asmhatreandClaude Opus 5
a065696478
Companion code for "Deploying Spring Boot 4 on Kubernetes: Probes, Graceful Shutdown, Limits and JVM Ergonomics". A dependency outage under three probe-group setups, a rolling restart under load four ways (three runs each), the JVM's ergonomic choices for nine pod shapes, one GC-heavy load under five CPU limits with throttling counters, and an HPA driven by a Micrometer gauge through prometheus-adapter. Measured on k3s v1.36.4. Co-Authored-By: Claude Opus 5 <[email protected]> Claude-Session: https://claude.ai/code/session_01C3TETMrqVUWeFkNtz3Jbo3
113 lines
4.2 KiB
YAML
113 lines
4.2 KiB
YAML
# prometheus-adapter v0.12.0 serving custom.metrics.k8s.io from one rule: the Micrometer gauge
|
|
# app.inflight.requests, which Prometheus stores as app_inflight_requests.
|
|
apiVersion: v1
|
|
kind: ServiceAccount
|
|
metadata: {name: prometheus-adapter, namespace: monitoring}
|
|
---
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: ClusterRole
|
|
metadata: {name: prometheus-adapter}
|
|
rules:
|
|
- apiGroups: [""]
|
|
resources: [namespaces, pods, services, nodes]
|
|
verbs: [get, list, watch]
|
|
---
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: ClusterRoleBinding
|
|
metadata: {name: prometheus-adapter}
|
|
roleRef: {apiGroup: rbac.authorization.k8s.io, kind: ClusterRole, name: prometheus-adapter}
|
|
subjects: [{kind: ServiceAccount, name: prometheus-adapter, namespace: monitoring}]
|
|
---
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: ClusterRoleBinding
|
|
metadata: {name: prometheus-adapter-auth-delegator}
|
|
roleRef: {apiGroup: rbac.authorization.k8s.io, kind: ClusterRole, name: system:auth-delegator}
|
|
subjects: [{kind: ServiceAccount, name: prometheus-adapter, namespace: monitoring}]
|
|
---
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: RoleBinding
|
|
metadata: {name: prometheus-adapter-auth-reader, namespace: kube-system}
|
|
roleRef: {apiGroup: rbac.authorization.k8s.io, kind: Role, name: extension-apiserver-authentication-reader}
|
|
subjects: [{kind: ServiceAccount, name: prometheus-adapter, namespace: monitoring}]
|
|
---
|
|
# The HPA controller reads custom metrics as this service account.
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: ClusterRole
|
|
metadata: {name: custom-metrics-reader}
|
|
rules:
|
|
- apiGroups: [custom.metrics.k8s.io]
|
|
resources: ["*"]
|
|
verbs: [get, list]
|
|
---
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: ClusterRoleBinding
|
|
metadata: {name: hpa-custom-metrics-reader}
|
|
roleRef: {apiGroup: rbac.authorization.k8s.io, kind: ClusterRole, name: custom-metrics-reader}
|
|
subjects: [{kind: ServiceAccount, name: horizontal-pod-autoscaler, namespace: kube-system}]
|
|
---
|
|
apiVersion: v1
|
|
kind: ConfigMap
|
|
metadata: {name: prometheus-adapter, namespace: monitoring}
|
|
data:
|
|
config.yaml: |
|
|
rules:
|
|
# Micrometer "app.inflight.requests" -> Prometheus "app_inflight_requests" (dots become
|
|
# underscores; a gauge gets no suffix). The series carries namespace/pod labels from the
|
|
# scrape config, which is how the adapter attributes it to a pod.
|
|
- seriesQuery: 'app_inflight_requests{namespace!="",pod!=""}'
|
|
resources:
|
|
overrides:
|
|
namespace: {resource: namespace}
|
|
pod: {resource: pod}
|
|
name:
|
|
matches: "^app_inflight_requests$"
|
|
as: "app_inflight_requests"
|
|
metricsQuery: 'avg_over_time(<<.Series>>{<<.LabelMatchers>>}[30s])'
|
|
---
|
|
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata: {name: prometheus-adapter, namespace: monitoring}
|
|
spec:
|
|
replicas: 1
|
|
selector: {matchLabels: {app: prometheus-adapter}}
|
|
template:
|
|
metadata: {labels: {app: prometheus-adapter}}
|
|
spec:
|
|
serviceAccountName: prometheus-adapter
|
|
containers:
|
|
- name: adapter
|
|
image: registry.k8s.io/prometheus-adapter/prometheus-adapter:v0.12.0
|
|
imagePullPolicy: Never
|
|
args:
|
|
- --prometheus-url=http://prometheus.monitoring.svc:9090/
|
|
- --metrics-relist-interval=15s
|
|
- --config=/etc/adapter/config.yaml
|
|
- --secure-port=6443
|
|
- --cert-dir=/tmp/cert
|
|
ports: [{containerPort: 6443}]
|
|
resources: {requests: {cpu: 50m, memory: 64Mi}, limits: {memory: 256Mi}}
|
|
volumeMounts:
|
|
- {name: config, mountPath: /etc/adapter}
|
|
- {name: tmp, mountPath: /tmp}
|
|
volumes:
|
|
- {name: config, configMap: {name: prometheus-adapter}}
|
|
- {name: tmp, emptyDir: {}}
|
|
---
|
|
apiVersion: v1
|
|
kind: Service
|
|
metadata: {name: prometheus-adapter, namespace: monitoring}
|
|
spec:
|
|
selector: {app: prometheus-adapter}
|
|
ports: [{port: 443, targetPort: 6443}]
|
|
---
|
|
apiVersion: apiregistration.k8s.io/v1
|
|
kind: APIService
|
|
metadata: {name: v1beta1.custom.metrics.k8s.io}
|
|
spec:
|
|
service: {name: prometheus-adapter, namespace: monitoring}
|
|
group: custom.metrics.k8s.io
|
|
version: v1beta1
|
|
insecureSkipTLSVerify: true # the adapter generated a self-signed cert; use cert-manager in real clusters
|
|
groupPriorityMinimum: 100
|
|
versionPriority: 100
|