mirror of
https://github.com/enix/x509-certificate-exporter.git
synced 2026-08-23 22:16:39 +00:00
95 lines
3.9 KiB
YAML
95 lines
3.9 KiB
YAML
# e2e-only overrides layered on top of dev/values.yaml. The exporter is
|
||
# scraped directly via Tilt's port-forward, so the ServiceMonitor +
|
||
# PrometheusRule resources (which depend on prom-operator CRDs) are not
|
||
# needed and disabled here.
|
||
#
|
||
# The hostPathsExporter section watches the subtree populated by the
|
||
# seed-hostpath Job (see test/e2e/seed-hostpath.yaml + dev/scenarios/
|
||
# hostpath.go). The `nodes` DaemonSet name doubles as a metric label,
|
||
# so keep it short. Paths and globs here MUST match what the seed
|
||
# scenarios materialise — both consumers are tied to dev/scenarios.
|
||
---
|
||
prometheusServiceMonitor:
|
||
create: false
|
||
prometheusRules:
|
||
create: false
|
||
|
||
# Hand-rolled Service that targets the DaemonSet pod specifically
|
||
# (component=host-nodes). The chart's default Service selects every
|
||
# exporter pod (Deployment + DaemonSet) — port-forwarding to it would
|
||
# route to a random one. This second Service lets us reach the
|
||
# DaemonSet pod deterministically on host port 19794, see Tiltfile.
|
||
#
|
||
# Lives in extraDeploy so Helm creates it inside the same release that
|
||
# creates the namespace (`--create-namespace`), avoiding the
|
||
# chicken-and-egg of a standalone `k8s_yaml(...)` that races the
|
||
# namespace.
|
||
extraDeploy:
|
||
- apiVersion: v1
|
||
kind: Service
|
||
metadata:
|
||
name: '{{ include "x509-certificate-exporter.fullname" . }}-nodes'
|
||
spec:
|
||
type: ClusterIP
|
||
selector:
|
||
app.kubernetes.io/name: '{{ include "x509-certificate-exporter.name" . }}'
|
||
app.kubernetes.io/instance: '{{ .Release.Name }}'
|
||
app.kubernetes.io/component: host-nodes
|
||
ports:
|
||
- name: metrics
|
||
port: 9793
|
||
targetPort: metrics
|
||
|
||
cabundlesExporter:
|
||
enabled: true
|
||
resources:
|
||
mutating: true
|
||
validating: true
|
||
apiservice: true
|
||
crdConversion: true
|
||
# The seed creates an `x509ce-e2e-*-ignored` resource that this
|
||
# excludeNames pattern must filter out — the e2e test asserts no
|
||
# x509_cert_* series for the matching resource name.
|
||
excludeNames:
|
||
- "*-ignored"
|
||
# Expose the managed-by label as a Prometheus label.
|
||
exposeLabels:
|
||
- app.kubernetes.io/managed-by
|
||
|
||
hostPathsExporter:
|
||
# 5s instead of the chart default (300s) so the exporter picks up
|
||
# files written by the seed-hostpath Job within the e2e suite's
|
||
# poll-and-retry window (12 × 5s = 60s).
|
||
refreshInterval: "5s"
|
||
# The DaemonSet pod can be scheduled before the seed-hostpath Job has
|
||
# had a chance to create /var/lib/x509ce-e2e/pki. The chart's default
|
||
# `Directory` would refuse to mount a non-existent path; let the
|
||
# kubelet create it on demand (the seed Job populates it shortly
|
||
# afterwards, and the exporter's 5s poll picks the new files up).
|
||
hostPathVolumeType: DirectoryOrCreate
|
||
daemonSets:
|
||
nodes:
|
||
# Each entry is materialised by the seed-hostpath Job (file or
|
||
# symlink under /var/lib/x509ce-e2e/pki). Listed individually so
|
||
# the actual rotation targets next to the symlinks are NOT
|
||
# walked themselves — we only want the symlink path in metrics.
|
||
watchFiles:
|
||
- /var/lib/x509ce-e2e/pki/static.pem
|
||
- /var/lib/x509ce-e2e/pki/kubelet-client-current.pem
|
||
- /var/lib/x509ce-e2e/pki/absolute-link.pem
|
||
- /var/lib/x509ce-e2e/pki/escape.pem
|
||
# Recursive globs under a shared static prefix — exercises the
|
||
# chart's static-prefix extraction (one HostPath volume covers
|
||
# both patterns) and the fileglob walker's `**` traversal,
|
||
# including a literal segment (`tls/`) sitting AFTER `**`.
|
||
watchDirectories:
|
||
- /var/lib/x509ce-e2e/recursive-pki/**/*.pem
|
||
- /var/lib/x509ce-e2e/recursive-pki/**/tls/*.pem
|
||
# Regression guard: the chart's mountPath for this mode must
|
||
# bind `<directory>` (not its parent), so the configmap-side
|
||
# scan path `/mnt/watch/dir-<sha>/<directory>/*.<ext>` actually
|
||
# contains the host file.
|
||
watchSpecificExtensionDirectories:
|
||
- directory: /var/lib/x509ce-e2e/extdir
|
||
extension: crt
|