Skip to content
This repository was archived by the owner on Sep 10, 2025. It is now read-only.

Commit c07b35b

Browse files
ndebuhrndebuhr
committed
🔍️ Add preconfigured monitoring via Prometheus and Grafana
1 parent 9280264 commit c07b35b

File tree

10 files changed

+482
-26
lines changed

10 files changed

+482
-26
lines changed

‎.github/workflows/build.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -34,9 +34,9 @@ jobs:
3434
uses: docker/build-push-action@v2
3535
with:
3636
context: ./docker
37-
file: ./docker/DockerfileKeycloakSeeding
37+
file: ./docker/DockerfileInitializers
3838
push: false
39-
tags: ndebuhr/cloud-native-workstation-keycloak-seeding:latest
39+
tags: ndebuhr/cloud-native-workstation-initializers:latest
4040

4141
- name: build novnc image
4242
uses: docker/build-push-action@v2

‎.github/workflows/publish.yml‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -41,19 +41,19 @@ jobs:
4141
push: true
4242
tags: ${{ steps.meta-code-server.outputs.tags }}
4343

44-
- name: meta for keycloak seeding image
45-
id: meta-keycloak-seeding
44+
- name: meta for initializers image
45+
id: meta-initializers
4646
uses: docker/metadata-action@v3
4747
with:
48-
images: ndebuhr/cloud-native-workstation-keycloak-seeding
48+
images: ndebuhr/cloud-native-workstation-initializers
4949

50-
- name: build and push keycloak seeding image
50+
- name: build and push initializers image
5151
uses: docker/build-push-action@v2
5252
with:
5353
context: ./docker
54-
file: ./docker/DockerfileKeycloakSeeding
54+
file: ./docker/DockerfileInitializers
5555
push: true
56-
tags: ${{ steps.meta-keycloak-seeding.outputs.tags }}
56+
tags: ${{ steps.meta-initializers.outputs.tags }}
5757

