fix(kps): Secure access to node-exporter metrics (#2570)

* fix(kps): Secure access to node-exporter metrics * feat(licenses): Add new kube-rbac-proxy image * feat(kps): Bump app version * fix(licenses): Fix registry
mesosphere · Sep 10, 2024 · c3a178a · c3a178a
1 parent 3644892
commit c3a178a
Show file tree

Hide file tree

Showing 22 changed files with 15 additions and 4 deletions.
diff --git a/licenses.d2iq.yaml b/licenses.d2iq.yaml
@@ -329,6 +329,11 @@ resources:
       - license_path: LICENSE
         ref: ${image_tag}
         url: https://github.com/brancz/kube-rbac-proxy
+  - container_image: quay.io/brancz/kube-rbac-proxy:v0.18.0
+    sources:
+      - license_path: LICENSE
+        ref: ${image_tag}
+        url: https://github.com/brancz/kube-rbac-proxy
   - container_image: ghcr.io/fluxcd/helm-controller:v0.37.4
     sources:
       - license_path: LICENSE

diff --git a/...-prometheus-stack/60.4.0/defaults/cm.yaml → ...-prometheus-stack/60.4.1/defaults/cm.yaml b/...-prometheus-stack/60.4.0/defaults/cm.yaml → ...-prometheus-stack/60.4.1/defaults/cm.yaml
@@ -1,7 +1,7 @@
 apiVersion: v1
 kind: ConfigMap
 metadata:
-  name: kube-prometheus-stack-60.4.0-d2iq-defaults
+  name: kube-prometheus-stack-60.4.1-d2iq-defaults
   namespace: ${releaseNamespace}
 data:
   values.yaml: |
@@ -452,8 +452,14 @@ data:
             prometheus.kommander.d2iq.io/select: "true"
     prometheus-node-exporter:
       priorityClassName: "dkp-critical-priority"
+      kubeRBACProxy:
+        enabled: true
       prometheus:
         monitor:
+          scheme: https
+          bearerTokenFile: /var/run/secrets/kubernetes.io/serviceaccount/token
+          tlsConfig:
+            insecureSkipVerify: true
           additionalLabels:
             prometheus.kommander.d2iq.io/select: "true"
           relabelings:

diff --git a/...-stack/60.4.0/defaults/kustomization.yaml → ...-stack/60.4.1/defaults/kustomization.yaml b/...-stack/60.4.0/defaults/kustomization.yaml → ...-stack/60.4.1/defaults/kustomization.yaml
diff --git a/...heus-stack/60.4.0/etcd-metrics-proxy.yaml → ...heus-stack/60.4.1/etcd-metrics-proxy.yaml b/...heus-stack/60.4.0/etcd-metrics-proxy.yaml → ...heus-stack/60.4.1/etcd-metrics-proxy.yaml
@@ -9,7 +9,7 @@ spec:
   wait: true
   interval: 6h
   retryInterval: 1m
-  path: ./services/kube-prometheus-stack/60.4.0/etcd-metrics-proxy
+  path: ./services/kube-prometheus-stack/60.4.1/etcd-metrics-proxy
   sourceRef:
     kind: GitRepository
     name: management

