typhoon/addons/prometheus/rbac/cluster-role.yaml

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: prometheus
rules:
- apiGroups: [""]
  resources:
  - nodes
  - nodes/metrics
  - services
  - endpoints
  - pods
  verbs: ["get", "list", "watch"]
- nonResourceURLs: ["/metrics"]
  verbs: ["get"]
addons: Switch to apps/v1 workload APIs * Deployments now belong to the apps/v1 API group * DaemonSets now belong to the apps/v1 API group * RBAC types now belong to the rbac.authorization.k8s.io/v1 API group 2018-02-10 23:51:55 -08:00			`apiVersion: rbac.authorization.k8s.io/v1`
addons: Include Prometheus and node-exporter manifests 2017-10-22 17:00:41 -07:00			`kind: ClusterRole`
			`metadata:`
			`name: prometheus`
			`rules:`
			`- apiGroups: [""]`
			`resources:`
			`- nodes`
Configure Prometheus to scrape Kubelets directly * Use Kubelet bearer token authn/authz to scrape metrics * Drop RBAC permission from nodes/proxy to nodes/metrics * Stop proxying kubelet scrapes through the apiserver, since this required higher privilege (nodes/proxy) and can add load to the apiserver on large clusters 2018-05-13 23:49:45 -07:00			`- nodes/metrics`
addons: Include Prometheus and node-exporter manifests 2017-10-22 17:00:41 -07:00			`- services`
			`- endpoints`
			`- pods`
			`verbs: ["get", "list", "watch"]`
			`- nonResourceURLs: ["/metrics"]`
			`verbs: ["get"]`