diff --git a/stable/prometheus/Chart.yaml b/stable/prometheus/Chart.yaml index 382f513e62..364e4c0fe4 100755 --- a/stable/prometheus/Chart.yaml +++ b/stable/prometheus/Chart.yaml @@ -1,5 +1,5 @@ name: prometheus -version: 4.4.0 +version: 4.5.0 description: Prometheus is a monitoring system and time series database. home: https://prometheus.io/ icon: https://raw.githubusercontent.com/prometheus/prometheus.github.io/master/assets/prometheus_logo-cb55bb5c346.png diff --git a/stable/prometheus/README.md b/stable/prometheus/README.md index 2656542905..579cd5419d 100644 --- a/stable/prometheus/README.md +++ b/stable/prometheus/README.md @@ -67,6 +67,7 @@ Parameter | Description | Default `alertmanager.podAnnotations` | annotations to be added to alertmanager pods | `{}` `alertmanager.replicaCount` | desired number of alertmanager pods | `1` `alertmanager.resources` | alertmanager pod resource requests & limits | `{}` +`alertmanager.serviceAccountName` | service account name for alertmanager to use (ignored if rbac.create=true) | `default` `alertmanager.service.annotations` | annotations for alertmanager service | `{}` `alertmanager.service.clusterIP` | internal alertmanager cluster service IP | `""` `alertmanager.service.externalIPs` | alertmanager service external IP addresses | `[]` @@ -89,6 +90,7 @@ Parameter | Description | Default `kubeStateMetrics.podAnnotations` | annotations to be added to kube-state-metrics pods | `{}` `kubeStateMetrics.replicaCount` | desired number of kube-state-metrics pods | `1` `kubeStateMetrics.resources` | kube-state-metrics resource requests and limits (YAML) | `{}` +`kubeStateMetrics.serviceAccountName` | service account name for kube-state-metrics to use (ignored if rbac.create=true) | `default` `kubeStateMetrics.service.annotations` | annotations for kube-state-metrics service | `{prometheus.io/scrape: "true"}` `kubeStateMetrics.service.clusterIP` | internal kube-state-metrics cluster service IP | `None` `kubeStateMetrics.service.externalIPs` | kube-state-metrics service external IP addresses | `[]` @@ -107,6 +109,7 @@ Parameter | Description | Default `nodeExporter.podAnnotations` | annotations to be added to node-exporter pods | `{}` `nodeExporter.tolerations` | node taints to tolerate (requires Kubernetes >=1.6) | `[]` `nodeExporter.resources` | node-exporter resource requests and limits (YAML) | `{}` +`nodeExporter.serviceAccountName` | service account name for node-exporter to use (ignored if rbac.create=true) | `default` `nodeExporter.service.annotations` | annotations for node-exporter service | `{prometheus.io/scrape: "true"}` `nodeExporter.service.clusterIP` | internal node-exporter cluster service IP | `None` `nodeExporter.service.externalIPs` | node-exporter service external IP addresses | `[]` @@ -135,6 +138,7 @@ Parameter | Description | Default `pushgateway.service.loadBalancerSourceRanges` | list of IP CIDRs allowed access to load balancer (if supported) | `[]` `pushgateway.service.servicePort` | pushgateway service port | `9091` `pushgateway.service.type` | type of pushgateway service to create | `ClusterIP` +`rbac.create` | If true, create & use RBAC resources | `false` `server.name` | Prometheus server container name | `server` `server.image.repository` | Prometheus server container image repository | `prom/prometheus` `server.image.tag` | Prometheus server container image tag | `v1.5.1` @@ -160,6 +164,7 @@ Parameter | Description | Default `server.podAnnotations` | annotations to be added to Prometheus server pods | `{}` `server.replicaCount` | desired number of Prometheus server pods | `1` `server.resources` | Prometheus server resource requests and limits | `{}` +`server.serviceAccountName` | service account name for server to use (ignored if rbac.create=true) | `default` `server.service.annotations` | annotations for Prometheus server service | `{}` `server.service.clusterIP` | internal Prometheus server cluster service IP | `""` `server.service.externalIPs` | Prometheus server service external IP addresses | `[]` diff --git a/stable/prometheus/templates/alertmanager-clusterrolebinding.yaml b/stable/prometheus/templates/alertmanager-clusterrolebinding.yaml new file mode 100644 index 0000000000..e6d9b4c323 --- /dev/null +++ b/stable/prometheus/templates/alertmanager-clusterrolebinding.yaml @@ -0,0 +1,20 @@ +{{- if .Values.rbac.create }} +apiVersion: rbac.authorization.k8s.io/v1beta1 +kind: ClusterRoleBinding +metadata: + labels: + app: {{ template "prometheus.name" . }} + chart: {{ .Chart.Name }}-{{ .Chart.Version }} + component: "{{ .Values.alertmanager.name }}" + heritage: {{ .Release.Service }} + release: {{ .Release.Name }} + name: {{ template "prometheus.alertmanager.fullname" . }} +subjects: + - kind: ServiceAccount + name: {{ template "prometheus.alertmanager.fullname" . }} + namespace: {{ .Release.Namespace }} +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: cluster-admin +{{- end }} diff --git a/stable/prometheus/templates/alertmanager-deployment.yaml b/stable/prometheus/templates/alertmanager-deployment.yaml index 3d624be101..a7594a4d19 100644 --- a/stable/prometheus/templates/alertmanager-deployment.yaml +++ b/stable/prometheus/templates/alertmanager-deployment.yaml @@ -22,6 +22,7 @@ spec: component: "{{ .Values.alertmanager.name }}" release: {{ .Release.Name }} spec: + serviceAccountName: {{ if .Values.rbac.create }}{{ template "prometheus.alertmanager.fullname" . }}{{ else }}"{{ .Values.alertmanager.serviceAccountName }}"{{ end }} containers: - name: {{ template "prometheus.name" . }}-{{ .Values.alertmanager.name }} image: "{{ .Values.alertmanager.image.repository }}:{{ .Values.alertmanager.image.tag }}" diff --git a/stable/prometheus/templates/alertmanager-serviceaccount.yaml b/stable/prometheus/templates/alertmanager-serviceaccount.yaml new file mode 100644 index 0000000000..e778983a62 --- /dev/null +++ b/stable/prometheus/templates/alertmanager-serviceaccount.yaml @@ -0,0 +1,12 @@ +{{- if .Values.rbac.create }} +apiVersion: v1 +kind: ServiceAccount +metadata: + labels: + app: {{ template "prometheus.name" . }} + chart: {{ .Chart.Name }}-{{ .Chart.Version }} + component: "{{ .Values.alertmanager.name }}" + heritage: {{ .Release.Service }} + release: {{ .Release.Name }} + name: {{ template "prometheus.alertmanager.fullname" . }} +{{- end }} diff --git a/stable/prometheus/templates/kube-state-metrics-clusterrole.yaml b/stable/prometheus/templates/kube-state-metrics-clusterrole.yaml new file mode 100644 index 0000000000..4d611cc056 --- /dev/null +++ b/stable/prometheus/templates/kube-state-metrics-clusterrole.yaml @@ -0,0 +1,34 @@ +{{- if .Values.rbac.create }} +apiVersion: rbac.authorization.k8s.io/v1beta1 +kind: ClusterRole +metadata: + labels: + app: {{ template "prometheus.name" . }} + chart: {{ .Chart.Name }}-{{ .Chart.Version }} + component: "{{ .Values.kubeStateMetrics.name }}" + heritage: {{ .Release.Service }} + release: {{ .Release.Name }} + name: {{ template "prometheus.kubeStateMetrics.fullname" . }} +rules: + - apiGroups: + - "" + resources: + - nodes + - pods + - services + - resourcequotas + - replicationcontrollers + - limitranges + verbs: + - list + - watch + - apiGroups: + - extensions + resources: + - daemonsets + - deployments + - replicasets + verbs: + - list + - watch +{{- end }} diff --git a/stable/prometheus/templates/kube-state-metrics-clusterrolebinding.yaml b/stable/prometheus/templates/kube-state-metrics-clusterrolebinding.yaml new file mode 100644 index 0000000000..cd3ad02513 --- /dev/null +++ b/stable/prometheus/templates/kube-state-metrics-clusterrolebinding.yaml @@ -0,0 +1,20 @@ +{{- if .Values.rbac.create }} +apiVersion: rbac.authorization.k8s.io/v1beta1 +kind: ClusterRoleBinding +metadata: + labels: + app: {{ template "prometheus.name" . }} + chart: {{ .Chart.Name }}-{{ .Chart.Version }} + component: "{{ .Values.kubeStateMetrics.name }}" + heritage: {{ .Release.Service }} + release: {{ .Release.Name }} + name: {{ template "prometheus.kubeStateMetrics.fullname" . }} +subjects: + - kind: ServiceAccount + name: {{ template "prometheus.kubeStateMetrics.fullname" . }} + namespace: {{ .Release.Namespace }} +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: {{ template "prometheus.kubeStateMetrics.fullname" . }} +{{- end }} diff --git a/stable/prometheus/templates/kube-state-metrics-deployment.yaml b/stable/prometheus/templates/kube-state-metrics-deployment.yaml index 034e489674..158370460b 100644 --- a/stable/prometheus/templates/kube-state-metrics-deployment.yaml +++ b/stable/prometheus/templates/kube-state-metrics-deployment.yaml @@ -22,6 +22,7 @@ spec: component: "{{ .Values.kubeStateMetrics.name }}" release: {{ .Release.Name }} spec: + serviceAccountName: {{ if .Values.rbac.create }}{{ template "prometheus.kubeStateMetrics.fullname" . }}{{ else }}"{{ .Values.kubeStateMetrics.serviceAccountName }}"{{ end }} containers: - name: {{ template "prometheus.name" . }}-{{ .Values.kubeStateMetrics.name }} image: "{{ .Values.kubeStateMetrics.image.repository }}:{{ .Values.kubeStateMetrics.image.tag }}" diff --git a/stable/prometheus/templates/kube-state-metrics-serviceaccount.yaml b/stable/prometheus/templates/kube-state-metrics-serviceaccount.yaml new file mode 100644 index 0000000000..7306688704 --- /dev/null +++ b/stable/prometheus/templates/kube-state-metrics-serviceaccount.yaml @@ -0,0 +1,12 @@ +{{- if .Values.rbac.create }} +apiVersion: v1 +kind: ServiceAccount +metadata: + labels: + app: {{ template "prometheus.name" . }} + chart: {{ .Chart.Name }}-{{ .Chart.Version }} + component: "{{ .Values.kubeStateMetrics.name }}" + heritage: {{ .Release.Service }} + release: {{ .Release.Name }} + name: {{ template "prometheus.kubeStateMetrics.fullname" . }} +{{- end }} diff --git a/stable/prometheus/templates/node-exporter-clusterrolebinding.yaml b/stable/prometheus/templates/node-exporter-clusterrolebinding.yaml new file mode 100644 index 0000000000..ed4710e282 --- /dev/null +++ b/stable/prometheus/templates/node-exporter-clusterrolebinding.yaml @@ -0,0 +1,20 @@ +{{- if .Values.rbac.create }} +apiVersion: rbac.authorization.k8s.io/v1beta1 +kind: ClusterRoleBinding +metadata: + labels: + app: {{ template "prometheus.name" . }} + chart: {{ .Chart.Name }}-{{ .Chart.Version }} + component: "{{ .Values.nodeExporter.name }}" + heritage: {{ .Release.Service }} + release: {{ .Release.Name }} + name: {{ template "prometheus.nodeExporter.fullname" . }} +subjects: + - kind: ServiceAccount + name: {{ template "prometheus.nodeExporter.fullname" . }} + namespace: {{ .Release.Namespace }} +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: cluster-admin +{{- end }} diff --git a/stable/prometheus/templates/node-exporter-daemonset.yaml b/stable/prometheus/templates/node-exporter-daemonset.yaml index aaf6b2f4ce..00276a6b9b 100644 --- a/stable/prometheus/templates/node-exporter-daemonset.yaml +++ b/stable/prometheus/templates/node-exporter-daemonset.yaml @@ -21,6 +21,7 @@ spec: component: "{{ .Values.nodeExporter.name }}" release: {{ .Release.Name }} spec: + serviceAccountName: {{ if .Values.rbac.create }}{{ template "prometheus.nodeExporter.fullname" . }}{{ else }}"{{ .Values.nodeExporter.serviceAccountName }}"{{ end }} containers: - name: {{ template "prometheus.name" . }}-{{ .Values.nodeExporter.name }} image: "{{ .Values.nodeExporter.image.repository }}:{{ .Values.nodeExporter.image.tag }}" diff --git a/stable/prometheus/templates/node-exporter-serviceaccount.yaml b/stable/prometheus/templates/node-exporter-serviceaccount.yaml new file mode 100644 index 0000000000..1537984abf --- /dev/null +++ b/stable/prometheus/templates/node-exporter-serviceaccount.yaml @@ -0,0 +1,12 @@ +{{- if .Values.rbac.create }} +apiVersion: v1 +kind: ServiceAccount +metadata: + labels: + app: {{ template "prometheus.name" . }} + chart: {{ .Chart.Name }}-{{ .Chart.Version }} + component: "{{ .Values.nodeExporter.name }}" + heritage: {{ .Release.Service }} + release: {{ .Release.Name }} + name: {{ template "prometheus.nodeExporter.fullname" . }} +{{- end }} diff --git a/stable/prometheus/templates/server-clusterrole.yaml b/stable/prometheus/templates/server-clusterrole.yaml new file mode 100644 index 0000000000..d9c6e4daea --- /dev/null +++ b/stable/prometheus/templates/server-clusterrole.yaml @@ -0,0 +1,35 @@ +{{- if .Values.rbac.create }} +apiVersion: rbac.authorization.k8s.io/v1beta1 +kind: ClusterRole +metadata: + labels: + app: {{ template "prometheus.name" . }} + chart: {{ .Chart.Name }}-{{ .Chart.Version }} + component: "{{ .Values.server.name }}" + heritage: {{ .Release.Service }} + release: {{ .Release.Name }} + name: {{ template "prometheus.server.fullname" . }} +rules: + - apiGroups: + - "" + resources: + - nodes + - nodes/proxy + - services + - endpoints + - pods + verbs: + - get + - list + - watch + - apiGroups: + - "" + resources: + - configmaps + verbs: + - get + - nonResourceURLs: + - "/metrics" + verbs: + - get +{{- end }} diff --git a/stable/prometheus/templates/server-clusterrolebinding.yaml b/stable/prometheus/templates/server-clusterrolebinding.yaml new file mode 100644 index 0000000000..31964910e8 --- /dev/null +++ b/stable/prometheus/templates/server-clusterrolebinding.yaml @@ -0,0 +1,20 @@ +{{- if .Values.rbac.create }} +apiVersion: rbac.authorization.k8s.io/v1beta1 +kind: ClusterRoleBinding +metadata: + labels: + app: {{ template "prometheus.name" . }} + chart: {{ .Chart.Name }}-{{ .Chart.Version }} + component: "{{ .Values.server.name }}" + heritage: {{ .Release.Service }} + release: {{ .Release.Name }} + name: {{ template "prometheus.server.fullname" . }} +subjects: + - kind: ServiceAccount + name: {{ template "prometheus.server.fullname" . }} + namespace: {{ .Release.Namespace }} +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: {{ template "prometheus.server.fullname" . }} +{{- end }} diff --git a/stable/prometheus/templates/server-deployment.yaml b/stable/prometheus/templates/server-deployment.yaml index a05ffbea5a..8d34517581 100644 --- a/stable/prometheus/templates/server-deployment.yaml +++ b/stable/prometheus/templates/server-deployment.yaml @@ -21,6 +21,7 @@ spec: component: "{{ .Values.server.name }}" release: {{ .Release.Name }} spec: + serviceAccountName: {{ if .Values.rbac.create }}{{ template "prometheus.server.fullname" . }}{{ else }}"{{ .Values.server.serviceAccountName }}"{{ end }} containers: - name: {{ template "prometheus.name" . }}-{{ .Values.server.name }}-{{ .Values.configmapReload.name }} image: "{{ .Values.configmapReload.image.repository }}:{{ .Values.configmapReload.image.tag }}" diff --git a/stable/prometheus/templates/server-serviceaccount.yaml b/stable/prometheus/templates/server-serviceaccount.yaml new file mode 100644 index 0000000000..a539b382f9 --- /dev/null +++ b/stable/prometheus/templates/server-serviceaccount.yaml @@ -0,0 +1,12 @@ +{{- if .Values.rbac.create }} +apiVersion: v1 +kind: ServiceAccount +metadata: + labels: + app: {{ template "prometheus.name" . }} + chart: {{ .Chart.Name }}-{{ .Chart.Version }} + component: "{{ .Values.server.name }}" + heritage: {{ .Release.Service }} + release: {{ .Release.Name }} + name: {{ template "prometheus.server.fullname" . }} +{{- end }} diff --git a/stable/prometheus/values.yaml b/stable/prometheus/values.yaml index 5687bf2b14..e59d53af4e 100644 --- a/stable/prometheus/values.yaml +++ b/stable/prometheus/values.yaml @@ -1,8 +1,14 @@ +rbac: + create: false + alertmanager: ## If false, alertmanager will not be installed ## enabled: true + # Defines the serviceAccountName to use when `rbac.create=false` + serviceAccountName: default + ## alertmanager container name ## name: alertmanager @@ -160,6 +166,9 @@ kubeStateMetrics: ## enabled: true + # Defines the serviceAccountName to use when `rbac.create=false` + serviceAccountName: default + ## kube-state-metrics container name ## name: kube-state-metrics @@ -215,6 +224,9 @@ nodeExporter: ## enabled: true + # Defines the serviceAccountName to use when `rbac.create=false` + serviceAccountName: default + ## node-exporter container name ## name: node-exporter @@ -223,7 +235,7 @@ nodeExporter: ## image: repository: prom/node-exporter - tag: v0.13.0 + tag: v0.14.0 pullPolicy: IfNotPresent ## Additional node-exporter container arguments @@ -290,6 +302,9 @@ server: ## name: server + # Defines the serviceAccountName to use when `rbac.create=false` + serviceAccountName: default + ## Prometheus server container image ## image: @@ -352,7 +367,7 @@ server: # operator: "Equal|Exists" # value: "value" # effect: "NoSchedule|PreferNoSchedule|NoExecute(1.6 only)" - + ## Node labels for Prometheus server pod assignment ## Ref: https://kubernetes.io/docs/user-guide/node-selection/ nodeSelector: {}