Skip to content

Commit 245546f

Browse files
philipgoughphilipgough
authored
rbac: Generate read only role binding for telemeter for analytics (#730)
* rbac: Generate read only role binding for telemeter for analytics * make: prometheusrules
1 parent ff29a2f commit 245546f

7 files changed

+20
-5938
lines changed

‎configuration/observatorium/rbac.go

+14-73
Original file line numberDiff line numberDiff line change
@@ -12,26 +12,22 @@ import (
1212
type tenantID string
1313

1414
const (
15-
cnvqeTenant tenantID = "cnvqe"
16-
telemeterTenant tenantID = "telemeter"
17-
rhobsTenant tenantID = "rhobs"
18-
psiocpTenant tenantID = "psiocp"
19-
rhodsTenant tenantID = "rhods"
20-
rhacsTenant tenantID = "rhacs"
21-
odfmsTenant tenantID = "odfms"
22-
refAddonTenant tenantID = "reference-addon"
23-
hypershiftTenant tenantID = "hypershift-platform"
24-
hypershiftStagingTenant tenantID = "hypershift-platform-staging"
25-
rhtapTenant tenantID = "rhtap"
26-
rhelTenant tenantID = "rhel"
15+
cnvqeTenant tenantID = "cnvqe"
16+
telemeterTenant tenantID = "telemeter"
17+
rhobsTenant tenantID = "rhobs"
18+
psiocpTenant tenantID = "psiocp"
19+
rhodsTenant tenantID = "rhods"
20+
rhacsTenant tenantID = "rhacs"
21+
odfmsTenant tenantID = "odfms"
22+
refAddonTenant tenantID = "reference-addon"
23+
rhtapTenant tenantID = "rhtap"
24+
rhelTenant tenantID = "rhel"
2725
)
2826

2927
type signal string
3028

3129
const (
3230
metricsSignal signal = "metrics"
33-
logsSignal signal = "logs"
34-
tracesSignal signal = "traces"
3531
)
3632

3733
type env string
@@ -207,67 +203,12 @@ func GenerateRBAC() *observatoriumRBAC {
207203
envs: []env{stagingEnv, productionEnv},
208204
})
209205

210-
// hypershift
211-
attachBinding(&obsRBAC, bindingOpts{
212-
name: "observatorium-hypershift-platform",
213-
tenant: hypershiftTenant,
214-
signals: []signal{metricsSignal},
215-
perms: []rbac.Permission{rbac.Write, rbac.Read},
216-
envs: []env{productionEnv},
217-
})
218-
219-
// hypershift
220-
// Special request of extra read account.
221-
// Ref: https://issues.redhat.com/browse/OHSS-22439
222-
attachBinding(&obsRBAC, bindingOpts{
223-
name: "observatorium-hypershift-platform-read",
224-
tenant: hypershiftTenant,
225-
signals: []signal{metricsSignal},
226-
perms: []rbac.Permission{rbac.Read}, // Read only.
227-
envs: []env{productionEnv},
228-
})
229-
230-
// hypershift
231-
// Special request of extra read account
232-
// Ref: https://issues.redhat.com/browse/OHSS-22439
233-
attachBinding(&obsRBAC, bindingOpts{
234-
name: "observatorium-hypershift-platform-qe-read",
235-
tenant: hypershiftTenant,
236-
signals: []signal{metricsSignal},
237-
perms: []rbac.Permission{rbac.Read}, // Read only.
238-
envs: []env{productionEnv},
239-
})
240-
241-
// hypershift staging
242-
// observatorium-hypershift-platform-staging is the only tenant that does not
243-
// follow conventions, due to them being present in an unique environment alongside
244-
// their production tenant on rhobsp02ue1.
245-
attachBinding(&obsRBAC, bindingOpts{
246-
name: "observatorium-hypershift-platform-staging",
247-
tenant: hypershiftStagingTenant,
248-
signals: []signal{metricsSignal},
249-
perms: []rbac.Permission{rbac.Write, rbac.Read},
250-
envs: []env{productionEnv},
251-
skipConventionCheck: true,
252-
})
253-
254-
// hypershift staging
206+
// analytics read only prod
255207
// Special request of extra read account.
256-
// Ref: https://issues.redhat.com/browse/OHSS-22439
257-
attachBinding(&obsRBAC, bindingOpts{
258-
name: "observatorium-hypershift-platform-staging-read",
259-
tenant: hypershiftStagingTenant,
260-
signals: []signal{metricsSignal},
261-
perms: []rbac.Permission{rbac.Read}, // Read only.
262-
envs: []env{productionEnv},
263-
skipConventionCheck: true,
264-
})
265-
266-
// hypershift staging
267-
// Ref: https://issues.redhat.com/browse/OHSS-22439
208+
// https://issues.redhat.com/browse/RHOBS-1116
268209
attachBinding(&obsRBAC, bindingOpts{
269-
name: "observatorium-hypershift-platform-staging-qe-read",
270-
tenant: hypershiftStagingTenant,
210+
name: "7f7f912e-0429-4639-8e70-609ecf65b280",
211+
tenant: telemeterTenant,
271212
signals: []signal{metricsSignal},
272213
perms: []rbac.Permission{rbac.Read}, // Read only.
273214
envs: []env{productionEnv},

