Merge pull request #1691 from Baarsgaard/helm_log_options

Add logging options to Helm chart

deploy/helm/grafana-operator/README.md

@@ -73,6 +73,9 @@ It's easier to just manage this configuration outside of the operator.
 | imagePullSecrets | list | `[]` | image pull secrets |
 | isOpenShift | bool | `false` | Determines if the target cluster is OpenShift. Additional rbac permissions for routes will be added on OpenShift |
 | leaderElect | bool | `false` | If you want to run multiple replicas of the grafana-operator, this is not recommended. |
+| logging.encoder | string | `"console"` | Log encoding ("console", "json") |
+| logging.level | string | `"info"` | Configure the verbosity of logging ("debug", "error", "info") |
+| logging.time | string | `"rfc3339"` | Time encoding ("epoch", "iso8601", "millis", "nano", "rfc3339", "rfc3339nano") |
 | metricsService.metricsPort | int | `9090` | metrics service port |
 | metricsService.pprofPort | int | `8888` | port for the pprof profiling endpoint |
 | metricsService.type | string | `"ClusterIP"` | metrics service type |
@@ -85,19 +88,21 @@ It's easier to just manage this configuration outside of the operator.
 | priorityClassName | string | `""` | pod priority class name |
 | rbac.create | bool | `true` | Specifies whether to create the ClusterRole and ClusterRoleBinding. If "namespaceScope" is true or "watchNamespaces" is set, this will create Role and RoleBinding instead. |
 | resources | object | `{}` | grafana operator container resources |
-| securityContext | object | `{"capabilities":{"drop":["ALL"]},"readOnlyRootFilesystem":true,"runAsNonRoot":true}` | grafana operator container security context |
+| securityContext.allowPrivilegeEscalation | bool | `false` | Whether to allow privilege escalation |
+| securityContext.capabilities | object | `{"drop":["ALL"]}` | A list of capabilities to drop |
+| securityContext.readOnlyRootFilesystem | bool | `true` | Whether to allow writing to the root filesystem |
+| securityContext.runAsNonRoot | bool | `true` | Whether to require a container to run as a non-root user |
 | serviceAccount.annotations | object | `{}` | Annotations to add to the service account |
 | serviceAccount.create | bool | `true` | Specifies whether a service account should be created |
 | serviceAccount.name | string | `""` | The name of the service account to use. If not set and create is true, a name is generated using the fullname template |
-| serviceMonitor | object | `{"additionalLabels":{},"enabled":false,"interval":"1m","metricRelabelings":[],"relabelings":[],"scrapeTimeout":"10s","targetLabels":[],"telemetryPath":"/metrics"}` | Enable this to use with Prometheus Operator |
 | serviceMonitor.additionalLabels | object | `{}` | Set of labels to transfer from the Kubernetes Service onto the target |
-| serviceMonitor.enabled | bool | `false` | When set true then use a ServiceMonitor to configure scraping |
+| serviceMonitor.enabled | bool | `false` | Whether to create a ServiceMonitor |
 | serviceMonitor.interval | string | `"1m"` | Set how frequently Prometheus should scrape |
 | serviceMonitor.metricRelabelings | list | `[]` | MetricRelabelConfigs to apply to samples before ingestion |
 | serviceMonitor.relabelings | list | `[]` | Set relabel_configs as per https://prometheus.io/docs/prometheus/latest/configuration/configuration/#relabel_config |
 | serviceMonitor.scrapeTimeout | string | `"10s"` | Set timeout for scrape |
 | serviceMonitor.targetLabels | list | `[]` | Set of labels to transfer from the Kubernetes Service onto the target |
 | serviceMonitor.telemetryPath | string | `"/metrics"` | Set path to metrics path |
 | tolerations | list | `[]` | pod tolerations |
-| watchNamespaceSelector | string | `""` | Sets the WATCH_NAMESPACE_SELECTOR environment variable, it defines which namespaces the operator should be listening for based on label and key value pair added on namespace kind. By default it's all namespaces. |
-| watchNamespaces | string | `""` | Sets the WATCH_NAMESPACE environment variable, it defines which namespaces the operator should be listening for. By default it's all namespaces, if you only want to listen for the same namespace as the operator is deployed to look at namespaceScope. |
+| watchNamespaceSelector | string | `""` | Sets the `WATCH_NAMESPACE_SELECTOR` environment variable, it defines which namespaces the operator should be listening for based on a namespace label (e.g. `"environment: dev"`). By default, the operator watches all namespaces. To make it watch only its own namespace, check out `namespaceScope` option instead. |
+| watchNamespaces | string | `""` | Sets the `WATCH_NAMESPACE` environment variable, it defines which namespaces the operator should be listening for (e.g. `"grafana, foo"`). By default, the operator watches all namespaces. To make it watch only its own namespace, check out `namespaceScope` option instead. |

