Skip to content

Commit 43ee64e

Browse files
vyzigoldjan--f
vyzigold
and
jan--f
authored
feat: TLS support for the Thanos web endpoint (#496)
* feat: add Thanos Web endpoint TLS support * test: add testcase for Querier with TLS * feat: watch Querier TLS resources --------- Co-authored-by: Jan Fajerski <[email protected]>
1 parent c009944 commit 43ee64e

File tree

8 files changed

+630
-8
lines changed

8 files changed

+630
-8
lines changed

‎bundle/manifests/monitoring.rhobs_thanosqueriers.yaml

+61
Original file line numberDiff line numberDiff line change
@@ -110,6 +110,67 @@ spec:
110110
type: object
111111
type: object
112112
x-kubernetes-map-type: atomic
113+
webTLSConfig:
114+
description: Configure TLS options for the Thanos web server.
115+
properties:
116+
certificate:
117+
description: Reference to the TLS public certificate for the web
118+
server.
119+
properties:
120+
key:
121+
description: The key of the secret to select from. Must be
122+
a valid secret key.
123+
minLength: 1
124+
type: string
125+
name:
126+
description: The name of the secret in the object's namespace
127+
to select from.
128+
minLength: 1
129+
type: string
130+
required:
131+
- key
132+
- name
133+
type: object
134+
certificateAuthority:
135+
description: Reference to the root Certificate Authority used
136+
to verify the web server's certificate.
137+
properties:
138+
key:
139+
description: The key of the secret to select from. Must be
140+
a valid secret key.
141+
minLength: 1
142+
type: string
143+
name:
144+
description: The name of the secret in the object's namespace
145+
to select from.
146+
minLength: 1
147+
type: string
148+
required:
149+
- key
150+
- name
151+
type: object
152+
privateKey:
153+
description: Reference to the TLS private key for the web server.
154+
properties:
155+
key:
156+
description: The key of the secret to select from. Must be
157+
a valid secret key.
158+
minLength: 1
159+
type: string
160+
name:
161+
description: The name of the secret in the object's namespace
162+
to select from.
163+
minLength: 1
164+
type: string
165+
required:
166+
- key
167+
- name
168+
type: object
169+
required:
170+
- certificate
171+
- certificateAuthority
172+
- privateKey
173+
type: object
113174
required:
114175
- selector
115176
type: object

‎deploy/crds/common/monitoring.rhobs_thanosqueriers.yaml

+61
Original file line numberDiff line numberDiff line change
@@ -110,6 +110,67 @@ spec:
110110
type: object
111111
type: object
112112
x-kubernetes-map-type: atomic
113+
webTLSConfig:
114+
description: Configure TLS options for the Thanos web server.
115+
properties:
116+
certificate:
117+
description: Reference to the TLS public certificate for the web
118+
server.
119+
properties:
120+
key:
121+
description: The key of the secret to select from. Must be
122+
a valid secret key.
123+
minLength: 1
124+
type: string
125+
name:
126+
description: The name of the secret in the object's namespace
127+
to select from.
128+
minLength: 1
129+
type: string
130+
required:
131+
- key
132+
- name
133+
type: object
134+
certificateAuthority:
135+
description: Reference to the root Certificate Authority used
136+
to verify the web server's certificate.
137+
properties:
138+
key:
139+
description: The key of the secret to select from. Must be
140+
a valid secret key.
141+
minLength: 1
142+
type: string
143+
name:
144+
description: The name of the secret in the object's namespace
145+
to select from.
146+
minLength: 1
147+
type: string
148+
required:
149+
- key
150+
- name
151+
type: object
152+
privateKey:
153+
description: Reference to the TLS private key for the web server.
154+
properties:
155+
key:
156+
description: The key of the secret to select from. Must be
157+
a valid secret key.
158+
minLength: 1
159+
type: string
160+
name:
161+
description: The name of the secret in the object's namespace
162+
to select from.
163+
minLength: 1
164+
type: string
165+
required:
166+
- key
167+
- name
168+
type: object
169+
required:
170+
- certificate
171+
- certificateAuthority
172+
- privateKey
173+
type: object
113174
required:
114175
- selector
115176
type: object

‎docs/api.md

+150
Original file line numberDiff line numberDiff line change
@@ -3690,6 +3690,13 @@ deduplicate.
36903690
<br/>
36913691
</td>
36923692
<td>false</td>
3693+
</tr><tr>
3694+
<td><b><a href="#thanosquerierspecwebtlsconfig">webTLSConfig</a></b></td>
3695+
<td>object</td>
3696+
<td>
3697+
Configure TLS options for the Thanos web server.<br/>
3698+
</td>
3699+
<td>false</td>
36933700
</tr></tbody>
36943701
</table>
36953702

@@ -3810,6 +3817,149 @@ list restricting them.<br/>
38103817
</tr></tbody>
38113818
</table>
38123819

