Deploy metal-metrics-exporter v2

.github/workflows/test.yaml

@@ -8,22 +8,22 @@ jobs:
     runs-on: ubuntu-latest
     container: metalstack/metal-deployment-base:latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - name: Test
         run: |
           make test
 
   spelling:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - name: Check spelling
         uses: crate-ci/typos@master
 
   markdown-lint:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - name: markdownlint-cli
         uses: DavidAnson/markdownlint-cli2-action@main
         with:
@@ -32,7 +32,7 @@ jobs:
   ansible-lint:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - name: Run ansible-lint
         uses: ansible/ansible-lint@v26.1.1
         with:

control-plane/roles/monitoring/defaults/main.yaml

@@ -42,9 +42,24 @@ monitoring_alertmanager_webhook_slack_repeat_interval: 24h
 event_exporter_enabled: false
 
 # metal metrics exporter
-monitoring_metal_api_url: "http://metal-api.metal-control-plane.svc:8080/metal"
-monitoring_metal_api_hmac: "metal-view"
-monitoring_metal_api_authtype: "Metal-View"
+monitoring_metal_apiserver_url: "https://v2.metal-control-plane.svc/"
+monitoring_metal_metrics_exporter_image_tag: latest
+monitoring_metal_metrics_exporter_image_name: ghcr.io/metal-stack/metal-metrics-exporter
+monitoring_metrics_exporter_token_expiration: 8h
+monitoring_metrics_exporter_permissions:
+  - admin:
+      methods:
+        - /metalstack.admin.v2.ImageService/Usage
+        - /metalstack.admin.v2.MachineService/Issues
+        - /metalstack.admin.v2.MachineService/List
+        - /metalstack.admin.v2.MachineService/ListBMC
+        - /metalstack.admin.v2.NetworkService/List
+        - /metalstack.admin.v2.PartitionService/Capacity
+        - /metalstack.admin.v2.ProjectService/List
+        - /metalstack.admin.v2.SwitchService/List
+  - infra:
+      methods:
+        - /metalstack.infra.v2.ComponentService/Ping
 
 # rethinkdb exporter
 monitoring_rethinkdb_exporter_metal_db_password: "change-me"

control-plane/roles/monitoring/meta/main.yaml

@@ -12,6 +12,7 @@ galaxy_info:
         - all
 
 dependencies:
+  - role: metal-ansible-modules
   - role: ansible-common
   - role: metal-roles/common/roles/defaults
   - role: metal-roles/common/roles/partition-prometheus-rules

control-plane/roles/monitoring/tasks/main.yaml

@@ -84,6 +84,42 @@
     helm_value_file_template: "thanos-values.yaml"
   when: monitoring_thanos_enabled
 
+- name: Create metal-apiserver token for metal-image-cache-sync
+  ansible.builtin.import_role:
+    name: metal-roles/common/roles/metal-deployment-token
+
+- name: Check metal-deployment-token has run
+  ansible.builtin.assert:
+    fail_msg:
+      "this role requires the metal-deployment-token role to be run before
+      execution, check role documentation"
+    quiet: true
+    that:
+      - "'metal_deployment_admin_token' in hostvars['localhost']"
+
+- name: Create api tokens for metal-metrics-exporter
+  delegate_to: localhost
+  environment:
+    METAL_APIV2_URL: "{{ monitoring_metal_apiserver_url }}"
+    METAL_APIV2_TOKEN: "{{ metal_deployment_admin_token }}"
+  block:
+    - name: Create metrics-exporter tenant
+      metal_v2_admin_tenant:
+        identifier: metrics-exporter
+        name: metal-metrics-exporter
+        description: tenant used by the metrics-exporter service in the metal-stack control-plane
+      register: _tenant
+
+    - name: Create metrics-exporter api token
+      metal_v2_admin_token:
+        identifier: metrics-exporter
+        user: "{{ _tenant.id }}"
+        description: "metal-metrics-exporter token"
+        expires: "{{ monitoring_metrics_exporter_token_expiration }}"
+        permissions: "{{ monitoring_metrics_exporter_permissions }}"
+      register: _metal_metrics_exporter_token
+
+
 - name: Deploy metrics exporters
   ansible.builtin.import_tasks: exporters.yaml
 - name: Deploy Grafana dashboards

control-plane/roles/monitoring/templates/metrics-exporters/metal-metrics-exporter.yaml

@@ -1,13 +1,69 @@
 ---
 apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: metal-token-renewal
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: metal-token-renewal
+rules:
+- apiGroups: [""]
+  resources: ["secrets"]
+  verbs: ["get", "update", "patch"]
+- apiGroups: [""]
+  resources: ["secrets"]
+  resourceNames: ["metal-metrics-exporter-config"]
+  verbs: ["get", "update", "patch"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: metal-token-renewal
+subjects:
+- kind: ServiceAccount
+  name: metal-token-renewal
+roleRef:
+  kind: Role
+  name: metal-token-renewal
+  apiGroup: rbac.authorization.k8s.io
+---
+apiVersion: batch/v1
+kind: CronJob
+metadata:
+  name: metal-metrics-exporter-token-refresher
+spec:
+  schedule: "@hourly"
+  jobTemplate:
+    metadata:
+      name: metal-metrics-exporter-token-refresher
+    spec:
+      template:
+        spec:
+          serviceAccountName: metal-token-refresher
+          restartPolicy: OnFailure
+          containers:
+          - name: token-refresher
+            image: ghcr.io/metal-stack/metal-token-refresher
+            env:
+            - name: METAL_APISERVER_URL
+              value: {{ monitoring_metal_apiserver_url }}
+            - name: TOKEN_SECRET_NAMESPACE
+              value: "monitoring"
+            - name: TOKEN_SECRET_NAME
+              value: "metal-metrics-exporter-config"
+            - name: TOKEN_SECRET_KEY
+              value: "token"
+---
+apiVersion: v1
 kind: Secret
 metadata:
   name: metal-metrics-exporter-config
 type: Opaque
 stringData:
-  url: {{ monitoring_metal_api_url }}
-  hmac: {{ monitoring_metal_api_hmac }}
-  authtype: {{ monitoring_metal_api_authtype }}
+  url: {{ monitoring_metal_apiserver_url }}
+  token: {{ _metal_metrics_exporter_token.secret }}
 ---
 apiVersion: v1
 kind: Service
@@ -44,8 +100,12 @@ spec:
         - name: metal-metrics-exporter
           command:
             - /metal-metrics-exporter
-          image: {{ metal_metrics_exporter_image_name }}:{{ metal_metrics_exporter_image_tag }}
+          image: {{ monitoring_metal_metrics_exporter_image_name }}:{{ monitoring_metal_metrics_exporter_image_tag }}
           imagePullPolicy: {{ metal_control_plane_image_pull_policy }}
+          securityContext:
+            allowPrivilegeEscalation: false
+            runAsNonRoot: true
+            runAsUser: 999
           ports:
             - containerPort: 9080
               name: metrics
@@ -55,13 +115,13 @@ spec:
                 secretKeyRef:
                   name: metal-metrics-exporter-config
                   key: url
-            - name: METAL_API_HMAC
-              valueFrom:
-                secretKeyRef:
-                  name: metal-metrics-exporter-config
-                  key: hmac
-            - name: METAL_API_AUTH_TYPE
-              valueFrom:
-                secretKeyRef:
-                  name: metal-metrics-exporter-config
-                  key: authtype
+            - name: METAL_API_TOKEN_FILE
+              value: /var/run/secrets/metal-metrics-exporter-config/token
+          volumeMounts:
+          - mountPath: /var/run/secrets/metal-metrics-exporter-config
+            name: metal-metrics-exporter-config
+      volumes:
+      - name: metal-metrics-exporter-config
+        secret:
+          defaultMode: 420
+          secretName: metal-metrics-exporter-config