Deployment config, ServiceAccount bearer token support (#7)

config/default/exporter_auth_proxy_patch.yaml

@@ -0,0 +1,36 @@
+# This patch inject a sidecar container which is a HTTP proxy for the
+# exporter, it performs RBAC authorization against the Kubernetes API using SubjectAccessReviews.
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: alerts-exporter
+spec:
+  template:
+    spec:
+      containers:
+      - name: kube-rbac-proxy
+        securityContext:
+          allowPrivilegeEscalation: false
+          capabilities:
+            drop:
+              - "ALL"
+        image: gcr.io/kubebuilder/kube-rbac-proxy:v0.13.1
+        args:
+        - "--secure-listen-address=0.0.0.0:8443"
+        - "--upstream=http://127.0.0.1:8080/"
+        - "--logtostderr=true"
+        - "--v=0"
+        ports:
+        - containerPort: 8443
+          protocol: TCP
+          name: https
+        resources:
+          limits:
+            cpu: 500m
+            memory: 128Mi
+          requests:
+            cpu: 10m
+            memory: 64Mi
+      - name: exporter
+        args:
+        - "--listen-addr=127.0.0.1:8080"

config/default/exporter_config_patch.yaml

@@ -0,0 +1,9 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: alerts-exporter
+spec:
+  template:
+    spec:
+      containers:
+      - name: exporter

config/default/kustomization.yaml

@@ -0,0 +1,11 @@
+# Adds namespace to all resources.
+namespace: alerts-exporter
+
+bases:
+- ../rbac
+- ../exporter
+- ../prometheus
+
+patchesStrategicMerge:
+# Protect the /metrics endpoint by putting it behind auth.
+- exporter_auth_proxy_patch.yaml

config/exporter/exporter.yaml

@@ -0,0 +1,58 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  labels:
+    control-plane: alerts-exporter
+    app.kubernetes.io/name: namespace
+    app.kubernetes.io/instance: exporter
+    app.kubernetes.io/component: exporter
+    app.kubernetes.io/created-by: alerts-exporter
+    app.kubernetes.io/part-of: alerts-exporter
+    app.kubernetes.io/managed-by: kustomize
+  name: alerts-exporter
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: alerts-exporter
+  labels:
+    control-plane: alerts-exporter
+    app.kubernetes.io/name: deployment
+    app.kubernetes.io/instance: exporter
+    app.kubernetes.io/component: exporter
+    app.kubernetes.io/created-by: alerts-exporter
+    app.kubernetes.io/part-of: alerts-exporter
+    app.kubernetes.io/managed-by: kustomize
+spec:
+  selector:
+    matchLabels:
+      control-plane: alerts-exporter
+  replicas: 1
+  template:
+    metadata:
+      annotations:
+        kubectl.kubernetes.io/default-container: exporter
+      labels:
+        control-plane: alerts-exporter
+    spec:
+      securityContext:
+        runAsNonRoot: true
+        seccompProfile:
+          type: RuntimeDefault
+      containers:
+      - name: exporter
+        image: ghcr.io/appuio/alerts_exporter:latest
+        securityContext:
+          allowPrivilegeEscalation: false
+          capabilities:
+            drop:
+              - "ALL"
+        resources:
+          limits:
+            cpu: 100m
+            memory: 128Mi
+          requests:
+            cpu: 10m
+            memory: 64Mi
+      serviceAccountName: alerts-exporter
+      terminationGracePeriodSeconds: 10

config/exporter/kustomization.yaml

@@ -0,0 +1,2 @@
+resources:
+- exporter.yaml

config/openshift4/exporter_openshift_patch.yaml

@@ -0,0 +1,27 @@
+# This patch inject a sidecar container which is a HTTP proxy for the
+# exporter, it performs RBAC authorization against the Kubernetes API using SubjectAccessReviews.
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: alerts-exporter
+spec:
+  template:
+    spec:
+      containers:
+      - name: exporter
+        args:
+        - --listen-addr=127.0.0.1:8080
+        - --tls
+        - --host=alertmanager-operated.openshift-monitoring.svc.cluster.local:9095
+        - --tls-server-name=alertmanager-main.openshift-monitoring.svc.cluster.local
+        - --k8s-bearer-token-auth
+        - --tls-ca-cert=/etc/ssl/certs/serving-certs/service-ca.crt
+        volumeMounts:
+          - mountPath: /etc/ssl/certs/serving-certs/
+            name: ca-bundle
+            readOnly: true
+      volumes:
+        - configMap:
+            defaultMode: 288
+            name: openshift-service-ca.crt
+          name: ca-bundle

config/openshift4/exporter_role_patch.yaml

@@ -0,0 +1,12 @@
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: exporter-role
+rules:
+- apiGroups:
+  - monitoring.coreos.com
+  resources:
+  - alertmanagers
+  verbs:
+  - patch

config/openshift4/kustomization.yaml

@@ -0,0 +1,7 @@
+bases:
+- ../default
+
+patchesStrategicMerge:
+# Protect the /metrics endpoint by putting it behind auth.
+- exporter_openshift_patch.yaml
+- exporter_role_patch.yaml

