[stable/opa] Fix prometheus servicemonitor discovery configuration (#23668)

* servicemonitor.yaml: fixed servicemonitor.specselector.matchLabels.app value which must match with service.metadata.labels.app
* servicemonitor.yaml: fixed servicemonitor.metadata.labels.release overide support which  might be required for prometheus operator servicemonitorselector matchlabels criteria
* servicemonitor.yaml: replaced hardcoded listening targetPort in favor of service port name reference
* service.yaml: Added service port declaration for prometheus port exposed by container
* deployment.yaml: added support for custom prometheus/mgmt port
* deployment.yaml: added container ports declarations for default port exposed (https) and additional port used by prometheus/mgmt (http)
* values.yaml: added support for custom prometheus/mgmt port

Signed-off-by: Franck Labatut <flabatut@gmail.com>

stable/opa/Chart.yaml

@@ -6,7 +6,7 @@ keywords:
 - opa
 - admission control
 - policy
-version: 1.14.3
+version: 1.14.4
 home: https://www.openpolicyagent.org
 icon: https://raw.githubusercontent.com/open-policy-agent/opa/master/logo/logo.png
 sources:

stable/opa/README.md

@@ -84,6 +84,7 @@ Reference](https://www.openpolicyagent.org/docs/configuration.html).
 | `livenessProbe` | HTTP liveness probe for OPA container. | See [values.yaml](values.yaml) |
 | `opa` | OPA configuration. | See [values.yaml](values.yaml) |
 | `mgmt` | kube-mgmt configuration. | See [values.yaml](values.yaml) |
+| `mgmt.port` | kube-mgmt/prometheus port used to communicate with opa. | See [values.yaml](values.yaml) |
 | `sar.resources` | CPU and memory limits for the sar container. | `{}` |
 | `priorityClassName` | The name of the priorityClass for the pods. | Unset |
 | `prometheus.enabled` | Flag to expose the `/metrics` endpoint to be scraped. | `false` |

stable/opa/templates/deployment.yaml

@@ -83,6 +83,13 @@ spec:
 {{- end }}
       containers:
         - name: opa
+          ports:
+          - name: https
+            containerPort: {{ .Values.port }}
+{{- if .Values.prometheus.enabled }}
+          - name: http
+            containerPort: {{ .Values.mgmt.port }}
+{{- end }}
           image: {{ .Values.image }}:{{ .Values.imageTag }}
           imagePullPolicy: {{ .Values.imagePullPolicy }}
           resources:
@@ -104,9 +111,9 @@ spec:
             - "--ignore=.*"
 {{- end }}
 {{- if .Values.prometheus.enabled }}
-            - "--addr=http://0.0.0.0:8181"
+            - "--addr=http://0.0.0.0:{{ .Values.mgmt.port }}"
 {{- else if .Values.mgmt.enabled }}
-            - "--addr=http://127.0.0.1:8181"
+            - "--addr=http://127.0.0.1:{{ .Values.mgmt.port }}"
 {{- end }}
 {{- if or .Values.authz.enabled .Values.bootstrapPolicies }}
             - "/bootstrap"
@@ -142,7 +149,7 @@ spec:
 {{- if .Values.authz.enabled }}
             - --opa-auth-token-file=/bootstrap/mgmt-token
 {{- end }}
-            - --opa-url=http://127.0.0.1:8181/v1
+            - --opa-url=http://127.0.0.1:{{ .Values.mgmt.port }}/v1
             - --replicate-path={{ .Values.mgmt.replicate.path }}
             - --enable-data={{ .Values.mgmt.data.enabled }}
             - --enable-policies={{ .Values.mgmt.configmapPolicies.enabled }}

stable/opa/templates/service.yaml

@@ -12,6 +12,10 @@ spec:
     protocol: TCP
     port: 443
     targetPort: {{ .Values.port }}
+{{- if .Values.prometheus.enabled }}
+  - name: http
+    port: {{ .Values.mgmt.port }}
+{{- end }}
 {{- if .Values.extraPorts }}
 {{ toYaml .Values.extraPorts | indent 2}}
 {{- end }}

stable/opa/templates/servicemonitor.yaml

@@ -6,7 +6,9 @@ metadata:
     app: {{ template "opa.name" . }}
     chart: {{ template "opa.chart" . }}
     heritage: {{ .Release.Service }}
+    {{- if not .Values.serviceMonitor.additionalLabels.release }}
     release: {{ .Release.Name }}
+    {{- end }}
     {{- if .Values.serviceMonitor.additionalLabels }}
     {{- toYaml .Values.serviceMonitor.additionalLabels | nindent 4}}
     {{- end }}
@@ -16,15 +18,14 @@ metadata:
   {{- end }}
 spec:
   endpoints:
-  - targetPort: 8181
+  - port: http
     interval: {{ .Values.serviceMonitor.interval }}
-    path: "/metrics"
   jobLabel: {{ template "opa.fullname" . }}
   namespaceSelector:
     matchNames:
     - {{ .Release.Namespace }}
   selector:
     matchLabels:
-      app: {{ template "opa.name" . }}
+      app: {{ template "opa.fullname" . }}
       release: {{ .Release.Name }}
 {{- end }}

stable/opa/values.yaml

@@ -125,6 +125,8 @@ mgmt:
   image: openpolicyagent/kube-mgmt
   imageTag: "0.10"
   imagePullPolicy: IfNotPresent
+# NOTE insecure http port conjointly used for mgmt access and prometheus metrics export
+  port: 8181
   extraArgs: []
   resources: {}
   data: