feat: support secrets in scrape authorization

[TheSpiritXIII]

Fixes #450 and #241.

This PR adds the following types to PodMonitoring/ClusterPodMonitoring's ScrapeEndpoint:

• scrapeEndpoint.tls.ca
• scrapeEndpoint.tls.cert
• scrapeEndpoint.tls.key
• scrapeEndpoint.oauth2.clientSecret
• scrapeEndpoint.auth.credentials
• scrapeEndpoint.basicAuth.password

These are all the same object pointing to a Kubernetes Secret with these fields:

secret.name
secret.key
secret.namespace

[TheSpiritXIII]

@pintohutch hello, I've responded to all of your comments. Can you please take another look and let me know your thoughts?

[bwplotka]

Nice! Will check it out, will try to deploy it too & test.

[bwplotka]

Proposed adding example https://github.com/GoogleCloudPlatform/prometheus-engine/pull/916

[mpskovvang]

Thrilled about the new feature! Could you possibly share when it's expected to be available on GKE? Much appreciated!

[TheSpiritXIII]

Thrilled about the new feature! Could you possibly share when it's expected to be available on GKE? Much appreciated!

The feature is already available on the GKE rapid release channel 1.29.3-gke.1113000 and above. We expect to port this change to the regular release channel sometime before the end of Q2.

For an example configuration, see: https://github.com/GoogleCloudPlatform/prometheus-engine/blob/main/examples/instrumentation/go-synthetic/go-synthetic-basic-auth.yaml

For full usage, see: https://github.com/GoogleCloudPlatform/prometheus-engine/blob/main/doc/api.md

Feel free to report any issues you see as a new bug on GitHub. Thanks for the interest!

[mpskovvang]

Feel free to report any issues you see as a new bug on GitHub. Thanks for the interest!

Thanks for the quick reply. I've successfully upgraded to 1.29.3-gke.1282000.

Unfortunately, I'm having an issue with namespaces:

invalid definition for endpoint with index 0: unable to parse or invalid Prometheus HTTP client config: must use namespace "ecommerce", got: "default"

If I omit the authorization the request succeeds.

apiVersion: monitoring.googleapis.com/v1
kind: PodMonitoring
metadata:
  name: meilisearch
  namespace: ecommerce
  labels:
    app.kubernetes.io/name: meilisearch
    app.kubernetes.io/instance: meilisearch
    app.kubernetes.io/version: "v1.7.0"
    app.kubernetes.io/component: search-engine
    app.kubernetes.io/part-of: meilisearch
spec:
  selector:
    matchLabels:
      app.kubernetes.io/name: meilisearch
      app.kubernetes.io/instance: meilisearch
  endpoints:
    - port: http
      path: /metrics
      interval: 1m
      timeout: 10s
      authorization:
        type: Bearer
        credentials:
          secret:
            name: meilisearch-master-key
            key: MEILI_MASTER_KEY

I've also attempted with ClusterPodMonitoring with secret.namespace: ecommerce, but faces another issue:

unable to read authorization credentials: secret ecommerce/meilisearch-master-key not found or forbidden

I guess this is related to https://github.com/GoogleCloudPlatform/prometheus-engine/issues/789

[TheSpiritXIII]

Unfortunately, I'm having an issue with namespaces

The fix is available in version:

GKE 1.30: 1.30.2-gke.1054000 or later.

And will be available in versions:

GKE 1.29: 1.29.6-gke.1150000 or later. GKE 1.28: 1.28.11-gke.1107000 or later.

Please allow 2-3 weeks for these versions to get rolled out. Thanks!

[cagataygurturk]

Unfortunately, I'm having an issue with namespaces

The fix is available in version:

GKE 1.30: 1.30.2-gke.1054000 or later.

And will be available in versions:

GKE 1.29: 1.29.6-gke.1150000 or later. GKE 1.28: 1.28.11-gke.1107000 or later.

Please allow 2-3 weeks for these versions to get rolled out. Thanks!

Hi, on 1.29.6-gke.1254000 I am still experiencing the same issue. Can you confirm the release schedule?

[TheSpiritXIII]

Can you confirm the release schedule?

Hi, we ended up doing additional security patch releases. 0.12 as shown in the releases page is available on the following GKE minor versions:

• 1.28.11-gke.1176000
• 1.29.6-gke.1256000
• 1.30.2-gke.1394000

These are the corresponding available versions on the GKE rapid release channel:

• 1.28.11-gke.1260000
• 1.29.6-gke.1326000
• 1.30.2-gke.1394003

Please create a new issue if you're having still problems since messages here could easily get lost! Thanks!