Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Making changes to existing published openshift blog #142

Merged
merged 1 commit into from
Jun 19, 2024
Merged

Making changes to existing published openshift blog #142

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Binary file modified content/posts/2024/05/21/openshift-unleashed/assets/deployment-topology.png
View file
Open in desktop
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
37 changes: 14 additions & 23 deletions content/posts/2024/05/21/openshift-unleashed/post.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -59,13 +59,14 @@
![](assets/product-arch.png)


## **Backbase Deployment Topology**
## **Deployment Topology**

Check warning on line 62 in content/posts/2024/05/21/openshift-unleashed/post.md

View workflow job for this annotation

GitHub Actions / vale

[vale] content/posts/2024/05/21/openshift-unleashed/post.md#L62 

[Google.Headings] 'Deployment Topology' should use sentence-style capitalization.
Raw output 
{"message": "[Google.Headings] 'Deployment Topology' should use sentence-style capitalization.", "location": {"path": "content/posts/2024/05/21/openshift-unleashed/post.md", "range": {"start": {"line": 62, "column": 6}}}, "severity": "WARNING"}

Let’s consider that all the necessary infrastructure components are present for the deployment of Backbase microservices and development is in full swing with Secure SDLC practices, deployment on RedHat Openshift Container Platform would look something very similar to deploying Backbase on a cloud based platform such as AWS, Azure or GCP with certain nuances specific to RedHat Openshift Container Platform. The below diagram depicts an example for the same :
Let’s consider that all the necessary infrastructure components are present for the deployment of microservices and development is in full swing with Secure SDLC practices, deployment on RedHat Openshift Container Platform would look something very similar to deploying microservices on a cloud based platform such as AWS, Azure or GCP with certain nuances specific to RedHat Openshift Container Platform. The below diagram depicts an example for the same :

Check warning on line 64 in content/posts/2024/05/21/openshift-unleashed/post.md

View workflow job for this annotation

GitHub Actions / vale

[vale] content/posts/2024/05/21/openshift-unleashed/post.md#L64 

[Google.OxfordComma] Use the Oxford comma in 'Let’s consider that all the necessary infrastructure components are present for the deployment of microservices and development is in full swing with Secure SDLC practices, deployment on RedHat Openshift Container Platform would look something very similar to deploying microservices on a cloud based platform such as AWS, Azure or'.
Raw output 
{"message": "[Google.OxfordComma] Use the Oxford comma in 'Let’s consider that all the necessary infrastructure components are present for the deployment of microservices and development is in full swing with Secure SDLC practices, deployment on RedHat Openshift Container Platform would look something very similar to deploying microservices on a cloud based platform such as AWS, Azure or'.", "location": {"path": "content/posts/2024/05/21/openshift-unleashed/post.md", "range": {"start": {"line": 64, "column": 1}}}, "severity": "WARNING"}

Check warning on line 64 in content/posts/2024/05/21/openshift-unleashed/post.md

View workflow job for this annotation

GitHub Actions / vale

[vale] content/posts/2024/05/21/openshift-unleashed/post.md#L64 

[write-good.Weasel] 'very' is a weasel word!
Raw output 
{"message": "[write-good.Weasel] 'very' is a weasel word!", "location": {"path": "content/posts/2024/05/21/openshift-unleashed/post.md", "range": {"start": {"line": 64, "column": 246}}}, "severity": "WARNING"}

Check warning on line 64 in content/posts/2024/05/21/openshift-unleashed/post.md

View workflow job for this annotation

GitHub Actions / vale

[vale] content/posts/2024/05/21/openshift-unleashed/post.md#L64 

[write-good.TooWordy] 'similar to' is too wordy.
Raw output 
{"message": "[write-good.TooWordy] 'similar to' is too wordy.", "location": {"path": "content/posts/2024/05/21/openshift-unleashed/post.md", "range": {"start": {"line": 64, "column": 251}}}, "severity": "WARNING"}


![](assets/deployment-topology.png)

In any traditional Kubernetes deployment, the Backbase product capabilities would be deployed to a namespace whereas in Openshift, they are called as Openshift projects.
In any traditional Kubernetes deployment, the microservices would be deployed to a namespace whereas in Openshift, they are called as Openshift projects.

Check warning on line 69 in content/posts/2024/05/21/openshift-unleashed/post.md

View workflow job for this annotation

GitHub Actions / vale

[vale] content/posts/2024/05/21/openshift-unleashed/post.md#L69 

[write-good.Passive] 'be deployed' may be passive voice. Use active voice if you can.
Raw output 
{"message": "[write-good.Passive] 'be deployed' may be passive voice. Use active voice if you can.", "location": {"path": "content/posts/2024/05/21/openshift-unleashed/post.md", "range": {"start": {"line": 69, "column": 67}}}, "severity": "WARNING"}

Check warning on line 69 in content/posts/2024/05/21/openshift-unleashed/post.md

View workflow job for this annotation

GitHub Actions / vale

[vale] content/posts/2024/05/21/openshift-unleashed/post.md#L69 

[write-good.Passive] 'are called' may be passive voice. Use active voice if you can.
Raw output 
{"message": "[write-good.Passive] 'are called' may be passive voice. Use active voice if you can.", "location": {"path": "content/posts/2024/05/21/openshift-unleashed/post.md", "range": {"start": {"line": 69, "column": 121}}}, "severity": "WARNING"}

In the above diagram, GitHub and JFrog Artifactory are two tools that are used for source code management and artifact/binary management which are two specific examples of tools used. For more details on the same :

Expand All @@ -84,28 +85,21 @@

## **Nuances - RedHat Openshift Container Platform**

This section describes the nuances and differences of working with the RedHat Openshift Container Platform and the deployment aspects of Backbase product capabilities.
This section describes the nuances and differences of working with the RedHat Openshift Container Platform and the deployment aspects of microservices.

### **Tightened Security**

By default, the Openshift container platform comes with security context constraints that’s described here : [Managing security context constraints | Authentication and authorization | OpenShift Container Platform 4.15 ](https://docs.openshift.com/container-platform/4.15/authentication/managing-security-context-constraints.html)

The Backbase product capability images are all secure, distroless, non-root images and therefore without any modification can be installed on the Openshift container platform. The web-base docker image used to run web applications is not compatible with the tightened security of the RedHat Openshift Container Platform under the restricted SCC : Managing SCCs in OpenShift because of the way UID’s are allocated during the creation of an Openshift project and the way a UID is allocated from that range when a pod is created which is described in this page :

The Backbase product capabilities are all secure, [distroless](https://github.com/GoogleContainerTools/distroless), non-root images and therefore without any modification can be installed on the Openshift container platform. The [web-base](https://repo.backbase.com/ui/native/backbase-docker-releases/web-base/) docker image used to run web applications is not compatible with the tightened security of the RedHat Openshift Container Platform under the restricted SCC : [Managing SCCs in OpenShift ](https://www.redhat.com/en/blog/managing-sccs-in-openshift) because of the way UID’s are allocated during the creation of an Openshift project and the way a UID is allocated from that range when a pod is created which is described in this page : [A Guide to OpenShift and UIDs ](https://www.redhat.com/en/blog/a-guide-to-openshift-and-uids)

To overcome the problem mentioned in the above section we can modify the FE angular app’s Dockerfile which is based on the web-base docker image to modify root group permissions to those directories that contain the nginx installation process and the HTML statics folder because the arbitrary user assigned by Openshift will be part of the root group.
The tightened security of the RedHat Openshift Container Platform under the restricted SCC : [Managing SCCs in OpenShift](https://www.redhat.com/en/blog/managing-sccs-in-openshift) because of the way UID’s are allocated during the creation of an Openshift project and the way a UID is allocated from that range when a pod is created which is described in this page : [A Guide to OpenShift and UIDs](https://www.redhat.com/en/blog/a-guide-to-openshift-and-uids)

Check warning on line 94 in content/posts/2024/05/21/openshift-unleashed/post.md

View workflow job for this annotation

GitHub Actions / vale

[vale] content/posts/2024/05/21/openshift-unleashed/post.md#L94 

[write-good.Passive] 'are allocated' may be passive voice. Use active voice if you can.
Raw output 
{"message": "[write-good.Passive] 'are allocated' may be passive voice. Use active voice if you can.", "location": {"path": "content/posts/2024/05/21/openshift-unleashed/post.md", "range": {"start": {"line": 94, "column": 207}}}, "severity": "WARNING"}

Check warning on line 94 in content/posts/2024/05/21/openshift-unleashed/post.md

View workflow job for this annotation

GitHub Actions / vale

[vale] content/posts/2024/05/21/openshift-unleashed/post.md#L94 

[write-good.Passive] 'is allocated' may be passive voice. Use active voice if you can.
Raw output 
{"message": "[write-good.Passive] 'is allocated' may be passive voice. Use active voice if you can.", "location": {"path": "content/posts/2024/05/21/openshift-unleashed/post.md", "range": {"start": {"line": 94, "column": 283}}}, "severity": "WARNING"}

Check warning on line 94 in content/posts/2024/05/21/openshift-unleashed/post.md

View workflow job for this annotation

GitHub Actions / vale

[vale] content/posts/2024/05/21/openshift-unleashed/post.md#L94 

[write-good.Passive] 'is created' may be passive voice. Use active voice if you can.
Raw output 
{"message": "[write-good.Passive] 'is created' may be passive voice. Use active voice if you can.", "location": {"path": "content/posts/2024/05/21/openshift-unleashed/post.md", "range": {"start": {"line": 94, "column": 323}}}, "severity": "WARNING"}

Check warning on line 94 in content/posts/2024/05/21/openshift-unleashed/post.md

View workflow job for this annotation

GitHub Actions / vale

[vale] content/posts/2024/05/21/openshift-unleashed/post.md#L94 

[write-good.Passive] 'is described' may be passive voice. Use active voice if you can.
Raw output 
{"message": "[write-good.Passive] 'is described' may be passive voice. Use active voice if you can.", "location": {"path": "content/posts/2024/05/21/openshift-unleashed/post.md", "range": {"start": {"line": 94, "column": 340}}}, "severity": "WARNING"}

### **Kubernetes Ingress vs Openshift Route**

This page even though written 6 years back is still a great article to learn about the differences between a Kubernetes Ingress and an Openshift Route : [Kubernetes Ingress vs OpenShift Route](https://www.redhat.com/en/blog/kubernetes-ingress-vs-openshift-route)

In most projects that run Openshift on a client’s infrastructure the recommended object to use for routing is an Openshift route as it has more features than that of a Kubernetes Ingress which is described in the above page.

_**Note:**_ For a Backbase web application with respect to Openshift, two Routes have to be created with the same hostname but different paths pointing to different backend services. For Example : A ‘/' path that points to the web application service and a '/api’ path that points to the edge service.
In most projects that run Openshift the recommended object to use for routing is an Openshift route as it has more features than that of a Kubernetes Ingress which is described in the above page.

Check warning on line 100 in content/posts/2024/05/21/openshift-unleashed/post.md

View workflow job for this annotation

GitHub Actions / vale

[vale] content/posts/2024/05/21/openshift-unleashed/post.md#L100 

[write-good.Passive] 'is described' may be passive voice. Use active voice if you can.
Raw output 
{"message": "[write-good.Passive] 'is described' may be passive voice. Use active voice if you can.", "location": {"path": "content/posts/2024/05/21/openshift-unleashed/post.md", "range": {"start": {"line": 100, "column": 165}}}, "severity": "WARNING"}

Check warning on line 100 in content/posts/2024/05/21/openshift-unleashed/post.md

View workflow job for this annotation

GitHub Actions / vale

[vale] content/posts/2024/05/21/openshift-unleashed/post.md#L100 

[Google.WordList] Use 'preceding' instead of 'above'.
Raw output 
{"message": "[Google.WordList] Use 'preceding' instead of 'above'.", "location": {"path": "content/posts/2024/05/21/openshift-unleashed/post.md", "range": {"start": {"line": 100, "column": 185}}}, "severity": "WARNING"}


Multiple ways exist to create a route through configuration where one such example is described below where a route template manifest is added to the templates/ folder of a helm chart with a condition to enable or disable the creation of the same.
Multiple ways to create a route through configuration where one such example is described below where a route template manifest is added to the templates/ folder of a helm chart with a condition to enable or disable the creation of the same.