diff --git a/...stack/60.4.0/etcd-metrics-proxy/cert.yaml → ...stack/60.4.1/etcd-metrics-proxy/cert.yaml b/...stack/60.4.0/etcd-metrics-proxy/cert.yaml → ...stack/60.4.1/etcd-metrics-proxy/cert.yaml
diff --git a/...0.4.0/etcd-metrics-proxy/client-rbac.yaml → ...0.4.1/etcd-metrics-proxy/client-rbac.yaml b/...0.4.0/etcd-metrics-proxy/client-rbac.yaml → ...0.4.1/etcd-metrics-proxy/client-rbac.yaml
diff --git a/...0/etcd-metrics-proxy/kube-rbac-proxy.yaml → ...1/etcd-metrics-proxy/kube-rbac-proxy.yaml b/...0/etcd-metrics-proxy/kube-rbac-proxy.yaml → ...1/etcd-metrics-proxy/kube-rbac-proxy.yaml
diff --git a/...ack/60.4.0/grafana-dashboards/calico.json → ...ack/60.4.1/grafana-dashboards/calico.json b/...ack/60.4.0/grafana-dashboards/calico.json → ...ack/60.4.1/grafana-dashboards/calico.json
diff --git a/...rafana-dashboards/controller-runtime.json → ...rafana-dashboards/controller-runtime.json b/...rafana-dashboards/controller-runtime.json → ...rafana-dashboards/controller-runtime.json
diff --git a/...rafana-dashboards/flux-cluster-stats.json → ...rafana-dashboards/flux-cluster-stats.json b/...rafana-dashboards/flux-cluster-stats.json → ...rafana-dashboards/flux-cluster-stats.json
diff --git a/...rafana-dashboards/flux-control-plane.json → ...rafana-dashboards/flux-control-plane.json b/...rafana-dashboards/flux-control-plane.json → ...rafana-dashboards/flux-control-plane.json
diff --git a/...4.0/grafana-dashboards/kustomization.yaml → ...4.1/grafana-dashboards/kustomization.yaml b/...4.0/grafana-dashboards/kustomization.yaml → ...4.1/grafana-dashboards/kustomization.yaml
diff --git a/...k/60.4.0/grafana-dashboards/pv-stats.json → ...k/60.4.1/grafana-dashboards/pv-stats.json b/...k/60.4.0/grafana-dashboards/pv-stats.json → ...k/60.4.1/grafana-dashboards/pv-stats.json
diff --git a/...-prometheus-stack/60.4.0/helmrelease.yaml → ...-prometheus-stack/60.4.1/helmrelease.yaml b/...-prometheus-stack/60.4.0/helmrelease.yaml → ...-prometheus-stack/60.4.1/helmrelease.yaml
@@ -9,7 +9,7 @@ spec:
   wait: true
   interval: 6h
   retryInterval: 1m
-  path: ./services/kube-prometheus-stack/60.4.0/helmrelease
+  path: ./services/kube-prometheus-stack/60.4.1/helmrelease
   sourceRef:
     kind: GitRepository
     name: management

diff --git a/...stack/60.4.0/helmrelease/extra-images.txt → ...stack/60.4.1/helmrelease/extra-images.txt b/...stack/60.4.0/helmrelease/extra-images.txt → ...stack/60.4.1/helmrelease/extra-images.txt
diff --git a/....0/helmrelease/kube-prometheus-stack.yaml → ....1/helmrelease/kube-prometheus-stack.yaml b/....0/helmrelease/kube-prometheus-stack.yaml → ....1/helmrelease/kube-prometheus-stack.yaml
@@ -27,7 +27,7 @@ spec:
   releaseName: kube-prometheus-stack
   valuesFrom:
     - kind: ConfigMap
-      name: kube-prometheus-stack-60.4.0-d2iq-defaults
+      name: kube-prometheus-stack-60.4.1-d2iq-defaults
     - kind: ConfigMap
       name: kube-prometheus-stack-mgmt-overrides
       optional: true

diff --git a/...ack/60.4.0/helmrelease/kustomization.yaml → ...ack/60.4.1/helmrelease/kustomization.yaml b/...ack/60.4.0/helmrelease/kustomization.yaml → ...ack/60.4.1/helmrelease/kustomization.yaml
diff --git a/...rometheus-stack/60.4.0/kustomization.yaml → ...rometheus-stack/60.4.1/kustomization.yaml b/...rometheus-stack/60.4.0/kustomization.yaml → ...rometheus-stack/60.4.1/kustomization.yaml
diff --git a/...theus-stack/60.4.0/rbac/alertmanager.yaml → ...theus-stack/60.4.1/rbac/alertmanager.yaml b/...theus-stack/60.4.0/rbac/alertmanager.yaml → ...theus-stack/60.4.1/rbac/alertmanager.yaml
diff --git a/...prometheus-stack/60.4.0/rbac/grafana.yaml → ...prometheus-stack/60.4.1/rbac/grafana.yaml b/...prometheus-stack/60.4.0/rbac/grafana.yaml → ...prometheus-stack/60.4.1/rbac/grafana.yaml
diff --git a/...heus-stack/60.4.0/rbac/kustomization.yaml → ...heus-stack/60.4.1/rbac/kustomization.yaml b/...heus-stack/60.4.0/rbac/kustomization.yaml → ...heus-stack/60.4.1/rbac/kustomization.yaml
diff --git a/...metheus-stack/60.4.0/rbac/prometheus.yaml → ...metheus-stack/60.4.1/rbac/prometheus.yaml b/...metheus-stack/60.4.0/rbac/prometheus.yaml → ...metheus-stack/60.4.1/rbac/prometheus.yaml