Skip to content

Commit 17cacbd

Browse files
branczbrancz
committed
*: generate RBAC aware bundle
1 parent 2f30e92 commit 17cacbd

18 files changed

+207
-45
lines changed

‎Documentation/rbac.md

+8-8
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@ In order for the Prometheus Operator to work in an RBAC based authorization envi
88

99
Here is a ready to use manifest of a `ClusterRole` that can be used to start the Prometheus Operator:
1010

11-
[embedmd]:# (../example/rbac/prometheus-operator-cluster-role.yaml)
11+
[embedmd]:# (../example/rbac/prometheus-operator/prometheus-operator-cluster-role.yaml)
1212
```yaml
1313
apiVersion: rbac.authorization.k8s.io/v1alpha1
1414
kind: ClusterRole
@@ -58,7 +58,7 @@ rules:
5858

5959
When the Prometheus Operator boots up for the first time it registers the `thirdpartyresources` it uses, therefore the `create` action on those is required.
6060

61-
As the Prometheus Operator work extensively with the `thirdpartyresources` it registers, it requires all actions on those objects. Those are:
61+
As the Prometheus Operator works extensively with the `thirdpartyresources` it registers, it requires all actions on those objects. Those are:
6262

6363
* `alertmanagers`
6464
* `prometheuses`
@@ -76,13 +76,13 @@ As the kubelet is currently not self-hosted, the Prometheus Operator has a featu
7676

7777
## Prometheus RBAC
7878

79-
The Prometheus server itself accesses the Kubernetes API to discover targets and Alertmanagers. Therefore a separate `ClusterRole` for those Prometheus servers need to exist.
79+
The Prometheus server itself accesses the Kubernetes API to discover targets and Alertmanagers. Therefore a separate `ClusterRole` for those Prometheus servers needs to exist.
8080

8181
As Prometheus does not modify any Objects in the Kubernetes API, but just reads them it simply requires the `get`, `list`, and `watch` actions.
8282

8383
In addition to the resources Prometheus itself needs to access, the Prometheus side-car needs to be able to `get` configmaps to be able to pull in rule files from configmap objects.
8484

85-
[embedmd]:# (../example/rbac/prometheus-cluster-role.yaml)
85+
[embedmd]:# (../example/rbac/prometheus/prometheus-cluster-role.yaml)
8686
```yaml
8787
apiVersion: rbac.authorization.k8s.io/v1alpha1
8888
kind: ClusterRole
@@ -110,7 +110,7 @@ To demonstrate how to use a `ClusterRole` with a `ClusterRoleBinding` and a `Ser
110110

111111
Say the Prometheus Operator shall be deployed in the `default` namespace. First a `ServiceAccount` needs to be setup.
112112

113-
[embedmd]:# (../example/rbac/prometheus-operator-service-account.yaml)
113+
[embedmd]:# (../example/rbac/prometheus-operator/prometheus-operator-service-account.yaml)
114114
```yaml
115115
apiVersion: v1
116116
kind: ServiceAccount
@@ -122,7 +122,7 @@ Note that the `ServiceAccountName` also has to actually be used in the `PodTempl
122122

123123
And then a `ClusterRoleBinding`:
124124

125-
[embedmd]:# (../example/rbac/prometheus-operator-cluster-role-binding.yaml)
125+
[embedmd]:# (../example/rbac/prometheus-operator/prometheus-operator-cluster-role-binding.yaml)
126126
```yaml
127127
apiVersion: rbac.authorization.k8s.io/v1alpha1
128128
kind: ClusterRoleBinding
@@ -142,7 +142,7 @@ Because the `Pod` that the Prometheus Operator is running in uses the `ServiceAc
142142

143143
When creating `Prometheus` objects the procedure is similar. It starts with a `ServiceAccount`.
144144

145-
[embedmd]:# (../example/rbac/prometheus-service-account.yaml)
145+
[embedmd]:# (../example/rbac/prometheus/prometheus-service-account.yaml)
146146
```yaml
147147
apiVersion: v1
148148
kind: ServiceAccount
@@ -152,7 +152,7 @@ metadata:
152152

153153
And then because the `ClusterRole` named `prometheus`, as described above, is likely to be used multiple times, a `ClusterRoleBinding` instead of a `RoleBinding` is used.
154154

155-
[embedmd]:# (../example/rbac/prometheus-cluster-role-binding.yaml)
155+
[embedmd]:# (../example/rbac/prometheus/prometheus-cluster-role-binding.yaml)
156156
```yaml
157157
apiVersion: rbac.authorization.k8s.io/v1alpha1
158158
kind: ClusterRoleBinding

‎Documentation/user-guides/getting-started.md

+72-10
Original file line numberDiff line numberDiff line change
@@ -6,8 +6,69 @@ The mission of the Prometheus Operator is to make running Prometheus on top of K
66

77
To follow this getting started you will need a Kubernetes cluster you have access to. Let's give the Prometheus Operator a spin:
88

9-
[embedmd]:# (../../deployment.yaml)
9+
[embedmd]:# (../../bundle.yaml)
1010
```yaml
11+
apiVersion: rbac.authorization.k8s.io/v1alpha1
12+
kind: ClusterRoleBinding
13+
metadata:
14+
name: prometheus-operator
15+
roleRef:
16+
apiGroup: rbac.authorization.k8s.io
17+
kind: ClusterRole
18+
name: prometheus-operator
19+
subjects:
20+
- kind: ServiceAccount
21+
name: prometheus-operator
22+
namespace: default
23+
---
24+
apiVersion: rbac.authorization.k8s.io/v1alpha1
25+
kind: ClusterRole
26+
metadata:
27+
name: prometheus-operator
28+
rules:
29+
- apiGroups:
30+
- extensions
31+
resources:
32+
- thirdpartyresources
33+
verbs:
34+
- create
35+
- apiGroups:
36+
- monitoring.coreos.com
37+
resources:
38+
- alertmanagers
39+
- prometheuses
40+
- servicemonitors
41+
verbs:
42+
- "*"
43+
- apiGroups:
44+
- apps
45+
resources:
46+
- statefulsets
47+
verbs: ["*"]
48+
- apiGroups: [""]
49+
resources:
50+
- configmaps
51+
- secrets
52+
verbs: ["*"]
53+
- apiGroups: [""]
54+
resources:
55+
- pods
56+
verbs: ["list", "delete"]
57+
- apiGroups: [""]
58+
resources:
59+
- services
60+
- endpoints
61+
verbs: ["get", "create", "update"]
62+
- apiGroups: [""]
63+
resources:
64+
- nodes
65+
verbs: ["list", "watch"]
66+
---
67+
apiVersion: v1
68+
kind: ServiceAccount
69+
metadata:
70+
name: prometheus-operator
71+
---
1172
apiVersion: extensions/v1beta1
1273
kind: Deployment
1374
metadata:
@@ -21,16 +82,17 @@ spec:
2182
labels:
2283
operator: prometheus
2384
spec:
85+
serviceAccountName: prometheus-operator
2486
containers:
25-
- name: prometheus-operator
26-
image: quay.io/coreos/prometheus-operator:v0.7.0
27-
resources:
28-
requests:
29-
cpu: 100m
30-
memory: 50Mi
31-
limits:
32-
cpu: 200m
33-
memory: 100Mi
87+
- name: prometheus-operator
88+
image: quay.io/coreos/prometheus-operator:v0.7.0
89+
resources:
90+
requests:
91+
cpu: 100m
92+
memory: 50Mi
93+
limits:
94+
cpu: 200m
95+
memory: 100Mi
3496
```
3597
3698
The Prometheus Operator introduces third party resources in Kubernetes to declare the desired state of a Prometheus and Alertmanager cluster as well as the Prometheus configuration. The resources it introduces are:

‎Makefile

+3
Original file line numberDiff line numberDiff line change
@@ -56,5 +56,8 @@ docs: embedmd apidocgen
5656
embedmd -w `find Documentation -name "*.md"`
5757
apidocgen pkg/client/monitoring/v1alpha1/types.go > Documentation/api.md
5858

59+
generate:
60+
hack/generate.sh
61+
@$(MAKE) docs
5962

6063
.PHONY: all build crossbuild test format check-license container e2e-test e2e-status e2e clean-e2e embedmd apidocgen docs

‎README.md

+4-2
Original file line numberDiff line numberDiff line change
@@ -88,9 +88,11 @@ at the [design doc](Documentation/design.md).
8888
Install the Operator inside a cluster by running the following command:
8989

9090
```
91-
kubectl apply -f deployment.yaml
91+
kubectl apply -f bundle.yaml
9292
```
9393

94+
> Note: make sure to adapt the namespace in the ClusterRoleBinding if deploying in another namespace than the default namespace.
95+
9496
To run the Operator outside of a cluster:
9597

9698
```
@@ -112,7 +114,7 @@ done
112114
After a couple of minutes you can go ahead and remove the operator itself.
113115

114116
```
115-
kubectl delete -f deployment.yaml
117+
kubectl delete -f bundle.yaml
116118
```
117119

118120
The operator automatically creates services in each namespace where you created a Prometheus or Alertmanager resources,

‎bundle.yaml

+85
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,85 @@
1+
apiVersion: rbac.authorization.k8s.io/v1alpha1
2+
kind: ClusterRoleBinding
3+
metadata:
4+
name: prometheus-operator
5+
roleRef:
6+
apiGroup: rbac.authorization.k8s.io
7+
kind: ClusterRole
8+
name: prometheus-operator
9+
subjects:
10+
- kind: ServiceAccount
11+
name: prometheus-operator
12+
namespace: default
13+
---
14+
apiVersion: rbac.authorization.k8s.io/v1alpha1
15+
kind: ClusterRole
16+
metadata:
17+
name: prometheus-operator
18+
rules:
19+
- apiGroups:
20+
- extensions
21+
resources:
22+
- thirdpartyresources
23+
verbs:
24+
- create
25+
- apiGroups:
26+
- monitoring.coreos.com
27+
resources:
28+
- alertmanagers
29+
- prometheuses
30+
- servicemonitors
31+
verbs:
32+
- "*"
33+
- apiGroups:
34+
- apps
35+
resources:
36+
- statefulsets
37+
verbs: ["*"]
38+
- apiGroups: [""]
39+
resources:
40+
- configmaps
41+
- secrets
42+
verbs: ["*"]
43+
- apiGroups: [""]
44+
resources:
45+
- pods
46+
verbs: ["list", "delete"]
47+
- apiGroups: [""]
48+
resources:
49+
- services
50+
- endpoints
51+
verbs: ["get", "create", "update"]
52+
- apiGroups: [""]
53+
resources:
54+
- nodes
55+
verbs: ["list", "watch"]
56+
---
57+
apiVersion: v1
58+
kind: ServiceAccount
59+
metadata:
60+
name: prometheus-operator
61+
---
62+
apiVersion: extensions/v1beta1
63+
kind: Deployment
64+
metadata:
65+
name: prometheus-operator
66+
labels:
67+
operator: prometheus
68+
spec:
69+
replicas: 1
70+
template:
71+
metadata:
72+
labels:
73+
operator: prometheus
74+
spec:
75+
serviceAccountName: prometheus-operator
76+
containers:
77+
- name: prometheus-operator
78+
image: quay.io/coreos/prometheus-operator:v0.7.0
79+
resources:
80+
requests:
81+
cpu: 100m
82+
memory: 50Mi
83+
limits:
84+
cpu: 200m
85+
memory: 100Mi

‎deployment.yaml

-23
This file was deleted.

‎example/non-rbac/prometheus-operator.yaml

+23
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
apiVersion: extensions/v1beta1
2+
kind: Deployment
3+
metadata:
4+
name: prometheus-operator
5+
labels:
6+
operator: prometheus
7+
spec:
8+
replicas: 1
9+
template:
10+
metadata:
11+
labels:
12+
operator: prometheus
13+
spec:
14+
containers:
15+
- name: prometheus-operator
16+
image: quay.io/coreos/prometheus-operator:v0.7.0
17+
resources:
18+
requests:
19+
cpu: 100m
20+
memory: 50Mi
21+
limits:
22+
cpu: 200m
23+
memory: 100Mi

‎example/rbac/prometheus-operator-cluster-role-binding.yaml ‎example/rbac/prometheus-operator/prometheus-operator-cluster-role-binding.yaml

File renamed without changes.

‎example/rbac/prometheus-operator-cluster-role.yaml ‎example/rbac/prometheus-operator/prometheus-operator-cluster-role.yaml

File renamed without changes.

‎example/rbac/prometheus-operator-service-account.yaml ‎example/rbac/prometheus-operator/prometheus-operator-service-account.yaml

File renamed without changes.

‎example/rbac/prometheus-operator.yaml ‎example/rbac/prometheus-operator/prometheus-operator.yaml

+1-1
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,7 @@ spec:
1414
serviceAccountName: prometheus-operator
1515
containers:
1616
- name: prometheus-operator
17-
image: quay.io/brancz/prometheus-operator:9c58518
17+
image: quay.io/coreos/prometheus-operator:v0.7.0
1818
resources:
1919
requests:
2020
cpu: 100m

‎example/rbac/prometheus-cluster-role-binding.yaml ‎example/rbac/prometheus/prometheus-cluster-role-binding.yaml

File renamed without changes.

‎example/rbac/prometheus-cluster-role.yaml ‎example/rbac/prometheus/prometheus-cluster-role.yaml

File renamed without changes.

‎example/rbac/prometheus-service-account.yaml ‎example/rbac/prometheus/prometheus-service-account.yaml

File renamed without changes.

‎example/rbac/prometheus.yaml ‎example/rbac/prometheus/prometheus.yaml

File renamed without changes.

‎hack/concat-kubernetes-manifests.sh

+6
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
#!/usr/bin/env bash
2+
3+
# Concatenate all files with "---" because that's how to specify multiple
4+
# Kubernetes manifests in one file. Because the first `awk` also adds "---" in
5+
# the first line, we remove it with the second `awk` call.
6+
awk 'FNR==1{print "---"}1' $@ | awk '{if (NR!=1) {print}}'

‎hack/generate.sh

+4
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
#!/usr/bin/env bash
2+
3+
hack/concat-kubernetes-manifests.sh example/rbac/prometheus-operator/*.yaml > bundle.yaml
4+

‎test/e2e/framework/framework.go

+1-1
Original file line numberDiff line numberDiff line change
@@ -100,7 +100,7 @@ func (f *Framework) setup(opImage string) error {
100100
}
101101

102102
func (f *Framework) setupPrometheusOperator(opImage string) error {
103-
fn, err := filepath.Abs("../../deployment.yaml")
103+
fn, err := filepath.Abs("../../example/non-rbac/prometheus-operator.yaml")
104104
if err != nil {
105105
return err
106106
}

0 commit comments

Comments
 (0)