From 4410a80e4ec95a5623723d4b9e66a81bfe61c655 Mon Sep 17 00:00:00 2001
From: tafkam <marco@eichhorn.digital>
Date: Sat, 25 Jul 2020 18:27:17 +0200
Subject: [PATCH] secure scheduler/controller metrics ports, kubeadm discovery
services
---
.../kube-prometheus/kube-prometheus-kubeadm.libsonnet | 4 ++--
.../kube-prometheus/prometheus/prometheus.libsonnet | 10 ++++++++++
2 files changed, 12 insertions(+), 2 deletions(-)
diff --git a/jsonnet/kube-prometheus/kube-prometheus-kubeadm.libsonnet b/jsonnet/kube-prometheus/kube-prometheus-kubeadm.libsonnet
index 9e497cd6..1ef808a8 100644
--- a/jsonnet/kube-prometheus/kube-prometheus-kubeadm.libsonnet
+++ b/jsonnet/kube-prometheus/kube-prometheus-kubeadm.libsonnet
@@ -5,12 +5,12 @@ local servicePort = k.core.v1.service.mixin.spec.portsType;
{
prometheus+: {
kubeControllerManagerPrometheusDiscoveryService:
- service.new('kube-controller-manager-prometheus-discovery', { component: 'kube-controller-manager' }, servicePort.newNamed('http-metrics', 10252, 10252)) +
+ service.new('kube-controller-manager-prometheus-discovery', { component: 'kube-controller-manager' }, servicePort.newNamed('http-metrics', 10257, 10257)) +
service.mixin.metadata.withNamespace('kube-system') +
service.mixin.metadata.withLabels({ 'k8s-app': 'kube-controller-manager' }) +
service.mixin.spec.withClusterIp('None'),
kubeSchedulerPrometheusDiscoveryService:
- service.new('kube-scheduler-prometheus-discovery', { component: 'kube-scheduler' }, servicePort.newNamed('http-metrics', 10251, 10251)) +
+ service.new('kube-scheduler-prometheus-discovery', { component: 'kube-scheduler' }, servicePort.newNamed('http-metrics', 10259, 10259)) +
service.mixin.metadata.withNamespace('kube-system') +
service.mixin.metadata.withLabels({ 'k8s-app': 'kube-scheduler' }) +
service.mixin.spec.withClusterIp('None'),
diff --git a/jsonnet/kube-prometheus/prometheus/prometheus.libsonnet b/jsonnet/kube-prometheus/prometheus/prometheus.libsonnet
index e4673f50..924ce636 100644
--- a/jsonnet/kube-prometheus/prometheus/prometheus.libsonnet
+++ b/jsonnet/kube-prometheus/prometheus/prometheus.libsonnet
@@ -248,6 +248,11 @@ local k = import 'ksonnet/ksonnet.beta.4/k.libsonnet';
{
port: 'http-metrics',
interval: '30s',
+ scheme: "https",
+ bearerTokenFile: "/var/run/secrets/kubernetes.io/serviceaccount/token",
+ tlsConfig: {
+ insecureSkipVerify: true
+ }
},
],
selector: {
@@ -349,6 +354,11 @@ local k = import 'ksonnet/ksonnet.beta.4/k.libsonnet';
{
port: 'http-metrics',
interval: '30s',
+ scheme: "https",
+ bearerTokenFile: "/var/run/secrets/kubernetes.io/serviceaccount/token",
+ tlsConfig: {
+ insecureSkipVerify: true
+ },
metricRelabelings: (import 'kube-prometheus/dropping-deprecated-metrics-relabelings.libsonnet') + [
{
sourceLabels: ['__name__'],
--
GitLab