[prometheus] add prometheus RBAC roles

mesosphere · Feb 4, 2020 · 8e6308b · 8e6308b
1 parent dec2604
commit 8e6308b
Show file tree

Hide file tree

Showing 5 changed files with 205 additions and 1 deletion.
diff --git a/staging/prometheus-operator/Chart.yaml b/staging/prometheus-operator/Chart.yaml
@@ -12,7 +12,7 @@ sources:
   - https://github.com/coreos/kube-prometheus
   - https://github.com/coreos/prometheus-operator
   - https://coreos.com/operators/prometheus
-version: 8.3.9
+version: 8.3.10
 appVersion: 0.34.0
 tillerVersion: ">=2.12.0"
 home: https://github.com/coreos/prometheus-operator

diff --git a/staging/prometheus-operator/templates/ingress-rbac/alertmanager.yaml b/staging/prometheus-operator/templates/ingress-rbac/alertmanager.yaml
@@ -0,0 +1,69 @@
+{{- if and .Values.ingressRBAC.enabled .Values.alertmanager.ingress.enabled }}
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: {{ template "prometheus-operator.name" . }}-alertmanager-admin
+  labels:
+    app: {{ template "prometheus-operator.name" . }}-alertmanager
+{{- if .Values.alertmanager.ingress.labels }}
+{{ toYaml .Values.alertmanager.ingress.labels | indent 4 }}
+{{- end }}
+{{ include "prometheus-operator.labels" . | indent 4 }}
+rules:
+- nonResourceURLs:
+  {{- range .Values.alertmanager.ingress.paths }}
+  - {{ . | trimSuffix "/" }}
+  - {{ . | trimSuffix "/" }}/*
+  {{- end }}
+  verbs:
+  - get
+  - head
+  - post
+  - put
+  - delete
+
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: {{ template "prometheus-operator.name" . }}-alertmanager-view
+  labels:
+    app: {{ template "prometheus-operator.name" . }}-alertmanager
+{{- if .Values.alertmanager.ingress.labels }}
+{{ toYaml .Values.alertmanager.ingress.labels | indent 4 }}
+{{- end }}
+{{ include "prometheus-operator.labels" . | indent 4 }}
+rules:
+- nonResourceURLs:
+  {{- range .Values.alertmanager.ingress.paths }}
+  - {{ . | trimSuffix "/" }}
+  - {{ . | trimSuffix "/" }}/*
+  {{- end }}
+  verbs:
+  - get
+  - head
+
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: {{ template "prometheus-operator.name" . }}-alertmanager-edit
+  labels:
+    app: {{ template "prometheus-operator.name" . }}-alertmanager
+{{- if .Values.alertmanager.ingress.labels }}
+{{ toYaml .Values.alertmanager.ingress.labels | indent 4 }}
+{{- end }}
+{{ include "prometheus-operator.labels" . | indent 4 }}
+rules:
+- nonResourceURLs:
+  {{- range .Values.alertmanager.ingress.paths }}
+  - {{ . | trimSuffix "/" }}
+  - {{ . | trimSuffix "/" }}/*
+  {{- end }}
+  verbs:
+  - get
+  - head
+  - post
+  - put
+{{- end }}
diff --git a/staging/prometheus-operator/templates/ingress-rbac/grafana.yaml b/staging/prometheus-operator/templates/ingress-rbac/grafana.yaml
@@ -0,0 +1,63 @@
+{{- if and .Values.ingressRBAC.enabled .Values.grafana.ingress.enabled }}
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: {{ template "prometheus-operator.name" . }}-grafana-admin
+  labels:
+    app: {{ template "prometheus-operator.name" . }}-grafana
+{{- if .Values.grafana.ingress.labels }}
+{{ toYaml .Values.grafana.ingress.labels | indent 4 }}
+{{- end }}
+{{ include "prometheus-operator.labels" . | indent 4 }}
+rules:
+  - nonResourceURLs:
+    - {{ .Values.grafana.ingress.path | trimSuffix "/" }}
+    - {{ .Values.grafana.ingress.path | trimSuffix "/" }}/*
+    verbs:
+      - get
+      - head
+      - post
+      - put
+      - delete
+
