add metrics service to tls cert

Author: maltesander

docs/modules/hdfs/pages/usage-guide/monitoring.adoc

@@ -23,12 +23,3 @@ http://<hdfs-stacklet>-namenode-<rolegroup-name>-metrics:9870/prom
 HDFS exposes metrics through the same port as their web UI. Hence, when configuring HDFS with TLS the metrics are also secured by TLS,
 and the clients scraping the metrics endpoint need to authenticate against it. This could for example be accomplished by utilizing mTLS
 between Kubernetes Pods with the xref:home:secret-operator:index.adoc[Secret Operator].
-
-When using the Prometheus `ServiceMonitor` for scraping, the `address` label needs relabeling to use the `headless` Service instead of the
-`metrics` Service. This is because per default Prometheus targets the Pod IPs as endpoints, but since the Pod IPs are not
-part of the certificate, the authentication will fail. Instead, the FQDN of the Pods, which can be added to the certificate, is used, but
-this FQDN is only available through the `headless` Service.
-
-A more detailed explanation can be found in the xref:home:nifi:usage_guide/monitoring.adoc[NiFi Operator Monitoring Docs] with a similar situation
-and an example of a Prometheus `ServiceMonitor` configured for TLS in the
-https://github.com/stackabletech/demos/blob/main/stacks/monitoring/prometheus-service-monitors.yaml[Monitoring Stack{external-link-icon}^].

rust/operator-binary/src/container.rs

@@ -48,6 +48,7 @@ use stackable_operator::{
             CustomContainerLogConfig,
         },
     },
+    role_utils::RoleGroupRef,
     utils::{COMMON_BASH_TRAP_FUNCTIONS, cluster_info::KubernetesClusterInfo},
 };
 use strum::{Display, EnumDiscriminants, IntoStaticStr};
@@ -216,24 +217,25 @@ impl ContainerConfig {
         hdfs: &v1alpha1::HdfsCluster,
         cluster_info: &KubernetesClusterInfo,
         role: &HdfsNodeRole,
-        role_group: &str,
+        rolegroup_ref: &RoleGroupRef<v1alpha1::HdfsCluster>,
         resolved_product_image: &ResolvedProductImage,
         merged_config: &AnyNodeConfig,
         env_overrides: Option<&BTreeMap<String, String>>,
         zk_config_map_name: &str,
-        object_name: &str,
         namenode_podrefs: &[HdfsPodRef],
         labels: &Labels,
     ) -> Result<(), Error> {
         // HDFS main container
         let main_container_config = Self::from(*role);
-        pb.add_volumes(main_container_config.volumes(merged_config, object_name, labels)?)
+        let object_name = &rolegroup_ref.object_name();
+
+        pb.add_volumes(main_container_config.volumes(merged_config, &object_name, labels)?)
             .context(AddVolumeSnafu)?;
         pb.add_container(main_container_config.main_container(
             hdfs,
             cluster_info,
             role,
-            role_group,
+            rolegroup_ref,
             resolved_product_image,
             zk_config_map_name,
             env_overrides,
@@ -277,6 +279,8 @@ impl ContainerConfig {
                         )
                         .with_pod_scope()
                         .with_node_scope()
+                        // To scrape metrics behind TLS endpoint (without FQDN)
+                        .with_service_scope(rolegroup_ref.rolegroup_metrics_service_name())
                         .with_format(SecretFormat::TlsPkcs12)
                         .with_tls_pkcs12_password(TLS_STORE_PASSWORD)
                         .with_auto_tls_cert_lifetime(
@@ -327,7 +331,7 @@ impl ContainerConfig {
                     hdfs,
                     cluster_info,
                     role,
-                    role_group,
+                    &rolegroup_ref,
                     resolved_product_image,
                     zk_config_map_name,
                     env_overrides,
@@ -348,7 +352,7 @@ impl ContainerConfig {
                     hdfs,
                     cluster_info,
                     role,
-                    role_group,
+                    &rolegroup_ref.role_group,
                     resolved_product_image,
                     zk_config_map_name,
                     env_overrides,
@@ -370,7 +374,7 @@ impl ContainerConfig {
                     hdfs,
                     cluster_info,
                     role,
-                    role_group,
+                    &rolegroup_ref.role_group,
                     resolved_product_image,
                     zk_config_map_name,
                     env_overrides,
@@ -393,7 +397,7 @@ impl ContainerConfig {
                     hdfs,
                     cluster_info,
                     role,
-                    role_group,
+                    &rolegroup_ref.role_group,
                     resolved_product_image,
                     zk_config_map_name,
                     env_overrides,
@@ -462,7 +466,7 @@ impl ContainerConfig {
         hdfs: &v1alpha1::HdfsCluster,
         cluster_info: &KubernetesClusterInfo,
         role: &HdfsNodeRole,
-        role_group: &str,
+        rolegroup_ref: &RoleGroupRef<v1alpha1::HdfsCluster>,
         resolved_product_image: &ResolvedProductImage,
         zookeeper_config_map_name: &str,
         env_overrides: Option<&BTreeMap<String, String>>,
@@ -481,7 +485,7 @@ impl ContainerConfig {
             .args(self.args(hdfs, cluster_info, role, merged_config, &[])?)
             .add_env_vars(self.env(
                 hdfs,
-                role_group,
+                &rolegroup_ref.role_group,
                 zookeeper_config_map_name,
                 env_overrides,
                 resources.as_ref(),

rust/operator-binary/src/hdfs_controller.rs

@@ -853,12 +853,11 @@ fn rolegroup_statefulset(
         hdfs,
         cluster_info,
         role,
-        &rolegroup_ref.role_group,
+        &rolegroup_ref,
         resolved_product_image,
         merged_config,
         env_overrides,
         &hdfs.spec.cluster_config.zookeeper_config_map_name,
-        &rolegroup_ref.object_name(),
         namenode_podrefs,
         &rolegroup_selector_labels,
     )
@@ -979,6 +978,7 @@ properties: []
             .unwrap()
             .get("default")
             .unwrap();
+        let rolegroup_ref = hdfs.rolegroup_ref(&role.to_string(), "default");
         let env_overrides = rolegroup_config.get(&PropertyNameKind::Env);
 
         let merged_config = role.merged_config(&hdfs, "default").unwrap();
@@ -997,12 +997,11 @@ properties: []
                 cluster_domain: DomainName::try_from("cluster.local").unwrap(),
             },
             &role,
-            "default",
+            &rolegroup_ref,
             &resolved_product_image,
             &merged_config,
             env_overrides,
             &hdfs.spec.cluster_config.zookeeper_config_map_name,
-            "todo",
             &[],
             &Labels::new(),
         )