[prometheus-pushgateway] add support for basicAuth in ServiceMonitor

charts/prometheus-pushgateway/.helmignore

@@ -21,4 +21,6 @@
 *.tmproj
 
 # OWNERS file for Kubernetes
-OWNERS
+OWNERS
+
+ci/

charts/prometheus-pushgateway/Chart.yaml

@@ -2,7 +2,7 @@ apiVersion: v2
 appVersion: "v1.11.0"
 description: A Helm chart for prometheus pushgateway
 name: prometheus-pushgateway
-version: 3.0.0
+version: 3.1.0
 home: https://github.com/prometheus/pushgateway
 sources:
   - https://github.com/prometheus/pushgateway

charts/prometheus-pushgateway/ci/basic-auth-values.yaml

@@ -0,0 +1,4 @@
+---
+webConfiguration:
+  basicAuthUsers:
+    job: A7ERGdgwLHnY

charts/prometheus-pushgateway/ci/servicemonitor-basicauth-secret-values.yaml

@@ -0,0 +1,15 @@
+---
+webConfiguration:
+  basicAuthUsers:
+    job: A7ERGdgwLHnY
+
+serviceMonitor:
+  enabled: true
+  namespace: null
+  basicAuth:
+    password:
+      name: smsecret
+      key: password
+    username:
+      name: smsecret
+      key: username

charts/prometheus-pushgateway/ci/servicemonitor-basicauth-values.yaml

@@ -0,0 +1,8 @@
+---
+webConfiguration:
+  basicAuthUsers:
+    job: A7ERGdgwLHnY
+
+serviceMonitor:
+  enabled: true
+  namespace: null

charts/prometheus-pushgateway/templates/_helpers.tpl

@@ -131,6 +131,17 @@ Define Authorization
 {{- $user }}:{{ $password }}
 {{- end }}
 
+{{/*
+Define basicAuth
+*/}}
+{{- define "prometheus-pushgateway.basicAuth" -}}
+{{- $users := keys .Values.webConfiguration.basicAuthUsers }}
+{{- $user := first $users }}
+{{- $password := index .Values.webConfiguration.basicAuthUsers $user -}}
+user: {{ $user | b64enc | quote }}
+password: {{ $password | b64enc | quote }}
+{{- end }}
+
 {{/*
 Returns pod spec
 */}}

charts/prometheus-pushgateway/templates/secret.yaml

@@ -8,3 +8,16 @@ metadata:
 data:
   web-config.yaml: {{ include "prometheus-pushgateway.webConfiguration" . | b64enc}}
 {{- end }}
+---
+{{- if and .Values.webConfiguration .Values.serviceMonitor.enabled (empty .Values.serviceMonitor.basicAuth) }}
+apiVersion: v1
+kind: Secret
+metadata:
+  name: {{ include "prometheus-pushgateway.fullname" . }}-basic-auth
+  namespace: {{ default (include "prometheus-pushgateway.namespace" .) .Values.serviceMonitor.namespace }}
+  labels:
+    {{- include "prometheus-pushgateway.defaultLabels" . | nindent 4 }}
+data:
+  {{- include "prometheus-pushgateway.basicAuth" . | nindent 2 }}
+type: Opaque
+{{- end }}

charts/prometheus-pushgateway/templates/servicemonitor.yaml

@@ -8,11 +8,7 @@ metadata:
     {{- toYaml .Values.serviceMonitor.additionalLabels | nindent 4 }}
     {{- end }}
   name: {{ include "prometheus-pushgateway.fullname" .  }}
-  {{- if .Values.serviceMonitor.namespace }}
-  namespace: {{ .Values.serviceMonitor.namespace }}
-  {{- else }}
-  namespace: {{ template "prometheus-pushgateway.namespace" . }}
-  {{- end }}
+  namespace: {{ default (include "prometheus-pushgateway.namespace" .) .Values.serviceMonitor.namespace }}
 spec:
   endpoints:
   - port: {{ .Values.service.portName }}
@@ -22,6 +18,17 @@ spec:
     {{- with .Values.serviceMonitor.scheme }}
     scheme: {{ . }}
     {{- end }}
+    {{- if and .Values.webConfiguration (empty .Values.serviceMonitor.basicAuth) }}
+    basicAuth:
+      password:
+        name: {{ include "prometheus-pushgateway.fullname" . }}-basic-auth
+        key: password
+      username:
+        name: {{ include "prometheus-pushgateway.fullname" . }}-basic-auth
+        key: user
+    {{- else if not (empty .Values.serviceMonitor.basicAuth) }}
+    basicAuth: {{ toYaml .Values.serviceMonitor.basicAuth | nindent 6 }}
+    {{- end }}
     {{- with .Values.serviceMonitor.bearerTokenFile }}
     bearerTokenFile: {{ . }}
     {{- end }}

charts/prometheus-pushgateway/values.yaml

@@ -110,6 +110,8 @@ resources: {}
 
 # -- Sets web configuration
 # To enable basic authentication, provide basicAuthUsers as a map
+# If serviceMonitor.enabled is set, a secret with these credentials will be created
+# and configured in serviceMonitor. serviceMonitor.basicAuth overrides this secret.
 webConfiguration: {}
   # basicAuthUsers:
   #   username: password
@@ -252,18 +254,24 @@ serviceMonitor:
   telemetryPath: "/metrics"
 
   # Fallback to the prometheus default unless specified
-  # interval: 10s
+  interval: ""
 
   ## scheme: HTTP scheme to use for scraping. Can be used with `tlsConfig` for example if using istio mTLS.
-  # scheme: ""
+  scheme: ""
+
+  ## Basic authentication
+  basicAuth: {}
+
+  ## Bearer token file
+  bearerTokenFile: ""
 
   ## tlsConfig: TLS configuration to use when scraping the endpoint. For example if using istio mTLS.
   ## Of type: https://github.com/coreos/prometheus-operator/blob/master/Documentation/api.md#tlsconfig
-  # tlsConfig: {}
+  tlsConfig: {}
 
   # bearerTokenFile:
   # Fallback to the prometheus default unless specified
-  # scrapeTimeout: 30s
+  scrapeTimeout: ""
 
   ## Used to pass Labels that are used by the Prometheus installed in your cluster to select Service Monitors to work with
   ## ref: https://github.com/coreos/prometheus-operator/blob/master/Documentation/api.md#prometheusspec