typhoon/addons/prometheus/rbac/cluster-role.yaml

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: prometheus
rules:
- apiGroups: [""]
  resources:
  - nodes
  - nodes/metrics
  - services
  - endpoints
  - pods
  verbs:
  - get
  - list
  - watch
- nonResourceURLs: ["/metrics"]
  verbs: ["get"]
- apiGroups:
  - networking.k8s.io
  resources:
  - ingresses
  verbs:
  - get
  - list
  - watch
addons: Switch to apps/v1 workload APIs * Deployments now belong to the apps/v1 API group * DaemonSets now belong to the apps/v1 API group * RBAC types now belong to the rbac.authorization.k8s.io/v1 API group 2018-02-10 23:51:55 -08:00			`apiVersion: rbac.authorization.k8s.io/v1`
addons: Include Prometheus and node-exporter manifests 2017-10-22 17:00:41 -07:00			`kind: ClusterRole`
			`metadata:`
			`name: prometheus`
			`rules:`
			`- apiGroups: [""]`
			`resources:`
			`- nodes`
Configure Prometheus to scrape Kubelets directly * Use Kubelet bearer token authn/authz to scrape metrics * Drop RBAC permission from nodes/proxy to nodes/metrics * Stop proxying kubelet scrapes through the apiserver, since this required higher privilege (nodes/proxy) and can add load to the apiserver on large clusters 2018-05-13 23:49:45 -07:00			`- nodes/metrics`
addons: Include Prometheus and node-exporter manifests 2017-10-22 17:00:41 -07:00			`- services`
			`- endpoints`
			`- pods`
Add Prometheus config for monitoring Kubernetes Ingress * Allow Kubernetes Ingress resources to be probed via Blackbox Exporter (if present) if annotated `prometheus.io/probe: "true"` * Fix probes of Services via Blackbox Exporter. Require Blackbox Exporter to be deployed in the same `monitoring` namespace, be named `blackbox-exporter`, and use port 8080 2021-12-29 11:51:11 -08:00			`verbs:`
			`- get`
			`- list`
			`- watch`
addons: Include Prometheus and node-exporter manifests 2017-10-22 17:00:41 -07:00			`- nonResourceURLs: ["/metrics"]`
			`verbs: ["get"]`
Add Prometheus config for monitoring Kubernetes Ingress * Allow Kubernetes Ingress resources to be probed via Blackbox Exporter (if present) if annotated `prometheus.io/probe: "true"` * Fix probes of Services via Blackbox Exporter. Require Blackbox Exporter to be deployed in the same `monitoring` namespace, be named `blackbox-exporter`, and use port 8080 2021-12-29 11:51:11 -08:00			`- apiGroups:`
			`- networking.k8s.io`
			`resources:`
			`- ingresses`
			`verbs:`
			`- get`
			`- list`
			`- watch`