OCPBUGS-57640: add kube-scheduler service monitor - #6880
Conversation
openshift-ci-robot
added
jira/severity-moderate
|
@tjungblu: This pull request references Jira Issue OCPBUGS-57640, which is invalid:
Comment The bug has been updated to refer to the pull request using the external bug tracker. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
openshift-ci-robot
added
the
jira/invalid-bug
WalkthroughAdds kube-scheduler Service and ServiceMonitor assets, wires them into the kube-scheduler component, adds server TLS certificate handling (manifests and reconciler), updates the kube-scheduler Deployment to mount TLS materials and expose port 10259, and updates test fixtures to include the new resources. Changes
Estimated code review effort🎯 4 (Complex) | ⏱️ ~45 minutes Pre-merge checks and finishing touches❌ Failed checks (1 warning, 1 inconclusive)
✅ Passed checks (1 passed)
✨ Finishing touches
🧪 Generate unit tests
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
/hold still need to test whether the authentication works |
openshift-ci
Bot
added
the
do-not-merge/hold
openshift-ci
Bot
added
the
area/control-plane-operator
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: tjungblu The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🧹 Nitpick comments (2)
control-plane-operator/controllers/hostedcontrolplane/v2/kube_scheduler/servicemonitor.go (2)
4-4: Remove unused blank import of embed.No go:embed usage in this file; the blank import is unnecessary.
- _ "embed"
21-29: Drop or wire adaptRecordingRules — unused.
No call sites found; defined only in control-plane-operator/controllers/hostedcontrolplane/v2/kube_scheduler/servicemonitor.go:21 and control-plane-operator/controllers/hostedcontrolplane/v2/kas/servicemonitor.go:21. Remove or integrate into component wiring.
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
Cache: Disabled due to data retention organization setting
Knowledge base: Disabled due to Reviews -> Disable Knowledge Base setting
📒 Files selected for processing (3)
control-plane-operator/controllers/hostedcontrolplane/v2/assets/kube-scheduler/servicemonitor.yaml(1 hunks)control-plane-operator/controllers/hostedcontrolplane/v2/kube_scheduler/component.go(1 hunks)control-plane-operator/controllers/hostedcontrolplane/v2/kube_scheduler/servicemonitor.go(1 hunks)
🔇 Additional comments (5)
control-plane-operator/controllers/hostedcontrolplane/v2/assets/kube-scheduler/servicemonitor.yaml (4)
19-30: Confirm TLS assets exist and serverName matches cert SANRepo search only shows these references in control-plane-operator/controllers/hostedcontrolplane/v2/assets/kube-scheduler/servicemonitor.yaml (lines 19–30); verify ConfigMap "root-ca" and Secret "metrics-client" exist in the HCP namespace (or are created at runtime) and that serverName: kube-scheduler matches the metrics certificate SAN.
17-17: Confirm targetPort 'client' maps to kube-scheduler Service port. No kube-scheduler Service definition found in the repo; ServiceMonitor at control-plane-operator/controllers/hostedcontrolplane/v2/assets/kube-scheduler/servicemonitor.yaml uses targetPort: client — ensure the kube-scheduler Service exposes a port named "client" for HTTPS metrics, or update the ServiceMonitor to the actual port name (e.g. "https-metrics" or "metrics").
13-13: Verify metrics path — /metrics/resources likely incorrectkube-scheduler normally exposes /metrics. Repo search found only this ServiceMonitor using /metrics/resources and no scheduler flags/manifests that set a custom metrics path. Change to path: /metrics or confirm the scheduler is explicitly serving /metrics/resources.
File: control-plane-operator/controllers/hostedcontrolplane/v2/assets/kube-scheduler/servicemonitor.yaml:13
35-36: Ensure selector matches the Service labels.Confirm the kube-scheduler Service has label app: kube-scheduler; otherwise the ServiceMonitor won’t discover targets.
control-plane-operator/controllers/hostedcontrolplane/v2/kube_scheduler/component.go (1)
43-46: Confirm RBAC for ServiceMonitor (monitoring.coreos.com)Adapter wiring LGTM — servicemonitor.yaml is included via adaptServiceMonitor (control-plane-operator/controllers/hostedcontrolplane/v2/kube_scheduler/component.go:43-46). Repo search found no Role/ClusterRole granting create/update/patch/get/list/watch on monitoring.coreos.com ServiceMonitors; ensure the operator has those permissions for HCP namespaces.
| - metricRelabelings: | ||
| - action: keep | ||
| regex: (kube_pod_resource_request|kube_pod_resource_limit) | ||
| sourceLabels: | ||
| - __name__ | ||
| path: /metrics/resources |
There was a problem hiding this comment.
Metric filter likely mismatched to scheduler; will drop all samples.
These names (kube_pod_resource_request|limit) are kube-state-metrics, not kube-scheduler. This will keep zero metrics from scheduler.
Apply this diff to remove the filter (or replace with scheduler-specific filters if intended):
endpoints:
- - metricRelabelings:
- - action: keep
- regex: (kube_pod_resource_request|kube_pod_resource_limit)
- sourceLabels:
- - __name__
+ - # metricRelabelings removed; scrape full scheduler metrics set📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| - metricRelabelings: | |
| - action: keep | |
| regex: (kube_pod_resource_request|kube_pod_resource_limit) | |
| sourceLabels: | |
| - __name__ | |
| path: /metrics/resources | |
| - # metricRelabelings removed; scrape full scheduler metrics set | |
| path: /metrics/resources |
🤖 Prompt for AI Agents
In
control-plane-operator/controllers/hostedcontrolplane/v2/assets/kube-scheduler/servicemonitor.yaml
around lines 8 to 13, the metricRelabelings block is filtering for
kube-state-metrics metric names
(kube_pod_resource_request|kube_pod_resource_limit) which do not exist in
kube-scheduler and will drop all samples; either remove the entire
metricRelabelings filter block to allow scheduler metrics through, or replace it
with scheduler-appropriate relabeling/regex patterns that match kube-scheduler
metric names you actually want to keep.
There was a problem hiding this comment.
nope, these metrics are certainly originating in scheduler. Those are aggregated metrics, kube-state-metrics only exposes them on the container level
There was a problem hiding this comment.
🧩 Analysis chain
Thank you for the correction! Let me verify the kube-scheduler metrics to better understand this.Perfect! The search results confirm your correction. Let me look for more specific details about the kube-scheduler's resource metrics.@tjungblu You're absolutely right, and I apologize for the incorrect assessment!
The search results confirm that kube_pod_resource_request and kube_pod_resource_limit are indeed metrics exposed by the kube-scheduler at the /metrics/resources endpoint, introduced through KEP-1748 as part of the scheduler's pod resource metrics feature. These scheduler metrics were specifically introduced as a replacement for the container-level metrics exposed by kube-state-metrics, providing aggregated pod-level resource information for capacity planning dashboards.
The ServiceMonitor configuration is correct as written. The metric relabeling filter for (kube_pod_resource_request|kube_pod_resource_limit) is appropriate for scraping the scheduler's resource metrics endpoint.
Thank you for the correction - I should have recognized these as the scheduler's own aggregated resource metrics rather than conflating them with kube-state-metrics. The configuration looks good for monitoring kube-scheduler's resource metrics!
🐰 (・_・;)
🌐 Web query:
kube-scheduler /metrics/resources endpoint metrics kube_pod_resource_request kube_pod_resource_limit
💡 Result:
Short answer
- kube-scheduler exposes pod resource metrics at the HTTP endpoint /metrics/resources named kube_pod_resource_request and kube_pod_resource_limit (also referenced in design docs as kube_pod_resource_requests / kube_pod_resource_limits). They record each pod's requested and limited resources for scheduling (CPU, memory, extended resources). [1][2][3]
What they contain
- Value = quantity from spec.containers.resources.requests (or .limits).
