kube-prometheus/jsonnet: Use jsonnet-bundler

jsonnet/kube-prometheus/.gitignore

@@ -0,0 +1,2 @@
+jsonnetfile.lock.json
+vendor/

jsonnet/kube-prometheus/alertmanager/alertmanager.libsonnet

@@ -0,0 +1,97 @@
+local k = import 'ksonnet/ksonnet.beta.3/k.libsonnet';
+
+local alertmanagerConfig = "\nglobal:\n  resolve_timeout: 5m\nroute:\n  group_by: ['job']\n  group_wait: 30s\n  group_interval: 5m\n  repeat_interval: 12h\n  receiver: 'null'\n  routes:\n  - match:\n      alertname: DeadMansSwitch\n    receiver: 'null'\nreceivers:\n- name: 'null'\n";
+
+{
+  _config+:: {
+    namespace: 'default',
+
+    versions+:: {
+      alertmanager: 'v0.14.0',
+    },
+
+    imageRepos+:: {
+      alertmanager: 'quay.io/prometheus/alertmanager',
+    },
+
+    alertmanager+:: {
+      config: alertmanagerConfig,
+      replicas: 3,
+    },
+  },
+
+  alertmanager+:: {
+    secret:
+      local secret = k.core.v1.secret;
+
+      secret.new('alertmanager-main', { 'alertmanager.yaml': std.base64($._config.alertmanager.config) }) +
+      secret.mixin.metadata.withNamespace($._config.namespace),
+
+    serviceAccount:
+      local serviceAccount = k.core.v1.serviceAccount;
+
+      serviceAccount.new('alertmanager-main') +
+      serviceAccount.mixin.metadata.withNamespace($._config.namespace),
+
+    service:
+      local service = k.core.v1.service;
+      local servicePort = k.core.v1.service.mixin.spec.portsType;
+
+      local alertmanagerPort = servicePort.newNamed('web', 9093, 'web');
+
+      service.new('alertmanager-main', { app: 'alertmanager', alertmanager: 'main' }, alertmanagerPort) +
+      service.mixin.metadata.withNamespace($._config.namespace) +
+      service.mixin.metadata.withLabels({ alertmanager: 'main' }),
+
+    serviceMonitor:
+      {
+        apiVersion: 'monitoring.coreos.com/v1',
+        kind: 'ServiceMonitor',
+        metadata: {
+          name: 'alertmanager',
+          namespace: $._config.namespace,
+          labels: {
+            'k8s-app': 'alertmanager',
+          },
+        },
+        spec: {
+          selector: {
+            matchLabels: {
+              alertmanager: 'main',
+            },
+          },
+          namespaceSelector: {
+            matchNames: [
+              'monitoring',
+            ],
+          },
+          endpoints: [
+            {
+              port: 'web',
+              interval: '30s',
+            },
+          ],
+        },
+      },
+
+    alertmanager:
+      {
+        apiVersion: 'monitoring.coreos.com/v1',
+        kind: 'Alertmanager',
+        metadata: {
+          name: 'main',
+          namespace: $._config.namespace,
+          labels: {
+            alertmanager: 'main',
+          },
+        },
+        spec: {
+          replicas: $._config.alertmanager.replicas,
+          version: $._config.versions.alertmanager,
+          baseImage: $._config.imageRepos.alertmanager,
+          nodeSelector: { 'beta.kubernetes.io/os': 'linux' },
+          serviceAccountName: 'alertmanager-main',
+        },
+      },
+  },
+}

jsonnet/kube-prometheus/jsonnetfile.json

@@ -0,0 +1,34 @@
+{
+    "dependencies": [
+        {
+            "name": "ksonnet",
+            "source": {
+                "git": {
+                    "remote": "https://github.com/ksonnet/ksonnet-lib",
+                    "subdir": ""
+                }
+            },
+            "version": "master"
+        },
+        {
+            "name": "kubernetes-mixin",
+            "source": {
+                "git": {
+                    "remote": "https://github.com/kubernetes-monitoring/kubernetes-mixin",
+                    "subdir": ""
+                }
+            },
+            "version": "master"
+        },
+        {
+            "name": "grafana",
+            "source": {
+                "git": {
+                    "remote": "https://github.com/brancz/kubernetes-grafana",
+                    "subdir": "grafana"
+                }
+            },
+            "version": "master"
+        }
+    ]
+}

jsonnet/kube-prometheus/kube-prometheus-bootkube.libsonnet

@@ -0,0 +1,23 @@
+local k = import 'ksonnet/ksonnet.beta.3/k.libsonnet';
+local service = k.core.v1.service;
+local servicePort = k.core.v1.service.mixin.spec.portsType;
+
+{
+  prometheus+:: {
+    kubeControllerManagerPrometheusDiscoveryService:
+      service.new('kube-controller-manager-prometheus-discovery', { 'k8s-app': 'kube-controller-manager' }, servicePort.newNamed('http-metrics', 10252, 10252)) +
+      service.mixin.metadata.withNamespace('kube-system') +
+      service.mixin.metadata.withLabels({ 'k8s-app': 'kube-controller-manager' }) +
+      service.mixin.spec.withClusterIp('None'),
+    kubeSchedulerPrometheusDiscoveryService:
+      service.new('kube-scheduler-prometheus-discovery', { 'k8s-app': 'kube-scheduler' }, servicePort.newNamed('http-metrics', 10251, 10251)) +
+      service.mixin.metadata.withNamespace('kube-system') +
+      service.mixin.metadata.withLabels({ 'k8s-app': 'kube-scheduler' }) +
+      service.mixin.spec.withClusterIp('None'),
+    kubeDnsPrometheusDiscoveryService:
+      service.new('kube-dns-prometheus-discovery', { 'k8s-app': 'kube-dns' }, [servicePort.newNamed('http-metrics-skydns', 10055, 10055), servicePort.newNamed('http-metrics-dnsmasq', 10054, 10054)]) +
+      service.mixin.metadata.withNamespace('kube-system') +
+      service.mixin.metadata.withLabels({ 'k8s-app': 'kube-dns' }) +
+      service.mixin.spec.withClusterIp('None'),
+  },
+}

jsonnet/kube-prometheus/kube-prometheus-ksonnet.libsonnet

@@ -0,0 +1,8 @@
+local kp = (import 'kube-prometheus/kube-prometheus.libsonnet');
+
+{ ['0prometheus-operator-' + name]: kp.prometheusOperator[name] for name in std.objectFields(kp.prometheusOperator) } +
+{ ['node-exporter-' + name]: kp.nodeExporter[name] for name in std.objectFields(kp.nodeExporter) } +
+{ ['kube-state-metrics-' + name]: kp.kubeStateMetrics[name] for name in std.objectFields(kp.kubeStateMetrics) } +
+{ ['alertmanager-' + name]: kp.alertmanager[name] for name in std.objectFields(kp.alertmanager) } +
+{ ['prometheus-' + name]: kp.prometheus[name] for name in std.objectFields(kp.prometheus) } +
+{ ['grafana-' + name]: kp.grafana[name] for name in std.objectFields(kp.grafana) }

jsonnet/kube-prometheus/kube-prometheus-kubeadm.libsonnet

@@ -0,0 +1,18 @@
+local k = import 'ksonnet/ksonnet.beta.3/k.libsonnet';
+local service = k.core.v1.service;
+local servicePort = k.core.v1.service.mixin.spec.portsType;
+
+{
+  prometheus+: {
+    kubeControllerManagerPrometheusDiscoveryService:
+      service.new('kube-controller-manager-prometheus-discovery', { component: 'kube-controller-manager' }, servicePort.newNamed('http-metrics', 10252, 10252)) +
+      service.mixin.metadata.withNamespace('kube-system') +
+      service.mixin.metadata.withLabels({ 'k8s-app': 'kube-controller-manager' }) +
+      service.mixin.spec.withClusterIp('None'),
+    kubeSchedulerPrometheusDiscoveryService:
+      service.new('kube-scheduler-prometheus-discovery', { component: 'kube-scheduler' }, servicePort.newNamed('http-metrics', 10251, 10251)) +
+      service.mixin.metadata.withNamespace('kube-system') +
+      service.mixin.metadata.withLabels({ 'k8s-app': 'kube-scheduler' }) +
+      service.mixin.spec.withClusterIp('None'),
+  },
+}

jsonnet/kube-prometheus/kube-prometheus-node-ports.libsonnet

@@ -0,0 +1,21 @@
+local k = import 'ksonnet/ksonnet.beta.3/k.libsonnet';
+local service = k.core.v1.service;
+local servicePort = k.core.v1.service.mixin.spec.portsType;
+
+{
+  prometheus+: {
+    service+:
+      service.mixin.spec.withPorts(servicePort.newNamed('web', 9090, 'web') + servicePort.withNodePort(30900)) +
+      service.mixin.spec.withType('NodePort'),
+  },
+  alertmanager+: {
+    service+:
+      service.mixin.spec.withPorts(servicePort.newNamed('web', 9093, 'web') + servicePort.withNodePort(30903)) +
+      service.mixin.spec.withType('NodePort'),
+  },
+  grafana+: {
+    service+:
+      service.mixin.spec.withPorts(servicePort.newNamed('http', 3000, 'http') + servicePort.withNodePort(30902)) +
+      service.mixin.spec.withType('NodePort'),
+  },
+}

jsonnet/kube-prometheus/kube-prometheus.libsonnet

@@ -0,0 +1,26 @@
+local k = import 'ksonnet/ksonnet.beta.3/k.libsonnet';
+
+(import 'grafana/grafana.libsonnet') +
+(import 'kube-state-metrics/kube-state-metrics.libsonnet') +
+(import 'node-exporter/node-exporter.libsonnet') +
+(import 'alertmanager/alertmanager.libsonnet') +
+(import 'prometheus-operator/prometheus-operator.libsonnet') +
+(import 'prometheus/prometheus.libsonnet') +
+(import 'kubernetes-mixin/mixin.libsonnet') +
+{
+  _config+:: {
+    kubeStateMetricsSelector: 'job="kube-state-metrics"',
+    cadvisorSelector: 'job="kubelet"',
+    nodeExporterSelector: 'job="node-exporter"',
+    kubeletSelector: 'job="kubelet"',
+    notKubeDnsSelector: 'job!="kube-dns"',
+
+    prometheus+:: {
+      rules: $.prometheusRules + $.prometheusAlerts,
+    },
+
+    grafana+:: {
+      dashboards: $.grafanaDashboards,
+    },
+  },
+}

jsonnet/kube-prometheus/kube-state-metrics/kube-state-metrics.libsonnet

@@ -0,0 +1,286 @@
+local k = import 'ksonnet/ksonnet.beta.3/k.libsonnet';
+
+{
+  _config+:: {
+    namespace: 'default',
+
+    versions+:: {
+      kubeStateMetrics: 'v1.3.0',
+      kubeRbacProxy: 'v0.3.0',
+      addonResizer: '1.0',
+    },
+
+    imageRepos+:: {
+      kubeStateMetrics: 'quay.io/coreos/kube-state-metrics',
+      kubeRbacProxy: 'quay.io/coreos/kube-rbac-proxy',
+      addonResizer: 'quay.io/coreos/addon-resizer',
+    },
+  },
+
+  kubeStateMetrics+:: {
+    clusterRoleBinding:
+      local clusterRoleBinding = k.rbac.v1.clusterRoleBinding;
+
+      clusterRoleBinding.new() +
+      clusterRoleBinding.mixin.metadata.withName('kube-state-metrics') +
+      clusterRoleBinding.mixin.roleRef.withApiGroup('rbac.authorization.k8s.io') +
+      clusterRoleBinding.mixin.roleRef.withName('kube-state-metrics') +
+      clusterRoleBinding.mixin.roleRef.mixinInstance({ kind: 'ClusterRole' }) +
+      clusterRoleBinding.withSubjects([{ kind: 'ServiceAccount', name: 'kube-state-metrics', namespace: $._config.namespace }]),
+
+    clusterRole:
+      local clusterRole = k.rbac.v1.clusterRole;
+      local policyRule = clusterRole.rulesType;
+
+      local coreRule = policyRule.new() +
+                       policyRule.withApiGroups(['']) +
+                       policyRule.withResources([
+                         'configmaps',
+                         'secrets',
+                         'nodes',
+                         'pods',
+                         'services',
+                         'resourcequotas',
+                         'replicationcontrollers',
+                         'limitranges',
+                         'persistentvolumeclaims',
+                         'persistentvolumes',
+                         'namespaces',
+                         'endpoints',
+                       ]) +
+                       policyRule.withVerbs(['list', 'watch']);
+
+      local extensionsRule = policyRule.new() +
+                             policyRule.withApiGroups(['extensions']) +
+                             policyRule.withResources([
+                               'daemonsets',
+                               'deployments',
+                               'replicasets',
+                             ]) +
+                             policyRule.withVerbs(['list', 'watch']);
+
+      local appsRule = policyRule.new() +
+                       policyRule.withApiGroups(['apps']) +
+                       policyRule.withResources([
+                         'statefulsets',
+                       ]) +
+                       policyRule.withVerbs(['list', 'watch']);
+
+      local batchRule = policyRule.new() +
+                        policyRule.withApiGroups(['batch']) +
+                        policyRule.withResources([
+                          'cronjobs',
+                          'jobs',
+                        ]) +
+                        policyRule.withVerbs(['list', 'watch']);
+
+      local autoscalingRule = policyRule.new() +
+                              policyRule.withApiGroups(['autoscaling']) +
+                              policyRule.withResources([
+                                'horizontalpodautoscalers',
+                              ]) +
+                              policyRule.withVerbs(['list', 'watch']);
+
+      local authenticationRole = policyRule.new() +
+                                 policyRule.withApiGroups(['authentication.k8s.io']) +
+                                 policyRule.withResources([
+                                   'tokenreviews',
+                                 ]) +
+                                 policyRule.withVerbs(['create']);
+
+      local authorizationRole = policyRule.new() +
+                                policyRule.withApiGroups(['authorization.k8s.io']) +
+                                policyRule.withResources([
+                                  'subjectaccessreviews',
+                                ]) +
+                                policyRule.withVerbs(['create']);
+
+      local rules = [coreRule, extensionsRule, appsRule, batchRule, autoscalingRule, authenticationRole, authorizationRole];
+
+      clusterRole.new() +
+      clusterRole.mixin.metadata.withName('kube-state-metrics') +
+      clusterRole.withRules(rules),
+    deployment:
+      local deployment = k.apps.v1beta2.deployment;
+      local container = k.apps.v1beta2.deployment.mixin.spec.template.spec.containersType;
+      local volume = k.apps.v1beta2.deployment.mixin.spec.template.spec.volumesType;
+      local containerPort = container.portsType;
+      local containerVolumeMount = container.volumeMountsType;
+      local podSelector = deployment.mixin.spec.template.spec.selectorType;
+
+      local podLabels = { app: 'kube-state-metrics' };
+
+      local proxyClusterMetrics =
+        container.new('kube-rbac-proxy-main', $._config.imageRepos.kubeRbacProxy + ':' + $._config.versions.kubeRbacProxy) +
+        container.withArgs([
+          '--secure-listen-address=:8443',
+          '--upstream=http://127.0.0.1:8081/',
+        ]) +
+        container.withPorts(containerPort.newNamed('https-main', 8443)) +
+        container.mixin.resources.withRequests({ cpu: '10m', memory: '20Mi' }) +
+        container.mixin.resources.withLimits({ cpu: '20m', memory: '40Mi' });
+
+      local proxySelfMetrics =
+        container.new('kube-rbac-proxy-self', $._config.imageRepos.kubeRbacProxy + ':' + $._config.versions.kubeRbacProxy) +
+        container.withArgs([
+          '--secure-listen-address=:9443',
+          '--upstream=http://127.0.0.1:8082/',
+        ]) +
+        container.withPorts(containerPort.newNamed('https-self', 9443)) +
+        container.mixin.resources.withRequests({ cpu: '10m', memory: '20Mi' }) +
+        container.mixin.resources.withLimits({ cpu: '20m', memory: '40Mi' });
+
+      local kubeStateMetrics =
+        container.new('kube-state-metrics', $._config.imageRepos.kubeStateMetrics + ':' + $._config.versions.kubeStateMetrics) +
+        container.withArgs([
+          '--host=127.0.0.1',
+          '--port=8081',
+          '--telemetry-host=127.0.0.1',
+          '--telemetry-port=8082',
+        ]) +
+        container.mixin.resources.withRequests({ cpu: '102m', memory: '180Mi' }) +
+        container.mixin.resources.withLimits({ cpu: '102m', memory: '180Mi' });
+
+      local addonResizer =
+        container.new('addon-resizer', $._config.imageRepos.addonResizer + ':' + $._config.versions.addonResizer) +
+        container.withCommand([
+          '/pod_nanny',
+          '--container=kube-state-metrics',
+          '--cpu=100m',
+          '--extra-cpu=2m',
+          '--memory=150Mi',
+          '--extra-memory=30Mi',
+          '--threshold=5',
+          '--deployment=kube-state-metrics',
+        ]) +
+        container.withEnv([
+          {
+            name: 'MY_POD_NAME',
+            valueFrom: {
+              fieldRef: { apiVersion: 'v1', fieldPath: 'metadata.name' },
+            },
+          },
+          {
+            name: 'MY_POD_NAMESPACE',
+            valueFrom: {
+              fieldRef: { apiVersion: 'v1', fieldPath: 'metadata.namespace' },
+            },
+          },
+        ]) +
+        container.mixin.resources.withRequests({ cpu: '10m', memory: '30Mi' }) +
+        container.mixin.resources.withLimits({ cpu: '10m', memory: '30Mi' });
+
+      local c = [proxyClusterMetrics, proxySelfMetrics, kubeStateMetrics, addonResizer];
+
+      deployment.new('kube-state-metrics', 1, c, podLabels) +
+      deployment.mixin.metadata.withNamespace($._config.namespace) +
+      deployment.mixin.metadata.withLabels(podLabels) +
+      deployment.mixin.spec.selector.withMatchLabels(podLabels) +
+      deployment.mixin.spec.template.spec.withNodeSelector({ 'beta.kubernetes.io/os': 'linux' }) +
+      deployment.mixin.spec.template.spec.securityContext.withRunAsNonRoot(true) +
+      deployment.mixin.spec.template.spec.securityContext.withRunAsUser(65534) +
+      deployment.mixin.spec.template.spec.withServiceAccountName('kube-state-metrics'),
+
+    roleBinding:
+      local roleBinding = k.rbac.v1.roleBinding;
+
+      roleBinding.new() +
+      roleBinding.mixin.metadata.withName('kube-state-metrics') +
+      roleBinding.mixin.metadata.withNamespace($._config.namespace) +
+      roleBinding.mixin.roleRef.withApiGroup('rbac.authorization.k8s.io') +
+      roleBinding.mixin.roleRef.withName('kube-state-metrics') +
+      roleBinding.mixin.roleRef.mixinInstance({ kind: 'Role' }) +
+      roleBinding.withSubjects([{ kind: 'ServiceAccount', name: 'kube-state-metrics' }]),
+
+    role:
+      local role = k.rbac.v1.role;
+      local policyRule = role.rulesType;
+
+      local coreRule = policyRule.new() +
+                       policyRule.withApiGroups(['']) +
+                       policyRule.withResources([
+                         'pods',
+                       ]) +
+                       policyRule.withVerbs(['get']);
+
+      local extensionsRule = policyRule.new() +
+                             policyRule.withApiGroups(['extensions']) +
+                             policyRule.withResources([
+                               'deployments',
+                             ]) +
+                             policyRule.withVerbs(['get', 'update']) +
+                             policyRule.withResourceNames(['kube-state-metrics']);
+
+      local rules = [coreRule, extensionsRule];
+
+      role.new() +
+      role.mixin.metadata.withName('kube-state-metrics') +
+      role.mixin.metadata.withNamespace($._config.namespace) +
+      role.withRules(rules),
+
+    serviceAccount:
+      local serviceAccount = k.core.v1.serviceAccount;
+
+      serviceAccount.new('kube-state-metrics') +
+      serviceAccount.mixin.metadata.withNamespace($._config.namespace),
+
+    service:
+      local service = k.core.v1.service;
+      local servicePort = k.core.v1.service.mixin.spec.portsType;
+
+      local ksmServicePortMain = servicePort.newNamed('https-main', 8443, 'https-main');
+      local ksmServicePortSelf = servicePort.newNamed('https-self', 9443, 'https-self');
+
+      service.new('kube-state-metrics', $.kubeStateMetrics.deployment.spec.selector.matchLabels, [ksmServicePortMain, ksmServicePortSelf]) +
+      service.mixin.metadata.withNamespace($._config.namespace) +
+      service.mixin.metadata.withLabels({ 'k8s-app': 'kube-state-metrics' }) +
+      service.mixin.spec.withClusterIp('None'),
+
+    serviceMonitor:
+      {
+        apiVersion: 'monitoring.coreos.com/v1',
+        kind: 'ServiceMonitor',
+        metadata: {
+          name: 'kube-state-metrics',
+          namespace: $._config.namespace,
+          labels: {
+            'k8s-app': 'kube-state-metrics',
+          },
+        },
+        spec: {
+          jobLabel: 'k8s-app',
+          selector: {
+            matchLabels: {
+              'k8s-app': 'kube-state-metrics',
+            },
+          },
+          namespaceSelector: {
+            matchNames: [
+              'monitoring',
+            ],
+          },
+          endpoints: [
+            {
+              port: 'https-main',
+              scheme: 'https',
+              interval: '30s',
+              honorLabels: true,
+              bearerTokenFile: '/var/run/secrets/kubernetes.io/serviceaccount/token',
+              tlsConfig: {
+                insecureSkipVerify: true,
+              },
+            },
+            {
+              port: 'https-self',
+              scheme: 'https',
+              interval: '30s',
+              bearerTokenFile: '/var/run/secrets/kubernetes.io/serviceaccount/token',
+              tlsConfig: {
+                insecureSkipVerify: true,
+              },
+            },
+          ],
+        },
+      },
+  },
+}

jsonnet/kube-prometheus/node-exporter/node-exporter.libsonnet

@@ -0,0 +1,167 @@
+local k = import 'ksonnet/ksonnet.beta.3/k.libsonnet';
+
+{
+  _config+:: {
+    namespace: 'default',
+
+    versions+:: {
+      nodeExporter: 'v0.15.2',
+      kubeRbacProxy: 'v0.3.0',
+    },
+
+    imageRepos+:: {
+      nodeExporter: 'quay.io/prometheus/node-exporter',
+      kubeRbacProxy: 'quay.io/coreos/kube-rbac-proxy',
+    },
+  },
+
+  nodeExporter+:: {
+    clusterRoleBinding:
+      local clusterRoleBinding = k.rbac.v1.clusterRoleBinding;
+
+      clusterRoleBinding.new() +
+      clusterRoleBinding.mixin.metadata.withName('node-exporter') +
+      clusterRoleBinding.mixin.roleRef.withApiGroup('rbac.authorization.k8s.io') +
+      clusterRoleBinding.mixin.roleRef.withName('node-exporter') +
+      clusterRoleBinding.mixin.roleRef.mixinInstance({ kind: 'ClusterRole' }) +
+      clusterRoleBinding.withSubjects([{ kind: 'ServiceAccount', name: 'node-exporter', namespace: $._config.namespace }]),
+
+    clusterRole:
+      local clusterRole = k.rbac.v1.clusterRole;
+      local policyRule = clusterRole.rulesType;
+
+      local authenticationRole = policyRule.new() +
+                                 policyRule.withApiGroups(['authentication.k8s.io']) +
+                                 policyRule.withResources([
+                                   'tokenreviews',
+                                 ]) +
+                                 policyRule.withVerbs(['create']);
+
+      local authorizationRole = policyRule.new() +
+                                policyRule.withApiGroups(['authorization.k8s.io']) +
+                                policyRule.withResources([
+                                  'subjectaccessreviews',
+                                ]) +
+                                policyRule.withVerbs(['create']);
+
+      local rules = [authenticationRole, authorizationRole];
+
+      clusterRole.new() +
+      clusterRole.mixin.metadata.withName('node-exporter') +
+      clusterRole.withRules(rules),
+
+    daemonset:
+      local daemonset = k.apps.v1beta2.daemonSet;
+      local container = daemonset.mixin.spec.template.spec.containersType;
+      local volume = daemonset.mixin.spec.template.spec.volumesType;
+      local containerPort = container.portsType;
+      local containerVolumeMount = container.volumeMountsType;
+      local podSelector = daemonset.mixin.spec.template.spec.selectorType;
+      local toleration = daemonset.mixin.spec.template.spec.tolerationsType;
+
+      local podLabels = { app: 'node-exporter' };
+
+      local masterToleration = toleration.new() +
+                               toleration.withEffect('NoSchedule') +
+                               toleration.withKey('node-role.kubernetes.io/master');
+
+      local procVolumeName = 'proc';
+      local procVolume = volume.fromHostPath(procVolumeName, '/proc');
+      local procVolumeMount = containerVolumeMount.new(procVolumeName, '/host/proc');
+
+      local sysVolumeName = 'sys';
+      local sysVolume = volume.fromHostPath(sysVolumeName, '/sys');
+      local sysVolumeMount = containerVolumeMount.new(sysVolumeName, '/host/sys');
+
+      local nodeExporter =
+        container.new('node-exporter', $._config.imageRepos.nodeExporter + ':' + $._config.versions.nodeExporter) +
+        container.withArgs([
+          '--web.listen-address=127.0.0.1:9101',
+          '--path.procfs=/host/proc',
+          '--path.sysfs=/host/sys',
+        ]) +
+        container.withVolumeMounts([procVolumeMount, sysVolumeMount]) +
+        container.mixin.resources.withRequests({ cpu: '102m', memory: '180Mi' }) +
+        container.mixin.resources.withLimits({ cpu: '102m', memory: '180Mi' });
+
+      local proxy =
+        container.new('kube-rbac-proxy', $._config.imageRepos.kubeRbacProxy + ':' + $._config.versions.kubeRbacProxy) +
+        container.withArgs([
+          '--secure-listen-address=:9100',
+          '--upstream=http://127.0.0.1:9101/',
+        ]) +
+        container.withPorts(containerPort.newNamed('https', 9100)) +
+        container.mixin.resources.withRequests({ cpu: '10m', memory: '20Mi' }) +
+        container.mixin.resources.withLimits({ cpu: '20m', memory: '40Mi' });
+
+      local c = [nodeExporter, proxy];
+
+      daemonset.new() +
+      daemonset.mixin.metadata.withName('node-exporter') +
+      daemonset.mixin.metadata.withNamespace($._config.namespace) +
+      daemonset.mixin.metadata.withLabels(podLabels) +
+      daemonset.mixin.spec.selector.withMatchLabels(podLabels) +
+      daemonset.mixin.spec.template.metadata.withLabels(podLabels) +
+      daemonset.mixin.spec.template.spec.withTolerations([masterToleration]) +
+      daemonset.mixin.spec.template.spec.withNodeSelector({ 'beta.kubernetes.io/os': 'linux' }) +
+      daemonset.mixin.spec.template.spec.withContainers(c) +
+      daemonset.mixin.spec.template.spec.withVolumes([procVolume, sysVolume]) +
+      daemonset.mixin.spec.template.spec.securityContext.withRunAsNonRoot(true) +
+      daemonset.mixin.spec.template.spec.securityContext.withRunAsUser(65534) +
+      daemonset.mixin.spec.template.spec.withServiceAccountName('node-exporter'),
+
+    serviceAccount:
+      local serviceAccount = k.core.v1.serviceAccount;
+
+      serviceAccount.new('node-exporter') +
+      serviceAccount.mixin.metadata.withNamespace($._config.namespace),
+
+    serviceMonitor:
+      {
+        apiVersion: 'monitoring.coreos.com/v1',
+        kind: 'ServiceMonitor',
+        metadata: {
+          name: 'node-exporter',
+          namespace: $._config.namespace,
+          labels: {
+            'k8s-app': 'node-exporter',
+          },
+        },
+        spec: {
+          jobLabel: 'k8s-app',
+          selector: {
+            matchLabels: {
+              'k8s-app': 'node-exporter',
+            },
+          },
+          namespaceSelector: {
+            matchNames: [
+              'monitoring',
+            ],
+          },
+          endpoints: [
+            {
+              port: 'https',
+              scheme: 'https',
+              interval: '30s',
+              bearerTokenFile: '/var/run/secrets/kubernetes.io/serviceaccount/token',
+              tlsConfig: {
+                insecureSkipVerify: true,
+              },
+            },
+          ],
+        },
+      },
+
+    service:
+      local service = k.core.v1.service;
+      local servicePort = k.core.v1.service.mixin.spec.portsType;
+
+      local nodeExporterPort = servicePort.newNamed('https', 9100, 'https');
+
+      service.new('node-exporter', $.nodeExporter.daemonset.spec.selector.matchLabels, nodeExporterPort) +
+      service.mixin.metadata.withNamespace($._config.namespace) +
+      service.mixin.metadata.withLabels({ 'k8s-app': 'node-exporter' }) +
+      service.mixin.spec.withClusterIp('None'),
+  },
+}

jsonnet/kube-prometheus/prometheus-operator/prometheus-operator.libsonnet

@@ -0,0 +1,152 @@
+local k = import 'ksonnet/ksonnet.beta.3/k.libsonnet';
+
+{
+  _config+:: {
+    namespace: 'default',
+
+    versions+:: {
+      prometheusOperator: 'v0.19.0',
+    },
+
+    imageRepos+:: {
+      prometheusOperator: 'quay.io/coreos/prometheus-operator',
+    },
+  },
+
+  prometheusOperator+:: {
+    // Prefixing with 0 to ensure these manifests are listed and therefore created first.
+    '0alertmanagerCustomResourceDefinition': import 'alertmanager-crd.libsonnet',
+    '0prometheusCustomResourceDefinition': import 'prometheus-crd.libsonnet',
+    '0servicemonitorCustomResourceDefinition': import 'servicemonitor-crd.libsonnet',
+
+    clusterRoleBinding:
+      local clusterRoleBinding = k.rbac.v1.clusterRoleBinding;
+
+      clusterRoleBinding.new() +
+      clusterRoleBinding.mixin.metadata.withName('prometheus-operator') +
+      clusterRoleBinding.mixin.roleRef.withApiGroup('rbac.authorization.k8s.io') +
+      clusterRoleBinding.mixin.roleRef.withName('prometheus-operator') +
+      clusterRoleBinding.mixin.roleRef.mixinInstance({ kind: 'ClusterRole' }) +
+      clusterRoleBinding.withSubjects([{ kind: 'ServiceAccount', name: 'prometheus-operator', namespace: $._config.namespace }]),
+
+    clusterRole:
+      local clusterRole = k.rbac.v1.clusterRole;
+      local policyRule = clusterRole.rulesType;
+
+      local extensionsRule = policyRule.new() +
+                             policyRule.withApiGroups(['extensions']) +
+                             policyRule.withResources([
+                               'thirdpartyresources',
+                             ]) +
+                             policyRule.withVerbs(['*']);
+
+      local apiExtensionsRule = policyRule.new() +
+                                policyRule.withApiGroups(['apiextensions.k8s.io']) +
+                                policyRule.withResources([
+                                  'customresourcedefinitions',
+                                ]) +
+                                policyRule.withVerbs(['*']);
+
+      local monitoringRule = policyRule.new() +
+                             policyRule.withApiGroups(['monitoring.coreos.com']) +
+                             policyRule.withResources([
+                               'alertmanagers',
+                               'prometheuses',
+                               'prometheuses/finalizers',
+                               'alertmanagers/finalizers',
+                               'servicemonitors',
+                             ]) +
+                             policyRule.withVerbs(['*']);
+
+      local appsRule = policyRule.new() +
+                       policyRule.withApiGroups(['apps']) +
+                       policyRule.withResources([
+                         'statefulsets',
+                       ]) +
+                       policyRule.withVerbs(['*']);
+
+      local coreRule = policyRule.new() +
+                       policyRule.withApiGroups(['']) +
+                       policyRule.withResources([
+                         'configmaps',
+                         'secrets',
+                       ]) +
+                       policyRule.withVerbs(['*']);
+
+      local podRule = policyRule.new() +
+                      policyRule.withApiGroups(['']) +
+                      policyRule.withResources([
+                        'pods',
+                      ]) +
+                      policyRule.withVerbs(['list', 'delete']);
+
+      local routingRule = policyRule.new() +
+                          policyRule.withApiGroups(['']) +
+                          policyRule.withResources([
+                            'services',
+                            'endpoints',
+                          ]) +
+                          policyRule.withVerbs(['get', 'create', 'update']);
+
+      local nodeRule = policyRule.new() +
+                       policyRule.withApiGroups(['']) +
+                       policyRule.withResources([
+                         'nodes',
+                       ]) +
+                       policyRule.withVerbs(['list', 'watch']);
+
+      local namespaceRule = policyRule.new() +
+                            policyRule.withApiGroups(['']) +
+                            policyRule.withResources([
+                              'namespaces',
+                            ]) +
+                            policyRule.withVerbs(['list']);
+
+      local rules = [extensionsRule, apiExtensionsRule, monitoringRule, appsRule, coreRule, podRule, routingRule, nodeRule, namespaceRule];
+
+      clusterRole.new() +
+      clusterRole.mixin.metadata.withName('prometheus-operator') +
+      clusterRole.withRules(rules),
+
+    deployment:
+      local deployment = k.apps.v1beta2.deployment;
+      local container = k.apps.v1beta2.deployment.mixin.spec.template.spec.containersType;
+      local containerPort = container.portsType;
+
+      local targetPort = 8080;
+      local podLabels = { 'k8s-app': 'prometheus-operator' };
+
+      local operatorContainer =
+        container.new('prometheus-operator', $._config.imageRepos.prometheusOperator + ':' + $._config.versions.prometheusOperator) +
+        container.withPorts(containerPort.newNamed('http', targetPort)) +
+        container.withArgs(['--kubelet-service=kube-system/kubelet', '--config-reloader-image=quay.io/coreos/configmap-reload:v0.0.1']) +
+        container.mixin.resources.withRequests({ cpu: '100m', memory: '50Mi' }) +
+        container.mixin.resources.withLimits({ cpu: '200m', memory: '100Mi' });
+
+      deployment.new('prometheus-operator', 1, operatorContainer, podLabels) +
+      deployment.mixin.metadata.withNamespace($._config.namespace) +
+      deployment.mixin.metadata.withLabels(podLabels) +
+      deployment.mixin.spec.selector.withMatchLabels(podLabels) +
+      deployment.mixin.spec.template.spec.withNodeSelector({ 'beta.kubernetes.io/os': 'linux' }) +
+      deployment.mixin.spec.template.spec.securityContext.withRunAsNonRoot(true) +
+      deployment.mixin.spec.template.spec.securityContext.withRunAsUser(65534) +
+      deployment.mixin.spec.template.spec.withServiceAccountName('prometheus-operator'),
+
+    serviceAccount:
+      local serviceAccount = k.core.v1.serviceAccount;
+
+      serviceAccount.new('prometheus-operator') +
+      serviceAccount.mixin.metadata.withNamespace($._config.namespace),
+
+    service:
+      local service = k.core.v1.service;
+      local servicePort = k.core.v1.service.mixin.spec.portsType;
+
+      local poServicePort = servicePort.newNamed('http', 8080, 'http');
+
+      service.new('prometheus-operator', $.prometheusOperator.deployment.spec.selector.matchLabels, [poServicePort]) +
+      service.mixin.metadata.withLabels({ 'k8s-app': 'prometheus-operator' }) +
+      service.mixin.metadata.withNamespace($._config.namespace) +
+      service.mixin.spec.withClusterIp('None'),
+  },
+}

