CNTRLPLANE-3584: Add kube-scheduler ServiceMonitor with CA-signed serving certs - #8489
Conversation
|
Pipeline controller notification For optional jobs, comment This repository is configured in: LGTM mode |
openshift-ci
Bot
added
the
do-not-merge/work-in-progress
|
Skipping CI for Draft Pull Request. |
openshift-ci-robot
added
jira/valid-reference
|
@dhgautam99: This pull request references Jira Issue OCPBUGS-63328, which is invalid:
Comment The bug has been updated to refer to the pull request using the external bug tracker. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
openshift-ci
Bot
added
needs-rebase
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
📝 WalkthroughWalkthroughThe controller now reconciles a kube-scheduler serving certificate during PKI reconciliation by creating/updating a Sequence Diagram(s)sequenceDiagram
participant Controller as HostedControlPlaneController
participant PKI as pki.Reconciler
participant CA as Root CA Secret
participant Secret as scheduler-server Secret
participant KubeSched as kube-scheduler Pod
participant Service as kube-scheduler Service
participant Prom as Prometheus (ServiceMonitor)
Controller->>PKI: ReconcileSchedulerServerSecret(secret, ca, ownerRef)
PKI->>CA: read root CA secret
PKI->>Secret: create/update signed serving cert (DNS names)
PKI-->>Controller: return success / error
Controller->>KubeSched: ensure Deployment mounts scheduler-server Secret and TLS flags
KubeSched-->>Service: listen on port 10259 (client)
Service-->>Prom: ServiceMonitor selects Service (app: kube-scheduler)
Prom->>KubeSched: scrape HTTPS /metrics using TLS config and relabeling
🚥 Pre-merge checks | ✅ 10 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (10 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
openshift-ci
Bot
added
area/control-plane-operator
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In
`@control-plane-operator/controllers/hostedcontrolplane/v2/kube_scheduler/servicemonitor.go`:
- Around line 12-16: Change the NamespaceSelector to use the hosted control
plane namespace instead of the ServiceMonitor's namespace: replace the current
sm.Spec.NamespaceSelector = prometheusoperatorv1.NamespaceSelector{MatchNames:
[]string{sm.Namespace}} with a selector that uses cpContext.HCP.Namespace (i.e.
MatchNames: []string{cpContext.HCP.Namespace}); update the code around
sm.Spec.NamespaceSelector to reference cpContext.HCP.Namespace so this v2
component follows the same pattern as kas/karpenteroperator/registryoperator.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository YAML (base), Central YAML (inherited)
Review profile: CHILL
Plan: Enterprise
Run ID: 7f706c17-7364-4fd2-b06e-12a97677c76c
📒 Files selected for processing (9)
control-plane-operator/controllers/hostedcontrolplane/hostedcontrolplane_controller.gocontrol-plane-operator/controllers/hostedcontrolplane/manifests/pki.gocontrol-plane-operator/controllers/hostedcontrolplane/pki/scheduler.gocontrol-plane-operator/controllers/hostedcontrolplane/v2/assets/kube-scheduler/deployment.yamlcontrol-plane-operator/controllers/hostedcontrolplane/v2/assets/kube-scheduler/service.yamlcontrol-plane-operator/controllers/hostedcontrolplane/v2/assets/kube-scheduler/servicemonitor.yamlcontrol-plane-operator/controllers/hostedcontrolplane/v2/kube_scheduler/component.gocontrol-plane-operator/controllers/hostedcontrolplane/v2/kube_scheduler/servicemonitor.gosupport/metrics/sets.go
| sm.Spec.NamespaceSelector = prometheusoperatorv1.NamespaceSelector{ | ||
| MatchNames: []string{sm.Namespace}, | ||
| } | ||
| sm.Spec.Endpoints[0].MetricRelabelConfigs = metrics.SchedulerRelabelConfigs(cpContext.MetricsSet) | ||
| util.ApplyClusterIDLabel(&sm.Spec.Endpoints[0], cpContext.HCP.Spec.ClusterID) |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
# Verify endpoint presence in scheduler ServiceMonitor asset and inspect adapter assumptions.
set -euo pipefail
echo "== kube-scheduler ServiceMonitor asset =="
fd -p 'servicemonitor.yaml' control-plane-operator/controllers/hostedcontrolplane/v2/assets/kube-scheduler \
-x sed -n '1,220p' {}
echo
echo "== adapter usage =="
rg -n -C3 'adaptServiceMonitor|NamespaceSelector|Endpoints\[0\]' \
control-plane-operator/controllers/hostedcontrolplane/v2/kube_scheduler/servicemonitor.goRepository: openshift/hypershift
Length of output: 1409
🏁 Script executed:
# Check how adaptServiceMonitor is called and how the ServiceMonitor is instantiated
grep -rn "adaptServiceMonitor\|NewServiceMonitor" control-plane-operator/controllers/hostedcontrolplane/v2/kube_scheduler/ --include="*.go"Repository: openshift/hypershift
Length of output: 409
🏁 Script executed:
# Find where ServiceMonitor is instantiated/loaded from assets
rg -B5 -A10 "func.*ServiceMonitor\|load.*ServiceMonitor" control-plane-operator/controllers/hostedcontrolplane/v2/kube_scheduler/Repository: openshift/hypershift
Length of output: 46
🏁 Script executed:
# Check the pattern in support/controlplane-component for how adapters are typically called
rg -B3 -A3 "Endpoints\[0\]" control-plane-operator/controllers/hostedcontrolplane/v2/ --include="*.go" | head -50Repository: openshift/hypershift
Length of output: 506
🏁 Script executed:
# Verify what namespace the ServiceMonitor ends up in
rg -B5 -A5 "NamespaceSelector" control-plane-operator/controllers/hostedcontrolplane/v2/ --include="*.go" | head -80Repository: openshift/hypershift
Length of output: 506
🏁 Script executed:
# Check component.go to understand how ServiceMonitor is instantiated/loaded
sed -n '40,60p' control-plane-operator/controllers/hostedcontrolplane/v2/kube_scheduler/component.goRepository: openshift/hypershift
Length of output: 377
🏁 Script executed:
# Look at the full servicemonitor.go file
cat -n control-plane-operator/controllers/hostedcontrolplane/v2/kube_scheduler/servicemonitor.goRepository: openshift/hypershift
Length of output: 916
🏁 Script executed:
# Check support/controlplane-component to understand how adapters are invoked
fd -p 'README.md' support/controlplane-component -x head -100 {}Repository: openshift/hypershift
Length of output: 2886
🏁 Script executed:
# Search for Endpoints[0] patterns across other component adapters
rg 'Endpoints\[0\]' control-plane-operator/controllers/hostedcontrolplane/v2/ -t goRepository: openshift/hypershift
Length of output: 9392
🏁 Script executed:
# Check how NamespaceSelector is typically set in other adapters
rg 'NamespaceSelector' control-plane-operator/controllers/hostedcontrolplane/v2/ -t go -B2 -A2Repository: openshift/hypershift
Length of output: 17302
Use cpContext.HCP.Namespace for NamespaceSelector to align with newer component patterns.
Line 13 should select from cpContext.HCP.Namespace instead of sm.Namespace. Newer v2 components (kas, karpenteroperator, registryoperator) correctly use cpContext.HCP.Namespace; this adapter uses the older pattern inconsistently.
