Skip to content
Closed
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Original file line number Diff line number Diff line change
Expand Up @@ -102,6 +102,15 @@ func (r *HostedControlPlaneReconciler) setupKASClientSigners(
return err
}

// kube-scheduler server cert
if _, err := reconcileSub(
manifests.KubeSchedulerServerCertSecret(hcp.Namespace),
kubeControlPlaneSigner,
pki.ReconcileKubeSchedulerServerCertSecret,
); err != nil {
return err
}

// KCM client cert
if _, err := reconcileSub(
manifests.KubeControllerManagerClientCertSecret(hcp.Namespace),
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -225,6 +225,10 @@ func KubeSchedulerClientCertSecret(ns string) *corev1.Secret {
return secretFor(ns, "kube-scheduler-client")
}

func KubeSchedulerServerCertSecret(ns string) *corev1.Secret {
return secretFor(ns, "kube-scheduler-server")
}

func KubeControllerManagerClientCertSecret(ns string) *corev1.Secret {
return secretFor(ns, "kube-controller-manager")
}
Expand Down
10 changes: 10 additions & 0 deletions control-plane-operator/controllers/hostedcontrolplane/pki/kas.go
Original file line number Diff line number Diff line change
Expand Up @@ -57,6 +57,16 @@ func ReconcileKubeSchedulerClientCertSecret(secret, ca *corev1.Secret, ownerRef
return reconcileSignedCert(secret, ca, ownerRef, "system:kube-scheduler", []string{"kubernetes"}, X509UsageClientAuth)
}

func ReconcileKubeSchedulerServerCertSecret(secret, ca *corev1.Secret, ownerRef config.OwnerRef) error {
svcName := "kube-scheduler"
dnsNames := []string{
svcName,
fmt.Sprintf("%s.%s.svc", svcName, secret.Namespace),
fmt.Sprintf("%s.%s.svc.cluster.local", svcName, secret.Namespace),
}
return reconcileSignedCertWithAddresses(secret, ca, ownerRef, "system:kube-scheduler", []string{"kubernetes"}, X509UsageServerAuth, dnsNames, nil)
}

