Endpoint auth

charts/rancher-monitoring/103.0.0+up45.31.1/charts/hardenedKubelet/Chart.yaml

@@ -6,9 +6,9 @@ annotations:
   catalog.rancher.io/namespace: cattle-monitoring-system
   catalog.rancher.io/release-name: rancher-pushprox
 apiVersion: v1
-appVersion: 0.1.0
+appVersion: 0.1.1
 description: Sets up a deployment of the PushProx proxy and a DaemonSet of PushProx
   clients.
 name: hardenedKubelet
 type: application
-version: 0.1.6
+version: 103.0.0

charts/rancher-monitoring/103.0.0+up45.31.1/charts/hardenedKubelet/README.md

@@ -55,7 +55,15 @@ The following tables list the configurable parameters of the rancher-pushprox ch
 | `clients.proxyUrl` | Overrides the default proxyUrl setting of `http://pushprox-{{ .Values.component }}-proxy.{{ . Release.Namespace }}.svc.cluster.local:{{ .Values.proxy.port }}"` with the `proxyUrl` specified | `""` |
 | `clients.useLocalhost` | Sets a flag on each client deployment to redirect scrapes directed to `HOST_IP` to `127.0.0.1` | `false` |
 | `clients.https.enabled` | Enables scraping metrics via HTTPS using the provided TLS certs that exist on each host | `false` |
+| `clients.https.forceHTTPSScheme` | Forces scraping metrics via HTTPS using the provided TLS certs that exist on each host | `false` |
 | `clients.https.useServiceAccountCredentials` | If set to true, the client will create a service account with permissions to scrape `/metrics` endpoint of Kubernetes components. The client will use the service account token provided to make authorized scrape requests to the Kubernetes API | `false` |
+| `clients.https.authenticationMethod.bearerTokenFile.enabled` | If set to true, the client will use service account credentials mounted at the configured path `clients.https.authenticationMethod.bearerTokenFile.bearerTokenFilePath`. This requires permissions to scrape `/metrics` endpoint of Kubernetes components. This method is deprecated by the prometheus operator and may be removed in a future release | `false` |
+| `clients.https.authenticationMethod.bearerTokenFile.bearerTokenFilePath` | This is a volume mount on the pod with permissions to scrape `/metrics` endpoint of Kubernetes components | `"/var/run/secrets/kubernetes.io/serviceaccount/token"` |
+| `clients.https.authenticationMethod.bearerTokenSecret.enabled` | If set to true, the client will use service account credentials to scrape `/metrics` endpoint of Kubernetes components. This method is deprecated by the prometheus operator and may be removed in a future release | `false` |
+| `clients.https.authenticationMethod.authorization.enabled` | If set to true, the client will use service account credentials to scrape `/metrics` endpoint of Kubernetes components | `false` |
+| `clients.https.authenticationMethod.authorization.type` | If set, the client will use this type of authorization in its client requests for metrics | `"bearer"` |
+| `clients.https.authenticationMethod.authorization.credentials.key` | If set, the client will use this key in the secret created by `clients.https.useServiceAccountCredentials` for authorization in its client requests for metrics | `"token"` |
+| `clients.https.authenticationMethod.authorization.credentials.optional` | If set to false, the client will fail if the key in the secret created by `clients.https.useServiceAccountCredentials` does not exist | `false` |
 | `clients.https.insecureSkipVerify` | If set to true, the client will disable SSL security checks | `false` |
 | `clients.https.certDir` | A `hostPath` where TLS certs can be found. This path is mounted as a volume on an `initContainer` which copies only the necessary files over to an EmptyDir volume used by each client. Required and only used if `clients.https.enabled` is set | `""` |
 | `clients.https.certFile` | The path to the TLS cert file located within `clients.https.certDir`. Required and only used if `clients.https.enabled` is set | `""` |
@@ -79,4 +87,4 @@ The following tables list the configurable parameters of the rancher-pushprox ch
 
 *Tip: The filepaths set in `clients.https.<cert|key|caCert>File` can include wildcard characters*. 
 
