K8SPSMDB-1268 Documented support for PMM 3 #261

nastena1606 · 2025-09-19T10:03:12Z

modified: docs/assets/fragments/monitor-db.txt
modified: docs/monitoring.md

modified: docs/assets/fragments/monitor-db.txt modified: docs/monitoring.md

Copilot

Pull Request Overview

Documents Operator support for PMM 3 alongside PMM 2, updates links to PMM 3 docs, and revises setup instructions (authentication and secrets) accordingly.

Update PMM references/links from PMM 2 to PMM 3, including QAN and pmm-admin docs
Add PMM 3 authentication flow (Grafana service accounts) and secret keys guidance
Adjust OS-specific tab labels and clarify configuration examples

Reviewed Changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 11 comments.

File	Description
docs/monitoring.md	Updates profiling/QAN links to PMM 3, refines examples and OS tab headings, and keeps secret patch examples
docs/assets/fragments/monitor-db.txt	Reworks monitoring section to cover PMM 2 and PMM 3, adds auth/secret instructions for both, reorganizes install flow and references

_{Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.}

docs/monitoring.md

docs/assets/fragments/monitor-db.txt

docs/monitoring.md

Copilot · 2025-09-19T10:08:05Z

docs/assets/fragments/monitor-db.txt

+        Key using `curl` and `jq` utilities. Replace `<login>:<password>@<server_host>` placeholders with your real PMM Server login, password, and hostname in the following command:
+
+        ``` {.bash data-prompt="$" }
+        $ API_KEY=$(curl --insecure -X POST -H "Content-Type: application/json" -d '{"name":"operator", "role": "Admin"}' "https://<login>:<password>@<server_host>/graph/api/auth/keys" | jq .key)


The Secret name in the example output is singular ('...-secret') but the docs and YAML use plural ('my-cluster-name-secrets'). Change to secret/my-cluster-name-secrets created.

docs/assets/fragments/monitor-db.txt

Copilot · 2025-09-19T10:08:06Z

docs/assets/fragments/monitor-db.txt

-1. Authorize PMM Client within PMM Server. 
+### Configure authentication
+
+=== "PMM3"


[nitpick] For consistency with the rest of the document ('PMM 2', 'PMM 3'), use a space in the tab labels: 'PMM 3' and 'PMM 2'.

Copilot · 2025-09-19T10:08:06Z

docs/assets/fragments/monitor-db.txt

+
+        When you create a service account token, you can select its lifetime: it can be either a permanent token that never expires or the one with the expiration date. PMM server cannot rotate service account tokens after they expire. So you must take care of reconfiguring PMM Client in this case.
+
+=== "PMM2"


[nitpick] For consistency with the rest of the document ('PMM 2', 'PMM 3'), use a space in the tab labels: 'PMM 3' and 'PMM 2'.

Co-authored-by: Copilot <[email protected]>

egegunes · 2025-09-22T08:06:09Z

docs/assets/fragments/monitor-db.txt


-        2. Edit the [deploy/secrets.yaml :octicons-link-external-16:](https://github.com/percona/percona-server-mongodb-operator/blob/main/deploy/secrets.yaml) secrets file and specify the PMM API key for the ``PMM_SERVER_API_KEY`` option.
-        3. Apply the configuration for the changes to take effect.
+        The API key is not rotated. 


i don't get this warning

I think it is about the fact that our API keys (same as tokens) aren't going to be rotated automatically, and the user has to rotate them manually.

Some linves above we mention:

When you create a service account token, you can select its lifetime: it can be either a permanent token that never expires or the one with the expiration date. PMM server cannot rotate service account tokens after they expire. So you must take care of reconfiguring PMM Client in this case.

Maybe we should clarify that further for the API keys (used for PMM2).

gkech · 2025-09-30T08:37:29Z

docs/assets/fragments/monitor-db.txt

+
+=== "PMM3"
+
+    PMM3 uses Grafana service accounts to control access to PMM server components and resources. To authenticate in PMM server, you need a service account token. [Generate a service account and token :octicons-link-external-16:](https://docs.percona.com/percona-monitoring-and-management/3/api/authentication.html?h=authe#generate-a-service-account-and-token). Specify the Admin role for the service account.


Should we mention Grafana here? I think we can omit this.

gkech · 2025-09-30T08:39:04Z

docs/assets/fragments/monitor-db.txt


-        2. Edit the [deploy/secrets.yaml :octicons-link-external-16:](https://github.com/percona/percona-server-mongodb-operator/blob/main/deploy/secrets.yaml) secrets file and specify the PMM API key for the ``PMM_SERVER_API_KEY`` option.
-        3. Apply the configuration for the changes to take effect.
+        The API key is not rotated. 


I think it is about the fact that our API keys (same as tokens) aren't going to be rotated automatically, and the user has to rotate them manually.

gkech · 2025-09-30T08:39:41Z

docs/assets/fragments/monitor-db.txt


-        2. Edit the [deploy/secrets.yaml :octicons-link-external-16:](https://github.com/percona/percona-server-mongodb-operator/blob/main/deploy/secrets.yaml) secrets file and specify the PMM API key for the ``PMM_SERVER_API_KEY`` option.
-        3. Apply the configuration for the changes to take effect.
+        The API key is not rotated. 


Some linves above we mention:

When you create a service account token, you can select its lifetime: it can be either a permanent token that never expires or the one with the expiration date. PMM server cannot rotate service account tokens after they expire. So you must take care of reconfiguring PMM Client in this case.

Maybe we should clarify that further for the API keys (used for PMM2).

gkech · 2025-09-30T08:50:03Z

docs/assets/fragments/monitor-db.txt


-        2. Apply the configuration for the changes to take effect.
+        ```{.text .no-copy}
+        secret/my-cluster-name-secret created


I think this should be plural, given that before we mentioned my-cluster-name-secrets

gkech · 2025-09-30T08:55:16Z

docs/monitoring.md

+=== ":simple-linux: on Linux"

    ```{.bash data-prompt="$"}
    $ kubectl patch secret/my-cluster-name-secrets -p '{"data":{"PMM_SERVER_API_KEY": '$(echo -n new_key | base64 --wrap=0)'}}'


Should we use TOKEN here for the example? Mainly because it is our recommended version.

gkech · 2025-09-30T08:55:23Z

docs/monitoring.md

+=== ":simple-apple: on macOS"

    ```{.bash data-prompt="$"}
    $ kubectl patch secret/my-cluster-name-secrets -p '{"data":{"PMM_SERVER_API_KEY": '$(echo -n new_key | base64)'}}'


Should we use TOKEN here for the example? Mainly because it is our recommended version.

gkech · 2025-09-30T11:18:18Z

docs/assets/fragments/monitor-db.txt

    !!! warning

-        The API key is not rotated. 
+        The API key is not rotated automatically when it expired. You must manually recreate it and reconfigure the PMM Client. 


I think we need to use simple present here i.e. automatically when it expires

K8SPSMDB-1268 Documented support for PMM 3

c472fba

modified: docs/assets/fragments/monitor-db.txt modified: docs/monitoring.md

nastena1606 requested a review from Copilot September 19, 2025 10:03

it-percona deployed to K8SPSMDB-1268-Doc-PMM3 - percona-mongodb-operator PR #261 September 19, 2025 10:03 — with Render View deployment

Copilot AI reviewed Sep 19, 2025

View reviewed changes

Update docs/monitoring.md

27cbed3

Co-authored-by: Copilot <[email protected]>

it-percona temporarily deployed to K8SPSMDB-1268-Doc-PMM3 - percona-mongodb-operator PR #261 September 19, 2025 11:54 — with Render Destroyed

Update docs/assets/fragments/monitor-db.txt

37600a0

Co-authored-by: Copilot <[email protected]>

it-percona temporarily deployed to K8SPSMDB-1268-Doc-PMM3 - percona-mongodb-operator PR #261 September 19, 2025 11:55 — with Render Destroyed

Update docs/assets/fragments/monitor-db.txt

97e0e8b

Co-authored-by: Copilot <[email protected]>

it-percona temporarily deployed to K8SPSMDB-1268-Doc-PMM3 - percona-mongodb-operator PR #261 September 19, 2025 11:55 — with Render Destroyed

it-percona deployed to K8SPSMDB-1268-Doc-PMM3 - percona-mongodb-operator PR #261 September 19, 2025 11:56 — with Render View deployment

Update docs/assets/fragments/monitor-db.txt

44c14c6

Co-authored-by: Copilot <[email protected]>

nastena1606 force-pushed the K8SPSMDB-1268-Doc-PMM3 branch from df74b7b to 44c14c6 Compare September 19, 2025 11:58

it-percona deployed to K8SPSMDB-1268-Doc-PMM3 - percona-mongodb-operator PR #261 September 19, 2025 11:58 — with Render View deployment

nastena1606 requested review from egegunes and gkech September 19, 2025 11:58

egegunes reviewed Sep 22, 2025

View reviewed changes

gkech reviewed Sep 30, 2025

View reviewed changes

Updated after the review

52bf631

it-percona deployed to K8SPSMDB-1268-Doc-PMM3 - percona-mongodb-operator PR #261 September 30, 2025 09:19 — with Render View deployment

gkech reviewed Sep 30, 2025

View reviewed changes

Updated after the review

c9b5dd9

it-percona deployed to K8SPSMDB-1268-Doc-PMM3 - percona-mongodb-operator PR #261 September 30, 2025 11:25 — with Render View deployment

gkech approved these changes Sep 30, 2025

View reviewed changes

nastena1606 added the pending release PR is ready to be included in the upcoming release label Sep 30, 2025

egegunes approved these changes Oct 3, 2025

View reviewed changes


		When you create a service account token, you can select its lifetime: it can be either a permanent token that never expires or the one with the expiration date. PMM server cannot rotate service account tokens after they expire. So you must take care of reconfiguring PMM Client in this case.

		=== "PMM2"


		=== "PMM3"

		PMM3 uses Grafana service accounts to control access to PMM server components and resources. To authenticate in PMM server, you need a service account token. [Generate a service account and token :octicons-link-external-16:](https://docs.percona.com/percona-monitoring-and-management/3/api/authentication.html?h=authe#generate-a-service-account-and-token). Specify the Admin role for the service account.

K8SPSMDB-1268 Documented support for PMM 3 #261

Are you sure you want to change the base?

K8SPSMDB-1268 Documented support for PMM 3 #261

Uh oh!

Conversation

nastena1606 commented Sep 19, 2025

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Reviewed Changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI Sep 19, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Copilot AI Sep 19, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Sep 19, 2025

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants