mirror of
https://github.com/fluxcd/flagger.git
synced 2026-04-15 06:57:34 +00:00
835 lines
28 KiB
YAML
835 lines
28 KiB
YAML
# Source: istio/charts/prometheus/templates/configmap.yaml
|
|
apiVersion: v1
|
|
kind: ConfigMap
|
|
metadata:
|
|
name: prometheus
|
|
namespace: istio-system
|
|
labels:
|
|
app: prometheus
|
|
chart: prometheus-1.0.6
|
|
heritage: Tiller
|
|
release: istio
|
|
data:
|
|
prometheus.yml: |-
|
|
global:
|
|
scrape_interval: 15s
|
|
scrape_configs:
|
|
|
|
- job_name: 'istio-mesh'
|
|
# Override the global default and scrape targets from this job every 5 seconds.
|
|
scrape_interval: 5s
|
|
|
|
kubernetes_sd_configs:
|
|
- role: endpoints
|
|
namespaces:
|
|
names:
|
|
- istio-system
|
|
|
|
relabel_configs:
|
|
- source_labels: [__meta_kubernetes_service_name, __meta_kubernetes_endpoint_port_name]
|
|
action: keep
|
|
regex: istio-telemetry;prometheus
|
|
|
|
|
|
# Scrape config for envoy stats
|
|
- job_name: 'envoy-stats'
|
|
metrics_path: /stats/prometheus
|
|
kubernetes_sd_configs:
|
|
- role: pod
|
|
|
|
relabel_configs:
|
|
- source_labels: [__meta_kubernetes_pod_container_port_name]
|
|
action: keep
|
|
regex: '.*-envoy-prom'
|
|
- source_labels: [__address__, __meta_kubernetes_pod_annotation_prometheus_io_port]
|
|
action: replace
|
|
regex: ([^:]+)(?::\d+)?;(\d+)
|
|
replacement: $1:15090
|
|
target_label: __address__
|
|
- action: labelmap
|
|
regex: __meta_kubernetes_pod_label_(.+)
|
|
- source_labels: [__meta_kubernetes_namespace]
|
|
action: replace
|
|
target_label: namespace
|
|
- source_labels: [__meta_kubernetes_pod_name]
|
|
action: replace
|
|
target_label: pod_name
|
|
|
|
metric_relabel_configs:
|
|
# Exclude some of the envoy metrics that have massive cardinality
|
|
# This list may need to be pruned further moving forward, as informed
|
|
# by performance and scalability testing.
|
|
- source_labels: [ cluster_name ]
|
|
regex: '(outbound|inbound|prometheus_stats).*'
|
|
action: drop
|
|
- source_labels: [ tcp_prefix ]
|
|
regex: '(outbound|inbound|prometheus_stats).*'
|
|
action: drop
|
|
- source_labels: [ listener_address ]
|
|
regex: '(.+)'
|
|
action: drop
|
|
- source_labels: [ http_conn_manager_listener_prefix ]
|
|
regex: '(.+)'
|
|
action: drop
|
|
- source_labels: [ http_conn_manager_prefix ]
|
|
regex: '(.+)'
|
|
action: drop
|
|
- source_labels: [ __name__ ]
|
|
regex: 'envoy_tls.*'
|
|
action: drop
|
|
- source_labels: [ __name__ ]
|
|
regex: 'envoy_tcp_downstream.*'
|
|
action: drop
|
|
- source_labels: [ __name__ ]
|
|
regex: 'envoy_http_(stats|admin).*'
|
|
action: drop
|
|
- source_labels: [ __name__ ]
|
|
regex: 'envoy_cluster_(lb|retry|bind|internal|max|original).*'
|
|
action: drop
|
|
|
|
|
|
- job_name: 'istio-policy'
|
|
# Override the global default and scrape targets from this job every 5 seconds.
|
|
scrape_interval: 5s
|
|
# metrics_path defaults to '/metrics'
|
|
# scheme defaults to 'http'.
|
|
|
|
kubernetes_sd_configs:
|
|
- role: endpoints
|
|
namespaces:
|
|
names:
|
|
- istio-system
|
|
|
|
|
|
relabel_configs:
|
|
- source_labels: [__meta_kubernetes_service_name, __meta_kubernetes_endpoint_port_name]
|
|
action: keep
|
|
regex: istio-policy;http-monitoring
|
|
|
|
- job_name: 'istio-telemetry'
