Fix metrics scraping
When monitoring.enabled: true is set, a ServiceMonitor is deployed that points to a secret named twistlock-basic-auth for credentials. The Helm chart requires the user to manually create the secret. In addition, the label selectors and port name are not correct for the serviceMonitor.
Now that we have an init routine, we should be able to do the following:
- Create a user in additional users (need to identify the least privileges role for this and document it)
- Set a value in
monitoring.credentials? for user to use- Password can be automatically looked up in the
additionalUserslist if not explicitly provided here - Optionally, password can be provided and lookup will be skipped (use case: upgrades where additional user does not need to be created)
- Password can be automatically looked up in the
- Create a secret holding the credentials. I suggest we change the name to something more intuitive like
twistlock-metrics-auth. Update the ServiceMonitor with the new name. - Update the serviceMonitor label selector (app.kubernetes.io/name: twistlock-console)
- Test prometheus to make sure it is scraping
Edited by Michael McLeroy