From 0a9ca8615bc8e365161ca60745ed039c54ed5059 Mon Sep 17 00:00:00 2001 From: daanvinken Date: Fri, 24 Jul 2026 17:26:36 +0200 Subject: [PATCH 1/3] fix(valkey-operator): align ServiceMonitor with metrics.secure When metrics.secure is true the metrics Service exposes port https, but the ServiceMonitor always targeted port http so scrapes failed. Use the matching port name, default scheme https, and insecureSkipVerify for the operator self-signed cert unless serviceMonitor overrides are set. Signed-off-by: daanvinken --- valkey-operator/CHANGELOG.md | 10 ++++++++++ valkey-operator/templates/servicemonitor.yaml | 18 +++++++++++++----- valkey-operator/values.yaml | 7 +++++-- 3 files changed, 28 insertions(+), 7 deletions(-) diff --git a/valkey-operator/CHANGELOG.md b/valkey-operator/CHANGELOG.md index f5d0d40d..6a840fcf 100644 --- a/valkey-operator/CHANGELOG.md +++ b/valkey-operator/CHANGELOG.md @@ -6,6 +6,16 @@ - Add log level configuration example to valkey-operator deployment. +### Fixed + +- Align ServiceMonitor endpoint port name and scrape scheme with `metrics.secure`. + When secure metrics are enabled the metrics Service exposes port `https`, but + the ServiceMonitor previously always targeted port `http`, so scrapes failed. + Defaults `scheme: https` and `tlsConfig.insecureSkipVerify: true` for the + operator's self-signed metrics cert when `metrics.secure` is true and the + ServiceMonitor fields are left unset; explicit `serviceMonitor.scheme` / + `tlsConfig` still win. + ## 0.4.0 - Valkey Operator version defaults to v0.4.0. See the [v0.4.0 release notes](https://github.com/valkey-io/valkey-operator/releases/tag/v0.4.0) for the upstream changes. diff --git a/valkey-operator/templates/servicemonitor.yaml b/valkey-operator/templates/servicemonitor.yaml index b08691bf..cfa4db30 100644 --- a/valkey-operator/templates/servicemonitor.yaml +++ b/valkey-operator/templates/servicemonitor.yaml @@ -15,7 +15,8 @@ metadata: {{- end }} spec: endpoints: - - port: http + # Port name must match metrics-service.yaml (http when insecure, https when metrics.secure). + - port: {{ if .Values.metrics.secure }}https{{ else }}http{{ end }} honorLabels: {{ .Values.metrics.serviceMonitor.honorLabels }} {{- with .Values.metrics.serviceMonitor.interval }} interval: {{ . }} @@ -23,12 +24,19 @@ spec: {{- with .Values.metrics.serviceMonitor.scrapeTimeout }} scrapeTimeout: {{ . }} {{- end }} - {{- with .Values.metrics.serviceMonitor.scheme }} - scheme: {{ . }} + {{- if .Values.metrics.serviceMonitor.scheme }} + scheme: {{ .Values.metrics.serviceMonitor.scheme }} + {{- else if .Values.metrics.secure }} + scheme: https {{- end }} - {{- with .Values.metrics.serviceMonitor.tlsConfig }} + {{- if .Values.metrics.serviceMonitor.tlsConfig }} tlsConfig: - {{- toYaml . | nindent 6 }} + {{- toYaml .Values.metrics.serviceMonitor.tlsConfig | nindent 6 }} + {{- else if .Values.metrics.secure }} + # Operator metrics use a self-signed cert by default; scrapers must skip verify + # unless a custom tlsConfig is provided. + tlsConfig: + insecureSkipVerify: true {{- end }} {{- with .Values.metrics.serviceMonitor.relabelings }} relabelings: diff --git a/valkey-operator/values.yaml b/valkey-operator/values.yaml index ecb3be4a..54eb8a72 100644 --- a/valkey-operator/values.yaml +++ b/valkey-operator/values.yaml @@ -235,9 +235,12 @@ metrics: interval: "" # Scrape timeout (defaults to the Prometheus global timeout when empty) scrapeTimeout: "" - # HTTP scheme used for scraping (defaults to http when empty) + # HTTP scheme used for scraping. When empty: https if metrics.secure is true, + # otherwise Prometheus defaults to http. scheme: "" - # TLS configuration used when scraping the endpoint + # TLS configuration used when scraping the endpoint. When empty and + # metrics.secure is true, insecureSkipVerify is set so the operator's + # self-signed metrics cert scrapes successfully. Set explicitly to override. tlsConfig: {} # Keep labels from the scraped target on collision with server-side labels honorLabels: false From 5d89dce189131f471f6ae0ce76d6a01feb984c81 Mon Sep 17 00:00:00 2001 From: daanvinken Date: Fri, 24 Jul 2026 18:22:22 +0200 Subject: [PATCH 2/3] fix(valkey-operator): opt-in insecureSkipVerify for secure ServiceMonitor Keep port/scheme aligned with metrics.secure. Do not default skip-verify; add metrics.serviceMonitor.insecureSkipVerify (false by default). Explicit tlsConfig still wins. Document secure scrape setup in the README. Signed-off-by: daanvinken --- valkey-operator/CHANGELOG.md | 13 +++-- valkey-operator/README.md | 55 ++++++++++++++++++- valkey-operator/templates/servicemonitor.yaml | 5 +- valkey-operator/values.yaml | 9 ++- 4 files changed, 69 insertions(+), 13 deletions(-) diff --git a/valkey-operator/CHANGELOG.md b/valkey-operator/CHANGELOG.md index 6a840fcf..1559dc2f 100644 --- a/valkey-operator/CHANGELOG.md +++ b/valkey-operator/CHANGELOG.md @@ -11,10 +11,15 @@ - Align ServiceMonitor endpoint port name and scrape scheme with `metrics.secure`. When secure metrics are enabled the metrics Service exposes port `https`, but the ServiceMonitor previously always targeted port `http`, so scrapes failed. - Defaults `scheme: https` and `tlsConfig.insecureSkipVerify: true` for the - operator's self-signed metrics cert when `metrics.secure` is true and the - ServiceMonitor fields are left unset; explicit `serviceMonitor.scheme` / - `tlsConfig` still win. + Defaults `scheme: https` when `metrics.secure` is true and + `serviceMonitor.scheme` is unset. + +### Added + +- `metrics.serviceMonitor.insecureSkipVerify` (default `false`). When true and + `metrics.secure` is true and `serviceMonitor.tlsConfig` is empty, injects + `tlsConfig.insecureSkipVerify` for the operator's self-signed metrics cert. + Explicit `serviceMonitor.tlsConfig` always wins. ## 0.4.0 diff --git a/valkey-operator/README.md b/valkey-operator/README.md index 86233fd3..07f855a8 100644 --- a/valkey-operator/README.md +++ b/valkey-operator/README.md @@ -1,6 +1,6 @@ # valkey-operator -![Version: 0.4.0](https://img.shields.io/badge/Version-0.4.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: v0.4.0](https://img.shields.io/badge/AppVersion-v0.4.0-informational?style=flat-square) +![Version: 0.4.1](https://img.shields.io/badge/Version-0.4.1-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: v0.4.0](https://img.shields.io/badge/AppVersion-v0.4.0-informational?style=flat-square) A Helm chart for deploying the [Valkey Operator](https://github.com/valkey-io/valkey-operator) on Kubernetes. @@ -73,8 +73,9 @@ See [values.yaml](values.yaml) for the full list of configurable parameters. | `metrics.serviceMonitor.annotations` | Annotations for the ServiceMonitor | `{}` | | `metrics.serviceMonitor.interval` | Scrape interval | `""` | | `metrics.serviceMonitor.scrapeTimeout` | Scrape timeout | `""` | -| `metrics.serviceMonitor.scheme` | HTTP scheme used for scraping | `""` | -| `metrics.serviceMonitor.tlsConfig` | TLS configuration used when scraping | `{}` | +| `metrics.serviceMonitor.scheme` | Scrape scheme. Empty: `https` when `metrics.secure` is true, else Prometheus default (`http`) | `""` | +| `metrics.serviceMonitor.insecureSkipVerify` | When `metrics.secure` is true and `tlsConfig` is empty, set `tlsConfig.insecureSkipVerify` for the self-signed metrics cert (opt-in) | `false` | +| `metrics.serviceMonitor.tlsConfig` | Full scrape TLS config; when set, overrides `insecureSkipVerify` | `{}` | | `metrics.serviceMonitor.honorLabels` | Keep labels from the scraped target on collision | `false` | | `metrics.serviceMonitor.relabelings` | relabelings applied before scraping | `[]` | | `metrics.serviceMonitor.metricRelabelings` | metricRelabelings applied before ingestion | `[]` | @@ -170,6 +171,54 @@ metrics: Both `metrics.secure` and `metrics.reader.binding.create` default to `false`, so existing installs keep serving metrics over insecure HTTP unless you opt in. +### ServiceMonitor + +Set `metrics.serviceMonitor.enabled: true` to create a Prometheus Operator ServiceMonitor +for the operator metrics Service. The endpoint **port name** always matches the metrics +Service: `http` when `metrics.secure` is `false`, `https` when it is `true`. + +When `metrics.secure` is `true`: + +- If `serviceMonitor.scheme` is empty, the chart sets `scheme: https`. +- The operator's metrics cert is self-signed by default. Scrapes will fail TLS + verification until you either: + - set `serviceMonitor.insecureSkipVerify: true` (opt-in; injects + `tlsConfig.insecureSkipVerify`), or + - set `serviceMonitor.tlsConfig` yourself (e.g. a CA). Explicit `tlsConfig` wins + over `insecureSkipVerify`. + +Example with secure metrics and a ServiceMonitor that accepts the self-signed cert: + +```yaml +metrics: + secure: true + reader: + binding: + create: true + serviceAccountName: prometheus + namespace: monitoring + serviceMonitor: + enabled: true + labels: + # match your Prometheus serviceMonitorSelector + release: prometheus + insecureSkipVerify: true +``` + +Example with a custom CA instead of skip-verify: + +```yaml +metrics: + secure: true + serviceMonitor: + enabled: true + tlsConfig: + ca: + secret: + name: operator-metrics-ca + key: ca.crt +``` + ## Source Code * diff --git a/valkey-operator/templates/servicemonitor.yaml b/valkey-operator/templates/servicemonitor.yaml index cfa4db30..2d481e20 100644 --- a/valkey-operator/templates/servicemonitor.yaml +++ b/valkey-operator/templates/servicemonitor.yaml @@ -32,9 +32,8 @@ spec: {{- if .Values.metrics.serviceMonitor.tlsConfig }} tlsConfig: {{- toYaml .Values.metrics.serviceMonitor.tlsConfig | nindent 6 }} - {{- else if .Values.metrics.secure }} - # Operator metrics use a self-signed cert by default; scrapers must skip verify - # unless a custom tlsConfig is provided. + {{- else if and .Values.metrics.secure .Values.metrics.serviceMonitor.insecureSkipVerify }} + # Opt-in: operator metrics use a self-signed cert by default. tlsConfig: insecureSkipVerify: true {{- end }} diff --git a/valkey-operator/values.yaml b/valkey-operator/values.yaml index 54eb8a72..084631e3 100644 --- a/valkey-operator/values.yaml +++ b/valkey-operator/values.yaml @@ -238,9 +238,12 @@ metrics: # HTTP scheme used for scraping. When empty: https if metrics.secure is true, # otherwise Prometheus defaults to http. scheme: "" - # TLS configuration used when scraping the endpoint. When empty and - # metrics.secure is true, insecureSkipVerify is set so the operator's - # self-signed metrics cert scrapes successfully. Set explicitly to override. + # When metrics.secure is true and tlsConfig is empty, set + # tlsConfig.insecureSkipVerify so scrapers accept the operator's self-signed + # metrics cert. Defaults to false (opt-in). Ignored when tlsConfig is set. + insecureSkipVerify: false + # Full TLS configuration for the scrape endpoint. When set, wins over + # insecureSkipVerify. Use this to trust a real CA instead of skip-verify. tlsConfig: {} # Keep labels from the scraped target on collision with server-side labels honorLabels: false From d3dd6812995c2649d14afdee7c020a258c7e7493 Mon Sep 17 00:00:00 2001 From: daanvinken Date: Thu, 30 Jul 2026 21:43:08 +0200 Subject: [PATCH 3/3] chore(valkey-operator): bump chart to 0.4.2 after rebase 0.4.1 already shipped on main with the log level description change. Move the ServiceMonitor secure-metrics fix notes to 0.4.2. Signed-off-by: daanvinken --- valkey-operator/CHANGELOG.md | 12 +++++++----- valkey-operator/Chart.yaml | 2 +- valkey-operator/README.md | 2 +- 3 files changed, 9 insertions(+), 7 deletions(-) diff --git a/valkey-operator/CHANGELOG.md b/valkey-operator/CHANGELOG.md index 1559dc2f..6cdbc4cd 100644 --- a/valkey-operator/CHANGELOG.md +++ b/valkey-operator/CHANGELOG.md @@ -1,10 +1,6 @@ # Changelog -## 0.4.1 - -### Changed - -- Add log level configuration example to valkey-operator deployment. +## 0.4.2 ### Fixed @@ -21,6 +17,12 @@ `tlsConfig.insecureSkipVerify` for the operator's self-signed metrics cert. Explicit `serviceMonitor.tlsConfig` always wins. +## 0.4.1 + +### Changed + +- Add log level configuration example to valkey-operator deployment. + ## 0.4.0 - Valkey Operator version defaults to v0.4.0. See the [v0.4.0 release notes](https://github.com/valkey-io/valkey-operator/releases/tag/v0.4.0) for the upstream changes. diff --git a/valkey-operator/Chart.yaml b/valkey-operator/Chart.yaml index cbebbdd4..6b72ee64 100644 --- a/valkey-operator/Chart.yaml +++ b/valkey-operator/Chart.yaml @@ -2,7 +2,7 @@ apiVersion: v2 name: valkey-operator description: A Helm chart for the Valkey Operator type: application -version: 0.4.1 +version: 0.4.2 appVersion: "v0.4.0" kubeVersion: ">=1.20.0-0" home: https://valkey.io/valkey-helm/ diff --git a/valkey-operator/README.md b/valkey-operator/README.md index 07f855a8..cfa6a7ff 100644 --- a/valkey-operator/README.md +++ b/valkey-operator/README.md @@ -1,6 +1,6 @@ # valkey-operator -![Version: 0.4.1](https://img.shields.io/badge/Version-0.4.1-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: v0.4.0](https://img.shields.io/badge/AppVersion-v0.4.0-informational?style=flat-square) +![Version: 0.4.2](https://img.shields.io/badge/Version-0.4.2-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: v0.4.0](https://img.shields.io/badge/AppVersion-v0.4.0-informational?style=flat-square) A Helm chart for deploying the [Valkey Operator](https://github.com/valkey-io/valkey-operator) on Kubernetes.