Suggested fix
func adaptServiceMonitor(cpContext component.WorkloadContext, sm *prometheusoperatorv1.ServiceMonitor) error {
sm.Spec.NamespaceSelector = prometheusoperatorv1.NamespaceSelector{
- MatchNames: []string{sm.Namespace},
+ MatchNames: []string{cpContext.HCP.Namespace},
}
sm.Spec.Endpoints[0].MetricRelabelConfigs = metrics.SchedulerRelabelConfigs(cpContext.MetricsSet)
util.ApplyClusterIDLabel(&sm.Spec.Endpoints[0], cpContext.HCP.Spec.ClusterID)📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| sm.Spec.NamespaceSelector = prometheusoperatorv1.NamespaceSelector{ | |
| MatchNames: []string{sm.Namespace}, | |
| } | |
| sm.Spec.Endpoints[0].MetricRelabelConfigs = metrics.SchedulerRelabelConfigs(cpContext.MetricsSet) | |
| util.ApplyClusterIDLabel(&sm.Spec.Endpoints[0], cpContext.HCP.Spec.ClusterID) | |
| sm.Spec.NamespaceSelector = prometheusoperatorv1.NamespaceSelector{ | |
| MatchNames: []string{cpContext.HCP.Namespace}, | |
| } | |
| sm.Spec.Endpoints[0].MetricRelabelConfigs = metrics.SchedulerRelabelConfigs(cpContext.MetricsSet) | |
| util.ApplyClusterIDLabel(&sm.Spec.Endpoints[0], cpContext.HCP.Spec.ClusterID) |
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In
`@control-plane-operator/controllers/hostedcontrolplane/v2/kube_scheduler/servicemonitor.go`
around lines 12 - 16, Change the NamespaceSelector to use the hosted control
plane namespace instead of the ServiceMonitor's namespace: replace the current
sm.Spec.NamespaceSelector = prometheusoperatorv1.NamespaceSelector{MatchNames:
[]string{sm.Namespace}} with a selector that uses cpContext.HCP.Namespace (i.e.
MatchNames: []string{cpContext.HCP.Namespace}); update the code around
sm.Spec.NamespaceSelector to reference cpContext.HCP.Namespace so this v2
component follows the same pattern as kas/karpenteroperator/registryoperator.
There was a problem hiding this comment.
@muraee, thanks for the confirmation! @dhgautam99, please update Line 13 to use cpContext.HCP.Namespace instead of sm.Namespace to align with the pattern used by the other v2 components (kas, karpenteroperator, registryoperator):
sm.Spec.NamespaceSelector = prometheusoperatorv1.NamespaceSelector{
MatchNames: []string{cpContext.HCP.Namespace},
}There was a problem hiding this comment.
actually nvm, most components use sm.Namespace, we should align the other ones instead
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
# Check the actual distribution of sm.Namespace vs cpContext.HCP.Namespace in NamespaceSelector adapters
rg -n 'NamespaceSelector' control-plane-operator/controllers/hostedcontrolplane/v2/ --type go -A2 | grep -E 'sm\.Namespace|cpContext\.HCP\.Namespace|MatchNames'Length of output: 4675
@muraee, you're absolutely right — I was wrong. The data confirms it clearly:
- ServiceMonitors (9 components):
routecm,ocm,olm/catalog_operator,olm/olm_operator,oapi,kcm,nto,etcd,cvo, and nowkube_schedulerall usesm.Namespace✅ - PodMonitors (all): use
cpContext.HCP.Namespace kas/servicemonitor.gois the only ServiceMonitor outlier usingcpContext.HCP.Namespace
I incorrectly conflated the PodMonitor pattern with the ServiceMonitor pattern when making the suggestion. The new kube-scheduler ServiceMonitor code using sm.Namespace is correct and consistent with the established pattern. kas would be the one to align in a follow-up.
Apologies for the noise!
✏️ Learnings added
Learnt from: muraee
Repo: openshift/hypershift PR: 8489
File: control-plane-operator/controllers/hostedcontrolplane/v2/kube_scheduler/servicemonitor.go:12-16
Timestamp: 2026-06-01T10:13:52.624Z
Learning: In the HyperShift repository (openshift/hypershift), ServiceMonitor adapters under `control-plane-operator/controllers/hostedcontrolplane/v2/` use `sm.Namespace` for `NamespaceSelector.MatchNames` (e.g., routecm, ocm, olm, oapi, kcm, nto, etcd, cvo, kube_scheduler). PodMonitor adapters use `cpContext.HCP.Namespace` instead. The `kas/servicemonitor.go` is the only ServiceMonitor outlier using `cpContext.HCP.Namespace` and should be considered for alignment to `sm.Namespace`. Do not suggest replacing `sm.Namespace` with `cpContext.HCP.Namespace` in ServiceMonitor adapters.
Note: Learnings are effective only in the context of similar code segments. To apply general coding guidelines, please configure review instructions. You can manage existing learnings in the app.
2c58e6d to
b7dc447
Compare
openshift-ci
Bot
removed
the
needs-rebase
|
/jira refresh |
openshift-ci-robot
added
jira/valid-bug
|
@dhgautam99: This pull request references Jira Issue OCPBUGS-63328, which is valid. The bug has been moved to the POST state. 3 validation(s) were run on this bug
DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
Codecov Report❌ Patch coverage is Additional details and impacted files@@ Coverage Diff @@
## main #8489 +/- ##
==========================================
+ Coverage 40.69% 41.44% +0.75%
==========================================
Files 755 758 +3
Lines 93373 93689 +316
==========================================
+ Hits 37994 38830 +836
+ Misses 52646 52137 -509
+ Partials 2733 2722 -11
... and 48 files with indirect coverage changes
Flags with carried forward coverage won't be shown. Click here to find out more. 🚀 New features to boost your workflow:
|
8606246 to
347cb8d
Compare
|
@dhgautam99: This pull request references Jira Issue OCPBUGS-63328, which is valid. 3 validation(s) were run on this bug
DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
|
@coderabbitai full review |
✅ Actions performedFull review triggered. |
There was a problem hiding this comment.
♻️ Duplicate comments (1)
control-plane-operator/controllers/hostedcontrolplane/v2/kube_scheduler/servicemonitor.go (1)
12-14:⚠️ Potential issue | 🟠 Major | ⚡ Quick winUse HostedControlPlane namespace for ServiceMonitor namespace selection.
Line 13 currently binds
MatchNamestosm.Namespace; this should usecpContext.HCP.Namespaceso scraping targets the control-plane namespace deterministically.Proposed fix
func adaptServiceMonitor(cpContext component.WorkloadContext, sm *prometheusoperatorv1.ServiceMonitor) error { sm.Spec.NamespaceSelector = prometheusoperatorv1.NamespaceSelector{ - MatchNames: []string{sm.Namespace}, + MatchNames: []string{cpContext.HCP.Namespace}, }As per coding guidelines, “Follow support/controlplane-component (cpov2) contracts for lifecycle components”.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@control-plane-operator/controllers/hostedcontrolplane/v2/kube_scheduler/servicemonitor.go` around lines 12 - 14, The ServiceMonitor namespace selector currently sets MatchNames to sm.Namespace; change it to use the HostedControlPlane namespace by assigning cpContext.HCP.Namespace to MatchNames (update the sm.Spec.NamespaceSelector = prometheusoperatorv1.NamespaceSelector{ MatchNames: []string{cpContext.HCP.Namespace} }), ensuring scraping targets the control-plane namespace deterministically; locate this in the ServiceMonitor construction where sm.Spec.NamespaceSelector is set and replace sm.Namespace with cpContext.HCP.Namespace.
🧹 Nitpick comments (1)
control-plane-operator/controllers/hostedcontrolplane/v2/kube_scheduler/servicemonitor_test.go (1)
76-96: ⚡ Quick winStrengthen namespace-selector test to detect wrong source namespace.
