assets,pkg: regenerate

Signed-off-by: Simon Pasquier <spasquie@redhat.com>
openshift · Apr 3, 2020 · d7b8427 · d7b8427
1 parent 1ea8e3c
commit d7b8427
Show file tree

Hide file tree

Showing 5 changed files with 88 additions and 8 deletions.
diff --git a/assets/thanos-querier/deployment.yaml b/assets/thanos-querier/deployment.yaml
@@ -131,6 +131,29 @@ spec:
             cpu: 1m
             memory: 20Mi
         terminationMessagePolicy: FallbackToLogsOnError
+      - args:
+        - --secure-listen-address=0.0.0.0:9093
+        - --upstream=http://127.0.0.1:9095
+        - --config-file=/etc/kube-rbac-proxy/config.yaml
+        - --tls-cert-file=/etc/tls/private/tls.crt
+        - --tls-private-key-file=/etc/tls/private/tls.key
+        - --tls-cipher-suites=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_RSA_WITH_AES_128_CBC_SHA256,TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256
+        - --logtostderr=true
+        image: quay.io/coreos/kube-rbac-proxy:v0.4.1
+        name: kube-rbac-proxy-alerts
+        ports:
+        - containerPort: 9093
+          name: tenancy-alerts
+        resources:
+          requests:
+            cpu: 1m
+            memory: 20Mi
+        terminationMessagePolicy: FallbackToLogsOnError
+        volumeMounts:
+        - mountPath: /etc/tls/private
+          name: secret-thanos-querier-tls
+        - mountPath: /etc/kube-rbac-proxy
+          name: secret-thanos-querier-kube-rbac-proxy-alerts
       priorityClassName: system-cluster-critical
       securityContext: {}
       serviceAccountName: thanos-querier
@@ -148,3 +171,6 @@ spec:
       - name: secret-thanos-querier-kube-rbac-proxy
         secret:
           secretName: thanos-querier-kube-rbac-proxy
+      - name: secret-thanos-querier-kube-rbac-proxy-alerts
+        secret:
+          secretName: thanos-querier-kube-rbac-proxy-alerts
diff --git a/assets/thanos-querier/kube-rbac-proxy-alerts-secret.yaml b/assets/thanos-querier/kube-rbac-proxy-alerts-secret.yaml
@@ -0,0 +1,19 @@
+apiVersion: v1
+data: {}
+kind: Secret
+metadata:
+  labels:
+    k8s-app: thanos
+  name: thanos-querier-kube-rbac-proxy-alerts
+  namespace: openshift-monitoring
+stringData:
+  config.yaml: |-
+    "authorization":
+      "resourceAttributes":
+        "apiGroups": "monitoring.coreos.com"
+        "namespace": "{{ .Value }}"
+        "resource": "prometheusrules"
+      "rewrites":
+        "byQueryParameter":
+          "name": "namespace"
+type: Opaque
diff --git a/assets/thanos-querier/kube-rbac-proxy-secret.yaml b/assets/thanos-querier/kube-rbac-proxy-secret.yaml
@@ -1,10 +1,19 @@
 apiVersion: v1
-data:
-  config.yaml: ImF1dGhvcml6YXRpb24iOgogICJyZXNvdXJjZUF0dHJpYnV0ZXMiOgogICAgImFwaVZlcnNpb24iOiAibWV0cmljcy5rOHMuaW8vdjFiZXRhMSIKICAgICJuYW1lc3BhY2UiOiAie3sgLlZhbHVlIH19IgogICAgInJlc291cmNlIjogInBvZHMiCiAgInJld3JpdGVzIjoKICAgICJieVF1ZXJ5UGFyYW1ldGVyIjoKICAgICAgIm5hbWUiOiAibmFtZXNwYWNlIg==
+data: {}
 kind: Secret
 metadata:
   labels:
     k8s-app: thanos
   name: thanos-querier-kube-rbac-proxy
   namespace: openshift-monitoring
+stringData:
+  config.yaml: |-
+    "authorization":
+      "resourceAttributes":
+        "apiVersion": "metrics.k8s.io/v1beta1"
+        "namespace": "{{ .Value }}"
+        "resource": "pods"
+      "rewrites":
+        "byQueryParameter":
+          "name": "namespace"
 type: Opaque
diff --git a/assets/thanos-querier/service.yaml b/assets/thanos-querier/service.yaml
@@ -15,6 +15,9 @@ spec:
   - name: tenancy
     port: 9092
     targetPort: tenancy
+  - name: tenancy-alerts
+    port: 9093
+    targetPort: tenancy-alerts
   selector:
     app.kubernetes.io/name: thanos-querier
   type: ClusterIP