Using prometheus in restricted openshift project (namespace)

[thibaut....@gmail.com]

Hello,
I m using prometheus into openshift infrastructure with limited rights to my project (namespace). I can't make auto discovery work despite the fact that this functionality (using a unique namespace) seems to be working since prometheus1.7 (i'm using last 2.0 version). Could you help me ? How can I make this auto discovery work ?
Thanks in advance

[thibaut....@gmail.com]

Configuration of prometheus.yml:
      - job_name: 'kubernetes-service-endpoints'

        kubernetes_sd_configs:
        - role: endpoints

          namespaces:
            names:
              - prom-expe

        relabel_configs:
          - source_labels: [__meta_kubernetes_service_annotation_prometheus_io_scrape]
            action: keep
            regex: true
          - source_labels: [__meta_kubernetes_service_annotation_prometheus_io_scheme]
            action: replace
            target_label: __scheme__
            regex: (https?)
          - source_labels: [__meta_kubernetes_service_annotation_prometheus_io_path]
            action: replace
            target_label: __metrics_path__
            regex: (.+)
          - source_labels: [__address__, __meta_kubernetes_service_annotation_prometheus_io_port]
            action: replace
            target_label: __address__
            regex: (.+)(?::\d+);(\d+)
            replacement: $1:$2
          - action: labelmap
            regex: __meta_kubernetes_service_label_(.+)
          - source_labels: [__meta_kubernetes_namespace]
            action: replace
            target_label: kubernetes_namespace
          - source_labels: [__meta_kubernetes_service_name]
            action: replace
            target_label: kubernetes_name

Answer from openshift:

level=error ts=2017-12-07T09:12:21.95257536Z caller=main.go:211 component=k8s_client_runtime err="github.com/prometheus/prometheus/discovery/kubernetes/kubernetes.go:178: Failed to list *v1.Service: User \"system:serviceaccount:prom-expe:prometheus-sa\" cannot list services in project \"prom-expe\""

level=warn ts=2017-12-07T09:12:22.0364455Z caller=main.go:377 msg="Received SIGTERM, exiting gracefully..."

Thanks @jordi for his previous answer but I already used the parameter namespace and this is not enough. Someone has an idea on how making this work (discover services from my project in openshift) ?

[Simon Pasquier]

Hi,

You need to grant appropriate permissions to the Prometheus service account (eg read permissions on the namespace/project).

See [1] for an example.

HTH

Simon

[1] https://github.com/simonpasquier/openshift_templates/tree/master/prometheus#setting-up-the-prometheus-account

--
You received this message because you are subscribed to the Google Groups "Prometheus Users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to prometheus-users+unsubscribe@googlegroups.com.
To post to this group, send email to prometheus-users@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/prometheus-users/7e002f58-9029-49a8-85f0-fe4480425b29%40googlegroups.com.

For more options, visit https://groups.google.com/d/optout.

[thibaut....@gmail.com]

Thanks for this quick answer but the thing is : I can't create any role, clusterrole... due to these restricted rights. That is why I don't know how to make auto discovery work without configuring a proper cluster role/role with my service account.

To unsubscribe from this group and stop receiving emails from it, send an email to prometheus-use...@googlegroups.com.
To post to this group, send email to promethe...@googlegroups.com.

[thibaut....@gmail.com]

My bad...

I simply needed to force the namespace in yaml file.
apiVersion: v1
kind: RoleBinding
metadata:
  name: prometheus-sa
  namespace: prom-expe

Thanks !

Le jeudi 7 décembre 2017 10:59:17 UTC+1, Simon Pasquier a écrit :

To unsubscribe from this group and stop receiving emails from it, send an email to prometheus-use...@googlegroups.com.
To post to this group, send email to promethe...@googlegroups.com.