From df7f2db2fb212aa53cd22ee6b998c5d653c3f932 Mon Sep 17 00:00:00 2001 From: Alejandro Escobar Date: Fri, 18 Aug 2017 08:29:18 -0700 Subject: [PATCH] [stable/prometheus] RBAC, namespaces, and node-exporter default update (#1443) * first commit to add rbac to prometheus. added clusterroles, bindings and service accounts added configuration changes to the readme doc. updated cluster roles. additional changes made to simplify rbac reasoning updated the readme file. addressed PR items. * Conform to standard RBAC pattern * Bump chart version * Delete extra metadata * Delete README whitespace * Clarify RBAC requirements --- stable/prometheus/Chart.yaml | 2 +- stable/prometheus/README.md | 5 +++ .../alertmanager-clusterrolebinding.yaml | 20 +++++++++++ .../templates/alertmanager-deployment.yaml | 1 + .../alertmanager-serviceaccount.yaml | 12 +++++++ .../kube-state-metrics-clusterrole.yaml | 34 ++++++++++++++++++ ...kube-state-metrics-clusterrolebinding.yaml | 20 +++++++++++ .../kube-state-metrics-deployment.yaml | 1 + .../kube-state-metrics-serviceaccount.yaml | 12 +++++++ .../node-exporter-clusterrolebinding.yaml | 20 +++++++++++ .../templates/node-exporter-daemonset.yaml | 1 + .../node-exporter-serviceaccount.yaml | 12 +++++++ .../templates/server-clusterrole.yaml | 35 +++++++++++++++++++ .../templates/server-clusterrolebinding.yaml | 20 +++++++++++ .../templates/server-deployment.yaml | 1 + .../templates/server-serviceaccount.yaml | 12 +++++++ stable/prometheus/values.yaml | 19 ++++++++-- 17 files changed, 224 insertions(+), 3 deletions(-) create mode 100644 stable/prometheus/templates/alertmanager-clusterrolebinding.yaml create mode 100644 stable/prometheus/templates/alertmanager-serviceaccount.yaml create mode 100644 stable/prometheus/templates/kube-state-metrics-clusterrole.yaml create mode 100644 stable/prometheus/templates/kube-state-metrics-clusterrolebinding.yaml create mode 100644 stable/prometheus/templates/kube-state-metrics-serviceaccount.yaml create mode 100644 stable/prometheus/templates/node-exporter-clusterrolebinding.yaml create mode 100644 stable/prometheus/templates/node-exporter-serviceaccount.yaml create mode 100644 stable/prometheus/templates/server-clusterrole.yaml create mode 100644 stable/prometheus/templates/server-clusterrolebinding.yaml create mode 100644 stable/prometheus/templates/server-serviceaccount.yaml diff --git a/stable/prometheus/Chart.yaml b/stable/prometheus/Chart.yaml index 382f513e62..364e4c0fe4 100755 --- a/stable/prometheus/Chart.yaml +++ b/stable/prometheus/Chart.yaml @@ -1,5 +1,5 @@ name: prometheus -version: 4.4.0 +version: 4.5.0 description: Prometheus is a monitoring system and time series database. home: https://prometheus.io/ icon: https://raw.githubusercontent.com/prometheus/prometheus.github.io/master/assets/prometheus_logo-cb55bb5c346.png diff --git a/stable/prometheus/README.md b/stable/prometheus/README.md index 2656542905..579cd5419d 100644 --- a/stable/prometheus/README.md +++ b/stable/prometheus/README.md @@ -67,6 +67,7 @@ Parameter | Description | Default `alertmanager.podAnnotations` | annotations to be added to alertmanager pods | `{}` `alertmanager.replicaCount` | desired number of alertmanager pods | `1` `alertmanager.resources` | alertmanager pod resource requests & limits | `{}` +`alertmanager.serviceAccountName` | service account name for alertmanager to use (ignored if rbac.create=true) | `default` `alertmanager.service.annotations` | annotations for alertmanager service | `{}` `alertmanager.service.clusterIP` | internal alertmanager cluster service IP | `""` `alertmanager.service.externalIPs` | alertmanager service external IP addresses | `[]` @@ -89,6 +90,7 @@ Parameter | Description | Default `kubeStateMetrics.podAnnotations` | annotations to be added to kube-state-metrics pods | `{}` `kubeStateMetrics.replicaCount` | desired number of kube-state-metrics pods | `1` `kubeStateMetrics.resources` | kube-state-metrics resource requests and limits (YAML) | `{}` +`kubeStateMetrics.serviceAccountName` | service account name for kube-state-metrics to use (ignored if rbac.create=true) | `default` `kubeStateMetrics.service.annotations` | annotations for kube-state-metrics service | `{prometheus.io/scrape: "true"}` `kubeStateMetrics.service.clusterIP` | internal kube-state-metrics cluster service IP | `None` `kubeStateMetrics.service.externalIPs` | kube-state-metrics service external IP addresses | `[]` @@ -107,6 +109,7 @@ Parameter | Description | Default `nodeExporter.podAnnotations` | annotations to be added to node-exporter pods | `{}` `nodeExporter.tolerations` | node taints to tolerate (requires Kubernetes >=1.6) | `[]` `nodeExporter.resources` | node-exporter resource requests and limits (YAML) | `{}` +`nodeExporter.serviceAccountName` | service account name for node-exporter to use (ignored if rbac.create=true) | `default` `nodeExporter.service.annotations` | annotations for node-exporter service | `{prometheus.io/scrape: "true"}` `nodeExporter.service.clusterIP` | internal node-exporter cluster service IP | `None` `nodeExporter.service.externalIPs` | node-exporter service external IP addresses | `[]` @@ -135,6 +138,7 @@ Parameter | Description | Default `pushgateway.service.loadBalancerSourceRanges` | list of IP CIDRs allowed access to load balancer (if supported) | `[]` `pushgateway.service.servicePort` | pushgateway service port | `9091` `pushgateway.service.type` | type of pushgateway service to create | `ClusterIP` +`rbac.create` | If true, create & use RBAC resources | `false` `server.name` | Prometheus server container name | `server` `server.image.repository` | Prometheus server container image repository | `prom/prometheus` `server.image.tag` | Prometheus server container image tag | `v1.5.1` @@ -160,6 +164,7 @@ Parameter | Description | Default `server.podAnnotations` | annotations to be added to Prometheus server pods | `{}` `server.replicaCount` | desired number of Prometheus server pods | `1` `server.resources` | Prometheus server resource requests and limits | `{}` +`server.serviceAccountName` | service account name for server to use (ignored if rbac.create=true) | `default` `server.service.annotations` | annotations for Prometheus server service | `{}` `server.service.clusterIP` | internal Prometheus server cluster service IP | `""` `server.service.externalIPs` | Prometheus server service external IP addresses | `[]` diff --git a/stable/prometheus/templates/alertmanager-clusterrolebinding.yaml b/stable/prometheus/templates/alertmanager-clusterrolebinding.yaml new file mode 100644 index 0000000000..e6d9b4c323 --- /dev/null +++ b/stable/prometheus/templates/alertmanager-clusterrolebinding.yaml @@ -0,0 +1,20 @@ +{{- if .Values.rbac.create }} +apiVersion: rbac.authorization.k8s.io/v1beta1 +kind: ClusterRoleBinding +metadata: + labels: + app: {{ template "prometheus.name" . }} + chart: {{ .Chart.Name }}-{{ .Chart.Version }} + component: "{{ .Values.alertmanager.name }}" + heritage: {{ .Release.Service }} + release: {{ .Release.Name }} + name: {{ template "prometheus.alertmanager.fullname" . }} +subjects: + - kind: ServiceAccount + name: {{ template "prometheus.alertmanager.fullname" . }} + namespace: {{ .Release.Namespace }} +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: cluster-admin +{{- end }} diff --git a/stable/prometheus/templates/alertmanager-deployment.yaml b/stable/prometheus/templates/alertmanager-deployment.yaml index 3d624be101..a7594a4d19 100644 --- a/stable/prometheus/templates/alertmanager-deployment.yaml +++ b/stable/prometheus/templates/alertmanager-deployment.yaml @@ -22,6 +22,7 @@ spec: component: "{{ .Values.alertmanager.name }}" release: {{ .Release.Name }} spec: + serviceAccountName: {{ if .Values.rbac.create }}{{ template "prometheus.alertmanager.fullname" . }}{{ else }}"{{ .Values.alertmanager.serviceAccountName }}"{{ end }} containers: - name: {{ template "prometheus.name" . }}-{{ .Values.alertmanager.name }} image: "{{ .Values.alertmanager.image.repository }}:{{ .Values.alertmanager.image.tag }}" diff --git a/stable/prometheus/templates/alertmanager-serviceaccount.yaml b/stable/prometheus/templates/alertmanager-serviceaccount.yaml new file mode 100644 index 0000000000..e778983a62 --- /dev/null +++ b/stable/prometheus/templates/alertmanager-serviceaccount.yaml @@ -0,0 +1,12 @@ +{{- if .Values.rbac.create }} +apiVersion: v1 +kind: ServiceAccount +metadata: + labels: + app: {{ template "prometheus.name" . }} + chart: {{ .Chart.Name }}-{{ .Chart.Version }} + component: "{{ .Values.alertmanager.name }}" + heritage: {{ .Release.Service }} + release: {{ .Release.Name }} + name: {{ template "prometheus.alertmanager.fullname" . }} +{{- end }} diff --git a/stable/prometheus/templates/kube-state-metrics-clusterrole.yaml b/stable/prometheus/templates/kube-state-metrics-clusterrole.yaml new file mode 100644 index 0000000000..4d611cc056 --- /dev/null +++ b/stable/prometheus/templates/kube-state-metrics-clusterrole.yaml @@ -0,0 +1,34 @@ +{{- if .Values.rbac.create }} +apiVersion: rbac.authorization.k8s.io/v1beta1 +kind: ClusterRole +metadata: + labels: + app: {{ template "prometheus.name" . }} + chart: {{ .Chart.Name }}-{{ .Chart.Version }} + component: "{{ .Values.kubeStateMetrics.name }}" + heritage: {{ .Release.Service }} + release: {{ .Release.Name }} + name: {{ template "prometheus.kubeStateMetrics.fullname" . }} +rules: + - apiGroups: + - "" + resources: + - nodes + - pods + - services + - resourcequotas + - replicationcontrollers + - limitranges + verbs: + - list + - watch + - apiGroups: + - extensions + resources: + - daemonsets + - deployments + - replicasets + verbs: + - list + - watch +{{- end }} diff --git a/stable/prometheus/templates/kube-state-metrics-clusterrolebinding.yaml b/stable/prometheus/templates/kube-state-metrics-clusterrolebinding.yaml new file mode 100644 index 0000000000..cd3ad02513 --- /dev/null +++ b/stable/prometheus/templates/kube-state-metrics-clusterrolebinding.yaml @@ -0,0 +1,20 @@ +{{- if .Values.rbac.create }} +apiVersion: rbac.authorization.k8s.io/v1beta1 +kind: ClusterRoleBinding +metadata: + labels: + app: {{ template "prometheus.name" . }} + chart: {{ .Chart.Name }}-{{ .Chart.Version }} + component: "{{ .Values.kubeStateMetrics.name }}" + heritage: {{ .Release.Service }} + release: {{ .Release.Name }} + name: {{ template "prometheus.kubeStateMetrics.fullname" . }} +subjects: + - kind: ServiceAccount + name: {{ template "prometheus.kubeStateMetrics.fullname" . }} + namespace: {{ .Release.Namespace }} +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: {{ template "prometheus.kubeStateMetrics.fullname" . }} +{{- end }} diff --git a/stable/prometheus/templates/kube-state-metrics-deployment.yaml b/stable/prometheus/templates/kube-state-metrics-deployment.yaml index 034e489674..158370460b 100644 --- a/stable/prometheus/templates/kube-state-metrics-deployment.yaml +++ b/stable/prometheus/templates/kube-state-metrics-deployment.yaml @@ -22,6 +22,7 @@ spec: component: "{{ .Values.kubeStateMetrics.name }}" release: {{ .Release.Name }} spec: + serviceAccountName: {{ if .Values.rbac.create }}{{ template "prometheus.kubeStateMetrics.fullname" . }}{{ else }}"{{ .Values.kubeStateMetrics.serviceAccountName }}"{{ end }} containers: - name: {{ template "prometheus.name" . }}-{{ .Values.kubeStateMetrics.name }} image: "{{ .Values.kubeStateMetrics.image.repository }}:{{ .Values.kubeStateMetrics.image.tag }}" diff --git a/stable/prometheus/templates/kube-state-metrics-serviceaccount.yaml b/stable/prometheus/templates/kube-state-metrics-serviceaccount.yaml new file mode 100644 index 0000000000..7306688704 --- /dev/null +++ b/stable/prometheus/templates/kube-state-metrics-serviceaccount.yaml @@ -0,0 +1,12 @@ +{{- if .Values.rbac.create }} +apiVersion: v1 +kind: ServiceAccount +metadata: + labels: + app: {{ template "prometheus.name" . }} + chart: {{ .Chart.Name }}-{{ .Chart.Version }} + component: "{{ .Values.kubeStateMetrics.name }}" + heritage: {{ .Release.Service }} + release: {{ .Release.Name }} + name: {{ template "prometheus.kubeStateMetrics.fullname" . }} +{{- end }} diff --git a/stable/prometheus/templates/node-exporter-clusterrolebinding.yaml b/stable/prometheus/templates/node-exporter-clusterrolebinding.yaml new file mode 100644 index 0000000000..ed4710e282 --- /dev/null +++ b/stable/prometheus/templates/node-exporter-clusterrolebinding.yaml @@ -0,0 +1,20 @@ +{{- if .Values.rbac.create }} +apiVersion: rbac.authorization.k8s.io/v1beta1 +kind: ClusterRoleBinding +metadata: + labels: + app: {{ template "prometheus.name" . }} + chart: {{ .Chart.Name }}-{{ .Chart.Version }} + component: "{{ .Values.nodeExporter.name }}" + heritage: {{ .Release.Service }} + release: {{ .Release.Name }} + name: {{ template "prometheus.nodeExporter.fullname" . }} +subjects: + - kind: ServiceAccount + name: {{ template "prometheus.nodeExporter.fullname" . }} + namespace: {{ .Release.Namespace }} +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: cluster-admin +{{- end }} diff --git a/stable/prometheus/templates/node-exporter-daemonset.yaml b/stable/prometheus/templates/node-exporter-daemonset.yaml index aaf6b2f4ce..00276a6b9b 100644 --- a/stable/prometheus/templates/node-exporter-daemonset.yaml +++ b/stable/prometheus/templates/node-exporter-daemonset.yaml @@ -21,6 +21,7 @@ spec: component: "{{ .Values.nodeExporter.name }}" release: {{ .Release.Name }} spec: + serviceAccountName: {{ if .Values.rbac.create }}{{ template "prometheus.nodeExporter.fullname" . }}{{ else }}"{{ .Values.nodeExporter.serviceAccountName }}"{{ end }} containers: - name: {{ template "prometheus.name" . }}-{{ .Values.nodeExporter.name }} image: "{{ .Values.nodeExporter.image.repository }}:{{ .Values.nodeExporter.image.tag }}" diff --git a/stable/prometheus/templates/node-exporter-serviceaccount.yaml b/stable/prometheus/templates/node-exporter-serviceaccount.yaml new file mode 100644 index 0000000000..1537984abf --- /dev/null +++ b/stable/prometheus/templates/node-exporter-serviceaccount.yaml @@ -0,0 +1,12 @@ +{{- if .Values.rbac.create }} +apiVersion: v1 +kind: ServiceAccount +metadata: + labels: + app: {{ template "prometheus.name" . }} + chart: {{ .Chart.Name }}-{{ .Chart.Version }} + component: "{{ .Values.nodeExporter.name }}" + heritage: {{ .Release.Service }} + release: {{ .Release.Name }} + name: {{ template "prometheus.nodeExporter.fullname" . }} +{{- end }} diff --git a/stable/prometheus/templates/server-clusterrole.yaml b/stable/prometheus/templates/server-clusterrole.yaml new file mode 100644 index 0000000000..d9c6e4daea --- /dev/null +++ b/stable/prometheus/templates/server-clusterrole.yaml @@ -0,0 +1,35 @@ +{{- if .Values.rbac.create }} +apiVersion: rbac.authorization.k8s.io/v1beta1 +kind: ClusterRole +metadata: + labels: + app: {{ template "prometheus.name" . }} + chart: {{ .Chart.Name }}-{{ .Chart.Version }} + component: "{{ .Values.server.name }}" + heritage: {{ .Release.Service }} + release: {{ .Release.Name }} + name: {{ template "prometheus.server.fullname" . }} +rules: + - apiGroups: + - "" + resources: + - nodes + - nodes/proxy + - services + - endpoints + - pods + verbs: + - get + - list + - watch + - apiGroups: + - "" + resources: + - configmaps + verbs: + - get + - nonResourceURLs: + - "/metrics" + verbs: + - get +{{- end }} diff --git a/stable/prometheus/templates/server-clusterrolebinding.yaml b/stable/prometheus/templates/server-clusterrolebinding.yaml new file mode 100644 index 0000000000..31964910e8 --- /dev/null +++ b/stable/prometheus/templates/server-clusterrolebinding.yaml @@ -0,0 +1,20 @@ +{{- if .Values.rbac.create }} +apiVersion: rbac.authorization.k8s.io/v1beta1 +kind: ClusterRoleBinding +metadata: + labels: + app: {{ template "prometheus.name" . }} + chart: {{ .Chart.Name }}-{{ .Chart.Version }} + component: "{{ .Values.server.name }}" + heritage: {{ .Release.Service }} + release: {{ .Release.Name }} + name: {{ template "prometheus.server.fullname" . }} +subjects: + - kind: ServiceAccount + name: {{ template "prometheus.server.fullname" . }} + namespace: {{ .Release.Namespace }} +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: {{ template "prometheus.server.fullname" . }} +{{- end }} diff --git a/stable/prometheus/templates/server-deployment.yaml b/stable/prometheus/templates/server-deployment.yaml index a05ffbea5a..8d34517581 100644 --- a/stable/prometheus/templates/server-deployment.yaml +++ b/stable/prometheus/templates/server-deployment.yaml @@ -21,6 +21,7 @@ spec: component: "{{ .Values.server.name }}" release: {{ .Release.Name }} spec: + serviceAccountName: {{ if .Values.rbac.create }}{{ template "prometheus.server.fullname" . }}{{ else }}"{{ .Values.server.serviceAccountName }}"{{ end }} containers: - name: {{ template "prometheus.name" . }}-{{ .Values.server.name }}-{{ .Values.configmapReload.name }} image: "{{ .Values.configmapReload.image.repository }}:{{ .Values.configmapReload.image.tag }}" diff --git a/stable/prometheus/templates/server-serviceaccount.yaml b/stable/prometheus/templates/server-serviceaccount.yaml new file mode 100644 index 0000000000..a539b382f9 --- /dev/null +++ b/stable/prometheus/templates/server-serviceaccount.yaml @@ -0,0 +1,12 @@ +{{- if .Values.rbac.create }} +apiVersion: v1 +kind: ServiceAccount +metadata: + labels: + app: {{ template "prometheus.name" . }} + chart: {{ .Chart.Name }}-{{ .Chart.Version }} + component: "{{ .Values.server.name }}" + heritage: {{ .Release.Service }} + release: {{ .Release.Name }} + name: {{ template "prometheus.server.fullname" . }} +{{- end }} diff --git a/stable/prometheus/values.yaml b/stable/prometheus/values.yaml index 5687bf2b14..e59d53af4e 100644 --- a/stable/prometheus/values.yaml +++ b/stable/prometheus/values.yaml @@ -1,8 +1,14 @@ +rbac: + create: false + alertmanager: ## If false, alertmanager will not be installed ## enabled: true + # Defines the serviceAccountName to use when `rbac.create=false` + serviceAccountName: default + ## alertmanager container name ## name: alertmanager @@ -160,6 +166,9 @@ kubeStateMetrics: ## enabled: true + # Defines the serviceAccountName to use when `rbac.create=false` + serviceAccountName: default + ## kube-state-metrics container name ## name: kube-state-metrics @@ -215,6 +224,9 @@ nodeExporter: ## enabled: true + # Defines the serviceAccountName to use when `rbac.create=false` + serviceAccountName: default + ## node-exporter container name ## name: node-exporter @@ -223,7 +235,7 @@ nodeExporter: ## image: repository: prom/node-exporter - tag: v0.13.0 + tag: v0.14.0 pullPolicy: IfNotPresent ## Additional node-exporter container arguments @@ -290,6 +302,9 @@ server: ## name: server + # Defines the serviceAccountName to use when `rbac.create=false` + serviceAccountName: default + ## Prometheus server container image ## image: @@ -352,7 +367,7 @@ server: # operator: "Equal|Exists" # value: "value" # effect: "NoSchedule|PreferNoSchedule|NoExecute(1.6 only)" - + ## Node labels for Prometheus server pod assignment ## Ref: https://kubernetes.io/docs/user-guide/node-selection/ nodeSelector: {}