Check warning on line 102 in content/posts/2024/05/21/openshift-unleashed/post.md

View workflow job for this annotation

GitHub Actions / vale

[vale] content/posts/2024/05/21/openshift-unleashed/post.md#L102 

[write-good.TooWordy] 'Multiple' is too wordy.
Raw output 
{"message": "[write-good.TooWordy] 'Multiple' is too wordy.", "location": {"path": "content/posts/2024/05/21/openshift-unleashed/post.md", "range": {"start": {"line": 102, "column": 1}}}, "severity": "WARNING"}

Check warning on line 102 in content/posts/2024/05/21/openshift-unleashed/post.md

View workflow job for this annotation

GitHub Actions / vale

[vale] content/posts/2024/05/21/openshift-unleashed/post.md#L102 

[write-good.Passive] 'is described' may be passive voice. Use active voice if you can.
Raw output 
{"message": "[write-good.Passive] 'is described' may be passive voice. Use active voice if you can.", "location": {"path": "content/posts/2024/05/21/openshift-unleashed/post.md", "range": {"start": {"line": 102, "column": 78}}}, "severity": "WARNING"}

Check warning on line 102 in content/posts/2024/05/21/openshift-unleashed/post.md

View workflow job for this annotation

GitHub Actions / vale

[vale] content/posts/2024/05/21/openshift-unleashed/post.md#L102 

[write-good.Passive] 'is added' may be passive voice. Use active voice if you can.
Raw output 
{"message": "[write-good.Passive] 'is added' may be passive voice. Use active voice if you can.", "location": {"path": "content/posts/2024/05/21/openshift-unleashed/post.md", "range": {"start": {"line": 102, "column": 129}}}, "severity": "WARNING"}

Check warning on line 102 in content/posts/2024/05/21/openshift-unleashed/post.md

View workflow job for this annotation

GitHub Actions / vale

[vale] content/posts/2024/05/21/openshift-unleashed/post.md#L102 

[Google.WordList] Use 'turn off' or 'off' instead of 'disable'.
Raw output 
{"message": "[Google.WordList] Use 'turn off' or 'off' instead of 'disable'.", "location": {"path": "content/posts/2024/05/21/openshift-unleashed/post.md", "range": {"start": {"line": 102, "column": 209}}}, "severity": "WARNING"}

```yaml

Expand Down Expand Up @@ -134,7 +128,6 @@
With this template, route can be created to expose a service to the outside of a cluster, simply add this to the helm chart’s values file.

