hyperledger-labs · jkneubuh · Jul 25, 2022 · Jul 25, 2022 · Jul 27, 2022 · Jul 28, 2022
diff --git a/config/prometheus/kustomization.yaml b/config/prometheus/kustomization.yaml
@@ -1,2 +1,3 @@
 resources:
 - monitor.yaml
+
diff --git a/sample-network/config/cas/kustomization.yaml b/sample-network/config/cas/kustomization.yaml
@@ -19,6 +19,8 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 
+namespace: ${NS}
+
 resources:
   - org0-ca.yaml
   - org1-ca.yaml

diff --git a/sample-network/config/console/kustomization.yaml b/sample-network/config/console/kustomization.yaml
@@ -1,5 +1,7 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 
+namespace: ${NS}
+
 resources:
   - hlf-operations-console.yaml
diff --git a/sample-network/config/manager/kustomization.yaml b/sample-network/config/manager/kustomization.yaml
@@ -18,5 +18,7 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 
+namespace: ${NS}
+
 resources:
   - hlf-operator-manager.yaml
diff --git a/sample-network/config/orderers/kustomization.yaml b/sample-network/config/orderers/kustomization.yaml
@@ -19,6 +19,8 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 
+namespace: ${NS}
+
 resources:
   - org0-orderers.yaml
 
diff --git a/sample-network/config/orderers/org0-orderers.yaml b/sample-network/config/orderers/org0-orderers.yaml
@@ -43,15 +43,15 @@ spec:
     - enrollment:
         component:
           caname: ca
-          cahost: test-network-org0-ca-ca.${INGRESS_DOMAIN}
+          cahost: ${NS}-org0-ca-ca.${INGRESS_DOMAIN}
           caport: "443"
           catls:
             cacert: "${ORG0_CA_CERT}"
           enrollid: "orderer1"
           enrollsecret: "orderer1pw"
         tls:
           caname: tlsca
-          cahost: test-network-org0-ca-ca.${INGRESS_DOMAIN}
+          cahost: ${NS}-org0-ca-ca.${INGRESS_DOMAIN}
           caport: "443"
           catls:
             cacert: "${ORG0_CA_CERT}"
@@ -64,15 +64,15 @@ spec:
     - enrollment:
         component:
           caname: ca
-          cahost: test-network-org0-ca-ca.${INGRESS_DOMAIN}
+          cahost: ${NS}-org0-ca-ca.${INGRESS_DOMAIN}
           caport: "443"
           catls:
             cacert: "${ORG0_CA_CERT}"
           enrollid: "orderer2"
           enrollsecret: "orderer2pw"
         tls:
           caname: tlsca
-          cahost: test-network-org0-ca-ca.${INGRESS_DOMAIN}
+          cahost: ${NS}-org0-ca-ca.${INGRESS_DOMAIN}
           caport: "443"
           catls:
             cacert: "${ORG0_CA_CERT}"
@@ -85,15 +85,15 @@ spec:
     - enrollment:
         component:
           caname: ca
-          cahost: test-network-org0-ca-ca.${INGRESS_DOMAIN}
+          cahost: ${NS}-org0-ca-ca.${INGRESS_DOMAIN}
           caport: "443"
           catls:
             cacert: "${ORG0_CA_CERT}"
           enrollid: "orderer3"
           enrollsecret: "orderer3pw"
         tls:
           caname: tlsca
-          cahost: test-network-org0-ca-ca.${INGRESS_DOMAIN}
+          cahost: ${NS}-org0-ca-ca.${INGRESS_DOMAIN}
           caport: "443"
           catls:
             cacert: "${ORG0_CA_CERT}"

diff --git a/sample-network/config/peers/kustomization.yaml b/sample-network/config/peers/kustomization.yaml
@@ -19,6 +19,8 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 
+namespace: ${NS}
+
 resources:
   - org1-peer1.yaml
   - org1-peer2.yaml

diff --git a/sample-network/config/peers/org1-peer1.yaml b/sample-network/config/peers/org1-peer1.yaml
@@ -23,7 +23,7 @@ metadata:
 spec:
   version: "${FABRIC_VERSION}"
   domain: "${INGRESS_DOMAIN}"
-  peerExternalEndpoint: "test-network-org1-peer1-peer.${INGRESS_DOMAIN}:443"
+  peerExternalEndpoint: "${NS}-org1-peer1-peer.${INGRESS_DOMAIN}:443"
   license:
     accept: true
   action:
@@ -33,6 +33,8 @@ spec:
     peer:
       keepalive:
         minInterval: 61s
+    metrics:
+      provider: prometheus
   customNames:
     pvc: {}
   images:
@@ -48,15 +50,15 @@ spec:
     enrollment:
       component:
         caname: ca
-        cahost: "test-network-org1-ca-ca.${INGRESS_DOMAIN}"
+        cahost: "${NS}-org1-ca-ca.${INGRESS_DOMAIN}"
         caport: "443"
         catls:
           cacert: "${ORG1_CA_CERT}"
         enrollid: "peer1"
         enrollsecret: "peer1pw"
       tls:
         caname: tlsca
-        cahost: "test-network-org1-ca-ca.${INGRESS_DOMAIN}"
+        cahost: "${NS}-org1-ca-ca.${INGRESS_DOMAIN}"
         caport: "443"
         catls:
           cacert: "${ORG1_CA_CERT}"

