Skip to content

Commit e3652fa

Browse files
stevsmitstevsmit
authored
Merge pull request #98474 from wgabor0427/OSDOCS-16037
OSDOCS-16037 added metrics and log level assemblies and modules
2 parents 3b28183 + 2793fb9 commit e3652fa

12 files changed

+788
-0
lines changed

‎_topic_maps/_topic_map.yml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1260,6 +1260,10 @@ Topics:
12601260
File: external-secrets-operator-config-net-policy
12611261
- Name: Configuring the egress proxy
12621262
File: external-secrets-operator-proxy
1263+
- Name: Monitoring the External Secrets Operator for Red Hat OpenShift
1264+
File: external-secrets-monitoring
1265+
- Name: Customizing the External Secrets Operator for Red Hat OpenShift
1266+
File: external-secrets-log-levels
12631267
- Name: Uninstalling the External Secrets Operator
12641268
File: external-secrets-operator-uninstall
12651269
- Name: External Secrets Operator APIs

‎modules/external-secrets-bit-warden-config.adoc‎

Lines changed: 67 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,67 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * security/external_secrets_operator/external-secrets-log-levels.adoc
4+
5+
:_mod-docs-content-type: PROCEDURE
6+
[id="external-secrets-bit-warden-config_{context}"]
7+
= Configuring the bitwardenSecretManagerProvider plugin
8+
9+
You can enable the `bitwardenSecretManagerProvider` to use the Bitwarden Secrets Manager provider as a source for your secrets.
10+
11+
.Prerequisites
12+
13+
* You have access to the cluster with `cluster-admin` privileges.
14+
* You have created the `ExternalSecretsConfig` custom resource.
15+
16+
.Procedure
17+
18+
. Edit the `ExternalSecretsConfig` custom resource by running the following command:
19+
+
20+
[source,terminal]
21+
----
22+
$ oc edit externalsecretsconfigs.operator.openshift.io cluster
23+
----
24+
25+
. Edit the `spec.plugins.bitwardenSecretManagerProvider` section as follows to enable the Bitwarden Secrets Manager:
26+
+
27+
[source,yaml]
28+
----
29+
apiVersion: operator.openshift.io/v1alpha1
30+
kind: ExternalSecretsConfig
31+
...
32+
spec:
33+
plugins:
34+
bitwardenSecretManagerProvider:
35+
mode: Enabled
36+
secretRef:
37+
name: <secret_object_name>
38+
----
39+
+
40+
where:
41+
42+
name:: The name of the secret containing the certificate key pair for the plugin. The key name in the secret for the certificate must be `tls.crt`. The key name for the private key must be `tls.key`. The key name for the Certificate Authority (CA) certificate key name must be `ca.crt`. Configuring the secret is optional when the cert-manager certificate provider is configured.
43+
44+
. Save your changes and exit the editor.
45+
46+
. If you disable the plugin the following resources must be deleted manually by running the following commands:
47+
48+
[source,terminal]
49+
----
50+
$ oc delete deployments.apps bitwarden-sdk-server -n external-secrets
51+
----
52+
53+
[source,terminal]
54+
----
55+
$ oc delete certificates.cert-manager.io bitwarden-tls-certs -n external-secrets
56+
----
57+
58+
[source,terminal]
59+
----
60+
$ oc delete service bitwarden-sdk-server -n external-secrets
61+
----
62+
63+
[source,terminal]
64+
----
65+
$ oc delete serviceaccounts bitwarden-sdk-server -n external-secrets
66+
----
67+

