Fix PodMonitor rbac #960
Merged
Fix PodMonitor rbac #960
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
In order for prometheus to be able to scrape the metallb endpoints, we need to provide the right set of permissions. Here we change the podmonitor template adding the permissions, making both the prometheus service account and the prometheus namespace configurable. Signed-off-by: Federico Paolinelli <fpaoline@redhat.com>
In order to allow prometheus to scrape the endpoints of both the speaker and the controller, we add a manifest containing the two PodMonitor instances and the permissions needed by the operator to be able to access those pods. Signed-off-by: Federico Paolinelli <fpaoline@redhat.com>
fedepaol
requested review from
daxmc99,
johananl,
rata and
russellb
as code owners
|
cc @gclawes |
|
lgtm, and confirmed with @fedepaol that he was able to test the helm changes |
paulfantom
reviewed
Oct 31, 2021
Comment on lines
+1
to
+29
| apiVersion: monitoring.coreos.com/v1 | ||
| kind: PodMonitor | ||
| metadata: | ||
| name: metallb-controller | ||
| spec: | ||
| selector: | ||
| matchLabels: | ||
| component: controller | ||
| namespaceSelector: | ||
| matchNames: | ||
| - metallb-system | ||
| podMetricsEndpoints: | ||
| - port: monitoring | ||
| path: /metrics | ||
| --- | ||
| apiVersion: monitoring.coreos.com/v1 | ||
| kind: PodMonitor | ||
| metadata: | ||
| name: metallb-speaker | ||
| spec: | ||
| selector: | ||
| matchLabels: | ||
| component: speaker | ||
| namespaceSelector: | ||
| matchNames: | ||
| - metallb-system | ||
| podMetricsEndpoints: | ||
| - port: monitoring | ||
| path: /metrics |
There was a problem hiding this comment.
Using the following selector allows reducing this to a single PodMonitor object:
selector:
matchLabels:
app: metallb
Full example: https://github.com/thaum-xyz/ankhmorpork/blob/master/base/metallb-system/config/podmonitor.yaml
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
When using metallb in combination with the prometheus operator, we need to grant prometheus permission to read the pods.
Here, we fix that by creating the required role / rolebinding.
On top of that, a new
prometheus-operator.yamlmanifest is created under manifests to allow the same configuration when deploying from manifests.