diff --git a/sample-network/config/peers/org1-peer2.yaml b/sample-network/config/peers/org1-peer2.yaml
@@ -23,7 +23,7 @@ metadata:
 spec:
   version: "${FABRIC_VERSION}"
   domain: "${INGRESS_DOMAIN}"
-  peerExternalEndpoint: "test-network-org1-peer2-peer.${INGRESS_DOMAIN}:443"
+  peerExternalEndpoint: "${NS}-org1-peer2-peer.${INGRESS_DOMAIN}:443"
   license:
     accept: true
   action:
@@ -48,15 +48,15 @@ spec:
     enrollment:
       component:
         caname: ca
-        cahost: "test-network-org1-ca-ca.${INGRESS_DOMAIN}"
+        cahost: "${NS}-org1-ca-ca.${INGRESS_DOMAIN}"
         caport: "443"
         catls:
           cacert: "${ORG1_CA_CERT}"
         enrollid: "peer2"
         enrollsecret: "peer2pw"
       tls:
         caname: tlsca
-        cahost: "test-network-org1-ca-ca.${INGRESS_DOMAIN}"
+        cahost: "${NS}-org1-ca-ca.${INGRESS_DOMAIN}"
         caport: "443"
         catls:
           cacert: "${ORG1_CA_CERT}"

diff --git a/sample-network/config/peers/org2-peer1.yaml b/sample-network/config/peers/org2-peer1.yaml
@@ -23,7 +23,7 @@ metadata:
 spec:
   version: "${FABRIC_VERSION}"
   domain: "${INGRESS_DOMAIN}"
-  peerExternalEndpoint: "test-network-org2-peer1-peer.${INGRESS_DOMAIN}:443"
+  peerExternalEndpoint: "${NS}-org2-peer1-peer.${INGRESS_DOMAIN}:443"
   license:
     accept: true
   action:
@@ -48,15 +48,15 @@ spec:
     enrollment:
       component:
         caname: ca
-        cahost: "test-network-org2-ca-ca.${INGRESS_DOMAIN}"
+        cahost: "${NS}-org2-ca-ca.${INGRESS_DOMAIN}"
         caport: "443"
         catls:
           cacert: "${ORG2_CA_CERT}"
         enrollid: "peer1"
         enrollsecret: "peer1pw"
       tls:
         caname: tlsca
-        cahost: "test-network-org2-ca-ca.${INGRESS_DOMAIN}"
+        cahost: "${NS}-org2-ca-ca.${INGRESS_DOMAIN}"
         caport: "443"
         catls:
           cacert: "${ORG2_CA_CERT}"

diff --git a/sample-network/config/peers/org2-peer2.yaml b/sample-network/config/peers/org2-peer2.yaml
@@ -23,7 +23,7 @@ metadata:
 spec:
   version: "${FABRIC_VERSION}"
   domain: "${INGRESS_DOMAIN}"
-  peerExternalEndpoint: "test-network-org2-peer2-peer.${INGRESS_DOMAIN}:443"
+  peerExternalEndpoint: "${NS}-org2-peer2-peer.${INGRESS_DOMAIN}:443"
   license:
     accept: true
   action:
@@ -48,15 +48,15 @@ spec:
     enrollment:
       component:
         caname: ca
-        cahost: "test-network-org2-ca-ca.${INGRESS_DOMAIN}"
+        cahost: "${NS}-org2-ca-ca.${INGRESS_DOMAIN}"
         caport: "443"
         catls:
           cacert: "${ORG2_CA_CERT}"
         enrollid: "peer2"
         enrollsecret: "peer2pw"
       tls:
         caname: tlsca
-        cahost: "test-network-org2-ca-ca.${INGRESS_DOMAIN}"
+        cahost: "${NS}-org2-ca-ca.${INGRESS_DOMAIN}"
         caport: "443"
         catls:
           cacert: "${ORG2_CA_CERT}"