|
|
# Override the global default and scrape targets from this job every 5 seconds.
|
|
scrape_interval: 5s
|
|
# metrics_path defaults to '/metrics'
|
|
# scheme defaults to 'http'.
|
|
|
|
kubernetes_sd_configs:
|
|
- role: endpoints
|
|
namespaces:
|
|
names:
|
|
- istio-system
|
|
|
|
relabel_configs:
|
|
- source_labels: [__meta_kubernetes_service_name, __meta_kubernetes_endpoint_port_name]
|
|
action: keep
|
|
regex: istio-telemetry;http-monitoring
|
|
|
|
- job_name: 'pilot'
|
|
# Override the global default and scrape targets from this job every 5 seconds.
|
|
scrape_interval: 5s
|
|
# metrics_path defaults to '/metrics'
|
|
# scheme defaults to 'http'.
|
|
|
|
kubernetes_sd_configs:
|
|
- role: endpoints
|
|
namespaces:
|
|
names:
|
|
- istio-system
|
|
|
|
relabel_configs:
|
|
- source_labels: [__meta_kubernetes_service_name, __meta_kubernetes_endpoint_port_name]
|
|
action: keep
|
|
regex: istio-pilot;http-monitoring
|
|
|
|
- job_name: 'galley'
|
|
# Override the global default and scrape targets from this job every 5 seconds.
|
|
scrape_interval: 5s
|
|
# metrics_path defaults to '/metrics'
|
|
# scheme defaults to 'http'.
|
|
|
|
kubernetes_sd_configs:
|
|
- role: endpoints
|
|
namespaces:
|
|
names:
|
|
- istio-system
|
|
|
|
relabel_configs:
|
|
- source_labels: [__meta_kubernetes_service_name, __meta_kubernetes_endpoint_port_name]
|
|
action: keep
|
|
regex: istio-galley;http-monitoring
|
|
|
|
# scrape config for API servers
|
|
- job_name: 'kubernetes-apiservers'
|
|
kubernetes_sd_configs:
|
|
- role: endpoints
|
|
namespaces:
|
|
names:
|
|
- default
|
|
scheme: https
|
|
tls_config:
|
|
ca_file: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
|
|
bearer_token_file: /var/run/secrets/kubernetes.io/serviceaccount/token
|
|
relabel_configs:
|
|
- source_labels: [__meta_kubernetes_service_name, __meta_kubernetes_endpoint_port_name]
|
|
action: keep
|
|
regex: kubernetes;https
|
|
|
|
# scrape config for nodes (kubelet)
|
|
- job_name: 'kubernetes-nodes'
|
|
scheme: https
|
|
tls_config:
|
|
ca_file: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
|
|
bearer_token_file: /var/run/secrets/kubernetes.io/serviceaccount/token
|
|
kubernetes_sd_configs:
|
|
- role: node
|
|
relabel_configs:
|
|
- action: labelmap
|
|
regex: __meta_kubernetes_node_label_(.+)
|
|
- target_label: __address__
|
|
replacement: kubernetes.default.svc:443
|
|
- source_labels: [__meta_kubernetes_node_name]
|
|
regex: (.+)
|
|
target_label: __metrics_path__
|
|
replacement: /api/v1/nodes/${1}/proxy/metrics
|
|
|
|
# Scrape config for Kubelet cAdvisor.
|
|
#
|
|
# This is required for Kubernetes 1.7.3 and later, where cAdvisor metrics
|
|
# (those whose names begin with 'container_') have been removed from the
|
|
# Kubelet metrics endpoint. This job scrapes the cAdvisor endpoint to
|
|
# retrieve those metrics.
|
|
#
|
|
# In Kubernetes 1.7.0-1.7.2, these metrics are only exposed on the cAdvisor
|
|
# HTTP endpoint; use "replacement: /api/v1/nodes/${1}:4194/proxy/metrics"
|
|
# in that case (and ensure cAdvisor's HTTP server hasn't been disabled with
|
|
# the --cadvisor-port=0 Kubelet flag).
|
|
#
|
|
# This job is not necessary and should be removed in Kubernetes 1.6 and
|
|
# earlier versions, or it will cause the metrics to be scraped twice.
|
|
- job_name: 'kubernetes-cadvisor'
|
|
scheme: https
|
|
tls_config:
|
|
ca_file: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
|
|
bearer_token_file: /var/run/secrets/kubernetes.io/serviceaccount/token
|
|
kubernetes_sd_configs:
|
|
- role: node
|
|
relabel_configs:
|
|
- action: labelmap
|
|
regex: __meta_kubernetes_node_label_(.+)
|
|
- target_label: __address__
|
|
replacement: kubernetes.default.svc:443
|
|
- source_labels: [__meta_kubernetes_node_name]
|
|
regex: (.+)
|
|
target_label: __metrics_path__
|
|
replacement: /api/v1/nodes/${1}/proxy/metrics/cadvisor
|
|
|
|
# scrape config for service endpoints.
|
|
- job_name: 'kubernetes-service-endpoints'
|
|
kubernetes_sd_configs:
|
|
- role: endpoints
|
|
relabel_configs:
|
|
- source_labels: [__meta_kubernetes_service_annotation_prometheus_io_scrape]
|
|
action: keep
|
|
regex: true
|
|
- source_labels: [__meta_kubernetes_service_annotation_prometheus_io_scheme]
|
|
action: replace
|
|
target_label: __scheme__
|
|
regex: (https?)
|
|
- source_labels: [__meta_kubernetes_service_annotation_prometheus_io_path]
|
|
action: replace
|
|
target_label: __metrics_path__
|
|
regex: (.+)
|
|
- source_labels: [__address__, __meta_kubernetes_service_annotation_prometheus_io_port]
|
|
action: replace
|
|
target_label: __address__
|
|
regex: ([^:]+)(?::\d+)?;(\d+)
|
|
replacement: $1:$2
|
|
- action: labelmap
|
|
regex: __meta_kubernetes_service_label_(.+)
|
|
- source_labels: [__meta_kubernetes_namespace]
|
|
action: replace
|
|
target_label: kubernetes_namespace
|
|
- source_labels: [__meta_kubernetes_service_name]
|
|
action: replace
|
|
target_label: kubernetes_name
|
|
|
|
- job_name: 'kubernetes-pods'
|
|
kubernetes_sd_configs:
|
|
- role: pod
|
|
relabel_configs: # If first two labels are present, pod should be scraped by the istio-secure job.
|
|
- source_labels: [__meta_kubernetes_pod_annotation_prometheus_io_scrape]
|
|
action: keep
|
|
regex: true
|
|
- source_labels: [__meta_kubernetes_pod_annotation_sidecar_istio_io_status]
|
|
action: drop
|
|
regex: (.+)
|
|
- source_labels: [__meta_kubernetes_pod_annotation_istio_mtls]
|
|
action: drop
|
|
regex: (true)
|
|
- source_labels: [__meta_kubernetes_pod_annotation_prometheus_io_path]
|
|
action: replace
|
|
target_label: __metrics_path__
|
|
regex: (.+)
|
|
- source_labels: [__address__, __meta_kubernetes_pod_annotation_prometheus_io_port]
|
|
action: replace
|
|
regex: ([^:]+)(?::\d+)?;(\d+)
|
|
replacement: $1:$2
|
|
target_label: __address__
|
|
- action: labelmap
|
|
regex: __meta_kubernetes_pod_label_(.+)
|
|
- source_labels: [__meta_kubernetes_namespace]
|
|
action: replace
|
|
target_label: namespace
|
|
- source_labels: [__meta_kubernetes_pod_name]
|
|
action: replace
|
|
target_label: pod_name
|
|
|
|
- job_name: 'kubernetes-pods-istio-secure'
|
|
scheme: https
|
|
tls_config:
|
|
ca_file: /etc/istio-certs/root-cert.pem
|
|
cert_file: /etc/istio-certs/cert-chain.pem
|
|
key_file: /etc/istio-certs/key.pem
|
|
insecure_skip_verify: true # prometheus does not support secure naming.