5858
- name: meta for novnc image
5959
id: meta-novnc

‎README.md‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -178,10 +178,10 @@ REPO=us.gcr.io/my-project/my-repo # for example
178178
# Build and push images
179179
cd docker
180180
docker build --file DockerfileCodeServer --tag $REPO/cloud-native-workstation-code-server:latest .
181-
docker build --file DockerfileKeycloakSeeding --tag $REPO/cloud-native-workstation-keycloak-seeding:latest .
181+
docker build --file DockerfileInitializers --tag $REPO/cloud-native-workstation-initializers:latest .
182182
docker build --file DockerfileNovnc --tag $REPO/cloud-native-workstation-novnc:latest .
183183
docker push $REPO/cloud-native-workstation-code-server:latest
184-
docker push $REPO/cloud-native-workstation-keycloak-seeding:latest
184+
docker push $REPO/cloud-native-workstation-initializers:latest
185185
docker push $REPO/cloud-native-workstation-novnc:latest
186186
cd ..
187187
```

docker/DockerfileKeycloakSeeding renamed to docker/DockerfileInitializers

File renamed without changes.

‎helm/templates/grafana-seeding.yaml‎

Lines changed: 124 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,124 @@
1+
---
2+
apiVersion: batch/v1
3+
kind: Job
4+
metadata:
5+
name: grafana-init
6+
namespace: {{ .Values.namespace }}
7+
labels:
8+
app: grafana-init
9+
spec:
10+
template:
11+
metadata:
12+
labels:
13+
app: grafana-init
14+
spec:
15+
{{ toYaml .Values.podDefaults | nindent 6 }}
16+
containers:
17+
- name: seed
18+
image: {{ .Values.docker.registry }}/cloud-native-workstation-initializers:{{ .Values.docker.tag }}
19+
imagePullPolicy: Always
20+
command: ["/bin/bash", "-c"]
21+
args:
22+
- |
23+
/opt/seed.sh || exit $?
24+
env:
25+
- name: USERNAME
26+
value: {{ .Values.authentication.username }}
27+
- name: PASSWORD
28+
value: {{ .Values.authentication.password }}
29+
securityContext:
30+
readOnlyRootFilesystem: true
31+
runAsNonRoot: true
32+
resources: {{- toYaml .Values.components.initializers.resources | nindent 10 }}
33+
volumeMounts:
34+
- name: grafana-seed-sh
35+
mountPath: /opt/seed.sh
36+
subPath: seed.sh
37+
volumes:
38+
- name: grafana-seed-sh
39+
configMap:
40+
name: grafana-seed-sh
41+
defaultMode: 0555
42+
restartPolicy: Never
43+
backoffLimit: 32
44+
---
45+
apiVersion: v1
46+
kind: ConfigMap
47+
metadata:
48+
name: grafana-seed-sh
49+
namespace: {{ .Values.namespace }}
50+
data:
51+
seed.sh: |
52+
#!/bin/bash
53+
# https://community.grafana.com/t/is-there-an-equivalent-http-api-to-import-a-dashboard-from-grafana-com/9581/2
54+
grafana_host="http://grafana:3030"
55+
grafana_cred="$USERNAME:$PASSWORD"
56+
grafana_datasource="Prometheus"
57+
58+
paths=(dashboards/prometheus_stats.json dashboards/prometheus_2_stats.json dashboards/grafana_stats.json )
59+
for path in "${paths[@]}"; do
60+
echo "Processing $path: "
61+
curl -s -k -u "$grafana_cred" -XPOST -H "Accept: application/json" \
62+
-H "Content-Type: application/json" \
63+
-d "{
64+
\"overwrite\":true, \
65+
\"pluginId\":\"prometheus\", \
66+
\"path\":\"$path\",
67+
\"inputs\":[{ \
68+
\"name\":\"*\", \
69+
\"type\":\"datasource\", \
70+
\"pluginId\":\"prometheus\", \
71+
\"value\":\"$grafana_datasource\" \
72+
}] \
73+
}" \
74+
$grafana_host/api/dashboards/import || exit $?
75+
echo ""
76+
done
77+
78+
ds=(13332 )
79+
for d in "${ds[@]}"; do
80+
echo "Processing $d: "
81+
j=$(curl -s -k -u "$grafana_cred" $grafana_host/api/gnet/dashboards/$d | jq .json)
82+
curl -s -k -u "$grafana_cred" -XPOST -H "Accept: application/json" \
83+
-H "Content-Type: application/json" \
84+
-d "{ \
85+
\"dashboard\":$j, \
86+
\"overwrite\":true, \
87+
\"inputs\":[ \
88+
{ \
89+
\"name\":\"DS_PROMETHEUS\", \
90+
\"type\":\"datasource\", \
91+
\"pluginId\":\"prometheus\", \
92+
\"value\":\"$grafana_datasource\" \
93+
}, \
94+
{ \
95+
\"name\":\"VAR_DATASOURCE\", \
96+
\"type\":\"constant\", \
97+
\"value\":\"$grafana_datasource\" \
98+
} \
99+
] \
100+
}" \
101+
$grafana_host/api/dashboards/import; echo ""
102+
done
103+
{{- if eq .Values.policies.enabled true }}
104+
---
105+
apiVersion: networking.k8s.io/v1
106+
kind: NetworkPolicy
107+
metadata:
108+
name: grafana-init
109+
namespace: cloud-native-workstation
110+
spec:
111+
podSelector:
112+
matchLabels:
113+
app: grafana-init
114+
policyTypes:
115+
- Egress
116+
- Ingress
117+
ingress:
118+
- {}
119+
egress:
120+
- to:
121+
- podSelector:
122+
matchLabels:
123+
app: grafana
124+
{{- end }}

‎helm/templates/grafana.yaml‎

Lines changed: 134 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,134 @@
1+
---
2+
apiVersion: apps/v1
3+
kind: Deployment
4+
metadata:
5+
labels:
6+
app: grafana
7+
name: grafana
8+
spec:
9+
replicas: 1
10+
selector:
11+
matchLabels:
12+
app: grafana
13+
template:
14+
metadata:
15+
labels:
16+
app: grafana
17+
spec:
18+
{{ toYaml .Values.podDefaults | nindent 6 }}
19+
initContainers:
20+
- name: take-data-dir-ownership
21+
image: alpine:3.6
22+
# Give `grafana` user (id 472) permissions a mounted volume
23+
# https://github.com/grafana/grafana-docker/blob/master/Dockerfile
24+
command:
25+
- chown
26+
- -R
27+
- 472:472
28+
- /var/lib/grafana
29+
resources: {{- toYaml .Values.components.grafana.resources | nindent 10 }}
30+
volumeMounts:
31+
- name: grafana-storage
32+
mountPath: /var/lib/grafana
33+
containers:
34+
- name: grafana
35+
image: grafana/grafana:8.1.1
36+
ports:
37+
- containerPort: 3000
38+
env:
39+
- name: GF_SERVER_HTTP_PORT
40+
value: "3000"
41+
- name: GF_SECURITY_ADMIN_USER
42+
value: {{ .Values.authentication.username }}
43+
- name: GF_SECURITY_ADMIN_PASSWORD
44+
value: {{ .Values.authentication.password }}
45+
- name: GF_INSTALL_PLUGINS
46+
value: "grafana-kubernetes-app"
47+
resources: {{- toYaml .Values.components.grafana.resources | nindent 10 }}
48+
volumeMounts:
49+
- name: grafana-storage
50+
mountPath: /var/lib/grafana
51+
- name: prometheus-data-source
52+
mountPath: /etc/grafana/provisioning/datasources/prometheus.yml
53+
subPath: prometheus.yml
54+
volumes:
55+
- name: grafana-storage
56+
persistentVolumeClaim:
57+
claimName: grafana-storage-pvc
58+
- name: prometheus-data-source
59+
configMap:
60+
name: prometheus-data-source-v1
61+
defaultMode: 0444
62+
status: {}
63+
---
64+
apiVersion: v1
65+
kind: PersistentVolumeClaim
66+
metadata:
67+
name: grafana-storage-pvc
68+
labels:
69+
app: grafana
70+
spec:
71+
accessModes:
72+
- ReadWriteOnce
73+
resources:
74+
requests:
75+
storage: 16Gi
76+
---
77+
apiVersion: v1
78+
kind: ConfigMap
79+
metadata:
80+
name: prometheus-data-source-v1
81+
data:
82+
prometheus.yml: |
83+
apiVersion: 1
84+
datasources:
85+
- name: Prometheus
86+
type: prometheus
87+
access: proxy
88+
url: http://prometheus:9090
89+
---
90+
apiVersion: v1
91+
kind: Service
92+
metadata:
93+
name: grafana
94+
spec:
95+
type: ClusterIP
96+
ports:
97+
- port: 3030
98+
targetPort: 3000
99+
selector:
100+
app: grafana
101+
{{- if eq .Values.policies.enabled true }}
102+
---
103+
apiVersion: networking.k8s.io/v1
104+
kind: NetworkPolicy
105+
metadata:
106+
name: grafana
107+
namespace: cloud-native-workstation
108+
spec:
109+
podSelector:
110+
matchLabels:
111+
app: grafana
112+
policyTypes:
113+
- Egress
114+
- Ingress
115+
ingress:
116+
- from:
117+
- podSelector:
118+
matchLabels:
119+
app: keycloak-gatekeeper
120+
- podSelector:
121+
matchLabels:
122+
app: grafana-init
123+
- podSelector:
124+
matchLabels:
125+
app: prometheus
126+
egress:
127+
- to:
128+
- podSelector:
129+
matchLabels:
130+
app: prometheus
131+
- ipBlock:
132+
# grafana.com
133+
cidr: 34.120.177.193/0
134+
{{- end }}

‎helm/templates/keycloak-seeding.yaml‎

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,7 @@ spec:
1515
{{ toYaml .Values.podDefaults | nindent 6 }}
1616
initContainers:
1717
- name: master-keycloak-init
18-
image: {{ .Values.docker.registry }}/cloud-native-workstation-keycloak-seeding:{{ .Values.docker.tag }}
18+
image: {{ .Values.docker.registry }}/cloud-native-workstation-initializers:{{ .Values.docker.tag }}
1919
imagePullPolicy: Always
2020
command: ["/bin/bash", "-c"]
2121
args:
@@ -29,7 +29,7 @@ spec:
2929
securityContext:
3030
readOnlyRootFilesystem: true
3131
runAsNonRoot: true
32-
resources: {{- toYaml .Values.components.keycloak.init.resources | nindent 10 }}
32+
resources: {{- toYaml .Values.components.initializers.resources | nindent 10 }}
3333
volumeMounts:
3434
- name: master-sh
3535
mountPath: /opt/master.sh
@@ -38,7 +38,7 @@ spec:
3838
mountPath: /etc/master.json
3939
subPath: master.json
4040
- name: client-scopes-keycloak-init
41-
image: {{ .Values.docker.registry }}/cloud-native-workstation-keycloak-seeding:{{ .Values.docker.tag }}
41+
image: {{ .Values.docker.registry }}/cloud-native-workstation-initializers:{{ .Values.docker.tag }}
4242
imagePullPolicy: Always
4343
command: ["/bin/bash", "-c"]
4444
args:
@@ -52,7 +52,7 @@ spec:
5252
securityContext:
5353
readOnlyRootFilesystem: true
5454
runAsNonRoot: true
55-
resources: {{- toYaml .Values.components.keycloak.init.resources | nindent 10 }}
55+
resources: {{- toYaml .Values.components.initializers.resources | nindent 10 }}
5656
volumeMounts:
5757
- name: client-scopes-sh
5858
mountPath: /opt/client-scopes.sh
@@ -63,7 +63,7 @@ spec:
6363
{{- $root := . }}
6464
{{- range .Values.access }}
6565
- name: {{ .name }}-keycloak-init
66-
image: {{ $root.Values.docker.registry }}/cloud-native-workstation-keycloak-seeding:{{ $root.Values.docker.tag }}
66+
image: {{ $root.Values.docker.registry }}/cloud-native-workstation-initializers:{{ $root.Values.docker.tag }}
6767
imagePullPolicy: Always
6868
command: ["/bin/bash", "-c"]
6969
args:
@@ -76,7 +76,7 @@ spec:
7676
value: {{ $root.Values.authentication.username }}
7777
- name: PASSWORD
7878
value: {{ $root.Values.authentication.password }}
79-
resources: {{- toYaml $root.Values.components.keycloak.init.resources | nindent 10 }}
79+
resources: {{- toYaml $root.Values.components.initializers.resources | nindent 10 }}
8080
securityContext:
8181
readOnlyRootFilesystem: true
8282
runAsNonRoot: true
@@ -99,12 +99,12 @@ spec:
9999
{{- end }}
100100
containers:
101101
- name: verify
102-
image: {{ $root.Values.docker.registry }}/cloud-native-workstation-keycloak-seeding:{{ $root.Values.docker.tag }}
102+
image: {{ $root.Values.docker.registry }}/cloud-native-workstation-initializers:{{ $root.Values.docker.tag }}
103103
command: ["/bin/bash", "-c"]
104104
args:
105105
- |
106106
curl http://keycloak:8080
107-
resources: {{- toYaml .Values.components.keycloak.init.resources | nindent 10 }}
107+
resources: {{- toYaml .Values.components.initializers.resources | nindent 10 }}
108108
volumes:
109109
- name: master-sh
110110
configMap:

0 commit comments

Comments
 (0)