Add cluster_id to app_operator_app_info metric, ABS migration, remove PSP support

.abs/main.yaml

@@ -0,0 +1,8 @@
+replace-app-version-with-git: true
+replace-chart-version-with-git: true
+generate-metadata: true
+chart-dir: ./helm/app-exporter
+destination: ./build
+
+# CI overwrites this, check .circleci/config.yaml
+catalog-base-url: https://giantswarm.github.io/control-plane-catalog/

.circleci/config.yml

@@ -1,7 +1,7 @@
 version: 2.1
 
 orbs:
-  architect: giantswarm/architect@5.10.1
+  architect: giantswarm/architect@5.11.1
 
 workflows:
   build:
@@ -28,6 +28,7 @@ workflows:
             - master
     - architect/push-to-app-catalog:
         context: architect
+        executor: app-build-suite
         name: push-to-app-catalog
         app_catalog: control-plane-catalog
         app_catalog_test: control-plane-test-catalog

CHANGELOG.md

@@ -7,9 +7,24 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+### Added
+
+- Add `cluster_id` field to `app_operator_app_info` metrics that contains the value of the `giantswarm.io/cluster` label from the App CR, empty otherwise.
+
+### Removed
+
+- Removed PSP support and thus support for pre v1.25 Kubernetes clusters.
+  - Removed `.global.podSecurityStandards.enforced` Helm value.
+- Removed `.project.branch` and `project.commit` Helm values.
+
 ### Changed
 
-- Remove operatorkit dependency.
+- Bump `architect-orb` to `v5.11.1`.
+- Updated build pipeline to use `app-build-suite`.
+  - Changed value for `application.giantswarm.io/branch` label to point to `.Chart.AppVersion` instead as ABS does not support mangling the templates anymore.
+  - Changed value for `application.giantswarm.io/commit` label to point to `.Chart.AppVersion` instead as ABS does not support mangling the templates anymore.
+- Defaulted `.image.tag` to be an empty string and default that to `.Chart.AppVersion` in the deployment.
+- Removed `operatorkit` dependency.
 
 ## [0.20.0] - 2024-04-30
 

go.mod

@@ -20,6 +20,7 @@ require (
 	github.com/google/go-cmp v0.6.0
 	github.com/prometheus/client_golang v1.20.5
 	github.com/spf13/viper v1.19.0
+	k8s.io/api v0.31.3
 	k8s.io/apimachinery v0.31.3
 	k8s.io/client-go v0.31.3
 	sigs.k8s.io/controller-runtime v0.19.2
@@ -97,7 +98,6 @@ require (
 	gopkg.in/resty.v1 v1.12.0 // indirect
 	gopkg.in/yaml.v2 v2.4.0 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
-	k8s.io/api v0.31.3 // indirect
 	k8s.io/apiextensions-apiserver v0.31.1 // indirect
 	k8s.io/klog/v2 v2.130.1 // indirect
 	k8s.io/kube-openapi v0.0.0-20240228011516-70dd3763d340 // indirect

helm/app-exporter/Chart.yaml

@@ -1,10 +1,10 @@
 apiVersion: "v1"
-appVersion: "[[ .AppVersion ]]"
+appVersion: "0.20.1-dev"
 description: "Chart holding app-exporter."
 home: "https://github.com/giantswarm/app-exporter"
 icon: https://s.giantswarm.io/app-icons/prometheus/1/light.svg
 name: "app-exporter"
-version: "[[ .Version ]]"
+version: "0.20.1-dev"
 annotations:
   application.giantswarm.io/team: "honeybadger"
   config.giantswarm.io/version: 1.x.x

helm/app-exporter/templates/_helpers.tpl

@@ -19,8 +19,8 @@ Common labels
 {{- define "labels.common" -}}
 app: {{ include "name" . | quote }}
 {{ include "labels.selector" . }}
-application.giantswarm.io/branch: {{ .Values.project.branch | replace "#" "-" | replace "/" "-" | replace "." "-" | trunc 63 | trimSuffix "-" | quote }}
-application.giantswarm.io/commit: {{ .Values.project.commit | quote }}
+application.giantswarm.io/branch: {{ .Chart.AppVersion | replace "#" "-" | replace "/" "-" | replace "." "-" | trunc 63 | trimSuffix "-" | quote }}
+application.giantswarm.io/commit: {{ .Chart.AppVersion | quote }}
 app.kubernetes.io/managed-by: {{ .Release.Service | quote }}
 app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
 application.giantswarm.io/team: {{ index .Chart.Annotations "application.giantswarm.io/team" | quote }}
@@ -34,3 +34,14 @@ Selector labels
 app.kubernetes.io/name: {{ include "name" . | quote }}
 app.kubernetes.io/instance: {{ .Release.Name | quote }}
 {{- end -}}
+
+{{/*
+Define image tag.
+*/}}
+{{- define "image.tag" -}}
+{{- if .Values.image.tag }}
+{{- .Values.image.tag }}
+{{- else }}
+{{- .Chart.AppVersion }}
+{{- end }}
+{{- end }}

helm/app-exporter/templates/deployment.yaml

@@ -44,14 +44,16 @@ spec:
         {{- end }}
       containers:
       - name: {{ include "name" . }}
-        image: "{{ .Values.registry.domain }}/{{ .Values.image.name }}:{{ .Values.image.tag }}"
+        image: "{{ .Values.registry.domain }}/{{ .Values.image.name }}:{{ include "image.tag" . }}"
         args:
         - daemon
         - --config.dirs=/var/run/{{ include "name" . }}/configmap/
         - --config.files=config
         volumeMounts:
         - name: {{ include "name" . }}-configmap
           mountPath: /var/run/{{ include "name" . }}/configmap/
+        ports:
+          - containerPort: {{ .Values.config.listenPort }}
         livenessProbe:
           httpGet:
             path: /healthz

helm/app-exporter/templates/rbac.yaml

@@ -40,36 +40,3 @@ roleRef:
   kind: ClusterRole
   name: {{ include "resource.default.name"  . }}
   apiGroup: rbac.authorization.k8s.io
----
-{{- if not (((.Values.global).podSecurityStandards).enforced) }}
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  name: {{ include "resource.psp.name" . }}
-  labels:
-    {{- include "labels.common" . | nindent 4 }}
-rules:
-  - apiGroups:
-      - extensions
-    resources:
-      - podsecuritypolicies
-    verbs:
-      - use
-    resourceNames:
-      - {{ include "resource.psp.name" . }}
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
-  name: {{ include "resource.psp.name" . }}
-  labels:
-    {{- include "labels.common" . | nindent 4 }}
-subjects:
-  - kind: ServiceAccount
-    name: {{ include "resource.default.name"  . }}
-    namespace: {{ include "resource.default.namespace"  . }}
-roleRef:
-  kind: ClusterRole
-  name: {{ include "resource.psp.name" . }}
-  apiGroup: rbac.authorization.k8s.io
-{{- end }}

helm/app-exporter/values.schema.json

@@ -49,19 +49,6 @@
                 }
             }
         },
-        "global": {
-            "type": "object",
-            "properties": {
-                "podSecurityStandards": {
-                    "type": "object",
-                    "properties": {
-                        "enforced": {
-                            "type": "boolean"
-                        }
-                    }
-                }
-            }
-        },
         "image": {
             "type": "object",
             "properties": {
@@ -107,17 +94,6 @@
                 }
             }
         },
-        "project": {
-            "type": "object",
-            "properties": {
-                "branch": {
-                    "type": "string"
-                },
-                "commit": {
-                    "type": "string"
-                }
-            }
-        },
         "provider": {
             "type": "object",
             "properties": {
@@ -154,6 +130,9 @@
                         }
                     }
                 },
+                "readOnlyRootFilesystem": {
+                    "type": "boolean"
+                },
                 "runAsNonRoot": {
                     "type": "boolean"
                 },

helm/app-exporter/values.yaml

@@ -8,7 +8,7 @@ deployment:
 
 image:
   name: "giantswarm/app-exporter"
-  tag: "[[ .Version ]]"
+  tag: ""
 
 registry:
   domain: gsoci.azurecr.io
@@ -23,10 +23,6 @@ pod:
   group:
     id: 1000
 
-project:
-  branch: "[[ .Branch ]]"
-  commit: "[[ .SHA ]]"
-
 config:
   debug: true
   listenPort: 8000
@@ -54,14 +50,11 @@ podSecurityContext:
 
 # Add seccomp profile to container security context
 securityContext:
+  readOnlyRootFilesystem: true
   allowPrivilegeEscalation: false
   capabilities:
     drop:
       - ALL
   runAsNonRoot: true
   seccompProfile:
     type: RuntimeDefault
-
-global:
-  podSecurityStandards:
-    enforced: false

service/collector/app.go

@@ -42,6 +42,7 @@ var (
 			labelUpgradeAvailable,
 			labelVersion,
 			labelVersionMismatch,
+			labelClusterId,
 		},
 		nil,
 	)
@@ -166,9 +167,16 @@ func (a *App) collectAppStatus(ctx context.Context, ch chan<- prometheus.Metric)
 		appSpecVersion := key.Version(app)
 		appStatusVersion := expkey.FormatVersion(app.Status.Version)
 
+		clusterLabel := key.ClusterLabel(app)
+
+		var clusterId string
+		{
+			clusterId = clusterLabel
+		}
+
 		// clusterMissing is true if `giantswarm.io/cluster` label is missing
-		// on the org-namespaced app. Otherwise it's false.
-		clusterMissing := key.IsInOrgNamespace(app) && key.ClusterLabel(app) == ""
+		// on the org-namespaced app. Otherwise, it's false.
+		clusterMissing := key.IsInOrgNamespace(app) && clusterLabel == ""
 
 		// For optional apps in public catalogs we check if an upgrade
 		// is available.
@@ -198,6 +206,7 @@ func (a *App) collectAppStatus(ctx context.Context, ch chan<- prometheus.Metric)
 			// Getting version from spec, not status since the version in the spec is the desired version.
 			appSpecVersion,
 			strconv.FormatBool(appSpecVersion != appStatusVersion),
+			clusterId,
 		)
 
 		if !key.IsAppCordoned(app) {