|
|
kubernetes_sd_configs:
|
|
- role: pod
|
|
relabel_configs:
|
|
- source_labels: [__meta_kubernetes_pod_annotation_prometheus_io_scrape]
|
|
action: keep
|
|
regex: true
|
|
# sidecar status annotation is added by sidecar injector and
|
|
# istio_workload_mtls_ability can be specifically placed on a pod to indicate its ability to receive mtls traffic.
|
|
- source_labels: [__meta_kubernetes_pod_annotation_sidecar_istio_io_status, __meta_kubernetes_pod_annotation_istio_mtls]
|
|
action: keep
|
|
regex: (([^;]+);([^;]*))|(([^;]*);(true))
|
|
- source_labels: [__meta_kubernetes_pod_annotation_prometheus_io_path]
|
|
action: replace
|
|
target_label: __metrics_path__
|
|
regex: (.+)
|
|
- source_labels: [__address__] # Only keep address that is host:port
|
|
action: keep # otherwise an extra target with ':443' is added for https scheme
|
|
regex: ([^:]+):(\d+)
|
|
- source_labels: [__address__, __meta_kubernetes_pod_annotation_prometheus_io_port]
|
|
action: replace
|
|
regex: ([^:]+)(?::\d+)?;(\d+)
|
|
replacement: $1:$2
|
|
target_label: __address__
|
|
- action: labelmap
|
|
regex: __meta_kubernetes_pod_label_(.+)
|
|
- source_labels: [__meta_kubernetes_namespace]
|
|
action: replace
|
|
target_label: namespace
|
|
- source_labels: [__meta_kubernetes_pod_name]
|
|
action: replace
|
|
target_label: pod_name
|
|
|
|
---
|
|
|
|
# Source: istio/charts/prometheus/templates/clusterrole.yaml
|
|
apiVersion: rbac.authorization.k8s.io/v1beta1
|
|
kind: ClusterRole
|
|
metadata:
|
|
name: prometheus-istio-system
|
|
labels:
|
|
app: prometheus
|
|
chart: prometheus-1.0.6
|
|
heritage: Tiller
|
|
release: istio
|
|
rules:
|
|
- apiGroups: [""]
|
|
resources:
|
|
- nodes
|
|
- services
|
|
- endpoints
|
|
- pods
|
|
- nodes/proxy
|
|
verbs: ["get", "list", "watch"]
|
|
- apiGroups: [""]
|
|
resources:
|
|
- configmaps
|
|
verbs: ["get"]
|
|
- nonResourceURLs: ["/metrics"]
|
|
verbs: ["get"]
|
|
|
|
---
|
|
|
|
# Source: istio/charts/prometheus/templates/serviceaccount.yaml
|
|
apiVersion: v1
|
|
kind: ServiceAccount
|
|
metadata:
|
|
name: prometheus
|
|
namespace: istio-system
|
|
labels:
|
|
app: prometheus
|
|
chart: prometheus-1.0.6
|
|
heritage: Tiller
|
|
release: istio
|
|
|
|
---
|
|
|
|
# Source: istio/charts/prometheus/templates/clusterrolebindings.yaml
|
|
apiVersion: rbac.authorization.k8s.io/v1beta1
|
|
kind: ClusterRoleBinding
|
|
metadata:
|
|
name: prometheus-istio-system
|
|
labels:
|
|
app: prometheus
|
|
chart: prometheus-1.0.6
|
|
heritage: Tiller
|
|
release: istio
|
|
roleRef:
|
|
apiGroup: rbac.authorization.k8s.io
|
|
kind: ClusterRole
|
|
name: prometheus-istio-system
|
|
subjects:
|
|
- kind: ServiceAccount
|
|
name: prometheus
|
|
namespace: istio-system
|
|
|
|
---
|
|
|
|
# Source: istio/charts/prometheus/templates/service.yaml
|
|
apiVersion: v1
|
|
kind: Service
|
|
metadata:
|
|
name: prometheus
|
|
namespace: istio-system
|
|
annotations:
|
|
prometheus.io/scrape: 'true'
|
|
labels:
|
|
name: prometheus
|
|
spec:
|
|
selector:
|
|
app: prometheus
|
|
ports:
|
|
- name: http-prometheus
|
|
protocol: TCP
|
|
port: 9090
|
|
|
|
---
|
|
|
|
# Source: istio/charts/prometheus/templates/deployment.yaml
|
|
apiVersion: apps/v1beta1
|
|
kind: Deployment
|
|
metadata:
|
|
name: prometheus
|
|
namespace: istio-system
|
|
labels:
|
|
app: prometheus
|
|
chart: prometheus-1.0.6
|
|
heritage: Tiller
|
|
release: istio
|
|
spec:
|
|
replicas: 1
|
|
selector:
|
|
matchLabels:
|
|
app: prometheus
|
|
template:
|
|
metadata:
|
|
labels:
|
|
app: prometheus
|
|
annotations:
|
|
sidecar.istio.io/inject: "false"