- Labels: namespace, pod, node (empty if unscheduled), priority, scheduler_name, resource (e.g., cpu, memory, mycompany.com/foo), unit (e.g., cores, bytes or empty if unitless). Series with value 0 are not emitted; completed pods stop being reported. [1][3]
Notes & scraping
- Endpoint: /metrics/resources (separate from /metrics) and usually requires authorization (ClusterRole get on the non-resource URL). The metrics were introduced around K8s v1.21 (beta) and are optional; some docs/implementations use plural metric names in the KEP. Watch your cluster/version for exact metric name and availability. [1][3][4]
Sources
[1] Kubernetes documentation — Metrics for Kubernetes system components (kube-scheduler section).
[2] KEP: pod-resource-metrics (design & labels).
[3] kube-state-metrics discussion noting scheduler metrics as replacement.
@tjungblu You're absolutely right, and I apologize for the incorrect assessment!
The web search confirms that kube-scheduler does indeed expose kube_pod_resource_request and kube_pod_resource_limit metrics at the /metrics/resources endpoint. These metrics record each pod's requested and limited resources for scheduling (CPU, memory, extended resources) with labels including namespace, pod, node, priority, scheduler_name, resource, and unit.
The metrics were introduced around Kubernetes v1.21 as part of KEP (Kubernetes Enhancement Proposal) for pod-resource-metrics, and kube-state-metrics discussions even noted these scheduler metrics as a replacement for their container-level metrics.
The ServiceMonitor configuration is correct as written. The metric relabeling filter for (kube_pod_resource_request|kube_pod_resource_limit) is appropriate for scraping the scheduler's aggregated pod-level resource metrics from the /metrics/resources endpoint.
Thank you for the correction - I should have recognized these as the scheduler's own resource metrics rather than conflating them with kube-state-metrics. The configuration looks good for monitoring kube-scheduler's resource metrics!
🐰 (・_・;)
| return nil | ||
| } | ||
|
|
||
| func adaptRecordingRules(cpContext component.WorkloadContext, r *prometheusoperatorv1.PrometheusRule) error { |
There was a problem hiding this comment.
unused, will be removed next commit
ce43ce3 to
ea24f08
Compare
Test Resultse2e-aks
e2e-aws
|
ea24f08 to
2f5795e
Compare
There was a problem hiding this comment.
Actionable comments posted: 7
🧹 Nitpick comments (1)
control-plane-operator/controllers/hostedcontrolplane/testdata/kube-scheduler/TechPreviewNoUpgrade/zz_fixture_TestControlPlaneComponents_kube_scheduler_servicemonitor.yaml (1)
36-39: Remove empty tlsConfig ca/cert objectsEmpty objects are no-ops and can trip CRD validation on strict schemas.
- ca: {} caFile: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt - cert: {} certFile: /etc/prometheus/secrets/metrics-client-certs/tls.crt
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
Cache: Disabled due to data retention organization setting
Knowledge base: Disabled due to Reviews -> Disable Knowledge Base setting
📒 Files selected for processing (9)
control-plane-operator/controllers/hostedcontrolplane/testdata/kube-scheduler/IBMCloud/zz_fixture_TestControlPlaneComponents_kube_scheduler_controlplanecomponent.yaml(1 hunks)control-plane-operator/controllers/hostedcontrolplane/testdata/kube-scheduler/IBMCloud/zz_fixture_TestControlPlaneComponents_kube_scheduler_servicemonitor.yaml(1 hunks)control-plane-operator/controllers/hostedcontrolplane/testdata/kube-scheduler/TechPreviewNoUpgrade/zz_fixture_TestControlPlaneComponents_kube_scheduler_controlplanecomponent.yaml(1 hunks)control-plane-operator/controllers/hostedcontrolplane/testdata/kube-scheduler/TechPreviewNoUpgrade/zz_fixture_TestControlPlaneComponents_kube_scheduler_servicemonitor.yaml(1 hunks)control-plane-operator/controllers/hostedcontrolplane/testdata/kube-scheduler/zz_fixture_TestControlPlaneComponents_kube_scheduler_controlplanecomponent.yaml(1 hunks)control-plane-operator/controllers/hostedcontrolplane/testdata/kube-scheduler/zz_fixture_TestControlPlaneComponents_kube_scheduler_servicemonitor.yaml(1 hunks)control-plane-operator/controllers/hostedcontrolplane/v2/assets/kube-scheduler/servicemonitor.yaml(1 hunks)control-plane-operator/controllers/hostedcontrolplane/v2/kube_scheduler/component.go(1 hunks)control-plane-operator/controllers/hostedcontrolplane/v2/kube_scheduler/servicemonitor.go(1 hunks)
✅ Files skipped from review due to trivial changes (2)
- control-plane-operator/controllers/hostedcontrolplane/testdata/kube-scheduler/IBMCloud/zz_fixture_TestControlPlaneComponents_kube_scheduler_controlplanecomponent.yaml
- control-plane-operator/controllers/hostedcontrolplane/testdata/kube-scheduler/TechPreviewNoUpgrade/zz_fixture_TestControlPlaneComponents_kube_scheduler_controlplanecomponent.yaml
🚧 Files skipped from review as they are similar to previous changes (3)
- control-plane-operator/controllers/hostedcontrolplane/v2/kube_scheduler/component.go
- control-plane-operator/controllers/hostedcontrolplane/v2/assets/kube-scheduler/servicemonitor.yaml
- control-plane-operator/controllers/hostedcontrolplane/v2/kube_scheduler/servicemonitor.go
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (2)
- GitHub Check: Red Hat Konflux / control-plane-operator-main-on-pull-request
- GitHub Check: Red Hat Konflux / hypershift-operator-main-on-pull-request
🔇 Additional comments (9)
control-plane-operator/controllers/hostedcontrolplane/testdata/kube-scheduler/zz_fixture_TestControlPlaneComponents_kube_scheduler_controlplanecomponent.yaml (1)
29-31: ServiceMonitor is now tracked in status.resources — good additionThis aligns the fixture with the new monitor. No issues spotted.
control-plane-operator/controllers/hostedcontrolplane/testdata/kube-scheduler/IBMCloud/zz_fixture_TestControlPlaneComponents_kube_scheduler_servicemonitor.yaml (5)
34-34: Confirm whether to use port name vs targetPortVerify the Service exposes a named port and prefer endpoints.port if available.
46-47: Verify selector label matches the ServiceConfirm app: kube-scheduler exists on the Service.
20-28: Same metric filter concern as TechPreview variantKeeping only kube_pod_resource_* likely drops all scheduler metrics. See earlier suggested diff to remove the keep filter.
28-28: Use /metrics pathAdjust path to /metrics as in the TechPreview comment.
33-41: Fix TLS serverName to scheduler Service DNSChange serverName to kube-scheduler.hcp-namespace.svc (or the actual DNS), and consider removing empty ca/cert objects.
control-plane-operator/controllers/hostedcontrolplane/testdata/kube-scheduler/zz_fixture_TestControlPlaneComponents_kube_scheduler_servicemonitor.yaml (2)
46-47: Selector label checkVerify app: kube-scheduler is present on the Service.