Right now the fixture sets
hcp.Namespaceandsm.Namespaceto the same value, so the assertion won’t catch an implementation that incorrectly usessm.Namespace. Set them differently in at least one case.Proposed tweak
hcp := &hyperv1.HostedControlPlane{ ObjectMeta: metav1.ObjectMeta{ Name: "test-hcp", - Namespace: "test-namespace", + Namespace: "hcp-namespace", }, @@ sm := &prometheusoperatorv1.ServiceMonitor{ ObjectMeta: metav1.ObjectMeta{ Name: "kube-scheduler", - Namespace: "test-namespace", + Namespace: "monitoring-namespace", },🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@control-plane-operator/controllers/hostedcontrolplane/v2/kube_scheduler/servicemonitor_test.go` around lines 76 - 96, The test fixture currently sets hcp.Namespace and sm.Namespace to the same value so a bug that reads the ServiceMonitor's Namespace instead of the HCP's Namespace will pass; update the test (the HostedControlPlane instance named hcp used to build component.WorkloadContext and the prometheusoperatorv1.ServiceMonitor instance sm) so at least one case uses different namespaces (e.g., hcp.Namespace = "test-namespace" and sm.Namespace = "service-namespace") and assert the code under test uses hcp.Namespace as the source; adjust the test case input for component.WorkloadContext and the ServiceMonitor setup to ensure the namespace-selector logic fails if it incorrectly references sm.Namespace.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Duplicate comments:
In
`@control-plane-operator/controllers/hostedcontrolplane/v2/kube_scheduler/servicemonitor.go`:
- Around line 12-14: The ServiceMonitor namespace selector currently sets
MatchNames to sm.Namespace; change it to use the HostedControlPlane namespace by
assigning cpContext.HCP.Namespace to MatchNames (update the
sm.Spec.NamespaceSelector = prometheusoperatorv1.NamespaceSelector{ MatchNames:
[]string{cpContext.HCP.Namespace} }), ensuring scraping targets the
control-plane namespace deterministically; locate this in the ServiceMonitor
construction where sm.Spec.NamespaceSelector is set and replace sm.Namespace
with cpContext.HCP.Namespace.
---
Nitpick comments:
In
`@control-plane-operator/controllers/hostedcontrolplane/v2/kube_scheduler/servicemonitor_test.go`:
- Around line 76-96: The test fixture currently sets hcp.Namespace and
sm.Namespace to the same value so a bug that reads the ServiceMonitor's
Namespace instead of the HCP's Namespace will pass; update the test (the
HostedControlPlane instance named hcp used to build component.WorkloadContext
and the prometheusoperatorv1.ServiceMonitor instance sm) so at least one case
uses different namespaces (e.g., hcp.Namespace = "test-namespace" and
sm.Namespace = "service-namespace") and assert the code under test uses
hcp.Namespace as the source; adjust the test case input for
component.WorkloadContext and the ServiceMonitor setup to ensure the
namespace-selector logic fails if it incorrectly references sm.Namespace.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository YAML (base), Central YAML (inherited)
Review profile: CHILL
Plan: Enterprise
Run ID: 4fa36214-c168-4aa6-bfea-b60297adea05
⛔ Files ignored due to path filters (20)
control-plane-operator/controllers/hostedcontrolplane/testdata/kube-scheduler/AROSwift/zz_fixture_TestControlPlaneComponents_kube_scheduler_controlplanecomponent.yamlis excluded by!**/testdata/**control-plane-operator/controllers/hostedcontrolplane/testdata/kube-scheduler/AROSwift/zz_fixture_TestControlPlaneComponents_kube_scheduler_deployment.yamlis excluded by!**/testdata/**control-plane-operator/controllers/hostedcontrolplane/testdata/kube-scheduler/AROSwift/zz_fixture_TestControlPlaneComponents_kube_scheduler_service.yamlis excluded by!**/testdata/**control-plane-operator/controllers/hostedcontrolplane/testdata/kube-scheduler/AROSwift/zz_fixture_TestControlPlaneComponents_kube_scheduler_servicemonitor.yamlis excluded by!**/testdata/**control-plane-operator/controllers/hostedcontrolplane/testdata/kube-scheduler/GCP/zz_fixture_TestControlPlaneComponents_kube_scheduler_controlplanecomponent.yamlis excluded by!**/testdata/**control-plane-operator/controllers/hostedcontrolplane/testdata/kube-scheduler/GCP/zz_fixture_TestControlPlaneComponents_kube_scheduler_deployment.yamlis excluded by!**/testdata/**control-plane-operator/controllers/hostedcontrolplane/testdata/kube-scheduler/GCP/zz_fixture_TestControlPlaneComponents_kube_scheduler_service.yamlis excluded by!**/testdata/**control-plane-operator/controllers/hostedcontrolplane/testdata/kube-scheduler/GCP/zz_fixture_TestControlPlaneComponents_kube_scheduler_servicemonitor.yamlis excluded by!**/testdata/**control-plane-operator/controllers/hostedcontrolplane/testdata/kube-scheduler/IBMCloud/zz_fixture_TestControlPlaneComponents_kube_scheduler_controlplanecomponent.yamlis excluded by!**/testdata/**control-plane-operator/controllers/hostedcontrolplane/testdata/kube-scheduler/IBMCloud/zz_fixture_TestControlPlaneComponents_kube_scheduler_deployment.yamlis excluded by!**/testdata/**control-plane-operator/controllers/hostedcontrolplane/testdata/kube-scheduler/IBMCloud/zz_fixture_TestControlPlaneComponents_kube_scheduler_service.yamlis excluded by!**/testdata/**control-plane-operator/controllers/hostedcontrolplane/testdata/kube-scheduler/IBMCloud/zz_fixture_TestControlPlaneComponents_kube_scheduler_servicemonitor.yamlis excluded by!**/testdata/**control-plane-operator/controllers/hostedcontrolplane/testdata/kube-scheduler/TechPreviewNoUpgrade/zz_fixture_TestControlPlaneComponents_kube_scheduler_controlplanecomponent.yamlis excluded by!**/testdata/**control-plane-operator/controllers/hostedcontrolplane/testdata/kube-scheduler/TechPreviewNoUpgrade/zz_fixture_TestControlPlaneComponents_kube_scheduler_deployment.yamlis excluded by!**/testdata/**control-plane-operator/controllers/hostedcontrolplane/testdata/kube-scheduler/TechPreviewNoUpgrade/zz_fixture_TestControlPlaneComponents_kube_scheduler_service.yamlis excluded by!**/testdata/**control-plane-operator/controllers/hostedcontrolplane/testdata/kube-scheduler/TechPreviewNoUpgrade/zz_fixture_TestControlPlaneComponents_kube_scheduler_servicemonitor.yamlis excluded by!**/testdata/**control-plane-operator/controllers/hostedcontrolplane/testdata/kube-scheduler/zz_fixture_TestControlPlaneComponents_kube_scheduler_controlplanecomponent.yamlis excluded by!**/testdata/**control-plane-operator/controllers/hostedcontrolplane/testdata/kube-scheduler/zz_fixture_TestControlPlaneComponents_kube_scheduler_deployment.yamlis excluded by!**/testdata/**control-plane-operator/controllers/hostedcontrolplane/testdata/kube-scheduler/zz_fixture_TestControlPlaneComponents_kube_scheduler_service.yamlis excluded by!**/testdata/**control-plane-operator/controllers/hostedcontrolplane/testdata/kube-scheduler/zz_fixture_TestControlPlaneComponents_kube_scheduler_servicemonitor.yamlis excluded by!**/testdata/**
📒 Files selected for processing (12)
control-plane-operator/controllers/hostedcontrolplane/hostedcontrolplane_controller.gocontrol-plane-operator/controllers/hostedcontrolplane/manifests/pki.gocontrol-plane-operator/controllers/hostedcontrolplane/pki/scheduler.gocontrol-plane-operator/controllers/hostedcontrolplane/pki/scheduler_test.gocontrol-plane-operator/controllers/hostedcontrolplane/v2/assets/kube-scheduler/deployment.yamlcontrol-plane-operator/controllers/hostedcontrolplane/v2/assets/kube-scheduler/service.yamlcontrol-plane-operator/controllers/hostedcontrolplane/v2/assets/kube-scheduler/servicemonitor.yamlcontrol-plane-operator/controllers/hostedcontrolplane/v2/kube_scheduler/component.gocontrol-plane-operator/controllers/hostedcontrolplane/v2/kube_scheduler/component_test.gocontrol-plane-operator/controllers/hostedcontrolplane/v2/kube_scheduler/servicemonitor.gocontrol-plane-operator/controllers/hostedcontrolplane/v2/kube_scheduler/servicemonitor_test.gosupport/metrics/sets.go
|
the other adapters (for example: etcd, kcm, cvo etc) are using sm.Namespace only. So, skipping coderabbitai's suggestion for now to use cpContext.HCP.Namespace instead of sm.Namespace |
openshift-ci
Bot
removed
the
do-not-merge/work-in-progress
|
@dhgautam99: This pull request references Jira Issue OCPBUGS-63328, which is invalid:
Comment DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
dhgautam99
changed the title
openshift-ci-robot
removed
the
jira/invalid-bug
|
@dhgautam99: This pull request references CNTRLPLANE-3584 which is a valid jira issue. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
| func SchedulerRelabelConfigs(set MetricsSet) []prometheusoperatorv1.RelabelConfig { | ||
| switch set { | ||
| case MetricsSetTelemetry: | ||
| return sreMetricsSetConfig.KubeScheduler |
There was a problem hiding this comment.
you can't use sreMetricsSetConfig for telemetry. The config might not exist in this case
7d26c7b to
160de75
Compare
…erts The kube-scheduler previously auto-generated self-signed serving certificates via --cert-dir. This change adds a CA-signed serving certificate, a Service, and a ServiceMonitor to enable Prometheus metrics scraping with proper mTLS authentication.
Add unit tests for scheduler component options, ServiceMonitor adapter, and server certificate reconciliation. Regenerate test fixtures after adding Service, ServiceMonitor, and CA-signed serving certificate support.
160de75 to
e994412
Compare
|
/lgtm |
|
Scheduling tests matching the |
AI Test Failure AnalysisJob: Generated by hypershift-analyze-e2e-failure post-step using Claude claude-opus-4-6 |
Test Failure Analysis CompleteJob Information
Test Failure AnalysisErrorSummaryThe Root CauseThe root cause is an Azure infrastructure transient failure — specifically, What happened step by step:
Why this is NOT related to the PR:
Recommendations
Evidence
|
|
/retest |
|
/verified by @dhgautam99 on lab cluster |
openshift-ci-robot
added
the
verified
|
@dhgautam99: This PR has been marked as verified by DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
|
@dhgautam99: all tests passed! Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
|
/cherry-pick release-4.22 |
|
@michaelryanmcneill: #8489 failed to apply on top of branch "release-4.22": DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
7 participants
What this PR does / why we need it:
Adds a ServiceMonitor for kube-scheduler to enable Prometheus metrics scraping with proper mTLS authentication.
Previously, kube-scheduler auto-generated self-signed serving certificates via
--cert-dir=/var/run/kubernetes. Prometheus could not verify the scheduler's identity using the cluster's root CA, and no ServiceMonitor existed.This PR:
scheduler-server) for kube-scheduler, following the KCM patternkube-schedulerService exposing port 10259SchedulerRelabelConfigs()for SRE metrics set supportWhich issue(s) this PR fixes:
Fixes https://issues.redhat.com/browse/CNTRLPLANE-3584
Special notes for your reviewer:
Follows the same pattern as kube-controller-manager's ServiceMonitor setup.
Checklist:
Summary by CodeRabbit
New Features
Metrics
Tests