|
|
scheduler.alpha.kubernetes.io/critical-pod: ""
|
|
spec:
|
|
serviceAccountName: prometheus
|
|
containers:
|
|
- name: prometheus
|
|
image: "docker.io/prom/prometheus:v2.3.1"
|
|
imagePullPolicy: IfNotPresent
|
|
args:
|
|
- '--storage.tsdb.retention=6h'
|
|
- '--config.file=/etc/prometheus/prometheus.yml'
|
|
ports:
|
|
- containerPort: 9090
|
|
name: http
|
|
livenessProbe:
|
|
httpGet:
|
|
path: /-/healthy
|
|
port: 9090
|
|
readinessProbe:
|
|
httpGet:
|
|
path: /-/ready
|
|
port: 9090
|
|
resources:
|
|
requests:
|
|
cpu: 10m
|
|
|
|
volumeMounts:
|
|
- name: config-volume
|
|
mountPath: /etc/prometheus
|
|
- mountPath: /etc/istio-certs
|
|
name: istio-certs
|
|
volumes:
|
|
- name: config-volume
|
|
configMap:
|
|
name: prometheus
|
|
- name: istio-certs
|
|
secret:
|
|
defaultMode: 420
|
|
optional: true
|
|
secretName: istio.default
|
|
affinity:
|
|
nodeAffinity:
|
|
requiredDuringSchedulingIgnoredDuringExecution:
|
|
nodeSelectorTerms:
|
|
- matchExpressions:
|
|
- key: beta.kubernetes.io/arch
|
|
operator: In
|
|
values:
|
|
- amd64
|
|
- ppc64le
|
|
- s390x
|
|
preferredDuringSchedulingIgnoredDuringExecution:
|
|
- weight: 2
|
|
preference:
|
|
matchExpressions:
|
|
- key: beta.kubernetes.io/arch
|
|
operator: In
|
|
values:
|
|
- amd64
|
|
- weight: 2
|
|
preference:
|
|
matchExpressions:
|
|
- key: beta.kubernetes.io/arch
|
|
operator: In
|
|
values:
|
|
- ppc64le
|
|
- weight: 2
|
|
preference:
|
|
matchExpressions:
|
|
- key: beta.kubernetes.io/arch
|
|
operator: In
|
|
values:
|
|
- s390x
|
|
|
|
---
|
|
apiVersion: "config.istio.io/v1alpha2"
|
|
kind: metric
|
|
metadata:
|
|
name: requestcount
|
|
namespace: istio-system
|
|
spec:
|
|
value: "1"
|
|
dimensions:
|
|
reporter: conditional((context.reporter.kind | "inbound") == "outbound", "source", "destination")
|
|
source_workload: source.workload.name | "unknown"
|
|
source_workload_namespace: source.workload.namespace | "unknown"
|
|
source_principal: source.principal | "unknown"
|
|
source_app: source.labels["app"] | "unknown"
|
|
source_version: source.labels["version"] | "unknown"
|
|
destination_workload: destination.workload.name | "unknown"
|
|
destination_workload_namespace: destination.workload.namespace | "unknown"
|
|
destination_principal: destination.principal | "unknown"
|
|
destination_app: destination.labels["app"] | "unknown"
|
|
destination_version: destination.labels["version"] | "unknown"
|
|
destination_service: destination.service.host | "unknown"
|
|
destination_service_name: destination.service.name | "unknown"
|
|
destination_service_namespace: destination.service.namespace | "unknown"
|
|
request_protocol: api.protocol | context.protocol | "unknown"
|
|
response_code: response.code | 200
|
|
connection_security_policy: conditional((context.reporter.kind | "inbound") == "outbound", "unknown", conditional(connection.mtls | false, "mutual_tls", "none"))
|
|
monitored_resource_type: '"UNSPECIFIED"'
|
|
---
|
|
apiVersion: "config.istio.io/v1alpha2"
|
|
kind: metric
|
|
metadata:
|
|
name: requestduration
|
|
namespace: istio-system
|
|
spec:
|
|
value: response.duration | "0ms"
|
|
dimensions:
|
|
reporter: conditional((context.reporter.kind | "inbound") == "outbound", "source", "destination")
|
|
source_workload: source.workload.name | "unknown"
|
|
source_workload_namespace: source.workload.namespace | "unknown"
|
|
source_principal: source.principal | "unknown"
|
|
source_app: source.labels["app"] | "unknown"
|
|
source_version: source.labels["version"] | "unknown"
|
|
