fix(kps): Secure access to node-exporter metrics (2.8) (#2624)

* fix(kps): Secure access to node-exporter metrics * feat(licenses): Add new kube-rbac-proxy image * feat(kps): Bump app version * fix(licenses): Fix registry/version * feat(kps): Missed a version bump
mesosphere · Sep 17, 2024 · 0ea320b · 0ea320b
1 parent 55e44f8
commit 0ea320b
Show file tree

Hide file tree

Showing 18 changed files with 15 additions and 4 deletions.
diff --git a/licenses.d2iq.yaml b/licenses.d2iq.yaml
@@ -355,6 +355,11 @@ resources:
       - license_path: LICENSE
         ref: ${image_tag}
         url: https://github.com/brancz/kube-rbac-proxy
+  - container_image: quay.io/brancz/kube-rbac-proxy:v0.14.0
+    sources:
+      - license_path: LICENSE
+        ref: ${image_tag}
+        url: https://github.com/brancz/kube-rbac-proxy
   - container_image: ghcr.io/fluxcd/helm-controller:v0.37.4
     sources:
       - license_path: LICENSE

diff --git a/...-prometheus-stack/48.3.2/defaults/cm.yaml → ...-prometheus-stack/48.3.3/defaults/cm.yaml b/...-prometheus-stack/48.3.2/defaults/cm.yaml → ...-prometheus-stack/48.3.3/defaults/cm.yaml
@@ -1,7 +1,7 @@
 apiVersion: v1
 kind: ConfigMap
 metadata:
-  name: kube-prometheus-stack-48.3.2-d2iq-defaults
+  name: kube-prometheus-stack-48.3.3-d2iq-defaults
   namespace: ${releaseNamespace}
 data:
   values.yaml: |
@@ -457,8 +457,14 @@ data:
             prometheus.kommander.d2iq.io/select: "true"
     prometheus-node-exporter:
       priorityClassName: "dkp-critical-priority"
+      kubeRBACProxy:
+        enabled: true
       prometheus:
         monitor:
+          scheme: https
+          bearerTokenFile: /var/run/secrets/kubernetes.io/serviceaccount/token
+          tlsConfig:
+            insecureSkipVerify: true
           additionalLabels:
             prometheus.kommander.d2iq.io/select: "true"
           relabelings:

diff --git a/...-stack/48.3.2/defaults/kustomization.yaml → ...-stack/48.3.3/defaults/kustomization.yaml b/...-stack/48.3.2/defaults/kustomization.yaml → ...-stack/48.3.3/defaults/kustomization.yaml
diff --git a/...heus-stack/48.3.2/etcd-metrics-proxy.yaml → ...heus-stack/48.3.3/etcd-metrics-proxy.yaml b/...heus-stack/48.3.2/etcd-metrics-proxy.yaml → ...heus-stack/48.3.3/etcd-metrics-proxy.yaml
@@ -9,7 +9,7 @@ spec:
   wait: true
   interval: 6h
   retryInterval: 1m
-  path: ./services/kube-prometheus-stack/48.3.2/etcd-metrics-proxy
+  path: ./services/kube-prometheus-stack/48.3.3/etcd-metrics-proxy
   sourceRef:
     kind: GitRepository
     name: management

diff --git a/...stack/48.3.2/etcd-metrics-proxy/cert.yaml → ...stack/48.3.3/etcd-metrics-proxy/cert.yaml b/...stack/48.3.2/etcd-metrics-proxy/cert.yaml → ...stack/48.3.3/etcd-metrics-proxy/cert.yaml
diff --git a/...8.3.2/etcd-metrics-proxy/client-rbac.yaml → ...8.3.3/etcd-metrics-proxy/client-rbac.yaml b/...8.3.2/etcd-metrics-proxy/client-rbac.yaml → ...8.3.3/etcd-metrics-proxy/client-rbac.yaml
diff --git a/...2/etcd-metrics-proxy/kube-rbac-proxy.yaml → ...3/etcd-metrics-proxy/kube-rbac-proxy.yaml b/...2/etcd-metrics-proxy/kube-rbac-proxy.yaml → ...3/etcd-metrics-proxy/kube-rbac-proxy.yaml
diff --git a/...ack/48.3.2/grafana-dashboards/calico.json → ...ack/48.3.3/grafana-dashboards/calico.json b/...ack/48.3.2/grafana-dashboards/calico.json → ...ack/48.3.3/grafana-dashboards/calico.json
diff --git a/...rafana-dashboards/controller-runtime.json → ...rafana-dashboards/controller-runtime.json b/...rafana-dashboards/controller-runtime.json → ...rafana-dashboards/controller-runtime.json
diff --git a/...rafana-dashboards/flux-cluster-stats.json → ...rafana-dashboards/flux-cluster-stats.json b/...rafana-dashboards/flux-cluster-stats.json → ...rafana-dashboards/flux-cluster-stats.json
diff --git a/...rafana-dashboards/flux-control-plane.json → ...rafana-dashboards/flux-control-plane.json b/...rafana-dashboards/flux-control-plane.json → ...rafana-dashboards/flux-control-plane.json
diff --git a/...3.2/grafana-dashboards/kustomization.yaml → ...3.3/grafana-dashboards/kustomization.yaml b/...3.2/grafana-dashboards/kustomization.yaml → ...3.3/grafana-dashboards/kustomization.yaml
diff --git a/...k/48.3.2/grafana-dashboards/pv-stats.json → ...k/48.3.3/grafana-dashboards/pv-stats.json b/...k/48.3.2/grafana-dashboards/pv-stats.json → ...k/48.3.3/grafana-dashboards/pv-stats.json
diff --git a/...-prometheus-stack/48.3.2/helmrelease.yaml → ...-prometheus-stack/48.3.3/helmrelease.yaml b/...-prometheus-stack/48.3.2/helmrelease.yaml → ...-prometheus-stack/48.3.3/helmrelease.yaml
@@ -9,7 +9,7 @@ spec:
   wait: true
   interval: 6h
   retryInterval: 1m
-  path: ./services/kube-prometheus-stack/48.3.2/helmrelease
+  path: ./services/kube-prometheus-stack/48.3.3/helmrelease
   sourceRef:
     kind: GitRepository
     name: management

diff --git a/...stack/48.3.2/helmrelease/extra-images.txt → ...stack/48.3.3/helmrelease/extra-images.txt b/...stack/48.3.2/helmrelease/extra-images.txt → ...stack/48.3.3/helmrelease/extra-images.txt
diff --git a/....2/helmrelease/kube-prometheus-stack.yaml → ....3/helmrelease/kube-prometheus-stack.yaml b/....2/helmrelease/kube-prometheus-stack.yaml → ....3/helmrelease/kube-prometheus-stack.yaml
@@ -27,7 +27,7 @@ spec:
   releaseName: kube-prometheus-stack
   valuesFrom:
     - kind: ConfigMap
-      name: kube-prometheus-stack-48.3.2-d2iq-defaults
+      name: kube-prometheus-stack-48.3.3-d2iq-defaults
     - kind: ConfigMap
       name: kube-prometheus-stack-mgmt-overrides
       optional: true

diff --git a/...ack/48.3.2/helmrelease/kustomization.yaml → ...ack/48.3.3/helmrelease/kustomization.yaml b/...ack/48.3.2/helmrelease/kustomization.yaml → ...ack/48.3.3/helmrelease/kustomization.yaml
diff --git a/...rometheus-stack/48.3.2/kustomization.yaml → ...rometheus-stack/48.3.3/kustomization.yaml b/...rometheus-stack/48.3.2/kustomization.yaml → ...rometheus-stack/48.3.3/kustomization.yaml