Target allocator TLS Implementation #239
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
musa-asad
reviewed
Oct 2, 2024
musa-asad
reviewed
Oct 2, 2024
|
I'll rebase the commits to clean-it -up after the initial review |
musa-asad
reviewed
Oct 3, 2024
musa-asad
reviewed
Oct 3, 2024
musa-asad
reviewed
Oct 3, 2024
musa-asad
reviewed
Oct 3, 2024
musa-asad
reviewed
Oct 3, 2024
musa-asad
previously approved these changes
Oct 3, 2024
mitali-salvi
reviewed
Oct 4, 2024
There was a problem hiding this comment.
The fix for selectors for target-allocator is separate from the TLS functionality, I would prefer if its a separate PR altogether. Makes it easier to review PR and rollback/root-cause if there's an issue again
The selector label needs to be added to the target-allocator deployment as well to associate it with the service. This is how the cloudwatch-agent daemon-set does it. https://github.com/aws/amazon-cloudwatch-agent-operator/blob/main/internal/manifests/collector/daemonset.go#L31
* Added https server, tests, secret marshalling * Added changelog * Moved TLS config. Cleaned up server. * TLS config as struct method. Go Idioms * Removed default tls file paths. Minor cleanup.
okankoAMZ
force-pushed
the
target-allocator
branch
from
ffb6848 to
c858373
Compare
mitali-salvi
approved these changes
Oct 9, 2024
musa-asad
approved these changes
Oct 9, 2024
okankoAMZ
added a commit
that referenced
this pull request
Nov 26, 2024
* Implemented Target Allocator Container (#214) * Merge `main` into `target-allocator` (#232) NodeJS merging-in from main * Supporting K8s 1.31 (#222) (#236) Co-authored-by: Mitali Salvi <44349099+mitali-salvi@users.noreply.github.com> * Implemented TargetAllocator resource deployments. (#208) * Adding target-allocator label to service selectors (#242) * Target allocator TLS Implementation (#239) * Ta https server (#2921) * Added https server, tests, secret marshalling --------- Co-authored-by: ItielOlenick <67790309+ItielOlenick@users.noreply.github.com> * [Target Allocator] Enable Deployment and Daemonset modes for Agent (#253) * Changes error to warning * [CI/CD] Add Target Allocator(TA) Build to Build and Upload Workflow (#247) * edited workflow * Clean up managed resources when disabled (#255) * Reconciler now removes un-used managed resources for CWA collector * remove pprof endpoint (#260) * [TA] One service per Target Allocator (#259) * added one-service per TA * Setup cert-watcher for TA server cert (#264) * [TA] Target Allocator TLS Unit-tests (#265) * TLS tests * Injecting Prometheus path if not specified in agent config (#258) * Injecting Prom path if it doesn't exist * Rebasing Target Allocator Branch to Main (#266) * Adding support for NodeJS auto instrumentation and integ tests (#220) * Support configurable resources for NodeJS. (#225) * Supporting JMX annotations (#240) * Add support for a supplemental YAML configuration for the CloudWatchAgent (#241) * Changed naming for OTLP container ports from agent JSON (#252) * Updated Release Notes for 1.8.0 (#251) * Adjust EKS add-on integration test service count expectations (#256) * Add integration tests for JMX. (#250) * Implemented Target Allocator Container (#214) * Implemented TargetAllocator resource deployments. (#208) * Update cmd/amazon-cloudwatch-agent-target-allocator/config/config.go Co-authored-by: Musa <musaasad@amazon.com> * Update internal/config/main.go Co-authored-by: Musa <musaasad@amazon.com> --------- Co-authored-by: Parampreet Singh <50599809+Paramadon@users.noreply.github.com> Co-authored-by: Musa <musaasad@amazon.com> Co-authored-by: Mitali Salvi <44349099+mitali-salvi@users.noreply.github.com> Co-authored-by: Jeffrey Chien <chienjef@amazon.com> --------- Co-authored-by: Musa <musaasad@amazon.com> Co-authored-by: Mitali Salvi <44349099+mitali-salvi@users.noreply.github.com> Co-authored-by: ItielOlenick <67790309+ItielOlenick@users.noreply.github.com> Co-authored-by: Kaushik Surya <108111936+sky333999@users.noreply.github.com> Co-authored-by: Parampreet Singh <50599809+Paramadon@users.noreply.github.com> Co-authored-by: Jeffrey Chien <chienjef@amazon.com>
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Issue
Currently, Target Allocator(TA)'s Scrape Server is a
httpserver. We want Target Allocator to be only accessed by the Agent; thus, we want the scrape server to be ahttpsserver.Description of changes:
Warning
This PR Requires changes to the helm chart to be fully working, without them it will not crash or break; however, collector(agent) will not be able to ping the Target Allocator Container
Testing
Setup
For this testing since the endpoint can only be accessed through the agent I added a
mock-collectorwhich just pings these endpoint on repeat using the certification on the pod.make container && make container-pushto generate the new operator containermake ta-build-and-pushto generate new Target Allocator containermock-collectorone.amazon-cloudwatch-agentnamespace deployed, deploy these changes withhelm upgradeResult
Pods
Service Description
Mock-Collector Output After boot-up
Target Allocator Output
Note
I have removed that config line after testing
By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice.