rhelemeter-template.yaml

apiVersion: template.openshift.io/v1
kind: Template
metadata:
  name: rhelemeter
objects:
- apiVersion: v1
  kind: Secret
  metadata:
    labels:
      k8s-app: rhelemeter-server
    name: rhelemeter-server-client-info
  stringData:
    client-info.json: |-
      {
          "config": {
              "common_name_header": "x-rh-certauth-cn",
              "issuer_header": "x-rh-certauth-issuer",
              "secret_header": "x-rh-rhelemeter-gateway-secret"
          },
          "secret": "${RHELEMETER_CLIENT_INFO_PSK}"
      }
  type: Opaque
- apiVersion: apps/v1
  kind: Deployment
  metadata:
    name: rhelemeter-server
  spec:
    replicas: ${{REPLICAS}}
    selector:
      matchLabels:
        k8s-app: rhelemeter-server
    template:
      metadata:
        labels:
          k8s-app: rhelemeter-server
      spec:
        containers:
        - command:
          - /usr/bin/rhelemeter-server
          - --listen=0.0.0.0:8443
          - --listen-internal=0.0.0.0:8081
          - --tls-key=/etc/pki/service/tls.key
          - --tls-crt=/etc/pki/service/tls.crt
          - --internal-tls-key=/etc/pki/service/tls.key
          - --internal-tls-crt=/etc/pki/service/tls.crt
          - --client-info-data-file=/etc/external/client-info.json
          - --oidc-issuer=$(OIDC_ISSUER)
          - --client-id=$(CLIENT_ID)
          - --client-secret=$(CLIENT_SECRET)
          - --whitelist={__name__="system_cpu_logical_count"}
          - --log-level=${RHELEMETER_LOG_LEVEL}
          - --limit-bytes=5242880
          - --tenant-id=${RHELEMETER_TENANT_ID}
          - --forward-url=${RHELEMETER_FORWARD_URL}
          env:
          - name: OIDC_ISSUER
            valueFrom:
              secretKeyRef:
                key: oidc_issuer
                name: rhelemeter-server
          - name: CLIENT_SECRET
            valueFrom:
              secretKeyRef:
                key: client_secret
                name: rhelemeter-server
          - name: CLIENT_ID
            valueFrom:
              secretKeyRef:
                key: client_id
                name: rhelemeter-server
          image: ${IMAGE}:${IMAGE_TAG}
          livenessProbe:
            httpGet:
              path: /healthz
              port: 8081
              scheme: HTTPS
          name: rhelemeter-server
          ports:
          - containerPort: 8443
            name: external
          - containerPort: 8081
            name: internal
          readinessProbe:
            httpGet:
              path: /healthz/ready
              port: 8081
              scheme: HTTPS
          resources:
            limits:
              cpu: ${RHELEMETER_SERVER_CPU_LIMIT}
              memory: ${RHELEMETER_SERVER_MEMORY_LIMIT}
            requests:
              cpu: ${RHELEMETER_SERVER_CPU_REQUEST}
              memory: ${RHELEMETER_SERVER_MEMORY_REQUEST}
          volumeMounts:
          - mountPath: /etc/pki/service
            name: rhelemeter-server-tls
            readOnly: false
          - mountPath: /etc/external
            name: rhelemeter-server-client-info
            readOnly: false
        serviceAccountName: rhelemeter-server
        volumes:
        - name: secret-rhelemeter-server
          secret:
            secretName: rhelemeter-server
        - name: rhelemeter-server-tls
          secret:
            secretName: rhelemeter-server-shared
        - name: rhelemeter-server-client-info
          secret:
            secretName: rhelemeter-server-client-info
- apiVersion: v1
  kind: Secret
  metadata:
    labels:
      k8s-app: rhelemeter-server
    name: rhelemeter-server
  stringData:
    client_id: ${RHELEMETER_CLIENT_ID}
    client_secret: ${RHELEMETER_CLIENT_SECRET}
    oidc_issuer: ${RHELEMETER_OIDC_ISSUER}
  type: Opaque
- apiVersion: v1
  kind: Service
  metadata:
    annotations:
      service.alpha.openshift.io/serving-cert-secret-name: rhelemeter-server-shared
    labels:
      k8s-app: rhelemeter-server
    name: rhelemeter-server
  spec:
    clusterIP: None
    ports:
    - name: external
      port: 8443
      targetPort: external
    - name: internal
      port: 8081
      targetPort: internal
    selector:
      k8s-app: rhelemeter-server
- apiVersion: v1
  kind: ServiceAccount
  metadata:
    name: rhelemeter-server
- apiVersion: monitoring.coreos.com/v1
  kind: ServiceMonitor
  metadata:
    labels:
      endpoint: metrics
      k8s-app: rhelemeter-server
      prometheus: app-sre
    name: rhelemeter-server
  spec:
    endpoints:
    - interval: 60s
      port: internal
      scheme: https
      tlsConfig:
        insecureSkipVerify: true
    jobLabel: k8s-app
    namespaceSelector:
      matchNames:
      - ${NAMESPACE}
    selector:
      matchLabels:
        k8s-app: rhelemeter-server
parameters:
- name: NAMESPACE
  value: rhelemeter
- name: IMAGE_TAG
  value: "5923762"
- name: IMAGE
  value: quay.io/app-sre/telemeter
- name: REPLICAS
  value: "2"
- name: RHELEMETER_TENANT_ID
  value: rhel
- name: RHELEMETER_FORWARD_URL
  value: ""
- name: RHELEMETER_OIDC_ISSUER
  value: https://sso.redhat.com/auth/realms/redhat-external
- name: RHELEMETER_CLIENT_ID
  value: ""
- name: RHELEMETER_CLIENT_SECRET
  value: ""
- name: RHELEMETER_CLIENT_INFO_PSK
  value: ""
- name: RHELEMETER_LOG_LEVEL
  value: warn
- name: RHELEMETER_SERVER_CPU_LIMIT
  value: "1"
- name: RHELEMETER_SERVER_CPU_REQUEST
  value: 100m
- name: RHELEMETER_SERVER_MEMORY_LIMIT
  value: 1Gi
- name: RHELEMETER_SERVER_MEMORY_REQUEST
  value: 500Mi