mirror of
https://github.com/NVIDIA/OpenShell.git
synced 2026-10-20 06:00:06 +08:00
Emilien Macchianddivesh
8b3cc3fdc0
* feat(server): add gateway capacity metrics and optional HPA Expose per-replica supervisor sessions, pending relay capacity, relay rejections and claim latency, and outbound peer request outcomes and latency. Use bounded labels and Prometheus histograms for the new latency metrics while preserving existing summary metrics. Add an optional Helm HPA with external-database and resource validation, conservative scale-down defaults, and support for custom metrics. Keep certificate hook pods outside gateway workload selectors. Document per-pod scraping, scaling limits, upgrade behavior, and PostgreSQL connection sizing. Part of #3528 Signed-off-by: Emilien Macchi <emacchi@redhat.com> * feat(server): unify routing metrics and clarify replica capacity Combine local relay setup and outbound peer requests in one counter, labeled by operation, route, target, outcome, and gRPC status. Preserve peer latency metrics. Rename the rejection reason from global_capacity to replica_capacity to reflect the per-replica relay budget. Keep capacity limits unchanged. Update tests and documentation. Signed-off-by: divesh <dgude@nvidia.com> * fix(server): align routed request metric labels and outcomes Count a local relay as successful only when its supervisor claims it, the same event that answers a peer relay on the owner, and rename the outcomes to local_error and remote_error so they say where an attempt failed. Label the peer latency histogram by operation, like the routed request counter, and rename the target label to relay_kind so it does not read as the Prometheus scrape target. Rename RelayCapacity.global to per_replica, drop the per-sandbox relay capacity gauge, which no per-sandbox series can pair with, describe the latency histogram as peer-only, and restore the note that unavailable spikes are expected during rollouts. Part of #3528 Signed-off-by: Emilien Macchi <emacchi@redhat.com> --------- Signed-off-by: Emilien Macchi <emacchi@redhat.com> Signed-off-by: divesh <dgude@nvidia.com> Co-authored-by: divesh <dgude@nvidia.com>
152 lines
4.8 KiB
YAML
152 lines
4.8 KiB
YAML
# SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
|
|
# SPDX-License-Identifier: Apache-2.0
|
|
|
|
suite: certgen hook
|
|
templates:
|
|
- templates/certgen.yaml
|
|
release:
|
|
name: openshell
|
|
namespace: my-namespace
|
|
|
|
tests:
|
|
- it: renders combined TLS and JWT certgen hook by default
|
|
template: templates/certgen.yaml
|
|
asserts:
|
|
- hasDocuments:
|
|
count: 4
|
|
- equal:
|
|
path: kind
|
|
value: Job
|
|
documentIndex: 3
|
|
- contains:
|
|
path: spec.template.spec.containers[0].args
|
|
content: "--server-secret-name=openshell-server-tls"
|
|
documentIndex: 3
|
|
- contains:
|
|
path: spec.template.spec.containers[0].args
|
|
content: "--client-secret-name=openshell-client-tls"
|
|
documentIndex: 3
|
|
- contains:
|
|
path: spec.template.spec.containers[0].args
|
|
content: "--jwt-secret-name=openshell-jwt-keys"
|
|
documentIndex: 3
|
|
- notContains:
|
|
path: spec.template.spec.containers[0].args
|
|
content: "--jwt-only"
|
|
documentIndex: 3
|
|
|
|
- it: renders JWT-only certgen hook when cert-manager owns TLS
|
|
