@@ -439,7 +439,7 @@ func addMetrics(ctx context.Context, cfg *rest.Config, kClient *kubernetes.Clien
439439 os .Exit (1 )
440440 }
441441
442- if err := handleServiceMonitor (ctx , cfg , mClient , kClient , operatorNs , metricsService ); err != nil {
442+ if err := handleServiceMonitor (ctx , cfg , mClient , operatorNs , metricsService ); err != nil {
443443 log .Error (err , "Error creating ServiceMonitor" )
444444 os .Exit (1 )
445445 }
@@ -531,6 +531,28 @@ func ensureMetricsServiceAndSecret(ctx context.Context, kClient *kubernetes.Clie
531531 }
532532 }
533533
534+ // Check if the metrics service account token secret exists. If not, create it and trigger a restart.
535+ _ , err = kClient .CoreV1 ().Secrets (ns ).Get (ctx , complianceOperatorMetricsSecretName , metav1.GetOptions {})
536+ if err != nil {
537+ if kerr .IsNotFound (err ) {
538+ secret := & v1.Secret {
539+ ObjectMeta : metav1.ObjectMeta {
540+ Name : complianceOperatorMetricsSecretName ,
541+ Namespace : ns ,
542+ Annotations : map [string ]string {
543+ "kubernetes.io/service-account.name" : complianceOperatorMetricsSA ,
544+ },
545+ },
546+ Type : v1 .SecretTypeServiceAccountToken ,
547+ }
548+ if _ , createErr := kClient .CoreV1 ().Secrets (ns ).Create (context .TODO (), secret , metav1.CreateOptions {}); createErr != nil && ! kerr .IsAlreadyExists (createErr ) {
549+ return nil , createErr
550+ }
551+ return nil , errors .New ("operator metrics token not found; restarting as the service may have just been created" )
552+ }
553+ return nil , err
554+ }
555+
534556 return returnService , nil
535557}
536558
@@ -681,7 +703,7 @@ func getDefaultRoles(platform PlatformType) []string {
681703 return defaultRolesPerPlatform [PlatformGeneric ]
682704}
683705
684- func generateOperatorServiceMonitor (service * v1.Service , namespace , secretName string ) * monitoring.ServiceMonitor {
706+ func generateOperatorServiceMonitor (service * v1.Service , namespace string ) * monitoring.ServiceMonitor {
685707 serviceMonitor := GenerateServiceMonitor (service )
686708 for i := range serviceMonitor .Spec .Endpoints {
687709 if serviceMonitor .Spec .Endpoints [i ].Port == ctrlMetrics .ControllerMetricsServiceName {
@@ -691,7 +713,7 @@ func generateOperatorServiceMonitor(service *v1.Service, namespace, secretName s
691713 Type : "Bearer" ,
692714 Credentials : & v1.SecretKeySelector {
693715 LocalObjectReference : v1.LocalObjectReference {
694- Name : secretName ,
716+ Name : complianceOperatorMetricsSecretName ,
695717 },
696718 Key : "token" ,
697719 },
@@ -707,25 +729,6 @@ func generateOperatorServiceMonitor(service *v1.Service, namespace, secretName s
707729 return serviceMonitor
708730}
709731
710- func getSecretNameForServiceAccount (clientset * kubernetes.Clientset , namespace string , serviceAccountName string ) (string , error ) {
711- // List all secrets in the specified namespace
712- secrets , err := clientset .CoreV1 ().Secrets (namespace ).List (context .TODO (), metav1.ListOptions {})
713- if err != nil {
714- return "" , err
715- }
716-
717- // Iterate through the secrets to find the one associated with the service account
718- for _ , secret := range secrets .Items {
719- if secret .Annotations != nil {
720- if saName , exists := secret .Annotations ["kubernetes.io/service-account.name" ]; exists && saName == serviceAccountName {
721- return secret .Name , nil
722- }
723- }
724- }
725-
726- return "" , errors .New ("secret for service account not found" )
727- }
728-
729732// createOrUpdateServiceMonitor creates or updates the ServiceMonitor if it already exists.
730733func createOrUpdateServiceMonitor (ctx context.Context , mClient * monclientv1.MonitoringV1Client ,
731734 namespace string , serviceMonitor * monitoring.ServiceMonitor ) error {
@@ -751,7 +754,7 @@ func createOrUpdateServiceMonitor(ctx context.Context, mClient *monclientv1.Moni
751754
752755// handleServiceMonitor attempts to create a ServiceMonitor out of service, and updates it to include the controller
753756// metrics paths.
754- func handleServiceMonitor (ctx context.Context , cfg * rest.Config , mClient * monclientv1.MonitoringV1Client , kubeClient * kubernetes. Clientset ,
757+ func handleServiceMonitor (ctx context.Context , cfg * rest.Config , mClient * monclientv1.MonitoringV1Client ,
755758 namespace string , service * v1.Service ) error {
756759 ok , err := ResourceExists (discovery .NewDiscoveryClientForConfigOrDie (cfg ),
757760 "monitoring.coreos.com/v1" , "ServiceMonitor" )
@@ -763,16 +766,7 @@ func handleServiceMonitor(ctx context.Context, cfg *rest.Config, mClient *moncli
763766 return nil
764767 }
765768
766- serviceAccountName := "compliance-operator"
767- secretName , err := getSecretNameForServiceAccount (kubeClient , namespace , serviceAccountName )
768- if err != nil {
769- if kerr .IsNotFound (err ) {
770- log .Infof ("Unable to find secret associated with %s service account: %s" , serviceAccountName , err )
771- } else {
772- log .Errorf ("Failed to retrieve secret associated with %s service account for setting up metrics monitor: %s" , serviceAccountName , err )
773- }
774- }
775- serviceMonitor := generateOperatorServiceMonitor (service , namespace , secretName )
769+ serviceMonitor := generateOperatorServiceMonitor (service , namespace )
776770
777771 return createOrUpdateServiceMonitor (ctx , mClient , namespace , serviceMonitor )
778772}
![openshift-merge-bot[bot]](https://avatars.githubusercontent.com/in/412865?v=4&size=40){kind=avatar}
0 commit comments