```yaml

route:
enabled: true
name: #<name of the route>
Expand All @@ -144,25 +137,23 @@
termination: edge
insecureEdgeTerminationPolicy: Redirect
wildcardPolicy: None

```
_**Note:**_ The above template can also be modified according to the client’s requirements to include other route features.

### **Block Exposed URLs**

Some exposed URLs that have to be blocked from public internet access and to only be accessible from the private network. These URLs are described here: [Block Exposed URLs](https://backbase.io/developers/documentation/security/infrastructure/block-exposed-urls/) as part of security best practices. These URLs can be blocked from public internet access directly on the Openshift route or any layer of networking above the Openshift route such as a WAF as a recommended practice. The following snippet shows how to do IP-based restriction on an Openshift route with a path to ensure it’s blocked from public access but can still be accessed from the private network. This configuration is however recommended to do on a WAF layer.
Some exposed URLs that have to be blocked from public internet access and to only be accessible from the private network. These URLs can be blocked from public internet access directly on the Openshift route or any layer of networking above the Openshift route such as a WAF as a recommended practice. The following snippet shows how to do IP-based restriction on an Openshift route with a path to ensure it’s blocked from public access but can still be accessed from the private network. This configuration is however recommended to do on a WAF layer.

Check warning on line 144 in content/posts/2024/05/21/openshift-unleashed/post.md

View workflow job for this annotation

GitHub Actions / vale

[vale] content/posts/2024/05/21/openshift-unleashed/post.md#L144 

[write-good.Passive] 'be blocked' may be passive voice. Use active voice if you can.
Raw output 
{"message": "[write-good.Passive] 'be blocked' may be passive voice. Use active voice if you can.", "location": {"path": "content/posts/2024/05/21/openshift-unleashed/post.md", "range": {"start": {"line": 144, "column": 32}}}, "severity": "WARNING"}

Check warning on line 144 in content/posts/2024/05/21/openshift-unleashed/post.md

View workflow job for this annotation

GitHub Actions / vale

[vale] content/posts/2024/05/21/openshift-unleashed/post.md#L144 

[write-good.Weasel] 'only' is a weasel word!
Raw output 
{"message": "[write-good.Weasel] 'only' is a weasel word!", "location": {"path": "content/posts/2024/05/21/openshift-unleashed/post.md", "range": {"start": {"line": 144, "column": 78}}}, "severity": "WARNING"}

Check warning on line 144 in content/posts/2024/05/21/openshift-unleashed/post.md

View workflow job for this annotation

GitHub Actions / vale

[vale] content/posts/2024/05/21/openshift-unleashed/post.md#L144 

[write-good.Passive] 'be blocked' may be passive voice. Use active voice if you can.
Raw output 
{"message": "[write-good.Passive] 'be blocked' may be passive voice. Use active voice if you can.", "location": {"path": "content/posts/2024/05/21/openshift-unleashed/post.md", "range": {"start": {"line": 144, "column": 138}}}, "severity": "WARNING"}

Check warning on line 144 in content/posts/2024/05/21/openshift-unleashed/post.md

View workflow job for this annotation

GitHub Actions / vale

[vale] content/posts/2024/05/21/openshift-unleashed/post.md#L144 

[Google.WordList] Use 'preceding' instead of 'above'.
Raw output 
{"message": "[Google.WordList] Use 'preceding' instead of 'above'.", "location": {"path": "content/posts/2024/05/21/openshift-unleashed/post.md", "range": {"start": {"line": 144, "column": 236}}}, "severity": "WARNING"}

Check warning on line 144 in content/posts/2024/05/21/openshift-unleashed/post.md

View workflow job for this annotation

GitHub Actions / vale

[vale] content/posts/2024/05/21/openshift-unleashed/post.md#L144 

[write-good.Passive] 'be accessed' may be passive voice. Use active voice if you can.
Raw output 
{"message": "[write-good.Passive] 'be accessed' may be passive voice. Use active voice if you can.", "location": {"path": "content/posts/2024/05/21/openshift-unleashed/post.md", "range": {"start": {"line": 144, "column": 452}}}, "severity": "WARNING"}

Check warning on line 144 in content/posts/2024/05/21/openshift-unleashed/post.md

View workflow job for this annotation

GitHub Actions / vale

[vale] content/posts/2024/05/21/openshift-unleashed/post.md#L144 

[write-good.TooWordy] 'however' is too wordy.
Raw output 
{"message": "[write-good.TooWordy] 'however' is too wordy.", "location": {"path": "content/posts/2024/05/21/openshift-unleashed/post.md", "range": {"start": {"line": 144, "column": 512}}}, "severity": "WARNING"}