deploy/helm/grafana-operator/templates/deployment.yaml

@@ -58,6 +58,9 @@ spec:
             - --health-probe-bind-address=:8081
             - --metrics-bind-address=0.0.0.0:{{ .Values.metricsService.metricsPort }}
             - --pprof-addr=0.0.0.0:{{ .Values.metricsService.pprofPort }}
+            - --zap-encoder={{ .Values.logging.encoder }}
+            - --zap-log-level={{ .Values.logging.level }}
+            - --zap-time-encoding={{ .Values.logging.time }}
             {{- if .Values.leaderElect }}
             - --leader-elect
             {{- end }}

deploy/helm/grafana-operator/values.yaml

@@ -5,19 +5,27 @@ namespaceScope: false
 # -- If you want to run multiple replicas of the grafana-operator, this is not recommended.
 leaderElect: false
 
-# -- Sets the WATCH_NAMESPACE environment variable,
-# it defines which namespaces the operator should be listening for.
-# By default it's all namespaces, if you only want to listen for the same namespace as the operator is deployed to look at namespaceScope.
+# -- Sets the `WATCH_NAMESPACE` environment variable,
+# it defines which namespaces the operator should be listening for (e.g. `"grafana, foo"`).
+# By default, the operator watches all namespaces. To make it watch only its own namespace, check out `namespaceScope` option instead.
 watchNamespaces: ""
 
-# -- Sets the WATCH_NAMESPACE_SELECTOR environment variable,
-# it defines which namespaces the operator should be listening for based on label and key value pair added on namespace kind.
-# By default it's all namespaces.
+# -- Sets the `WATCH_NAMESPACE_SELECTOR` environment variable,
+# it defines which namespaces the operator should be listening for based on a namespace label (e.g. `"environment: dev"`).
+# By default, the operator watches all namespaces. To make it watch only its own namespace, check out `namespaceScope` option instead.
 watchNamespaceSelector: ""
 
 # -- Determines if the target cluster is OpenShift. Additional rbac permissions for routes will be added on OpenShift
 isOpenShift: false
 
+logging:
+  # -- Log encoding ("console", "json")
+  encoder: console
+  # -- Configure the verbosity of logging ("debug", "error", "info")
+  level: info
+  # -- Time encoding ("epoch", "iso8601", "millis", "nano", "rfc3339", "rfc3339nano")
+  time: rfc3339
+
 # -- Additional environment variables
 env: []
   # -- grafana image, e.g. docker.io/grafana/grafana:9.1.6, overwrites the default grafana image defined in the operator
@@ -77,12 +85,16 @@ podAnnotations: {}
 # -- pod security context
 podSecurityContext: {}
 
-# -- grafana operator container security context
 securityContext:
+  # -- A list of capabilities to drop
   capabilities:
     drop:
       - ALL
+  # -- Whether to allow privilege escalation
+  allowPrivilegeEscalation: false
+  # -- Whether to allow writing to the root filesystem
   readOnlyRootFilesystem: true
+  # -- Whether to require a container to run as a non-root user
   runAsNonRoot: true
 
 # -- grafana operator container resources
@@ -100,9 +112,8 @@ tolerations: []
 # -- pod affinity
 affinity: {}
 
-# -- Enable this to use with Prometheus Operator
 serviceMonitor:
-  # -- When set true then use a ServiceMonitor to configure scraping
+  # -- Whether to create a ServiceMonitor
   enabled: false
   # -- Set of labels to transfer from the Kubernetes Service onto the target
   additionalLabels: {}
@@ -137,4 +148,3 @@ extraObjects: []
 #     dataFrom:
 #     - extract:
 #         key: my-secret-store-secret
-

deploy/kustomize/base/deployment.yaml

@@ -52,7 +52,12 @@ spec:
               cpu: 100m
               memory: 20Mi
           securityContext:
+            capabilities:
+              drop:
+                - ALL
             allowPrivilegeEscalation: false
+            readOnlyRootFilesystem: true
+            runAsNonRoot: true
           volumeMounts:
             - name: dashboards-dir
               mountPath: /tmp/dashboards