[stable/prometheus] add support for running without cluster-admin privileges (#23049)

* add support for running on kubernetes setups (such as openshift) where you only have access to your own namespaces

Signed-off-by: Klavs Klavsen <klavs@EnableIT.dk>

* bump chart versions

Signed-off-by: Klavs Klavsen <klavs@EnableIT.dk>

* reverted kube-state-metrics so this branch is only about prometheus chart

Signed-off-by: Klavs Klavsen <klavs@EnableIT.dk>

* signing

Signed-off-by: Klavs Klavsen <klavs@enableit.dk>

* lint fix

Signed-off-by: Klavs Klavsen <klavs@EnableIT.dk>

* lint fix

Signed-off-by: Klavs Klavsen <klavs@EnableIT.dk>

stable/prometheus/Chart.yaml

@@ -1,6 +1,6 @@
 apiVersion: v1
 name: prometheus
-version: 11.6.1
+version: 11.6.2
 appVersion: 2.19.0
 description: Prometheus is a monitoring system and time series database.
 home: https://prometheus.io/

stable/prometheus/templates/alertmanager-clusterrole.yaml

@@ -1,4 +1,4 @@
-{{- if and .Values.alertmanager.enabled .Values.rbac.create -}}
+{{- if and .Values.alertmanager.enabled .Values.rbac.create .Values.alertmanager.useClusterRole -}}
 apiVersion: rbac.authorization.k8s.io/v1beta1
 kind: ClusterRole
 metadata:

stable/prometheus/templates/alertmanager-clusterrolebinding.yaml

@@ -1,4 +1,4 @@
-{{- if and .Values.alertmanager.enabled .Values.rbac.create -}}
+{{- if and .Values.alertmanager.enabled .Values.rbac.create .Values.alertmanager.useClusterRole -}}
 apiVersion: rbac.authorization.k8s.io/v1beta1
 kind: ClusterRoleBinding
 metadata:

stable/prometheus/templates/alertmanager-role.yaml

@@ -0,0 +1,24 @@
+{{- if and .Values.alertmanager.enabled .Values.rbac.create (eq .Values.alertmanager.useClusterRole false) -}}
+{{- range $.Values.alertmanager.namespaces }}
+apiVersion: rbac.authorization.k8s.io/v1beta1
+kind: Role
+metadata:
+  labels:
+    {{- include "prometheus.alertmanager.labels" $ | nindent 4 }}
+  name: {{ template "prometheus.alertmanager.fullname" $ }}
+  namespace: {{ . }}
+rules:
+{{- if $.Values.podSecurityPolicy.enabled }}
+  - apiGroups:
+    - extensions
+    resources:
+    - podsecuritypolicies
+    verbs:
+    - use
+    resourceNames:
+    - {{ template "prometheus.alertmanager.fullname" $ }}
+{{- else }}
+  []
+{{- end }}
+{{- end }}
+{{- end }}

stable/prometheus/templates/alertmanager-rolebinding.yaml

@@ -0,0 +1,19 @@
+{{- if and .Values.alertmanager.enabled .Values.rbac.create (eq .Values.alertmanager.useClusterRole false) -}}
+{{ range $.Values.alertmanager.namespaces }}
+apiVersion: rbac.authorization.k8s.io/v1beta1
+kind: RoleBinding
+metadata:
+  labels:
+    {{- include "prometheus.alertmanager.labels" $ | nindent 4 }}
+  name: {{ template "prometheus.alertmanager.fullname" $ }}
+  namespace: {{ . }}
+subjects:
+  - kind: ServiceAccount
+    name: {{ template "prometheus.serviceAccountName.alertmanager" $ }}
+{{ include "prometheus.namespace" $ | indent 4 }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: {{ template "prometheus.alertmanager.fullname" $ }}
+{{- end }}
+{{ end }}

stable/prometheus/templates/server-clusterrole.yaml

@@ -1,4 +1,4 @@
-{{- if and .Values.server.enabled .Values.rbac.create -}}
+{{- if and .Values.server.enabled .Values.rbac.create (empty .Values.server.useExistingClusterRoleName) -}}
 apiVersion: rbac.authorization.k8s.io/v1beta1
 kind: ClusterRole
 metadata:

stable/prometheus/templates/server-clusterrolebinding.yaml

@@ -1,4 +1,4 @@
-{{- if and .Values.server.enabled .Values.rbac.create -}}
+{{- if and .Values.server.enabled .Values.rbac.create (empty .Values.server.namespaces) (empty .Values.server.useExistingClusterRoleName) -}}
 apiVersion: rbac.authorization.k8s.io/v1beta1
 kind: ClusterRoleBinding
 metadata:

stable/prometheus/templates/server-rolebinding.yaml

@@ -0,0 +1,20 @@
+{{- if and .Values.server.enabled .Values.rbac.create .Values.server.useExistingClusterRoleName .Values.server.namespaces -}}
+{{ range $.Values.server.namespaces -}}
+---
+apiVersion: rbac.authorization.k8s.io/v1beta1
+kind: RoleBinding
+metadata:
+  labels:
+    {{- include "prometheus.server.labels" $ | nindent 4 }}
+  name: {{ template "prometheus.server.fullname" $ }}
+  namespace: {{ . }}
+subjects:
+  - kind: ServiceAccount
+    name: {{ template "prometheus.serviceAccountName.server" $ }}
+{{ include "prometheus.namespace" $ | indent 4 }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: {{ $.Values.server.useExistingClusterRoleName }}
+{{ end -}}
+{{ end -}}

stable/prometheus/values.yaml

@@ -32,6 +32,11 @@ alertmanager:
   ##
   enabled: true
 
+  ## Use a ClusterRole (and ClusterRoleBinding)
+  ## - If set to false, we define a Role and RoleBinding in the defined namespaces ONLY
+  ## This makes alertmanager work - for users who do not have ClusterAdmin privs, but wants alertmanager to operate on their own namespaces, instead of clusterwide.
+  useClusterRole: true
+
   ## alertmanager container name
   ##
   name: alertmanager
@@ -538,6 +543,21 @@ server:
   ## Prometheus server container name
   ##
   enabled: true
+
+  ## Use a ClusterRole (and ClusterRoleBinding)
+  ## - If set to false - we define a RoleBinding in the defined namespaces ONLY
+  ##
+  ## NB: because we need a Role with nonResourceURL's ("/metrics") - you must get someone with Cluster-admin privileges to define this role for you, before running with this setting enabled.
+  ##     This makes prometheus work - for users who do not have ClusterAdmin privs, but wants prometheus to operate on their own namespaces, instead of clusterwide.
+  ##
+  ## You MUST also set namespaces to the ones you have access to and want monitored by Prometheus.
+  ##
+  # useExistingClusterRoleName: nameofclusterrole
+
+  ## namespaces to monitor (instead of monitoring all - clusterwide). Needed if you want to run without Cluster-admin privileges.
+  # namespaces:
+  #   - yournamespace
+
   name: server
   sidecarContainers: