Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix proxy prometheus configuration and remove ws-manager-bridge role #5828

Merged
merged 4 commits into from
Sep 23, 2021
Merged

Fix proxy prometheus configuration and remove ws-manager-bridge role #5828

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
bc95909
[ws-manager-bridge] Remove duplicated roleRef
aledbf Sep 23, 2021
81af62c
[proxy] Mount Service Account Token
aledbf Sep 23, 2021
72b16ed
Listen on localhost
aledbf Sep 23, 2021
629e858
Fix Caddy prometheus configuration
aledbf Sep 23, 2021
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion chart/templates/proxy-deny-all-allow-explicit-networkpolicy.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -28,7 +28,7 @@ spec:
# Allow prometheus scraping from proxy /metrics endpoint
- ports:
- protocol: TCP
port: 9145
port: 9500
from:
- namespaceSelector:
matchLabels:
Expand Down
28 changes: 27 additions & 1 deletion chart/templates/proxy-deployment.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -51,7 +51,33 @@ spec:
- -c
- "sysctl -w net.core.somaxconn=32768; sysctl -w net.ipv4.ip_local_port_range='1024 65000'"
containers:
{{ include "gitpod.kube-rbac-proxy" $this | indent 6 }}
# TODO: remove once Caddy can listen only in localhost
- name: kube-rbac-proxy
args:
- --v=10
- --logtostderr
- --insecure-listen-address=[$(IP)]:9500
- --upstream=http://127.0.0.1:9545/
env:
- name: IP
valueFrom:
fieldRef:
apiVersion: v1
fieldPath: status.podIP
image: quay.io/brancz/kube-rbac-proxy:v0.11.0
imagePullPolicy: IfNotPresent
ports:
- containerPort: 9500
name: metrics
protocol: TCP
resources:
requests:
cpu: 1m
memory: 30Mi
securityContext:
runAsGroup: 65532
runAsNonRoot: true
runAsUser: 65532
- name: proxy
image: {{ template "gitpod.comp.imageFull" $this }}
{{ include "gitpod.container.imagePullPolicy" $this | indent 8 }}
Expand Down
1 change: 0 additions & 1 deletion chart/templates/proxy-serviceaccount.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,4 +10,3 @@ metadata:
component: proxy
kind: service-account
stage: {{ .Values.installation.stage }}
automountServiceAccountToken: false
4 changes: 0 additions & 4 deletions chart/templates/ws-manager-bridge-rolebinding.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,10 +20,6 @@ roleRef:
kind: ClusterRole
name: {{ .Release.Namespace }}-ns-psp:unprivileged
apiGroup: rbac.authorization.k8s.io
roleRef:
kind: ClusterRole
name: {{ .Release.Namespace }}-kube-rbac-proxy
apiGroup: rbac.authorization.k8s.io

---

Expand Down
3 changes: 2 additions & 1 deletion components/proxy/conf/Caddyfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -131,7 +131,8 @@
respond /ready 200
}

127.0.0.1:9500 {
# TODO: refactor once we can listen only in localhost
:9545 {
metrics /metrics {
disable_openmetrics
}
Expand Down