Add rancher-monitoring chart 104.1.2+up57.0.3
This commit is contained in:
wbsong111
@@ -0,0 +1,135 @@
|
||||
{{- if and .Values.global.rbac.create .Values.global.rbac.userRoles.create }}
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: monitoring-admin
|
||||
labels: {{ include "kube-prometheus-stack.labels" . | nindent 4 }}
|
||||
{{- if .Values.global.rbac.userRoles.aggregateToDefaultRoles }}
|
||||
rbac.authorization.k8s.io/aggregate-to-admin: "true"
|
||||
{{- end }}
|
||||
rules:
|
||||
- apiGroups:
|
||||
- monitoring.coreos.com
|
||||
resources:
|
||||
- alertmanagers
|
||||
- prometheuses
|
||||
- prometheuses/finalizers
|
||||
- alertmanagers/finalizers
|
||||
verbs:
|
||||
- 'get'
|
||||
- 'list'
|
||||
- 'watch'
|
||||
- apiGroups:
|
||||
- monitoring.coreos.com
|
||||
resources:
|
||||
- thanosrulers
|
||||
- thanosrulers/finalizers
|
||||
- servicemonitors
|
||||
- podmonitors
|
||||
- prometheusrules
|
||||
- podmonitors
|
||||
- probes
|
||||
- probes/finalizers
|
||||
- alertmanagerconfigs
|
||||
verbs:
|
||||
- '*'
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: monitoring-edit
|
||||
labels: {{ include "kube-prometheus-stack.labels" . | nindent 4 }}
|
||||
{{- if .Values.global.rbac.userRoles.aggregateToDefaultRoles }}
|
||||
rbac.authorization.k8s.io/aggregate-to-edit: "true"
|
||||
{{- end }}
|
||||
rules:
|
||||
- apiGroups:
|
||||
- monitoring.coreos.com
|
||||
resources:
|
||||
- alertmanagers
|
||||
- prometheuses
|
||||
- prometheuses/finalizers
|
||||
- alertmanagers/finalizers
|
||||
verbs:
|
||||
- 'get'
|
||||
- 'list'
|
||||
- 'watch'
|
||||
- apiGroups:
|
||||
- monitoring.coreos.com
|
||||
resources:
|
||||
- thanosrulers
|
||||
- thanosrulers/finalizers
|
||||
- servicemonitors
|
||||
- podmonitors
|
||||
- prometheusrules
|
||||
- podmonitors
|
||||
- probes
|
||||
- alertmanagerconfigs
|
||||
verbs:
|
||||
- '*'
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: monitoring-view
|
||||
labels: {{ include "kube-prometheus-stack.labels" . | nindent 4 }}
|
||||
{{- if .Values.global.rbac.userRoles.aggregateToDefaultRoles }}
|
||||
rbac.authorization.k8s.io/aggregate-to-view: "true"
|
||||
{{- end }}
|
||||
rules:
|
||||
- apiGroups:
|
||||
- monitoring.coreos.com
|
||||
resources:
|
||||
- alertmanagers
|
||||
- prometheuses
|
||||
- prometheuses/finalizers
|
||||
- alertmanagers/finalizers
|
||||
- thanosrulers
|
||||
- thanosrulers/finalizers
|
||||
- servicemonitors
|
||||
- podmonitors
|
||||
- prometheusrules
|
||||
- podmonitors
|
||||
- probes
|
||||
- probes/finalizers
|
||||
- alertmanagerconfigs
|
||||
verbs:
|
||||
- 'get'
|
||||
- 'list'
|
||||
- 'watch'
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: monitoring-ui-view
|
||||
labels: {{ include "kube-prometheus-stack.labels" . | nindent 4 }}
|
||||
rules:
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- services/proxy
|
||||
resourceNames:
|
||||
- "http:{{ template "kube-prometheus-stack.fullname" . }}-prometheus:{{ .Values.prometheus.service.port }}"
|
||||
- "https:{{ template "kube-prometheus-stack.fullname" . }}-prometheus:{{ .Values.prometheus.service.port }}"
|
||||
- "http:{{ template "kube-prometheus-stack.fullname" . }}-alertmanager:{{ .Values.alertmanager.service.port }}"
|
||||
- "https:{{ template "kube-prometheus-stack.fullname" . }}-alertmanager:{{ .Values.alertmanager.service.port }}"
|
||||
{{- if .Values.grafana.enabled }}
|
||||
- "http:{{ include "call-nested" (list . "grafana" "grafana.fullname") }}:{{ .Values.grafana.service.port }}"
|
||||
- "https:{{ include "call-nested" (list . "grafana" "grafana.fullname") }}:{{ .Values.grafana.service.port }}"
|
||||
{{- end }}
|
||||
verbs:
|
||||
- 'get'
|
||||
- 'create'
|
||||
- apiGroups:
|
||||
- ""
|
||||
resourceNames:
|
||||
- {{ template "kube-prometheus-stack.fullname" . }}-prometheus
|
||||
- {{ template "kube-prometheus-stack.fullname" . }}-alertmanager
|
||||
{{- if .Values.grafana.enabled }}
|
||||
- {{ include "call-nested" (list . "grafana" "grafana.fullname") }}
|
||||
{{- end }}
|
||||
resources:
|
||||
- endpoints
|
||||
verbs:
|
||||
- list
|
||||
{{- end }}
|
||||
@@ -0,0 +1,48 @@
|
||||
{{- if and .Values.global.rbac.create .Values.global.rbac.userRoles.create }}
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: Role
|
||||
metadata:
|
||||
name: monitoring-config-admin
|
||||
namespace: {{ template "kube-prometheus-stack.namespace" . }}
|
||||
labels: {{ include "kube-prometheus-stack.labels" . | nindent 4 }}
|
||||
rules:
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- configmaps
|
||||
- secrets
|
||||
verbs:
|
||||
- '*'
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: Role
|
||||
metadata:
|
||||
name: monitoring-config-edit
|
||||
namespace: {{ template "kube-prometheus-stack.namespace" . }}
|
||||
labels: {{ include "kube-prometheus-stack.labels" . | nindent 4 }}
|
||||
rules:
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- configmaps
|
||||
- secrets
|
||||
verbs:
|
||||
- '*'
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: Role
|
||||
metadata:
|
||||
name: monitoring-config-view
|
||||
namespace: {{ template "kube-prometheus-stack.namespace" . }}
|
||||
labels: {{ include "kube-prometheus-stack.labels" . | nindent 4 }}
|
||||
rules:
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- configmaps
|
||||
- secrets
|
||||
verbs:
|
||||
- 'get'
|
||||
- 'list'
|
||||
- 'watch'
|
||||
{{- end }}
|
||||
@@ -0,0 +1,47 @@
|
||||
{{- if and .Values.global.rbac.create .Values.global.rbac.userRoles.create .Values.grafana.enabled }}
|
||||
{{- if .Values.grafana.defaultDashboardsEnabled }}
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: Role
|
||||
metadata:
|
||||
name: monitoring-dashboard-admin
|
||||
namespace: {{ .Values.grafana.defaultDashboards.namespace }}
|
||||
labels: {{ include "kube-prometheus-stack.labels" . | nindent 4 }}
|
||||
rules:
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- configmaps
|
||||
verbs:
|
||||
- '*'
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: Role
|
||||
metadata:
|
||||
name: monitoring-dashboard-edit
|
||||
namespace: {{ .Values.grafana.defaultDashboards.namespace }}
|
||||
labels: {{ include "kube-prometheus-stack.labels" . | nindent 4 }}
|
||||
rules:
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- configmaps
|
||||
verbs:
|
||||
- '*'
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: Role
|
||||
metadata:
|
||||
name: monitoring-dashboard-view
|
||||
namespace: {{ .Values.grafana.defaultDashboards.namespace }}
|
||||
labels: {{ include "kube-prometheus-stack.labels" . | nindent 4 }}
|
||||
rules:
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- configmaps
|
||||
verbs:
|
||||
- 'get'
|
||||
- 'list'
|
||||
- 'watch'
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
+18
@@ -0,0 +1,18 @@
|
||||
{{- if and .Values.grafana.enabled .Values.grafana.defaultDashboardsEnabled .Values.ingressNginx.enabled }}
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
namespace: {{ .Values.grafana.defaultDashboards.namespace }}
|
||||
name: {{ printf "%s-%s" (include "kube-prometheus-stack.fullname" $) "ingress-nginx" | trunc 63 | trimSuffix "-" }}
|
||||
{{- if .Values.grafana.sidecar.dashboards.annotations }}
|
||||
annotations: {{ toYaml .Values.grafana.sidecar.dashboards.annotations | nindent 4 }}
|
||||
{{- end }}
|
||||
labels:
|
||||
{{- if $.Values.grafana.sidecar.dashboards.label }}
|
||||
{{ $.Values.grafana.sidecar.dashboards.label }}: "1"
|
||||
{{- end }}
|
||||
app: {{ template "kube-prometheus-stack.name" $ }}-grafana
|
||||
{{ include "kube-prometheus-stack.labels" $ | indent 4 }}
|
||||
data:
|
||||
{{ (.Files.Glob "files/ingress-nginx/*").AsConfig | indent 2 }}
|
||||
{{- end }}
|
||||
+17
@@ -0,0 +1,17 @@
|
||||
{{- if and .Values.grafana.enabled .Values.grafana.defaultDashboardsEnabled }}
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
namespace: {{ .Values.grafana.defaultDashboards.namespace }}
|
||||
name: rancher-default-dashboards-cluster
|
||||
annotations:
|
||||
{{ toYaml .Values.grafana.sidecar.dashboards.annotations | indent 4 }}
|
||||
labels:
|
||||
{{- if $.Values.grafana.sidecar.dashboards.label }}
|
||||
{{ $.Values.grafana.sidecar.dashboards.label }}: "1"
|
||||
