add example release-0.3 to release-0.8 migration to docs
This commit is contained in:
Paul Sweeney
327
docs/migration-example/my.release-0.3.jsonnet
Normal file
327
docs/migration-example/my.release-0.3.jsonnet
Normal file
@@ -0,0 +1,327 @@
|
||||
# Has the following customisations
|
||||
# Custom alert manager config
|
||||
# Ingresses for the alert manager, prometheus and grafana
|
||||
# Grafana admin user password
|
||||
# Custom prometheus rules
|
||||
# Custom grafana dashboards
|
||||
# Custom prometheus config - Data retention, memory, etc.
|
||||
# Node exporter role and role binding so we can use a PSP for the node exporter
|
||||
|
||||
|
||||
|
||||
# External variables
|
||||
# See https://jsonnet.org/learning/tutorial.html
|
||||
local cluster_identifier = std.extVar('cluster_identifier');
|
||||
local etcd_ip = std.extVar('etcd_ip');
|
||||
local etcd_tls_ca = std.extVar('etcd_tls_ca');
|
||||
local etcd_tls_cert = std.extVar('etcd_tls_cert');
|
||||
local etcd_tls_key = std.extVar('etcd_tls_key');
|
||||
local grafana_admin_password = std.extVar('grafana_admin_password');
|
||||
local prometheus_data_retention_period = std.extVar('prometheus_data_retention_period');
|
||||
local prometheus_request_memory = std.extVar('prometheus_request_memory');
|
||||
|
||||
|
||||
# Derived variables
|
||||
local alert_manager_host = 'alertmanager.' + cluster_identifier + '.myorg.local';
|
||||
local grafana_host = 'grafana.' + cluster_identifier + '.myorg.local';
|
||||
local prometheus_host = 'prometheus.' + cluster_identifier + '.myorg.local';
|
||||
|
||||
|
||||
# Imports
|
||||
local k = import 'ksonnet/ksonnet.beta.3/k.libsonnet';
|
||||
local ingress = k.extensions.v1beta1.ingress;
|
||||
local ingressRule = ingress.mixin.spec.rulesType;
|
||||
local ingressRuleHttpPath = ingressRule.mixin.http.pathsType;
|
||||
local ingressTls = ingress.mixin.spec.tlsType;
|
||||
local role = k.rbac.v1.role;
|
||||
local roleBinding = k.rbac.v1.roleBinding;
|
||||
local roleRulesType = k.rbac.v1.role.rulesType;
|
||||
|
||||
|
||||
local kp =
|
||||
(import 'kube-prometheus/kube-prometheus.libsonnet') +
|
||||
(import 'kube-prometheus/kube-prometheus-kubeadm.libsonnet') +
|
||||
(import 'kube-prometheus/kube-prometheus-static-etcd.libsonnet') +
|
||||
|
||||
{
|
||||
_config+:: {
|
||||
# Override namespace
|
||||
namespace: 'monitoring',
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
# Override alert manager config
|
||||
# See https://github.com/coreos/kube-prometheus/tree/master/examples/alertmanager-config-external.jsonnet
|
||||
alertmanager+: {
|
||||
config: importstr 'alertmanager.yaml',
|
||||
},
|
||||
|
||||
# Override etcd config
|
||||
# See https://github.com/coreos/kube-prometheus/blob/master/jsonnet/kube-prometheus/kube-prometheus-static-etcd.libsonnet
|
||||
# See https://github.com/coreos/kube-prometheus/blob/master/examples/etcd-skip-verify.jsonnet
|
||||
etcd+:: {
|
||||
clientCA: etcd_tls_ca,
|
||||
clientCert: etcd_tls_cert,
|
||||
clientKey: etcd_tls_key,
|
||||
ips: [ etcd_ip ],
|
||||
},
|
||||
|
||||
# Override grafana config
|
||||
# anonymous access
|
||||
# See http://docs.grafana.org/installation/configuration/
|
||||
# See http://docs.grafana.org/auth/overview/#anonymous-authentication
|
||||
# admin_password
|
||||
# See http://docs.grafana.org/installation/configuration/#admin-password
|
||||
grafana+:: {
|
||||
config: {
|
||||
sections: {
|
||||
'auth.anonymous': {
|
||||
enabled: true
|
||||
},
|
||||
security: {
|
||||
admin_password: grafana_admin_password
|
||||
},
|
||||
},
|
||||
},
|
||||
|
||||
|
||||
|
||||
},
|
||||
},
|
||||
|
||||
# Additional grafana dashboards
|
||||
grafanaDashboards+:: {
|
||||
'my-specific.json': (import 'my-grafana-dashboard-definitions.json'),
|
||||
},
|
||||
|
||||
