From a2f3f4328a5efb679b089be671c895d15fd5395a Mon Sep 17 00:00:00 2001 From: Stefan Majer Date: Mon, 20 Jul 2026 08:56:56 +0200 Subject: [PATCH 1/6] Deploy metal-metrics-server v2 --- .../roles/monitoring/defaults/main.yaml | 7 +- .../roles/monitoring/tasks/main.yaml | 44 ++++++++++ .../metal-metrics-exporter.yaml | 88 ++++++++++++++++--- 3 files changed, 122 insertions(+), 17 deletions(-) diff --git a/control-plane/roles/monitoring/defaults/main.yaml b/control-plane/roles/monitoring/defaults/main.yaml index 0c9d49db3..809ecaae9 100644 --- a/control-plane/roles/monitoring/defaults/main.yaml +++ b/control-plane/roles/monitoring/defaults/main.yaml @@ -42,9 +42,10 @@ monitoring_alertmanager_webhook_slack_repeat_interval: 24h event_exporter_enabled: false # metal metrics exporter -monitoring_metal_api_url: "http://metal-api.metal-control-plane.svc:8080/metal" -monitoring_metal_api_hmac: "metal-view" -monitoring_metal_api_authtype: "Metal-View" +monitoring_metal_apiserver_url: "https://v2.metal-control-plane.svc/" +monitoring_metal_metrics_exporter_image_tag: latest +monitoring_metal_metrics_exporter_image_name: ghcr.io/metal-stack/metal-metrics-exporter +monitoring_metrics_exporter_token_expiration: 8h # rethinkdb exporter monitoring_rethinkdb_exporter_metal_db_password: "change-me" diff --git a/control-plane/roles/monitoring/tasks/main.yaml b/control-plane/roles/monitoring/tasks/main.yaml index 1254eb5ca..ec19bc5db 100644 --- a/control-plane/roles/monitoring/tasks/main.yaml +++ b/control-plane/roles/monitoring/tasks/main.yaml @@ -73,6 +73,50 @@ helm_value_file_template: "thanos-values.yaml" when: monitoring_thanos_enabled +- name: Create metal-apiserver token for metal-image-cache-sync + ansible.builtin.import_role: + name: metal-roles/common/roles/metal-deployment-token + +- name: Check metal-deployment-token has run + ansible.builtin.assert: + fail_msg: + "this role requires the metal-deployment-token role to be run before + execution, check role documentation" + quiet: true + that: + - "'metal_deployment_admin_token' in hostvars['localhost']" + + +- name: create api tokens for metal-metrics-exporter + block: + - name: create metrics-exporter tenant + metal_v2_admin_tenant: + identifier: metrics-exporter + name: metal-metrics-exporter + description: tenant used by the metrics-exporter service in the metal-stack control-plane + register: _tenant + + - name: create metrics-exporter api token + metal_v2_admin_token: + identifier: metrics-exporter + user: "{{ _tenant.id }}" + description: "metal-metrics-exporter token" + expires: "{{ monitoring_metrics_exporter_token_expiration }}" + permissions: + - subject: "*" + methods: + - /metalstack.admin.v2.ImageService/Usage + - /metalstack.admin.v2.MachineService/Issues + - /metalstack.admin.v2.MachineService/List + - /metalstack.admin.v2.MachineService/ListBMC + - /metalstack.admin.v2.NetworkService/List + - /metalstack.admin.v2.PartitionService/Capacity + - /metalstack.admin.v2.ProjectService/List + - /metalstack.admin.v2.SwitchService/List + - /metalstack.infra.v2.ComponentService/Ping + register: _metal_metrics_exporter_token + + - name: Deploy metrics exporters ansible.builtin.import_tasks: exporters.yaml - name: Deploy Grafana dashboards diff --git a/control-plane/roles/monitoring/templates/metrics-exporters/metal-metrics-exporter.yaml b/control-plane/roles/monitoring/templates/metrics-exporters/metal-metrics-exporter.yaml index 3c6c32229..149e8f0aa 100644 --- a/control-plane/roles/monitoring/templates/metrics-exporters/metal-metrics-exporter.yaml +++ b/control-plane/roles/monitoring/templates/metrics-exporters/metal-metrics-exporter.yaml @@ -1,13 +1,69 @@ --- apiVersion: v1 +kind: ServiceAccount +metadata: + name: metal-token-renewal +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + name: metal-token-renewal +rules: +- apiGroups: [""] + resources: ["secrets"] + verbs: ["get", "update", "patch"] +- apiGroups: [""] + resources: ["secrets"] + resourceNames: ["metal-metrics-exporter-config"] + verbs: ["get", "update", "patch"] +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: metal-token-renewal +subjects: +- kind: ServiceAccount + name: metal-token-renewal +roleRef: + kind: Role + name: metal-token-renewal + apiGroup: rbac.authorization.k8s.io +--- +apiVersion: batch/v1 +kind: CronJob +metadata: + name: metal-metrics-exporter-token-refresher +spec: + schedule: "@hourly" + jobTemplate: + metadata: + name: metal-metrics-exporter-token-refresher + spec: + template: + spec: + serviceAccountName: metal-token-refresher + restartPolicy: OnFailure + containers: + - name: token-refresher + image: ghcr.io/metal-stack/metal-token-refresher + env: + - name: METAL_APISERVER_URL + value: {{ monitoring_metal_apiserver_url }} + - name: TOKEN_SECRET_NAMESPACE + value: "monitoring" + - name: TOKEN_SECRET_NAME + value: "metal-metrics-exporter-config" + - name: TOKEN_SECRET_KEY + value: "token" +--- +apiVersion: v1 kind: Secret metadata: name: metal-metrics-exporter-config type: Opaque stringData: - url: {{ monitoring_metal_api_url }} - hmac: {{ monitoring_metal_api_hmac }} - authtype: {{ monitoring_metal_api_authtype }} + url: {{ monitoring_metal_apiserver_url }} + token: {{ _metal_metrics_exporter_token.secret }} --- apiVersion: v1 kind: Service @@ -44,8 +100,12 @@ spec: - name: metal-metrics-exporter command: - /metal-metrics-exporter - image: {{ metal_metrics_exporter_image_name }}:{{ metal_metrics_exporter_image_tag }} + image: {{ monitoring_metal_metrics_exporter_image_name }}:{{ monitoring_metal_metrics_exporter_image_tag }} imagePullPolicy: {{ metal_control_plane_image_pull_policy }} + securityContext: + allowPrivilegeEscalation: false + runAsNonRoot: true + runAsUser: 999 ports: - containerPort: 9080 name: metrics @@ -55,13 +115,13 @@ spec: secretKeyRef: name: metal-metrics-exporter-config key: url - - name: METAL_API_HMAC - valueFrom: - secretKeyRef: - name: metal-metrics-exporter-config - key: hmac - - name: METAL_API_AUTH_TYPE - valueFrom: - secretKeyRef: - name: metal-metrics-exporter-config - key: authtype \ No newline at end of file + - name: METAL_API_TOKEN_FILE + value: /var/run/secrets/metal-metrics-exporter-config/token + volumeMounts: + - mountPath: /var/run/secrets/metal-metrics-exporter-config + name: metal-metrics-exporter-config + volumes: + - name: metal-metrics-exporter-config + secret: + defaultMode: 420 + secretName: metal-metrics-exporter-config From ac00d78a07f7f7c94ac736cbc09c2211fd04a5d8 Mon Sep 17 00:00:00 2001 From: Stefan Majer Date: Wed, 22 Jul 2026 11:57:23 +0200 Subject: [PATCH 2/6] Adoptions --- control-plane/roles/monitoring/defaults/main.yaml | 14 ++++++++++++++ control-plane/roles/monitoring/tasks/main.yaml | 13 +------------ 2 files changed, 15 insertions(+), 12 deletions(-) diff --git a/control-plane/roles/monitoring/defaults/main.yaml b/control-plane/roles/monitoring/defaults/main.yaml index a9ab20f9a..9f58c311a 100644 --- a/control-plane/roles/monitoring/defaults/main.yaml +++ b/control-plane/roles/monitoring/defaults/main.yaml @@ -46,6 +46,20 @@ monitoring_metal_apiserver_url: "https://v2.metal-control-plane.svc/" monitoring_metal_metrics_exporter_image_tag: latest monitoring_metal_metrics_exporter_image_name: ghcr.io/metal-stack/metal-metrics-exporter monitoring_metrics_exporter_token_expiration: 8h +monitoring_metrics_exporter_permissions: + - admin: + methods: + - /metalstack.admin.v2.ImageService/Usage + - /metalstack.admin.v2.MachineService/Issues + - /metalstack.admin.v2.MachineService/List + - /metalstack.admin.v2.MachineService/ListBMC + - /metalstack.admin.v2.NetworkService/List + - /metalstack.admin.v2.PartitionService/Capacity + - /metalstack.admin.v2.ProjectService/List + - /metalstack.admin.v2.SwitchService/List + - infra: + methods: + - /metalstack.infra.v2.ComponentService/Ping # rethinkdb exporter monitoring_rethinkdb_exporter_metal_db_password: "change-me" diff --git a/control-plane/roles/monitoring/tasks/main.yaml b/control-plane/roles/monitoring/tasks/main.yaml index 06ece430e..96062856f 100644 --- a/control-plane/roles/monitoring/tasks/main.yaml +++ b/control-plane/roles/monitoring/tasks/main.yaml @@ -113,18 +113,7 @@ user: "{{ _tenant.id }}" description: "metal-metrics-exporter token" expires: "{{ monitoring_metrics_exporter_token_expiration }}" - permissions: - - subject: "*" - methods: - - /metalstack.admin.v2.ImageService/Usage - - /metalstack.admin.v2.MachineService/Issues - - /metalstack.admin.v2.MachineService/List - - /metalstack.admin.v2.MachineService/ListBMC - - /metalstack.admin.v2.NetworkService/List - - /metalstack.admin.v2.PartitionService/Capacity - - /metalstack.admin.v2.ProjectService/List - - /metalstack.admin.v2.SwitchService/List - - /metalstack.infra.v2.ComponentService/Ping + permissions: "{{ monitoring_metrics_exporter_permissions }}" register: _metal_metrics_exporter_token From 9561b9fa2db8c7786a105f2f68c0abcd13eed362 Mon Sep 17 00:00:00 2001 From: Stefan Majer Date: Wed, 22 Jul 2026 12:48:53 +0200 Subject: [PATCH 3/6] Fix --- control-plane/roles/monitoring/meta/main.yaml | 1 + control-plane/roles/monitoring/tasks/main.yaml | 1 - 2 files changed, 1 insertion(+), 1 deletion(-) diff --git a/control-plane/roles/monitoring/meta/main.yaml b/control-plane/roles/monitoring/meta/main.yaml index fef061796..1ada37f59 100644 --- a/control-plane/roles/monitoring/meta/main.yaml +++ b/control-plane/roles/monitoring/meta/main.yaml @@ -12,6 +12,7 @@ galaxy_info: - all dependencies: + - role: metal-ansible-modules - role: ansible-common - role: metal-roles/common/roles/defaults - role: metal-roles/common/roles/partition-prometheus-rules diff --git a/control-plane/roles/monitoring/tasks/main.yaml b/control-plane/roles/monitoring/tasks/main.yaml index 96062856f..3064023e5 100644 --- a/control-plane/roles/monitoring/tasks/main.yaml +++ b/control-plane/roles/monitoring/tasks/main.yaml @@ -97,7 +97,6 @@ that: - "'metal_deployment_admin_token' in hostvars['localhost']" - - name: create api tokens for metal-metrics-exporter block: - name: create metrics-exporter tenant From 95e1a73b075c35f26aa0086f518fa5c03d080d0e Mon Sep 17 00:00:00 2001 From: Stefan Majer Date: Wed, 22 Jul 2026 14:16:09 +0200 Subject: [PATCH 4/6] Fix --- control-plane/roles/monitoring/tasks/main.yaml | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/control-plane/roles/monitoring/tasks/main.yaml b/control-plane/roles/monitoring/tasks/main.yaml index 3064023e5..4f1307ffc 100644 --- a/control-plane/roles/monitoring/tasks/main.yaml +++ b/control-plane/roles/monitoring/tasks/main.yaml @@ -98,6 +98,10 @@ - "'metal_deployment_admin_token' in hostvars['localhost']" - name: create api tokens for metal-metrics-exporter + delegate_to: localhost + environment: + METAL_APIV2_URL: "{{ monitoring_metal_apiserver_url }}" + METAL_APIV2_TOKEN: "{{ metal_deployment_admin_token }}" block: - name: create metrics-exporter tenant metal_v2_admin_tenant: From 087932e54a53223afb4d6a160719e74284564df1 Mon Sep 17 00:00:00 2001 From: Stefan Majer Date: Wed, 22 Jul 2026 14:21:19 +0200 Subject: [PATCH 5/6] Update actions --- .github/workflows/test.yaml | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/.github/workflows/test.yaml b/.github/workflows/test.yaml index 1fcd009de..f20e2e509 100644 --- a/.github/workflows/test.yaml +++ b/.github/workflows/test.yaml @@ -8,7 +8,7 @@ jobs: runs-on: ubuntu-latest container: metalstack/metal-deployment-base:latest steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@v7 - name: Test run: | make test @@ -16,14 +16,14 @@ jobs: spelling: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@v7 - name: Check spelling uses: crate-ci/typos@master markdown-lint: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@v7 - name: markdownlint-cli uses: DavidAnson/markdownlint-cli2-action@main with: @@ -32,7 +32,7 @@ jobs: ansible-lint: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@v7 - name: Run ansible-lint uses: ansible/ansible-lint@v26.1.1 with: From fa3b3fb0795ffd1144adace92a4d759dfc73c7a6 Mon Sep 17 00:00:00 2001 From: Stefan Majer Date: Mon, 27 Jul 2026 14:08:09 +0200 Subject: [PATCH 6/6] Linter --- control-plane/roles/monitoring/defaults/main.yaml | 2 +- control-plane/roles/monitoring/tasks/main.yaml | 6 +++--- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/control-plane/roles/monitoring/defaults/main.yaml b/control-plane/roles/monitoring/defaults/main.yaml index 9f58c311a..4efb5a173 100644 --- a/control-plane/roles/monitoring/defaults/main.yaml +++ b/control-plane/roles/monitoring/defaults/main.yaml @@ -59,7 +59,7 @@ monitoring_metrics_exporter_permissions: - /metalstack.admin.v2.SwitchService/List - infra: methods: - - /metalstack.infra.v2.ComponentService/Ping + - /metalstack.infra.v2.ComponentService/Ping # rethinkdb exporter monitoring_rethinkdb_exporter_metal_db_password: "change-me" diff --git a/control-plane/roles/monitoring/tasks/main.yaml b/control-plane/roles/monitoring/tasks/main.yaml index 4f1307ffc..563b3799e 100644 --- a/control-plane/roles/monitoring/tasks/main.yaml +++ b/control-plane/roles/monitoring/tasks/main.yaml @@ -97,20 +97,20 @@ that: - "'metal_deployment_admin_token' in hostvars['localhost']" -- name: create api tokens for metal-metrics-exporter +- name: Create api tokens for metal-metrics-exporter delegate_to: localhost environment: METAL_APIV2_URL: "{{ monitoring_metal_apiserver_url }}" METAL_APIV2_TOKEN: "{{ metal_deployment_admin_token }}" block: - - name: create metrics-exporter tenant + - name: Create metrics-exporter tenant metal_v2_admin_tenant: identifier: metrics-exporter name: metal-metrics-exporter description: tenant used by the metrics-exporter service in the metal-stack control-plane register: _tenant - - name: create metrics-exporter api token + - name: Create metrics-exporter api token metal_v2_admin_token: identifier: metrics-exporter user: "{{ _tenant.id }}"