destination_workload: destination.workload.name | "unknown"
|
|
destination_workload_namespace: destination.workload.namespace | "unknown"
|
|
destination_principal: destination.principal | "unknown"
|
|
destination_app: destination.labels["app"] | "unknown"
|
|
destination_version: destination.labels["version"] | "unknown"
|
|
destination_service: destination.service.host | "unknown"
|
|
destination_service_name: destination.service.name | "unknown"
|
|
destination_service_namespace: destination.service.namespace | "unknown"
|
|
request_protocol: api.protocol | context.protocol | "unknown"
|
|
response_code: response.code | 200
|
|
connection_security_policy: conditional((context.reporter.kind | "inbound") == "outbound", "unknown", conditional(connection.mtls | false, "mutual_tls", "none"))
|
|
monitored_resource_type: '"UNSPECIFIED"'
|
|
---
|
|
apiVersion: "config.istio.io/v1alpha2"
|
|
kind: metric
|
|
metadata:
|
|
name: requestsize
|
|
namespace: istio-system
|
|
spec:
|
|
value: request.size | 0
|
|
dimensions:
|
|
reporter: conditional((context.reporter.kind | "inbound") == "outbound", "source", "destination")
|
|
source_workload: source.workload.name | "unknown"
|
|
source_workload_namespace: source.workload.namespace | "unknown"
|
|
source_principal: source.principal | "unknown"
|
|
source_app: source.labels["app"] | "unknown"
|
|
source_version: source.labels["version"] | "unknown"
|
|
destination_workload: destination.workload.name | "unknown"
|
|
destination_workload_namespace: destination.workload.namespace | "unknown"
|
|
destination_principal: destination.principal | "unknown"
|
|
destination_app: destination.labels["app"] | "unknown"
|
|
destination_version: destination.labels["version"] | "unknown"
|
|
destination_service: destination.service.host | "unknown"
|
|
destination_service_name: destination.service.name | "unknown"
|
|
destination_service_namespace: destination.service.namespace | "unknown"
|
|
request_protocol: api.protocol | context.protocol | "unknown"
|
|
response_code: response.code | 200
|
|
connection_security_policy: conditional((context.reporter.kind | "inbound") == "outbound", "unknown", conditional(connection.mtls | false, "mutual_tls", "none"))
|
|
monitored_resource_type: '"UNSPECIFIED"'
|
|
---
|
|
apiVersion: "config.istio.io/v1alpha2"
|
|
kind: metric
|
|
metadata:
|
|
name: responsesize
|
|
namespace: istio-system
|
|
spec:
|
|
value: response.size | 0
|
|
dimensions:
|
|
reporter: conditional((context.reporter.kind | "inbound") == "outbound", "source", "destination")
|
|
source_workload: source.workload.name | "unknown"
|
|
source_workload_namespace: source.workload.namespace | "unknown"
|
|
source_principal: source.principal | "unknown"
|
|
source_app: source.labels["app"] | "unknown"
|
|
source_version: source.labels["version"] | "unknown"
|
|
destination_workload: destination.workload.name | "unknown"
|
|
destination_workload_namespace: destination.workload.namespace | "unknown"
|
|
destination_principal: destination.principal | "unknown"
|
|
destination_app: destination.labels["app"] | "unknown"
|
|
destination_version: destination.labels["version"] | "unknown"
|
|
destination_service: destination.service.host | "unknown"
|
|
destination_service_name: destination.service.name | "unknown"
|
|
destination_service_namespace: destination.service.namespace | "unknown"
|
|
request_protocol: api.protocol | context.protocol | "unknown"
|
|
response_code: response.code | 200
|
|
connection_security_policy: conditional((context.reporter.kind | "inbound") == "outbound", "unknown", conditional(connection.mtls | false, "mutual_tls", "none"))