‎modules/external-secrets-cert-manager-config.adoc‎

Lines changed: 86 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,86 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * security/external_secrets_operator/external-secrets-log-levels.adoc
4+
5+
:_mod-docs-content-type: PROCEDURE
6+
[id="external-secrets-cert-manager-config_{context}"]
7+
= Configuring cert-manager for the external-secrets certificate requirements
8+
9+
The `external-secrets` webhook and plugins can be assigned to `cert-manager` for certificate management. This configuration is optional.
10+
11+
When `cert-manager` is not used, `external-secrets` defaults to its own certificate management. In this mode, it automatically generates the required certificates for the webhook, while you are responsible for manually configuring certificates for the plugins.
12+
13+
.Prerequisites
14+
15+
* You have access to the cluster with `cluster-admin` privileges.
16+
* You have created the `ExternalSecretsConfig` custom resource.
17+
* You have installed the {cert-manager-operator}. For more information, see "Installing the {cert-manager-operator}"
18+
19+
.Procedure
20+
21+
. Edit the `ExternalSecretsConfig` custom resource by running the following command:
22+
+
23+
[source,terminal]
24+
----
25+
$ oc edit externalsecretsconfigs.operator.openshift.io cluster
26+
----
27+
28+
. Configure `cert-manager` by editing the `spec.controllerConfig.certProvider.certManager` section as follows:
29+
+
30+
[source,yaml]
31+
----
32+
apiVersion: operator.openshift.io/v1alpha1
33+
kind: ExternalSecretsConfig
34+
...
35+
spec:
36+
controllerConfig:
37+
certProvider:
38+
certManager:
39+
injectAnnotations: "true"
40+
issuerRef:
41+
name: <issuer_name>
42+
kind: <issuer_kind>
43+
group: <issuer_group>
44+
mode: Enabled
45+
----
46+
+
47+
where:
48+
49+
injectAnnotation:: Must be set to `true` when enabled.
50+
name:: Name of the issuer object referenced in `ExternalSecretsConfig`.
51+
kind:: API issuer. Can be set to either `Issuer` or `ClusterIssuer`.
52+
group:: API issuer group. The group name must be `cert-manager.io`.
53+
mode:: Must be set to `Enabled`. This is an immutable field and cannot be modified once it is configured.
54+
55+
. Save your changes.
56+
57+
. After you update the `cert-manager` configurations in the `externalsecretsconfig.operator.openshift.io` object, you must manually delete `external-secrets-cert-controller` deployment by running the following command. This prevents performance degradation of the `external-secrets` application.
58+
+
59+
[source,terminal]
60+
----
61+
$ oc delete deployments.apps external-secrets-cert-controller -n external-secrets
62+
----
63+
64+
. Optionally, you can delete other resources created for the `cert-controller` by running the following commands:
65+
+
66+
[source,terminal]
67+
----
68+
$ oc delete clusterrolebindings.rbac.authorization.k8s.io external-secrets-cert-controller
69+
----
70+
+
71+
[source,terminal]
72+
----
73+
$ oc delete clusterroles.rbac.authorization.k8s.io external-secrets-cert-controller
74+
----
75+
+
76+
[source,terminal]
77+
----
78+
$ oc delete serviceaccounts external-secrets-cert-controller -n external-secrets
79+
----
80+
+
81+
[source,terminal]
82+
----
83+
$ oc delete secrets external-secrets-webhook -n external-secrets
84+
----
85+
86+

‎modules/external-secrets-enable-metrics.adoc‎

Lines changed: 128 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,128 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * security/external_secrets_operator/exteernal-secrets-monitoring.adoc
4+
5+
:_mod-docs-content-type: PROCEDURE
6+
[id="external-secrets-enable-metrics_{context}"]
7+
= Configuring metrics collection for {external-secrets-operator} operands by using a ServiceMonitor
8+
9+
[role="_abstract"]
10+
The {external-secrets-operator} operands exposes metrics by default on port `8080` at the `/metrics` service endpoint for all three components (`external-secrets`, `external-secrets-cert-controll`, and `external-secrets-webhook`). You can configure metrics collection for the external-secrets operands by creating a `ServiceMonitor` custom resource (CR) that enables the Prometheus Operator to collect custom metrics. For more information, see "Configuring user workload monitoring".
11+
12+
.Prerequisites
13+
14+
* You have access to the cluster as a user with the `cluster-admin` role.
15+
* You have installed the {external-secrets-operator}.
16+
* You have enabled the user workload monitoring.
17+
18+
.Procedure
19+
20+
. Create the `ClusterRoleBinding` resource required for granting permissions to access metrics:
21+
22+
.. Create the `clusterrolebinding-external-secrets.yaml` YAML file:
23+
+
24+
The following example shows a `cluserrolebinding-external-secrets.yaml` file.
25+
+
26+
[source,yaml]
27+
----
28+
apiVersion: rbac.authorization.k8s.io/v1
29+
kind: ClusterRoleBinding
30+
metadata:
31+
labels:
32+
app: external-secrets
33+
name: external-secrets-allow-metrics-access
34+
roleRef:
35+
apiGroup: rbac.authorization.k8s.io
36+
kind: ClusterRole
37+
name: external-secrets-operator-metrics-reader
38+
subjects:
39+
- kind: ServiceAccount
40+
name: external-secrets
41+
namespace: external-secrets
42+
- kind: ServiceAccount
43+
name: external-secrets-cert-controller
44+
namespace: external-secrets
45+
- kind: ServiceAccount
46+
name: external-secrets-webhook
47+
namespace: external-secrets
48+
----
49+
50+
.. Create the `ClusterRoldeBinding` custom resource by running the following command:
51+
+
52+
[source,terminal]
53+
----
54+
$ oc apply -f clusterrolebinding-external-secrets.yaml
55+
----
56+
57+
. Create the `ServiceMonitor` CR:
58+
59+
.. Create the `servicemonitor-external-secrets.yaml` YAML file:
60+
+
61+
[source,yaml]
62+
----
63+
apiVersion: monitoring.coreos.com/v1
64+
kind: ServiceMonitor
65+
metadata:
66+
labels:
67+
app: external-secrets
68+
name: external-secrets-metrics-monitor
69+
namespace: external-secrets
70+
spec:
71+
endpoints:
72+
- interval: 60s
73+
path: /metrics
74+
port: metrics
75+
scheme: http
76+
scrapeTimeout: 30s
77+
namespaceSelector:
78+
matchNames:
79+
- external-secrets
80+
selector:
81+
matchExpressions:
82+
- key: app.kubernetes.io/name
83+
operator: In
84+
values:
85+
- external-secrets
86+
- external-secrets-cert-controller
87+
- external-secrets-webhook
88+
- key: app.kubernetes.io/instance
89+
operator: In
90+
values:
91+
- external-secrets
92+
- key: app.kubernetes.io/managed-by
93+
operator: In
94+
values:
95+
- external-secrets-operator
96+
----
97+
98+
.. Create the `ServiceMonitor` CR by running the following command:
99+
+
100+
[source,terminal]
101+
----
102+
$ oc apply -f servicemonitor-external-secrets.yaml
103+
----
104+
+
105+
After the `ServiceMonitor` CR is created, the user workload Prometheus instance begins metrics collection from the {external-secrets-operator} operands. The collected metrics are labeled with `job="external-secrets"`,`job="external-secrets-cainjector"`, and `job="external-secrets-webhook"`.
106+
107+
.Verification
108+
109+
. In the {product-title} web console, navigate to *Observe* -> *Targets*.
110+
111+
. In the Label filter field, enter the following labels to filter the metrics targets for each operand:
112+
+
113+
[source,terminal]
114+
----
115+
$ service=external-secrets
116+
----
117+
+
118+
[source,terminal]
119+
----
120+
$ service=external-secrets-cert-controller-metrics
121+
----
122+
+
123+
[source,terminal]
124+
----
125+
$ service=external-secrets-webhook
126+
----
127+
128+
. Confirm that the *Status* column shows `Up` for the `external-secrets`, `external-secrets-cert-controller` and `external-secrets-webhook`.

‎modules/external-secrets-enable-operand-log-level.adoc‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * security/external_secrets_operator/external-secrets-log-levels.adoc
4+
5+
:_mod-docs-content-type: PROCEDURE
6+
[id="external-secrets-enable-operand-log-level_{context}"]
7+
= Setting a log level for the {external-secrets-operator} operand
8+
9+
You can set a log level for the {external-secrets-operator} to determine the verbosity of log messages.
10+
11+
.Prerequisites
12+
13+
* You have access to the cluster with `cluster-admin` privileges.
14+
* You have created the `ExternalSecretsConfig` custom resource.
15+
16+
.Procedure
17+
18+
. Edit the `ExternalSecretsConfig` CR by running the following command:
19+
+
20+
[source,terminal]
21+
----
22+
$ oc edit externalsecretsconfigs.operator.openshift.io cluster
23+
----
24+
25+
. Set the log level value by editing the `spec.appConfig.logLevel` section:
26+
+
27+
[source,yaml]
28+
----
29+
apiVersion: operator.openshift.io/v1alpha1
30+
kind: ExternalSecretsConfig
31+
...
32+
spec:
33+
appConfig:
34+
logLevel: <log_level> <1>
35+
----
36+
+
37+
<1> Supports the value range of 1-5. The log level gets mapped to the following operand support levels:
38+
* 1 - warnings
39+
* 2 - error logs
40+
* 3 - info logs
41+
* 4 and 5 - debug logs
42+
43+
. Save your changes and exit the editor.
44+

‎modules/external-secrets-enable-operator-log-level.adoc‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * security/external_secrets_operator/external-secrets-log-levels.adoc
4+
5+
:_mod-docs-content-type: PROCEDURE
6+
[id="external-secrets-enable-operator-log-level_{context}"]
7+
= Setting a log level for the {external-secrets-operator}
8+
9+
You can set a log level for the {external-secrets-operator} to determine the verbosity of the operator log messages.
10+
11+
.Prerequisites
12+
13+
* You have access to the cluster with `cluster-admin` privileges.
14+
* You have created the `ExternalSecretsConfig` custom resource.
15+
16+
.Procedure
17+
18+
* Update the subscription object for {external-secrets-operator} to provide the verbosity level for the operator logs by running the following command:
19+
+
20+
[source,terminal]
21+
----
22+
$ oc -n <external_secrets_operator_namespace> patch subscription openshift-external-secrets-operator --type='merge' -p '{"spec":{"config":{"env":[{"name":"OPERATOR_LOG_LEVEL","value":"<log_level>"}]}}}'
23+
----
24+
+
25+
where:
26+
27+
external_secrets_operator_namespace:: Namespace where the operator is installed.
28+
29+
log_level:: Supports the value range of 1-5. The default is 2.
30+
31+
.Verification
32+
33+
. The External Secrets Operator pod is redeployed. Verify that the log level of the {external-secrets-operator} is updated by running the following command:
34+
+
35+
[source,terminal]
36+
----
37+
$ oc set env deploy/external-secrets-operator-controller-manager -n external-secrets-operator --list | grep -e OPERATOR_LOG_LEVEL -e container
38+
----
39+
+
40+
.Example output
41+
[source,terminal]
42+
----
43+
# deployments/external-secrets-operator-controller-manager, container manager
44+
OPERATOR_LOG_LEVEL=2
45+
----
46+
47+
. Verify that the log level of the {external-secrets-operator} is updated by running the `oc logs` command:
48+
+
49+
[source,terminal]
50+
----
51+
$ oc logs -n external-secrets-operator -f deployments/external-secrets-operator-controller-manager -c manager
52+
----

0 commit comments

Comments
 (0)