-
Notifications
You must be signed in to change notification settings - Fork 164
helm/metrics: add a new gauge metric to monitor helm releases #579
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Changes from all commits
File filter
Filter by extension
Conversations
Jump to
Diff view
Diff view
There are no files selected for viewing
Large diffs are not rendered by default.
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,80 @@ | ||
| package metrics | ||
|
|
||
| import ( | ||
| "log" | ||
| "os" | ||
|
|
||
| "helm.sh/helm/v3/pkg/action" | ||
| "k8s.io/cli-runtime/pkg/genericclioptions" | ||
| "k8s.io/client-go/rest" | ||
| k8smetrics "k8s.io/component-base/metrics" | ||
| "k8s.io/component-base/metrics/legacyregistry" | ||
| "k8s.io/klog/v2" | ||
| ) | ||
|
|
||
| var ( | ||
| helmChartReleaseHealthStatus = k8smetrics.NewGaugeVec( | ||
| &k8smetrics.GaugeOpts{ | ||
| Name: "helm_chart_release_health_status", | ||
| Help: "Health of the Helm release", | ||
| }, | ||
| []string{"releaseName", "chartName", "chartVersion"}, | ||
| ) | ||
| ) | ||
|
|
||
| func init() { | ||
| legacyregistry.MustRegister(helmChartReleaseHealthStatus) | ||
| } | ||
|
|
||
| func HandleHelmChartReleaseHealthStatus() { | ||
| defer recoverMetricPanic() | ||
|
|
||
| actionConfig, err := getActionConfig() | ||
| if err != nil { | ||
| klog.Errorf("metric helm_chart_release_health_status unhandled: %v", err) | ||
| return | ||
| } | ||
| listAction := action.NewList(actionConfig) | ||
| releases, err := listAction.Run() | ||
| if err != nil { | ||
| klog.Errorf("metric helm_chart_release_health_status unhandled: %v", err) | ||
| return | ||
| } | ||
|
|
||
| if len(releases) == 0 { | ||
| // Initialize metrics with value 0 | ||
| // Reference: https://prometheus.io/docs/practices/instrumentation/#avoid-missing-metrics | ||
| helmChartReleaseHealthStatus.WithLabelValues("", "", "").Set(0) | ||
| return | ||
| } | ||
|
|
||
| for _, release := range releases { | ||
| releaseStatus := release.Info.Status.String() | ||
| healthStatus := 1 | ||
| if releaseStatus == "failed" || releaseStatus == "unknown" { | ||
| healthStatus = 0 | ||
| } | ||
| klog.V(4).Infof("metric helm_chart_release_health_status %d: %s %s %s", healthStatus, release.Name, release.Chart.Metadata.Name, release.Chart.Metadata.Version) | ||
| helmChartReleaseHealthStatus.WithLabelValues(release.Name, release.Chart.Metadata.Name, release.Chart.Metadata.Version).Set(float64(healthStatus)) | ||
| } | ||
| } | ||
|
|
||
| // Reference: https://github.com/helm/helm/issues/7430#issuecomment-620489002 | ||
| func getActionConfig() (*action.Configuration, error) { | ||
| actionConfig := new(action.Configuration) | ||
| // Create the rest config instance with ServiceAccount values loaded in them | ||
| config, err := rest.InClusterConfig() | ||
| if err != nil { | ||
| return nil, err | ||
| } | ||
| // Create the ConfigFlags struct instance with initialized values from ServiceAccount | ||
| var configFlags *genericclioptions.ConfigFlags = genericclioptions.NewConfigFlags(false) | ||
| configFlags.APIServer = &config.Host | ||
| configFlags.BearerToken = &config.BearerToken | ||
| configFlags.CAFile = &config.CAFile | ||
| // Empty string for all namespaces | ||
| if err := actionConfig.Init(configFlags, "", os.Getenv("HELM_DRIVER"), log.Printf); err != nil { | ||
| return nil, err | ||
| } | ||
| return actionConfig, nil | ||
| } |
Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.
Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.
Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.
Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Why does the operator need to be able to fetch any secret from the cluster? Looks like a potential security issue. If we need we should rather create a Role for a specific namespace. But on the other hand I dont see any usage in the added code, where we are fetching any secret for the metrics.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
The
helm list --all-namespacesaction frommetrics.gorequires this particular permission. If I remove this it would produce:There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
This is pretty concerning because console-operator is effectively running as root on the cluster with this change. Is there any way to add the metrics without needing this permission?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Yeah this is a hard no. We won't escalate the console operator to have read on Secrets cluster-wide.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Understand, we are looking for alternative options to mitigate. It won't be a full solution if we have to use the users identity on the console side, but that is what we will pivot towards. For future reference @spadgett and @jwforres, If we had a way to filter Allow Rules by Resource Type like for example "type": "helm.sh/release.v1", would that work to reduce the access escalation? Trying to figure out if I propose a change in Kubernetes RBAC upstream on this.