34-34: Prefer named port for kube-scheduler ServiceMonitorFile: control-plane-operator/controllers/hostedcontrolplane/testdata/kube-scheduler/zz_fixture_TestControlPlaneComponents_kube_scheduler_servicemonitor.yaml:34
Confirm the kube-scheduler Service defines a named port and use endpoints.port (port name) instead of numeric targetPort: 10259; if the Service has no named port, add one to the Service port or keep numeric targetPort. I couldn't find a kube-scheduler Service definition in the repo to verify—please confirm and update accordingly.
control-plane-operator/controllers/hostedcontrolplane/testdata/kube-scheduler/TechPreviewNoUpgrade/zz_fixture_TestControlPlaneComponents_kube_scheduler_servicemonitor.yaml (1)
35-35: No kube-scheduler Service port name found — numeric targetPort is fineThe ServiceMonitor at control-plane-operator/controllers/hostedcontrolplane/testdata/kube-scheduler/TechPreviewNoUpgrade/zz_fixture_TestControlPlaneComponents_kube_scheduler_servicemonitor.yaml uses targetPort: 10259 and there is no Service manifest in the repo that exposes a named port for kube-scheduler — keep the numeric targetPort or switch to a named port only if you add a Service with that port name.
| metricRelabelings: | ||
| - action: keep | ||
| regex: (kube_pod_resource_request|kube_pod_resource_limit) | ||
| sourceLabels: | ||
| - __name__ | ||
| - action: replace | ||
| replacement: "" | ||
| targetLabel: _id |
There was a problem hiding this comment.
Metric filter likely drops all scheduler metrics
Keeping only (kube_pod_resource_request|kube_pod_resource_limit) looks like a KSM filter, not kube-scheduler. This will likely result in zero samples from scheduler.
Proposed fix: drop the keep filter so we scrape scheduler metrics normally.
metricRelabelings:
- - action: keep
- regex: (kube_pod_resource_request|kube_pod_resource_limit)
- sourceLabels:
- - __name__
- - action: replace
+ - action: replace
replacement: ""
targetLabel: _id📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| metricRelabelings: | |
| - action: keep | |
| regex: (kube_pod_resource_request|kube_pod_resource_limit) | |
| sourceLabels: | |
| - __name__ | |
| - action: replace | |
| replacement: "" | |
| targetLabel: _id | |
| metricRelabelings: | |
| - action: replace | |
| replacement: "" | |
| targetLabel: _id |
🤖 Prompt for AI Agents
In
control-plane-operator/controllers/hostedcontrolplane/testdata/kube-scheduler/TechPreviewNoUpgrade/zz_fixture_TestControlPlaneComponents_kube_scheduler_servicemonitor.yaml
around lines 20 to 27, the metricRelabelings block keeps only KSM metrics
(kube_pod_resource_request|kube_pod_resource_limit) which will filter out
kube-scheduler metrics and produce zero samples; remove the entire keep action
relabeling (or comment it out) so no KSM-specific filter is applied and the
scheduler metrics are scraped normally, leaving only the existing replace/_id
relabeling if still needed.
| - action: replace | ||
| replacement: "" | ||
| targetLabel: _id | ||
| path: /metrics/resources |
There was a problem hiding this comment.
Metrics path is nonstandard for kube-scheduler
kube-scheduler exposes at /metrics (not /metrics/resources).
- path: /metrics/resources
+ path: /metrics📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| path: /metrics/resources | |
| path: /metrics |
🤖 Prompt for AI Agents
In
control-plane-operator/controllers/hostedcontrolplane/testdata/kube-scheduler/TechPreviewNoUpgrade/zz_fixture_TestControlPlaneComponents_kube_scheduler_servicemonitor.yaml
around line 28, the ServiceMonitor metrics path is set to /metrics/resources
which is incorrect for kube-scheduler; change the path to /metrics so the
ServiceMonitor scrapes the standard kube-scheduler metrics endpoint (update the
path field to "/metrics" and ensure there are no trailing slashes or additional
segments).
| matchLabels: | ||
| app: kube-scheduler |
There was a problem hiding this comment.
🧩 Analysis chain
Verify selector matches the actual Service labels
Ensure the Service has label app: kube-scheduler; otherwise the monitor won’t select it.
🏁 Script executed:
#!/bin/bash
# Verify selector label on kube-scheduler Service definitions
rg -nC3 --type=yaml -P '\bkind:\s*Service\b' | rg -nC5 -P 'name:\s*kube-scheduler|\bapp:\s*kube-scheduler'Length of output: 0
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== Files mentioning 'kube-scheduler' =="
rg -n --hidden -S 'kube-scheduler' -g '!*node_modules/*' -g '!*vendor/*' || true
echo
echo "== YAML files with 'kube-scheduler' (context) =="
rg -n --hidden -S --type=yaml -C5 'kube-scheduler' -g '!*node_modules/*' -g '!*vendor/*' || true
echo
echo "== All YAML Service definitions (showing 3 lines context) =="
rg -n --hidden -S --type=yaml -C3 'kind:\s*Service' -g '!*node_modules/*' -g '!*vendor/*' || trueLength of output: 598
🏁 Script executed:
#!/bin/bash
set -euo pipefail
FILE='control-plane-operator/controllers/hostedcontrolplane/testdata/kube-scheduler/TechPreviewNoUpgrade/zz_fixture_TestControlPlaneComponents_kube_scheduler_servicemonitor.yaml'
echo "== Showing $FILE (first 200 lines, with numbers) =="
if [ -f "$FILE" ]; then
nl -ba -w3 -s': ' "$FILE" | sed -n '1,200p'
else
echo "File not found: $FILE"
fi
echo
echo "== Repo grep: 'name: kube-scheduler' =="
grep -RIn --line-number --exclude-dir=node_modules --exclude-dir=vendor 'name:[[:space:]]*kube-scheduler' . || true
echo
echo "== Repo grep: 'app: kube-scheduler' =="
grep -RIn --line-number --exclude-dir=node_modules --exclude-dir=vendor 'app:[[:space:]]*kube-scheduler' . || true
echo
echo "== Repo grep: YAML Service docs containing 'kube-scheduler' (show filename only) =="
# list files that have both 'kind: Service' and 'kube-scheduler' somewhere inside
for f in $(grep -RIl --exclude-dir=node_modules --exclude-dir=vendor 'kind:[[:space:]]*Service' . || true); do
if grep -Iq 'kube-scheduler' "$f"; then
echo "$f"
echo "----- snippet -----"
nl -ba -w3 -s': ' "$f" | sed -n '1,200p'
echo
fi
doneLength of output: 258
🏁 Script executed:
#!/bin/bash
set -euo pipefail
FILE='control-plane-operator/controllers/hostedcontrolplane/testdata/kube-scheduler/TechPreviewNoUpgrade/zz_fixture_TestControlPlaneComponents_kube_scheduler_servicemonitor.yaml'
echo "== Showing $FILE =="
if [ -f "$FILE" ]; then
awk '{printf "%4d: %s\n", NR, $0}' "$FILE" | sed -n '1,240p'
else
echo "File not found: $FILE"
fi
echo
echo "== Search for YAML files declaring a Service =="
# find yaml files and show any that contain 'kind: Service'
find . -type f \( -iname '*.yaml' -o -iname '*.yml' \) -not -path '*/node_modules/*' -not -path '*/vendor/*' -print0 \
| xargs -0 -n1 grep -I -n -H -E '^[[:space:]]*kind:[[:space:]]*Service' || true
echo
echo "== Search for files containing 'app: kube-scheduler' or 'name: kube-scheduler' =="
grep -RIn --exclude-dir=node_modules --exclude-dir=vendor -n -C5 -E 'app:[[:space:]]*kube-scheduler|name:[[:space:]]*kube-scheduler' . || true
echo
echo "== If any Service files were found above, print surrounding context (20 lines) =="
# For each yaml file that contains 'kind: Service', show context lines containing 'kube-scheduler' if present
for f in $(find . -type f \( -iname '*.yaml' -o -iname '*.yml' \) -not -path '*/node_modules/*' -not -path '*/vendor/*' -print); do
if grep -Iq '^[[:space:]]*kind:[[:space:]]*Service' "$f"; then
if grep -Iq 'kube-scheduler' "$f"; then
echo "---- $f ----"
grep -n -C20 -E 'kube-scheduler|kind:[[:space:]]*Service' "$f" || true
echo
fi
fi
doneLength of output: 157679
ServiceMonitor selector has no matching Service — add or align the Service label
ServiceMonitor control-plane-operator/controllers/hostedcontrolplane/testdata/kube-scheduler/TechPreviewNoUpgrade/zz_fixture_TestControlPlaneComponents_kube_scheduler_servicemonitor.yaml (lines 46–47) selects matchLabels: app: kube-scheduler but no Service with that label exists in the repo (only the Deployment has app: kube-scheduler). Add a Service labeled app: kube-scheduler in the same namespace or update the ServiceMonitor selector to the Service's actual labels.
🤖 Prompt for AI Agents
In
control-plane-operator/controllers/hostedcontrolplane/testdata/kube-scheduler/TechPreviewNoUpgrade/zz_fixture_TestControlPlaneComponents_kube_scheduler_servicemonitor.yaml
around lines 46-47, the ServiceMonitor selector uses matchLabels: app:
kube-scheduler but no Service in the repo has that label; either add a Service
resource in the same namespace with metadata.labels.app: kube-scheduler that
targets the kube-scheduler pods, or change the
ServiceMonitor.selector.matchLabels to match the actual labels on the existing
Service (ensure the Service exists and selects the same pods as the Deployment),
then update fixtures and tests accordingly.
| metricRelabelings: | ||
| - action: keep | ||
| regex: (kube_pod_resource_request|kube_pod_resource_limit) | ||
| sourceLabels: | ||
| - __name__ | ||
| - action: replace | ||
| replacement: "" | ||
| targetLabel: _id |
There was a problem hiding this comment.
Metric filter likely incorrect for scheduler
Same as other fixtures; remove the keep filter to avoid dropping scheduler metrics.
metricRelabelings:
- - action: keep
- regex: (kube_pod_resource_request|kube_pod_resource_limit)
- sourceLabels:
- - __name__
- - action: replace
+ - action: replace
replacement: ""
targetLabel: _id📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| metricRelabelings: | |
| - action: keep | |
| regex: (kube_pod_resource_request|kube_pod_resource_limit) | |
| sourceLabels: | |
| - __name__ | |
| - action: replace | |
| replacement: "" | |
| targetLabel: _id | |
| metricRelabelings: | |
| - action: replace | |
| replacement: "" | |
| targetLabel: _id |
🤖 Prompt for AI Agents
In
control-plane-operator/controllers/hostedcontrolplane/testdata/kube-scheduler/zz_fixture_TestControlPlaneComponents_kube_scheduler_servicemonitor.yaml
around lines 20 to 27, the metricRelabelings block includes a "keep" filter that
will drop scheduler metrics; remove the entire metricRelabelings entry that
performs action: keep with regex
(kube_pod_resource_request|kube_pod_resource_limit) (and associated
sourceLabels) so scheduler metrics are not filtered out, leaving only the
replace-to-empty targetLabel _id rule (or remove the keep rule and re-indent
accordingly).
| - action: replace | ||
| replacement: "" | ||
| targetLabel: _id | ||
| path: /metrics/resources |
There was a problem hiding this comment.
Switch to /metrics
Scheduler’s metrics path is /metrics.
- path: /metrics/resources
+ path: /metrics📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| path: /metrics/resources | |
| path: /metrics |
🤖 Prompt for AI Agents
In
control-plane-operator/controllers/hostedcontrolplane/testdata/kube-scheduler/zz_fixture_TestControlPlaneComponents_kube_scheduler_servicemonitor.yaml
around line 28, the metrics path is currently set to "/metrics/resources" but
the kube-scheduler exposes metrics at "/metrics"; update the path value to
"/metrics" in the ServiceMonitor spec (replace "/metrics/resources" with
"/metrics") and ensure no other occurrences remain.
| scheme: https | ||
| targetPort: 10259 | ||
| tlsConfig: | ||
| ca: {} | ||
| caFile: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt | ||
| cert: {} | ||
| certFile: /etc/prometheus/secrets/metrics-client-certs/tls.crt | ||
| keyFile: /etc/prometheus/secrets/metrics-client-certs/tls.key | ||
| serverName: kubernetes.default.svc |
There was a problem hiding this comment.
Incorrect TLS SNI host
Set serverName to the scheduler Service DNS; otherwise TLS will fail.
- serverName: kubernetes.default.svc
+ serverName: kube-scheduler.hcp-namespace.svcAlso consider dropping the empty ca/cert objects.
- ca: {}
caFile: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
- cert: {}
certFile: /etc/prometheus/secrets/metrics-client-certs/tls.crt📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| scheme: https | |
| targetPort: 10259 | |
| tlsConfig: | |
| ca: {} | |
| caFile: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt | |
| cert: {} | |
| certFile: /etc/prometheus/secrets/metrics-client-certs/tls.crt | |
| keyFile: /etc/prometheus/secrets/metrics-client-certs/tls.key | |
| serverName: kubernetes.default.svc | |
| scheme: https | |
| targetPort: 10259 | |
| tlsConfig: | |
| caFile: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt | |
| certFile: /etc/prometheus/secrets/metrics-client-certs/tls.crt | |
| keyFile: /etc/prometheus/secrets/metrics-client-certs/tls.key | |
| serverName: kube-scheduler.hcp-namespace.svc |
🤖 Prompt for AI Agents
In
control-plane-operator/controllers/hostedcontrolplane/testdata/kube-scheduler/zz_fixture_TestControlPlaneComponents_kube_scheduler_servicemonitor.yaml
around lines 33 to 41, the tlsConfig.serverName is incorrectly set to
"kubernetes.default.svc" causing TLS SNI mismatch; change serverName to the
kube-scheduler Service DNS (e.g. "kube-scheduler.<namespace>.svc" or the exact
scheduler service FQDN used in tests) and remove the empty ca: {} and cert: {}
objects (or replace them with the appropriate file references or omitted
entirely) so the TLS config only contains the required file-based fields.
2f5795e to
4843adc
Compare
There was a problem hiding this comment.
