operator: Expose only an HTTPS gateway when in openshift-logging mode #6288

aminesnow · 2022-06-02T09:03:15Z

What this PR does / why we need it:
This PR configures LokiStack gateway to exclusively use the HTTPS protocol when using the openshift-logging mode. In addition, traffic to the gateway k8s service is re-encrypted using a reencrypt termination policy while using the openshift-logging mode.

Which issue(s) this PR fixes:
Fixes #

Special notes for your reviewer:

Checklist

Documentation added
Tests updated
Is this an important fix or new feature? Add an entry in the CHANGELOG.md.
Changes that require user attention or interaction to upgrade are documented in docs/sources/upgrading/_index.md

CLAassistant · 2022-06-02T09:03:21Z

All committers have signed the CLA.

operator/bundle/manifests/loki-operator.clusterserviceversion.yaml

operator/config/manager/kustomization.yaml

operator/hack/addons_ocp.yaml

operator/internal/manifests/gateway_tenants.go

grafanabot · 2022-06-03T08:11:52Z

./tools/diff_coverage.sh ../loki-main/test_results.txt test_results.txt ingester,distributor,querier,querier/queryrange,iter,storage,chunkenc,logql,loki

Change in test coverage per package. Green indicates 0 or positive change, red indicates that test coverage for a package fell.

+           ingester	0%
-        distributor	-0.3%
+            querier	0%
+ querier/queryrange	0%
+               iter	0%
+            storage	0%
+           chunkenc	0%
+              logql	0%
+               loki	0%

grafanabot · 2022-06-03T10:52:49Z

./tools/diff_coverage.sh ../loki-main/test_results.txt test_results.txt ingester,distributor,querier,querier/queryrange,iter,storage,chunkenc,logql,loki

Change in test coverage per package. Green indicates 0 or positive change, red indicates that test coverage for a package fell.

+           ingester	0%
+        distributor	0.3%
+            querier	0%
+ querier/queryrange	0%
+               iter	0%
+            storage	0%
+           chunkenc	0%
+              logql	0%
+               loki	0%

grafanabot · 2022-06-03T14:33:13Z

./tools/diff_coverage.sh ../loki-main/test_results.txt test_results.txt ingester,distributor,querier,querier/queryrange,iter,storage,chunkenc,logql,loki

Change in test coverage per package. Green indicates 0 or positive change, red indicates that test coverage for a package fell.

+           ingester	0%
-        distributor	-0.3%
+            querier	0%
+ querier/queryrange	0%
+               iter	0%
+            storage	0%
+           chunkenc	0%
+              logql	0%
+               loki	0%

grafanabot · 2022-06-03T15:10:09Z

./tools/diff_coverage.sh ../loki-main/test_results.txt test_results.txt ingester,distributor,querier,querier/queryrange,iter,storage,chunkenc,logql,loki

Change in test coverage per package. Green indicates 0 or positive change, red indicates that test coverage for a package fell.

+           ingester	0%
+        distributor	0.3%
+            querier	0%
+ querier/queryrange	0%
+               iter	0%
+            storage	0%
+           chunkenc	0%
+              logql	0%
+               loki	0%

grafanabot · 2022-06-03T16:02:20Z

./tools/diff_coverage.sh ../loki-main/test_results.txt test_results.txt ingester,distributor,querier,querier/queryrange,iter,storage,chunkenc,logql,loki

Change in test coverage per package. Green indicates 0 or positive change, red indicates that test coverage for a package fell.

+           ingester	0%
+        distributor	0%
+            querier	0%
+ querier/queryrange	0%
+               iter	0%
+            storage	0%
+           chunkenc	0%
+              logql	0%
+               loki	0%

grafanabot · 2022-06-03T16:41:42Z

./tools/diff_coverage.sh ../loki-main/test_results.txt test_results.txt ingester,distributor,querier,querier/queryrange,iter,storage,chunkenc,logql,loki

Change in test coverage per package. Green indicates 0 or positive change, red indicates that test coverage for a package fell.

+           ingester	0%
+        distributor	0.3%
+            querier	0%
+ querier/queryrange	0%
+               iter	0%
+            storage	0%
+           chunkenc	0%
+              logql	0%
+               loki	0%

grafanabot · 2022-06-03T16:50:11Z

./tools/diff_coverage.sh ../loki-main/test_results.txt test_results.txt ingester,distributor,querier,querier/queryrange,iter,storage,chunkenc,logql,loki

Change in test coverage per package. Green indicates 0 or positive change, red indicates that test coverage for a package fell.

+           ingester	0%
+        distributor	0%
+            querier	0%
+ querier/queryrange	0%
+               iter	0%
+            storage	0%
+           chunkenc	0%
+              logql	0%
+               loki	0%

xperimental

No proper review, just passing by.

operator/internal/manifests/gateway.go

Co-authored-by: Robert Jacob <[email protected]>

grafanabot · 2022-06-07T16:50:33Z

./tools/diff_coverage.sh ../loki-main/test_results.txt test_results.txt ingester,distributor,querier,querier/queryrange,iter,storage,chunkenc,logql,loki

Change in test coverage per package. Green indicates 0 or positive change, red indicates that test coverage for a package fell.

+           ingester	0%
+        distributor	0.3%
+            querier	0%
+ querier/queryrange	0%
+               iter	0%
+            storage	0%
+           chunkenc	0%
+              logql	0%
+               loki	0%

periklis

Looks overall good to me 🚀 Only a couple of small improvements and we are set to go! Thank you for your contribution! Keep rocking!

operator/CHANGELOG.md

operator/internal/manifests/build_test.go

operator/internal/manifests/gateway.go

operator/internal/manifests/gateway_tenants.go

operator/internal/manifests/gateway_tenants_test.go

operator/internal/manifests/openshift/configure.go

…gateway-route-https

grafanabot · 2022-06-08T10:59:30Z

./tools/diff_coverage.sh ../loki-main/test_results.txt test_results.txt ingester,distributor,querier,querier/queryrange,iter,storage,chunkenc,logql,loki

Change in test coverage per package. Green indicates 0 or positive change, red indicates that test coverage for a package fell.

+           ingester	0%
-        distributor	-0.3%
+            querier	0%
+ querier/queryrange	0%
+               iter	0%
+            storage	0%
+           chunkenc	0%
+              logql	0%
+               loki	0.6%

periklis

Looks good to me!

xperimental

This achieves the goal of having a TLS gateway when on OpenShift. I would have expected the "TLS-enabled gateway" to be an option that is also available "without OpenShift" and that the OpenShift-config would just set this option enabled.

Should we refactor the PR into that direction or is "TLS only with OpenShift tenancy" the way we want to go?

xperimental · 2022-06-09T09:42:37Z

operator/internal/manifests/openshift/configure.go

 func ConfigureGatewayDeployment(
 	d *appsv1.Deployment,
 	gwContainerName string,
 	sercretVolumeName, tlsDir, certFile, keyFile string,
 	caDir, caFile string,
 	withTLS, withCertSigningService bool,
+	secretName, serviceName, serverName string,


serviceName is unused

The goal is to also use the Route CR and reencrypt to gateway. So it's pretty Openshift specific

indeed serviceName is unused! thnx

operator/internal/manifests/openshift/configure.go

grafanabot · 2022-06-09T14:25:18Z

./tools/diff_coverage.sh ../loki-main/test_results.txt test_results.txt ingester,distributor,querier,querier/queryrange,iter,storage,chunkenc,logql,loki

Change in test coverage per package. Green indicates 0 or positive change, red indicates that test coverage for a package fell.

+           ingester	0%
+        distributor	0%
+            querier	0%
- querier/queryrange	-0.1%
+               iter	0%
+            storage	0%
+           chunkenc	0%
+              logql	0%
+               loki	0%

grafanabot · 2022-06-09T14:50:34Z

./tools/diff_coverage.sh ../loki-main/test_results.txt test_results.txt ingester,distributor,querier,querier/queryrange,iter,storage,chunkenc,logql,loki

Change in test coverage per package. Green indicates 0 or positive change, red indicates that test coverage for a package fell.

+           ingester	0%
+        distributor	0%
+            querier	0%
- querier/queryrange	-0.1%
+               iter	0%
+            storage	0%
+           chunkenc	0%
+              logql	0%
+               loki	0%

xperimental

Looks good. 👍

Only remaining question from my point-of-view is whether we need to update the documentation / examples and the provided Grafana configuration in this PR or if this is done later.

pull-request-size bot added the size/L label Jun 2, 2022

github-actions bot added the sig/operator label Jun 2, 2022

periklis reviewed Jun 2, 2022

View reviewed changes

operator/bundle/manifests/loki-operator.clusterserviceversion.yaml Outdated Show resolved Hide resolved

periklis reviewed Jun 2, 2022

View reviewed changes

operator/bundle/manifests/loki-operator.clusterserviceversion.yaml Outdated Show resolved Hide resolved

periklis reviewed Jun 2, 2022

View reviewed changes

operator/config/manager/kustomization.yaml Outdated Show resolved Hide resolved

periklis reviewed Jun 2, 2022

View reviewed changes

operator/hack/addons_ocp.yaml Show resolved Hide resolved

periklis requested changes Jun 2, 2022

View reviewed changes

operator/internal/manifests/gateway_tenants.go Outdated Show resolved Hide resolved