|
|
monitored_resource_type: '"UNSPECIFIED"'
|
|
---
|
|
apiVersion: "config.istio.io/v1alpha2"
|
|
kind: metric
|
|
metadata:
|
|
name: tcpbytesent
|
|
namespace: istio-system
|
|
spec:
|
|
value: connection.sent.bytes | 0
|
|
dimensions:
|
|
reporter: conditional((context.reporter.kind | "inbound") == "outbound", "source", "destination")
|
|
source_workload: source.workload.name | "unknown"
|
|
source_workload_namespace: source.workload.namespace | "unknown"
|
|
source_principal: source.principal | "unknown"
|
|
source_app: source.labels["app"] | "unknown"
|
|
source_version: source.labels["version"] | "unknown"
|
|
destination_workload: destination.workload.name | "unknown"
|
|
destination_workload_namespace: destination.workload.namespace | "unknown"
|
|
destination_principal: destination.principal | "unknown"
|
|
destination_app: destination.labels["app"] | "unknown"
|
|
destination_version: destination.labels["version"] | "unknown"
|
|
destination_service: destination.service.name | "unknown"
|
|
destination_service_name: destination.service.name | "unknown"
|
|
destination_service_namespace: destination.service.namespace | "unknown"
|
|
connection_security_policy: conditional((context.reporter.kind | "inbound") == "outbound", "unknown", conditional(connection.mtls | false, "mutual_tls", "none"))
|
|
monitored_resource_type: '"UNSPECIFIED"'
|
|
---
|
|
apiVersion: "config.istio.io/v1alpha2"
|
|
kind: metric
|
|
metadata:
|
|
name: tcpbytereceived
|
|
namespace: istio-system
|
|
spec:
|
|
value: connection.received.bytes | 0
|
|
dimensions:
|
|
reporter: conditional((context.reporter.kind | "inbound") == "outbound", "source", "destination")
|
|
source_workload: source.workload.name | "unknown"
|
|
source_workload_namespace: source.workload.namespace | "unknown"
|
|
source_principal: source.principal | "unknown"
|
|
source_app: source.labels["app"] | "unknown"
|
|
source_version: source.labels["version"] | "unknown"
|
|
destination_workload: destination.workload.name | "unknown"
|
|
destination_workload_namespace: destination.workload.namespace | "unknown"
|
|
destination_principal: destination.principal | "unknown"
|
|
destination_app: destination.labels["app"] | "unknown"
|
|
destination_version: destination.labels["version"] | "unknown"
|
|
destination_service: destination.service.name | "unknown"
|
|
destination_service_name: destination.service.name | "unknown"
|
|
destination_service_namespace: destination.service.namespace | "unknown"
|
|
connection_security_policy: conditional((context.reporter.kind | "inbound") == "outbound", "unknown", conditional(connection.mtls | false, "mutual_tls", "none"))
|
|
monitored_resource_type: '"UNSPECIFIED"'
|
|
---
|
|
apiVersion: "config.istio.io/v1alpha2"
|
|
kind: prometheus
|
|
metadata:
|
|
name: handler
|
|
namespace: istio-system
|
|
spec:
|
|
metrics:
|
|
- name: requests_total
|
|
instance_name: requestcount.metric.istio-system
|
|
kind: COUNTER
|
|
label_names:
|
|
- reporter
|
|
- source_app
|
|
- source_principal
|
|
- source_workload
|
|
- source_workload_namespace
|
|
- source_version
|
|
- destination_app
|
|
- destination_principal
|
|
- destination_workload
|
|
- destination_workload_namespace
|
|
- destination_version
|
|
- destination_service
|
|
- destination_service_name
|
|
- destination_service_namespace
|
|
- request_protocol
|
|
- response_code
|
|
- connection_security_policy
|
|
- name: request_duration_seconds
|
|
instance_name: requestduration.metric.istio-system
|
|
kind: DISTRIBUTION
|
