v-m/vmagent: Allow listing all pods in cluster
The original RBAC configuration allowed `vmagent` only to list the pods in the `victoria-metrics` namespace. In order to allow it to monitor other applications' pods, it needs to be assigned permission to list pods in all namespaces.dch-webhooks-secrets
parent
8f088fb6ae
commit
225fd8469c
|
@ -19,6 +19,7 @@ rules:
|
|||
- ''
|
||||
resources:
|
||||
- nodes
|
||||
- pods
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
|
@ -51,40 +52,6 @@ subjects:
|
|||
name: vmagent
|
||||
namespace: victoria-metrics
|
||||
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: Role
|
||||
metadata:
|
||||
name: vmagent
|
||||
labels:
|
||||
app.kubernetes.io/name: vmagent
|
||||
app.kubernetes.io/component: vmagent
|
||||
rules:
|
||||
- apiGroups:
|
||||
- ''
|
||||
resources:
|
||||
- pods
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: RoleBinding
|
||||
metadata:
|
||||
name: vmagent
|
||||
labels:
|
||||
app.kubernetes.io/name: vmagent
|
||||
app.kubernetes.io/component: vmagent
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: Role
|
||||
name: vmagent
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: vmagent
|
||||
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
|
|
Loading…
Reference in New Issue