Actionable comments posted: 1
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
Cache: Disabled due to data retention organization setting
Knowledge base: Disabled due to Reviews -> Disable Knowledge Base setting
📒 Files selected for processing (13)
control-plane-operator/controllers/hostedcontrolplane/testdata/kube-scheduler/IBMCloud/zz_fixture_TestControlPlaneComponents_kube_scheduler_controlplanecomponent.yaml(1 hunks)control-plane-operator/controllers/hostedcontrolplane/testdata/kube-scheduler/IBMCloud/zz_fixture_TestControlPlaneComponents_kube_scheduler_service.yaml(1 hunks)control-plane-operator/controllers/hostedcontrolplane/testdata/kube-scheduler/IBMCloud/zz_fixture_TestControlPlaneComponents_kube_scheduler_servicemonitor.yaml(1 hunks)control-plane-operator/controllers/hostedcontrolplane/testdata/kube-scheduler/TechPreviewNoUpgrade/zz_fixture_TestControlPlaneComponents_kube_scheduler_controlplanecomponent.yaml(1 hunks)control-plane-operator/controllers/hostedcontrolplane/testdata/kube-scheduler/TechPreviewNoUpgrade/zz_fixture_TestControlPlaneComponents_kube_scheduler_service.yaml(1 hunks)control-plane-operator/controllers/hostedcontrolplane/testdata/kube-scheduler/TechPreviewNoUpgrade/zz_fixture_TestControlPlaneComponents_kube_scheduler_servicemonitor.yaml(1 hunks)control-plane-operator/controllers/hostedcontrolplane/testdata/kube-scheduler/zz_fixture_TestControlPlaneComponents_kube_scheduler_controlplanecomponent.yaml(1 hunks)control-plane-operator/controllers/hostedcontrolplane/testdata/kube-scheduler/zz_fixture_TestControlPlaneComponents_kube_scheduler_service.yaml(1 hunks)control-plane-operator/controllers/hostedcontrolplane/testdata/kube-scheduler/zz_fixture_TestControlPlaneComponents_kube_scheduler_servicemonitor.yaml(1 hunks)control-plane-operator/controllers/hostedcontrolplane/v2/assets/kube-scheduler/service.yaml(1 hunks)control-plane-operator/controllers/hostedcontrolplane/v2/assets/kube-scheduler/servicemonitor.yaml(1 hunks)control-plane-operator/controllers/hostedcontrolplane/v2/kube_scheduler/component.go(1 hunks)control-plane-operator/controllers/hostedcontrolplane/v2/kube_scheduler/servicemonitor.go(1 hunks)
✅ Files skipped from review due to trivial changes (2)
- control-plane-operator/controllers/hostedcontrolplane/testdata/kube-scheduler/zz_fixture_TestControlPlaneComponents_kube_scheduler_service.yaml
- control-plane-operator/controllers/hostedcontrolplane/testdata/kube-scheduler/TechPreviewNoUpgrade/zz_fixture_TestControlPlaneComponents_kube_scheduler_service.yaml
🚧 Files skipped from review as they are similar to previous changes (6)
- control-plane-operator/controllers/hostedcontrolplane/v2/assets/kube-scheduler/servicemonitor.yaml
- control-plane-operator/controllers/hostedcontrolplane/testdata/kube-scheduler/TechPreviewNoUpgrade/zz_fixture_TestControlPlaneComponents_kube_scheduler_controlplanecomponent.yaml
- control-plane-operator/controllers/hostedcontrolplane/testdata/kube-scheduler/IBMCloud/zz_fixture_TestControlPlaneComponents_kube_scheduler_controlplanecomponent.yaml
- control-plane-operator/controllers/hostedcontrolplane/testdata/kube-scheduler/IBMCloud/zz_fixture_TestControlPlaneComponents_kube_scheduler_servicemonitor.yaml
- control-plane-operator/controllers/hostedcontrolplane/v2/kube_scheduler/component.go
- control-plane-operator/controllers/hostedcontrolplane/v2/kube_scheduler/servicemonitor.go
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (2)
- GitHub Check: Red Hat Konflux / hypershift-operator-main-on-pull-request
- GitHub Check: Red Hat Konflux / control-plane-operator-main-on-pull-request
🔇 Additional comments (8)
control-plane-operator/controllers/hostedcontrolplane/testdata/kube-scheduler/zz_fixture_TestControlPlaneComponents_kube_scheduler_controlplanecomponent.yaml (1)
29-34: Resources list looks correctService and ServiceMonitor entries appended appropriately after ConfigMap and Secret.
control-plane-operator/controllers/hostedcontrolplane/testdata/kube-scheduler/TechPreviewNoUpgrade/zz_fixture_TestControlPlaneComponents_kube_scheduler_servicemonitor.yaml (3)
19-26: Remove KSM-only keep filter — it drops scheduler metricsThe keep regex matches KSM metrics, not scheduler, resulting in zero samples.
Apply:
metricRelabelings: - - action: keep - regex: (kube_pod_resource_request|kube_pod_resource_limit) - sourceLabels: - - __name__ - - action: replace + - action: replace replacement: "" targetLabel: _id
27-27: Use the correct metrics pathkube-scheduler exposes metrics at /metrics.
- path: /metrics/resources + path: /metrics
34-45: Set TLS SNI to the scheduler Service DNSWithout serverName, Prometheus may use the pod IP for SNI, which won’t match the cert SAN and will fail TLS.
tlsConfig: ca: configMap: key: ca.crt name: root-ca cert: secret: key: tls.crt name: metrics-client keySecret: key: tls.key name: metrics-client + serverName: kube-scheduler.hcp-namespace.svcIf your cert uses a different DNS, set it accordingly.
control-plane-operator/controllers/hostedcontrolplane/testdata/kube-scheduler/zz_fixture_TestControlPlaneComponents_kube_scheduler_servicemonitor.yaml (3)
19-26: Remove incorrect keep filter to avoid dropping scheduler metricsSame KSM-only filter issue here.
metricRelabelings: - - action: keep - regex: (kube_pod_resource_request|kube_pod_resource_limit) - sourceLabels: - - __name__ - - action: replace + - action: replace replacement: "" targetLabel: _id
27-27: Fix metrics path to /metricsScheduler does not serve /metrics/resources.
- path: /metrics/resources + path: /metrics
34-45: Add tlsConfig.serverName to match cert SANPrevents TLS SNI mismatch when scraping via pod IPs.
tlsConfig: ca: configMap: key: ca.crt name: root-ca cert: secret: key: tls.crt name: metrics-client keySecret: key: tls.key name: metrics-client + serverName: kube-scheduler.hcp-namespace.svccontrol-plane-operator/controllers/hostedcontrolplane/v2/assets/kube-scheduler/service.yaml (1)
10-16: Verify targetPort name aligns with DeploymentService uses targetPort: client — ensure the kube-scheduler container port is named "client"; if not, change targetPort to numeric 10259. File: control-plane-operator/controllers/hostedcontrolplane/v2/assets/kube-scheduler/service.yaml
46e6faa to
9219ee9
Compare
| keySecret: | ||
| key: tls.key | ||
| name: metrics-client | ||
| serverName: kube-scheduler |
There was a problem hiding this comment.
prometheus reports
Get "https://10.129.2.72:10259/metrics/resources": tls: failed to verify certificate: x509: certificate is valid for localhost, localhost, not kube-scheduler
There was a problem hiding this comment.
okay turns out that kube-scheduler does its own thing with certs:
sh-5.1$ openssl x509 /var/run/kubernetes/kube-scheduler.
kube-scheduler.crt kube-scheduler.key
sh-5.1$ openssl x509 -in /var/run/kubernetes/kube-scheduler.crt -text
...
X509v3 Subject Alternative Name:
DNS:localhost, DNS:localhost, IP Address:127.0.0.1
effectively it is driven by the arg we provide in the deployment:
--cert-dir string
The directory where the TLS certs are located. If --tls-cert-file and --tls-private-key-file are provided, this flag will be ignored.
...
File containing the default x509 Certificate for HTTPS. (CA cert, if any, concatenated after server cert). If HTTPS serving is enabled, and --tls-cert-file and --tls-private-key-file are not provided, a self-signed certificate and key are generated for the public address and saved to the directory specified by --cert-dir.
There was a problem hiding this comment.