aminesnow changed the title ~~operator: Gateway route https~~ operator: Expose only and HTTPS gateway when in openshift mode Jun 3, 2022

aminesnow changed the title ~~operator: Expose only and HTTPS gateway when in openshift mode~~ operator: Expose only an HTTPS gateway when in openshift mode Jun 3, 2022

aminesnow changed the title ~~operator: Expose only an HTTPS gateway when in openshift mode~~ operator: Expose only an HTTPS gateway when in openshift-logging mode Jun 3, 2022

pull-request-size bot added size/XXL and removed size/L labels Jun 3, 2022

github-actions bot added the area/docs label Jun 3, 2022

expose only an HTTPS gateway when in openshift-logging mode

c50f700

aminesnow force-pushed the gateway-route-https branch from 389c3c9 to c50f700 Compare June 3, 2022 16:44

pull-request-size bot added size/L and removed size/XXL labels Jun 3, 2022

github-actions bot removed the area/docs label Jun 3, 2022

aminesnow marked this pull request as ready for review June 7, 2022 10:04

aminesnow requested a review from a team as a code owner June 7, 2022 10:04

xperimental reviewed Jun 7, 2022

View reviewed changes

operator/internal/manifests/gateway.go Outdated Show resolved Hide resolved

typo fix

0ff1de3

Co-authored-by: Robert Jacob <[email protected]>

periklis requested changes Jun 8, 2022

View reviewed changes

Mohamed-Amine Bouqsimi added 3 commits June 8, 2022 12:52

fixes

880800e

Merge branch 'gateway-route-https' of github.com:aminesnow/loki into …

8da4e55

…gateway-route-https

typo fixes

c77ad79

periklis reviewed Jun 8, 2022

View reviewed changes

xperimental requested changes Jun 9, 2022

View reviewed changes

refactor

74e8d4d

typo

6ac2571

xperimental approved these changes Jun 9, 2022

View reviewed changes

periklis approved these changes Jun 10, 2022

View reviewed changes

periklis merged commit 73a144e into grafana:main Jun 10, 2022

This was referenced Jun 28, 2022

dannykopping/remove cache stats dannykopping/loki#13

Closed

dannykopping/remove cache stats dannykopping/loki#14

Draft

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

operator: Expose only an HTTPS gateway when in openshift-logging mode #6288

operator: Expose only an HTTPS gateway when in openshift-logging mode #6288

aminesnow commented Jun 2, 2022 •

edited

Loading

CLAassistant commented Jun 2, 2022 •

edited

Loading

grafanabot commented Jun 3, 2022

grafanabot commented Jun 3, 2022

grafanabot commented Jun 3, 2022

grafanabot commented Jun 3, 2022

grafanabot commented Jun 3, 2022

grafanabot commented Jun 3, 2022

grafanabot commented Jun 3, 2022

xperimental left a comment

grafanabot commented Jun 7, 2022

periklis left a comment

grafanabot commented Jun 8, 2022

periklis left a comment

xperimental left a comment

xperimental Jun 9, 2022

aminesnow Jun 9, 2022

grafanabot commented Jun 9, 2022

grafanabot commented Jun 9, 2022

xperimental left a comment

operator: Expose only an HTTPS gateway when in openshift-logging mode #6288

operator: Expose only an HTTPS gateway when in openshift-logging mode #6288

Conversation

aminesnow commented Jun 2, 2022 • edited Loading

CLAassistant commented Jun 2, 2022 • edited Loading

grafanabot commented Jun 3, 2022

grafanabot commented Jun 3, 2022

grafanabot commented Jun 3, 2022

grafanabot commented Jun 3, 2022

grafanabot commented Jun 3, 2022

grafanabot commented Jun 3, 2022

grafanabot commented Jun 3, 2022

xperimental left a comment

Choose a reason for hiding this comment

grafanabot commented Jun 7, 2022

periklis left a comment

Choose a reason for hiding this comment

grafanabot commented Jun 8, 2022

periklis left a comment

Choose a reason for hiding this comment

xperimental left a comment

Choose a reason for hiding this comment

xperimental Jun 9, 2022

Choose a reason for hiding this comment

aminesnow Jun 9, 2022

Choose a reason for hiding this comment

grafanabot commented Jun 9, 2022

grafanabot commented Jun 9, 2022

xperimental left a comment

Choose a reason for hiding this comment

aminesnow commented Jun 2, 2022 •

edited

Loading

CLAassistant commented Jun 2, 2022 •

edited

Loading