Support custom ca

charts/deploy/templates/cluster-ca-bundle-configmap.yaml

@@ -0,0 +1,10 @@
+{{- if .Values.custom_ca }}
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  labels:
+    config.openshift.io/inject-trusted-cabundle: "true"
+  name: cluster-ca-bundle
+  namespace: {{ .Release.Namespace }}
+{{- end }}

charts/deploy/templates/grafana.yaml

@@ -16,36 +16,46 @@ spec:
     auth.anonymous:
       enabled: True
   containers:
-    - args:
-        - '-provider=openshift'
-        - '-pass-basic-auth=false'
-        - '-https-address=:9091'
-        - '-http-address='
-        - '-email-domain=*'
-        - '-upstream=http://localhost:3000'
-        - '-openshift-sar={"resource": "namespaces", "verb": "get"}'
-        - '-openshift-delegate-urls={"/": {"resource": "namespaces", "verb": "get"}}'
-        - '-tls-cert=/etc/tls/private/tls.crt'
-        - '-tls-key=/etc/tls/private/tls.key'
-        - '-client-secret-file=/var/run/secrets/kubernetes.io/serviceaccount/token'
-        - '-cookie-secret-file=/etc/proxy/secrets/session_secret'
-        - '-openshift-service-account=grafana-serviceaccount'
-        - '-openshift-ca=/etc/pki/tls/cert.pem'
-        - '-openshift-ca=/var/run/secrets/kubernetes.io/serviceaccount/ca.crt'
-        - '-skip-auth-regex=^/metrics'
-      image: 'quay.io/openshift/origin-oauth-proxy:4.2'
-      name: grafana-proxy
-      ports:
-        - containerPort: 9091
-          name: grafana-proxy
-      resources: {}
-      volumeMounts:
-        - mountPath: /etc/tls/private
-          name: secret-grafana-k8s-tls
-          readOnly: false
-        - mountPath: /etc/proxy/secrets
-          name: secret-grafana-k8s-proxy
-          readOnly: false
+  - args:
+    - '-provider=openshift'
+    - '-pass-basic-auth=false'
+    - '-https-address=:9091'
+    - '-http-address='
+    - '-email-domain=*'
+    - '-upstream=http://localhost:3000'
+    - '-openshift-sar={"resource": "namespaces", "verb": "get"}'
+    - '-openshift-delegate-urls={"/": {"resource": "namespaces", "verb": "get"}}'
+    - '-tls-cert=/etc/tls/private/tls.crt'
+    - '-tls-key=/etc/tls/private/tls.key'
+    - '-client-secret-file=/var/run/secrets/kubernetes.io/serviceaccount/token'
+    - '-cookie-secret-file=/etc/proxy/secrets/session_secret'
+    - '-openshift-service-account=grafana-serviceaccount'
+    - '-openshift-ca=/etc/pki/tls/cert.pem'
+    - '-openshift-ca=/var/run/secrets/kubernetes.io/serviceaccount/ca.crt'
+{{- if .Values.custom_ca }}
+    - -openshift-ca=/etc/prometheus/configmaps/cluster-ca-bundle/ca-bundle.crt
+{{- end}}
+    - '-skip-auth-regex=^/metrics'
+    image: 'quay.io/openshift/origin-oauth-proxy:4.2'
+    name: grafana-proxy
+    ports:
+      - containerPort: 9091
+        name: grafana-proxy
+    resources: {}
+    volumeMounts:
+      - mountPath: /etc/tls/private
+        name: secret-grafana-k8s-tls
+        readOnly: false
+      - mountPath: /etc/proxy/secrets
+        name: secret-grafana-k8s-proxy
+        readOnly: false
+      - name: configmap-cluster-ca-bundle
+        readOnly: true
+        mountPath: /etc/prometheus/configmaps/cluster-ca-bundle
+{{- if .Values.custom_ca }}
+  configMaps:
+    - cluster-ca-bundle
+{{- end }}
   secrets:
     - grafana-k8s-tls
     - grafana-k8s-proxy

charts/deploy/templates/prometheus-cr.yaml

@@ -21,6 +21,10 @@ spec:
   additionalScrapeConfigs:
     name: additional-scrape-configs
     key: prometheus-additional.yml
+{{- if .Values.custom_ca }}
+  configMaps:
+    - cluster-ca-bundle
+{{- end }}
   secrets:
     - prometheus-pelorus-tls
     - prometheus-pelorus-htpasswd
@@ -41,6 +45,9 @@ spec:
     - -cookie-secret=bacon
     - -openshift-ca=/etc/pki/tls/cert.pem
     - -openshift-ca=/var/run/secrets/kubernetes.io/serviceaccount/ca.crt
+{{- if .Values.custom_ca }}
+    - -openshift-ca=/etc/prometheus/configmaps/cluster-ca-bundle/ca-bundle.crt
+{{- end}}
     - -skip-auth-regex=^/metrics
     image: registry.redhat.io/openshift3/oauth-proxy:v3.11
     name: prometheus-proxy
@@ -59,4 +66,8 @@ spec:
       name: secret-prometheus-pelorus-tls
     - mountPath: /etc/proxy/htpasswd
       name: secret-prometheus-pelorus-htpasswd
+    - name: configmap-cluster-ca-bundle
+      readOnly: true
+      mountPath: /etc/prometheus/configmaps/cluster-ca-bundle
+
 

charts/deploy/values.yaml

@@ -6,6 +6,9 @@ openshift_prometheus_htpasswd_auth: changeme
 openshift_prometheus_basic_auth_pass: changeme
 extra_prometheus_hosts:
 
+# Uncomment this if your cluster serves privately signed certificates
+# custom_ca: true
+
 deployment:
   labels:
     app.kubernetes.io/component: prometheus

docs/Configuration.md

@@ -1,5 +1,20 @@
 # Configuration
 
+## Configuring The Pelorus Stack
+
+The Pelorus stack (Prometheus, Grafana, Thanos, etc.) can be configured by changing the `values.yaml` file that is passed to helm. The recommended practice is to make a copy of the one [provided in this repo](/charts/)deploy/values.yaml), and store in in your own configuration repo for safe keeping, and updating. Once established, you can make configuration changes by updating your `values.yaml` and applying the changes like so:
+
+```
+./runhelm.sh -v myclusterconfigs/pelorus/values.yaml
+```
+
+The following configurations may be made through the `values.yaml` file:
+
+| Variable | Required | Explanation | Default Value |
+|---|---|---|---|
+| `custom_ca` | no | Whether or not the cluster serves custom signed certificates for ingress (e.g. router certs). If `true` we will load the custom via the [certificate injection method](https://docs.openshift.com/container-platform/4.4/networking/configuring-a-custom-pki.html#certificate-injection-using-operators_configuring-a-custom-pki)  | `false`  |
+| `extra_prometheus_hosts` | no | Configures additional prometheus instances for a multi-cluster setup. See [Deploying across multple clusters](/docs/Install.md#deploying-across-multiple-clusters) for details. | Nil |
+
 ## Configuring Exporters
 
 ### Commit Time Exporter

docs/Install.md

@@ -48,7 +48,7 @@ See the [Configuration Guide](/docs/Configuration.md) for more information on ex
 
 ## Customizing Pelorus
 
-The following sections describe the supported customizations that can be made to a Pelorus deployment.
+See [Configuring the Pelorus Stack](/docs/Configuration.md) for a full readout of all possible configuration items. The following sections describe the  most common supported customizations that can be made to a Pelorus deployment.
 
 ### Configure Long Term Storage