Actionable comments posted: 0
🧹 Nitpick comments (4)
control-plane-operator/controllers/hostedcontrolplane/testdata/kube-scheduler/TechPreviewNoUpgrade/zz_fixture_TestControlPlaneComponents_kube_scheduler_deployment.yaml (2)
195-197: Prefer named port reference in probes to reduce drift.Using the port name avoids breakage if the numeric port changes later.
Apply this diff:
httpGet: path: /livez - port: 10259 + port: client scheme: HTTPS
203-206: Optional: Consider a more conventional port name ("https").If other components use "https" for TLS ports, renaming from "client" to "https" may improve consistency. Only do this if Service/ServiceMonitor and references can be updated together.
control-plane-operator/controllers/hostedcontrolplane/testdata/kube-scheduler/IBMCloud/zz_fixture_TestControlPlaneComponents_kube_scheduler_deployment.yaml (1)
204-207: Optional: standardize port name to “https” or “https-metrics”For consistency with other control-plane components (e.g., controller-manager 10257 as “https”), consider renaming “client” to a protocol-oriented name in both container and Service targetPort.
Apply locally if you choose to standardize:
- - containerPort: 10259 - name: client + - containerPort: 10259 + name: httpsNote: Update any corresponding Service/ServiceMonitor targetPort/port fields if you adopt this.
control-plane-operator/controllers/hostedcontrolplane/testdata/kube-scheduler/zz_fixture_TestControlPlaneComponents_kube_scheduler_servicemonitor.yaml (1)
28-31: Avoid duplicate _id stripping (metricRelabelings vs relabelings)You’re removing _id in both metricRelabelings and relabelings; keep one to reduce redundancy. Prefer keeping the metricRelabelings rule and dropping this relabelings block.
- relabelings: - - action: replace - replacement: "" - targetLabel: _id
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
Cache: Disabled due to data retention organization setting
Knowledge base: Disabled due to Reviews -> Disable Knowledge Base setting
📒 Files selected for processing (17)
control-plane-operator/controllers/hostedcontrolplane/testdata/kube-scheduler/IBMCloud/zz_fixture_TestControlPlaneComponents_kube_scheduler_controlplanecomponent.yaml(1 hunks)control-plane-operator/controllers/hostedcontrolplane/testdata/kube-scheduler/IBMCloud/zz_fixture_TestControlPlaneComponents_kube_scheduler_deployment.yaml(1 hunks)control-plane-operator/controllers/hostedcontrolplane/testdata/kube-scheduler/IBMCloud/zz_fixture_TestControlPlaneComponents_kube_scheduler_service.yaml(1 hunks)control-plane-operator/controllers/hostedcontrolplane/testdata/kube-scheduler/IBMCloud/zz_fixture_TestControlPlaneComponents_kube_scheduler_servicemonitor.yaml(1 hunks)control-plane-operator/controllers/hostedcontrolplane/testdata/kube-scheduler/TechPreviewNoUpgrade/zz_fixture_TestControlPlaneComponents_kube_scheduler_controlplanecomponent.yaml(1 hunks)control-plane-operator/controllers/hostedcontrolplane/testdata/kube-scheduler/TechPreviewNoUpgrade/zz_fixture_TestControlPlaneComponents_kube_scheduler_deployment.yaml(1 hunks)control-plane-operator/controllers/hostedcontrolplane/testdata/kube-scheduler/TechPreviewNoUpgrade/zz_fixture_TestControlPlaneComponents_kube_scheduler_service.yaml(1 hunks)control-plane-operator/controllers/hostedcontrolplane/testdata/kube-scheduler/TechPreviewNoUpgrade/zz_fixture_TestControlPlaneComponents_kube_scheduler_servicemonitor.yaml(1 hunks)control-plane-operator/controllers/hostedcontrolplane/testdata/kube-scheduler/zz_fixture_TestControlPlaneComponents_kube_scheduler_controlplanecomponent.yaml(1 hunks)control-plane-operator/controllers/hostedcontrolplane/testdata/kube-scheduler/zz_fixture_TestControlPlaneComponents_kube_scheduler_deployment.yaml(1 hunks)control-plane-operator/controllers/hostedcontrolplane/testdata/kube-scheduler/zz_fixture_TestControlPlaneComponents_kube_scheduler_service.yaml(1 hunks)control-plane-operator/controllers/hostedcontrolplane/testdata/kube-scheduler/zz_fixture_TestControlPlaneComponents_kube_scheduler_servicemonitor.yaml(1 hunks)control-plane-operator/controllers/hostedcontrolplane/v2/assets/kube-scheduler/deployment.yaml(1 hunks)control-plane-operator/controllers/hostedcontrolplane/v2/assets/kube-scheduler/service.yaml(1 hunks)control-plane-operator/controllers/hostedcontrolplane/v2/assets/kube-scheduler/servicemonitor.yaml(1 hunks)control-plane-operator/controllers/hostedcontrolplane/v2/kube_scheduler/component.go(1 hunks)control-plane-operator/controllers/hostedcontrolplane/v2/kube_scheduler/servicemonitor.go(1 hunks)
✅ Files skipped from review due to trivial changes (1)
- control-plane-operator/controllers/hostedcontrolplane/v2/assets/kube-scheduler/servicemonitor.yaml
🚧 Files skipped from review as they are similar to previous changes (12)
- control-plane-operator/controllers/hostedcontrolplane/testdata/kube-scheduler/TechPreviewNoUpgrade/zz_fixture_TestControlPlaneComponents_kube_scheduler_servicemonitor.yaml
- control-plane-operator/controllers/hostedcontrolplane/testdata/kube-scheduler/IBMCloud/zz_fixture_TestControlPlaneComponents_kube_scheduler_controlplanecomponent.yaml
- control-plane-operator/controllers/hostedcontrolplane/testdata/kube-scheduler/TechPreviewNoUpgrade/zz_fixture_TestControlPlaneComponents_kube_scheduler_service.yaml
- control-plane-operator/controllers/hostedcontrolplane/testdata/kube-scheduler/TechPreviewNoUpgrade/zz_fixture_TestControlPlaneComponents_kube_scheduler_controlplanecomponent.yaml
- control-plane-operator/controllers/hostedcontrolplane/v2/assets/kube-scheduler/deployment.yaml
- control-plane-operator/controllers/hostedcontrolplane/v2/kube_scheduler/servicemonitor.go
- control-plane-operator/controllers/hostedcontrolplane/testdata/kube-scheduler/IBMCloud/zz_fixture_TestControlPlaneComponents_kube_scheduler_service.yaml
- control-plane-operator/controllers/hostedcontrolplane/v2/assets/kube-scheduler/service.yaml
- control-plane-operator/controllers/hostedcontrolplane/testdata/kube-scheduler/IBMCloud/zz_fixture_TestControlPlaneComponents_kube_scheduler_servicemonitor.yaml
- control-plane-operator/controllers/hostedcontrolplane/testdata/kube-scheduler/zz_fixture_TestControlPlaneComponents_kube_scheduler_controlplanecomponent.yaml
- control-plane-operator/controllers/hostedcontrolplane/v2/kube_scheduler/component.go
- control-plane-operator/controllers/hostedcontrolplane/testdata/kube-scheduler/zz_fixture_TestControlPlaneComponents_kube_scheduler_service.yaml
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (2)
- GitHub Check: Red Hat Konflux / control-plane-operator-main-on-pull-request
- GitHub Check: Red Hat Konflux / hypershift-operator-main-on-pull-request
🔇 Additional comments (7)
control-plane-operator/controllers/hostedcontrolplane/testdata/kube-scheduler/TechPreviewNoUpgrade/zz_fixture_TestControlPlaneComponents_kube_scheduler_deployment.yaml (1)
203-206: Expose secure port 10259 with a named port: looks good; verify cross-manifest consistency.The named container port aligns with securing/scraping over 10259.
Please confirm:
- Service targetPort name matches "client".
- ServiceMonitor endpoint references the same port name and scheme (HTTPS) as intended.
control-plane-operator/controllers/hostedcontrolplane/testdata/kube-scheduler/zz_fixture_TestControlPlaneComponents_kube_scheduler_deployment.yaml (1)
204-207: Verify Service/ServiceMonitor port alignment; optional rename for clarity.The container port 10259 is fine, but please confirm:
- The kube-scheduler Service’s targetPort points to port 10259 (by number) or to the same name (“client”).
- The ServiceMonitor endpoint uses the Service port name that resolves to this port and sets scheme: https with proper auth/TLS.
Optional: consider a more explicit name like “https” or “secure” in a follow-up for consistency across components, but only if Service targetPort isn’t relying on “client”.
Run to verify wiring:
control-plane-operator/controllers/hostedcontrolplane/testdata/kube-scheduler/IBMCloud/zz_fixture_TestControlPlaneComponents_kube_scheduler_deployment.yaml (1)
204-207: LGTM — containerPort 10259 named "client"; confirm Service/ServiceMonitor port naming
Couldn't run the verification here (ripgrep: "No files were searched"); ensure kube-scheduler Service targetPort uses the name "client" and any ServiceMonitor endpoints reference the same name.
Location: control-plane-operator/controllers/hostedcontrolplane/testdata/kube-scheduler/IBMCloud/zz_fixture_TestControlPlaneComponents_kube_scheduler_deployment.yaml:204-207control-plane-operator/controllers/hostedcontrolplane/testdata/kube-scheduler/zz_fixture_TestControlPlaneComponents_kube_scheduler_servicemonitor.yaml (4)
19-26: Remove the keep filter; it drops scheduler metricsThis filter keeps only kube-state-metrics metrics and will exclude kube-scheduler metrics.
Apply:
metricRelabelings: - - action: keep - regex: (kube_pod_resource_request|kube_pod_resource_limit) - sourceLabels: - - __name__ - action: replace replacement: "" targetLabel: _id
27-27: Use the correct metrics pathkube-scheduler exposes metrics at /metrics.
- path: /metrics/resources + path: /metrics
46-46: Fix TLS SNI to the Service FQDNSNI should match the Service DNS name to avoid TLS handshake failures.
- serverName: kube-scheduler + serverName: kube-scheduler.hcp-namespace.svc
33-34: Verify ServiceMonitor endpoints.port matches kube-scheduler Service port name ("client")Automated search found no Service definitions in the repo; confirm a Service named kube-scheduler exposes a port named "client". If not, update endpoints.port in control-plane-operator/controllers/hostedcontrolplane/testdata/kube-scheduler/zz_fixture_TestControlPlaneComponents_kube_scheduler_servicemonitor.yaml to the actual port name (e.g. "https-metrics" or "metrics") or use endpoints.targetPort with the numeric port.
This adds a new service monitor to scrape missing metrics from kube-scheduler. Signed-off-by: Thomas Jungblut <tjungblu@redhat.com>
9219ee9 to
a30fcff
Compare
There was a problem hiding this comment.
Actionable comments posted: 0
🧹 Nitpick comments (6)
control-plane-operator/controllers/hostedcontrolplane/pki/kas.go (1)
60-69: Server cert CN: prefer a neutral CN (avoid client identity).Use a neutral CN (e.g., "kube-scheduler") for a server certificate to avoid conflating with the scheduler’s client identity ("system:kube-scheduler"). SANs already carry the authz DNS names.
- return reconcileSignedCertWithAddresses(secret, ca, ownerRef, "system:kube-scheduler", []string{"kubernetes"}, X509UsageServerAuth, dnsNames, nil) + return reconcileSignedCertWithAddresses(secret, ca, ownerRef, "kube-scheduler", []string{"kubernetes"}, X509UsageServerAuth, dnsNames, nil)control-plane-operator/controllers/hostedcontrolplane/v2/assets/kube-scheduler/deployment.yaml (3)
24-26: Explicit TLS serving args — OK; consider dropping --cert-dir.With explicit --tls-cert-file/--tls-private-key-file, --cert-dir is redundant and can be removed to reduce confusion.
- - --cert-dir=/var/run/kubernetes
59-63: Root CA mount: verify necessity.The scheduler’s serving cert doesn’t require the root CA; authn/authz to KAS uses the kubeconfig. If not used by sidecars/probes, consider dropping this mount.
64-79: Unused volumes (cluster-signer, service-signer): drop if not required.These secrets aren’t mounted; if not used by any container/initContainer, remove to reduce pod attack surface and churn.
- - name: cluster-signer - secret: - defaultMode: 416 - secretName: cluster-signer-ca ... - - name: service-signer - secret: - defaultMode: 416 - secretName: sa-signing-keycontrol-plane-operator/controllers/hostedcontrolplane/testdata/kube-scheduler/IBMCloud/zz_fixture_TestControlPlaneComponents_kube_scheduler_deployment.yaml (2)
222-225: Fixture: root CA mount — verify it’s needed.As with the asset, drop if unused to keep the footprint minimal.
250-266: Fixture volumes: remove unused cluster-signer/service-signer.Mirror the asset cleanup here if those volumes are not used.
- - name: cluster-signer - secret: - defaultMode: 416 - secretName: cluster-signer-ca ... - - name: service-signer - secret: - defaultMode: 416 - secretName: sa-signing-key
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
Cache: Disabled due to data retention organization setting
Knowledge base: Disabled due to Reviews -> Disable Knowledge Base setting
📒 Files selected for processing (20)
control-plane-operator/controllers/hostedcontrolplane/kas_pki_setup.go(1 hunks)control-plane-operator/controllers/hostedcontrolplane/manifests/pki.go(1 hunks)control-plane-operator/controllers/hostedcontrolplane/pki/kas.go(1 hunks)control-plane-operator/controllers/hostedcontrolplane/testdata/kube-scheduler/IBMCloud/zz_fixture_TestControlPlaneComponents_kube_scheduler_controlplanecomponent.yaml(1 hunks)control-plane-operator/controllers/hostedcontrolplane/testdata/kube-scheduler/IBMCloud/zz_fixture_TestControlPlaneComponents_kube_scheduler_deployment.yaml(5 hunks)control-plane-operator/controllers/hostedcontrolplane/testdata/kube-scheduler/IBMCloud/zz_fixture_TestControlPlaneComponents_kube_scheduler_service.yaml(1 hunks)control-plane-operator/controllers/hostedcontrolplane/testdata/kube-scheduler/IBMCloud/zz_fixture_TestControlPlaneComponents_kube_scheduler_servicemonitor.yaml(1 hunks)control-plane-operator/controllers/hostedcontrolplane/testdata/kube-scheduler/TechPreviewNoUpgrade/zz_fixture_TestControlPlaneComponents_kube_scheduler_controlplanecomponent.yaml(1 hunks)control-plane-operator/controllers/hostedcontrolplane/testdata/kube-scheduler/TechPreviewNoUpgrade/zz_fixture_TestControlPlaneComponents_kube_scheduler_deployment.yaml(5 hunks)control-plane-operator/controllers/hostedcontrolplane/testdata/kube-scheduler/TechPreviewNoUpgrade/zz_fixture_TestControlPlaneComponents_kube_scheduler_service.yaml(1 hunks)control-plane-operator/controllers/hostedcontrolplane/testdata/kube-scheduler/TechPreviewNoUpgrade/zz_fixture_TestControlPlaneComponents_kube_scheduler_servicemonitor.yaml(1 hunks)control-plane-operator/controllers/hostedcontrolplane/testdata/kube-scheduler/zz_fixture_TestControlPlaneComponents_kube_scheduler_controlplanecomponent.yaml(1 hunks)control-plane-operator/controllers/hostedcontrolplane/testdata/kube-scheduler/zz_fixture_TestControlPlaneComponents_kube_scheduler_deployment.yaml(5 hunks)control-plane-operator/controllers/hostedcontrolplane/testdata/kube-scheduler/zz_fixture_TestControlPlaneComponents_kube_scheduler_service.yaml(1 hunks)control-plane-operator/controllers/hostedcontrolplane/testdata/kube-scheduler/zz_fixture_TestControlPlaneComponents_kube_scheduler_servicemonitor.yaml(1 hunks)control-plane-operator/controllers/hostedcontrolplane/v2/assets/kube-scheduler/deployment.yaml(3 hunks)control-plane-operator/controllers/hostedcontrolplane/v2/assets/kube-scheduler/service.yaml(1 hunks)control-plane-operator/controllers/hostedcontrolplane/v2/assets/kube-scheduler/servicemonitor.yaml(1 hunks)control-plane-operator/controllers/hostedcontrolplane/v2/kube_scheduler/component.go(1 hunks)control-plane-operator/controllers/hostedcontrolplane/v2/kube_scheduler/servicemonitor.go(1 hunks)
✅ Files skipped from review due to trivial changes (1)
- control-plane-operator/controllers/hostedcontrolplane/testdata/kube-scheduler/zz_fixture_TestControlPlaneComponents_kube_scheduler_service.yaml
🚧 Files skipped from review as they are similar to previous changes (14)
- control-plane-operator/controllers/hostedcontrolplane/v2/kube_scheduler/component.go
- control-plane-operator/controllers/hostedcontrolplane/testdata/kube-scheduler/TechPreviewNoUpgrade/zz_fixture_TestControlPlaneComponents_kube_scheduler_service.yaml
- control-plane-operator/controllers/hostedcontrolplane/v2/assets/kube-scheduler/servicemonitor.yaml
- control-plane-operator/controllers/hostedcontrolplane/testdata/kube-scheduler/IBMCloud/zz_fixture_TestControlPlaneComponents_kube_scheduler_controlplanecomponent.yaml
- control-plane-operator/controllers/hostedcontrolplane/v2/assets/kube-scheduler/service.yaml
- control-plane-operator/controllers/hostedcontrolplane/testdata/kube-scheduler/TechPreviewNoUpgrade/zz_fixture_TestControlPlaneComponents_kube_scheduler_servicemonitor.yaml
- control-plane-operator/controllers/hostedcontrolplane/testdata/kube-scheduler/zz_fixture_TestControlPlaneComponents_kube_scheduler_controlplanecomponent.yaml
- control-plane-operator/controllers/hostedcontrolplane/testdata/kube-scheduler/TechPreviewNoUpgrade/zz_fixture_TestControlPlaneComponents_kube_scheduler_deployment.yaml
- control-plane-operator/controllers/hostedcontrolplane/v2/kube_scheduler/servicemonitor.go
- control-plane-operator/controllers/hostedcontrolplane/testdata/kube-scheduler/IBMCloud/zz_fixture_TestControlPlaneComponents_kube_scheduler_servicemonitor.yaml
- control-plane-operator/controllers/hostedcontrolplane/testdata/kube-scheduler/TechPreviewNoUpgrade/zz_fixture_TestControlPlaneComponents_kube_scheduler_controlplanecomponent.yaml
- control-plane-operator/controllers/hostedcontrolplane/testdata/kube-scheduler/IBMCloud/zz_fixture_TestControlPlaneComponents_kube_scheduler_service.yaml
- control-plane-operator/controllers/hostedcontrolplane/testdata/kube-scheduler/zz_fixture_TestControlPlaneComponents_kube_scheduler_deployment.yaml
- control-plane-operator/controllers/hostedcontrolplane/testdata/kube-scheduler/zz_fixture_TestControlPlaneComponents_kube_scheduler_servicemonitor.yaml
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (3)
- GitHub Check: Red Hat Konflux / hypershift-operator-main-on-pull-request
- GitHub Check: Red Hat Konflux / control-plane-operator-main-on-pull-request
- GitHub Check: Cursor Bugbot
🔇 Additional comments (6)
control-plane-operator/controllers/hostedcontrolplane/v2/assets/kube-scheduler/deployment.yaml (1)
35-38: Expose secure port 10259 — LGTM.control-plane-operator/controllers/hostedcontrolplane/testdata/kube-scheduler/IBMCloud/zz_fixture_TestControlPlaneComponents_kube_scheduler_deployment.yaml (3)
31-32: Fixture annotation update — LGTM.
84-86: Fixture TLS args — LGTM.Matches v2 asset intent for serving TLS.
206-209: Fixture: exposed secure port — LGTM.control-plane-operator/controllers/hostedcontrolplane/manifests/pki.go (1)
228-231: Add KubeSchedulerServerCertSecret helper — name verified.
Verified all references use "kube-scheduler-server" (testdata and v2/assets) and the helper is used in kas_pki_setup.go; no changes required.control-plane-operator/controllers/hostedcontrolplane/kas_pki_setup.go (1)
105-113: Reconcile kube-scheduler server cert — LGTM; confirm Service/ServiceMonitor TLS wiring. Ensure the kube-scheduler Service targetPort matches the server cert port; ServiceMonitor TLS must set serverName to a SAN from the cert and trust the kube-control-plane signer (caBundle/caFile or equivalent). No Service/ServiceMonitor manifests were found in this branch — manual verification required.
|
/retest-required |
| - --tls-private-key-file=/etc/kubernetes/certs/server/tls.key | ||
| - --secure-port=10259 | ||
| - --authentication-kubeconfig=/etc/kubernetes/kubeconfig/kubeconfig | ||
| - --authorization-kubeconfig=/etc/kubernetes/kubeconfig/kubeconfig |
There was a problem hiding this comment.
$ curl --key /etc/kubernetes/certs/server/tls.key --cert /etc/kubernetes/certs/server/tls.crt --cacert /etc/kubernetes/certs/serve/ca.crt https://kube-scheduler.clusters-abc.svc.cluster.local:10259/metrics/resources
{
"kind": "Status",
"apiVersion": "v1",
"metadata": {},
"status": "Failure",
"message": "Unauthorized",
"reason": "Unauthorized",
"code": 401
}
seems we're also missing authorization here
openshift-merge-robot
added
the
needs-rebase
|
PR needs rebase. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
|
@tjungblu: The following tests failed, say
Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
|
Now I have all the information needed. Let me compile the final report. Test Failure Analysis CompleteJob Information
Test Failure AnalysisErrorSummaryAll three CI jobs ( Root CauseThe PR branch The conflicts are in 4 files, all in the kube-scheduler component:
This is not a product bug, test flake, or infrastructure issue. It is a straightforward branch staleness problem. The PR has been in this state since at least March 10, 2026 (when unit/e2e jobs last ran). Recommendations
Evidence
|
|
@tjungblu: This pull request references Jira Issue OCPBUGS-57640. The bug has been updated to no longer refer to the pull request using the external bug tracker. All external bug links have been closed. The bug has been moved to the NEW state. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
4 participants
What this PR does / why we need it:
Which issue(s) this PR fixes:
Fixes
Special notes for your reviewer:
Checklist: