Skip to content

Commit f58439f

Browse files
solssonsolsson
committed
Merge branch 'revert-to-prometheus-annotations' into prometheus-operator-example
2 parents f1ee182 + 7378f81 commit f58439f

File tree

2 files changed

+286
-0
lines changed

2 files changed

+286
-0
lines changed

‎config/prometheus.yaml‎

Lines changed: 273 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,273 @@
1+
# A scrape configuration for running Prometheus on a Kubernetes cluster.
2+
# This uses separate scrape configs for cluster components (i.e. API server, node)
3+
# and services to allow each to use different authentication configs.
4+
#
5+
# Kubernetes labels will be added as Prometheus labels on metrics via the
6+
# `labelmap` relabeling action.
7+
#
8+
# If you are using Kubernetes 1.7.2 or earlier, please take note of the comments
9+
# for the kubernetes-cadvisor job; you will need to edit or remove this job.
10+
11+
# Scrape config for API servers.
12+
#
13+
# Kubernetes exposes API servers as endpoints to the default/kubernetes
14+
# service so this uses `endpoints` role and uses relabelling to only keep
15+
# the endpoints associated with the default/kubernetes service using the
16+
# default named port `https`. This works for single API server deployments as
17+
# well as HA API server deployments.
18+
scrape_configs:
19+
- job_name: 'kubernetes-apiservers'
20+
21+
kubernetes_sd_configs:
22+
- role: endpoints
23+
24+
# Default to scraping over https. If required, just disable this or change to
25+
# `http`.
26+
scheme: https
27+
28+
# This TLS & bearer token file config is used to connect to the actual scrape
29+
# endpoints for cluster components. This is separate to discovery auth
30+
# configuration because discovery & scraping are two separate concerns in
31+
# Prometheus. The discovery auth config is automatic if Prometheus runs inside
32+
# the cluster. Otherwise, more config options have to be provided within the
33+
# <kubernetes_sd_config>.
34+
tls_config:
35+
ca_file: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
36+
# If your node certificates are self-signed or use a different CA to the
37+
# master CA, then disable certificate verification below. Note that
38+
# certificate verification is an integral part of a secure infrastructure
39+
# so this should only be disabled in a controlled environment. You can
40+
# disable certificate verification by uncommenting the line below.
41+
#
42+
# insecure_skip_verify: true
43+
bearer_token_file: /var/run/secrets/kubernetes.io/serviceaccount/token
44+
45+
# Keep only the default/kubernetes service endpoints for the https port. This
46+
# will add targets for each API server which Kubernetes adds an endpoint to
47+
# the default/kubernetes service.
48+
relabel_configs:
49+
- source_labels: [__meta_kubernetes_namespace, __meta_kubernetes_service_name, __meta_kubernetes_endpoint_port_name]
50+
action: keep
51+
regex: default;kubernetes;https
52+
53+
# Scrape config for nodes (kubelet).
54+
#
55+
# Rather than connecting directly to the node, the scrape is proxied though the
56+
# Kubernetes apiserver. This means it will work if Prometheus is running out of
57+
# cluster, or can't connect to nodes for some other reason (e.g. because of
58+
# firewalling).
59+
- job_name: 'kubernetes-nodes'
60+
61+
# Default to scraping over https. If required, just disable this or change to
62+
# `http`.
63+
scheme: https
64+
65+
# This TLS & bearer token file config is used to connect to the actual scrape
66+
# endpoints for cluster components. This is separate to discovery auth
67+
# configuration because discovery & scraping are two separate concerns in
68+
# Prometheus. The discovery auth config is automatic if Prometheus runs inside
69+
# the cluster. Otherwise, more config options have to be provided within the
70+
# <kubernetes_sd_config>.
71+
tls_config:
72+
ca_file: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
73+
bearer_token_file: /var/run/secrets/kubernetes.io/serviceaccount/token
74+
75+
kubernetes_sd_configs:
76+
- role: node
77+
78+
relabel_configs:
79+
- action: labelmap
80+
regex: __meta_kubernetes_node_label_(.+)
81+
- target_label: __address__
82+
replacement: kubernetes.default.svc:443
83+
- source_labels: [__meta_kubernetes_node_name]
84+
regex: (.+)
85+
target_label: __metrics_path__
86+
replacement: /api/v1/nodes/${1}/proxy/metrics
87+
88+
# Scrape config for Kubelet cAdvisor.
89+
#
90+
# This is required for Kubernetes 1.7.3 and later, where cAdvisor metrics
91+
# (those whose names begin with 'container_') have been removed from the
92+
# Kubelet metrics endpoint. This job scrapes the cAdvisor endpoint to
93+
# retrieve those metrics.
94+
#
95+
# In Kubernetes 1.7.0-1.7.2, these metrics are only exposed on the cAdvisor
96+
# HTTP endpoint; use "replacement: /api/v1/nodes/${1}:4194/proxy/metrics"
97+
# in that case (and ensure cAdvisor's HTTP server hasn't been disabled with
98+
# the --cadvisor-port=0 Kubelet flag).
99+
#
100+
# This job is not necessary and should be removed in Kubernetes 1.6 and
101+
# earlier versions, or it will cause the metrics to be scraped twice.
102+
- job_name: 'kubernetes-cadvisor'
103+
104+
# Default to scraping over https. If required, just disable this or change to
105+
# `http`.
106+
scheme: https
107+
108+
# This TLS & bearer token file config is used to connect to the actual scrape
109+
# endpoints for cluster components. This is separate to discovery auth
110+
# configuration because discovery & scraping are two separate concerns in
111+
# Prometheus. The discovery auth config is automatic if Prometheus runs inside
112+
# the cluster. Otherwise, more config options have to be provided within the
113+
# <kubernetes_sd_config>.
114+
tls_config:
115+
ca_file: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
116+
bearer_token_file: /var/run/secrets/kubernetes.io/serviceaccount/token
117+
118+
kubernetes_sd_configs:
119+
- role: node
120+
121+
relabel_configs:
122+
- action: labelmap
123+
regex: __meta_kubernetes_node_label_(.+)
124+
- target_label: __address__
125+
replacement: kubernetes.default.svc:443
126+
- source_labels: [__meta_kubernetes_node_name]
127+
regex: (.+)
128+
target_label: __metrics_path__
129+
replacement: /api/v1/nodes/${1}/proxy/metrics/cadvisor
130+
131+
# Scrape config for service endpoints.
132+
#
133+
# The relabeling allows the actual service scrape endpoint to be configured
134+
# via the following annotations:
135+
#
136+
# * `prometheus.io/scrape`: Only scrape services that have a value of `true`
137+
# * `prometheus.io/scheme`: If the metrics endpoint is secured then you will need
138+
# to set this to `https` & most likely set the `tls_config` of the scrape config.
139+
# * `prometheus.io/path`: If the metrics path is not `/metrics` override this.
140+
# * `prometheus.io/port`: If the metrics are exposed on a different port to the
141+
# service then set this appropriately.
142+
- job_name: 'kubernetes-service-endpoints'
143+
144+
kubernetes_sd_configs:
145+
- role: endpoints
146+
147+
relabel_configs:
148+
- source_labels: [__meta_kubernetes_service_annotation_prometheus_io_scrape]
149+
action: keep
150+
regex: true
151+
- source_labels: [__meta_kubernetes_service_annotation_prometheus_io_scheme]
152+
action: replace
153+
target_label: __scheme__
154+
regex: (https?)
155+
- source_labels: [__meta_kubernetes_service_annotation_prometheus_io_path]
156+
action: replace
157+
target_label: __metrics_path__
158+
regex: (.+)
159+
- source_labels: [__address__, __meta_kubernetes_service_annotation_prometheus_io_port]
160+
action: replace
161+
target_label: __address__
162+
regex: ([^:]+)(?::\d+)?;(\d+)
163+
replacement: $1:$2
164+
- action: labelmap
165+
regex: __meta_kubernetes_service_label_(.+)
166+
- source_labels: [__meta_kubernetes_namespace]
167+
action: replace
168+
target_label: kubernetes_namespace
169+
- source_labels: [__meta_kubernetes_service_name]
170+
action: replace
171+
target_label: kubernetes_name
172+
173+
# Example scrape config for probing services via the Blackbox Exporter.
174+
#
175+
# The relabeling allows the actual service scrape endpoint to be configured
176+
# via the following annotations:
177+
#
178+
# * `prometheus.io/probe`: Only probe services that have a value of `true`
179+
- job_name: 'kubernetes-services'
180+
181+
metrics_path: /probe
182+
params:
183+
module: [http_2xx]
184+
185+
kubernetes_sd_configs:
186+
- role: service
187+
188+
relabel_configs:
189+
- source_labels: [__meta_kubernetes_service_annotation_prometheus_io_probe]
190+
action: keep
191+
regex: true
192+
- source_labels: [__address__]
193+
target_label: __param_target
194+
- target_label: __address__
195+
replacement: blackbox-exporter.example.com:9115
196+
- source_labels: [__param_target]
197+
target_label: instance
198+
- action: labelmap
199+
regex: __meta_kubernetes_service_label_(.+)
200+
- source_labels: [__meta_kubernetes_namespace]
201+
target_label: kubernetes_namespace
202+
- source_labels: [__meta_kubernetes_service_name]
203+
target_label: kubernetes_name
204+
205+
# Example scrape config for probing ingresses via the Blackbox Exporter.
206+
#
207+
# The relabeling allows the actual ingress scrape endpoint to be configured
208+
# via the following annotations:
209+
#
210+
# * `prometheus.io/probe`: Only probe services that have a value of `true`
211+
- job_name: 'kubernetes-ingresses'
212+
213+
metrics_path: /probe
214+
params:
215+
module: [http_2xx]
216+
217+
kubernetes_sd_configs:
218+
- role: ingress
219+
220+
relabel_configs:
221+
- source_labels: [__meta_kubernetes_ingress_annotation_prometheus_io_probe]
222+
action: keep
223+
regex: true
224+
- source_labels: [__meta_kubernetes_ingress_scheme,__address__,__meta_kubernetes_ingress_path]
225+
regex: (.+);(.+);(.+)
226+
replacement: ${1}://${2}${3}
227+
target_label: __param_target
228+
- target_label: __address__
229+
replacement: blackbox-exporter.example.com:9115
230+
- source_labels: [__param_target]
231+
target_label: instance
232+
- action: labelmap
233+
regex: __meta_kubernetes_ingress_label_(.+)
234+
- source_labels: [__meta_kubernetes_namespace]
235+
target_label: kubernetes_namespace
236+
- source_labels: [__meta_kubernetes_ingress_name]
237+
target_label: kubernetes_name
238+
239+
# Example scrape config for pods
240+
#
241+
# The relabeling allows the actual pod scrape endpoint to be configured via the
242+
# following annotations:
243+
#
244+
# * `prometheus.io/scrape`: Only scrape pods that have a value of `true`
245+
# * `prometheus.io/path`: If the metrics path is not `/metrics` override this.
246+
# * `prometheus.io/port`: Scrape the pod on the indicated port instead of the
247+
# pod's declared ports (default is a port-free target if none are declared).
248+
- job_name: 'kubernetes-pods'
249+
250+
kubernetes_sd_configs:
251+
- role: pod
252+
253+
relabel_configs:
254+
- source_labels: [__meta_kubernetes_pod_annotation_prometheus_io_scrape]
255+
action: keep
256+
regex: true
257+
- source_labels: [__meta_kubernetes_pod_annotation_prometheus_io_path]
258+
action: replace
259+
target_label: __metrics_path__
260+
regex: (.+)
261+
- source_labels: [__address__, __meta_kubernetes_pod_annotation_prometheus_io_port]
262+
action: replace
263+
regex: ([^:]+)(?::\d+)?;(\d+)
264+
replacement: $1:$2
265+
target_label: __address__
266+
- action: labelmap
267+
regex: __meta_kubernetes_pod_label_(.+)
268+
- source_labels: [__meta_kubernetes_namespace]
269+
action: replace
270+
target_label: kubernetes_namespace
271+
- source_labels: [__meta_kubernetes_pod_name]
272+
action: replace
273+
target_label: kubernetes_pod_name

‎install-prometheus-operator.sh‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -31,6 +31,19 @@ set -x
3131
cd $SOURCE_DIR
3232
cd $OPERATOR_KUBE_DIR
3333
34+
# ServiceMonitor support disabled in favor of Prometheus' built in k8s service discovery
35+
mkdir manifests/prometheus-service-monitor
36+
mv -v manifests/prometheus/prometheus-k8s-service-monitor-* manifests/prometheus-service-monitor/
37+
mv -v manifests/prometheus/prometheus-k8s.yaml manifests/prometheus-service-monitor/
38+
cat manifests/prometheus-service-monitor/prometheus-k8s.yaml \
39+
| grep -v 'matchExpressions:' | grep -v '- {key: k8s-app, operator: Exists}' \
40+
> manifests/prometheus/prometheus-k8s.yaml
41+
diff -u manifests/prometheus-service-monitor/prometheus-k8s.yaml manifests/prometheus/prometheus-k8s.yaml
42+
43+
# Create config manually instead
44+
kubectl create namespace monitoring
45+
kubectl -n monitoring create secret generic prometheus-k8s --from-file ../../../../config/prometheus.yaml
46+
3447
EOF
3548
cat $SOURCE_DIR/$OPERATOR_KUBE_DIR/$OPERATOR_DEPLOY >> deploy.sh
3649

0 commit comments

Comments
 (0)