allow cross namespace metrics scraping (#854)

pingcap · Aug 30, 2019 · 4c6c104 · 4c6c104
1 parent 8f81b48
commit 4c6c104
Show file tree

Hide file tree

Showing 2 changed files with 13 additions and 12 deletions.
diff --git a/charts/tidb-cluster/templates/config/_prometheus-config.tpl b/charts/tidb-cluster/templates/config/_prometheus-config.tpl
@@ -14,9 +14,6 @@ scrape_configs:
     honor_labels: true
     kubernetes_sd_configs:
     - role: pod
-      namespaces:
-        names:
-        - {{ .Release.Namespace }}
     tls_config:
       insecure_skip_verify: true
     relabel_configs:

diff --git a/charts/tidb-cluster/templates/monitor-rbac.yaml b/charts/tidb-cluster/templates/monitor-rbac.yaml
@@ -1,9 +1,9 @@
 {{- if .Values.monitor.create }}
 {{- if .Values.rbac.create }}
-kind: Role
 apiVersion: rbac.authorization.k8s.io/v1beta1
+kind: ClusterRole
 metadata:
-  name: {{ template "cluster.name" . }}-monitor
+  name: {{ template "cluster.name" . }}:monitor
   labels:
     app.kubernetes.io/name: {{ template "chart.name" . }}
     app.kubernetes.io/managed-by: {{ .Release.Service }}
@@ -12,13 +12,16 @@ metadata:
     helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+"  "_" }}
 rules:
 - apiGroups: [""]
-  resources: ["pods"]
-  verbs: ["get", "watch", "list"]
+  resources:
+  - pods
+  verbs: ["get", "list", "watch"]
+- nonResourceURLs: ["/metrics"]
+  verbs: ["get"]
 ---
-kind: RoleBinding
+kind: ClusterRoleBinding
 apiVersion: rbac.authorization.k8s.io/v1beta1
 metadata:
-  name: {{ template "cluster.name" . }}-monitor
+  name: {{ template "cluster.name" . }}:monitor
   labels:
     app.kubernetes.io/name: {{ template "chart.name" . }}
     app.kubernetes.io/managed-by: {{ .Release.Service }}
@@ -32,12 +35,13 @@ subjects:
   {{- else }}
   name: {{ template "cluster.name" . }}-monitor
   {{- end }}
+  namespace: {{ .Release.Namespace }}
 roleRef:
-  kind: Role
-  name: {{ template "cluster.name" . }}-monitor
+  kind: ClusterRole
+  name: {{ template "cluster.name" . }}:monitor
   apiGroup: rbac.authorization.k8s.io
----
 {{- if not .Values.monitor.serviceAccount }}
+---
 kind: ServiceAccount
 apiVersion: v1
 metadata: