-
Notifications
You must be signed in to change notification settings - Fork 380
MON-4383: feat(auto_docs_examples): adjust and add more examples #2573
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
base: main
Are you sure you want to change the base?
Conversation
machine424
commented
Feb 28, 2025
- I added CHANGELOG entry for this change.
- No user facing changes, so no entry in CHANGELOG was needed.
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: machine424 The full list of commands accepted by this bot can be found here. The pull request process is described here
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
Issues go stale after 90d of inactivity. Mark the issue as fresh by commenting If this issue is safe to close now please do so with /lifecycle stale |
Stale issues rot after 30d of inactivity. Mark the issue as fresh by commenting If this issue is safe to close now please do so with /lifecycle rotten |
Rotten issues close after 30d of inactivity. Reopen the issue by commenting /close |
@openshift-bot: Closed this PR. In response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
/reopen |
@machine424: Reopened this PR. In response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
--serviceaccount=test-alertmanager-tenancy-monitoring-rules-edit:am-client | ||
TOKEN=$(oc create token am-client --namespace=test-alertmanager-tenancy-monitoring-rules-edit) | ||
CA_CERT=$(oc get secret router-certs-default -n openshift-ingress -o jsonpath='{.data.tls\.crt}' | base64 --decode) | ||
curl --cacert <(printf "%s" "$CA_CERT") --fail -H "Authorization: Bearer $TOKEN" "https://alertmanager-main.openshift-monitoring:9092/api/v2/alerts?namespace=test-alertmanager-tenancy-monitoring-rules-edit" |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
echo
8b95877
to
93e521a
Compare
s + '.' | ||
else if namespace != '' then | ||
s + ' in the `%s` project.' | ||
s + ' in the `%s` project.' % namespace |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
this is needed for the PR
338bdea
to
7475bb0
Compare
/retitle MON-4383: feat(auto_docs_examples): adjust and add more examples |
@machine424: This pull request references MON-4383 which is a valid jira issue. Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the task to target the "4.21.0" version, but no target version was set. In response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
/retest-required |
/skip |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Hello @machine424 I have added a few suggestions for the wording and format. Thanks!
$ curl -k -H "Authorization: Bearer $TOKEN" "https://$ROUTE/api/v2/alerts?filter=alertname=Watchdog" | ||
# The endpoints can also be accessed from within the cluster. | ||
$ curl -k -H "Authorization: Bearer $TOKEN" "https://alertmanager-main.openshift-monitoring:9094/api/v2/alerts?filter=alertname=Watchdog" | ||
---- |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
A few small suggestions for better flow:
---- | |
+ | |
The following example exercises permissions granted by the `monitoring-alertmanager-view` role. The binding commands must be run by a user with the necessary privileges. | |
+ | |
[source,terminal] | |
---- | |
# Create a test namespace and a service account. | |
$ oc create namespace test-alertmanager-web-monitoring-alertmanager-view | |
$ oc create serviceaccount am-client --namespace=test-alertmanager-web-monitoring-alertmanager-view | |
# Bind the role to the service account. | |
# The binding in this example is applied to a service account but can also be applied to any user. | |
$ oc create rolebinding test-alertmanager-web-monitoring-alertmanager-view \ | |
--namespace=openshift-monitoring \ | |
--role=monitoring-alertmanager-view \ | |
--serviceaccount=test-alertmanager-web-monitoring-alertmanager-view:am-client | |
# Generate a token to access the endpoints. | |
$ TOKEN=$(oc create token am-client --namespace=test-alertmanager-web-monitoring-alertmanager-view) | |
# Access Alertmanager endpoints externally. | |
$ ROUTE=$(oc get route alertmanager-main --namespace=openshift-monitoring -ojsonpath={.spec.host}) | |
$ curl -k -H "Authorization: Bearer $TOKEN" "https://$ROUTE/api/v2/alerts?filter=alertname=Watchdog" | |
# Access Alertmanager endpoints from within the cluster. | |
$ curl -k -H "Authorization: Bearer $TOKEN" "https://alertmanager-main.openshift-monitoring:9094/api/v2/alerts?filter=alertname=Watchdog" | |
---- |
---- | ||
# The following example exercises permissions granted by the monitoring-alertmanager-edit Role. | ||
# The binding commands are supposed to run by a user with the necessary privileges. | ||
$ oc create namespace test-alertmanager-web-monitoring-alertmanager-edit |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
---- | |
# The following example exercises permissions granted by the monitoring-alertmanager-edit Role. | |
# The binding commands are supposed to run by a user with the necessary privileges. | |
$ oc create namespace test-alertmanager-web-monitoring-alertmanager-edit | |
+ | |
The following example exercises permissions granted by the `monitoring-alertmanager-edit` role. The binding commands must be run by a user with the necessary privileges. | |
+ | |
[source,terminal] | |
---- | |
# Create a test namespace and a service account. | |
$ oc create namespace test-alertmanager-web-monitoring-alertmanager-edit |
$ oc create serviceaccount am-client --namespace=test-alertmanager-web-monitoring-alertmanager-edit | ||
# The binding is done to a ServiceAccount, but it can also be applied to any other user. | ||
$ oc create rolebinding test-alertmanager-web-monitoring-alertmanager-edit \ | ||
--namespace=openshift-monitoring \ | ||
--role=monitoring-alertmanager-edit \ | ||
--serviceaccount=test-alertmanager-web-monitoring-alertmanager-edit:am-client |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
$ oc create serviceaccount am-client --namespace=test-alertmanager-web-monitoring-alertmanager-edit | |
# The binding is done to a ServiceAccount, but it can also be applied to any other user. | |
$ oc create rolebinding test-alertmanager-web-monitoring-alertmanager-edit \ | |
--namespace=openshift-monitoring \ | |
--role=monitoring-alertmanager-edit \ | |
--serviceaccount=test-alertmanager-web-monitoring-alertmanager-edit:am-client | |
$ oc create serviceaccount am-client --namespace=test-alertmanager-web-monitoring-alertmanager-edit | |
# Bind the role to the service account. | |
# The binding in this example is applied to a service account but can also be applied to any user. | |
$ oc create rolebinding test-alertmanager-web-monitoring-alertmanager-edit \ | |
--namespace=openshift-monitoring \ | |
--role=monitoring-alertmanager-edit \ | |
--serviceaccount=test-alertmanager-web-monitoring-alertmanager-edit:am-client |
# The token can then be used to access the endpoints on the port. | ||
$ TOKEN=$(oc create token am-client --namespace=test-alertmanager-web-monitoring-alertmanager-edit) |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
# The token can then be used to access the endpoints on the port. | |
$ TOKEN=$(oc create token am-client --namespace=test-alertmanager-web-monitoring-alertmanager-edit) | |
# Generate a token to access the endpoints on the port. | |
$ TOKEN=$(oc create token am-client --namespace=test-alertmanager-web-monitoring-alertmanager-edit) |
$ ROUTE=$(oc get route alertmanager-main --namespace=openshift-monitoring -ojsonpath={.spec.host}) | ||
$ curl -k -X POST "https://$ROUTE/api/v2/silences" \ |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
$ ROUTE=$(oc get route alertmanager-main --namespace=openshift-monitoring -ojsonpath={.spec.host}) | |
$ curl -k -X POST "https://$ROUTE/api/v2/silences" \ | |
# Access Alertmanager endpoints externally. | |
$ ROUTE=$(oc get route alertmanager-main --namespace=openshift-monitoring -ojsonpath={.spec.host}) | |
$ curl -k -X POST "https://$ROUTE/api/v2/silences" \ |
---- | ||
---- | ||
# The following example exercises permissions granted by the monitoring-edit Cluster Role. | ||
# The binding commands are supposed to run by a user with the necessary privileges. | ||
$ oc create namespace test-thanos-querier-tenancy-rules-monitoring-edit |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
---- | |
---- | |
# The following example exercises permissions granted by the monitoring-edit Cluster Role. | |
# The binding commands are supposed to run by a user with the necessary privileges. | |
$ oc create namespace test-thanos-querier-tenancy-rules-monitoring-edit | |
---- | |
+ | |
The following example exercises permissions granted by the `monitoring-edit` cluster role. The binding commands must be run by a user with the necessary privileges. | |
+ | |
[source,terminal] | |
---- | |
# Create a test namespace and a service account. | |
$ oc create namespace test-thanos-querier-tenancy-rules-monitoring-edit |
# The binding commands are supposed to run by a user with the necessary privileges. | ||
$ oc create namespace test-thanos-querier-tenancy-rules-monitoring-edit | ||
$ oc create serviceaccount thanos-client --namespace=test-thanos-querier-tenancy-rules-monitoring-edit | ||
# The binding is done to a Service Account, but it can also be applied to any other user. |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
# The binding is done to a Service Account, but it can also be applied to any other user. | |
# Bind the role to the service account. | |
# The binding in this example is applied to a service account but can also be applied to any user. |
--namespace=test-thanos-querier-tenancy-rules-monitoring-edit \ | ||
--clusterrole=monitoring-edit \ | ||
--serviceaccount=test-thanos-querier-tenancy-rules-monitoring-edit:thanos-client | ||
# The token can then be used to access the endpoints. |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
# The token can then be used to access the endpoints. | |
# Generate a token to access the endpoints. |
--serviceaccount=test-thanos-querier-tenancy-rules-monitoring-edit:thanos-client | ||
# The token can then be used to access the endpoints. | ||
$ TOKEN=$(oc create token thanos-client --namespace=test-thanos-querier-tenancy-rules-monitoring-edit) | ||
# Because the port is not exposed by default, the endpoint is assumed to be accessed from within the cluster. |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
# Because the port is not exposed by default, the endpoint is assumed to be accessed from within the cluster. | |
# Access Alertmanager endpoints from within the cluster. The port is not exposed externally by default. |
---- | ||
---- | ||
# The following example exercises permissions granted by the monitoring-rules-view Cluster Role. | ||
# The binding commands are supposed to run by a user with the necessary privileges. | ||
$ oc create namespace test-thanos-querier-tenancy-rules-monitoring-rules-view | ||
$ oc create serviceaccount thanos-client --namespace=test-thanos-querier-tenancy-rules-monitoring-rules-view | ||
# The binding is done to a Service Account, but it can also be applied to any other user. | ||
$ oc create rolebinding test-thanos-querier-tenancy-rules-monitoring-rules-view \ | ||
--namespace=test-thanos-querier-tenancy-rules-monitoring-rules-view \ | ||
--clusterrole=monitoring-rules-view \ | ||
--serviceaccount=test-thanos-querier-tenancy-rules-monitoring-rules-view:thanos-client | ||
# The token can then be used to access the endpoints. | ||
$ TOKEN=$(oc create token thanos-client --namespace=test-thanos-querier-tenancy-rules-monitoring-rules-view) | ||
# Because the port is not exposed by default, the endpoint is assumed to be accessed from within the cluster. | ||
$ curl -k -f -H "Authorization: Bearer $TOKEN" "https://thanos-querier.openshift-monitoring:9093/api/v1/rules?namespace=test-thanos-querier-tenancy-rules-monitoring-rules-view" | ||
$ curl -k -f -H "Authorization: Bearer $TOKEN" "https://thanos-querier.openshift-monitoring:9093/api/v1/alerts?namespace=test-thanos-querier-tenancy-rules-monitoring-rules-view" | ||
---- |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
---- | |
---- | |
# The following example exercises permissions granted by the monitoring-rules-view Cluster Role. | |
# The binding commands are supposed to run by a user with the necessary privileges. | |
$ oc create namespace test-thanos-querier-tenancy-rules-monitoring-rules-view | |
$ oc create serviceaccount thanos-client --namespace=test-thanos-querier-tenancy-rules-monitoring-rules-view | |
# The binding is done to a Service Account, but it can also be applied to any other user. | |
$ oc create rolebinding test-thanos-querier-tenancy-rules-monitoring-rules-view \ | |
--namespace=test-thanos-querier-tenancy-rules-monitoring-rules-view \ | |
--clusterrole=monitoring-rules-view \ | |
--serviceaccount=test-thanos-querier-tenancy-rules-monitoring-rules-view:thanos-client | |
# The token can then be used to access the endpoints. | |
$ TOKEN=$(oc create token thanos-client --namespace=test-thanos-querier-tenancy-rules-monitoring-rules-view) | |
# Because the port is not exposed by default, the endpoint is assumed to be accessed from within the cluster. | |
$ curl -k -f -H "Authorization: Bearer $TOKEN" "https://thanos-querier.openshift-monitoring:9093/api/v1/rules?namespace=test-thanos-querier-tenancy-rules-monitoring-rules-view" | |
$ curl -k -f -H "Authorization: Bearer $TOKEN" "https://thanos-querier.openshift-monitoring:9093/api/v1/alerts?namespace=test-thanos-querier-tenancy-rules-monitoring-rules-view" | |
---- | |
---- | |
+ | |
The following example exercises permissions granted by the `monitoring-rules-view` cluster role. The binding commands must be run by a user with the necessary privileges. | |
+ | |
[source,terminal] | |
---- | |
# Create a test namespace and a service account. | |
$ oc create namespace test-thanos-querier-tenancy-rules-monitoring-rules-view | |
$ oc create serviceaccount thanos-client --namespace=test-thanos-querier-tenancy-rules-monitoring-rules-view | |
# Bind the role to the service account. | |
# The binding in this example is applied to a service account but can also be applied to any user. | |
$ oc create rolebinding test-thanos-querier-tenancy-rules-monitoring-rules-view \ | |
--namespace=test-thanos-querier-tenancy-rules-monitoring-rules-view \ | |
--clusterrole=monitoring-rules-view \ | |
--serviceaccount=test-thanos-querier-tenancy-rules-monitoring-rules-view:thanos-client | |
# Generate a token to access the endpoints. | |
$ TOKEN=$(oc create token thanos-client --namespace=test-thanos-querier-tenancy-rules-monitoring-rules-view) | |
# Access Alertmanager endpoints from within the cluster. The port is not exposed externally by default. | |
$ curl -k -f -H "Authorization: Bearer $TOKEN" "https://thanos-querier.openshift-monitoring:9093/api/v1/rules?namespace=test-thanos-querier-tenancy-rules-monitoring-rules-view" | |
$ curl -k -f -H "Authorization: Bearer $TOKEN" "https://thanos-querier.openshift-monitoring:9093/api/v1/alerts?namespace=test-thanos-querier-tenancy-rules-monitoring-rules-view" | |
---- |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Hello @machine424 I have added a few suggestions for the wording and format. Thanks!
@machine424: The following tests failed, say
Full PR test history. Your PR dashboard. Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |