Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

operator: Expose only an HTTPS gateway when in openshift-logging mode #6288

Merged
merged 7 commits into from
Jun 10, 2022
Merged

operator: Expose only an HTTPS gateway when in openshift-logging mode #6288

Show file tree
Hide file tree
Changes from 2 commits
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
c50f700
expose only an HTTPS gateway when in openshift-logging mode
Jun 3, 2022
0ff1de3
typo fix
aminesnow Jun 7, 2022
880800e
fixes
Jun 8, 2022
8da4e55
Merge branch 'gateway-route-https' of github.com:aminesnow/loki into …
Jun 8, 2022
c77ad79
typo fixes
Jun 8, 2022
74e8d4d
refactor
Jun 9, 2022
6ac2571
typo
Jun 9, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions operator/CHANGELOG.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,7 @@
## Main

- [6195](https://github.com/grafana/loki/pull/6195) **periklis**: Add ruler config support
- [6288](https://github.com/grafana/loki/pull/6288) **aminesnow**: Expose only an HTTPS gateway when in openshift mode
aminesnow marked this conversation as resolved.
Show resolved Hide resolved
- [6198](https://github.com/grafana/loki/pull/6198) **periklis**: Add support for custom S3 CA
- [6199](https://github.com/grafana/loki/pull/6199) **Red-GV**: Update GCP secret volume path
- [6125](https://github.com/grafana/loki/pull/6125) **sasagarw**: Add method to get authenticated from GCP
Expand Down
8 changes: 5 additions & 3 deletions operator/hack/addons_ocp.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -37,12 +37,12 @@ spec:
- name: LOKI_ORG_ID
value: application
- name: LOKI_ADDR
value: http://lokistack-dev-gateway-http.openshift-logging.svc:8080/api/logs/v1/application
value: https://lokistack-dev-gateway-http.openshift-logging.svc:8080/api/logs/v1/application
- name: LOKI_BEARER_TOKEN_FILE
value: /var/run/secrets/kubernetes.io/serviceaccount/token
args:
- -c
- while true; do logcli query '{job="systemd-journal"}'; sleep 30; done
- while true; do logcli --ca-cert="/var/run/secrets/kubernetes.io/serviceaccount/service-ca.crt" query '{job="systemd-journal"}'; sleep 30; done
serviceAccountName: lokistack-dev-addons-logcli
---
apiVersion: apps/v1
Expand Down Expand Up @@ -118,7 +118,9 @@ metadata:
data:
promtail.yaml: |
clients:
- url: http://lokistack-dev-gateway-http.openshift-logging.svc:8080/api/logs/v1/application/loki/api/v1/push
- url: https://lokistack-dev-gateway-http.openshift-logging.svc:8080/api/logs/v1/application/loki/api/v1/push
aminesnow marked this conversation as resolved.
Show resolved Hide resolved
tls_config:
ca_file: /var/run/secrets/kubernetes.io/serviceaccount/service-ca.crt
tenant_id: application
bearer_token_file: /var/run/secrets/kubernetes.io/serviceaccount/token
backoff_config:
Expand Down
1 change: 1 addition & 0 deletions operator/hack/lokistack_gateway_ocp.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,6 +2,7 @@ apiVersion: loki.grafana.com/v1beta1
kind: LokiStack
metadata:
name: lokistack-dev
namespace: openshift-logging
spec:
size: 1x.extra-small
storage:
Expand Down
2 changes: 1 addition & 1 deletion operator/internal/manifests/build_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -263,7 +263,7 @@ func TestBuildAll_WithFeatureFlags_EnableTLSServiceMonitorConfig(t *testing.T) {
continue
}

secretName := fmt.Sprintf("%s-http-metrics", name)
secretName := fmt.Sprintf("%s-http-tls", name)
periklis marked this conversation as resolved.
Show resolved Hide resolved
expVolume := corev1.Volume{
Name: secretName,
VolumeSource: corev1.VolumeSource{
Expand Down
11 changes: 7 additions & 4 deletions operator/internal/manifests/gateway.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,7 +20,7 @@ import (
)

const (
tlsMetricsSercetVolume = "tls-metrics-secret"
tlsSecretVolume = "tls-secret"
)

// BuildGateway returns a list of k8s objects for Loki Stack Gateway
Expand Down Expand Up @@ -49,7 +49,7 @@ func BuildGateway(opts Options) ([]client.Object, error) {

if opts.Stack.Tenants != nil {
mode := opts.Stack.Tenants.Mode
if err := configureDeploymentForMode(dpl, mode, opts.Flags); err != nil {
if err := configureDeploymentForMode(dpl, mode, opts.Flags, opts.Name, opts.Namespace); err != nil {
return nil, err
}

Expand All @@ -58,6 +58,9 @@ func BuildGateway(opts Options) ([]client.Object, error) {
}

objs = configureGatewayObjsForMode(objs, opts)
if err != nil {
return nil, err
}
aminesnow marked this conversation as resolved.
Show resolved Hide resolved
}

return objs, nil
Expand Down Expand Up @@ -356,7 +359,7 @@ func configureGatewayMetricsPKI(podSpec *corev1.PodSpec, serviceName string) err
secretVolumeSpec := corev1.PodSpec{
Volumes: []corev1.Volume{
{
Name: tlsMetricsSercetVolume,
Name: tlsSercetVolume,
VolumeSource: corev1.VolumeSource{
Secret: &corev1.SecretVolumeSource{
SecretName: secretName,
Expand All @@ -368,7 +371,7 @@ func configureGatewayMetricsPKI(podSpec *corev1.PodSpec, serviceName string) err
secretContainerSpec := corev1.Container{
VolumeMounts: []corev1.VolumeMount{
{
Name: tlsMetricsSercetVolume,
Name: tlsSercetVolume,
ReadOnly: true,
MountPath: gateway.LokiGatewayTLSDir,
},
Expand Down
11 changes: 9 additions & 2 deletions operator/internal/manifests/gateway_tenants.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -56,22 +56,29 @@ func ApplyGatewayDefaultOptions(opts *Options) error {
return nil
}

func configureDeploymentForMode(d *appsv1.Deployment, mode lokiv1beta1.ModeType, flags FeatureFlags) error {
func configureDeploymentForMode(d *appsv1.Deployment, mode lokiv1beta1.ModeType, flags FeatureFlags, name, ns string) error {
aminesnow marked this conversation as resolved.
Show resolved Hide resolved
switch mode {
case lokiv1beta1.Static, lokiv1beta1.Dynamic:
return nil // nothing to configure
case lokiv1beta1.OpenshiftLogging:
serviceName := serviceNameGatewayHTTP(name)
secretName := signingServiceSecretName(serviceName)
serverName := fqdn(serviceName, ns)
return openshift.ConfigureGatewayDeployment(
d,
gatewayContainerName,
tlsMetricsSercetVolume,
tlsSercetVolume,
gateway.LokiGatewayTLSDir,
gateway.LokiGatewayCertFile,
gateway.LokiGatewayKeyFile,
gateway.LokiGatewayCABundleDir,
gateway.LokiGatewayCAFile,
flags.EnableTLSServiceMonitorConfig,
flags.EnableCertificateSigningService,
secretName,
serviceName,
serverName,
gatewayHTTPPort,
)
}

Expand Down
136 changes: 131 additions & 5 deletions operator/internal/manifests/gateway_tenants_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,7 @@
package manifests

import (
"fmt"
"testing"

monitoringv1 "github.com/prometheus-operator/prometheus-operator/pkg/apis/monitoring/v1"
Expand Down Expand Up @@ -184,6 +185,8 @@ func TestConfigureDeploymentForMode(t *testing.T) {
dpl *appsv1.Deployment
want *appsv1.Deployment
}
name := "test"
ns := "test-ns"
aminesnow marked this conversation as resolved.
Show resolved Hide resolved

tc := []tt{
{
Expand All @@ -199,9 +202,13 @@ func TestConfigureDeploymentForMode(t *testing.T) {
want: &appsv1.Deployment{},
},
{