{{- end }}
|
||||
app: {{ template "kube-prometheus-stack.name" $ }}-grafana
|
||||
{{ include "kube-prometheus-stack.labels" $ | indent 4 }}
|
||||
data:
|
||||
{{ (.Files.Glob "files/rancher/cluster/*").AsConfig | indent 2 }}
|
||||
{{- end }}
|
||||
+17
@@ -0,0 +1,17 @@
|
||||
{{- if and .Values.grafana.enabled .Values.grafana.defaultDashboardsEnabled }}
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
namespace: {{ .Values.grafana.defaultDashboards.namespace }}
|
||||
name: rancher-default-dashboards-home
|
||||
annotations:
|
||||
{{ toYaml .Values.grafana.sidecar.dashboards.annotations | indent 4 }}
|
||||
labels:
|
||||
{{- if $.Values.grafana.sidecar.dashboards.label }}
|
||||
{{ $.Values.grafana.sidecar.dashboards.label }}: "1"
|
||||
{{- end }}
|
||||
app: {{ template "kube-prometheus-stack.name" $ }}-grafana
|
||||
{{ include "kube-prometheus-stack.labels" $ | indent 4 }}
|
||||
data:
|
||||
{{ (.Files.Glob "files/rancher/home/*").AsConfig | indent 2 }}
|
||||
{{- end }}
|
||||
+17
@@ -0,0 +1,17 @@
|
||||
{{- if and .Values.grafana.enabled .Values.grafana.defaultDashboardsEnabled }}
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
namespace: {{ .Values.grafana.defaultDashboards.namespace }}
|
||||
name: rancher-fleet-dashboards
|
||||
annotations:
|
||||
{{ toYaml .Values.grafana.sidecar.dashboards.annotations | indent 4 }}
|
||||
labels:
|
||||
{{- if $.Values.grafana.sidecar.dashboards.label }}
|
||||
{{ $.Values.grafana.sidecar.dashboards.label }}: "1"
|
||||
{{- end }}
|
||||
app: {{ template "kube-prometheus-stack.name" $ }}-grafana
|
||||
{{ include "kube-prometheus-stack.labels" $ | indent 4 }}
|
||||
data:
|
||||
{{ (.Files.Glob "files/rancher/fleet/*").AsConfig | indent 2 }}
|
||||
{{- end }}
|
||||
+31
@@ -0,0 +1,31 @@
|
||||
{{- $files := (.Files.Glob "files/rancher/k8s/*").AsConfig }}
|
||||
{{- $filesDict := (fromYaml $files) }}
|
||||
{{- if not (include "exporter.kubeEtcd.enabled" .) }}
|
||||
{{- $filesDict = (unset $filesDict "rancher-etcd-nodes.json") -}}
|
||||
{{- $filesDict = (unset $filesDict "rancher-etcd.json") -}}
|
||||
{{- end }}
|
||||
{{- if not (include "exporter.kubeControllerManager.enabled" .) }}
|
||||
{{- $filesDict = (unset $filesDict "rancher-k8s-components-nodes.json") -}}
|
||||
{{- $filesDict = (unset $filesDict "rancher-k8s-components.json") -}}
|
||||
{{- else }}
|
||||
{{- $_ := (set $filesDict "rancher-k8s-components-nodes.json" (get $filesDict "rancher-k8s-components-nodes.json" | replace "kube-controller-manager" (include "exporter.kubeControllerManager.jobName" .))) -}}
|
||||
{{- $_ := (set $filesDict "rancher-k8s-components.json" (get $filesDict "rancher-k8s-components.json" | replace "kube-controller-manager" (include "exporter.kubeControllerManager.jobName" .))) -}}
|
||||
{{- end }}
|
||||
{{ $files = (toYaml $filesDict) }}
|
||||
{{- if and .Values.grafana.enabled .Values.grafana.defaultDashboardsEnabled }}
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
namespace: {{ .Values.grafana.defaultDashboards.namespace }}
|
||||
name: rancher-default-dashboards-k8s
|
||||
annotations:
|
||||
{{ toYaml .Values.grafana.sidecar.dashboards.annotations | indent 4 }}
|
||||
labels:
|
||||
{{- if $.Values.grafana.sidecar.dashboards.label }}
|
||||
{{ $.Values.grafana.sidecar.dashboards.label }}: "1"
|
||||
{{- end }}
|
||||
app: {{ template "kube-prometheus-stack.name" $ }}-grafana
|
||||
{{ include "kube-prometheus-stack.labels" $ | indent 4 }}
|
||||
data:
|
||||
{{ $files | indent 2 }}
|
||||
{{- end }}
|
||||
+17
@@ -0,0 +1,17 @@
|
||||
{{- if and .Values.grafana.enabled .Values.grafana.defaultDashboardsEnabled }}
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
namespace: {{ .Values.grafana.defaultDashboards.namespace }}
|
||||
name: rancher-default-dashboards-nodes
|
||||
annotations:
|
||||
{{ toYaml .Values.grafana.sidecar.dashboards.annotations | indent 4 }}
|
||||
labels:
|
||||
{{- if $.Values.grafana.sidecar.dashboards.label }}
|
||||
{{ $.Values.grafana.sidecar.dashboards.label }}: "1"
|
||||
{{- end }}
|
||||
app: {{ template "kube-prometheus-stack.name" $ }}-grafana
|
||||
