[chore] add documentation for setting up RBAC for the k8sobserver extension #35597
Conversation
Signed-off-by: Florian Bacher <[email protected]>
bacherfl
changed the title
| auth_type: serviceAccount | ||
| collection_interval: 10s | ||
| endpoint: "`endpoint`:`kubelet_endpoint_port`" |
There was a problem hiding this comment.
Using kubelet_endpoint_port to monitor the discovered Redis Pod looks weird? Should be just port instead?
| endpoint: "`endpoint`:`kubelet_endpoint_port`" | |
| endpoint: "`endpoint`:`port`" |
There was a problem hiding this comment.
just looked into that again - i think this still needs to be kubelet_endpoint_port, as this is not related to the redis receiver example, but for a kubeletstats receiver, which is created based on a detected k8s.node (this example is essentially a copy paste from the config example further above in the readme).
There was a problem hiding this comment.
Ah, I just realized that there are 2 different config blocks, I saw it as only one 🤦🏽♂️
| auth_type: serviceAccount | ||
| collection_interval: 10s | ||
| endpoint: "`endpoint`:`kubelet_endpoint_port`" |
There was a problem hiding this comment.
Ah, I just realized that there are 2 different config blocks, I saw it as only one 🤦🏽♂️
|
@open-telemetry/collector-contrib-approvers this should be good to go? |
| ``` | ||
|
|
||
| 2. Create a `ClusterRole`/`ClusterRoleBinding` that grants permission to read pods, nodes, services and ingresses. |
There was a problem hiding this comment.
I suppose using just a Role instead of ClusterRole is also an option if the user only want to observe e.g. pods in a specific namespace?
There was a problem hiding this comment.
Sorry for the late reply - right now, the k8sobserver works only with ClusterRoles, but I'm working on an issue (#9401) to also support the use of namespaced resources and thus also be usable with Roles instead of ClusterRoles
There was a problem hiding this comment.
Edit: I just realized that the issue i linked in the comment above is for the k8sclusterreceiver, and not the k8sobserver - However, looking at the code of the k8sobserver, it seems like the informer being created here also is currently always attempting to observe all namespaces. so it might make sense to also do something similar as in #9401 for this component.
Description
This PR extends the readme of the k8sobserver by describing how to set up the required RBAC permissions to observe the related k8s resources
Link to tracking issue
Fixes #35595
Documentation
Extended the readme