OperatorConfig CRD supports more of alertmanager_config

cmd/operator/deploy/operator/clusterrole.yaml

@@ -39,6 +39,10 @@ metadata:
 rules:
 - apiGroups: ["", "apps", "admissionregistration.k8s.io", "monitoring.googleapis.com", "certificates.k8s.io"]
   resources:
+# TODO(pintohutch): restrict access to non-CRD resources to select namespaces only.
+# This can also be enforced via watch/list filters of controllers/managers.
+# Ultimately we'll want that enforced here by the kube-apiserver and configured
+# properly at the controller/manager level.
   - deployments
   - podmonitorings
   - podmonitorings/status
@@ -48,6 +52,7 @@ rules:
   - certificatesigningrequests
   - rules
   - operatorconfigs
+  - secrets
   verbs: ["create", "update", "get", "list", "watch", "delete"]
 ---
 apiVersion: rbac.authorization.k8s.io/v1

cmd/operator/deploy/operator/crds.yaml

@@ -284,49 +284,6 @@ spec:
                   description: Alerting contains how the rule-evaluator configures alerting.
                   type: object
                   properties:
-                    alertmanagerConfigs:
-                      description: 'AlertmanagerConfigs contains a list of secret or configmap selectors that can be used to insert complete Alertmanager config specs. Each selector should return a payload that can be unmarshalled to a list of alertmanager_config: https://prometheus.io/docs/prometheus/latest/configuration/configuration/#alertmanager_config.'
-                      type: array
-                      items:
-                        description: 'NamespacedSecretOrConfigMap allows to specify data as a Secret or ConfigMap. Fields are mutually exclusive. Taking inspiration from prometheus-operator: https://github.com/prometheus-operator/prometheus-operator/blob/2c81b0cf6a5673e08057499a08ddce396b19dda4/Documentation/api.md#secretorconfigmap'
-                        type: object
-                        properties:
-                          configMap:
-                            description: ConfigMap containing data to use for the targets.
-                            type: object
-                            required:
-                              - key
-                              - namespace
-                            properties:
-                              key:
-                                description: The key to select.
-                                type: string
-                              name:
-                                description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names TODO: Add other useful fields. apiVersion, kind, uid?'
-                                type: string
-                              namespace:
-                                type: string
-                              optional:
-                                description: Specify whether the ConfigMap or its key must be defined
-                                type: boolean
-                          secret:
-                            description: Secret containing data to use for the targets.
-                            type: object
-                            required:
-                              - key
-                              - namespace
-                            properties:
-                              key:
-                                description: The key of the secret to select from.  Must be a valid secret key.
-                                type: string
-                              name:
-                                description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names TODO: Add other useful fields. apiVersion, kind, uid?'
-                                type: string
-                              namespace:
-                                type: string
-                              optional:
-                                description: Specify whether the Secret or its key must be defined
-                                type: boolean
                     alertmanagers:
                       description: Alertmanagers contains endpoint configuration for designated Alertmanagers.
                       type: array
@@ -496,10 +453,10 @@ spec:
                                 description: Used to verify the hostname for the targets.
                                 type: string
                 labelLocation:
-                  description: LabelLocation is the `location` label value on exported time series generated from recording rules. If left blank, the rule-evaluator will try and fetch the location from the GCE metadata server.
+                  description: 'LabelLocation is the `location` label value on exported time series generated from recording rules. If left blank, the rule-evaluator will try and fetch the location from the GCE metadata server. TODO(pintohutch): promote LabelLocation to OperatorConfig to permit configuration of collectors as well.'
                   type: string
                 labelProjectID:
-                  description: LabelProjectID is the `project_id` label value on exported time series generated from recording rules. If left blank, the rule-evaluator will try and fetch the project ID from the GCE metadata server.
+                  description: 'LabelProjectID is the `project_id` label value on exported time series generated from recording rules. If left blank, the rule-evaluator will try and fetch the project ID from the GCE metadata server. TODO(pintohutch): promote LabelProjectID to OperatorConfig to permit configuration of collectors as well.'
                   type: string
                 projectID:
                   description: ProjectID is the GCP project ID to evaluate rules against. If left blank, the rule-evaluator will try and fetch the project ID from the GCE metadata server.

cmd/rule-evaluator/main.go

@@ -43,6 +43,9 @@ import (
 	"github.com/prometheus/common/model"
 	"github.com/prometheus/prometheus/config"
 	"github.com/prometheus/prometheus/discovery"
+
+	// Import to enable 'kubernetes_sd_configs' to SD config register.
+	_ "github.com/prometheus/prometheus/discovery/kubernetes"
 	"github.com/prometheus/prometheus/notifier"
 	"github.com/prometheus/prometheus/pkg/labels"
 	"github.com/prometheus/prometheus/promql"

pkg/operator/apis/monitoring/v1alpha1/types.go

@@ -84,11 +84,6 @@ type RuleEvaluatorSpec struct {
 type AlertingSpec struct {
 	// Alertmanagers contains endpoint configuration for designated Alertmanagers.
 	Alertmanagers []AlertmanagerEndpoints `json:"alertmanagers,omitempty"`
-	// AlertmanagerConfigs contains a list of secret or configmap selectors
-	// that can be used to insert complete Alertmanager config specs.
-	// Each selector should return a payload that can be unmarshalled to
-	// a list of alertmanager_config: https://prometheus.io/docs/prometheus/latest/configuration/configuration/#alertmanager_config.
-	AlertmanagerConfigs []NamespacedSecretOrConfigMap `json:"alertmanagerConfigs,omitempty"`
 }
 
 // AlertmanagerEndpoints defines a selection of a single Endpoints object

pkg/operator/operator.go

@@ -169,7 +169,7 @@ func New(logger logr.Logger, clientConfig *rest.Config, registry prometheus.Regi
 		return nil, errors.Wrap(err, "build Kubernetes clientset")
 	}
 	// Create temporary directory to store webhook serving cert files.
-	certDir, err := ioutil.TempDir("", "prometheus-engine-operator-certs")
+	certDir, err := ioutil.TempDir("", "operator-cert")
 	if err != nil {
 		return nil, errors.Wrap(err, "create temporary certificate dir")
 	}