```yaml
haproxy.router.openshift.io/ip_whitelist: '<IPv4 address>'
```

### **Rate Limiting**

The production hardening guide dictates what URLs should be configured with [Rate Limiting](https://backbase.io/developers/documentation/security/overview/production-hardening-guide/). Rate limiting restricts the number of requests allowed from each originating IP address within a specific time frame.
Rate limiting restricts the number of requests allowed from each originating IP address within a specific time frame.

On the Openshift route layer, this can also be done through a set of annotations for TCP and HTTP traffic which is described here : [Route configuration - Configuring Routes | Networking | OpenShift Container Platform 4.15](https://docs.openshift.com/container-platform/4.15/networking/routes/route-configuration.html#nw-route-specific-annotations_route-configuration)

In simple terms the following configuration should be more than sufficient to enable rate limiting for a particular route and path. The configuration can be adjusted based on client requirements. This can also be tested if it works using JMeter and similar tools by sending concurrent requests. This configuration is however recommended to do on a WAF layer.
In simple terms the following configuration should be more than sufficient to enable rate limiting for a particular route and path. The configuration can be adjusted based on client requirements. This can also be tested if it works using JMeter and similar tools by sending concurrent requests. This configuration is however recommended to do on a WAF layer.

Check warning on line 156 in content/posts/2024/05/21/openshift-unleashed/post.md

View workflow job for this annotation

GitHub Actions / vale

[vale] content/posts/2024/05/21/openshift-unleashed/post.md#L156 

[write-good.TooWordy] 'sufficient' is too wordy.
Raw output 
{"message": "[write-good.TooWordy] 'sufficient' is too wordy.", "location": {"path": "content/posts/2024/05/21/openshift-unleashed/post.md", "range": {"start": {"line": 156, "column": 65}}}, "severity": "WARNING"}

Check warning on line 156 in content/posts/2024/05/21/openshift-unleashed/post.md

View workflow job for this annotation

GitHub Actions / vale

[vale] content/posts/2024/05/21/openshift-unleashed/post.md#L156 

[write-good.Passive] 'be adjusted' may be passive voice. Use active voice if you can.
Raw output 
{"message": "[write-good.Passive] 'be adjusted' may be passive voice. Use active voice if you can.", "location": {"path": "content/posts/2024/05/21/openshift-unleashed/post.md", "range": {"start": {"line": 156, "column": 155}}}, "severity": "WARNING"}

Check warning on line 156 in content/posts/2024/05/21/openshift-unleashed/post.md

View workflow job for this annotation

GitHub Actions / vale

[vale] content/posts/2024/05/21/openshift-unleashed/post.md#L156 

[write-good.Passive] 'be tested' may be passive voice. Use active voice if you can.
Raw output 
{"message": "[write-good.Passive] 'be tested' may be passive voice. Use active voice if you can.", "location": {"path": "content/posts/2024/05/21/openshift-unleashed/post.md", "range": {"start": {"line": 156, "column": 211}}}, "severity": "WARNING"}

Check warning on line 156 in content/posts/2024/05/21/openshift-unleashed/post.md

View workflow job for this annotation

GitHub Actions / vale

[vale] content/posts/2024/05/21/openshift-unleashed/post.md#L156 

[write-good.TooWordy] 'however' is too wordy.
Raw output 
{"message": "[write-good.TooWordy] 'however' is too wordy.", "location": {"path": "content/posts/2024/05/21/openshift-unleashed/post.md", "range": {"start": {"line": 156, "column": 318}}}, "severity": "WARNING"}


```yaml
Expand All @@ -172,7 +163,7 @@

### **Cache-Control Header**

There was a finding during penetration testing that the Cache-Control header had no-cache but not no-store for certain API endpoints. To mitigate this on the Openshift infrastructure layer from 4.14 version of Openshift onwards, the response header could be set on the Openshift route itself as part of it’s configuration : [Route configuration - Configuring Routes | Networking | OpenShift Container Platform 4.15](https://docs.openshift.com/container-platform/4.15/networking/routes/route-configuration.html#nw-http-header-configuration_route-configuration)
The Openshift infrastructure layer from 4.14 version of Openshift onwards, the response header could be set on the Openshift route itself as part of it’s configuration : [Route configuration - Configuring Routes | Networking | OpenShift Container Platform 4.15](https://docs.openshift.com/container-platform/4.15/networking/routes/route-configuration.html#nw-http-header-configuration_route-configuration)

Check warning on line 166 in content/posts/2024/05/21/openshift-unleashed/post.md

