Robert RappandClaude Opus 5.5
4ac251715e
ci / test (push) Failing after 23s
kube-state-metrics (NodePort 30808) und ServiceAccount prometheus-infra (nur nodes/metrics) im Cluster; Prometheus auf infra liest kubelet/cAdvisor per TLS gegen die k3s-CA. Ziele per file_sd aus kubectl get nodes, cAdvisor auf die nötigen Reihen begrenzt. Dashboard "k3s – Pods" (Vorgabe nex), Alerts K3s* nur mit notify. Playbook monitoring-k3s.yml. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
89 lines
2.6 KiB
YAML
89 lines
2.6 KiB
YAML
# kube-state-metrics v2.19.1 (Task 6.5): Zustand der Objekte (Pods, Deployments, Knoten, PVCs) für Prometheus auf infra.
|
|
# NodePort 30808 auf jedem Knoten; Prometheus fragt genau ein Ziel ab (file_sd, monitoring-targets.py).
|
|
# Nur die Ressourcen, die Dashboard und Alerts brauchen (infra hat 4 GB RAM).
|
|
apiVersion: v1
|
|
kind: ServiceAccount
|
|
metadata:
|
|
name: kube-state-metrics
|
|
namespace: kube-system
|
|
---
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: ClusterRole
|
|
metadata:
|
|
name: kube-state-metrics
|
|
rules:
|
|
- apiGroups: [""]
|
|
resources: [nodes, pods, namespaces, persistentvolumeclaims]
|
|
verbs: [list, watch]
|
|
- apiGroups: [apps]
|
|
resources: [deployments, daemonsets, statefulsets, replicasets]
|
|
verbs: [list, watch]
|
|
---
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: ClusterRoleBinding
|
|
metadata:
|
|
name: kube-state-metrics
|
|
roleRef:
|
|
apiGroup: rbac.authorization.k8s.io
|
|
kind: ClusterRole
|
|
name: kube-state-metrics
|
|
subjects:
|
|
- kind: ServiceAccount
|
|
name: kube-state-metrics
|
|
namespace: kube-system
|
|
---
|
|
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
name: kube-state-metrics
|
|
namespace: kube-system
|
|
labels: {app: kube-state-metrics}
|
|
spec:
|
|
replicas: 1
|
|
selector:
|
|
matchLabels: {app: kube-state-metrics}
|
|
template:
|
|
metadata:
|
|
labels: {app: kube-state-metrics}
|
|
spec:
|
|
serviceAccountName: kube-state-metrics
|
|
automountServiceAccountToken: true
|
|
securityContext:
|
|
runAsNonRoot: true
|
|
runAsUser: 65534
|
|
seccompProfile: {type: RuntimeDefault}
|
|
containers:
|
|
- name: kube-state-metrics
|
|
image: registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.19.1
|
|
args:
|
|
- --resources=nodes,pods,namespaces,persistentvolumeclaims,deployments,daemonsets,statefulsets,replicasets
|
|
- --port=8080
|
|
- --telemetry-port=8081
|
|
ports:
|
|
- {name: metrics, containerPort: 8080}
|
|
- {name: telemetry, containerPort: 8081}
|
|
readinessProbe:
|
|
httpGet: {path: /readyz, port: 8081}
|
|
initialDelaySeconds: 5
|
|
livenessProbe:
|
|
httpGet: {path: /livez, port: 8080}
|
|
initialDelaySeconds: 5
|
|
resources:
|
|
requests: {cpu: 10m, memory: 64Mi}
|
|
limits: {memory: 192Mi}
|
|
securityContext:
|
|
allowPrivilegeEscalation: false
|
|
readOnlyRootFilesystem: true
|
|
capabilities: {drop: [ALL]}
|
|
---
|
|
apiVersion: v1
|
|
kind: Service
|
|
metadata:
|
|
name: kube-state-metrics
|
|
namespace: kube-system
|
|
spec:
|
|
type: NodePort
|
|
selector: {app: kube-state-metrics}
|
|
ports:
|
|
- {name: metrics, port: 8080, targetPort: metrics, nodePort: 30808}
|