Revert ":bug: (kustomize/v2): fix ServiceMonitor with TLS kustomize s…

…caffolding"
kubernetes-sigs · Feb 10, 2025 · b30379c · b30379c
1 parent 338af81
commit b30379c
Show file tree

Hide file tree

Showing 18 changed files with 142 additions and 329 deletions.
diff --git a/docs/book/src/cronjob-tutorial/testdata/project/config/default/kustomization.yaml b/docs/book/src/cronjob-tutorial/testdata/project/config/default/kustomization.yaml
@@ -75,17 +75,6 @@ replacements:
          delimiter: '.'
          index: 0
          create: true
-     - select:
-         kind: ServiceMonitor
-         group: monitoring.coreos.com
-         version: v1
-         name: controller-manager-metrics-monitor
-       fieldPaths:
-         - spec.endpoints.0.tlsConfig.serverName
-       options:
-         delimiter: '.'
-         index: 0
-         create: true
 
  - source:
      kind: Service
@@ -105,17 +94,6 @@ replacements:
          delimiter: '.'
          index: 1
          create: true
-     - select:
-         kind: ServiceMonitor
-         group: monitoring.coreos.com
-         version: v1
-         name: controller-manager-metrics-monitor
-       fieldPaths:
-         - spec.endpoints.0.tlsConfig.serverName
-       options:
-         delimiter: '.'
-         index: 1
-         create: true
 
  - source: # Uncomment the following block if you have any webhook
      kind: Service

diff --git a/docs/book/src/cronjob-tutorial/testdata/project/config/prometheus/monitor_tls_patch.yaml b/docs/book/src/cronjob-tutorial/testdata/project/config/prometheus/monitor_tls_patch.yaml
@@ -1,19 +1,22 @@
 # Patch for Prometheus ServiceMonitor to enable secure TLS configuration
 # using certificates managed by cert-manager
-- op: replace
-  path: /spec/endpoints/0/tlsConfig
-  value:
-    # SERVICE_NAME and SERVICE_NAMESPACE will be substituted by kustomize
-    serverName: SERVICE_NAME.SERVICE_NAMESPACE.svc
-    insecureSkipVerify: false
-    ca:
-      secret:
-        name: metrics-server-cert
-        key: ca.crt
-    cert:
-      secret:
-        name: metrics-server-cert
-        key: tls.crt
-    keySecret:
-      name: metrics-server-cert
-      key: tls.key
+apiVersion: monitoring.coreos.com/v1
+kind: ServiceMonitor
+metadata:
+  name: controller-manager-metrics-monitor
+  namespace: system
+spec:
+  endpoints:
+    - tlsConfig:
+        insecureSkipVerify: false
+        ca:
+          secret:
+            name: metrics-server-cert
+            key: ca.crt
+        cert:
+          secret:
+            name: metrics-server-cert
+            key: tls.crt
+        keySecret:
+          name: metrics-server-cert
+          key: tls.key
diff --git a/docs/book/src/cronjob-tutorial/testdata/project/dist/install.yaml b/docs/book/src/cronjob-tutorial/testdata/project/dist/install.yaml
@@ -4276,11 +4276,7 @@ metadata:
   namespace: project-system
 spec:
   endpoints:
-  - bearerTokenFile: /var/run/secrets/kubernetes.io/serviceaccount/token
-    path: /metrics
-    port: https
-    scheme: https
-    tlsConfig:
+  - tlsConfig:
       ca:
         secret:
           key: ca.crt
@@ -4293,7 +4289,6 @@ spec:
       keySecret:
         key: tls.key
         name: metrics-server-cert
-      serverName: project-controller-manager-metrics-service.project-system.svc
   selector:
     matchLabels:
       app.kubernetes.io/name: project

diff --git a/docs/book/src/getting-started/testdata/project/config/default/kustomization.yaml b/docs/book/src/getting-started/testdata/project/config/default/kustomization.yaml
@@ -75,17 +75,6 @@ patches:
 #         delimiter: '.'
 #         index: 0
 #         create: true
-#     - select:
-#         kind: ServiceMonitor
-#         group: monitoring.coreos.com
-#         version: v1
-#         name: controller-manager-metrics-monitor
-#       fieldPaths:
-#         - spec.endpoints.0.tlsConfig.serverName
-#       options:
-#         delimiter: '.'
-#         index: 0
-#         create: true
 #
 # - source:
 #     kind: Service
@@ -105,17 +94,6 @@ patches:
 #         delimiter: '.'
 #         index: 1
 #         create: true
-#     - select:
-#         kind: ServiceMonitor
-#         group: monitoring.coreos.com
-#         version: v1
-#         name: controller-manager-metrics-monitor
-#       fieldPaths:
-#         - spec.endpoints.0.tlsConfig.serverName
-#       options:
-#         delimiter: '.'
-#         index: 1
-#         create: true
 #
 # - source: # Uncomment the following block if you have any webhook
 #     kind: Service

diff --git a/docs/book/src/getting-started/testdata/project/config/prometheus/monitor_tls_patch.yaml b/docs/book/src/getting-started/testdata/project/config/prometheus/monitor_tls_patch.yaml
@@ -1,19 +1,22 @@
 # Patch for Prometheus ServiceMonitor to enable secure TLS configuration
 # using certificates managed by cert-manager
-- op: replace
-  path: /spec/endpoints/0/tlsConfig
-  value:
-    # SERVICE_NAME and SERVICE_NAMESPACE will be substituted by kustomize
-    serverName: SERVICE_NAME.SERVICE_NAMESPACE.svc
-    insecureSkipVerify: false
-    ca:
-      secret:
-        name: metrics-server-cert
-        key: ca.crt
-    cert:
-      secret:
-        name: metrics-server-cert
-        key: tls.crt
-    keySecret:
-      name: metrics-server-cert
-      key: tls.key
+apiVersion: monitoring.coreos.com/v1
+kind: ServiceMonitor
+metadata:
+  name: controller-manager-metrics-monitor
+  namespace: system
+spec:
+  endpoints:
+    - tlsConfig:
+        insecureSkipVerify: false
+        ca:
+          secret:
+            name: metrics-server-cert
+            key: ca.crt
+        cert:
+          secret:
+            name: metrics-server-cert
+            key: tls.crt
+        keySecret:
+          name: metrics-server-cert
+          key: tls.key
diff --git a/docs/book/src/multiversion-tutorial/testdata/project/config/default/kustomization.yaml b/docs/book/src/multiversion-tutorial/testdata/project/config/default/kustomization.yaml
@@ -75,17 +75,6 @@ replacements:
          delimiter: '.'
          index: 0
          create: true
-     - select:
-         kind: ServiceMonitor
-         group: monitoring.coreos.com
-         version: v1
-         name: controller-manager-metrics-monitor
-       fieldPaths:
-         - spec.endpoints.0.tlsConfig.serverName
-       options:
-         delimiter: '.'
-         index: 0
-         create: true
 
  - source:
      kind: Service
@@ -105,17 +94,6 @@ replacements:
          delimiter: '.'
          index: 1
          create: true
-     - select:
-         kind: ServiceMonitor
-         group: monitoring.coreos.com
-         version: v1
-         name: controller-manager-metrics-monitor
-       fieldPaths:
-         - spec.endpoints.0.tlsConfig.serverName
-       options:
-         delimiter: '.'
-         index: 1
-         create: true
 
  - source: # Uncomment the following block if you have any webhook
      kind: Service

diff --git a/.../book/src/multiversion-tutorial/testdata/project/config/prometheus/monitor_tls_patch.yaml b/.../book/src/multiversion-tutorial/testdata/project/config/prometheus/monitor_tls_patch.yaml
@@ -1,19 +1,22 @@
 # Patch for Prometheus ServiceMonitor to enable secure TLS configuration
 # using certificates managed by cert-manager
-- op: replace
-  path: /spec/endpoints/0/tlsConfig
-  value:
-    # SERVICE_NAME and SERVICE_NAMESPACE will be substituted by kustomize
-    serverName: SERVICE_NAME.SERVICE_NAMESPACE.svc
-    insecureSkipVerify: false
-    ca:
-      secret:
-        name: metrics-server-cert
-        key: ca.crt
-    cert:
-      secret:
-        name: metrics-server-cert
-        key: tls.crt
-    keySecret:
-      name: metrics-server-cert
-      key: tls.key
+apiVersion: monitoring.coreos.com/v1
+kind: ServiceMonitor
+metadata:
+  name: controller-manager-metrics-monitor
+  namespace: system
+spec:
+  endpoints:
+    - tlsConfig:
+        insecureSkipVerify: false
+        ca:
+          secret:
+            name: metrics-server-cert
+            key: ca.crt
+        cert:
+          secret:
+            name: metrics-server-cert
+            key: tls.crt
+        keySecret:
+          name: metrics-server-cert
+          key: tls.key
diff --git a/docs/book/src/multiversion-tutorial/testdata/project/dist/install.yaml b/docs/book/src/multiversion-tutorial/testdata/project/dist/install.yaml
@@ -8122,11 +8122,7 @@ metadata:
   namespace: project-system
 spec:
   endpoints:
-  - bearerTokenFile: /var/run/secrets/kubernetes.io/serviceaccount/token
-    path: /metrics
-    port: https
-    scheme: https
-    tlsConfig:
+  - tlsConfig:
       ca:
         secret:
           key: ca.crt
@@ -8139,7 +8135,6 @@ spec:
       keySecret:
         key: tls.key
         name: metrics-server-cert
-      serverName: project-controller-manager-metrics-service.project-system.svc
   selector:
     matchLabels:
       app.kubernetes.io/name: project

diff --git a/hack/docs/internal/cronjob-tutorial/sample.go b/hack/docs/internal/cronjob-tutorial/sample.go
@@ -52,17 +52,6 @@ const certManagerForMetricsAndWebhooks = `#replacements:
 #         delimiter: '.'
 #         index: 0
 #         create: true
-#     - select:
-#         kind: ServiceMonitor
-#         group: monitoring.coreos.com
-#         version: v1
-#         name: controller-manager-metrics-monitor
-#       fieldPaths:
-#         - spec.endpoints.0.tlsConfig.serverName
-#       options:
-#         delimiter: '.'
-#         index: 0
-#         create: true
 #
 # - source:
 #     kind: Service
@@ -82,17 +71,6 @@ const certManagerForMetricsAndWebhooks = `#replacements:
 #         delimiter: '.'
 #         index: 1
 #         create: true
-#     - select:
-#         kind: ServiceMonitor
-#         group: monitoring.coreos.com
-#         version: v1
-#         name: controller-manager-metrics-monitor
-#       fieldPaths:
-#         - spec.endpoints.0.tlsConfig.serverName
-#       options:
-#         delimiter: '.'
-#         index: 1
-#         create: true
 #
 # - source: # Uncomment the following block if you have any webhook
 #     kind: Service

diff --git a/...plugins/common/kustomize/v2/scaffolds/internal/templates/config/kdefault/kustomization.go b/...plugins/common/kustomize/v2/scaffolds/internal/templates/config/kdefault/kustomization.go
@@ -120,17 +120,6 @@ patches:
 #         delimiter: '.'
 #         index: 0
 #         create: true
-#     - select:
-#         kind: ServiceMonitor
-#         group: monitoring.coreos.com
-#         version: v1
-#         name: controller-manager-metrics-monitor
-#       fieldPaths:
-#         - spec.endpoints.0.tlsConfig.serverName
-#       options:
-#         delimiter: '.'
-#         index: 0
-#         create: true
 #
 # - source:
 #     kind: Service
@@ -150,17 +139,6 @@ patches:
 #         delimiter: '.'
 #         index: 1
 #         create: true
-#     - select:
-#         kind: ServiceMonitor
-#         group: monitoring.coreos.com
-#         version: v1
-#         name: controller-manager-metrics-monitor
-#       fieldPaths:
-#         - spec.endpoints.0.tlsConfig.serverName
-#       options:
-#         delimiter: '.'
-#         index: 1
-#         create: true
 #
 # - source: # Uncomment the following block if you have any webhook
 #     kind: Service

diff --git a/...s/common/kustomize/v2/scaffolds/internal/templates/config/prometheus/monitor_tls_patch.go b/...s/common/kustomize/v2/scaffolds/internal/templates/config/prometheus/monitor_tls_patch.go
@@ -44,21 +44,24 @@ func (f *ServiceMonitorPatch) SetTemplateDefaults() error {
 
 const serviceMonitorPatchTemplate = `# Patch for Prometheus ServiceMonitor to enable secure TLS configuration
 # using certificates managed by cert-manager
-- op: replace
-  path: /spec/endpoints/0/tlsConfig
-  value:
-    # SERVICE_NAME and SERVICE_NAMESPACE will be substituted by kustomize
-    serverName: SERVICE_NAME.SERVICE_NAMESPACE.svc
-    insecureSkipVerify: false
-    ca:
-      secret:
-        name: metrics-server-cert
-        key: ca.crt
-    cert:
-      secret:
-        name: metrics-server-cert
-        key: tls.crt
-    keySecret:
-      name: metrics-server-cert
-      key: tls.key
+apiVersion: monitoring.coreos.com/v1
+kind: ServiceMonitor
+metadata:
+  name: controller-manager-metrics-monitor
+  namespace: system
+spec:
+  endpoints:
+    - tlsConfig:
+        insecureSkipVerify: false
+        ca:
+          secret:
+            name: metrics-server-cert
+            key: ca.crt
+        cert:
+          secret:
+            name: metrics-server-cert
+            key: tls.crt
+        keySecret:
+          name: metrics-server-cert
+          key: tls.key
 `