Merge pull request #131 from appuio/fix/missing-es-operator-metrics-t…

…oken

Manually generate missing Elasticsearch Operator metrics token

component/elasticsearch.libsonnet

@@ -1,4 +1,5 @@
 // main template for openshift4-lokistack
+local workaround = import 'es_workaround.libsonnet';
 local kap = import 'lib/kapitan.libjsonnet';
 local kube = import 'lib/kube.libjsonnet';
 local resourceLocker = import 'lib/resource-locker.libjsonnet';
@@ -125,6 +126,7 @@ if elasticsearch.enabled then
     '40_es_machineconfig': machineconfig_journald,
     '40_es_netpol': netpol_operator,
     [if kibana_host != null then '40_es_kibana_host']: kibana_patchWithAdditionalPermissions,
+    '40_es_operator_metrics_token': workaround.missing_metrics_token,
   }
 else
   std.trace(

component/es_workaround.libsonnet

@@ -0,0 +1,35 @@
+local com = import 'lib/commodore.libjsonnet';
+local kap = import 'lib/kapitan.libjsonnet';
+local kube = import 'lib/kube.libjsonnet';
+local po = import 'lib/patch-operator.libsonnet';
+
+// The hiera parameters for the component
+local inv = kap.inventory();
+local params = inv.parameters.openshift4_logging;
+
+
+// Generate missing metrics SA token for Elasticsearch Operator.
+//
+// The ServiceMonitor for the Elasticsearch Operator references a SA token secret
+// called `elasticsearch-operator-controller-manager-metrics-token` which doesn't exist
+// on the cluster after the operator is installed or upgraded to 5.8.6 via
+// OLM.
+local missing_metrics_token =
+  kube.Secret('elasticsearch-operator-controller-manager-metrics-token') {
+    metadata+: {
+      // Loki operator is deployed in openshift-operators-redhat
+      namespace: 'openshift-operators-redhat',
+      annotations+: {
+        'kubernetes.io/service-account.name': 'elasticsearch-operator-controller-manager-metrics-reader',
+        // disable argocd prune/delete so removing the workaround should be
+        // fairly easy in case the Elasticsearch Operator OLM install fixes the issue.
+        'argocd.argoproj.io/sync-options': 'Prune=false,Delete=false',
+      },
+    },
+    data:: {},
+    type: 'kubernetes.io/service-account-token',
+  };
+
+{
+  missing_metrics_token: [ missing_metrics_token ],
+}

tests/golden/elasticsearch/openshift4-logging/openshift4-logging/40_es_operator_metrics_token.yaml

@@ -0,0 +1,11 @@
+apiVersion: v1
+kind: Secret
+metadata:
+  annotations:
+    argocd.argoproj.io/sync-options: Prune=false,Delete=false
+    kubernetes.io/service-account.name: elasticsearch-operator-controller-manager-metrics-reader
+  labels:
+    name: elasticsearch-operator-controller-manager-metrics-token
+  name: elasticsearch-operator-controller-manager-metrics-token
+  namespace: openshift-operators-redhat
+type: kubernetes.io/service-account-token