{"action":"created","issue":{"url":"https://api.github.com/repos/coreos/prometheus-operator/issues/1696","repository_url":"https://api.github.com/repos/coreos/prometheus-operator","labels_url":"https://api.github.com/repos/coreos/prometheus-operator/issues/1696/labels{/name}","comments_url":"https://api.github.com/repos/coreos/prometheus-operator/issues/1696/comments","events_url":"https://api.github.com/repos/coreos/prometheus-operator/issues/1696/events","html_url":"https://github.com/coreos/prometheus-operator/issues/1696","id":344469575,"node_id":"MDU6SXNzdWUzNDQ0Njk1NzU=","number":1696,"title":"make kube-prometheus Ksonnet create full power ClusterRole","user":{"login":"prune998","id":1110398,"node_id":"MDQ6VXNlcjExMTAzOTg=","avatar_url":"https://avatars2.githubusercontent.com/u/1110398?v=4","gravatar_id":"","url":"https://api.github.com/users/prune998","html_url":"https://github.com/prune998","followers_url":"https://api.github.com/users/prune998/followers","following_url":"https://api.github.com/users/prune998/following{/other_user}","gists_url":"https://api.github.com/users/prune998/gists{/gist_id}","starred_url":"https://api.github.com/users/prune998/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/prune998/subscriptions","organizations_url":"https://api.github.com/users/prune998/orgs","repos_url":"https://api.github.com/users/prune998/repos","events_url":"https://api.github.com/users/prune998/events{/privacy}","received_events_url":"https://api.github.com/users/prune998/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":15,"created_at":"2018-07-25T14:31:46Z","updated_at":"2018-08-23T08:03:02Z","closed_at":"2018-08-23T08:03:02Z","author_association":"CONTRIBUTOR","body":"**What did you do?**\r\nI'm deploying a Prometheus using the Ksonnet templates from kube-prometheus\r\n\r\n**What did you expect to see?**\r\nI expect my cluster to be working and scrape metrics from my applications in any `namespace`\r\n\r\n**What did you see instead? Under which circumstances?**\r\nBy default the `ClusterRole` is created as : \r\n```\r\napiVersion: rbac.authorization.k8s.io/v1\r\nkind: ClusterRole\r\nmetadata:\r\n  name: prometheus-k8s\r\nrules:\r\n- apiGroups:\r\n  - \"\"\r\n  resources:\r\n  - nodes/metrics\r\n  verbs:\r\n  - get\r\n- nonResourceURLs:\r\n  - /metrics\r\n  verbs:\r\n  - get\r\n```\r\nWhich allows to gather all the nodes metrics but not the user's `services` or `pods`.\r\n\r\n**What would solve the issue**\r\nThe `ClusterRole` should enable to scrape metrics from pods/services in any namespace as this is what most people should need. \r\nMaybe this power enforcement should be enabled by a true/false trigger in the config ? \r\n\r\nIn the end, the ClusterRole should look something similar to : \r\n```\r\napiVersion: rbac.authorization.k8s.io/v1\r\nkind: ClusterRole\r\nmetadata:\r\n  annotations:\r\n    kubectl.kubernetes.io/last-applied-configuration: |\r\n      {\"apiVersion\":\"rbac.authorization.k8s.io/v1\",\"kind\":\"ClusterRole\",\"metadata\":{\"annotations\":{},\"name\":\"prometheus-k8s\",\"namespace\":\"\"},\"rules\":[{\"apiGroups\":[\"\"],\"resources\":[\"nodes/metrics\"],\"verbs\":[\"get\"]},{\"nonResourceURLs\":[\"/metrics\"],\"verbs\":[\"get\"]}]}\r\n  creationTimestamp: 2018-07-24T18:45:23Z\r\n  name: prometheus-k8s\r\n  resourceVersion: \"19867614\"\r\n  selfLink: /apis/rbac.authorization.k8s.io/v1/clusterroles/prometheus-k8s\r\n  uid: b928e4d8-8f71-11e8-af1d-42010a8400e0\r\nrules:\r\n- apiGroups:\r\n  - \"\"\r\n  resources:\r\n  - nodes/metrics\r\n  verbs:\r\n  - get\r\n- nonResourceURLs:\r\n  - /metrics\r\n  verbs:\r\n  - get\r\n- apiGroups:\r\n  - \"\"\r\n  resources:\r\n  - pods\r\n  - nodes\r\n  - namespaces\r\n  - services\r\n  - endpoints\r\n  verbs:\r\n  - get\r\n  - list\r\n  - watch\r\n```\r\n\r\n**Environment**\r\n\r\n* Prometheus Operator version:\r\n\r\n\t`v0.22.2`\r\n\r\n* Kubernetes version information:\r\n\r\n\t`1.10.5-gke.3`\r\n\r\n* Kubernetes cluster kind: \r\n\r\n\tGKE\r\n\r\n"},"comment":{"url":"https://api.github.com/repos/coreos/prometheus-operator/issues/comments/415328333","html_url":"https://github.com/coreos/prometheus-operator/issues/1696#issuecomment-415328333","issue_url":"https://api.github.com/repos/coreos/prometheus-operator/issues/1696","id":415328333,"node_id":"MDEyOklzc3VlQ29tbWVudDQxNTMyODMzMw==","user":{"login":"brancz","id":4546722,"node_id":"MDQ6VXNlcjQ1NDY3MjI=","avatar_url":"https://avatars3.githubusercontent.com/u/4546722?v=4","gravatar_id":"","url":"https://api.github.com/users/brancz","html_url":"https://github.com/brancz","followers_url":"https://api.github.com/users/brancz/followers","following_url":"https://api.github.com/users/brancz/following{/other_user}","gists_url":"https://api.github.com/users/brancz/gists{/gist_id}","starred_url":"https://api.github.com/users/brancz/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/brancz/subscriptions","organizations_url":"https://api.github.com/users/brancz/orgs","repos_url":"https://api.github.com/users/brancz/repos","events_url":"https://api.github.com/users/brancz/events{/privacy}","received_events_url":"https://api.github.com/users/brancz/received_events","type":"User","site_admin":false},"created_at":"2018-08-23T08:03:02Z","updated_at":"2018-08-23T08:03:02Z","author_association":"MEMBER","body":"As #1708 is merged I'm closing this here. Thanks a lot for the fantastic contribution @prune998! :tada: "}}
{"actor":{"display_login":"brancz"}}