v-m/vmagent: Allow listing all pods in cluster
The original RBAC configuration allowed `vmagent` only to list the pods in the `victoria-metrics` namespace. In order to allow it to monitor other applications' pods, it needs to be assigned permission to list pods in all namespaces.dch-webhooks-secrets
parent
8f088fb6ae
commit
225fd8469c
|
@ -19,6 +19,7 @@ rules:
|
||||||
- ''
|
- ''
|
||||||
resources:
|
resources:
|
||||||
- nodes
|
- nodes
|
||||||
|
- pods
|
||||||
verbs:
|
verbs:
|
||||||
- get
|
- get
|
||||||
- list
|
- list
|
||||||
|
@ -51,40 +52,6 @@ subjects:
|
||||||
name: vmagent
|
name: vmagent
|
||||||
namespace: victoria-metrics
|
namespace: victoria-metrics
|
||||||
|
|
||||||
---
|
|
||||||
apiVersion: rbac.authorization.k8s.io/v1
|
|
||||||
kind: Role
|
|
||||||
metadata:
|
|
||||||
name: vmagent
|
|
||||||
labels:
|
|
||||||
app.kubernetes.io/name: vmagent
|
|
||||||
app.kubernetes.io/component: vmagent
|
|
||||||
rules:
|
|
||||||
- apiGroups:
|
|
||||||
- ''
|
|
||||||
resources:
|
|
||||||
- pods
|
|
||||||
verbs:
|
|
||||||
- get
|
|
||||||
- list
|
|
||||||
- watch
|
|
||||||
|
|
||||||
---
|
|
||||||
apiVersion: rbac.authorization.k8s.io/v1
|
|
||||||
kind: RoleBinding
|
|
||||||
metadata:
|
|
||||||
name: vmagent
|
|
||||||
labels:
|
|
||||||
app.kubernetes.io/name: vmagent
|
|
||||||
app.kubernetes.io/component: vmagent
|
|
||||||
roleRef:
|
|
||||||
apiGroup: rbac.authorization.k8s.io
|
|
||||||
kind: Role
|
|
||||||
name: vmagent
|
|
||||||
subjects:
|
|
||||||
- kind: ServiceAccount
|
|
||||||
name: vmagent
|
|
||||||
|
|
||||||
---
|
---
|
||||||
apiVersion: v1
|
apiVersion: v1
|
||||||
kind: Service
|
kind: Service
|
||||||
|
|
Loading…
Reference in New Issue