Skip to content

Commit 19e1b7c

Browse files
metalmatzemetalmatze
committed
Create jsonnet-based Kubernetes example with cert-manager
1 parent 245c645 commit 19e1b7c

26 files changed

+809
-0
lines changed

‎examples/kubernetes/main-webhook.jsonnet

Lines changed: 117 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,117 @@
1+
// This example is super close to the kube-prometheus structure.
2+
// It's just simplified to be standalone. kube-prometheus packs the entire monitoring stack, including Prometheus.
3+
// Additionally, it adds the necessary objects to enable validating webhooks with cert-manager.
4+
local kp =
5+
(import '../../jsonnet/pyrra/kubernetes.libsonnet') +
6+
{
7+
values+:: {
8+
common+: {
9+
namespace: 'monitoring',
10+
versions+: {
11+
pyrra: '0.7.0-rc.0',
12+
},
13+
},
14+
},
15+
16+
pyrra+: {
17+
// We add the additional necessary configuration to mount the self-signed certiciate via a Kubernetes secret.
18+
// This certificate is used to serve the webhook http server.
19+
kubernetesDeployment+: {
20+
spec+: {
21+
template+: {
22+
spec+: {
23+
containers: [
24+
c {
25+
args+: [
26+
'--disable-webhooks=false',
27+
],
28+
volumeMounts+: [{
29+
name: 'certs',
30+
mountPath: '/tmp/k8s-webhook-server/serving-certs',
31+
}],
32+
}
33+
for c in super.containers
34+
],
35+
volumes+: [{
36+
name: 'certs',
37+
secret: {
38+
secretName: 'pyrra-webhook-validation',
39+
},
40+
}],
41+
},
42+
},
43+
},
44+
},
45+
46+
// This webhook tells the Kubernetes API server which objects to validate
47+
// and where to send the validation webhooks to.
48+
webhook: {
49+
apiVersion: 'admissionregistration.k8s.io/v1',
50+
kind: 'ValidatingWebhookConfiguration',
51+
metadata: {
52+
name: 'validating-webhook-configuration',
53+
annotations: {
54+
'cert-manager.io/inject-ca-from': 'monitoring/pyrra-webhook-validation',
55+
},
56+
},
57+
webhooks: [
58+
{
59+
admissionReviewVersions: ['v1'],
60+
clientConfig: {
61+
service: {
62+
name: 'pyrra-kubernetes',
63+
namespace: $.pyrra._config.namespace,
64+
path: '/validate-pyrra-dev-v1alpha1-servicelevelobjective',
65+
port: 9443,
66+
},
67+
},
68+
failurePolicy: 'Fail',
69+
name: 'slo.pyrra.dev-servicelevelobjectives',
70+
rules: [
71+
{
72+
apiGroups: ['pyrra.dev'],
73+
apiVersions: ['v1alpha1'],
74+
operations: ['CREATE', 'UPDATE'],
75+
resources: ['servicelevelobjectives'],
76+
},
77+
],
78+
sideEffects: 'None',
79+
},
80+
],
81+
},
82+
83+
// This certificate requests a self-signed certificate from cert-manager to be written to a Kubernetes secret.
84+
certificate: {
85+
apiVersion: 'cert-manager.io/v1',
86+
kind: 'Certificate',
87+
metadata: {
88+
name: 'pyrra-webhook-validation',
89+
namespace: $.pyrra._config.namespace,
90+
},
91+
spec: {
92+
dnsNames: ['pyrra-kubernetes.%s.svc' % $.pyrra._config.namespace],
93+
issuerRef: {
94+
name: 'selfsigned',
95+
},
96+
secretName: 'pyrra-webhook-validation',
97+
},
98+
},
99+
100+
// This issuer creates self-signed certificates if requested.
101+
issuer: {
102+
apiVersion: 'cert-manager.io/v1',
103+
kind: 'Issuer',
104+
metadata: {
105+
name: 'selfsigned',
106+
namespace: 'monitoring',
107+
},
108+
spec: {
109+
selfSigned: {},
110+
},
111+
},
112+
},
113+
};
114+
115+
{ 'setup/pyrra-slo-CustomResourceDefinition': kp.pyrra.crd } +
116+
{ ['pyrra-' + name]: kp.pyrra[name] for name in std.objectFields(kp.pyrra) if name != 'crd' && !std.startsWith(name, 'slo-') }
117+
{ ['slos/' + name]: kp.pyrra[name] for name in std.objectFields(kp.pyrra) if std.startsWith(name, 'slo-') }

‎examples/kubernetes/manifests-webhook/pyrra-apiDeployment.yaml

Lines changed: 43 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,43 @@
1+
apiVersion: apps/v1
2+
kind: Deployment
3+
metadata:
4+
labels:
5+
app.kubernetes.io/component: api
6+
app.kubernetes.io/name: pyrra
7+
app.kubernetes.io/part-of: kube-prometheus
8+
app.kubernetes.io/version: 0.7.0-rc.0
9+
name: pyrra-api
10+
namespace: monitoring
11+
spec:
12+
replicas: 1
13+
selector:
14+
matchLabels:
15+
app.kubernetes.io/component: api
16+
app.kubernetes.io/name: pyrra
17+
app.kubernetes.io/part-of: kube-prometheus
18+
strategy:
19+
rollingUpdate:
20+
maxSurge: 1
21+
maxUnavailable: 1
22+
template:
23+
metadata:
24+
labels:
25+
app.kubernetes.io/component: api
26+
app.kubernetes.io/name: pyrra
27+
app.kubernetes.io/part-of: kube-prometheus
28+
app.kubernetes.io/version: 0.7.0-rc.0
29+
spec:
30+
containers:
31+
- args:
32+
- api
33+
- --api-url=http://pyrra-kubernetes.monitoring.svc.cluster.local:9444
34+
- --prometheus-url=http://prometheus-k8s.monitoring.svc.cluster.local:9090
35+
image: ghcr.io/pyrra-dev/pyrra:v0.7.0-rc.0
36+
name: pyrra
37+
ports:
38+
- containerPort: 9099
39+
securityContext:
40+
allowPrivilegeEscalation: false
41+
readOnlyRootFilesystem: true
42+
nodeSelector:
43+
kubernetes.io/os: linux

‎examples/kubernetes/manifests-webhook/pyrra-apiService.yaml

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
apiVersion: v1
2+
kind: Service
3+
metadata:
4+
labels:
5+
app.kubernetes.io/component: api
6+
app.kubernetes.io/name: pyrra
7+
app.kubernetes.io/part-of: kube-prometheus
8+
app.kubernetes.io/version: 0.7.0-rc.0
9+
name: pyrra-api
10+
namespace: monitoring
11+
spec:
12+
ports:
13+
- name: http
14+
port: 9099
15+
targetPort: 9099
16+
selector:
17+
app.kubernetes.io/component: api
18+
app.kubernetes.io/name: pyrra
19+
app.kubernetes.io/part-of: kube-prometheus

‎examples/kubernetes/manifests-webhook/pyrra-certificate.yaml

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
apiVersion: cert-manager.io/v1
2+
kind: Certificate
3+
metadata:
4+
name: pyrra-webhook-validation
5+
namespace: monitoring
6+
spec:
7+
dnsNames:
8+
- pyrra-kubernetes.monitoring.svc
9+
issuerRef:
10+
name: selfsigned
11+
secretName: pyrra-webhook-validation

‎examples/kubernetes/manifests-webhook/pyrra-issuer.yaml

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
apiVersion: cert-manager.io/v1
2+
kind: Issuer
3+
metadata:
4+
name: selfsigned
5+
namespace: monitoring
6+
spec:
7+
selfSigned: {}

‎examples/kubernetes/manifests-webhook/pyrra-kubernetesClusterRole.yaml

Lines changed: 49 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,49 @@
1+
apiVersion: rbac.authorization.k8s.io/v1
2+
kind: ClusterRole
3+
metadata:
4+
labels:
5+
app.kubernetes.io/component: kubernetes
6+
app.kubernetes.io/name: pyrra
7+
app.kubernetes.io/part-of: kube-prometheus
8+
app.kubernetes.io/version: 0.7.0-rc.0
9+
name: pyrra-kubernetes
10+
namespace: monitoring
11+
rules:
12+
- apiGroups:
13+
- monitoring.coreos.com
14+
resources:
15+
- prometheusrules
16+
verbs:
17+
- create
18+
- delete
19+
- get
20+
- list
21+
- patch
22+
- update
23+
- watch
24+
- apiGroups:
25+
- monitoring.coreos.com
26+
resources:
27+
- prometheusrules/status
28+
verbs:
29+
- get
30+
- apiGroups:
31+
- pyrra.dev
32+
resources:
33+
- servicelevelobjectives
34+
verbs:
35+
- create
36+
- delete
37+
- get
38+
- list
39+
- patch
40+
- update
41+
- watch
42+
- apiGroups:
43+
- pyrra.dev
44+
resources:
45+
- servicelevelobjectives/status
46+
verbs:
47+
- get
48+
- patch
49+
- update

‎examples/kubernetes/manifests-webhook/pyrra-kubernetesClusterRoleBinding.yaml

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
apiVersion: rbac.authorization.k8s.io/v1
2+
kind: ClusterRoleBinding
3+
metadata:
4+
labels:
5+
app.kubernetes.io/component: kubernetes
6+
app.kubernetes.io/name: pyrra
7+
app.kubernetes.io/part-of: kube-prometheus
8+
app.kubernetes.io/version: 0.7.0-rc.0
9+
name: pyrra-kubernetes
10+
namespace: monitoring
11+
roleRef:
12+
apiGroup: rbac.authorization.k8s.io
13+
kind: ClusterRole
14+
name: pyrra-kubernetes
15+
subjects:
16+
- kind: ServiceAccount
17+
name: pyrra-kubernetes
18+
namespace: monitoring

‎examples/kubernetes/manifests-webhook/pyrra-kubernetesDeployment.yaml

Lines changed: 50 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,50 @@
1+
apiVersion: apps/v1
2+
kind: Deployment
3+
metadata:
4+
labels:
5+
app.kubernetes.io/component: kubernetes
6+
app.kubernetes.io/name: pyrra
7+
app.kubernetes.io/part-of: kube-prometheus
8+
app.kubernetes.io/version: 0.7.0-rc.0
9+
name: pyrra-kubernetes
10+
namespace: monitoring
11+
spec:
12+
replicas: 1
13+
selector:
14+
matchLabels:
15+
app.kubernetes.io/component: kubernetes
16+
app.kubernetes.io/name: pyrra
17+
app.kubernetes.io/part-of: kube-prometheus
18+
strategy:
19+
rollingUpdate:
20+
maxSurge: 1
21+
maxUnavailable: 1
22+
template:
23+
metadata:
24+
labels:
25+
app.kubernetes.io/component: kubernetes
26+
app.kubernetes.io/name: pyrra
27+
app.kubernetes.io/part-of: kube-prometheus
28+
app.kubernetes.io/version: 0.7.0-rc.0
29+
spec:
30+
containers:
31+
- args:
32+
- kubernetes
33+
- --disable-webhooks=false
34+
image: ghcr.io/pyrra-dev/pyrra:v0.7.0-rc.0
35+
name: pyrra
36+
ports:
37+
- containerPort: 9099
38+
securityContext:
39+
allowPrivilegeEscalation: false
40+
readOnlyRootFilesystem: true
41+
volumeMounts:
42+
- mountPath: /tmp/k8s-webhook-server/serving-certs
43+
name: certs
44+
nodeSelector:
45+
kubernetes.io/os: linux
46+
serviceAccountName: pyrra-kubernetes
47+
volumes:
48+
- name: certs
49+
secret:
50+
secretName: pyrra-webhook-validation

‎examples/kubernetes/manifests-webhook/pyrra-kubernetesService.yaml

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
apiVersion: v1
2+
kind: Service
3+
metadata:
4+
labels:
5+
app.kubernetes.io/component: kubernetes
6+
app.kubernetes.io/name: pyrra
7+
app.kubernetes.io/part-of: kube-prometheus
8+
app.kubernetes.io/version: 0.7.0-rc.0
9+
name: pyrra-kubernetes
10+
namespace: monitoring
11+
spec:
12+
ports:
13+
- name: http
14+
port: 9444
15+
targetPort: 9444
16+
- name: webhooks
17+
port: 9443
18+
targetPort: 9443
19+
selector:
20+
app.kubernetes.io/component: kubernetes
21+
app.kubernetes.io/name: pyrra
22+
app.kubernetes.io/part-of: kube-prometheus

‎examples/kubernetes/manifests-webhook/pyrra-kubernetesServiceAccount.yaml

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
apiVersion: v1
2+
kind: ServiceAccount
3+
metadata:
4+
labels:
5+
app.kubernetes.io/component: kubernetes
6+
app.kubernetes.io/name: pyrra
7+
app.kubernetes.io/part-of: kube-prometheus
8+
app.kubernetes.io/version: 0.7.0-rc.0
9+
name: pyrra-kubernetes
10+
namespace: monitoring

‎examples/kubernetes/manifests-webhook/pyrra-webhook.yaml

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
apiVersion: admissionregistration.k8s.io/v1
2+
kind: ValidatingWebhookConfiguration
3+
metadata:
4+
annotations:
5+
cert-manager.io/inject-ca-from: monitoring/pyrra-webhook-validation
6+
name: validating-webhook-configuration
7+
webhooks:
8+
- admissionReviewVersions:
9+
- v1
10+
clientConfig:
11+
service:
12+
name: pyrra-kubernetes
13+
namespace: monitoring
14+
path: /validate-pyrra-dev-v1alpha1-servicelevelobjective
15+
port: 9443
16+
failurePolicy: Fail
17+
name: slo.pyrra.dev-servicelevelobjectives
18+
rules:
19+
- apiGroups:
20+
- pyrra.dev
21+
apiVersions:
22+
- v1alpha1
23+
operations:
24+
- CREATE
25+
- UPDATE
26+
resources:
27+
- servicelevelobjectives
28+
sideEffects: None

0 commit comments

Comments
 (0)