-See [rancher-monitoring](https://github.com/rancher/charts/tree/gh-pages/packages/rancher-monitoring) for examples of how this chart can be used.
+See [rancher-monitoring](https://github.com/rancher/charts/tree/gh-pages/packages/rancher-monitoring) for examples of how this chart can be used.

charts/rancher-monitoring/103.0.0+up45.31.1/charts/hardenedKubelet/templates/_helpers.tpl

@@ -68,6 +68,10 @@ provider: kubernetes
 {{- printf "pushprox-%s-client" (required ".Values.component is required" .Values.component) -}}
 {{- end -}}
 
+{{- define "pushProxy.client.serviceAccountTokenName" -}}
+{{- printf "pushprox-%s-client-service-account-token" (required ".Values.component is required" .Values.component) -}}
+{{- end -}}
+
 {{- define "pushProxy.client.labels" -}}
 k8s-app: {{ template "pushProxy.client.name" . }}
 {{ template "pushProxy.commonLabels" . }}
@@ -98,6 +102,11 @@ app: {{ template "pushprox.serviceMonitor.name" . }}
 {{- define "pushProxy.serviceMonitor.endpoints" -}}
 {{- $proxyURL := (include "pushProxy.proxyUrl" .) -}}
 {{- $useHTTPS := .Values.clients.https.enabled -}}
+{{- $forceHTTPSScheme := .Values.clients.https.forceHTTPSScheme -}}
+{{- $insecureSkipVerify := .Values.clients.https.insecureSkipVerify -}}
+{{- $useServiceAccountCredentials := .Values.clients.https.useServiceAccountCredentials -}}
+{{- $serviceAccountTokenName := (include "pushProxy.client.serviceAccountTokenName" . ) -}}
+{{- $metricRelabelings := list }}
 {{- $endpoints := .Values.serviceMonitor.endpoints }}
 {{- range $endpoints }}
 {{- if $.Values.proxy.enabled }}
@@ -117,15 +126,41 @@ app: {{ template "pushprox.serviceMonitor.name" . }}
 {{- $_ := set $clusterNameRelabel "targetLabel" "cluster_name" }}
 {{- $_ := set $clusterNameRelabel "replacement" $.Values.global.cattle.clusterName }}
 {{- end }}
-{{- $metricRelabelings := append (list ($clusterNameRelabel)) ($clusterIdRelabel) }}
+{{- $metricRelabelings := gt (len (keys $clusterNameRelabel)) 0 | ternary (append ($metricRelabelings) ($clusterNameRelabel)) ($metricRelabelings) }}
+{{- $metricRelabelings := gt (len (keys $clusterIdRelabel)) 0 | ternary (append ($metricRelabelings) ($clusterIdRelabel)) ($metricRelabelings) }}
+{{- if not (empty $metricRelabelings) }}
 {{- $_ := set . "metricRelabelings" ($metricRelabelings)}}
+{{- end }}
+{{- if $forceHTTPSScheme -}}
+{{- $_ := set . "scheme" "https" }}
+{{- end -}}
 {{- if $useHTTPS -}}
 {{- if (hasKey . "params") }}
 {{- $_ := set (get . "params") "_scheme" (list "https") }}
 {{- else }}
 {{- $_ := set . "params" (dict "_scheme" (list "https")) }}
 {{- end }}
 {{- end }}
+{{- if (hasKey . "tlsConfig") }}
+{{- $_ := set (get . "tlsConfig") "insecureSkipVerify" $insecureSkipVerify }}
+{{- else }}
+{{- $_ := set . "tlsConfig" (dict "insecureSkipVerify" $insecureSkipVerify) }}
+{{- end }}
+{{- if $.Values.clients.https.authenticationMethod.bearerTokenFile.enabled }}
+{{- $_ := set . "bearerTokenFile" $.Values.clients.https.authenticationMethod.bearerTokenFile.bearerTokenFilePath }}
+{{- end }}
+{{- if $.Values.clients.https.authenticationMethod.bearerTokenSecret.enabled }}
+{{- $_ := set . "bearerTokenSecret" $serviceAccountTokenName }}
+{{- end }}
+{{- if $.Values.clients.https.authenticationMethod.authorization.enabled }}
+{{- if (hasKey . "authorization") }}
+{{- $_ := set (get . "authorization") "type" $.Values.clients.https.authenticationMethod.authorization.type }}
+{{- $_ := set (get . "authorization") "credentials" (dict "name" $serviceAccountTokenName "key" $.Values.clients.https.authenticationMethod.authorization.credentials.key "optional" $.Values.clients.https.authenticationMethod.authorization.credentials.optional) }}
+{{- else }}
+{{- $_ := set . "authorization" (dict "type" $.Values.clients.https.authenticationMethod.authorization.type) }}
+{{- $_ := set . "authorization" (dict "credentials" (dict "name" $serviceAccountTokenName "key" $.Values.clients.https.authenticationMethod.authorization.credentials.key "optional" $.Values.clients.https.authenticationMethod.authorization.credentials.optional)) }}
+{{- end }}
+{{- end }}
 {{- end }}
 {{- toYaml $endpoints }}
-{{- end -}}
+{{- end -}}