desc: "openshift-logging mode",
mode: lokiv1beta1.OpenshiftLogging,
dpl: &appsv1.Deployment{
ObjectMeta: metav1.ObjectMeta{
Namespace: ns,
},
Spec: appsv1.DeploymentSpec{
Template: corev1.PodTemplateSpec{
Spec: corev1.PodSpec{
Expand All @@ -220,6 +227,9 @@ func TestConfigureDeploymentForMode(t *testing.T) {
},
},
want: &appsv1.Deployment{
ObjectMeta: metav1.ObjectMeta{
Namespace: ns,
},
Spec: appsv1.DeploymentSpec{
Template: corev1.PodTemplateSpec{
Spec: corev1.PodSpec{
Expand All @@ -230,6 +240,32 @@ func TestConfigureDeploymentForMode(t *testing.T) {
"--logs.read.endpoint=http://example.com",
"--logs.tail.endpoint=http://example.com",
"--logs.write.endpoint=http://example.com",
"--tls.server.cert-file=/var/run/tls/tls.crt",
"--tls.server.key-file=/var/run/tls/tls.key",
"--tls.healthchecks.server-ca-file=/var/run/ca/service-ca.crt",
fmt.Sprintf("--tls.healthchecks.server-name=%s", "test-gateway-http.test-ns.svc.cluster.local"),
fmt.Sprintf("--web.healthchecks.url=https://localhost:%d", gatewayHTTPPort),
},
VolumeMounts: []corev1.VolumeMount{
{
Name: tlsSercetVolume,
ReadOnly: true,
MountPath: gateway.LokiGatewayTLSDir,
},
},
ReadinessProbe: &corev1.Probe{
ProbeHandler: corev1.ProbeHandler{
HTTPGet: &corev1.HTTPGetAction{
Scheme: corev1.URISchemeHTTPS,
},
},
},
LivenessProbe: &corev1.Probe{
ProbeHandler: corev1.ProbeHandler{
HTTPGet: &corev1.HTTPGetAction{
Scheme: corev1.URISchemeHTTPS,
},
},
},
},
{
Expand Down Expand Up @@ -284,6 +320,16 @@ func TestConfigureDeploymentForMode(t *testing.T) {
},
},
},
Volumes: []corev1.Volume{
{
Name: tlsSercetVolume,
VolumeSource: corev1.VolumeSource{
Secret: &corev1.SecretVolumeSource{
SecretName: "test-gateway-http-tls",
},
},
},
},
},
},
},
Expand All @@ -296,6 +342,9 @@ func TestConfigureDeploymentForMode(t *testing.T) {
EnableTLSServiceMonitorConfig: true,
},
dpl: &appsv1.Deployment{
ObjectMeta: metav1.ObjectMeta{
Namespace: ns,
},
Spec: appsv1.DeploymentSpec{
Template: corev1.PodTemplateSpec{
Spec: corev1.PodSpec{
Expand All @@ -307,13 +356,33 @@ func TestConfigureDeploymentForMode(t *testing.T) {
"--logs.tail.endpoint=http://example.com",
"--logs.write.endpoint=http://example.com",
},
VolumeMounts: []corev1.VolumeMount{
{
Name: tlsSercetVolume,
ReadOnly: true,
MountPath: gateway.LokiGatewayTLSDir,
},
},
},
},
Volumes: []corev1.Volume{
{
Name: tlsSercetVolume,
VolumeSource: corev1.VolumeSource{
Secret: &corev1.SecretVolumeSource{
SecretName: "test-gateway-http-tls",
},
},
},
},
},
},
},
},
want: &appsv1.Deployment{
ObjectMeta: metav1.ObjectMeta{
Namespace: ns,
},
Spec: appsv1.DeploymentSpec{
Template: corev1.PodTemplateSpec{
Spec: corev1.PodSpec{
Expand All @@ -324,6 +393,32 @@ func TestConfigureDeploymentForMode(t *testing.T) {
"--logs.read.endpoint=http://example.com",
"--logs.tail.endpoint=http://example.com",
"--logs.write.endpoint=http://example.com",
"--tls.server.cert-file=/var/run/tls/tls.crt",
"--tls.server.key-file=/var/run/tls/tls.key",
"--tls.healthchecks.server-ca-file=/var/run/ca/service-ca.crt",
fmt.Sprintf("--tls.healthchecks.server-name=%s", "test-gateway-http.test-ns.svc.cluster.local"),
fmt.Sprintf("--web.healthchecks.url=https://localhost:%d", gatewayHTTPPort),
},
VolumeMounts: []corev1.VolumeMount{
{
Name: tlsSercetVolume,
ReadOnly: true,
MountPath: gateway.LokiGatewayTLSDir,
},
},
ReadinessProbe: &corev1.Probe{
ProbeHandler: corev1.ProbeHandler{
HTTPGet: &corev1.HTTPGetAction{
Scheme: corev1.URISchemeHTTPS,
},
},
},
LivenessProbe: &corev1.Probe{
ProbeHandler: corev1.ProbeHandler{
HTTPGet: &corev1.HTTPGetAction{
Scheme: corev1.URISchemeHTTPS,
},
},
},
},
{
Expand Down Expand Up @@ -380,13 +475,23 @@ func TestConfigureDeploymentForMode(t *testing.T) {
},
VolumeMounts: []corev1.VolumeMount{
{
Name: tlsMetricsSercetVolume,
Name: tlsSercetVolume,
ReadOnly: true,
MountPath: gateway.LokiGatewayTLSDir,
},
},
},
},
Volumes: []corev1.Volume{
{
Name: tlsSercetVolume,
VolumeSource: corev1.VolumeSource{
Secret: &corev1.SecretVolumeSource{
SecretName: "test-gateway-http-tls",
},
},
},
},
},
},
},
Expand All @@ -401,7 +506,8 @@ func TestConfigureDeploymentForMode(t *testing.T) {
},
dpl: &appsv1.Deployment{
ObjectMeta: metav1.ObjectMeta{
Name: "gateway",
Name: "gateway",
Namespace: ns,
},
Spec: appsv1.DeploymentSpec{
Template: corev1.PodTemplateSpec{
Expand Down Expand Up @@ -435,7 +541,8 @@ func TestConfigureDeploymentForMode(t *testing.T) {
},
want: &appsv1.Deployment{
ObjectMeta: metav1.ObjectMeta{
Name: "gateway",
Name: "gateway",
Namespace: ns,
},
Spec: appsv1.DeploymentSpec{
Template: corev1.PodTemplateSpec{
Expand All @@ -450,6 +557,11 @@ func TestConfigureDeploymentForMode(t *testing.T) {
"--logs.tail.endpoint=https://example.com",
"--logs.write.endpoint=https://example.com",
"--logs.tls.ca-file=/var/run/ca/service-ca.crt",
"--tls.server.cert-file=/var/run/tls/tls.crt",
"--tls.server.key-file=/var/run/tls/tls.key",
"--tls.healthchecks.server-ca-file=/var/run/ca/service-ca.crt",
fmt.Sprintf("--tls.healthchecks.server-name=%s", "test-gateway-http.test-ns.svc.cluster.local"),
fmt.Sprintf("--web.healthchecks.url=https://localhost:%d", gatewayHTTPPort),
},
VolumeMounts: []corev1.VolumeMount{
{
Expand All @@ -463,6 +575,20 @@ func TestConfigureDeploymentForMode(t *testing.T) {
MountPath: "/var/run/ca",
},
},
ReadinessProbe: &corev1.Probe{
ProbeHandler: corev1.ProbeHandler{
HTTPGet: &corev1.HTTPGetAction{
Scheme: corev1.URISchemeHTTPS,
},
},
},
LivenessProbe: &corev1.Probe{
ProbeHandler: corev1.ProbeHandler{
HTTPGet: &corev1.HTTPGetAction{
Scheme: corev1.URISchemeHTTPS,
},
},
},
},
{
Name: "opa",
Expand Down Expand Up @@ -518,7 +644,7 @@ func TestConfigureDeploymentForMode(t *testing.T) {
},
VolumeMounts: []corev1.VolumeMount{
{
Name: tlsMetricsSercetVolume,
Name: tlsSercetVolume,
ReadOnly: true,
MountPath: gateway.LokiGatewayTLSDir,
},
Expand Down Expand Up @@ -551,7 +677,7 @@ func TestConfigureDeploymentForMode(t *testing.T) {
tc := tc
t.Run(tc.desc, func(t *testing.T) {
t.Parallel()
err := configureDeploymentForMode(tc.dpl, tc.mode, tc.flags)
err := configureDeploymentForMode(tc.dpl, tc.mode, tc.flags, name, ns)
require.NoError(t, err)
require.Equal(t, tc.want, tc.dpl)
})
Expand Down
Loading