# Alert manager needs an externalUrl
|
||||
alertmanager+:: {
|
||||
alertmanager+: {
|
||||
spec+: {
|
||||
# See https://github.com/coreos/prometheus-operator/blob/master/Documentation/api.md
|
||||
# See https://github.com/coreos/prometheus-operator/blob/master/Documentation/user-guides/exposing-prometheus-and-alertmanager.md
|
||||
externalUrl: 'https://' + alert_manager_host,
|
||||
},
|
||||
},
|
||||
},
|
||||
|
||||
|
||||
# Add additional ingresses
|
||||
# See https://github.com/coreos/kube-prometheus/tree/master/examples/ingress.jsonnet
|
||||
ingress+:: {
|
||||
alertmanager:
|
||||
ingress.new() +
|
||||
|
||||
|
||||
ingress.mixin.metadata.withName('alertmanager') +
|
||||
ingress.mixin.metadata.withNamespace($._config.namespace) +
|
||||
ingress.mixin.metadata.withAnnotations({
|
||||
'kubernetes.io/ingress.class': 'nginx-api',
|
||||
}) +
|
||||
|
||||
ingress.mixin.spec.withRules(
|
||||
ingressRule.new() +
|
||||
ingressRule.withHost(alert_manager_host) +
|
||||
ingressRule.mixin.http.withPaths(
|
||||
ingressRuleHttpPath.new() +
|
||||
|
||||
|
||||
|
||||
|
||||
ingressRuleHttpPath.mixin.backend.withServiceName('alertmanager-operated') +
|
||||
|
||||
ingressRuleHttpPath.mixin.backend.withServicePort(9093)
|
||||
),
|
||||
) +
|
||||
|
||||
|
||||
# Note we do not need a TLS secretName here as we are going to use the nginx-ingress default secret which is a wildcard
|
||||
# secretName would need to be in the same namespace at this time, see https://github.com/kubernetes/ingress-nginx/issues/2371
|
||||
ingress.mixin.spec.withTls(
|
||||
ingressTls.new() +
|
||||
ingressTls.withHosts(alert_manager_host)
|
||||
),
|
||||
|
||||
|
||||
grafana:
|
||||
ingress.new() +
|
||||
|
||||
|
||||
ingress.mixin.metadata.withName('grafana') +
|
||||
ingress.mixin.metadata.withNamespace($._config.namespace) +
|
||||
ingress.mixin.metadata.withAnnotations({
|
||||
'kubernetes.io/ingress.class': 'nginx-api',
|
||||
}) +
|
||||
|
||||
ingress.mixin.spec.withRules(
|
||||
ingressRule.new() +
|
||||
ingressRule.withHost(grafana_host) +
|
||||
ingressRule.mixin.http.withPaths(
|
||||
ingressRuleHttpPath.new() +
|
||||
|
||||
|
||||
|
||||
|
||||
ingressRuleHttpPath.mixin.backend.withServiceName('grafana') +
|
||||
|
||||
ingressRuleHttpPath.mixin.backend.withServicePort(3000)
|
||||
),
|
||||
) +
|
||||
|
||||
|
||||
# Note we do not need a TLS secretName here as we are going to use the nginx-ingress default secret which is a wildcard
|
||||
# secretName would need to be in the same namespace at this time, see https://github.com/kubernetes/ingress-nginx/issues/2371
|
||||
ingress.mixin.spec.withTls(
|
||||
ingressTls.new() +
|
||||
ingressTls.withHosts(grafana_host)
|
||||
),
|
||||
|
||||
|
||||
prometheus:
|
||||
ingress.new() +
|
||||
|
||||
|
||||
ingress.mixin.metadata.withName('prometheus') +
|
||||
ingress.mixin.metadata.withNamespace($._config.namespace) +
|
||||
ingress.mixin.metadata.withAnnotations({
|
||||
'kubernetes.io/ingress.class': 'nginx-api',
|
||||
}) +
|
||||
ingress.mixin.spec.withRules(
|
||||
ingressRule.new() +
|
||||
|
||||
ingressRule.withHost(prometheus_host) +
|
||||
ingressRule.mixin.http.withPaths(
|
||||
ingressRuleHttpPath.new() +
|
||||
|
||||
|
||||
|
||||
|
||||
ingressRuleHttpPath.mixin.backend.withServiceName('prometheus-operated') +
|
||||
|
||||
ingressRuleHttpPath.mixin.backend.withServicePort(9090)
|
||||
),
|
||||
) +
|
||||
|
||||
|
||||
# Note we do not need a TLS secretName here as we are going to use the nginx-ingress default secret which is a wildcard
|
||||
# secretName would need to be in the same namespace at this time, see https://github.com/kubernetes/ingress-nginx/issues/2371
|
||||
ingress.mixin.spec.withTls(
|
||||
ingressTls.new() +
|
||||
ingressTls.withHosts(prometheus_host)
|
||||
),