func ReconcileKubeControllerManagerClientCertSecret(secret, ca *corev1.Secret, ownerRef config.OwnerRef) error {
return reconcileSignedCert(secret, ca, ownerRef, "system:kube-controller-manager", []string{"kubernetes"}, X509UsageClientAuth)
}
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -26,3 +26,9 @@ status:
- group: ""
kind: Secret
name: kube-scheduler-kubeconfig
- group: ""
kind: Service
name: kube-scheduler
- group: monitoring.coreos.com
kind: ServiceMonitor
name: kube-scheduler
Original file line number Diff line number Diff line change
Expand Up @@ -28,8 +28,8 @@ spec:
template:
metadata:
annotations:
cluster-autoscaler.kubernetes.io/safe-to-evict-local-volumes: cert-work,tmp-dir
component.hypershift.openshift.io/config-hash: 022a8a3a8c3f52a8
cluster-autoscaler.kubernetes.io/safe-to-evict-local-volumes: tmp-dir
component.hypershift.openshift.io/config-hash: 022a8a3a87ecf31a87ecf31a8c3f52a8
hypershift.openshift.io/release-image: quay.io/openshift-release-dev/ocp-release:4.16.10-x86_64
creationTimestamp: null
labels:
Expand Down Expand Up @@ -81,6 +81,8 @@ spec:
- args:
- --config=/etc/kubernetes/config/config.json
- --cert-dir=/var/run/kubernetes
- --tls-cert-file=/etc/kubernetes/certs/server/tls.crt
- --tls-private-key-file=/etc/kubernetes/certs/server/tls.key
- --secure-port=10259
- --authentication-kubeconfig=/etc/kubernetes/kubeconfig/kubeconfig
- --authorization-kubeconfig=/etc/kubernetes/kubeconfig/kubeconfig
Expand Down Expand Up @@ -201,6 +203,10 @@ spec:
successThreshold: 1
timeoutSeconds: 5
name: kube-scheduler
ports:
- containerPort: 10259
name: client
protocol: TCP
resources:
requests:
cpu: 25m
Expand All @@ -209,12 +215,14 @@ spec:
readOnlyRootFilesystem: true
terminationMessagePolicy: FallbackToLogsOnError
volumeMounts:
- mountPath: /var/run/kubernetes
name: cert-work
- mountPath: /etc/kubernetes/kubeconfig
name: kubeconfig
- mountPath: /etc/kubernetes/config
name: scheduler-config
- mountPath: /etc/kubernetes/certs/root-ca
name: root-ca
- mountPath: /etc/kubernetes/certs/server
name: server-crt
- mountPath: /tmp
name: tmp-dir
initContainers:
Expand All @@ -239,12 +247,26 @@ spec:
operator: Equal
value: hcp-namespace
volumes:
- name: cluster-signer
secret:
defaultMode: 416
secretName: cluster-signer-ca
- configMap:
defaultMode: 420
name: root-ca
name: root-ca
- name: service-signer
secret:
defaultMode: 416
secretName: sa-signing-key
- name: server-crt
secret:
defaultMode: 416
secretName: kube-scheduler-server
- configMap:
defaultMode: 420
name: kube-scheduler
name: scheduler-config
- emptyDir: {}
name: cert-work
- name: kubeconfig
secret:
defaultMode: 416
Expand Down
Original file line number Diff line number Diff line change
@@ -0,0 +1,30 @@
apiVersion: v1
kind: Service
metadata:
creationTimestamp: null
labels:
app: kube-scheduler
name: kube-scheduler
namespace: hcp-namespace
ownerReferences:
- apiVersion: hypershift.openshift.io/v1beta1
blockOwnerDeletion: true
controller: true
kind: HostedControlPlane
name: hcp
uid: ""
resourceVersion: "1"
spec:
internalTrafficPolicy: Cluster
ipFamilyPolicy: PreferDualStack
ports:
- name: client
port: 10259
protocol: TCP
targetPort: client
selector:
app: kube-scheduler
Comment thread
coderabbitai[bot] marked this conversation as resolved.
sessionAffinity: None
type: ClusterIP
status:
loadBalancer: {}
Original file line number Diff line number Diff line change
@@ -0,0 +1,52 @@
apiVersion: monitoring.coreos.com/v1
kind: ServiceMonitor
metadata:
creationTimestamp: null
name: kube-scheduler
namespace: hcp-namespace
ownerReferences:
- apiVersion: hypershift.openshift.io/v1beta1
blockOwnerDeletion: true
controller: true
kind: HostedControlPlane
name: hcp
uid: ""
resourceVersion: "1"
spec:
endpoints:
- honorLabels: true
interval: 30s
metricRelabelings:
- action: keep
regex: (kube_pod_resource_request|kube_pod_resource_limit)
sourceLabels:
- __name__
- action: replace
replacement: ""
targetLabel: _id
path: /metrics/resources
relabelings:
- action: replace
replacement: ""