View workflow job for this annotation

GitHub Actions / vale

[vale] content/posts/2024/05/21/openshift-unleashed/post.md#L166 

[write-good.Passive] 'be set' may be passive voice. Use active voice if you can.
Raw output 
{"message": "[write-good.Passive] 'be set' may be passive voice. Use active voice if you can.", "location": {"path": "content/posts/2024/05/21/openshift-unleashed/post.md", "range": {"start": {"line": 166, "column": 102}}}, "severity": "WARNING"}

An example snippet of the same under the spec section:

Expand Down Expand Up @@ -211,7 +202,7 @@

To scrape metrics of a user defined application one can use ServiceMonitor object described here : [Managing metrics - Monitoring | Observability | OpenShift Container Platform 4.15](https://docs.openshift.com/container-platform/4.15/observability/monitoring/managing-metrics.html)

This allows to gather metrics related to the application such as JVM, GC etc based on a label that’s assigned to each deployment of a microservice when deployed to the cluster. In the following ServiceMonitor object example a label of app.backbase.com/monitoring: "true" is added while deploying the capability to the cluster based on which applications are selected to be scraped for metrics.
This allows to gather metrics related to the application such as JVM, GC etc based on a label that’s assigned to each deployment of a microservice when deployed to the cluster. In the following ServiceMonitor object example a label of app.example.com/monitoring: "true" is added while deploying the microservice to the cluster based on which applications are selected to be scraped for metrics.

Check warning on line 205 in content/posts/2024/05/21/openshift-unleashed/post.md

View workflow job for this annotation

GitHub Actions / vale

[vale] content/posts/2024/05/21/openshift-unleashed/post.md#L205 

[Google.WordList] Use 'app' instead of 'application'.
Raw output 
{"message": "[Google.WordList] Use 'app' instead of 'application'.", "location": {"path": "content/posts/2024/05/21/openshift-unleashed/post.md", "range": {"start": {"line": 205, "column": 46}}}, "severity": "WARNING"}

Check warning on line 205 in content/posts/2024/05/21/openshift-unleashed/post.md

View workflow job for this annotation

GitHub Actions / vale

[vale] content/posts/2024/05/21/openshift-unleashed/post.md#L205 

[write-good.Passive] 'is added' may be passive voice. Use active voice if you can.
Raw output 
{"message": "[write-good.Passive] 'is added' may be passive voice. Use active voice if you can.", "location": {"path": "content/posts/2024/05/21/openshift-unleashed/post.md", "range": {"start": {"line": 205, "column": 271}}}, "severity": "WARNING"}

Check warning on line 205 in content/posts/2024/05/21/openshift-unleashed/post.md

View workflow job for this annotation

GitHub Actions / vale

[vale] content/posts/2024/05/21/openshift-unleashed/post.md#L205 

[write-good.Passive] 'are selected' may be passive voice. Use active voice if you can.
Raw output 
{"message": "[write-good.Passive] 'are selected' may be passive voice. Use active voice if you can.", "location": {"path": "content/posts/2024/05/21/openshift-unleashed/post.md", "range": {"start": {"line": 205, "column": 356}}}, "severity": "WARNING"}

Check warning on line 205 in content/posts/2024/05/21/openshift-unleashed/post.md

View workflow job for this annotation

GitHub Actions / vale

[vale] content/posts/2024/05/21/openshift-unleashed/post.md#L205 

[write-good.Passive] 'be scraped' may be passive voice. Use active voice if you can.
Raw output 
{"message": "[write-good.Passive] 'be scraped' may be passive voice. Use active voice if you can.", "location": {"path": "content/posts/2024/05/21/openshift-unleashed/post.md", "range": {"start": {"line": 205, "column": 372}}}, "severity": "WARNING"}

```yaml
apiVersion: monitoring.coreos.com/v1
Expand All @@ -229,7 +220,7 @@
path: /actuator/prometheus
selector:
matchLabels:
app.backbase.com/monitoring: "true"
app.example.com/monitoring: "true"
```

If the actuator endpoints for scraping are protected behind authentication, the ServiceMonitor object also supports basic authentication with username/password as per the below example under the spec.endpoints section where the username/password can be referred from a Kubernetes Secret.
Expand Down
Loading