MIgrating form helm chart to operator - questions

[grzesuav]

Hi, I am trying to migrate from chelm chart to use operator, I have cryostat cr

apiVersion: operator.cryostat.io/v1beta2
kind: Cryostat
metadata:
  annotations:
    argocd.argoproj.io/tracking-id: >-
      argocd-compute_cryostat-cr-staging:operator.cryostat.io/Cryostat:compute-platform-observability/cryostat-main
  name: cryostat-main
  namespace: compute-platform-observability
spec:
  enableCertManager: true
  eventTemplates: []
  operandMetadata:
    podMetadata:
      annotations:
        sidecar.istio.io/inject: 'false'
  reportOptions:
    replicas: 0
  resources:
    coreResources:
      requests:
        memory: 1Gi
    dataSourceResources:
      requests:
        memory: 700Mi
...
  serviceOptions:
    coreConfig:
      httpPort: 8181
      serviceType: ClusterIP
  storageOptions:
    pvc:
      annotations: {}
      labels: {}
      spec:
        accessModes:
          - ReadWriteOnce
        resources:
          requests:
            storage: 5Gi
        storageClassName: managed-csi
  targetDiscoveryOptions:
    discoveryPortNames:
      - tcp-jfr-jmx
    discoveryPortNumbers:
      - 9091
  targetNamespaces:
...
  trustedCertSecrets: []

however I see some differences with the target instance. I do not want cryostat to expose https, I want only to expose http, however with the following it creates

- args:
    - --alpha-config=/etc/oauth2_proxy/alpha_config/alpha_config.json
    env:
    - name: OAUTH2_PROXY_REDIRECT_URL
      value: http://localhost:4180/oauth2/callback
    - name: OAUTH2_PROXY_EMAIL_DOMAINS
      value: '*'
    - name: OAUTH2_PROXY_SKIP_AUTH_ROUTES
      value: .*
    envFrom:
    - secretRef:
        name: cryostat-main-oauth2-cookie
        optional: false
    image: quay.io/oauth2-proxy/oauth2-proxy:latest
    imagePullPolicy: Always
    livenessProbe:
      failureThreshold: 3
      httpGet:
        path: /ping
        port: 4180
        scheme: HTTPS
      periodSeconds: 10
      successThreshold: 1
      timeoutSeconds: 1
    name: cryostat-main-auth-proxy
    ports:
    - containerPort: 4180
      protocol: TCP
...

when I do

k port-forward svc/cryostat-main  8181:8181

I see the port on cryostat is exposed as https (I have waring in the browser that it got http request on https).

What I need to set on CR to make it start on http ?

[grzesuav]

ok, im operator setup the proxy image is set to image: quay.io/oauth2-proxy/oauth2-proxy:latest, in helm chart it is set to fixed version, will try to adjust that - to use quay.io/oauth2-proxy/oauth2-proxy:v7.6.0

[andrewazores]

https://github.com/cryostatio/cryostat-operator?tab=readme-ov-file#security

Can you try disabling the cert-manager integration?

[tthvo]

cryostatio/cryostat-operator#984 (comment)

[grzesuav]

thanks, this one get solved. Another question, my instance from CR is missing grafana url, when I look at this code - https://github.com/cryostatio/cryostat-operator/blob/v3.0.1/internal/controllers/common/resource_definitions/resource_definitions.go#L1132 I am not sure how to drive this variable, as I do not set it in my CR. Any suggestion ?

[andrewazores]

Since 3.0, the Grafana dashboard container is normally deployed in the same Pod as Cryostat, hidden behind the same auth proxy instance. This way the two share the same authentication/authorization. Since you are not using OpenShift and Routes, this spec.AuthProxyURL should get set here:

https://github.com/cryostatio/cryostat-operator/blob/85d6445d2c1110e1b98c41a438d0cddac34e03a0/internal/controllers/ingresses.go#L51

ie when the Operator tries to reconcile Ingresses for the installation.

[grzesuav]

Hmm will look there. Is there any way to bypass it ? We do not use ingress, I just need native kubernetes service as we do not have ingress controller. We use istio virtual service

[andrewazores]

I don't think there is any way to bypass it right now - the Operator does assume that it will manage either Ingresses or Routes for the installation. Your manifest/argocd/istio setup is unfortunately pretty far outside of how we designed the Operator to be installed and used, so some of the assumptions we made don't hold in your setup :-(