This commit adds support for deploying rancher-monitoring into hardened clusters.
It modifies some of the default securityContexts and does some misc. fixes such as:
- Removing default AppArmor PSP annotations from Grafana (related to https://github.com/helm/charts/issues/9090)
- Modifying rkeScheduler and rkeControllerManager to use localhost to scrape components since the endpoints aren't exposed in a hardened cluster
These changes have been verified on a hardened RKE cluster.
This commit renames `grafana-dashboards` to `cattle-dashboards` and deprecates the `grafana-datasources` namespace in favor of the normal release namespace.
Related Issue: rancher/rancher#28887
- `rke2-scheduler`
- `rke2-controller-manager`
- `rke2-proxy`
- `rke2-etcd`
All exporters are created from the cattle-pushprox chart. This commit
also modifies the relevant Grafana Dashboard ConfigMaps and
PrometheusRules to deploy if the PushProx exporters are enabled.
See changes to `overlay/CHANGELOG.md` for details on what has been added/modified.
This commit sets the following field to false:
`<serviceMonitor|podMonitor|rule>SelectorNilUsesHelmValues: true`
As a result, we look for all CRs with any labels in all namespaces rather than just
the ones tagged with `release: rancher-monitoring`.
This commit adds NoExecute / NoSchedule tolerations by default to all of the
PushProx exporters since the default expectation when deploying these exporters
is that they are deployed on the expected nodes based on nodeSelector labels
regardless of any taints added to those nodes.
Users can always choose to override these settings if necessary.
- Moves `monitoringRole` settings into `global.rbac` in values.yaml
- Moves user ClusterRoles into one file: `rancher-monitoring/clusterroles.yaml`
- Reformats user ClusterRoles format to look like upstream format
- Enables aggregateRolesForRBAC by default
- Updates README.md and CHANGELOG.md for relevant ClusterRole changes
Removes the code that supports the Helm 2 hack for crd/ (`prometheus-operator/cleanup-crds.yaml` and
`prometheus-operator/crds.yaml`) and removes crd-install hooks from crds.
Also updates the README.md and CHANGELOG.md accordingly.
Caleb Bron
Denise Schannon
Arvind Iyengar
Brenda Rearden
Menna