Graham McIntire
e1274bc63b
Cluster-side: - Deploy kube-state-metrics (kube-system) for cluster-state series. - Deploy node-exporter DaemonSet on all 7 nodes via the new monitoring ns (privileged PSS, hostNetwork, read-only host mounts). - Both managed by ArgoCD apps under home/cluster/argocd/apps/. Prometheus-side: - Replace direct pod-IP scraping (which can't reach the 10.244.0.0/16 pod network from outside the cluster) with API-server-proxy scraping for both Services and Pods. Now one target per pod, all healthy. - Extend external Prometheus RBAC with services/proxy + pods/proxy. Grafana-side: - Add file-based dashboard provisioner; ship 5 standard dashboards (Node Exporter Full, k8s cluster-via-prometheus, k8s all-in-one, k8s monitoring, Prometheus 2.0 overview). prom.w5isp.com:3000 now shows live data for all 7 cluster nodes plus the prom host itself.
61 lines
1.4 KiB
YAML
61 lines
1.4 KiB
YAML
---
|
|
# RBAC for an external Prometheus on prom.w5isp.com to scrape home-cluster.
|
|
# Apply once with `kubectl apply -f k8s-rbac.yaml`.
|
|
apiVersion: v1
|
|
kind: Namespace
|
|
metadata:
|
|
name: prometheus-external
|
|
---
|
|
apiVersion: v1
|
|
kind: ServiceAccount
|
|
metadata:
|
|
name: prometheus
|
|
namespace: prometheus-external
|
|
---
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: ClusterRole
|
|
metadata:
|
|
name: prometheus-external
|
|
rules:
|
|
- apiGroups: [""]
|
|
resources:
|
|
- nodes
|
|
- nodes/proxy
|
|
- nodes/metrics
|
|
- services
|
|
- services/proxy
|
|
- endpoints
|
|
- pods
|
|
- pods/proxy
|
|
verbs: ["get", "list", "watch"]
|
|
- apiGroups:
|
|
- extensions
|
|
- networking.k8s.io
|
|
resources:
|
|
- ingresses
|
|
verbs: ["get", "list", "watch"]
|
|
- nonResourceURLs: ["/metrics", "/metrics/cadvisor"]
|
|
verbs: ["get"]
|
|
---
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: ClusterRoleBinding
|
|
metadata:
|
|
name: prometheus-external
|
|
roleRef:
|
|
apiGroup: rbac.authorization.k8s.io
|
|
kind: ClusterRole
|
|
name: prometheus-external
|
|
subjects:
|
|
- kind: ServiceAccount
|
|
name: prometheus
|
|
namespace: prometheus-external
|
|
---
|
|
# Long-lived bearer token Secret for the SA (k8s 1.24+ no longer auto-creates one).
|
|
apiVersion: v1
|
|
kind: Secret
|
|
metadata:
|
|
name: prometheus-token
|
|
namespace: prometheus-external
|
|
annotations:
|
|
kubernetes.io/service-account.name: prometheus
|
|
type: kubernetes.io/service-account-token
|