Merge commit 'fe564d72279f4ab061b961dd528623f0ed272667' as 'cluster-config'

cluster-config/components/openshift-monitoring/README.md

@@ -0,0 +1,4 @@
+This is used to configure a couple of things with openshift-monitoring:
+
+1. Sets the cluster label so that it can be referenced in templates. This lets us include the cluster name in the received alerts
+2. Sets up a service account that external monitoring tools can use to query thanos, the bearer token can be retrieved from the secret.

cluster-config/components/openshift-monitoring/base/cluster-monitoring-config-cm.yaml

@@ -0,0 +1,48 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: cluster-monitoring-config
+  namespace: openshift-monitoring
+data:
+  config.yaml: |
+    alertmanagerMain:
+      enableUserAlertmanagerConfig: true
+    enableUserWorkload: true
+    nodeExporter:
+      collectors:
+        buddyinfo: {}
+        cpufreq: {}
+        ksmd: {}
+        mountstats: {}
+        netclass: {}
+        netdev: {}
+        processes: {}
+        systemd: {}
+        tcpstat: {}
+    prometheusK8s:
+      additionalAlertmanagerConfigs:
+      - apiVersion: v2
+        bearerToken:
+          key: token
+          name: observability-alertmanager-accessor
+        scheme: https
+        staticConfigs:
+        - alertmanager-open-cluster-management-observability.apps.hub.ocplab.com
+        tlsConfig:
+          ca:
+            key: service-ca.crt
+            name: hub-alertmanager-router-ca
+          insecureSkipVerify: false
+      externalLabels:
+        cluster: ${CLUSTER_GITOPS_NAME}
+        managed_cluster: ${CLUSTER_ID}
+      volumeClaimTemplate:
+        metadata: {}
+        spec:
+          accessModes:
+          - ReadWriteOnce
+          resources:
+            requests:
+              storage: 40Gi
+          volumeMode: Filesystem
+        status: {}

cluster-config/components/openshift-monitoring/base/kustomization.yaml

@@ -0,0 +1,8 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - cluster-monitoring-config-cm.yaml
+  - monitoring-role-binding.yaml
+  - service-account.yaml
+  - token-secret.yaml

cluster-config/components/openshift-monitoring/base/monitoring-role-binding.yaml

@@ -0,0 +1,12 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: external-monitor-reader
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: cluster-monitoring-view
+subjects:
+- kind: ServiceAccount
+  name: external-monitor-reader
+  namespace: openshift-monitoring

cluster-config/components/openshift-monitoring/base/service-account.yaml

@@ -0,0 +1,5 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: external-monitor-reader
+  namespace: openshift-monitoring

cluster-config/components/openshift-monitoring/base/token-secret.yaml

@@ -0,0 +1,8 @@
+apiVersion: v1
+kind: Secret
+metadata:
+  annotations:
+    kubernetes.io/service-account.name: external-monitor-reader
+  name: external-monitor-reader
+  namespace: openshift-monitoring
+type: kubernetes.io/service-account-token