atlas-botandClaude Opus 5.5
fe2e163b6a
Loki runs SingleBinary with auth disabled and answers GET on /ingester/shutdown and /flush, so an RBAC `get` on services/proxy for loki:3100 would not be read-only. Put an nginx allow-list in front of it (query, query_range, labels, label/<name>/values, series; GET only; upstream URI rebuilt per location) and grant the paperclip read SA `get` on that Service only. Owner decision: REN-622 (option A2). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
36 lines
1.3 KiB
YAML
36 lines
1.3 KiB
YAML
apiVersion: kustomize.config.k8s.io/v1beta1
|
|
kind: Kustomization
|
|
resources:
|
|
- grafana-oauth-externalsecret.yaml
|
|
- alertmanager-smtp-externalsecret.yaml
|
|
- helmrelease-prometheus.yaml
|
|
- helmrelease-loki.yaml
|
|
- helmrelease-alloy-syslog.yaml
|
|
- helmrelease-blackbox-exporter.yaml
|
|
- loki-basic-auth-externalsecret.yaml
|
|
- loki-basic-auth-middleware.yaml
|
|
- loki-ingress.yaml
|
|
- loki-read-gateway.yaml
|
|
- alertmanager-gate-service.yaml
|
|
- alertmanager-gate-ingress.yaml
|
|
- prometheus-gate-service.yaml
|
|
- prometheus-gate-ingress.yaml
|
|
- ci-diagnostics-rbac.yaml
|
|
- smartctl-exporter.yaml
|
|
- intel-gpu-exporter.yaml
|
|
- dashboards/
|
|
configMapGenerator:
|
|
# Hash suffix kept on purpose: an edit to the .conf rolls the gateway pod,
|
|
# which is stateless and off the ingest path.
|
|
- name: loki-read-gateway
|
|
namespace: monitoring
|
|
files:
|
|
- loki-read-gateway.conf
|
|
# prometheusrule-garage.yaml lives in ./monitoring-rules/ and is applied by a
|
|
# separate Flux Kustomization that dependsOn `monitoring` — otherwise the
|
|
# server-side dry-run of the PrometheusRule fails on a fresh cluster
|
|
# ("no matches for kind PrometheusRule") because the CRD is provided by
|
|
# kube-prometheus-stack's chart, which we're applying *in this same
|
|
# Kustomization*. The split lets the chart install (CRDs and all) before
|
|
# Flux tries to admit the rule.
|