3820+
3821+
### ThanosQuerier.spec.webTLSConfig
3822+
<sup><sup>[↩ Parent](#thanosquerierspec)</sup></sup>
3823+
3824+
3825+
3826+
Configure TLS options for the Thanos web server.
3827+
3828+
<table>
3829+
<thead>
3830+
<tr>
3831+
<th>Name</th>
3832+
<th>Type</th>
3833+
<th>Description</th>
3834+
<th>Required</th>
3835+
</tr>
3836+
</thead>
3837+
<tbody><tr>
3838+
<td><b><a href="#thanosquerierspecwebtlsconfigcertificate">certificate</a></b></td>
3839+
<td>object</td>
3840+
<td>
3841+
Reference to the TLS public certificate for the web server.<br/>
3842+
</td>
3843+
<td>true</td>
3844+
</tr><tr>
3845+
<td><b><a href="#thanosquerierspecwebtlsconfigcertificateauthority">certificateAuthority</a></b></td>
3846+
<td>object</td>
3847+
<td>
3848+
Reference to the root Certificate Authority used to verify the web server's certificate.<br/>
3849+
</td>
3850+
<td>true</td>
3851+
</tr><tr>
3852+
<td><b><a href="#thanosquerierspecwebtlsconfigprivatekey">privateKey</a></b></td>
3853+
<td>object</td>
3854+
<td>
3855+
Reference to the TLS private key for the web server.<br/>
3856+
</td>
3857+
<td>true</td>
3858+
</tr></tbody>
3859+
</table>
3860+
3861+
3862+
### ThanosQuerier.spec.webTLSConfig.certificate
3863+
<sup><sup>[↩ Parent](#thanosquerierspecwebtlsconfig)</sup></sup>
3864+
3865+
3866+
3867+
Reference to the TLS public certificate for the web server.
3868+
3869+
<table>
3870+
<thead>
3871+
<tr>
3872+
<th>Name</th>
3873+
<th>Type</th>
3874+
<th>Description</th>
3875+
<th>Required</th>
3876+
</tr>
3877+
</thead>
3878+
<tbody><tr>
3879+
<td><b>key</b></td>
3880+
<td>string</td>
3881+
<td>
3882+
The key of the secret to select from. Must be a valid secret key.<br/>
3883+
</td>
3884+
<td>true</td>
3885+
</tr><tr>
3886+
<td><b>name</b></td>
3887+
<td>string</td>
3888+
<td>
3889+
The name of the secret in the object's namespace to select from.<br/>
3890+
</td>
3891+
<td>true</td>
3892+
</tr></tbody>
3893+
</table>
3894+
3895+
3896+
### ThanosQuerier.spec.webTLSConfig.certificateAuthority
3897+
<sup><sup>[↩ Parent](#thanosquerierspecwebtlsconfig)</sup></sup>
3898+
3899+
3900+
3901+
Reference to the root Certificate Authority used to verify the web server's certificate.
3902+
3903+
<table>
3904+
<thead>
3905+
<tr>
3906+
<th>Name</th>
3907+
<th>Type</th>
3908+
<th>Description</th>
3909+
<th>Required</th>
3910+
</tr>
3911+
</thead>
3912+
<tbody><tr>
3913+
<td><b>key</b></td>
3914+
<td>string</td>
3915+
<td>
3916+
The key of the secret to select from. Must be a valid secret key.<br/>
3917+
</td>
3918+
<td>true</td>
3919+
</tr><tr>
3920+
<td><b>name</b></td>
3921+
<td>string</td>
3922+
<td>
3923+
The name of the secret in the object's namespace to select from.<br/>
3924+
</td>
3925+
<td>true</td>
3926+
</tr></tbody>
3927+
</table>
3928+
3929+
3930+
### ThanosQuerier.spec.webTLSConfig.privateKey
3931+
<sup><sup>[↩ Parent](#thanosquerierspecwebtlsconfig)</sup></sup>
3932+
3933+
3934+
3935+
Reference to the TLS private key for the web server.
3936+
3937+
<table>
3938+
<thead>
3939+
<tr>
3940+
<th>Name</th>
3941+
<th>Type</th>
3942+
<th>Description</th>
3943+
<th>Required</th>
3944+
</tr>
3945+
</thead>
3946+
<tbody><tr>
3947+
<td><b>key</b></td>
3948+
<td>string</td>
3949+
<td>
3950+
The key of the secret to select from. Must be a valid secret key.<br/>
3951+
</td>
3952+
<td>true</td>
3953+
</tr><tr>
3954+
<td><b>name</b></td>
3955+
<td>string</td>
3956+
<td>
3957+
The name of the secret in the object's namespace to select from.<br/>
3958+
</td>
3959+
<td>true</td>
3960+
</tr></tbody>
3961+
</table>
3962+
38133963
# observability.openshift.io/v1alpha1
38143964

38153965
Resource Types:

‎pkg/apis/monitoring/v1alpha1/types.go

+3
Original file line numberDiff line numberDiff line change
@@ -279,6 +279,9 @@ type ThanosQuerierSpec struct {
279279
// Selector to select which namespaces the Monitoring Stack objects are discovered from.
280280
NamespaceSelector NamespaceSelector `json:"namespaceSelector,omitempty"`
281281
ReplicaLabels []string `json:"replicaLabels,omitempty"`
282+
// Configure TLS options for the Thanos web server.
283+
// +optional
284+
WebTLSConfig *WebTLSConfig `json:"webTLSConfig,omitempty"`
282285
}
283286

284287
// ThanosQuerierStatus defines the observed state of ThanosQuerier.

‎pkg/apis/monitoring/v1alpha1/zz_generated.deepcopy.go

+5
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

0 commit comments

Comments
 (0)