targetLabel: _id
scheme: https
targetPort: client
tlsConfig:
ca:
configMap:
key: ca.crt
name: root-ca
cert:
secret:
key: tls.crt
name: kube-scheduler-server
keySecret:
key: tls.key
name: kube-scheduler-server
serverName: kube-scheduler
namespaceSelector:
matchNames:
- hcp-namespace
selector:
matchLabels:
app: kube-scheduler
Original file line number Diff line number Diff line change
Expand Up @@ -26,3 +26,9 @@ status:
- group: ""
kind: Secret
name: kube-scheduler-kubeconfig
- group: ""
kind: Service
name: kube-scheduler
- group: monitoring.coreos.com
kind: ServiceMonitor
name: kube-scheduler
Original file line number Diff line number Diff line change
Expand Up @@ -28,8 +28,8 @@ spec:
template:
metadata:
annotations:
cluster-autoscaler.kubernetes.io/safe-to-evict-local-volumes: cert-work,tmp-dir
component.hypershift.openshift.io/config-hash: 022a8a3acb8019bf
cluster-autoscaler.kubernetes.io/safe-to-evict-local-volumes: tmp-dir
component.hypershift.openshift.io/config-hash: 022a8a3a87ecf31a87ecf31acb8019bf
hypershift.openshift.io/release-image: quay.io/openshift-release-dev/ocp-release:4.16.10-x86_64
creationTimestamp: null
labels:
Expand Down Expand Up @@ -81,6 +81,8 @@ spec:
- args:
- --config=/etc/kubernetes/config/config.json
- --cert-dir=/var/run/kubernetes
- --tls-cert-file=/etc/kubernetes/certs/server/tls.crt
- --tls-private-key-file=/etc/kubernetes/certs/server/tls.key
- --secure-port=10259
- --authentication-kubeconfig=/etc/kubernetes/kubeconfig/kubeconfig
- --authorization-kubeconfig=/etc/kubernetes/kubeconfig/kubeconfig
Expand Down Expand Up @@ -200,6 +202,10 @@ spec:
successThreshold: 1
timeoutSeconds: 5
name: kube-scheduler
ports:
- containerPort: 10259
name: client
protocol: TCP
resources:
requests:
cpu: 25m
Expand All @@ -208,12 +214,14 @@ spec:
readOnlyRootFilesystem: true
terminationMessagePolicy: FallbackToLogsOnError
volumeMounts:
- mountPath: /var/run/kubernetes
name: cert-work
- mountPath: /etc/kubernetes/kubeconfig
name: kubeconfig
- mountPath: /etc/kubernetes/config
name: scheduler-config
- mountPath: /etc/kubernetes/certs/root-ca
name: root-ca
- mountPath: /etc/kubernetes/certs/server
name: server-crt
- mountPath: /tmp
name: tmp-dir
initContainers:
Expand All @@ -238,12 +246,26 @@ spec:
operator: Equal
value: hcp-namespace
volumes:
- name: cluster-signer
secret:
defaultMode: 416
secretName: cluster-signer-ca
- configMap:
defaultMode: 420
name: root-ca
name: root-ca
- name: service-signer
secret:
defaultMode: 416
secretName: sa-signing-key
- name: server-crt
secret:
defaultMode: 416
secretName: kube-scheduler-server
- configMap:
defaultMode: 420
name: kube-scheduler
name: scheduler-config
- emptyDir: {}
name: cert-work
- name: kubeconfig
secret:
defaultMode: 416
Expand Down
Original file line number Diff line number Diff line change
@@ -0,0 +1,30 @@
apiVersion: v1
kind: Service
metadata:
creationTimestamp: null
labels:
app: kube-scheduler
name: kube-scheduler
namespace: hcp-namespace
ownerReferences:
- apiVersion: hypershift.openshift.io/v1beta1
blockOwnerDeletion: true
controller: true
kind: HostedControlPlane
name: hcp
uid: ""
resourceVersion: "1"
spec:
internalTrafficPolicy: Cluster
ipFamilyPolicy: PreferDualStack
ports:
- name: client
port: 10259
protocol: TCP
targetPort: client
selector:
app: kube-scheduler
sessionAffinity: None
type: ClusterIP
status:
loadBalancer: {}
Original file line number Diff line number Diff line change
@@ -0,0 +1,52 @@
apiVersion: monitoring.coreos.com/v1
kind: ServiceMonitor
metadata:
creationTimestamp: null
name: kube-scheduler
namespace: hcp-namespace
ownerReferences:
- apiVersion: hypershift.openshift.io/v1beta1
blockOwnerDeletion: true
controller: true
kind: HostedControlPlane
name: hcp
uid: ""
resourceVersion: "1"
spec:
endpoints:
- honorLabels: true
interval: 30s
metricRelabelings:
- action: keep
regex: (kube_pod_resource_request|kube_pod_resource_limit)
sourceLabels:
- __name__
- action: replace
replacement: ""
targetLabel: _id
Comment on lines +19 to +26

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue

Metric filter likely drops all scheduler metrics

Keeping only (kube_pod_resource_request|kube_pod_resource_limit) looks like a KSM filter, not kube-scheduler. This will likely result in zero samples from scheduler.

Proposed fix: drop the keep filter so we scrape scheduler metrics normally.

     metricRelabelings:
-    - action: keep
-      regex: (kube_pod_resource_request|kube_pod_resource_limit)
-      sourceLabels:
-      - __name__
-    - action: replace
+    - action: replace
       replacement: ""
       targetLabel: _id
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
metricRelabelings:
- action: keep
regex: (kube_pod_resource_request|kube_pod_resource_limit)
sourceLabels:
- __name__
- action: replace
replacement: ""
targetLabel: _id
metricRelabelings:
- action: replace
replacement: ""
targetLabel: _id
🤖 Prompt for AI Agents
In
control-plane-operator/controllers/hostedcontrolplane/testdata/kube-scheduler/TechPreviewNoUpgrade/zz_fixture_TestControlPlaneComponents_kube_scheduler_servicemonitor.yaml
around lines 20 to 27, the metricRelabelings block keeps only KSM metrics
(kube_pod_resource_request|kube_pod_resource_limit) which will filter out
kube-scheduler metrics and produce zero samples; remove the entire keep action
relabeling (or comment it out) so no KSM-specific filter is applied and the
scheduler metrics are scraped normally, leaving only the existing replace/_id
relabeling if still needed.

path: /metrics/resources

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue

Metrics path is nonstandard for kube-scheduler

kube-scheduler exposes at /metrics (not /metrics/resources).

-    path: /metrics/resources
+    path: /metrics
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
path: /metrics/resources
path: /metrics
🤖 Prompt for AI Agents
In
control-plane-operator/controllers/hostedcontrolplane/testdata/kube-scheduler/TechPreviewNoUpgrade/zz_fixture_TestControlPlaneComponents_kube_scheduler_servicemonitor.yaml
around line 28, the ServiceMonitor metrics path is set to /metrics/resources
which is incorrect for kube-scheduler; change the path to /metrics so the
ServiceMonitor scrapes the standard kube-scheduler metrics endpoint (update the
path field to "/metrics" and ensure there are no trailing slashes or additional
segments).

relabelings:
- action: replace
replacement: ""
targetLabel: _id
scheme: https
targetPort: client
tlsConfig:
ca:
configMap:
key: ca.crt
name: root-ca
cert:
secret:
key: tls.crt
name: kube-scheduler-server
keySecret:
key: tls.key
name: kube-scheduler-server
serverName: kube-scheduler
namespaceSelector:
matchNames:
- hcp-namespace
selector:
matchLabels:
app: kube-scheduler
Comment on lines +51 to +52

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue

🧩 Analysis chain

Verify selector matches the actual Service labels

Ensure the Service has label app: kube-scheduler; otherwise the monitor won’t select it.


🏁 Script executed:

#!/bin/bash
# Verify selector label on kube-scheduler Service definitions
rg -nC3 --type=yaml -P '\bkind:\s*Service\b' | rg -nC5 -P 'name:\s*kube-scheduler|\bapp:\s*kube-scheduler'

Length of output: 0


🏁 Script executed:

#!/bin/bash
set -euo pipefail
echo "== Files mentioning 'kube-scheduler' =="
rg -n --hidden -S 'kube-scheduler' -g '!*node_modules/*' -g '!*vendor/*' || true

echo
echo "== YAML files with 'kube-scheduler' (context) =="
rg -n --hidden -S --type=yaml -C5 'kube-scheduler' -g '!*node_modules/*' -g '!*vendor/*' || true

echo
echo "== All YAML Service definitions (showing 3 lines context) =="
rg -n --hidden -S --type=yaml -C3 'kind:\s*Service' -g '!*node_modules/*' -g '!*vendor/*' || true

Length of output: 598


🏁 Script executed:

#!/bin/bash
set -euo pipefail

FILE='control-plane-operator/controllers/hostedcontrolplane/testdata/kube-scheduler/TechPreviewNoUpgrade/zz_fixture_TestControlPlaneComponents_kube_scheduler_servicemonitor.yaml'

echo "== Showing $FILE (first 200 lines, with numbers) =="
if [ -f "$FILE" ]; then
  nl -ba -w3 -s': ' "$FILE" | sed -n '1,200p'
else
  echo "File not found: $FILE"
fi

echo
echo "== Repo grep: 'name: kube-scheduler' =="
grep -RIn --line-number --exclude-dir=node_modules --exclude-dir=vendor 'name:[[:space:]]*kube-scheduler' . || true

echo
echo "== Repo grep: 'app: kube-scheduler' =="
grep -RIn --line-number --exclude-dir=node_modules --exclude-dir=vendor 'app:[[:space:]]*kube-scheduler' . || true

echo
echo "== Repo grep: YAML Service docs containing 'kube-scheduler' (show filename only) =="
# list files that have both 'kind: Service' and 'kube-scheduler' somewhere inside
for f in $(grep -RIl --exclude-dir=node_modules --exclude-dir=vendor 'kind:[[:space:]]*Service' . || true); do
  if grep -Iq 'kube-scheduler' "$f"; then
    echo "$f"
    echo "----- snippet -----"
    nl -ba -w3 -s': ' "$f" | sed -n '1,200p'
    echo
  fi
done

Length of output: 258


🏁 Script executed:

#!/bin/bash
set -euo pipefail

FILE='control-plane-operator/controllers/hostedcontrolplane/testdata/kube-scheduler/TechPreviewNoUpgrade/zz_fixture_TestControlPlaneComponents_kube_scheduler_servicemonitor.yaml'

echo "== Showing $FILE =="
if [ -f "$FILE" ]; then
  awk '{printf "%4d: %s\n", NR, $0}' "$FILE" | sed -n '1,240p'
else
  echo "File not found: $FILE"
fi

echo
echo "== Search for YAML files declaring a Service =="
# find yaml files and show any that contain 'kind: Service'
find . -type f \( -iname '*.yaml' -o -iname '*.yml' \) -not -path '*/node_modules/*' -not -path '*/vendor/*' -print0 \
  | xargs -0 -n1 grep -I -n -H -E '^[[:space:]]*kind:[[:space:]]*Service' || true

echo
echo "== Search for files containing 'app: kube-scheduler' or 'name: kube-scheduler' =="
grep -RIn --exclude-dir=node_modules --exclude-dir=vendor -n -C5 -E 'app:[[:space:]]*kube-scheduler|name:[[:space:]]*kube-scheduler' . || true

echo
echo "== If any Service files were found above, print surrounding context (20 lines) =="
# For each yaml file that contains 'kind: Service', show context lines containing 'kube-scheduler' if present
for f in $(find . -type f \( -iname '*.yaml' -o -iname '*.yml' \) -not -path '*/node_modules/*' -not -path '*/vendor/*' -print); do
  if grep -Iq '^[[:space:]]*kind:[[:space:]]*Service' "$f"; then
    if grep -Iq 'kube-scheduler' "$f"; then
      echo "---- $f ----"
      grep -n -C20 -E 'kube-scheduler|kind:[[:space:]]*Service' "$f" || true
      echo
    fi
  fi
done

Length of output: 157679


ServiceMonitor selector has no matching Service — add or align the Service label

ServiceMonitor control-plane-operator/controllers/hostedcontrolplane/testdata/kube-scheduler/TechPreviewNoUpgrade/zz_fixture_TestControlPlaneComponents_kube_scheduler_servicemonitor.yaml (lines 46–47) selects matchLabels: app: kube-scheduler but no Service with that label exists in the repo (only the Deployment has app: kube-scheduler). Add a Service labeled app: kube-scheduler in the same namespace or update the ServiceMonitor selector to the Service's actual labels.

🤖 Prompt for AI Agents
In
control-plane-operator/controllers/hostedcontrolplane/testdata/kube-scheduler/TechPreviewNoUpgrade/zz_fixture_TestControlPlaneComponents_kube_scheduler_servicemonitor.yaml
around lines 46-47, the ServiceMonitor selector uses matchLabels: app:
kube-scheduler but no Service in the repo has that label; either add a Service
resource in the same namespace with metadata.labels.app: kube-scheduler that
targets the kube-scheduler pods, or change the
ServiceMonitor.selector.matchLabels to match the actual labels on the existing
Service (ensure the Service exists and selects the same pods as the Deployment),
then update fixtures and tests accordingly.

Original file line number Diff line number Diff line change
Expand Up @@ -26,3 +26,9 @@ status:
- group: ""
kind: Secret
name: kube-scheduler-kubeconfig
- group: ""
kind: Service
name: kube-scheduler
- group: monitoring.coreos.com
kind: ServiceMonitor
name: kube-scheduler
Loading