Pull request CrunchyData#1: Mask secrets and commit current changes.

Daren Lord · Daren Lord · commit 586e3dbdbf96 · 2023-02-08T15:42:38.000-07:00
Merge in DPO-PGO/postgres-operator from ~DLORD/postgres-operator:master to dev

* commit 'ffa7d1a4f2d68e2afddb27343bbb6c75ea4e48a6':
  Mask secrets and commit current changes.
diff --git a/kustomize/monitoring/alertmanager-config.yaml b/kustomize/monitoring/alertmanager-config.yaml
@@ -3,7 +3,7 @@ data:
   alertmanager.yml: |
     ###
     #
-    # Copyright © 2017-2023 Crunchy Data Solutions, Inc. All Rights Reserved.
+    # Copyright 2017-2022 Crunchy Data Solutions, Inc. All Rights Reserved.
     #
     ###
 
@@ -31,7 +31,11 @@ data:
     receivers:
     - name: 'default-receiver'
       email_configs:
-      - to: 'example@crunchydata.com'
+      - to: 'example@yourcompany.com'
+        send_resolved: true
+    - name: "alerta-receiver"
+      webhook_configs:
+      - url: 'https://alerta.overstock.com/api/webhooks/prometheus?api-key=<path:kv/data/dpo/operations/argocd/apps/pgo/monitoring#alertaKey>'
         send_resolved: true
 
     ## Examples of alternative alert receivers. See documentation for more info on how to configure these fully
@@ -54,7 +58,7 @@ data:
     #    send_resolved: true
 
     route:
-        receiver: default-receiver
+        receiver: alerta-receiver
         group_by: [severity, service, job, alertname]
         group_wait: 30s
         group_interval: 5m
diff --git a/kustomize/monitoring/alertmanager-rules-config.yaml b/kustomize/monitoring/alertmanager-rules-config.yaml
diff --git a/kustomize/monitoring/crunchy_grafana_dashboards.yml b/kustomize/monitoring/crunchy_grafana_dashboards.yml
@@ -1,6 +1,6 @@
 ###
 #
-# Copyright © 2017-2023 Crunchy Data Solutions, Inc. All Rights Reserved.
+# Copyright 2017-2022 Crunchy Data Solutions, Inc. All Rights Reserved.
 #
 ###
 apiVersion: 1
@@ -13,4 +13,4 @@ providers:
   disableDeletion: false
   updateIntervalSeconds: 3 #how often Grafana will scan for changed dashboards
   options:
-    path: /etc/grafana/provisioning/dashboards
+    path: $GF_PATHS_PROVISIONING/dashboards
diff --git a/kustomize/monitoring/dashboards/pgbackrest.json b/kustomize/monitoring/dashboards/pgbackrest.json
@@ -52,7 +52,7 @@
   "gnetId": null,
   "graphTooltip": 0,
   "id": null,
-  "iteration": 1625069660860,
+  "iteration": 1624546649377,
   "links": [
     {
       "asDropdown": false,
@@ -664,7 +664,7 @@
     ]
   },
   "time": {
-    "from": "now-2w",
+    "from": "now-30m",
     "to": "now"
   },
   "timepicker": {
diff --git a/kustomize/monitoring/dashboards/pod_details.json b/kustomize/monitoring/dashboards/pod_details.json
@@ -42,11 +42,11 @@
       }
     ]
   },
-  "editable": false,
+  "editable": true,
   "gnetId": null,
   "graphTooltip": 0,
   "id": null,
-  "iteration": 1625069717503,
+  "iteration": 1624647381559,
   "links": [
     {
       "icon": "external link",
diff --git a/kustomize/monitoring/dashboards/postgres_overview.json b/kustomize/monitoring/dashboards/postgres_overview.json
@@ -46,7 +46,7 @@
   "gnetId": null,
   "graphTooltip": 0,
   "id": null,
-  "iteration": 1625069480601,
+  "iteration": 1624491413218,
   "links": [],
   "panels": [
     {
diff --git a/kustomize/monitoring/dashboards/postgresql_details.json b/kustomize/monitoring/dashboards/postgresql_details.json
@@ -54,11 +54,11 @@
       }
     ]
   },
-  "editable": false,
+  "editable": true,
   "gnetId": null,
   "graphTooltip": 0,
   "id": null,
-  "iteration": 1625069813048,
+  "iteration": 1624495934950,
   "links": [
     {
       "asDropdown": false,
@@ -2143,6 +2143,6 @@
   },
   "timezone": "browser",
   "title": "PostgreSQLDetails",
-  "uid": "fMip0cuMk",
+  "uid": "pc4NNgknk",
   "version": 1
 }
diff --git a/kustomize/monitoring/dashboards/postgresql_service_health.json b/kustomize/monitoring/dashboards/postgresql_service_health.json
@@ -42,11 +42,11 @@
       }
     ]
   },
-  "editable": false,
+  "editable": true,
   "gnetId": null,
   "graphTooltip": 0,
   "id": null,
-  "iteration": 1625069909806,
+  "iteration": 1624491530019,
   "links": [
     {
       "asDropdown": false,
@@ -626,7 +626,7 @@
     ]
   },
   "time": {
-    "from": "now-1h",
+    "from": "now-30m",
     "to": "now"
   },
   "timepicker": {
diff --git a/kustomize/monitoring/dashboards/prometheus_alerts.json b/kustomize/monitoring/dashboards/prometheus_alerts.json
@@ -938,7 +938,7 @@
     "list": []
   },
   "time": {
-    "from": "now-1h",
+    "from": "now-30m",
     "to": "now"
   },
   "timepicker": {
diff --git a/kustomize/monitoring/dashboards/query_statistics.json b/kustomize/monitoring/dashboards/query_statistics.json
@@ -59,7 +59,7 @@
   "gnetId": null,
   "graphTooltip": 0,
   "id": null,
-  "iteration": 1625070004605,
+  "iteration": 1624501789811,
   "links": [
     {
       "icon": "external link",
diff --git a/kustomize/monitoring/deploy-grafana.yaml b/kustomize/monitoring/deploy-grafana.yaml
@@ -27,6 +27,8 @@ spec:
     spec:
       containers:
       - env:
+        - name: GF_AUTH_LDAP__ENABLE
+          value: "true"
         - name: GF_PATHS_DATA
           value: /data/grafana/data
         - name: GF_SECURITY_ADMIN_USER__FILE
@@ -73,6 +75,8 @@ spec:
           name: grafana-datasources
         - mountPath: /etc/grafana/provisioning/dashboards
           name: grafana-dashboards
+        - mountPath: /etc/grafana
+          name: grafana-config
       dnsPolicy: ClusterFirst
       restartPolicy: Always
       securityContext:
@@ -99,4 +103,7 @@ spec:
           defaultMode: 420
           name: grafana-dashboards
         name: grafana-dashboards
+      - name: grafana-config
+        secret:
+          secretName: grafana-config
 
diff --git a/kustomize/monitoring/grafana-config.yaml b/kustomize/monitoring/grafana-config.yaml
@@ -0,0 +1,39 @@
+apiVersion: v1
+kind: Secret
+metadata:
+  labels:
+    app.kubernetes.io/component: crunchy-grafana
+    app.kubernetes.io/name: crunchy-grafana
+    app.kubernetes.io/part-of: postgres-operator-monitoring
+    app.kubernetes.io/version: 8.5.10
+    vendor: crunchydata
+  name: grafana-config
+stringData:
+  grafana.ini: |
+    [auth.ldap]
+    allow_sign_up = true
+    config_file = /etc/grafana/ldap.toml
+    enabled = true
+  ldap.toml: |
+    [[servers]]
+    host = "<path:kv/data/dpo/operations/argocd/config#ldapHost>"
+    port = 389
+    use_ssl = false
+    start_tls = false
+    ssl_skip_verify = false
+    bind_dn = "CN=svc_dbsa_ldap,OU=Special,OU=OSTK_Accounts,DC=overstock,DC=com"
+    bind_password = '<path:kv/data/dpo/operations/argocd/ldap#password>'
+    search_filter = "(sAMAccountName=%s)"
+    search_base_dns = ["ou=OSTK_Accounts,DC=overstock,DC=com"]
+    [servers.attributes]
+    name = "givenName"
+    surname = "sn"
+    member_of = "memberOf"
+    email = "mail"
+    username = "sAMAccountName"
+    [[servers.group_mappings]]
+    group_dn = "CN=g.acl.dpo,OU=Groups,OU=OSTK_Accounts,DC=overstock,DC=com"
+    org_role = "Admin"
+    grafana_admin = true
+    org_id = 1
+type: Opaque
diff --git a/kustomize/monitoring/grafana-datasources.yaml b/kustomize/monitoring/grafana-datasources.yaml
@@ -3,7 +3,7 @@ data:
   crunchy_grafana_datasource.yml: |
     ###
     #
-    # Copyright 2017-2023 Crunchy Data Solutions, Inc. All Rights Reserved.
+    # Copyright 2017-2022 Crunchy Data Solutions, Inc. All Rights Reserved.
     #
     ###
 
