 9.x to 10.x Version 10 upgrades prometheus-operator to from 0.38.x 0.42.x. Starting with 0.40.x an additional `Probes` CRD is introduced. Helm does not automatically upgrade or install new CRDs on a chart upgrade, so you have to install the CRD manually before updating: diff --git a/charts/kube-prometheus-stack/templates/prometheus-operator/deployment.yaml b/charts/kube-prometheus-stack/templates/prometheus-operator/deployment.yaml index 552ef1ad..3bd8105a 100644 --- a/charts/kube-prometheus-stack/templates/prometheus-operator/deployment.yaml +++ b/charts/kube-prometheus-stack/templates/prometheus-operator/deployment.yaml @@ -89,14 +89,30 @@ spec: {{- if .Values.prometheusOperator.secretFieldSelector }} - --secret-field-selector={{ .Values.prometheusOperator.secretFieldSelector }} {{- end }} + {{- if .Values.prometheusOperator.tls.enabled }} + - --web.enable-tls=true + - --web.cert-file=cert/cert + - --web.key-file=cert/key + - --web.listen-address=:8443 + ports: + - containerPort: 8443 + name: https + {{- else }} ports: - containerPort: 8080 name: http + {{- end }} resources: {{ toYaml .Values.prometheusOperator.resources | indent 12 }} securityContext: allowPrivilegeEscalation: false readOnlyRootFilesystem: true + {{- if .Values.prometheusOperator.tls.enabled }} + volumeMounts: + - name: tls-proxy-secret + mountPath: /cert + readOnly: true + {{- end }} {{- if .Values.prometheusOperator.tlsProxy.enabled }} - name: tls-proxy {{- if .Values.prometheusOperator.tlsProxy.image.sha }} @@ -125,7 +141,7 @@ spec: allowPrivilegeEscalation: false readOnlyRootFilesystem: true {{- end }} -{{- if .Values.prometheusOperator.tlsProxy.enabled }} +{{- if or .Values.prometheusOperator.tlsProxy.enabled .Values.prometheusOperator.tls.enabled }} volumes: - name: tls-proxy-secret secret: diff --git a/charts/kube-prometheus-stack/templates/prometheus-operator/service.yaml b/charts/kube-prometheus-stack/templates/prometheus-operator/service.yaml index 6e67b3d5..b42997e5 100644 --- a/charts/kube-prometheus-stack/templates/prometheus-operator/service.yaml +++ b/charts/kube-prometheus-stack/templates/prometheus-operator/service.yaml @@ -32,13 +32,15 @@ spec: {{- end }} {{- end }} ports: + {{- if not .Values.prometheusOperator.tls.enabled }} - name: http {{- if eq .Values.prometheusOperator.service.type "NodePort" }} nodePort: {{ .Values.prometheusOperator.service.nodePort }} {{- end }} port: 8080 targetPort: http - {{- if .Values.prometheusOperator.tlsProxy.enabled }} + {{- end }} + {{- if or .Values.prometheusOperator.tlsProxy.enabled .Values.prometheusOperator.tls.enabled }} - name: https {{- if eq .Values.prometheusOperator.service.type "NodePort"}} nodePort: {{ .Values.prometheusOperator.service.nodePortTls }} diff --git a/charts/kube-prometheus-stack/templates/prometheus-operator/servicemonitor.yaml b/charts/kube-prometheus-stack/templates/prometheus-operator/servicemonitor.yaml index 52f2d572..7524ddf4 100644 --- a/charts/kube-prometheus-stack/templates/prometheus-operator/servicemonitor.yaml +++ b/charts/kube-prometheus-stack/templates/prometheus-operator/servicemonitor.yaml @@ -9,7 +9,19 @@ metadata: {{ include "kube-prometheus-stack.labels" . | indent 4 }} spec: endpoints: + {{- if .Values.prometheusOperator.tls.enabled }} + - port: https + scheme: https + tlsConfig: + serverName: {{ template "kube-prometheus-stack.operator.fullname" . }} + ca: + secret: + name: {{ template "kube-prometheus-stack.fullname" . }}-admission + key: ca + optional: false + {{- else }} - port: http + {{- end }} honorLabels: true {{- if .Values.prometheusOperator.serviceMonitor.interval }} interval: {{ .Values.prometheusOperator.serviceMonitor.interval }} diff --git a/charts/kube-prometheus-stack/values.yaml b/charts/kube-prometheus-stack/values.yaml index 0530e486..9a4397d8 100644 --- a/charts/kube-prometheus-stack/values.yaml +++ b/charts/kube-prometheus-stack/values.yaml @@ -1158,6 +1158,7 @@ prometheusOperator: # Only for prometheusOperator.image.tag < v0.39.0 manageCrds: true + # This is deprecated and will be removed in v11 of the chart. Please use native TLS support below. tlsProxy: enabled: true image: @@ -1167,6 +1168,10 @@ prometheusOperator: pullPolicy: IfNotPresent resources: {} + # Prometheus-Operator v0.39.0 and later support TLS natively. To preserve compatibility with tlsProxy, the secret tls-proxy-secret is reused + tls: + enabled: false + ## Admission webhook support for PrometheusRules resources added in Prometheus Operator 0.30 can be enabled to prevent incorrectly formatted ## rules from making their way into prometheus and potentially preventing the container from starting admissionWebhooks: