-
Notifications
You must be signed in to change notification settings - Fork 5.4k
Closed
Labels
enhancementNew feature or requestNew feature or request
Description
Is your feature request related to a problem ?
The prometheus chart requires ClusterRole nodes/proxy permission due to the default values using the Kubernetes API proxy to access some metrics. This elevated permission has some potential for privilege escalation in the cluster.
Using the proxy shouldn't be necessary as there is a ServiceAccount token. This is how configuration of the scrape configs is done in the kube-prometheus-stack chart. I'm guessing these changes were not backported to the original prometheus chart.
Describe the solution you'd like.
Remove /api/v1/nodes/$1/proxy/metrics relabeling for the metrics_path so that we no longer need the permission nodes/proxy.
Describe alternatives you've considered.
NONE
Additional context.
No response
Reactions are currently unavailable
Metadata
Metadata
Assignees
Labels
enhancementNew feature or requestNew feature or request