|
||||
},
|
||||
|
||||
|
||||
# Node exporter PSP role and role binding
|
||||
# Add a new top level field for this, the "node-exporter" PSP already exists, so not defining here just referencing
|
||||
# See https://github.com/coreos/prometheus-operator/issues/787
|
||||
nodeExporterPSP: {
|
||||
role:
|
||||
role.new() +
|
||||
|
||||
|
||||
role.mixin.metadata.withName('node-exporter-psp') +
|
||||
role.mixin.metadata.withNamespace($._config.namespace) +
|
||||
role.withRules([
|
||||
roleRulesType.new() +
|
||||
roleRulesType.withApiGroups(['policy']) +
|
||||
roleRulesType.withResources(['podsecuritypolicies']) +
|
||||
roleRulesType.withVerbs(['use']) +
|
||||
roleRulesType.withResourceNames(['node-exporter'])
|
||||
]),
|
||||
|
||||
roleBinding:
|
||||
roleBinding.new() +
|
||||
roleBinding.mixin.roleRef.withApiGroup('rbac.authorization.k8s.io') +
|
||||
|
||||
|
||||
roleBinding.mixin.metadata.withName('node-exporter-psp') +
|
||||
roleBinding.mixin.metadata.withNamespace($._config.namespace) +
|
||||
|
||||
|
||||
|
||||
roleBinding.mixin.roleRef.withName('node-exporter-psp') +
|
||||
roleBinding.mixin.roleRef.mixinInstance({ kind: 'Role' }) +
|
||||
|
||||
|
||||
roleBinding.withSubjects([{ kind: 'ServiceAccount', name: 'node-exporter' }]),
|
||||
|
||||
|
||||
},
|
||||
|
||||
|
||||
# Prometheus needs some extra custom config
|
||||
prometheus+:: {
|
||||
prometheus+: {
|
||||
spec+: {
|
||||
# See https://github.com/coreos/prometheus-operator/blob/master/Documentation/api.md#prometheusspec
|
||||
externalLabels: {
|
||||
cluster: cluster_identifier,
|
||||
},
|
||||
# See https://github.com/coreos/prometheus-operator/blob/master/Documentation/api.md
|
||||
# See https://github.com/coreos/prometheus-operator/blob/master/Documentation/user-guides/exposing-prometheus-and-alertmanager.md
|
||||
externalUrl: 'https://' + prometheus_host,
|
||||
# Override reuest memory
|
||||
resources: {
|
||||
requests: {
|
||||
memory: prometheus_request_memory,
|
||||
},
|
||||
},
|
||||
# Override data retention period
|
||||
retention: prometheus_data_retention_period,
|
||||
},
|
||||
},
|
||||
},
|
||||
|
||||
|
||||
# Additional prometheus rules
|
||||
# See https://github.com/coreos/kube-prometheus/docs/developing-prometheus-rules-and-grafana-dashboards.md
|
||||
# cat my-prometheus-rules.yaml | gojsontoyaml -yamltojson | jq . > my-prometheus-rules.json
|
||||
prometheusRules+:: {
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
groups+: import 'my-prometheus-rules.json',
|
||||
|
||||
|
||||
},
|
||||
};
|
||||
|
||||
|
||||
# Render
|
||||
{ ['00namespace-' + name]: kp.kubePrometheus[name] for name in std.objectFields(kp.kubePrometheus) } +
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
{ ['0prometheus-operator-' + name]: kp.prometheusOperator[name] for name in std.objectFields(kp.prometheusOperator) } +
|
||||
|
||||
|
||||
{ ['alertmanager-' + name]: kp.alertmanager[name] for name in std.objectFields(kp.alertmanager) } +
|
||||
|
||||
{ ['grafana-' + name]: kp.grafana[name] for name in std.objectFields(kp.grafana) } +
|
||||
{ ['kube-state-metrics-' + name]: kp.kubeStateMetrics[name] for name in std.objectFields(kp.kubeStateMetrics) } +
|
||||
|
||||
{ [name + '-ingress']: kp.ingress[name] for name in std.objectFields(kp.ingress) } +
|
||||
{ ['node-exporter-' + name]: kp.nodeExporter[name] for name in std.objectFields(kp.nodeExporter) } +
|
||||
{ ['node-exporter-psp-' + name]: kp.nodeExporterPSP[name] for name in std.objectFields(kp.nodeExporterPSP) } +
|
||||
{ ['prometheus-' + name]: kp.prometheus[name] for name in std.objectFields(kp.prometheus) } +
|
||||
{ ['prometheus-adapter-' + name]: kp.prometheusAdapter[name] for name in std.objectFields(kp.prometheusAdapter) }
|
||||
|
||||
Reference in New Issue
Block a user