Skip to content

Commit 261c1a0

Browse files
copejonclaude
copejon
and
claude
committed
USHIFT-6951: Add metrics-server as optional MicroShift component
Add metrics-server with Go cert provisioning, kustomize manifests, healthcheck registration, auto-rebase support, RPM packaging, and OpenTelemetry collector drop-in configuration. Establishes shared infrastructure used by all metrics exporters: - OPTIONAL_COMPONENTS in rebase.sh for CMO repo cloning - update_metrics_images() for image digest resolution - otelcol.d drop-in config directory and service wrapper - mergeWorkloads() for shared-namespace healthcheck Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
1 parent 93e835e commit 261c1a0

30 files changed

Lines changed: 882 additions & 7 deletions

‎assets/optional/metrics-server/00-namespace.yaml‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
apiVersion: v1
2+
kind: Namespace
3+
metadata:
4+
name: openshift-monitoring
5+
labels:
6+
name: openshift-monitoring
7+
pod-security.kubernetes.io/enforce: privileged
8+
pod-security.kubernetes.io/audit: privileged
9+
pod-security.kubernetes.io/warn: privileged

‎assets/optional/metrics-server/01-cluster-role-binding-auth-delegator.yaml‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
apiVersion: rbac.authorization.k8s.io/v1
2+
kind: ClusterRoleBinding
3+
metadata:
4+
labels:
5+
app.kubernetes.io/component: metrics-server
6+
app.kubernetes.io/managed-by: cluster-monitoring-operator
7+
app.kubernetes.io/name: auth-delegator
8+
app.kubernetes.io/part-of: openshift-monitoring
9+
name: metrics-server:system:auth-delegator
10+
roleRef:
11+
apiGroup: rbac.authorization.k8s.io
12+
kind: ClusterRole
13+
name: system:auth-delegator
14+
subjects:
15+
- kind: ServiceAccount
16+
name: metrics-server
17+
namespace: openshift-monitoring

‎assets/optional/metrics-server/01-cluster-role-binding.yaml‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
apiVersion: rbac.authorization.k8s.io/v1
2+
kind: ClusterRoleBinding
3+
metadata:
4+
labels:
5+
app.kubernetes.io/managed-by: cluster-monitoring-operator
6+
app.kubernetes.io/name: metrics-server
7+
app.kubernetes.io/part-of: openshift-monitoring
8+
name: system:metrics-server
9+
roleRef:
10+
apiGroup: rbac.authorization.k8s.io
11+
kind: ClusterRole
12+
name: system:metrics-server
13+
subjects:
14+
- kind: ServiceAccount
15+
name: metrics-server
16+
namespace: openshift-monitoring
17+
- kind: User
18+
name: system:metrics-server

‎assets/optional/metrics-server/01-cluster-role.yaml‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
apiVersion: rbac.authorization.k8s.io/v1
2+
kind: ClusterRole
3+
metadata:
4+
labels:
5+
app.kubernetes.io/component: metrics-server
6+
app.kubernetes.io/managed-by: cluster-monitoring-operator
7+
app.kubernetes.io/name: metrics-server
8+
app.kubernetes.io/part-of: openshift-monitoring
9+
name: system:metrics-server
10+
rules:
11+
- apiGroups:
12+
- ""
13+
resources:
14+
- nodes/metrics
15+
verbs:
16+
- get
17+
- apiGroups:
18+
- ""
19+
resources:
20+
- pods
21+
- nodes
22+
verbs:
23+
- get
24+
- list
25+
- watch

‎assets/optional/metrics-server/01-role-binding-auth-reader.yaml‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
apiVersion: rbac.authorization.k8s.io/v1
2+
kind: RoleBinding
3+
metadata:
4+
labels:
5+
app.kubernetes.io/component: metrics-server
6+
app.kubernetes.io/managed-by: cluster-monitoring-operator
7+
app.kubernetes.io/name: metrics-server-auth-reader
8+
app.kubernetes.io/part-of: openshift-monitoring
9+
name: metrics-server-auth-reader
10+
namespace: kube-system
11+
roleRef:
12+
apiGroup: rbac.authorization.k8s.io
13+
kind: Role
14+
name: extension-apiserver-authentication-reader
15+
subjects:
16+
- kind: ServiceAccount
17+
name: metrics-server
18+
namespace: openshift-monitoring