|
label_names:
|
|
- reporter
|
|
- source_app
|
|
- source_principal
|
|
- source_workload
|
|
- source_workload_namespace
|
|
- source_version
|
|
- destination_app
|
|
- destination_principal
|
|
- destination_workload
|
|
- destination_workload_namespace
|
|
- destination_version
|
|
- destination_service
|
|
- destination_service_name
|
|
- destination_service_namespace
|
|
- request_protocol
|
|
- response_code
|
|
- connection_security_policy
|
|
buckets:
|
|
explicit_buckets:
|
|
bounds: [0.005, 0.01, 0.025, 0.05, 0.1, 0.25, 0.5, 1, 2.5, 5, 10]
|
|
- name: request_bytes
|
|
instance_name: requestsize.metric.istio-system
|
|
kind: DISTRIBUTION
|
|
label_names:
|
|
- reporter
|
|
- source_app
|
|
- source_principal
|
|
- source_workload
|
|
- source_workload_namespace
|
|
- source_version
|
|
- destination_app
|
|
- destination_principal
|
|
- destination_workload
|
|
- destination_workload_namespace
|
|
- destination_version
|
|
- destination_service
|
|
- destination_service_name
|
|
- destination_service_namespace
|
|
- request_protocol
|
|
- response_code
|
|
- connection_security_policy
|
|
buckets:
|
|
exponentialBuckets:
|
|
numFiniteBuckets: 8
|
|
scale: 1
|
|
growthFactor: 10
|
|
- name: response_bytes
|
|
instance_name: responsesize.metric.istio-system
|
|
kind: DISTRIBUTION
|
|
label_names:
|
|
- reporter
|
|
- source_app
|
|
- source_principal
|
|
- source_workload
|
|
- source_workload_namespace
|
|
- source_version
|
|
- destination_app
|
|
- destination_principal
|
|
- destination_workload
|
|
- destination_workload_namespace
|
|
- destination_version
|
|
- destination_service
|
|
- destination_service_name
|
|
- destination_service_namespace
|
|
- request_protocol
|
|
- response_code
|
|
- connection_security_policy
|
|
buckets:
|
|
exponentialBuckets:
|
|
numFiniteBuckets: 8
|
|
scale: 1
|
|
growthFactor: 10
|
|
- name: tcp_sent_bytes_total
|
|
instance_name: tcpbytesent.metric.istio-system
|
|
kind: COUNTER
|
|
label_names:
|
|
- reporter
|
|
- source_app
|
|
- source_principal
|
|
- source_workload
|
|
- source_workload_namespace
|
|
- source_version
|
|
- destination_app
|
|
- destination_principal
|
|
- destination_workload
|
|
- destination_workload_namespace
|
|
- destination_version
|
|
- destination_service
|
|
- destination_service_name
|
|
- destination_service_namespace
|
|
- connection_security_policy
|
|
- name: tcp_received_bytes_total
|
|
instance_name: tcpbytereceived.metric.istio-system
|
|
kind: COUNTER
|
|
label_names:
|
|
- reporter
|
|
- source_app
|
|
- source_principal
|
|
- source_workload
|
|
- source_workload_namespace
|
|
- source_version
|
|
- destination_app
|
|
- destination_principal
|
|
- destination_workload
|
|
- destination_workload_namespace
|
|
- destination_version
|
|
- destination_service
|
|
- destination_service_name
|
|
- destination_service_namespace
|
|
- connection_security_policy
|
|
---
|
|
apiVersion: "config.istio.io/v1alpha2"
|
|
kind: rule
|
|
metadata:
|
|
name: promhttp
|
|
namespace: istio-system
|
|
spec:
|
|
match: context.protocol == "http" || context.protocol == "grpc"
|
|
actions:
|
|
- handler: handler.prometheus
|
|
instances:
|
|
- requestcount.metric
|
|
- requestduration.metric
|
|
- requestsize.metric
|
|
- responsesize.metric
|
|
---
|
|
apiVersion: "config.istio.io/v1alpha2"
|
|
kind: rule
|
|
metadata:
|
|
name: promtcp
|
|
namespace: istio-system
|
|
spec:
|
|
match: context.protocol == "tcp"
|
|
actions:
|
|
- handler: handler.prometheus
|
|
instances:
|
|
- tcpbytesent.metric
|
|
- tcpbytereceived.metric
|
|
---
|