Merge pull request #443 from frobware/two-tier-metrics-agent-collection

Decouple metrics from hostNetwork using proxy DaemonSet

Author: dave-tucker

Containerfile.bpfman-agent

@@ -23,6 +23,7 @@ COPY . .
 # the docker BUILDPLATFORM arg will be linux/arm64 when for Apple x86 it will be linux/amd64. Therefore,
 # by leaving it empty we can ensure that the container and binary shipped on it will have the same platform.
 RUN CGO_ENABLED=0 GOOS=${TARGETOS:-linux} GOARCH=${TARGETARCH} go build -mod vendor -o bpfman-agent ./cmd/bpfman-agent/main.go
+RUN CGO_ENABLED=0 GOOS=${TARGETOS:-linux} GOARCH=${TARGETARCH} go build -mod vendor -o metrics-proxy ./cmd/metrics-proxy/main.go
 
 
 FROM --platform=$BUILDPLATFORM docker.io/library/golang:1.24 AS cri-tools-build
@@ -59,6 +60,7 @@ ARG TARGETPLATFORM
 
 WORKDIR /
 COPY --from=bpfman-agent-build /usr/src/bpfman-operator/bpfman-agent .
+COPY --from=bpfman-agent-build /usr/src/bpfman-operator/metrics-proxy .
 
 # Install crictl
 COPY --from=cri-tools-build /usr/src/cri-tools/crictl /usr/local/bin

Containerfile.bpfman-operator

@@ -38,6 +38,7 @@ ARG TARGETPLATFORM
 WORKDIR /
 COPY --from=bpfman-operator-build /usr/src/bpfman-operator/config/bpfman-deployment/daemonset.yaml ./config/bpfman-deployment/daemonset.yaml
 COPY --from=bpfman-operator-build /usr/src/bpfman-operator/config/bpfman-deployment/csidriverinfo.yaml ./config/bpfman-deployment/csidriverinfo.yaml
+COPY --from=bpfman-operator-build /usr/src/bpfman-operator/config/bpfman-deployment/metrics-proxy-daemonset.yaml ./config/bpfman-deployment/metrics-proxy-daemonset.yaml
 COPY --from=bpfman-operator-build /usr/src/bpfman-operator/config/openshift/restricted-scc.yaml ./config/openshift/restricted-scc.yaml
 COPY --from=bpfman-operator-build /usr/src/bpfman-operator/bpfman-operator .
 USER 65532:65532

Makefile

@@ -310,6 +310,12 @@ test-integration: ## Run Integration tests.
 		  kustomization.yaml.env > kustomization.yaml
 	GOFLAGS="-tags=integration_tests" go test -count=1 -race -v ./test/integration/...
 
+.PHONY: test-integration-local
+test-integration-local: ## Run Integration tests against existing deployment. Use TEST= to specify test pattern.
+	USE_EXISTING_KIND_CLUSTER=$(shell kubectl config current-context | sed 's/kind-//') \
+	SKIP_BPFMAN_DEPLOY=true \
+	GOFLAGS="-tags=integration_tests" go test -count=1 -race -v ./test/integration $(if $(TEST),-run $(TEST),)
+
 ## The physical bundle is no longer tracked in git since it should be considered
 ## and treated as a release artifact, rather than something that's updated
 ## as part of a pull request.
@@ -337,6 +343,7 @@ build-release-yamls: generate kustomize ## Generate the crd install bundle for a
 build: fmt ## Build bpfman-operator and bpfman-agent binaries.
 	CGO_ENABLED=0 GOOS=linux GOARCH=$(GOARCH) go build -mod vendor -o bin/bpfman-operator cmd/bpfman-operator/main.go
 	CGO_ENABLED=0 GOOS=linux GOARCH=$(GOARCH) go build -mod vendor -o bin/bpfman-agent cmd/bpfman-agent/main.go
+	CGO_ENABLED=0 GOOS=linux GOARCH=$(GOARCH) go build -mod vendor -o bin/metrics-proxy cmd/metrics-proxy/main.go
 
 # These paths map the host's GOCACHE location to the container's
 # location. We want to mount the host's Go cache in the container to

bundle/manifests/bpfman-agent-metrics-monitor_monitoring.coreos.com_v1_servicemonitor.yaml

@@ -12,7 +12,7 @@ metadata:
 spec:
   endpoints:
   - bearerTokenFile: /var/run/secrets/kubernetes.io/serviceaccount/token
-    path: /metrics
+    path: /agent-metrics
     port: https-metrics
     scheme: https
     tlsConfig:

bundle/manifests/bpfman-agent-metrics-service_v1_service.yaml

@@ -13,12 +13,13 @@ metadata:
     app.kubernetes.io/part-of: bpfman-operator
   name: bpfman-agent-metrics-service
 spec:
+  clusterIP: None
   ports:
   - name: https-metrics
     port: 8443
     protocol: TCP
     targetPort: https-metrics
   selector:
-    name: bpfman-daemon
+    name: bpfman-metrics-proxy
 status:
   loadBalancer: {}

bundle/manifests/bpfman-config_v1_configmap.yaml

@@ -3,7 +3,6 @@ data:
   bpfman.agent.healthprobe.addr: :8175
   bpfman.agent.image: quay.io/bpfman/bpfman-agent:latest
   bpfman.agent.log.level: info
-  bpfman.agent.metric.addr: :8443
   bpfman.image: quay.io/bpfman/bpfman:latest
   bpfman.log.level: info
   bpfman.toml: |

bundle/manifests/bpfman-metrics-reader_rbac.authorization.k8s.io_v1_clusterrole.yaml

@@ -13,5 +13,6 @@ metadata:
 rules:
 - nonResourceURLs:
   - /metrics
+  - /agent-metrics
   verbs:
   - get

bundle/manifests/bpfman-operator.clusterserviceversion.yaml

@@ -994,7 +994,7 @@ metadata:
     capabilities: Basic Install
     categories: OpenShift Optional
     containerImage: quay.io/bpfman/bpfman-operator:latest
-    createdAt: "2025-05-13T16:53:16Z"
+    createdAt: "2025-06-03T12:16:50Z"
     description: The bpfman Operator is designed to manage eBPF programs for applications.
     features.operators.openshift.io/cnf: "false"
     features.operators.openshift.io/cni: "false"

bundle/manifests/bpfman-prometheus-metrics-reader_rbac.authorization.k8s.io_v1_clusterrolebinding.yaml

@@ -0,0 +1,20 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  creationTimestamp: null
+  labels:
+    app.kubernetes.io/component: metrics
+    app.kubernetes.io/created-by: bpfman-operator
+    app.kubernetes.io/instance: prometheus-metrics-reader
+    app.kubernetes.io/managed-by: kustomize
+    app.kubernetes.io/name: clusterrolebinding
+    app.kubernetes.io/part-of: bpfman-operator
+  name: bpfman-prometheus-metrics-reader
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: bpfman-metrics-reader
+subjects:
+- kind: ServiceAccount
+  name: prometheus-k8s
+  namespace: openshift-monitoring