Skip to content

[prometheus] Remove use of API proxy #3079

@SuperQ

Description

@SuperQ

Is your feature request related to a problem ?

The prometheus chart requires ClusterRole nodes/proxy permission due to the default values using the Kubernetes API proxy to access some metrics. This elevated permission has some potential for privilege escalation in the cluster.

Using the proxy shouldn't be necessary as there is a ServiceAccount token. This is how configuration of the scrape configs is done in the kube-prometheus-stack chart. I'm guessing these changes were not backported to the original prometheus chart.

Describe the solution you'd like.

Remove /api/v1/nodes/$1/proxy/metrics relabeling for the metrics_path so that we no longer need the permission nodes/proxy.

Describe alternatives you've considered.

NONE

Additional context.

No response

Metadata

Metadata

Assignees

No one assigned

    Labels

    enhancementNew feature or request

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions