Merge pull request #400 from mesosphere/jr/prometheus-ingress-roles

[prometheus] add prometheus RBAC roles
mesosphere · Feb 4, 2020 · fd59bed · fd59bed
2 parents dec2604 + 757b628
commit fd59bed
Show file tree

Hide file tree

Showing 5 changed files with 204 additions and 1 deletion.
diff --git a/staging/prometheus-operator/Chart.yaml b/staging/prometheus-operator/Chart.yaml
@@ -12,7 +12,7 @@ sources:
   - https://github.com/coreos/kube-prometheus
   - https://github.com/coreos/prometheus-operator
   - https://coreos.com/operators/prometheus
-version: 8.3.9
+version: 8.3.10
 appVersion: 0.34.0
 tillerVersion: ">=2.12.0"
 home: https://github.com/coreos/prometheus-operator

diff --git a/staging/prometheus-operator/templates/ingress-rbac/alertmanager.yaml b/staging/prometheus-operator/templates/ingress-rbac/alertmanager.yaml
@@ -0,0 +1,69 @@
+{{- if and .Values.mesosphereResources.ingressRBAC.enabled .Values.alertmanager.ingress.enabled }}
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: {{ template "prometheus-operator.name" . }}-alertmanager-admin
+  labels:
+    app: {{ template "prometheus-operator.name" . }}-alertmanager
+{{- if .Values.alertmanager.ingress.labels }}
+{{ toYaml .Values.alertmanager.ingress.labels | indent 4 }}
+{{- end }}
+{{ include "prometheus-operator.labels" . | indent 4 }}
+rules:
+- nonResourceURLs:
+  {{- range .Values.alertmanager.ingress.paths }}
+  - {{ . | trimSuffix "/" }}
+  - {{ . | trimSuffix "/" }}/*
+  {{- end }}
+  verbs:
+  - get
+  - head
+  - post
+  - put
+  - delete
+
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: {{ template "prometheus-operator.name" . }}-alertmanager-view
+  labels:
+    app: {{ template "prometheus-operator.name" . }}-alertmanager
+{{- if .Values.alertmanager.ingress.labels }}
+{{ toYaml .Values.alertmanager.ingress.labels | indent 4 }}
+{{- end }}
+{{ include "prometheus-operator.labels" . | indent 4 }}
+rules:
+- nonResourceURLs:
+  {{- range .Values.alertmanager.ingress.paths }}
+  - {{ . | trimSuffix "/" }}
+  - {{ . | trimSuffix "/" }}/*
+  {{- end }}
+  verbs:
+  - get
+  - head
+
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: {{ template "prometheus-operator.name" . }}-alertmanager-edit
+  labels:
+    app: {{ template "prometheus-operator.name" . }}-alertmanager
+{{- if .Values.alertmanager.ingress.labels }}
+{{ toYaml .Values.alertmanager.ingress.labels | indent 4 }}
+{{- end }}
+{{ include "prometheus-operator.labels" . | indent 4 }}
+rules:
+- nonResourceURLs:
+  {{- range .Values.alertmanager.ingress.paths }}
+  - {{ . | trimSuffix "/" }}
+  - {{ . | trimSuffix "/" }}/*
+  {{- end }}
+  verbs:
+  - get
+  - head
+  - post
+  - put
+{{- end }}
diff --git a/staging/prometheus-operator/templates/ingress-rbac/grafana.yaml b/staging/prometheus-operator/templates/ingress-rbac/grafana.yaml
@@ -0,0 +1,63 @@
+{{- if and .Values.mesosphereResources.ingressRBAC.enabled .Values.grafana.ingress.enabled }}
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: {{ template "prometheus-operator.name" . }}-grafana-admin
+  labels:
+    app: {{ template "prometheus-operator.name" . }}-grafana
+{{- if .Values.grafana.ingress.labels }}
+{{ toYaml .Values.grafana.ingress.labels | indent 4 }}
+{{- end }}
+{{ include "prometheus-operator.labels" . | indent 4 }}
+rules:
+  - nonResourceURLs:
+    - {{ .Values.grafana.ingress.path | trimSuffix "/" }}
+    - {{ .Values.grafana.ingress.path | trimSuffix "/" }}/*
+    verbs:
+      - get
+      - head
+      - post
+      - put
+      - delete
+
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: {{ template "prometheus-operator.name" . }}-grafana-view
+  labels:
+    app: {{ template "prometheus-operator.name" . }}-grafana
+{{- if .Values.grafana.ingress.labels }}
+{{ toYaml .Values.grafana.ingress.labels | indent 4 }}
+{{- end }}
+{{ include "prometheus-operator.labels" . | indent 4 }}
+rules:
+  - nonResourceURLs:
+    - {{ .Values.grafana.ingress.path | trimSuffix "/" }}
+    - {{ .Values.grafana.ingress.path | trimSuffix "/" }}/*
+    verbs:
+      - get
+      - head
+
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: {{ template "prometheus-operator.name" . }}-grafana-edit
+  labels:
+    app: {{ template "prometheus-operator.name" . }}-grafana
+{{- if .Values.grafana.ingress.labels }}
+{{ toYaml .Values.grafana.ingress.labels | indent 4 }}
+{{- end }}
+{{ include "prometheus-operator.labels" . | indent 4 }}
+rules:
+  - nonResourceURLs:
+    - {{ .Values.grafana.ingress.path | trimSuffix "/" }}
+    - {{ .Values.grafana.ingress.path | trimSuffix "/" }}/*
+    verbs:
+      - get
+      - head
+      - post
+      - put
+{{- end }}
diff --git a/staging/prometheus-operator/templates/ingress-rbac/prometheus.yaml b/staging/prometheus-operator/templates/ingress-rbac/prometheus.yaml
@@ -0,0 +1,69 @@
+{{- if and .Values.mesosphereResources.ingressRBAC.enabled .Values.prometheus.ingress.enabled }}
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: {{ template "prometheus-operator.name" . }}-prom-admin
+  labels:
+    app: {{ template "prometheus-operator.name" . }}-prom
+  {{- if .Values.prometheus.ingress.labels }}
+  {{ toYaml .Values.prometheus.ingress.labels | indent 4 }}
+  {{- end }}
+  {{ include "prometheus-operator.labels" . | indent 4 }}
+rules:
+  - nonResourceURLs:
+    {{- range .Values.prometheus.ingress.paths }}
+    - {{ . | trimSuffix "/" }}
+    - {{ . | trimSuffix "/" }}/*
+    {{- end }}
+    verbs:
+      - get
+      - head
+      - post
+      - put
+      - delete
+
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: {{ template "prometheus-operator.name" . }}-prom-view
+  labels:
+    app: {{ template "prometheus-operator.name" . }}-prom
+  {{- if .Values.prometheus.ingress.labels }}
+  {{ toYaml .Values.prometheus.ingress.labels | indent 4 }}
+  {{- end }}
+  {{ include "prometheus-operator.labels" . | indent 4 }}
+rules:
+  - nonResourceURLs:
+    {{- range .Values.prometheus.ingress.paths }}
+    - {{ . | trimSuffix "/" }}
+    - {{ . | trimSuffix "/" }}/*
+    {{- end }}
+    verbs:
+      - get
+      - head
+
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: {{ template "prometheus-operator.name" . }}-prom-edit
+  labels:
+    app: {{ template "prometheus-operator.name" . }}-prom
+  {{- if .Values.prometheus.ingress.labels }}
+  {{ toYaml .Values.prometheus.ingress.labels | indent 4 }}
+  {{- end }}
+  {{ include "prometheus-operator.labels" . | indent 4 }}
+rules:
+  - nonResourceURLs:
+    {{- range .Values.prometheus.ingress.paths }}
+    - {{ . | trimSuffix "/" }}
+    - {{ . | trimSuffix "/" }}/*
+    {{- end }}
+    verbs:
+      - get
+      - head
+      - post
+      - put
+  {{- end }}
diff --git a/staging/prometheus-operator/values.yaml b/staging/prometheus-operator/values.yaml
@@ -76,6 +76,8 @@ mesosphereResources:
       image: dwdraju/alpine-curl-jq
       secretKeyRef: ops-portal-credentials
       serviceURL: http://prometheus-kubeaddons-grafana.kubeaddons:3000
+  ingressRBAC:
+    enabled: true
 
 
 ## Provide custom recording or alerting rules to be deployed into the cluster.