charts/rancher-monitoring/103.0.0+up45.31.1/charts/hardenedKubelet/templates/pushprox-clients-rbac.yaml

@@ -42,6 +42,18 @@ metadata:
   namespace: {{ include "pushprox.namespace" . }}
   labels: {{ include "pushProxy.client.labels" . | nindent 4 }}
 ---
+{{- if .Values.clients.https.useServiceAccountCredentials }}
+apiVersion: v1
+kind: Secret
+type: kubernetes.io/service-account-token
+metadata:
+  name: {{ template "pushProxy.client.serviceAccountTokenName" . }}
+  namespace: {{ include "pushprox.namespace" . }}
+  labels: {{ include "pushProxy.client.labels" . | nindent 4 }}
+  annotations:
+    kubernetes.io/service-account.name: {{ template "pushProxy.client.name" . }}
+{{- end }}
+---
 {{- if .Values.global.cattle.psp.enabled }}
 apiVersion: policy/v1beta1
 kind: PodSecurityPolicy
@@ -82,4 +94,4 @@ spec:
     readOnly: true
 {{- end }}
 {{- end }}
-{{- end }}{{- end }}
+{{- end }}{{- end }}

charts/rancher-monitoring/103.0.0+up45.31.1/charts/hardenedKubelet/templates/pushprox-clients.yaml

@@ -35,6 +35,10 @@ spec:
       hostNetwork: true
       dnsPolicy: ClusterFirstWithHostNet
       serviceAccountName: {{ template "pushProxy.client.name" . }}
+      {{- if .Values.global.imagePullSecretName }}
+      imagePullSecrets:
+      - name: {{ .Values.global.imagePullSecretName }}
+      {{- end }}
       containers:
       - name: pushprox-client
         image: {{ template "system_default_registry" . }}{{ .Values.clients.image.repository }}:{{ .Values.clients.image.tag }}
@@ -150,4 +154,4 @@ spec:
       - name: metrics-cert-dir
         emptyDir: {}
       {{- end }}
-{{- end }}{{- end }}
+{{- end }}{{- end }}

charts/rancher-monitoring/103.0.0+up45.31.1/charts/hardenedKubelet/templates/pushprox-proxy.yaml

@@ -26,6 +26,10 @@ spec:
 {{ toYaml .Values.proxy.tolerations | indent 8 }}
 {{- end }}
       serviceAccountName: {{ template "pushProxy.proxy.name" . }}
+      {{- if .Values.global.imagePullSecretName }}
+      imagePullSecrets:
+      - name: {{ .Values.global.imagePullSecretName }}
+      {{- end }}
       containers:
       - name: pushprox-proxy
         image: {{ template "system_default_registry" . }}{{ .Values.proxy.image.repository }}:{{ .Values.proxy.image.tag }}
@@ -50,4 +54,4 @@ spec:
     protocol: TCP
     targetPort: {{ .Values.proxy.port }}
   selector: {{ include "pushProxy.proxy.labels" . | nindent 4 }}
-{{- end }}{{- end }}
+{{- end }}{{- end }}

charts/rancher-monitoring/103.0.0+up45.31.1/charts/hardenedKubelet/templates/pushprox-servicemonitor.yaml

@@ -42,4 +42,4 @@ spec:
     protocol: TCP
     targetPort: {{ .Values.metricsPort }}
   selector: {{ default (include "pushProxy.client.labels" .) $selector | nindent 4 }}
-{{- end }}{{- end }}
+{{- end }}{{- end }}

charts/rancher-monitoring/103.0.0+up45.31.1/charts/hardenedKubelet/values.yaml

@@ -75,9 +75,29 @@ clients:
   https:
     # Does the client require https to access the metrics?
     enabled: false
+    # Does the client require requests be sent to http or https?
+    forceHTTPSScheme: false
     # If set to true, the client will create a service account with adequate permissions and set a flag
     # on the client to use the service account token provided by it to make authorized scrape requests
     useServiceAccountCredentials: false
+    # Configuration for authentication to metrics via https endpoint
+    authenticationMethod:
+      # Reads token from defined file in container
+      # This function is deprecated in the prometheus operator api and may be removed in a future version
+      bearerTokenFile:
+        enabled: false
+        bearerTokenFilePath: "/var/run/secrets/kubernetes.io/serviceaccount/token"
+      # Reads token from defined secret in namespace
+      # This function is deprecated in the prometheus operator api and may be removed in a future version
+      bearerTokenSecret:
+        enabled: false
+      # Reads token from defined secret in namespace
+      authorization:
+        enabled: false
+        type: "bearer"
+        credentials:
+          key: "token"
+          optional: false
     # If set to true, the client will disable SSL security checks
     insecureSkipVerify: false
     # Directory on host where necessary TLS cert and key to scrape metrics can be found
@@ -143,4 +163,4 @@ proxy:
   image:
     repository: rancher/pushprox-proxy
     tag: v0.1.0-rancher2-proxy
-  command: ["pushprox-proxy"]
+  command: ["pushprox-proxy"]

charts/rancher-monitoring/103.0.0+up45.31.1/charts/hardenedNodeExporter/Chart.yaml

@@ -6,9 +6,9 @@ annotations:
   catalog.rancher.io/namespace: cattle-monitoring-system
   catalog.rancher.io/release-name: rancher-pushprox
 apiVersion: v1
-appVersion: 0.1.0
+appVersion: 0.1.1
 description: Sets up a deployment of the PushProx proxy and a DaemonSet of PushProx
   clients.
 name: hardenedNodeExporter
 type: application
-version: 0.1.6
+version: 103.0.0

charts/rancher-monitoring/103.0.0+up45.31.1/charts/hardenedNodeExporter/README.md