config/prometheus/kustomization.yaml

@@ -0,0 +1,2 @@
+resources:
+- monitor.yaml

config/prometheus/monitor.yaml

@@ -0,0 +1,30 @@
+
+# Prometheus Monitor Service (Metrics)
+apiVersion: monitoring.coreos.com/v1
+kind: ServiceMonitor
+metadata:
+  labels:
+    control-plane: alerts-exporter
+    app.kubernetes.io/name: servicemonitor
+    app.kubernetes.io/instance: alerts-exporter-metrics-monitor
+    app.kubernetes.io/component: metrics
+    app.kubernetes.io/created-by: alerts-exporter
+    app.kubernetes.io/part-of: alerts-exporter
+    app.kubernetes.io/managed-by: kustomize
+  name: alerts-exporter-metrics-monitor
+spec:
+  endpoints:
+    - path: /metrics
+      port: https
+      scheme: https
+      bearerTokenFile: /var/run/secrets/kubernetes.io/serviceaccount/token
+      tlsConfig:
+        insecureSkipVerify: true
+      metricRelabelings:
+      - action: keep
+        regex: alerts_exporter_.+
+        sourceLabels:
+        - __name__
+  selector:
+    matchLabels:
+      control-plane: alerts-exporter

config/rbac/auth_proxy_client_clusterrole.yaml

@@ -0,0 +1,16 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  labels:
+    app.kubernetes.io/name: clusterrole
+    app.kubernetes.io/instance: metrics-reader
+    app.kubernetes.io/component: kube-rbac-proxy
+    app.kubernetes.io/created-by: alerts-exporter
+    app.kubernetes.io/part-of: alerts-exporter
+    app.kubernetes.io/managed-by: kustomize
+  name: metrics-reader
+rules:
+- nonResourceURLs:
+  - "/metrics"
+  verbs:
+  - get

config/rbac/auth_proxy_role.yaml

@@ -0,0 +1,24 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  labels:
+    app.kubernetes.io/name: clusterrole
+    app.kubernetes.io/instance: proxy-role
+    app.kubernetes.io/component: kube-rbac-proxy
+    app.kubernetes.io/created-by: alerts-exporter
+    app.kubernetes.io/part-of: alerts-exporter
+    app.kubernetes.io/managed-by: kustomize
+  name: proxy-role
+rules:
+- apiGroups:
+  - authentication.k8s.io
+  resources:
+  - tokenreviews
+  verbs:
+  - create
+- apiGroups:
+  - authorization.k8s.io
+  resources:
+  - subjectaccessreviews
+  verbs:
+  - create

config/rbac/auth_proxy_role_binding.yaml

@@ -0,0 +1,18 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  labels:
+    app.kubernetes.io/name: clusterrolebinding
+    app.kubernetes.io/instance: proxy-rolebinding
+    app.kubernetes.io/component: kube-rbac-proxy
+    app.kubernetes.io/created-by: alerts-exporter
+    app.kubernetes.io/part-of: alerts-exporter
+    app.kubernetes.io/managed-by: kustomize
+  name: proxy-rolebinding
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: proxy-role
+subjects:
+- kind: ServiceAccount
+  name: alerts-exporter

config/rbac/auth_proxy_service.yaml

@@ -0,0 +1,20 @@
+apiVersion: v1
+kind: Service
+metadata:
+  labels:
+    control-plane: alerts-exporter
+    app.kubernetes.io/name: service
+    app.kubernetes.io/instance: alerts-exporter-metrics-service
+    app.kubernetes.io/component: kube-rbac-proxy
+    app.kubernetes.io/created-by: alerts-exporter
+    app.kubernetes.io/part-of: alerts-exporter
+    app.kubernetes.io/managed-by: kustomize
+  name: alerts-exporter-metrics-service
+spec:
+  ports:
+  - name: https
+    port: 8443
+    protocol: TCP
+    targetPort: https
+  selector:
+    control-plane: alerts-exporter

config/rbac/kustomization.yaml

@@ -0,0 +1,9 @@
+resources:
+- service_account.yaml
+- role.yaml
+- role_binding.yaml
+
+- auth_proxy_service.yaml
+- auth_proxy_role.yaml
+- auth_proxy_role_binding.yaml
+- auth_proxy_client_clusterrole.yaml

config/rbac/role.yaml

@@ -0,0 +1,10 @@
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: exporter-role
+rules:
+- nonResourceURLs:
+  - /api/v2/alerts
+  verbs:
+  - get

config/rbac/role_binding.yaml

@@ -0,0 +1,18 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  labels:
+    app.kubernetes.io/name: clusterrolebinding
+    app.kubernetes.io/instance: exporter-rolebinding
+    app.kubernetes.io/component: rbac
+    app.kubernetes.io/created-by: alerts-exporter
+    app.kubernetes.io/part-of: alerts-exporter
+    app.kubernetes.io/managed-by: kustomize
+  name: exporter-rolebinding
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: exporter-role
+subjects:
+- kind: ServiceAccount
+  name: alerts-exporter

config/rbac/service_account.yaml

@@ -0,0 +1,11 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  labels:
+    app.kubernetes.io/name: serviceaccount
+    app.kubernetes.io/instance: alerts-exporter
+    app.kubernetes.io/component: rbac
+    app.kubernetes.io/created-by: alerts-exporter
+    app.kubernetes.io/part-of: alerts-exporter
+    app.kubernetes.io/managed-by: kustomize
+  name: alerts-exporter