‎assets/optional/metrics-server/01-service-account.yaml‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
apiVersion: v1
2+
kind: ServiceAccount
3+
metadata:
4+
labels:
5+
app.kubernetes.io/component: metrics-server
6+
app.kubernetes.io/managed-by: cluster-monitoring-operator
7+
app.kubernetes.io/name: metrics-server
8+
app.kubernetes.io/part-of: openshift-monitoring
9+
name: metrics-server
10+
namespace: openshift-monitoring

‎assets/optional/metrics-server/02-configmap-audit-profiles.yaml‎

Lines changed: 45 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,45 @@
1+
apiVersion: v1
2+
data:
3+
metadata-profile.yaml: |-
4+
"apiVersion": "audit.k8s.io/v1"
5+
"kind": "Policy"
6+
"metadata":
7+
"name": "Metadata"
8+
"omitStages":
9+
- "RequestReceived"
10+
"rules":
11+
- "level": "Metadata"
12+
none-profile.yaml: |-
13+
"apiVersion": "audit.k8s.io/v1"
14+
"kind": "Policy"
15+
"metadata":
16+
"name": "None"
17+
"omitStages":
18+
- "RequestReceived"
19+
"rules":
20+
- "level": "None"
21+
request-profile.yaml: |-
22+
"apiVersion": "audit.k8s.io/v1"
23+
"kind": "Policy"
24+
"metadata":
25+
"name": "Request"
26+
"omitStages":
27+
- "RequestReceived"
28+
"rules":
29+
- "level": "Request"
30+
requestresponse-profile.yaml: |-
31+
"apiVersion": "audit.k8s.io/v1"
32+
"kind": "Policy"
33+
"metadata":
34+
"name": "RequestResponse"
35+
"omitStages":
36+
- "RequestReceived"
37+
"rules":
38+
- "level": "RequestResponse"
39+
kind: ConfigMap
40+
metadata:
41+
labels:
42+
app.kubernetes.io/managed-by: cluster-monitoring-operator
43+
app.kubernetes.io/part-of: openshift-monitoring
44+
name: metrics-server-audit-profiles
45+
namespace: openshift-monitoring

‎assets/optional/metrics-server/03-deployment.yaml‎

Lines changed: 111 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,111 @@
1+
apiVersion: apps/v1
2+
kind: Deployment
3+
metadata:
4+
labels:
5+
app.kubernetes.io/component: metrics-server
6+
app.kubernetes.io/managed-by: cluster-monitoring-operator
7+
app.kubernetes.io/name: metrics-server
8+
app.kubernetes.io/part-of: openshift-monitoring
9+
name: metrics-server
10+
namespace: openshift-monitoring
11+
spec:
12+
replicas: 1
13+
selector:
14+
matchLabels:
15+
app.kubernetes.io/component: metrics-server
16+
app.kubernetes.io/name: metrics-server
17+
app.kubernetes.io/part-of: openshift-monitoring
18+
strategy:
19+
type: Recreate
20+
template:
21+
metadata:
22+
annotations:
23+
openshift.io/required-scc: restricted-v2
24+
target.workload.openshift.io/management: '{"effect": "PreferredDuringScheduling"}'
25+
labels:
26+
app.kubernetes.io/component: metrics-server
27+
app.kubernetes.io/name: metrics-server
28+
app.kubernetes.io/part-of: openshift-monitoring
29+
spec:
30+
containers:
31+
- args:
32+
- --secure-port=10250
33+
- --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname
34+
- --kubelet-use-node-status-port
35+
- --metric-resolution=15s
36+
- --kubelet-certificate-authority=/etc/tls/kubelet-serving-ca-bundle/ca-bundle.crt
37+
- --kubelet-client-certificate=/etc/tls/metrics-server-client-certs/tls.crt
38+
- --kubelet-client-key=/etc/tls/metrics-server-client-certs/tls.key
39+
- --tls-cert-file=/etc/tls/private/tls.crt
40+
- --tls-private-key-file=/etc/tls/private/tls.key
41+
- --tls-cipher-suites=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305
42+
- --shutdown-send-retry-after=true
43+
- --shutdown-delay-duration=150s
44+
- --disable-http2-serving=true
45+
image: quay.io/openshift/kube-metrics-server
46+
imagePullPolicy: IfNotPresent
47+
livenessProbe:
48+
failureThreshold: 3
49+
httpGet:
50+
path: /livez
51+
port: https
52+
scheme: HTTPS
53+
periodSeconds: 10
54+
name: metrics-server
55+
ports:
56+
- containerPort: 10250
57+
name: https
58+
protocol: TCP
59+
readinessProbe:
60+
failureThreshold: 6
61+
httpGet:
62+
path: /readyz
63+
port: https
64+
scheme: HTTPS
65+
initialDelaySeconds: 20
66+
periodSeconds: 20
67+
resources:
68+
requests:
69+
cpu: 1m
70+
memory: 40Mi
71+
securityContext:
72+
allowPrivilegeEscalation: false
73+
readOnlyRootFilesystem: true
74+
runAsNonRoot: true
75+
terminationMessagePolicy: FallbackToLogsOnError
76+
volumeMounts:
77+
- mountPath: /etc/tls/private
78+
name: secret-metrics-server-tls
79+
- mountPath: /etc/tls/metrics-server-client-certs
80+
name: secret-metrics-server-client-certs
81+
- mountPath: /etc/tls/kubelet-serving-ca-bundle
82+
name: configmap-kubelet-serving-ca-bundle
83+
- mountPath: /etc/audit
84+
name: metrics-server-audit-profiles
85+
readOnly: true
86+
- mountPath: /var/log/metrics-server
87+
name: audit-log
88+
readOnly: false
89+
nodeSelector:
90+
kubernetes.io/os: linux
91+
priorityClassName: system-cluster-critical
92+
serviceAccountName: metrics-server
93+
terminationGracePeriodSeconds: 170
94+
tolerations:
95+
- effect: NoSchedule
96+
key: node-role.kubernetes.io/master
97+
volumes:
98+
- name: secret-metrics-server-client-certs
99+
secret:
100+
secretName: metrics-server-client-certs
101+
- name: secret-metrics-server-tls
102+
secret:
103+
secretName: metrics-server-tls
104+
- configMap:
105+
name: kubelet-serving-ca-bundle
106+
name: configmap-kubelet-serving-ca-bundle
107+
- emptyDir: {}
108+
name: audit-log
109+
- configMap:
110+
name: metrics-server-audit-profiles
111+
name: metrics-server-audit-profiles

‎assets/optional/metrics-server/04-api-service.yaml‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
apiVersion: apiregistration.k8s.io/v1
2+
kind: APIService
3+
metadata:
4+
annotations:
5+
service.beta.openshift.io/inject-cabundle: "true"
6+
labels:
7+
app.kubernetes.io/component: metrics-server
8+
app.kubernetes.io/managed-by: cluster-monitoring-operator
9+
app.kubernetes.io/name: metrics-server
10+
app.kubernetes.io/part-of: openshift-monitoring
11+
name: v1beta1.metrics.k8s.io
12+
spec:
13+
group: metrics.k8s.io
14+
groupPriorityMinimum: 100
15+
insecureSkipTLSVerify: false
16+
service:
17+
name: metrics-server
18+
namespace: openshift-monitoring
19+
port: 443
20+
version: v1beta1
21+
versionPriority: 100

‎assets/optional/metrics-server/04-service.yaml‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
apiVersion: v1
2+
kind: Service
3+
metadata:
4+
annotations:
5+
openshift.io/description: Expose the metrics-server web server on port 443. This port is for internal use, and no other usage is guaranteed.
6+
service.beta.openshift.io/serving-cert-secret-name: metrics-server-tls
7+
labels:
8+
app.kubernetes.io/component: metrics-server
9+
app.kubernetes.io/managed-by: cluster-monitoring-operator
10+
app.kubernetes.io/name: metrics-server
11+
app.kubernetes.io/part-of: openshift-monitoring
12+
name: metrics-server
13+
namespace: openshift-monitoring
14+
spec:
15+
ports:
16+
- name: https
17+
port: 443
18+
protocol: TCP
19+
targetPort: https
20+
selector:
21+
app.kubernetes.io/name: metrics-server
22+
app.kubernetes.io/part-of: openshift-monitoring

0 commit comments

Comments
 (0)