You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
When the target allocator is configured to watch Prometheus custom
resources in the cluster to discover targets, it is currently hard-coded
to require a ClusterRole with a policy rule of listing namespaces. This
prevents usage in environments where configuring ClusterRoles is not
permitted i.e. in namespace-as-a-service setups where only Roles can be
created.
This change introduces two fields in the prometheusCR specification to
allow configuring the namespaces that can be interacted with by the
target allocator.
- allowNamespaces is a comma-separated list of namespaces for the target
allocator to watch. If set to an empty string, it will list all
list all namespaces in the cluster. This is mutually exclusive with
denyNamespaces. Defaults to an empty string.
- denyNamespaces is a comma-separated list of namespaces for the target
allocator to not watch. If set to an empty string, it will not exclude
any namespaces. This is mutually exclusive with allowNamespaces.
Defaults to an empty string.
Fixes: #3086
Signed-off-by: Charlie Le <[email protected]>
Copy file name to clipboardexpand all lines: apis/v1beta1/targetallocator_types.go
+6
Original file line number
Diff line number
Diff line change
@@ -12,6 +12,12 @@ type TargetAllocatorPrometheusCR struct {
12
12
// Enabled indicates whether to use a PrometheusOperator custom resources as targets or not.
13
13
// +optional
14
14
Enabledbool`json:"enabled,omitempty"`
15
+
// AllowNamespaces Namespaces to scope the interaction of the Target Allocator and the apiserver (allow list). This is mutually exclusive with DenyNamespaces.
// DenyNamespaces Namespaces to scope the interaction of the Target Allocator and the apiserver (allow list). This is mutually exclusive with AllowNamespaces.
logger.Info("the env var WATCH_NAMESPACE isn't set, watching all namespaces")
69
70
}
70
71
71
-
factory:=informers.NewMonitoringInformerFactories(allowList, map[string]struct{}{}, mClient, allocatorconfig.DefaultResyncTime, nil) //TODO decide what strategy to use regarding namespaces
0 commit comments