‎configuration/observatorium/slo.go

-113
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,6 @@ import (
1616
const (
1717
globalSLOWindowDuration = "28d" // Window over which all RHOBS SLOs are calculated.
1818
globalMetricsSLOAvailabilityTargetPercent = "99" // The Availability Target percentage for RHOBS metrics availability SLOs.
19-
globalLogsSLOAvailabilityTargetPercent = "95" // The Availability Target percentage for RHOBS logs availability SLOs.
2019
globalSLOLatencyTargetPercent = "90" // The Latency Target percentage for RHOBS latency SLOs.
2120
genericSLOLatencySeconds = "5" // Latency request duration to measure percentile target (this is diff for query SLOs).
2221
)
@@ -131,7 +130,6 @@ type rhobsSLOs struct {
131130
totalExpr string
132131
alertName string
133132
sloType sloType
134-
signal signal
135133
}
136134

137135
// rhobSLOList is a list of shorthand SLOs.
@@ -165,9 +163,6 @@ func (slos rhobSLOList) GetObjectives(envName rhobsInstanceEnv) []pyrrav1alpha1.
165163
if s.sloType == sloTypeAvailability {
166164
// Metrics availability target as the default.
167165
objective.Spec.Target = globalMetricsSLOAvailabilityTargetPercent
168-
if s.signal == logsSignal {
169-
objective.Spec.Target = globalLogsSLOAvailabilityTargetPercent
170-
}
171166
objective.Spec.ServiceLevelIndicator = pyrrav1alpha1.ServiceLevelIndicator{
172167
Ratio: &pyrrav1alpha1.RatioIndicator{
173168
Errors: pyrrav1alpha1.Query{
@@ -506,91 +501,6 @@ func ObservatoriumSLOs(envName rhobsInstanceEnv, signal signal) []pyrrav1alpha1.
506501
sloType: sloTypeLatency,
507502
},
508503
}
509-
case logsSignal:
510-
slos = rhobSLOList{
511-
// Observatorium Logs Availability SLOs.
512-
{
513-
name: "api-logs-write-availability-slo",
514-
labels: map[string]string{
515-
"service": "observatorium-api",
516-
"instance": string(envName),
517-
},
518-
description: "API logs /push handler is burning too much error budget to guarantee availability SLOs.",
519-
successOrErrorsExpr: "http_requests_total{job=\"" + apiJobSelector[envName] + "\", handler=\"push\", group=\"logsv1\", code=~\"^5..$\"}",
520-
totalExpr: "http_requests_total{job=\"" + apiJobSelector[envName] + "\", handler=\"push\", group=\"logsv1\"}",
521-
alertName: "APILogsPushAvailabilityErrorBudgetBurning",
522-
sloType: sloTypeAvailability,
523-
signal: logsSignal,
524-
},
525-
{
526-
name: "api-logs-query-availability-slo",
527-
labels: map[string]string{
528-
"service": "observatorium-api",
529-
"instance": string(envName),
530-
},
531-
description: "API logs /query, /labels, or /label_values handler is burning too much error budget to guarantee availability SLOs.",
532-
successOrErrorsExpr: "http_requests_total{job=\"" + apiJobSelector[envName] + "\", handler=~\"query|label|labels|label_values\", group=\"logsv1\", code=~\"^5..$\"}",
533-
totalExpr: "http_requests_total{job=\"" + apiJobSelector[envName] + "\", handler=~\"query|label|labels|label_values\", group=\"logsv1\"}",
534-
alertName: "APILogsQueryAvailabilityErrorBudgetBurning",
535-
sloType: sloTypeAvailability,
536-
signal: logsSignal,
537-
},
538-
{
539-
name: "api-logs-query-range-availability-slo",
540-
labels: map[string]string{
541-
"service": "observatorium-api",
542-
"instance": string(envName),
543-
},
544-
description: "API logs /query_range handler is burning too much error budget to guarantee availability SLOs.",
545-
successOrErrorsExpr: "http_requests_total{job=\"" + apiJobSelector[envName] + "\", handler=\"query_range\", group=\"logsv1\", code=~\"^5..$\"}",
546-
totalExpr: "http_requests_total{job=\"" + apiJobSelector[envName] + "\", handler=\"query_range\", group=\"logsv1\"}",
547-
alertName: "APILogsQueryRangeAvailabilityErrorBudgetBurning",
548-
sloType: sloTypeAvailability,
549-
signal: logsSignal,
550-
},
551-
{
552-
name: "api-logs-tail-availability-slo",
553-
labels: map[string]string{
554-
"service": "observatorium-api",
555-
"instance": string(envName),
556-
},
557-
description: "API logs /tail is burning too much error budget to guarantee availability SLOs.",
558-
successOrErrorsExpr: "http_requests_total{job=\"" + apiJobSelector[envName] + "\", handler=\"tail\", group=\"logsv1\", code=~\"^5..$\"}",
559-
totalExpr: "http_requests_total{job=\"" + apiJobSelector[envName] + "\", handler=\"tail\", group=\"logsv1\"}",
560-
alertName: "APILogsTailAvailabilityErrorBudgetBurning",
561-
sloType: sloTypeAvailability,
562-
signal: logsSignal,
563-
},
564-
{
565-
name: "api-logs-prom-tail-availability-slo",
566-
labels: map[string]string{
567-
"service": "observatorium-api",
568-
"instance": string(envName),
569-
},
570-
description: "API logs /prom_tail is burning too much error budget to guarantee availability SLOs.",
571-
successOrErrorsExpr: "http_requests_total{job=\"" + apiJobSelector[envName] + "\", handler=\"prom_tail\", group=\"logsv1\", code=~\"^5..$\"}",
572-
totalExpr: "http_requests_total{job=\"" + apiJobSelector[envName] + "\", handler=\"prom_tail\", group=\"logsv1\"}",
573-
alertName: "APILogsPromTailAvailabilityErrorBudgetBurning",
574-
sloType: sloTypeAvailability,
575-
signal: logsSignal,
576-
},
577-
578-
// Observatorium Logs Latency SLOs.
579-
{
580-
name: "api-logs-write-latency-slo",
581-
labels: map[string]string{
582-
"service": "observatorium-api",
583-
"instance": string(envName),
584-
},
585-
description: "API /push handler is burning too much error budget to guarantee latency SLOs.",
586-
successOrErrorsExpr: "http_request_duration_seconds_bucket{job=\"" + apiJobSelector[envName] + "\", handler=\"push\", group=\"logsv1\", code=~\"^2..$\", le=\"" + genericSLOLatencySeconds + "\"}",
587-
totalExpr: "http_request_duration_seconds_count{job=\"" + apiJobSelector[envName] + "\", handler=\"push\", group=\"logsv1\", code=~\"^2..$\"}",
588-
alertName: "APILogsPushLatencyErrorBudgetBurning",
589-
sloType: sloTypeLatency,
590-
},
591-
}
592-
case tracesSignal:
593-
panic("tracing signal is not yet supported")
594504
default:
595505
panic(signal + " is not an Observatorium signal")
596506
}
@@ -656,14 +566,6 @@ func GenSLO(genPyrra, genRules *mimic.Generator) {
656566
genRules,
657567
)
658568

659-
envSLOs(
660-
mstProduction,
661-
ObservatoriumSLOs(mstProduction, logsSignal),
662-
"rhobs-slos-logs-mst-production",
663-
genPyrra,
664-
genRules,
665-
)
666-
667569
envSLOs(
668570
mstStage,
669571
ObservatoriumSLOs(mstStage, metricsSignal),
@@ -672,21 +574,6 @@ func GenSLO(genPyrra, genRules *mimic.Generator) {
672574
genRules,
673575
)
674576

675-
envSLOs(
676-
mstStage,
677-
ObservatoriumSLOs(mstStage, logsSignal),
678-
"rhobs-slos-logs-mst-stage",
679-
genPyrra,
680-
genRules,
681-
)
682-
683-
envSLOs(
684-
rhobsp02ue1Production,
685-
ObservatoriumSLOs(rhobsp02ue1Production, metricsSignal),
686-
"rhobs-slos-rhobsp02ue1-prod",
687-
genPyrra,
688-
genRules,
689-
)
690577
}
691578

692579
// envSLOs generates the resultant config for a particular rhobsInstanceEnv.

0 commit comments

Comments
 (0)