@@ -55,7 +55,15 @@ The following tables list the configurable parameters of the rancher-pushprox ch
 | `clients.proxyUrl` | Overrides the default proxyUrl setting of `http://pushprox-{{ .Values.component }}-proxy.{{ . Release.Namespace }}.svc.cluster.local:{{ .Values.proxy.port }}"` with the `proxyUrl` specified | `""` |
 | `clients.useLocalhost` | Sets a flag on each client deployment to redirect scrapes directed to `HOST_IP` to `127.0.0.1` | `false` |
 | `clients.https.enabled` | Enables scraping metrics via HTTPS using the provided TLS certs that exist on each host | `false` |
+| `clients.https.forceHTTPSScheme` | Forces scraping metrics via HTTPS using the provided TLS certs that exist on each host | `false` |
 | `clients.https.useServiceAccountCredentials` | If set to true, the client will create a service account with permissions to scrape `/metrics` endpoint of Kubernetes components. The client will use the service account token provided to make authorized scrape requests to the Kubernetes API | `false` |
+| `clients.https.authenticationMethod.bearerTokenFile.enabled` | If set to true, the client will use service account credentials mounted at the configured path `clients.https.authenticationMethod.bearerTokenFile.bearerTokenFilePath`. This requires permissions to scrape `/metrics` endpoint of Kubernetes components. This method is deprecated by the prometheus operator and may be removed in a future release | `false` |
+| `clients.https.authenticationMethod.bearerTokenFile.bearerTokenFilePath` | This is a volume mount on the pod with permissions to scrape `/metrics` endpoint of Kubernetes components | `"/var/run/secrets/kubernetes.io/serviceaccount/token"` |
+| `clients.https.authenticationMethod.bearerTokenSecret.enabled` | If set to true, the client will use service account credentials to scrape `/metrics` endpoint of Kubernetes components. This method is deprecated by the prometheus operator and may be removed in a future release | `false` |
+| `clients.https.authenticationMethod.authorization.enabled` | If set to true, the client will use service account credentials to scrape `/metrics` endpoint of Kubernetes components | `false` |
+| `clients.https.authenticationMethod.authorization.type` | If set, the client will use this type of authorization in its client requests for metrics | `"bearer"` |
+| `clients.https.authenticationMethod.authorization.credentials.key` | If set, the client will use this key in the secret created by `clients.https.useServiceAccountCredentials` for authorization in its client requests for metrics | `"token"` |
+| `clients.https.authenticationMethod.authorization.credentials.optional` | If set to false, the client will fail if the key in the secret created by `clients.https.useServiceAccountCredentials` does not exist | `false` |
 | `clients.https.insecureSkipVerify` | If set to true, the client will disable SSL security checks | `false` |
 | `clients.https.certDir` | A `hostPath` where TLS certs can be found. This path is mounted as a volume on an `initContainer` which copies only the necessary files over to an EmptyDir volume used by each client. Required and only used if `clients.https.enabled` is set | `""` |
 | `clients.https.certFile` | The path to the TLS cert file located within `clients.https.certDir`. Required and only used if `clients.https.enabled` is set | `""` |
@@ -79,4 +87,4 @@ The following tables list the configurable parameters of the rancher-pushprox ch
 
 *Tip: The filepaths set in `clients.https.<cert|key|caCert>File` can include wildcard characters*. 
 
-See [rancher-monitoring](https://github.com/rancher/charts/tree/gh-pages/packages/rancher-monitoring) for examples of how this chart can be used.
+See [rancher-monitoring](https://github.com/rancher/charts/tree/gh-pages/packages/rancher-monitoring) for examples of how this chart can be used.

charts/rancher-monitoring/103.0.0+up45.31.1/charts/hardenedNodeExporter/templates/_helpers.tpl

@@ -68,6 +68,10 @@ provider: kubernetes
 {{- printf "pushprox-%s-client" (required ".Values.component is required" .Values.component) -}}
 {{- end -}}
 
+{{- define "pushProxy.client.serviceAccountTokenName" -}}
+{{- printf "pushprox-%s-client-service-account-token" (required ".Values.component is required" .Values.component) -}}
+{{- end -}}
+
 {{- define "pushProxy.client.labels" -}}
 k8s-app: {{ template "pushProxy.client.name" . }}
 {{ template "pushProxy.commonLabels" . }}
@@ -98,6 +102,11 @@ app: {{ template "pushprox.serviceMonitor.name" . }}
 {{- define "pushProxy.serviceMonitor.endpoints" -}}
 {{- $proxyURL := (include "pushProxy.proxyUrl" .) -}}
 {{- $useHTTPS := .Values.clients.https.enabled -}}
+{{- $forceHTTPSScheme := .Values.clients.https.forceHTTPSScheme -}}
+{{- $insecureSkipVerify := .Values.clients.https.insecureSkipVerify -}}
+{{- $useServiceAccountCredentials := .Values.clients.https.useServiceAccountCredentials -}}
+{{- $serviceAccountTokenName := (include "pushProxy.client.serviceAccountTokenName" . ) -}}
+{{- $metricRelabelings := list }}
 {{- $endpoints := .Values.serviceMonitor.endpoints }}
 {{- range $endpoints }}
 {{- if $.Values.proxy.enabled }}
@@ -117,15 +126,41 @@ app: {{ template "pushprox.serviceMonitor.name" . }}
 {{- $_ := set $clusterNameRelabel "targetLabel" "cluster_name" }}
 {{- $_ := set $clusterNameRelabel "replacement" $.Values.global.cattle.clusterName }}
 {{- end }}
-{{- $metricRelabelings := append (list ($clusterNameRelabel)) ($clusterIdRelabel) }}
+{{- $metricRelabelings := gt (len (keys $clusterNameRelabel)) 0 | ternary (append ($metricRelabelings) ($clusterNameRelabel)) ($metricRelabelings) }}
+{{- $metricRelabelings := gt (len (keys $clusterIdRelabel)) 0 | ternary (append ($metricRelabelings) ($clusterIdRelabel)) ($metricRelabelings) }}
+{{- if not (empty $metricRelabelings) }}
 {{- $_ := set . "metricRelabelings" ($metricRelabelings)}}
+{{- end }}
+{{- if $forceHTTPSScheme -}}
+{{- $_ := set . "scheme" "https" }}
+{{- end -}}
 {{- if $useHTTPS -}}
 {{- if (hasKey . "params") }}
 {{- $_ := set (get . "params") "_scheme" (list "https") }}
 {{- else }}
 {{- $_ := set . "params" (dict "_scheme" (list "https")) }}
 {{- end }}
 {{- end }}
+{{- if (hasKey . "tlsConfig") }}
+{{- $_ := set (get . "tlsConfig") "insecureSkipVerify" $insecureSkipVerify }}
+{{- else }}
+{{- $_ := set . "tlsConfig" (dict "insecureSkipVerify" $insecureSkipVerify) }}
+{{- end }}
+{{- if $.Values.clients.https.authenticationMethod.bearerTokenFile.enabled }}
+{{- $_ := set . "bearerTokenFile" $.Values.clients.https.authenticationMethod.bearerTokenFile.bearerTokenFilePath }}
+{{- end }}
+{{- if $.Values.clients.https.authenticationMethod.bearerTokenSecret.enabled }}
+{{- $_ := set . "bearerTokenSecret" $serviceAccountTokenName }}
+{{- end }}
+{{- if $.Values.clients.https.authenticationMethod.authorization.enabled }}
+{{- if (hasKey . "authorization") }}
+{{- $_ := set (get . "authorization") "type" $.Values.clients.https.authenticationMethod.authorization.type }}
+{{- $_ := set (get . "authorization") "credentials" (dict "name" $serviceAccountTokenName "key" $.Values.clients.https.authenticationMethod.authorization.credentials.key "optional" $.Values.clients.https.authenticationMethod.authorization.credentials.optional) }}
+{{- else }}
+{{- $_ := set . "authorization" (dict "type" $.Values.clients.https.authenticationMethod.authorization.type) }}
+{{- $_ := set . "authorization" (dict "credentials" (dict "name" $serviceAccountTokenName "key" $.Values.clients.https.authenticationMethod.authorization.credentials.key "optional" $.Values.clients.https.authenticationMethod.authorization.credentials.optional)) }}
+{{- end }}
+{{- end }}
 {{- end }}
 {{- toYaml $endpoints }}
-{{- end -}}
+{{- end -}}