diff --git a/sample-network/config/prometheus/ingress-grafana.yaml b/sample-network/config/prometheus/ingress-grafana.yaml
@@ -0,0 +1,27 @@
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  annotations:
+    nginx.ingress.kubernetes.io/proxy-connect-timeout: 60s
+    nginx.ingress.kubernetes.io/ssl-passthrough: "false"
+  labels:
+    app: grafana
+  name: grafana
+  namespace: monitoring
+spec:
+  ingressClassName: nginx
+  rules:
+    - host: grafana.${INGRESS_DOMAIN}
+      http:
+        paths:
+          - backend:
+              service:
+                name: grafana
+                port:
+                  name: http
+            path: /
+            pathType: ImplementationSpecific
+  tls:
+    - hosts:
+        - prometheus.${INGRESS_DOMAIN}
diff --git a/sample-network/config/prometheus/ingress-prometheus.yaml b/sample-network/config/prometheus/ingress-prometheus.yaml
@@ -0,0 +1,27 @@
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  annotations:
+    nginx.ingress.kubernetes.io/proxy-connect-timeout: 60s
+    nginx.ingress.kubernetes.io/ssl-passthrough: "false"
+  labels:
+    app: prometheus-k8s
+  name: prometheus-k8s
+  namespace: monitoring
+spec:
+  ingressClassName: nginx
+  rules:
+    - host: prometheus.${INGRESS_DOMAIN}
+      http:
+        paths:
+          - backend:
+              service:
+                name: prometheus-k8s
+                port:
+                  name: web
+            path: /
+            pathType: ImplementationSpecific
+  tls:
+    - hosts:
+        - prometheus.${INGRESS_DOMAIN}
diff --git a/sample-network/config/prometheus/kustomization.yaml b/sample-network/config/prometheus/kustomization.yaml
@@ -0,0 +1,30 @@
+#
+# Copyright contributors to the Hyperledger Fabric Operator project
+#
+# SPDX-License-Identifier: Apache-2.0
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at:
+#
+# 	  http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+namespace: monitoring
+
+resources:
+  - servicemonitor-org0-orderersnode1.yaml
+  - servicemonitor-org0-orderersnode2.yaml
+  - servicemonitor-org0-orderersnode3.yaml
+  - servicemonitor-org1-peer1.yaml
+  - servicemonitor-org1-peer2.yaml
+  - servicemonitor-org2-peer1.yaml
+  - servicemonitor-org2-peer2.yaml
diff --git a/sample-network/config/prometheus/servicemonitor-org0-orderersnode1.yaml b/sample-network/config/prometheus/servicemonitor-org0-orderersnode1.yaml
@@ -0,0 +1,40 @@
+apiVersion: monitoring.coreos.com/v1
+kind: ServiceMonitor
+metadata:
+  name: org0-orderersnode1
+  namespace: monitoring
+spec:
+  namespaceSelector:
+    # todo: establish RBAC for visibility from system:serviceaccount:monitoring:prometheus-k8s
+    matchNames:
+      - ${NS}
+  selector:
+    matchLabels:
+      app: org0-orderersnode1
+  endpoints:
+    - port: operations
+      scheme: https
+
+      # The operations /metrics endpoint is secured by mTLS, and must be presented with a client certificate
+      # and key signed by the org CA.  In this example we will use the org admin TLS enrollment to connect
+      # to the endpoint. See https://cloud.ibm.com/docs/blockchain?topic=blockchain-ibp-monitoring-prometheus
+      # for an example of creating a custom org enrollment for external monitors via ingress.
+      #
+      # tlsca-signcert.pem : temp/cas/$org-ca/tlsca-signcert.pem
+      # cert.pem : temp/enrollments/$org/users/org0admin/tls/signcerts/cert.pem
+      # key.pem : temp/enrollments/$org/users/org0admin/tls/keystore/key.pem
+      tlsConfig:
+        serverName: org0-orderersnode1
+        ca:
+          secret:
+            name: org0-servicemonitor-tls-secret
+            key: tlsca-signcert.pem
+        cert:
+          secret:
+            name: org0-servicemonitor-tls-secret
+            key: cert.pem
+        keySecret:
+          name: org0-servicemonitor-tls-secret
+          key: key.pem
+
+
diff --git a/sample-network/config/prometheus/servicemonitor-org0-orderersnode2.yaml b/sample-network/config/prometheus/servicemonitor-org0-orderersnode2.yaml
@@ -0,0 +1,40 @@
+apiVersion: monitoring.coreos.com/v1
+kind: ServiceMonitor
+metadata:
+  name: org0-orderersnode2
+  namespace: monitoring
+spec:
+  namespaceSelector:
+    # todo: establish RBAC for visibility from system:serviceaccount:monitoring:prometheus-k8s
+    matchNames:
+      - ${NS}
+  selector:
+    matchLabels:
+      app: org0-orderersnode2
+  endpoints:
+    - port: operations
+      scheme: https
+
+      # The operations /metrics endpoint is secured by mTLS, and must be presented with a client certificate
+      # and key signed by the org CA.  In this example we will use the org admin TLS enrollment to connect
+      # to the endpoint. See https://cloud.ibm.com/docs/blockchain?topic=blockchain-ibp-monitoring-prometheus
+      # for an example of creating a custom org enrollment for external monitors via ingress.
+      #
+      # tlsca-signcert.pem : temp/cas/$org-ca/tlsca-signcert.pem
+      # cert.pem : temp/enrollments/$org/users/org0admin/tls/signcerts/cert.pem
+      # key.pem : temp/enrollments/$org/users/org0admin/tls/keystore/key.pem
+      tlsConfig:
+        serverName: org0-orderersnode2
+        ca:
+          secret:
+            name: org0-servicemonitor-tls-secret
+            key: tlsca-signcert.pem
+        cert:
+          secret:
+            name: org0-servicemonitor-tls-secret
+            key: cert.pem
+        keySecret:
+          name: org0-servicemonitor-tls-secret
+          key: key.pem
+
+