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: {{ template "prometheus-operator.name" . }}-grafana-view
+  labels:
+    app: {{ template "prometheus-operator.name" . }}-grafana
+{{- if .Values.grafana.ingress.labels }}
+{{ toYaml .Values.grafana.ingress.labels | indent 4 }}
+{{- end }}
+{{ include "prometheus-operator.labels" . | indent 4 }}
+rules:
+  - nonResourceURLs:
+    - {{ .Values.grafana.ingress.path | trimSuffix "/" }}
+    - {{ .Values.grafana.ingress.path | trimSuffix "/" }}/*
+    verbs:
+      - get
+      - head
+
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: {{ template "prometheus-operator.name" . }}-grafana-edit
+  labels:
+    app: {{ template "prometheus-operator.name" . }}-grafana
+{{- if .Values.grafana.ingress.labels }}
+{{ toYaml .Values.grafana.ingress.labels | indent 4 }}
+{{- end }}
+{{ include "prometheus-operator.labels" . | indent 4 }}
+rules:
+  - nonResourceURLs:
+    - {{ .Values.grafana.ingress.path | trimSuffix "/" }}
+    - {{ .Values.grafana.ingress.path | trimSuffix "/" }}/*
+    verbs:
+      - get
+      - head
+      - post
+      - put
+{{- end }}
diff --git a/staging/prometheus-operator/templates/ingress-rbac/prometheus.yaml b/staging/prometheus-operator/templates/ingress-rbac/prometheus.yaml
@@ -0,0 +1,69 @@
+{{- if and .Values.ingressRBAC.enabled .Values.prometheus.ingress.enabled }}
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: {{ template "prometheus-operator.name" . }}-prom-admin
+  labels:
+    app: {{ template "prometheus-operator.name" . }}-prom
+  {{- if .Values.prometheus.ingress.labels }}
+  {{ toYaml .Values.prometheus.ingress.labels | indent 4 }}
+  {{- end }}
+  {{ include "prometheus-operator.labels" . | indent 4 }}
+rules:
+  - nonResourceURLs:
+    {{- range .Values.prometheus.ingress.paths }}
+    - {{ . | trimSuffix "/" }}
+    - {{ . | trimSuffix "/" }}/*
+    {{- end }}
+    verbs:
+      - get
+      - head
+      - post
+      - put
+      - delete
+
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: {{ template "prometheus-operator.name" . }}-prom-view
+  labels:
+    app: {{ template "prometheus-operator.name" . }}-prom
+  {{- if .Values.prometheus.ingress.labels }}
+  {{ toYaml .Values.prometheus.ingress.labels | indent 4 }}
+  {{- end }}
+  {{ include "prometheus-operator.labels" . | indent 4 }}
+rules:
+  - nonResourceURLs:
+    {{- range .Values.prometheus.ingress.paths }}
+    - {{ . | trimSuffix "/" }}
+    - {{ . | trimSuffix "/" }}/*
+    {{- end }}
+    verbs:
+      - get
+      - head
+
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: {{ template "prometheus-operator.name" . }}-prom-edit
+  labels:
+    app: {{ template "prometheus-operator.name" . }}-prom
+  {{- if .Values.prometheus.ingress.labels }}
+  {{ toYaml .Values.prometheus.ingress.labels | indent 4 }}
+  {{- end }}
+  {{ include "prometheus-operator.labels" . | indent 4 }}
+rules:
+  - nonResourceURLs:
+    {{- range .Values.prometheus.ingress.paths }}
+    - {{ . | trimSuffix "/" }}
+    - {{ . | trimSuffix "/" }}/*
+    {{- end }}
+    verbs:
+      - get
+      - head
+      - post
+      - put
+  {{- end }}
diff --git a/staging/prometheus-operator/values.yaml b/staging/prometheus-operator/values.yaml
@@ -1885,3 +1885,6 @@ prometheus:
     ## https://github.com/coreos/prometheus-operator/blob/master/Documentation/api.md#podmetricsendpoint
     ##
     # podMetricsEndpoints: []
+
+ingressRBAC:
+  enabled: true