{"action":"created","issue":{"url":"https://api.github.com/repos/prometheus/prometheus/issues/2280","repository_url":"https://api.github.com/repos/prometheus/prometheus","labels_url":"https://api.github.com/repos/prometheus/prometheus/issues/2280/labels{/name}","comments_url":"https://api.github.com/repos/prometheus/prometheus/issues/2280/comments","events_url":"https://api.github.com/repos/prometheus/prometheus/issues/2280/events","html_url":"https://github.com/prometheus/prometheus/issues/2280","id":195406277,"number":2280,"title":"Kubernetes SD: Allow restricting namespaces ","user":{"login":"brancz","id":4546722,"avatar_url":"https://avatars.githubusercontent.com/u/4546722?v=3","gravatar_id":"","url":"https://api.github.com/users/brancz","html_url":"https://github.com/brancz","followers_url":"https://api.github.com/users/brancz/followers","following_url":"https://api.github.com/users/brancz/following{/other_user}","gists_url":"https://api.github.com/users/brancz/gists{/gist_id}","starred_url":"https://api.github.com/users/brancz/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/brancz/subscriptions","organizations_url":"https://api.github.com/users/brancz/orgs","repos_url":"https://api.github.com/users/brancz/repos","events_url":"https://api.github.com/users/brancz/events{/privacy}","received_events_url":"https://api.github.com/users/brancz/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":2,"created_at":"2016-12-14T00:13:58Z","updated_at":"2016-12-14T01:27:26Z","closed_at":null,"body":"Currently the Kubernetes SD lists and watches all changes for each role. This is problematic for two reasons:\r\n\r\n- Scalability: Watching and acting on _every_ event of a Pods and Endpoints objects can get problematic due to the sheer amount of events in a large cluster.\r\n- Security: Advanced setups include role based access to limit what a service account is able to access, and thus will make Prometheus error when it tries to list/watch *all* namespaces, when it is only allowed to access certain namespaces.\r\n\r\nI see two possibilities (this part is up for discussion):\r\n\r\n- An array of namespaces in the Kubernetes SD config, which if empty has the same behavior as it does now, so lists and watches all namespaces, and if specified only watches/lists those in the list. \r\n- A subsection to discover namespaces, which would also be relabelable.\r\n\r\nThe second solution seems like it is the desirable one, but besides adding complexity it requires the ability to watch/list namespaces in the first place, I'm not sure if this is ok. Possibly this is not an \"or\" decision, but both are required to cover everyones needs.\r\n\r\nThis will make #2191 a bit more complicated for the Kubernetes SD, but still doable.\r\n\r\n@fabxc @beorn7 @juliusv @brian-brazil @matthiasr @alexsomesan"},"comment":{"url":"https://api.github.com/repos/prometheus/prometheus/issues/comments/266915404","html_url":"https://github.com/prometheus/prometheus/issues/2280#issuecomment-266915404","issue_url":"https://api.github.com/repos/prometheus/prometheus/issues/2280","id":266915404,"user":{"login":"brancz","id":4546722,"avatar_url":"https://avatars.githubusercontent.com/u/4546722?v=3","gravatar_id":"","url":"https://api.github.com/users/brancz","html_url":"https://github.com/brancz","followers_url":"https://api.github.com/users/brancz/followers","following_url":"https://api.github.com/users/brancz/following{/other_user}","gists_url":"https://api.github.com/users/brancz/gists{/gist_id}","starred_url":"https://api.github.com/users/brancz/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/brancz/subscriptions","organizations_url":"https://api.github.com/users/brancz/orgs","repos_url":"https://api.github.com/users/brancz/repos","events_url":"https://api.github.com/users/brancz/events{/privacy}","received_events_url":"https://api.github.com/users/brancz/received_events","type":"User","site_admin":false},"created_at":"2016-12-14T01:27:26Z","updated_at":"2016-12-14T01:27:26Z","body":"> A simple regex is the most we should need.\r\n\r\nAgreed."}}
{"actor":{"display_login":"brancz"}}