{{ include "kube-prometheus-stack.labels" $ | indent 4 }}
|
||||
data:
|
||||
{{ (.Files.Glob "files/rancher/nodes/*").AsConfig | indent 2 }}
|
||||
{{- end }}
|
||||
+18
@@ -0,0 +1,18 @@
|
||||
{{- $selector := (include "rancher.serviceMonitor.selector" .) -}}
|
||||
{{- if and .Values.grafana.enabled .Values.grafana.defaultDashboardsEnabled .Values.rancherMonitoring.enabled $selector }}
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
namespace: {{ .Values.grafana.defaultDashboards.namespace }}
|
||||
name: rancher-default-dashboards-performance-debugging
|
||||
annotations:
|
||||
{{ toYaml .Values.grafana.sidecar.dashboards.annotations | indent 4 }}
|
||||
labels:
|
||||
{{- if $.Values.grafana.sidecar.dashboards.label }}
|
||||
{{ $.Values.grafana.sidecar.dashboards.label }}: "1"
|
||||
{{- end }}
|
||||
app: {{ template "kube-prometheus-stack.name" $ }}-grafana
|
||||
{{ include "kube-prometheus-stack.labels" $ | indent 4 }}
|
||||
data:
|
||||
{{ (.Files.Glob "files/rancher/performance/*").AsConfig | indent 2 }}
|
||||
{{- end }}
|
||||
+17
@@ -0,0 +1,17 @@
|
||||
{{- if and .Values.grafana.enabled .Values.grafana.defaultDashboardsEnabled }}
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
namespace: {{ .Values.grafana.defaultDashboards.namespace }}
|
||||
name: rancher-default-dashboards-pods
|
||||
annotations:
|
||||
{{ toYaml .Values.grafana.sidecar.dashboards.annotations | indent 4 }}
|
||||
labels:
|
||||
{{- if $.Values.grafana.sidecar.dashboards.label }}
|
||||
{{ $.Values.grafana.sidecar.dashboards.label }}: "1"
|
||||
{{- end }}
|
||||
app: {{ template "kube-prometheus-stack.name" $ }}-grafana
|
||||
{{ include "kube-prometheus-stack.labels" $ | indent 4 }}
|
||||
data:
|
||||
{{ (.Files.Glob "files/rancher/pods/*").AsConfig | indent 2 }}
|
||||
{{- end }}
|
||||
+17
@@ -0,0 +1,17 @@
|
||||
{{- if and .Values.grafana.enabled .Values.grafana.defaultDashboardsEnabled }}
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
namespace: {{ .Values.grafana.defaultDashboards.namespace }}
|
||||
name: rancher-default-dashboards-workloads
|
||||
annotations:
|
||||
{{ toYaml .Values.grafana.sidecar.dashboards.annotations | indent 4 }}
|
||||
labels:
|
||||
{{- if $.Values.grafana.sidecar.dashboards.label }}
|
||||
{{ $.Values.grafana.sidecar.dashboards.label }}: "1"
|
||||
{{- end }}
|
||||
app: {{ template "kube-prometheus-stack.name" $ }}-grafana
|
||||
{{ include "kube-prometheus-stack.labels" $ | indent 4 }}
|
||||
data:
|
||||
{{ (.Files.Glob "files/rancher/workloads/*").AsConfig | indent 2 }}
|
||||
{{- end }}
|
||||
+53
@@ -0,0 +1,53 @@
|
||||
{{- if .Values.rancherMonitoring.enabled }}
|
||||
apiVersion: monitoring.coreos.com/v1
|
||||
kind: ServiceMonitor
|
||||
metadata:
|
||||
labels: {{ include "kube-prometheus-stack.labels" . | nindent 4 }}
|
||||
name: monitoring-fleet-controller
|
||||
namespace: cattle-fleet-system
|
||||
spec:
|
||||
endpoints:
|
||||
- port: metrics
|
||||
metricRelabelings:
|
||||
{{ if .Values.global.cattle.clusterId }}
|
||||
- sourceLabels: [__address__]
|
||||
targetLabel: cluster_id
|
||||
replacement: {{ .Values.global.cattle.clusterId }}
|
||||
{{- end }}
|
||||
{{ if .Values.global.cattle.clusterName}}
|
||||
- sourceLabels: [__address__]
|
||||
targetLabel: cluster_name
|
||||
replacement: {{ .Values.global.cattle.clusterName }}
|
||||
{{- end }}
|
||||
jobLabel: fleet
|
||||
selector:
|
||||
matchLabels:
|
||||
app: fleet-controller
|
||||
{{- end }}
|
||||
---
|
||||
{{- if .Values.rancherMonitoring.enabled }}
|
||||
apiVersion: monitoring.coreos.com/v1
|
||||
kind: ServiceMonitor
|
||||
metadata:
|
||||
labels: {{ include "kube-prometheus-stack.labels" . | nindent 4 }}
|
||||
name: monitoring-gitops-controller
|
||||
namespace: cattle-fleet-system
|
||||
spec:
|
||||
endpoints:
|
||||
- port: metrics
|
||||
metricRelabelings:
|
||||
{{ if .Values.global.cattle.clusterId }}
|
||||
- sourceLabels: [__address__]
|
||||
targetLabel: cluster_id
|
||||
replacement: {{ .Values.global.cattle.clusterId }}
|
||||
{{- end }}
|
||||
{{ if .Values.global.cattle.clusterName}}
|
||||
- sourceLabels: [__address__]
|
||||
targetLabel: cluster_name
|
||||
replacement: {{ .Values.global.cattle.clusterName }}
|
||||
{{- end }}
|
||||
jobLabel: gitops
|
||||
selector:
|
||||
matchLabels:
|
||||
app: gitjob
|
||||
{{- end }}
|
||||
+27
@@ -0,0 +1,27 @@
|
||||
{{- if and (not .Values.ingressNginx.enabled) (.Values.rkeIngressNginx.enabled) }}
|
||||
{{- fail "Cannot set .Values.rkeIngressNginx.enabled=true when .Values.ingressNginx.enabled=false" }}
|
||||
{{- end }}
|
||||
{{- if and .Values.ingressNginx.enabled (not .Values.rkeIngressNginx.enabled) }}
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: {{ template "kube-prometheus-stack.fullname" . }}-ingress-nginx
|
||||
labels:
|
||||
app: {{ template "kube-prometheus-stack.name" . }}-ingress-nginx
|
||||
jobLabel: ingress-nginx
|
||||
{{ include "kube-prometheus-stack.labels" . | indent 4 }}
|
||||
namespace: {{ .Values.ingressNginx.namespace }}
|
||||
spec:
|
||||
clusterIP: None
|
||||
ports:
|
||||
- name: http-metrics
|
||||
port: {{ .Values.ingressNginx.service.port }}
|
||||
protocol: TCP
|
||||
targetPort: {{ .Values.ingressNginx.service.targetPort }}
|
||||
selector:
|
||||
{{- if .Values.ingressNginx.service.selector }}
|
||||
{{ toYaml .Values.ingressNginx.service.selector | indent 4 }}
|
||||
{{- else }}
|
||||
app: ingress-nginx
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
+49
@@ -0,0 +1,49 @@
|
||||
{{- if and (not .Values.ingressNginx.enabled) (.Values.rkeIngressNginx.enabled) }}
|
||||
{{- fail "Cannot set .Values.rkeIngressNginx.enabled=true when .Values.ingressNginx.enabled=false" }}
|
||||
{{- end }}
|
||||
{{- if and .Values.ingressNginx.enabled (not .Values.rkeIngressNginx.enabled) }}
|
||||
apiVersion: monitoring.coreos.com/v1
|
||||
kind: ServiceMonitor
|
||||
metadata:
|
||||
name: {{ template "kube-prometheus-stack.fullname" . }}-ingress-nginx
|
||||
namespace: {{ .Values.ingressNginx.namespace }}
|
||||
labels:
|
||||
app: {{ template "kube-prometheus-stack.name" . }}-ingress-nginx
|
||||
{{ include "kube-prometheus-stack.labels" . | indent 4 }}
|
||||
spec:
|
||||
jobLabel: jobLabel
|
||||
selector:
|
||||
matchLabels:
|
||||
app: {{ template "kube-prometheus-stack.name" . }}-ingress-nginx
|
||||
release: {{ $.Release.Name | quote }}
|
||||
namespaceSelector:
|
||||
matchNames:
|
||||
- {{ .Values.ingressNginx.namespace }}
|
||||
endpoints:
|
||||
- port: http-metrics
|
||||
{{- if .Values.ingressNginx.serviceMonitor.interval}}
|
||||
interval: {{ .Values.ingressNginx.serviceMonitor.interval }}
|
||||
{{- end }}
|
||||
{{- if .Values.ingressNginx.serviceMonitor.proxyUrl }}
|
||||
proxyUrl: {{ .Values.ingressNginx.serviceMonitor.proxyUrl}}
|
||||
{{- end }}
|
||||
bearerTokenFile: /var/run/secrets/kubernetes.io/serviceaccount/token
|
||||
metricRelabelings:
|
||||
{{- if .Values.ingressNginx.serviceMonitor.metricRelabelings }}
|
||||
{{ tpl (toYaml .Values.ingressNginx.serviceMonitor.metricRelabelings | indent 4) . }}
|
||||
{{- end }}
|
||||
{{ if .Values.global.cattle.clusterId }}
|
||||
- sourceLabels: [__address__]
|
||||
targetLabel: cluster_id
|
||||
replacement: {{ .Values.global.cattle.clusterId }}
|
||||
{{- end }}
|
||||
{{ if .Values.global.cattle.clusterName}}
|
||||
- sourceLabels: [__address__]
|
||||
targetLabel: cluster_name
|
||||
replacement: {{ .Values.global.cattle.clusterName }}
|
||||
{{- end }}
|
||||
{{- if .Values.ingressNginx.serviceMonitor.relabelings }}
|
||||
relabelings:
|
||||
{{ toYaml .Values.ingressNginx.serviceMonitor.relabelings | indent 4 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
+58
@@ -0,0 +1,58 @@
|
||||
{{- $selector := (include "rancher.serviceMonitor.selector" .) -}}
|
||||
{{- if and .Values.rancherMonitoring.enabled $selector }}
|
||||
apiVersion: monitoring.coreos.com/v1
|
||||
kind: ServiceMonitor
|
||||
metadata:
|
||||
labels: {{ include "kube-prometheus-stack.labels" . | nindent 4 }}
|
||||
name: rancher
|
||||
namespace: cattle-system
|
||||
spec:
|
||||
endpoints:
|
||||
- bearerTokenFile: /var/run/secrets/kubernetes.io/serviceaccount/token
|
||||
port: http
|
||||
tlsConfig:
|
||||
caFile: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
|
||||
insecureSkipVerify: true
|
||||
serverName: rancher
|
||||
metricRelabelings:
|
||||
{{ if .Values.global.cattle.clusterId }}
|
||||
- sourceLabels: [__address__]
|
||||
targetLabel: cluster_id
|
||||
replacement: {{ .Values.global.cattle.clusterId }}
|
||||
{{- end }}
|
||||
{{ if .Values.global.cattle.clusterName}}
|
||||
- sourceLabels: [__address__]
|
||||
targetLabel: cluster_name
|
||||
replacement: {{ .Values.global.cattle.clusterName }}
|
||||
{{- end }}
|
||||
jobLabel: rancher
|
||||
{{- if .Values.rancherMonitoring.namespaceSelector }}
|
||||
namespaceSelector: {{ .Values.rancherMonitoring.namespaceSelector | toYaml | nindent 4 }}
|
||||
{{- end }}
|
||||
selector: {{ include "rancher.serviceMonitor.selector" . | nindent 4 }}
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: {{ template "kube-prometheus-stack.fullname" . }}-rancher-metrics
|
||||
rules:
|
||||
- apiGroups:
|
||||
- management.cattle.io
|
||||
resources:
|
||||
- ranchermetrics
|
||||
verbs:
|
||||
- get
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
name: {{ template "kube-prometheus-stack.fullname" . }}-rancher-metrics
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: {{ template "kube-prometheus-stack.fullname" . }}-rancher-metrics
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: {{ template "kube-prometheus-stack.fullname" . }}-prometheus
|
||||
namespace: {{ template "kube-prometheus-stack.namespace" . }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,147 @@
|
||||
{{- $namespaces := dict "_0" .Release.Namespace -}}
|
||||
{{- if and .Values.grafana.enabled .Values.grafana.defaultDashboardsEnabled (not .Values.grafana.defaultDashboards.useExistingNamespace) -}}
|
||||
{{- $_ := set $namespaces "_1" .Values.grafana.defaultDashboards.namespace -}}
|
||||
{{- end -}}
|
||||
apiVersion: batch/v1
|
||||
kind: Job
|
||||
metadata:
|
||||
name: {{ .Chart.Name }}-patch-sa
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
app: {{ .Chart.Name }}-patch-sa
|
||||
annotations:
|
||||
"helm.sh/hook": post-install, post-upgrade
|
||||
"helm.sh/hook-delete-policy": hook-succeeded, before-hook-creation
|
||||
spec:
|
||||
template:
|
||||
metadata:
|
||||
name: {{ .Chart.Name }}-patch-sa
|
||||
labels:
|
||||
app: {{ .Chart.Name }}-patch-sa
|
||||
spec:
|
||||
serviceAccountName: {{ .Chart.Name }}-patch-sa
|
||||
securityContext:
|
||||
runAsNonRoot: true
|
||||
runAsUser: 1000
|
||||
restartPolicy: Never
|
||||
nodeSelector: {{ include "linux-node-selector" . | nindent 8 }}
|
||||
tolerations: {{ include "linux-node-tolerations" . | nindent 8 }}
|
||||
containers:
|
||||
{{- range $_, $ns := $namespaces }}
|
||||
- name: patch-sa-{{ $ns }}
|
||||
image: {{ template "system_default_registry" $ }}{{ $.Values.global.kubectl.repository }}:{{ $.Values.global.kubectl.tag }}
|
||||
imagePullPolicy: {{ $.Values.global.kubectl.pullPolicy }}
|
||||
command: ["kubectl", "patch", "serviceaccount", "default", "-p", "{\"automountServiceAccountToken\": false}"]
|
||||
args: ["-n", "{{ $ns }}"]
|
||||
{{- end }}
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: {{ .Chart.Name }}-patch-sa
|
||||
labels:
|
||||
app: {{ .Chart.Name }}-patch-sa
|
||||
rules:
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- serviceaccounts
|
||||
verbs: ['get', 'patch']
|
||||
{{- if .Values.global.cattle.psp.enabled }}
|
||||
- apiGroups: ['policy']
|
||||
resources: ['podsecuritypolicies']
|
||||
verbs: ['use']
|
||||
resourceNames:
|
||||
- {{ .Chart.Name }}-patch-sa
|
||||
{{- end }}
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
name: {{ .Chart.Name }}-patch-sa
|
||||
labels:
|
||||
app: {{ .Chart.Name }}-patch-sa
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: {{ .Chart.Name }}-patch-sa
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: {{ .Chart.Name }}-patch-sa
|
||||
namespace: {{ .Release.Namespace }}
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: {{ .Chart.Name }}-patch-sa
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
app: {{ .Chart.Name }}-patch-sa
|
||||
---
|
||||
{{- if .Values.global.cattle.psp.enabled }}
|
||||
apiVersion: policy/v1beta1
|
||||
kind: PodSecurityPolicy
|
||||
metadata:
|
||||
name: {{ .Chart.Name }}-patch-sa
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
app: {{ .Chart.Name }}-patch-sa
|
||||
spec:
|
||||
privileged: false
|
||||
hostNetwork: false
|
||||
hostIPC: false
|
||||
hostPID: false
|
||||
runAsUser:
|
||||
rule: 'MustRunAsNonRoot'
|
||||
seLinux:
|
||||
rule: 'RunAsAny'
|
||||
supplementalGroups:
|
||||
rule: 'MustRunAs'
|
||||
ranges:
|
||||
- min: 1
|
||||
max: 65535
|
||||
fsGroup:
|
||||
rule: 'MustRunAs'
|
||||
ranges:
|
||||
- min: 1
|
||||
max: 65535
|
||||
readOnlyRootFilesystem: false
|
||||
volumes:
|
||||
- 'secret'
|
||||
{{- range $_, $ns := $namespaces }}
|
||||
---
|
||||
apiVersion: networking.k8s.io/v1
|
||||
kind: NetworkPolicy
|
||||
metadata:
|
||||
name: default-allow-all
|
||||
namespace: {{ $ns }}
|
||||
spec:
|
||||
podSelector: {}
|
||||
ingress:
|
||||
- {}
|
||||
egress:
|
||||
- {}
|
||||
policyTypes:
|
||||
- Ingress
|
||||
- Egress
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
---
|
||||
{{- if .Values.hardened.k3s.networkPolicy.enabled }}
|
||||
apiVersion: networking.k8s.io/v1
|
||||
kind: NetworkPolicy
|
||||
metadata:
|
||||
name: rancher-monitoring-coredns-allow-all
|
||||
namespace: kube-system
|
||||
spec:
|
||||
ingress:
|
||||
- {}
|
||||
egress:
|
||||
- {}
|
||||
policyTypes:
|
||||
- Ingress
|
||||
- Egress
|
||||
podSelector:
|
||||
matchLabels:
|
||||
k8s-app: kube-dns
|
||||
{{- end }}
|
||||
@@ -0,0 +1,13 @@
|
||||
{{- if .Values.upgrade.enabled }}
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: {{ template "kube-prometheus-stack.fullname" . }}-upgrade
|
||||
namespace: {{ template "kube-prometheus-stack.namespace" . }}
|
||||
annotations:
|
||||
"helm.sh/hook": pre-upgrade, pre-rollback
|
||||
"helm.sh/hook-delete-policy": before-hook-creation, hook-succeeded, hook-failed
|
||||
"helm.sh/hook-weight": "0"
|
||||
data:
|
||||
{{ (.Files.Glob "files/upgrade/scripts/*").AsConfig | indent 2 }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,46 @@
|
||||
{{- if .Values.upgrade.enabled }}
|
||||
apiVersion: batch/v1
|
||||
kind: Job
|
||||
metadata:
|
||||
name: {{ template "kube-prometheus-stack.fullname" . }}-upgrade
|
||||
namespace: {{ template "kube-prometheus-stack.namespace" . }}
|
||||
labels:
|
||||
app: {{ template "kube-prometheus-stack.fullname" . }}-upgrade
|
||||
annotations:
|
||||
"helm.sh/hook": pre-upgrade, pre-rollback
|
||||
"helm.sh/hook-delete-policy": before-hook-creation, hook-succeeded, hook-failed
|
||||
"helm.sh/hook-weight": "2"
|
||||
spec:
|
||||
template:
|
||||
metadata:
|
||||
name: {{ template "kube-prometheus-stack.fullname" . }}-upgrade
|
||||
labels:
|
||||
app: {{ template "kube-prometheus-stack.fullname" . }}-upgrade
|
||||
spec:
|
||||
serviceAccountName: {{ template "kube-prometheus-stack.fullname" . }}-upgrade
|
||||
securityContext:
|
||||
runAsNonRoot: false
|
||||
runAsUser: 0
|
||||
restartPolicy: Never
|
||||
nodeSelector: {{ include "linux-node-selector" . | nindent 8 }}
|
||||
tolerations: {{ include "linux-node-tolerations" . | nindent 8 }}
|
||||
containers:
|
||||
- name: run-scripts
|
||||
image: {{ template "system_default_registry" . }}{{ .Values.upgrade.image.repository }}:{{ .Values.upgrade.image.tag }}
|
||||
imagePullPolicy: {{ $.Values.global.kubectl.pullPolicy }}
|
||||
command:
|
||||
- /bin/sh
|
||||
- -c
|
||||
- >
|
||||
for s in $(find /etc/scripts -type f); do
|
||||
echo "Running $s...";
|
||||
cat $s | bash
|
||||
done;
|
||||
volumeMounts:
|
||||
- name: upgrade
|
||||
mountPath: /etc/scripts
|
||||
volumes:
|
||||
- name: upgrade
|
||||
configMap:
|
||||
name: {{ template "kube-prometheus-stack.fullname" . }}-upgrade
|
||||
{{- end }}
|
||||
@@ -0,0 +1,131 @@
|
||||
{{- if .Values.upgrade.enabled }}
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: Role
|
||||
metadata:
|
||||
name: {{ template "kube-prometheus-stack.fullname" . }}-upgrade
|
||||
namespace: {{ template "kube-prometheus-stack.namespace" . }}
|
||||
labels:
|
||||
app: {{ template "kube-prometheus-stack.fullname" . }}-upgrade
|
||||
annotations:
|
||||
"helm.sh/hook": pre-upgrade, pre-rollback
|
||||
"helm.sh/hook-delete-policy": before-hook-creation, hook-succeeded
|
||||
"helm.sh/hook-weight": "1"
|
||||
rules:
|
||||
- apiGroups:
|
||||
- apps
|
||||
resources:
|
||||
- deployments
|
||||
- daemonsets
|
||||
- statefulsets
|
||||
verbs:
|
||||
- 'list'
|
||||
- 'delete'
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: RoleBinding
|
||||
metadata:
|
||||
name: {{ template "kube-prometheus-stack.fullname" . }}-upgrade
|
||||
namespace: {{ template "kube-prometheus-stack.namespace" . }}
|
||||
labels:
|
||||
app: {{ template "kube-prometheus-stack.fullname" . }}-upgrade
|
||||
annotations:
|
||||
"helm.sh/hook": pre-upgrade, pre-rollback
|
||||
"helm.sh/hook-delete-policy": before-hook-creation, hook-succeeded, hook-failed
|
||||
"helm.sh/hook-weight": "1"
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: Role
|
||||
name: {{ template "kube-prometheus-stack.fullname" . }}-upgrade
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: {{ template "kube-prometheus-stack.fullname" . }}-upgrade
|
||||
namespace: {{ template "kube-prometheus-stack.namespace" . }}
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: {{ template "kube-prometheus-stack.fullname" . }}-upgrade
|
||||
labels:
|
||||
app: {{ template "kube-prometheus-stack.fullname" . }}-upgrade
|
||||
annotations:
|
||||
"helm.sh/hook": pre-upgrade, pre-rollback
|
||||
"helm.sh/hook-delete-policy": before-hook-creation, hook-succeeded, hook-failed
|
||||
"helm.sh/hook-weight": "1"
|
||||
rules:
|
||||
{{- if .Values.global.cattle.psp.enabled }}
|
||||
- apiGroups: ['policy']
|
||||
resources: ['podsecuritypolicies']
|
||||
verbs: ['use']
|
||||
resourceNames:
|
||||
- {{ template "kube-prometheus-stack.fullname" . }}-upgrade
|
||||
{{- end }}
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
name: {{ template "kube-prometheus-stack.fullname" . }}-upgrade
|
||||
labels:
|
||||
app: {{ template "kube-prometheus-stack.fullname" . }}-upgrade
|
||||
annotations:
|
||||
"helm.sh/hook": pre-upgrade, pre-rollback
|
||||
"helm.sh/hook-delete-policy": before-hook-creation, hook-succeeded, hook-failed
|
||||
"helm.sh/hook-weight": "1"
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: {{ template "kube-prometheus-stack.fullname" . }}-upgrade
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: {{ template "kube-prometheus-stack.fullname" . }}-upgrade
|
||||
namespace: {{ template "kube-prometheus-stack.namespace" . }}
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: {{ template "kube-prometheus-stack.fullname" . }}-upgrade
|
||||
namespace: {{ template "kube-prometheus-stack.namespace" . }}
|
||||
labels:
|
||||
app: {{ template "kube-prometheus-stack.fullname" . }}-upgrade
|
||||
annotations:
|
||||
"helm.sh/hook": pre-upgrade, pre-rollback
|
||||
"helm.sh/hook-delete-policy": before-hook-creation, hook-succeeded, hook-failed
|
||||
"helm.sh/hook-weight": "1"
|
||||
---
|
||||
{{- if .Values.global.cattle.psp.enabled }}
|
||||
apiVersion: policy/v1beta1
|
||||
kind: PodSecurityPolicy
|
||||
metadata:
|
||||
name: {{ template "kube-prometheus-stack.fullname" . }}-upgrade
|
||||
namespace: {{ template "kube-prometheus-stack.namespace" . }}
|
||||
labels:
|
||||
app: {{ template "kube-prometheus-stack.fullname" . }}-upgrade
|
||||
annotations:
|
||||
"helm.sh/hook": pre-upgrade, pre-rollback
|
||||
"helm.sh/hook-delete-policy": before-hook-creation, hook-succeeded, hook-failed
|
||||
"helm.sh/hook-weight": "1"
|
||||
spec:
|
||||
privileged: false
|
||||
allowPrivilegeEscalation: false
|
||||
hostNetwork: false
|
||||
hostIPC: false
|
||||
hostPID: false
|
||||
runAsUser:
|
||||
rule: 'RunAsAny'
|
||||
seLinux:
|
||||
rule: 'RunAsAny'
|
||||
supplementalGroups:
|
||||
rule: 'MustRunAs'
|
||||
ranges:
|
||||
- min: 1
|
||||
max: 65535
|
||||
fsGroup:
|
||||
rule: 'MustRunAs'
|
||||
ranges:
|
||||
- min: 1
|
||||
max: 65535
|
||||
readOnlyRootFilesystem: false
|
||||
volumes:
|
||||
- 'configMap'
|
||||
- 'secret'
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
Reference in New Issue
Block a user