[GEP-19] Adapt monitoring configuration

charts/gardener-extension-shoot-cert-service/templates/rbac.yaml

@@ -119,6 +119,15 @@ rules:
   - patch
   - update
   - delete
+# TODO(rfranzke): Remove this after August 2024.
+- apiGroups:
+  - apps
+  resources:
+  - statefulsets
+  verbs:
+  - get
+  - list
+  - watch
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding

charts/internal/shoot-cert-management-seed/templates/0helpers.tpl

@@ -1,3 +1,6 @@
+{{/* HINT: This file is intentionally NOT called _helpers.tpl (as usual) since this Helm chart is embedded via go embed. */}}
+{{/* HINT: go embed does not support hidden files, hence, _helpers.tpl cannot be used as name. */}}
+
 {{/* vim: set filetype=mustache: */}}
 {{/*
 Expand the name of the chart.

charts/internal/shoot-cert-management-seed/templates/configmap-dashboards.yaml

@@ -0,0 +1,12 @@
+{{- if .Values.gep19Monitoring }}
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: cert-controller-manager-dashboards
+  namespace: {{ .Release.Namespace }}
+  labels:
+    dashboard.monitoring.gardener.cloud/shoot: "true"
+data:
+  cert-controller-manager-dashboard.json: |-
+{{- .Files.Get "cert-dashboard.json" | nindent 4 }}
+{{- end }}

charts/internal/shoot-cert-management-seed/templates/configmap-observability.yaml

@@ -1,3 +1,4 @@
+{{- if not .Values.gep19Monitoring }}
 apiVersion: v1
 kind: ConfigMap
 metadata:
@@ -56,3 +57,4 @@ data:
   dashboard_users: |
     cert-controller-manager-dashboard.json: |-
 {{- .Files.Get "cert-dashboard.json" | nindent 6 }}
+{{- end }}

charts/internal/shoot-cert-management-seed/templates/prometheusrule.yaml

@@ -0,0 +1,26 @@
+{{- if .Values.gep19Monitoring }}
+{{- if gt .Values.configuration.certExpirationAlertDays 0.0 }}
+apiVersion: monitoring.coreos.com/v1
+kind: PrometheusRule
+metadata:
+  name: shoot-cert-controller-manager
+  namespace: {{ .Release.Namespace }}
+  labels:
+    prometheus: shoot
+spec:
+  groups:
+  - name: cert-controller-manager.rules
+    rules:
+    - alert: SslCertificateWillExpireSoon
+      expr: ((cert_management_cert_object_expire > 0) - time()) / 86400 <= {{ .Values.configuration.certExpirationAlertDays }}
+      for: 30m
+      labels:
+        service: cert-controller-manager
+        severity: critical
+        type: seed
+        visibility: operator
+      annotations:
+        description: Certificate in namespace {{ .Release.Namespace }} will expire in less than {{ .Values.configuration.certExpirationAlertDays }} days.
+        summary: TLS certificate will expire in less than {{ .Values.configuration.certExpirationAlertDays }} days
+{{- end }}
+{{- end }}

charts/internal/shoot-cert-management-seed/templates/servicemonitor.yaml

@@ -0,0 +1,25 @@
+{{- if .Values.gep19Monitoring }}
+apiVersion: monitoring.coreos.com/v1
+kind: ServiceMonitor
+metadata:
+  name: shoot-cert-controller-manager
+  namespace: {{ .Release.Namespace }}
+  labels:
+    prometheus: shoot
+spec:
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: {{ include "cert-management.name" . }}
+      app.kubernetes.io/instance: {{ .Release.Name }}
+  endpoints:
+  - port: metrics
+    relabelings:
+    - action: labelmap
+      regex: __meta_kubernetes_service_label_(.+)
+    metricRelabelings:
+    - sourceLabels:
+      - __name__
+      action: keep
+      regex: ^(cert_management_.+)$
+  honorLabels: false
+{{- end }}

charts/internal/shoot-cert-management-seed/values.yaml

@@ -86,3 +86,6 @@ additionalConfiguration:
 - --kubeconfig.disable-deploy-crds
 - --source.disable-deploy-crds
 - --target.disable-deploy-crds
+
+# TODO(rfranzke): Remove this field after August 2024.
+gep19Monitoring: false

pkg/controller/actuator.go

@@ -24,6 +24,7 @@ import (
 	kutil "github.com/gardener/gardener/pkg/utils/kubernetes"
 	"github.com/gardener/gardener/pkg/utils/managedresources"
 	"github.com/go-logr/logr"
+	appsv1 "k8s.io/api/apps/v1"
 	autoscalingv1 "k8s.io/api/autoscaling/v1"
 	corev1 "k8s.io/api/core/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
@@ -316,6 +317,15 @@ func (a *actuator) createSeedResources(ctx context.Context, certConfig *service.
 		cfg["privateKeyDefaults"] = defaults
 	}
 
+	// TODO(rfranzke): Delete this after August 2024.
+	gep19Monitoring := a.client.Get(ctx, client.ObjectKey{Name: "prometheus-shoot", Namespace: namespace}, &appsv1.StatefulSet{}) == nil
+	if gep19Monitoring {
+		if err := kutil.DeleteObject(ctx, a.client, &corev1.ConfigMap{ObjectMeta: metav1.ObjectMeta{Name: "cert-controller-manager-observability-config", Namespace: namespace}}); err != nil {
+			return fmt.Errorf("failed deleting cert-controller-manager-observability-config ConfigMap: %w", err)
+		}
+	}
+	certManagementConfig["gep19Monitoring"] = gep19Monitoring
+
 	certManagementConfig, err = chart.InjectImages(certManagementConfig, imagevector.ImageVector(), []string{v1alpha1.CertManagementImageName})
 	if err != nil {
 		return fmt.Errorf("failed to find image version for %s: %v", v1alpha1.CertManagementImageName, err)