template: templates/certgen.yaml
|
|
set:
|
|
certManager.enabled: true
|
|
pkiInitJob.enabled: false
|
|
asserts:
|
|
- hasDocuments:
|
|
count: 4
|
|
- equal:
|
|
path: kind
|
|
value: Job
|
|
documentIndex: 3
|
|
- contains:
|
|
path: spec.template.spec.containers[0].args
|
|
content: "--jwt-only"
|
|
documentIndex: 3
|
|
- contains:
|
|
path: spec.template.spec.containers[0].args
|
|
content: "--jwt-secret-name=openshell-jwt-keys"
|
|
documentIndex: 3
|
|
- notContains:
|
|
path: spec.template.spec.containers[0].args
|
|
content: "--server-secret-name=openshell-server-tls"
|
|
documentIndex: 3
|
|
- notContains:
|
|
path: spec.template.spec.containers[0].args
|
|
content: "--client-secret-name=openshell-client-tls"
|
|
documentIndex: 3
|
|
|
|
- it: uses the configured sandbox JWT secret name
|
|
template: templates/certgen.yaml
|
|
set:
|
|
server.sandboxJwt.signingSecretName: custom-jwt-keys
|
|
asserts:
|
|
- contains:
|
|
path: spec.template.spec.containers[0].args
|
|
content: "--jwt-secret-name=custom-jwt-keys"
|
|
documentIndex: 3
|
|
|
|
- it: renders JWT-only hook when cert-manager is enabled even if pkiInitJob remains enabled
|
|
template: templates/certgen.yaml
|
|
set:
|
|
certManager.enabled: true
|
|
pkiInitJob.enabled: true
|
|
pkiInitJob.serverDnsNames:
|
|
- extra.example.test
|
|
pkiInitJob.serverIpAddresses:
|
|
- 192.0.2.10
|
|
asserts:
|
|
- hasDocuments:
|
|
count: 4
|
|
- equal:
|
|
path: kind
|
|
value: Job
|
|
documentIndex: 3
|
|
- contains:
|
|
path: spec.template.spec.containers[0].args
|
|
content: "--jwt-only"
|
|
documentIndex: 3
|
|
- contains:
|
|
path: spec.template.spec.containers[0].args
|
|
content: "--jwt-secret-name=openshell-jwt-keys"
|
|
documentIndex: 3
|
|
- notContains:
|
|
path: spec.template.spec.containers[0].args
|
|
content: "--server-secret-name=openshell-server-tls"
|
|
documentIndex: 3
|
|
- notContains:
|
|
path: spec.template.spec.containers[0].args
|
|
content: "--client-secret-name=openshell-client-tls"
|
|
documentIndex: 3
|
|
- notContains:
|
|
path: spec.template.spec.containers[0].args
|
|
content: "--server-san=extra.example.test"
|
|
documentIndex: 3
|
|
- notContains:
|
|
path: spec.template.spec.containers[0].args
|
|
content: "--server-san=192.0.2.10"
|
|
documentIndex: 3
|
|
|
|
- it: labels hook pods so that gateway selectors do not match them
|
|
template: templates/certgen.yaml
|
|
asserts:
|
|
- equal:
|
|
path: spec.template.metadata.labels
|
|
value:
|
|
app.kubernetes.io/name: openshell-certgen
|
|
app.kubernetes.io/instance: openshell
|
|
app.kubernetes.io/component: certgen
|
|
documentIndex: 3
|
|
- notEqual:
|
|
path: spec.template.metadata.labels["app.kubernetes.io/name"]
|
|
value: openshell
|
|
documentIndex: 3
|
|
|
|
- it: labels the backend CA hook pod so that gateway selectors do not match it
|
|
template: templates/certgen.yaml
|
|
set:
|
|
certManager.enabled: true
|
|
grpcRoute.backendTLSPolicy.enabled: true
|
|
asserts:
|
|
- hasDocuments:
|
|
count: 5
|
|
- equal:
|
|
path: metadata.name
|
|
value: openshell-certgen-backend-ca
|
|
documentIndex: 4
|
|
- equal:
|
|
path: spec.template.metadata.labels
|
|
value:
|
|
app.kubernetes.io/name: openshell-certgen
|
|
app.kubernetes.io/instance: openshell
|
|
app.kubernetes.io/component: certgen
|
|
documentIndex: 4
|