fix: add kube-rbac-metrics sidecar and fix default labels

chart/saml-exporter/README.md

@@ -14,14 +14,14 @@ This command deploys the MongoDB Exporter with the default configuration. The [c
 
 ## Using the Chart
 
-The chart comes with a ServiceMonitor for use with the [Prometheus Operator](https://github.com/helm/charts/tree/master/stable/prometheus-operator).
+The chart comes with a ServiceMonitor (or PodMonitor) for use with the [Prometheus Operator](https://github.com/helm/charts/tree/master/stable/prometheus-operator).
 If you're not using the Prometheus Operator, you can disable the ServiceMonitor by setting `serviceMonitor.enabled` to `false` and instead
 populate the `podAnnotations` as below:
 
 ```yaml
 podAnnotations:
   prometheus.io/scrape: "true"
-  prometheus.io/port: "metrics"
+  prometheus.io/port: "http-metrics"
   prometheus.io/path: "/metrics"
 ```
 

chart/saml-exporter/templates/dashboard.yaml

@@ -3,15 +3,11 @@ apiVersion: v1
 kind: ConfigMap
 metadata:
   name: {{ include "saml-exporter.fullname" . }}-dashboard
-  {{- if or .Values.labels .Values.grafanaDashboard.labels }}
   labels:
-    {{- with .Values.labels }}
-    {{- toYaml . | nindent 4 }}
-    {{- end }}
+    {{- include "saml-exporter.labels" . | nindent 4 }}
     {{- with .Values.grafanaDashboard.labels }}
     {{- toYaml . | nindent 4 }}
     {{- end }}
-  {{- end }}  
   {{- if or .Values.annotations .Values.grafanaDashboard.annotations }}
   annotations:
     {{- with .Values.annotations }}
@@ -22,6 +18,5 @@ metadata:
     {{- end }}
   {{- end }}  
 data:
-  {{- $fileName := printf "dashboard.json" (include "saml-exporter.fullname" .) }}
-  {{- ($.Files.Glob (printf $fileName)).AsConfig | nindent 2 }}
-{{- end -}}
+  {{- ($.Files.Glob (printf "dashboard.json")).AsConfig | nindent 2 }}
+{{- end -}}

chart/saml-exporter/templates/deployment.yaml

@@ -2,15 +2,11 @@ apiVersion: apps/v1
 kind: Deployment
 metadata:
   name: {{ include "saml-exporter.fullname" . }}
-  {{- if or .Values.annotations .Values.deploymentAnnotations }}
   labels:
-    {{- with .Values.labels }}
-    {{- toYaml . | nindent 4 }}
-    {{- end }}
+    {{- include "saml-exporter.labels" . | nindent 4 }}
     {{- with .Values.deploymentLabels }}
     {{- toYaml . | nindent 4 }}
     {{- end }}
-  {{- end }}  
   {{- if or .Values.annotations .Values.deploymentAnnotations }}
   annotations:
     {{- with .Values.annotations }}
@@ -47,8 +43,10 @@ spec:
         imagePullPolicy: {{ .Values.image.pullPolicy }}
         args:
         - --bind={{ printf ":%s" .Values.port }}
-        - --path={{ .Values.metricsPath }}
-        - {{ .Values.samlMetadataURL | required ".Values.samlMetadataURL is required." }}
+        - --metrics-path={{ .Values.metricsPath }}
+        {{- range .Values.samlMetadataURLSlice | required ".Values.samlMetadataURL is required." }}
+        - {{ . }}
+        {{- end }}
         {{- if .Values.extraArgs }}
         {{- toYaml .Values.extraArgs | nindent 8 }}
         {{- end }}
@@ -80,6 +78,30 @@ spec:
           subPath: {{ .subPath }}
           {{- end }}
         {{- end }}
+      {{- if .Values.kubeRBACProxy.enabled }}
+      - args:
+        - --secure-listen-address=0.0.0.0:8443
+        - --upstream=http://127.0.0.1:{{ .Values.port }}
+        - --logtostderr=true
+        - --v=0
+        image: {{ .Values.kubeRBACProxy.image }}
+        imagePullPolicy: IfNotPresent
+        name: kube-rbac-proxy
+        ports:
+        - containerPort: 8443
+          name: https-metrics
+          protocol: TCP
+        {{- with .Values.kubeRBACProxy.resources }}
+        resources:
+          {{- toYaml . | nindent 10 }}
+        {{- end }}        
+        {{- with .Values.kubeRBACProxy.securityContext }}
+        securityContext:
+          {{- toYaml . | nindent 10 }}
+        {{- end }}        
+        terminationMessagePath: /dev/termination-log
+        terminationMessagePolicy: File
+      {{- end }}        
       {{- if .Values.extraContainers }}
       {{- toYaml .Values.extraContainers | nindent 6 }}
       {{- end }}

chart/saml-exporter/templates/metrics-rbac.yaml

@@ -0,0 +1,63 @@
+{{- if .Values.kubeRBACProxy.enabled }}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: {{ include "saml-exporter.fullname" . }}-metrics-reader
+  labels:
+    {{- include "saml-exporter.labels" . | nindent 4 }}
+rules:
+  - nonResourceURLs:
+      - "/metrics"
+    verbs:
+      - get
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: {{ include "saml-exporter.fullname" . }}-metrics
+  labels:
+    {{- include "saml-exporter.labels" . | nindent 4 }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: {{ include "saml-exporter.fullname" . }}-metrics-reader
+subjects:
+- kind: ServiceAccount
+  name: {{ template "saml-exporter.serviceAccountName" . }}
+  namespace: {{ .Release.Namespace }}
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: {{ include "saml-exporter.fullname" . }}-proxy
+  labels:
+    {{- include "saml-exporter.labels" . | nindent 4 }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: {{ include "saml-exporter.fullname" . }}-proxy
+subjects:
+  - kind: ServiceAccount
+    name: {{ template "saml-exporter.serviceAccountName" . }}
+    namespace: {{ .Release.Namespace }}
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: {{ include "saml-exporter.fullname" . }}-proxy
+  labels:
+    {{- include "saml-exporter.labels" . | nindent 4 }}
+rules:
+  - apiGroups:
+      - authentication.k8s.io
+    resources:
+      - tokenreviews
+    verbs:
+      - create
+  - apiGroups:
+      - authorization.k8s.io
+    resources:
+      - subjectaccessreviews
+    verbs:
+      - create
+  {{- end }}

chart/saml-exporter/templates/podmonitor.yaml

@@ -3,15 +3,11 @@ apiVersion: monitoring.coreos.com/v1
 kind: PodMonitor
 metadata:
   name: {{ include "saml-exporter.fullname" . }}
-   {{- if or .Values.labels .Values.podMonitor.labels }}
   labels:
-    {{- with .Values.labels }}
-    {{- toYaml . | nindent 4 }}
-    {{- end }}
+    {{- include "saml-exporter.labels" . | nindent 4 }}
     {{- with .Values.podMonitor.labels }}
     {{- toYaml . | nindent 4 }}
     {{- end }}
-  {{- end }}  
   {{- if or .Values.annotations .Values.podMonitor.annotations }}
   annotations:
     {{- with .Values.annotations }}
@@ -26,14 +22,23 @@ metadata:
   {{- end }}
 spec:
   podMetricsEndpoints:
-  - port: metrics
-    path: {{ .Values.metricsPath }}
+  - path: {{ .Values.metricsPath }}
+    {{- if .Values.kubeRBACProxy.enabled }}
+    port: https-metrics
+    scheme: https
+    bearerTokenSecret:
+      key: token
+      name: {{ template "saml-exporter.serviceAccountName" . }}
+    tlsConfig:
+      insecureSkipVerify: true
+    {{- else }}
+    port: http-metrics
+    {{- end }}
     interval: {{ .Values.podMonitor.interval }}
     scrapeTimeout: {{ .Values.podMonitor.scrapeTimeout }}
     {{- if .Values.podMonitor.metricRelabelings }}
     metricRelabelings: {{ toYaml .Values.podMonitor.metricRelabelings | nindent 4 }}
     {{- end }}
-
   namespaceSelector:
     matchNames:
     - {{ .Release.Namespace }}

chart/saml-exporter/templates/prometheusrule.yaml

@@ -1,21 +1,98 @@
 {{- if .Values.prometheusRule.enabled }}
+{{- $rulePrefix:= .Values.prometheusRule.rulePrefix }}
 apiVersion: monitoring.coreos.com/v1
 kind: PrometheusRule
 metadata:
 metadata:
   name: {{ template "saml-exporter.fullname" . }}
-  labels: {{- merge ( include "saml-exporter.labels" . | fromYaml) .Values.prometheusRule.labels | toYaml | nindent 4 }}
-  {{- with .Values.annotations }}
+  labels:
+    {{- include "saml-exporter.labels" . | nindent 4 }}
+    {{- with .Values.prometheusRule.labels }}
+    {{- toYaml . | nindent 4 }}
+    {{- end }}
+  {{- if or .Values.annotations .Values.prometheusRule.annotations }}
   annotations:
+    {{- with .Values.annotations }}
     {{- toYaml . | nindent 4 }}
-  {{- end }}
+    {{- end }}
+    {{- with .Values.prometheusRule.annotations }}
+    {{- toYaml . | nindent 4 }}
+    {{- end }}
+  {{- end }}  
   {{- if .Values.prometheusRule.namespace }}
   namespace: {{ .Values.prometheusRule.namespace }}
   {{- end }}
 spec:
-{{- with .Values.prometheusRule.rules }}
   groups:
-    - name: {{ template "saml-exporter.name" $ }}
-      rules: {{ tpl (toYaml .) $ | nindent 8 }}
+  {{- if .Values.prometheusRule.disableBuiltinAlertGroup }}
+    {{- if not (len .Values.prometheusRule.extraAlertGroups) }}
+      {{ fail "Extra alert groups (extraAlertGroups) are required when disableBuiltinAlertGroup is set!" }}
+    {{- end }}
+  {{- else }}
+  - name: saml-exporter.rules
+    rules:
+    {{- if .Values.prometheusRule.alertOnReadErrors }}
+    - alert: '{{ printf "%s %s" $rulePrefix "X509CertificateReadErrors" | trim }}'
+      expr: delta(saml_x509_read_errors[15m]) > 0
+      for: 5m
+      labels:
+        severity: {{ .Values.prometheusRule.readErrorsSeverity }}
+        {{- if .Values.prometheusRule.alertExtraLabels }}
+        {{- toYaml .Values.prometheusRule.alertExtraLabels | nindent 8 }}
+        {{- end }}
+      annotations:
+        summary: Increasing read errors for saml-exporter
+        description: Over the last 15 minutes, this saml-exporter instance has experienced errors reading certificate files or querying the Kubernetes API. This could be caused by a misconfiguration if triggered when the exporter starts.
+        {{- if .Values.prometheusRule.alertExtraAnnotations }}
+        {{- toYaml .Values.prometheusRule.alertExtraAnnotations | nindent 8 }}
+        {{- end }}
+    {{- end }}
+    {{- if .Values.prometheusRule.alertOnCertificateErrors }}
+    - alert: '{{ printf "%s %s" $rulePrefix "X509CertificateError" | trim }}'
+      expr: saml_x509_cert_error > 0
+      for: 15m
+      labels:
+        severity: {{ .Values.prometheusRule.certificateErrorsSeverity }}
+        {{- if .Values.prometheusRule.alertExtraLabels }}
+        {{- toYaml .Values.prometheusRule.alertExtraLabels | nindent 8 }}
+        {{- end }}
+      annotations:
+        summary: Certificate cannot be decoded
+        description: Certificate could not be decoded {{ "{{if" }} $labels.secret_name {{ "}}" }}in Kubernetes secret "{{ "{{" }} $labels.secret_namespace {{ "}}" }}/{{ "{{" }} $labels.secret_name {{ "}}" }}"{{ "{{else}}" }}at location "{{ "{{" }} $labels.filepath {{ "}}" }}"{{ "{{end}}" }}
+        {{- if .Values.prometheusRule.alertExtraAnnotations }}
+        {{- toYaml .Values.prometheusRule.alertExtraAnnotations | nindent 8 }}
+        {{- end }}
+    {{- end }}
+    - alert: '{{ printf "%s %s" $rulePrefix "X509CertificateRenewal" | trim }}'
+      expr: ((saml_x509_cert_not_after - time()) / 86400) < {{ .Values.prometheusRule.warningDaysLeft }}
+      for: 15m
+      labels:
+        severity: {{ .Values.prometheusRule.certificateRenewalsSeverity }}
+        {{- if .Values.prometheusRule.alertExtraLabels }}
+        {{- toYaml .Values.prometheusRule.alertExtraLabels | nindent 8 }}
+        {{- end }}
+      annotations:
+        summary: Certificate should be renewed
+        description: Certificate for "{{ "{{" }} $labels.subject_CN {{ "}}" }}" should be renewed {{ "{{if" }} $labels.secret_name {{ "}}" }}in Kubernetes secret "{{ "{{" }} $labels.secret_namespace {{ "}}" }}/{{ "{{" }} $labels.secret_name {{ "}}" }}"{{ "{{else}}" }}at location "{{ "{{" }} $labels.filepath {{ "}}" }}"{{ "{{end}}" }}
+        {{- if .Values.prometheusRule.alertExtraAnnotations }}
+        {{- toYaml .Values.prometheusRule.alertExtraAnnotations | nindent 8 }}
+        {{- end }}
+    - alert: '{{ printf "%s %s" $rulePrefix "X509CertificateExpiration" | trim }}'
+      expr: ((saml_x509_cert_not_after - time()) / 86400) < {{ .Values.prometheusRule.criticalDaysLeft }}
+      for: 15m
+      labels:
+        severity: {{ .Values.prometheusRule.certificateExpirationsSeverity }}
+        {{- if .Values.prometheusRule.alertExtraLabels }}
+        {{- toYaml .Values.prometheusRule.alertExtraLabels | nindent 8 }}
+        {{- end }}
+      annotations:
+        summary: Certificate is about to expire
+        description: Certificate for "{{ "{{" }} $labels.subject_CN {{ "}}" }}" is about to expire {{ "{{if" }} $labels.secret_name {{ "}}" }}in Kubernetes secret "{{ "{{" }} $labels.secret_namespace {{ "}}" }}/{{ "{{" }} $labels.secret_name {{ "}}" }}"{{ "{{else}}" }}at location "{{ "{{" }} $labels.filepath {{ "}}" }}"{{ "{{end}}" }}
+        {{- if .Values.prometheusRule.alertExtraAnnotations }}
+        {{- toYaml .Values.prometheusRule.alertExtraAnnotations | nindent 8 }}
+        {{- end }}
+  {{- end }}
+{{- range .Values.prometheusRule.extraAlertGroups }}
+  - {{ tpl (toYaml .) $ | indent 4 | trim }}
 {{- end }}
 {{- end }}

chart/saml-exporter/templates/service.yaml

@@ -1,17 +1,13 @@
-{{ if .Values.service.enabled }}
+{{ if or .Values.service.enabled .Values.serviceMonitor.enabled }}
 apiVersion: v1
 kind: Service
 metadata:
   name: {{ include "saml-exporter.fullname" . }}
-   {{- if or .Values.labels .Values.service.labels }}
   labels:
-    {{- with .Values.labels }}
-    {{- toYaml . | nindent 4 }}
-    {{- end }}
+    {{- include "saml-exporter.labels" . | nindent 4 }}
     {{- with .Values.service.labels }}
     {{- toYaml . | nindent 4 }}
     {{- end }}
-  {{- end }}  
   {{- if or .Values.annotations .Values.service.annotations }}
   annotations:
     {{- with .Values.annotations }}
@@ -21,19 +17,20 @@ metadata:
     {{- toYaml . | nindent 4 }}
     {{- end }}
   {{- end }}  
-
-
-  labels: {{- merge ( include "saml-exporter.labels" . | fromYaml) .Values.service.labels | toYaml | nindent 4 }}
-  {{- with .Values.annotations }}
-  annotations:
-    {{- toYaml . | nindent 4 }}
-  {{- end }}
 spec:
   ports:
+    {{- if .Values.kubeRBACProxy.enabled }}
+    - port: {{ .Values.service.port }}
+      protocol: TCP
+      name: https-metrics
+      protocol: TCP
+      targetPort: https-metrics
+    {{- else }}
     - port: {{ .Values.service.port }}
       targetPort: http-metrics
       protocol: TCP
       name: http-metrics
+    {{- end }}
   selector:
     app.kubernetes.io/name: {{ include "saml-exporter.name" . }}
     app.kubernetes.io/instance: {{ .Release.Name }}

chart/saml-exporter/templates/serviceaccount-token.yaml

@@ -0,0 +1,11 @@
+{{- if .Values.serviceAccount.create -}}
+apiVersion: v1
+kind: Secret
+metadata:
+  name: {{ template "saml-exporter.serviceAccountName" . }}
+  labels:
+    {{- include "saml-exporter.labels" . | nindent 4 }}
+  annotations:
+    kubernetes.io/service-account.name: {{ template "saml-exporter.serviceAccountName" . }}
+type: kubernetes.io/service-account-token
+{{- end -}}

chart/saml-exporter/templates/serviceaccount.yaml

@@ -3,15 +3,11 @@ apiVersion: v1
 kind: ServiceAccount
 metadata:
   name: {{ template "saml-exporter.serviceAccountName" . }}
-   {{- if or .Values.labels .Values.serviceAccount.labels }}
   labels:
-    {{- with .Values.labels }}
-    {{- toYaml . | nindent 4 }}
-    {{- end }}
+    {{- include "saml-exporter.labels" . | nindent 4 }}
     {{- with .Values.serviceAccount.labels }}
     {{- toYaml . | nindent 4 }}
     {{- end }}
-  {{- end }}  
   {{- if or .Values.annotations .Values.serviceAccount.annotations }}
   annotations:
     {{- with .Values.annotations }}