diff --git a/kustomize/monitoring/grafana-secret.yaml b/kustomize/monitoring/grafana-secret.yaml
@@ -1,7 +1,7 @@
 apiVersion: v1
 data:
-  password: YWRtaW4=
-  username: YWRtaW4=
+  password: <path:kv/data/dpo/operations/argocd/apps/pgo/monitoring#grafanaPassword | base64encode>
+  username: <path:kv/data/dpo/operations/argocd/apps/pgo/monitoring#grafanaUsername | base64encode>
 kind: Secret
 metadata:
   labels:
diff --git a/kustomize/monitoring/kustomization.yaml b/kustomize/monitoring/kustomization.yaml
@@ -1,6 +1,6 @@
 kind: Kustomization
 apiVersion: kustomize.config.k8s.io/v1beta1
-namespace: postgres-operator
+namespace: pgo
 resources:
   - pvcs.yaml
   - ./dashboards
@@ -9,6 +9,7 @@ resources:
   - alertmanager-config.yaml
   - alertmanager-rules-config.yaml
   - grafana-datasources.yaml
+  - grafana-config.yaml
 # secrets
   - grafana-secret.yaml
 # RBAC
diff --git a/kustomize/monitoring/prometheus-config.yaml b/kustomize/monitoring/prometheus-config.yaml
@@ -3,7 +3,7 @@ data:
   prometheus.yml: |+
     ###
     #
-    # Copyright 2017-2023 Crunchy Data Solutions, Inc. All Rights Reserved.
+    # Copyright 2017-2022 Crunchy Data Solutions, Inc. All Rights Reserved.
     #
     ###
 
@@ -19,6 +19,10 @@ data:
       - role: pod
 
       relabel_configs:
+      - source_labels: [__meta_kubernetes_namespace,__meta_kubernetes_pod_label_postgres_operator_crunchydata_com_role]
+        target_label: instance
+        replacement: '$1'
+        separator: "-"
       - source_labels: [__meta_kubernetes_pod_label_postgres_operator_crunchydata_com_crunchy_postgres_exporter,__meta_kubernetes_pod_label_crunchy_postgres_exporter]
         action: keep
         regex: true
@@ -62,6 +66,15 @@ data:
         target_label: role
         replacement: '$1'
         separator: ""
+      - source_labels: [dbname]
+        target_label: dbname
+        replacement: '$1'
+      - source_labels: [relname]
+        target_label: relname
+        replacement: '$1'
+      - source_labels: [schemaname]
+        target_label: schemaname
+        replacement: '$1'
 
     rule_files:
       - /etc/prometheus/alert-rules.d/*.yml
diff --git a/kustomize/monitoring/pvcs.yaml b/kustomize/monitoring/pvcs.yaml
@@ -6,11 +6,12 @@ metadata:
     vendor: crunchydata
   name: alertmanagerdata
 spec:
+  storageClassName: ontapnas
   accessModes:
   - ReadWriteOnce
   resources:
     requests:
-      storage: 5Gi
+      storage: 50Gi
 ---
 apiVersion: v1
 kind: PersistentVolumeClaim
@@ -20,11 +21,12 @@ metadata:
     vendor: crunchydata
   name: grafanadata
 spec:
+  storageClassName: ontapnas
   accessModes:
   - ReadWriteOnce
   resources:
     requests:
-      storage: 5Gi
+      storage: 50Gi
 ---
 apiVersion: v1
 kind: PersistentVolumeClaim
@@ -34,8 +36,9 @@ metadata:
     vendor: crunchydata
   name: prometheusdata
 spec:
+  storageClassName: ontapnas
   accessModes:
   - ReadWriteOnce
   resources:
     requests:
-      storage: 5Gi
+      storage: 50Gi
diff --git a/kustomize/monitoring/service.yaml b/kustomize/monitoring/service.yaml
@@ -7,7 +7,7 @@ metadata:
     name: crunchy-alertmanager
   name: crunchy-alertmanager
 spec:
-  type: ClusterIP
+  type: LoadBalancer
   ports:
   - name: alertmanager
     port: 9093
@@ -25,7 +25,7 @@ metadata:
     name: crunchy-grafana
   name: crunchy-grafana
 spec:
-  type: ClusterIP
+  type: LoadBalancer
   ports:
   - name: grafana
     port: 3000
@@ -43,7 +43,7 @@ metadata:
     name: crunchy-prometheus
   name: crunchy-prometheus
 spec:
-  type: ClusterIP
+  type: LoadBalancer
   ports:
   - name: prometheus
     port: 9090

Original file line number	Diff line number	Diff line change
`@@ -1,6 +1,6 @@`
`1`	`1`	`###`
`2`	`2`	`#`
`3`		`-# Copyright © 2017-2023 Crunchy Data Solutions, Inc. All Rights Reserved.`
	`3`	`+# Copyright 2017-2022 Crunchy Data Solutions, Inc. All Rights Reserved.`
`4`	`4`	`#`
`5`	`5`	`###`
`6`	`6`	`apiVersion: 1`
`@@ -13,4 +13,4 @@ providers:`
`13`	`13`	`disableDeletion: false`
`14`	`14`	`updateIntervalSeconds: 3 #how often Grafana will scan for changed dashboards`
`15`	`15`	`options:`
`16`		`- path: /etc/grafana/provisioning/dashboards`
	`16`	`+ path: $GF_PATHS_PROVISIONING/dashboards`
Original file line number	Diff line number	Diff line change
`@@ -42,11 +42,11 @@`
`42`	`42`	`}`
`43`	`43`	`]`
`44`	`44`	`},`
`45`		`- "editable": false,`
	`45`	`+ "editable": true,`
`46`	`46`	`"gnetId": null,`
`47`	`47`	`"graphTooltip": 0,`
`48`	`48`	`"id": null,`
`49`		`- "iteration": 1625069717503,`
	`49`	`+ "iteration": 1624647381559,`
`50`	`50`	`"links": [`
`51`	`51`	`{`
`52`	`52`	`"icon": "external link",`
Original file line number	Diff line number	Diff line change
`@@ -46,7 +46,7 @@`
`46`	`46`	`"gnetId": null,`
`47`	`47`	`"graphTooltip": 0,`
`48`	`48`	`"id": null,`
`49`		`- "iteration": 1625069480601,`
	`49`	`+ "iteration": 1624491413218,`
`50`	`50`	`"links": [],`
`51`	`51`	`"panels": [`
`52`	`52`	`{`
Original file line number	Diff line number	Diff line change
`@@ -54,11 +54,11 @@`
`54`	`54`	`}`
`55`	`55`	`]`
`56`	`56`	`},`
`57`		`- "editable": false,`
	`57`	`+ "editable": true,`
`58`	`58`	`"gnetId": null,`
`59`	`59`	`"graphTooltip": 0,`
`60`	`60`	`"id": null,`
`61`		`- "iteration": 1625069813048,`
	`61`	`+ "iteration": 1624495934950,`
`62`	`62`	`"links": [`
`63`	`63`	`{`
`64`	`64`	`"asDropdown": false,`
`@@ -2143,6 +2143,6 @@`
`2143`	`2143`	`},`
`2144`	`2144`	`"timezone": "browser",`
`2145`	`2145`	`"title": "PostgreSQLDetails",`
`2146`		`- "uid": "fMip0cuMk",`
	`2146`	`+ "uid": "pc4NNgknk",`
`2147`	`2147`	`"version": 1`
`2148`	`2148`	`}`
Original file line number	Diff line number	Diff line change
`@@ -59,7 +59,7 @@`
`59`	`59`	`"gnetId": null,`
`60`	`60`	`"graphTooltip": 0,`
`61`	`61`	`"id": null,`
`62`		`- "iteration": 1625070004605,`
	`62`	`+ "iteration": 1624501789811,`
`63`	`63`	`"links": [`
`64`	`64`	`{`
`65`	`65`	`"icon": "external link",`