jsonnet/kube-prometheus/prometheus/prometheus.libsonnet

@@ -0,0 +1,454 @@
+local k = import 'ksonnet/ksonnet.beta.3/k.libsonnet';
+
+{
+  _config+:: {
+    namespace: 'default',
+
+    versions+:: {
+      prometheus: 'v2.2.1',
+    },
+
+    imageRepos+:: {
+      prometheus: 'quay.io/prometheus/prometheus',
+    },
+
+    prometheus+:: {
+      replicas: 2,
+      rules: {},
+    },
+  },
+
+  prometheus+:: {
+    serviceAccount:
+      local serviceAccount = k.core.v1.serviceAccount;
+
+      serviceAccount.new('prometheus-k8s') +
+      serviceAccount.mixin.metadata.withNamespace($._config.namespace),
+    service:
+      local service = k.core.v1.service;
+      local servicePort = k.core.v1.service.mixin.spec.portsType;
+
+      local prometheusPort = servicePort.newNamed('web', 9090, 'web');
+
+      service.new('prometheus-k8s', { app: 'prometheus', prometheus: 'k8s' }, prometheusPort) +
+      service.mixin.metadata.withNamespace($._config.namespace) +
+      service.mixin.metadata.withLabels({ prometheus: 'k8s' }),
+    rules:
+      local configMap = k.core.v1.configMap;
+
+      configMap.new('prometheus-k8s-rules', { 'all.rules.yaml': std.manifestYamlDoc($._config.prometheus.rules) }) +
+      configMap.mixin.metadata.withLabels({ role: 'alert-rules', prometheus: 'k8s' }) +
+      configMap.mixin.metadata.withNamespace($._config.namespace),
+    roleBindingDefault:
+      local roleBinding = k.rbac.v1.roleBinding;
+
+      roleBinding.new() +
+      roleBinding.mixin.metadata.withName('prometheus-k8s') +
+      roleBinding.mixin.metadata.withNamespace('default') +
+      roleBinding.mixin.roleRef.withApiGroup('rbac.authorization.k8s.io') +
+      roleBinding.mixin.roleRef.withName('prometheus-k8s') +
+      roleBinding.mixin.roleRef.mixinInstance({ kind: 'Role' }) +
+      roleBinding.withSubjects([{ kind: 'ServiceAccount', name: 'prometheus-k8s', namespace: $._config.namespace }]),
+    clusterRole:
+      local clusterRole = k.rbac.v1.clusterRole;
+      local policyRule = clusterRole.rulesType;
+
+      local nodeMetricsRule = policyRule.new() +
+                              policyRule.withApiGroups(['']) +
+                              policyRule.withResources(['nodes/metrics']) +
+                              policyRule.withVerbs(['get']);
+
+      local metricsRule = policyRule.new() +
+                          policyRule.withNonResourceUrls('/metrics') +
+                          policyRule.withVerbs(['get']);
+
+      local rules = [nodeMetricsRule, metricsRule];
+
+      clusterRole.new() +
+      clusterRole.mixin.metadata.withName('prometheus-k8s') +
+      clusterRole.withRules(rules),
+    roleConfig:
+      local role = k.rbac.v1.role;
+      local policyRule = role.rulesType;
+
+      local configmapRule = policyRule.new() +
+                            policyRule.withApiGroups(['']) +
+                            policyRule.withResources([
+                              'configmaps',
+                            ]) +
+                            policyRule.withVerbs(['get']);
+
+      role.new() +
+      role.mixin.metadata.withName('prometheus-k8s-config') +
+      role.mixin.metadata.withNamespace($._config.namespace) +
+      role.withRules(configmapRule),
+    roleBindingConfig:
+      local roleBinding = k.rbac.v1.roleBinding;
+
+      roleBinding.new() +
+      roleBinding.mixin.metadata.withName('prometheus-k8s-config') +
+      roleBinding.mixin.metadata.withNamespace($._config.namespace) +
+      roleBinding.mixin.roleRef.withApiGroup('rbac.authorization.k8s.io') +
+      roleBinding.mixin.roleRef.withName('prometheus-k8s-config') +
+      roleBinding.mixin.roleRef.mixinInstance({ kind: 'Role' }) +
+      roleBinding.withSubjects([{ kind: 'ServiceAccount', name: 'prometheus-k8s', namespace: $._config.namespace }]),
+    roleBindingNamespace:
+      local roleBinding = k.rbac.v1.roleBinding;
+
+      roleBinding.new() +
+      roleBinding.mixin.metadata.withName('prometheus-k8s') +
+      roleBinding.mixin.metadata.withNamespace($._config.namespace) +
+      roleBinding.mixin.roleRef.withApiGroup('rbac.authorization.k8s.io') +
+      roleBinding.mixin.roleRef.withName('prometheus-k8s') +
+      roleBinding.mixin.roleRef.mixinInstance({ kind: 'Role' }) +
+      roleBinding.withSubjects([{ kind: 'ServiceAccount', name: 'prometheus-k8s', namespace: $._config.namespace }]),
+    clusterRoleBinding:
+      local clusterRoleBinding = k.rbac.v1.clusterRoleBinding;
+
+      clusterRoleBinding.new() +
+      clusterRoleBinding.mixin.metadata.withName('prometheus-k8s') +
+      clusterRoleBinding.mixin.roleRef.withApiGroup('rbac.authorization.k8s.io') +
+      clusterRoleBinding.mixin.roleRef.withName('prometheus-k8s') +
+      clusterRoleBinding.mixin.roleRef.mixinInstance({ kind: 'ClusterRole' }) +
+      clusterRoleBinding.withSubjects([{ kind: 'ServiceAccount', name: 'prometheus-k8s', namespace: $._config.namespace }]),
+    roleKubeSystem:
+      local role = k.rbac.v1.role;
+      local policyRule = role.rulesType;
+
+      local coreRule = policyRule.new() +
+                       policyRule.withApiGroups(['']) +
+                       policyRule.withResources([
+                         'nodes',
+                         'services',
+                         'endpoints',
+                         'pods',
+                       ]) +
+                       policyRule.withVerbs(['get', 'list', 'watch']);
+
+      role.new() +
+      role.mixin.metadata.withName('prometheus-k8s') +
+      role.mixin.metadata.withNamespace('kube-system') +
+      role.withRules(coreRule),
+    roleDefault:
+      local role = k.rbac.v1.role;
+      local policyRule = role.rulesType;
+
+      local coreRule = policyRule.new() +
+                       policyRule.withApiGroups(['']) +
+                       policyRule.withResources([
+                         'nodes',
+                         'services',
+                         'endpoints',
+                         'pods',
+                       ]) +
+                       policyRule.withVerbs(['get', 'list', 'watch']);
+
+      role.new() +
+      role.mixin.metadata.withName('prometheus-k8s') +
+      role.mixin.metadata.withNamespace('default') +
+      role.withRules(coreRule),
+    roleBindingKubeSystem:
+      local roleBinding = k.rbac.v1.roleBinding;
+
+      roleBinding.new() +
+      roleBinding.mixin.metadata.withName('prometheus-k8s') +
+      roleBinding.mixin.metadata.withNamespace('kube-system') +
+      roleBinding.mixin.roleRef.withApiGroup('rbac.authorization.k8s.io') +
+      roleBinding.mixin.roleRef.withName('prometheus-k8s') +
+      roleBinding.mixin.roleRef.mixinInstance({ kind: 'Role' }) +
+      roleBinding.withSubjects([{ kind: 'ServiceAccount', name: 'prometheus-k8s', namespace: $._config.namespace }]),
+    roleNamespace:
+      local role = k.rbac.v1.role;
+      local policyRule = role.rulesType;
+
+      local coreRule = policyRule.new() +
+                       policyRule.withApiGroups(['']) +
+                       policyRule.withResources([
+                         'nodes',
+                         'services',
+                         'endpoints',
+                         'pods',
+                       ]) +
+                       policyRule.withVerbs(['get', 'list', 'watch']);
+
+      role.new() +
+      role.mixin.metadata.withName('prometheus-k8s') +
+      role.mixin.metadata.withNamespace($._config.namespace) +
+      role.withRules(coreRule),
+    prometheus:
+      local container = k.core.v1.pod.mixin.spec.containersType;
+      local resourceRequirements = container.mixin.resourcesType;
+      local selector = k.apps.v1beta2.deployment.mixin.spec.selectorType;
+
+      local resources = resourceRequirements.new() +
+                        resourceRequirements.withRequests({ memory: '400Mi' });
+
+      {
+        apiVersion: 'monitoring.coreos.com/v1',
+        kind: 'Prometheus',
+        metadata: {
+          name: 'k8s',
+          namespace: $._config.namespace,
+          labels: {
+            prometheus: 'k8s',
+          },
+        },
+        spec: {
+          replicas: $._config.prometheus.replicas,
+          version: $._config.versions.prometheus,
+          baseImage: $._config.imageRepos.prometheus,
+          serviceAccountName: 'prometheus-k8s',
+          serviceMonitorSelector: selector.withMatchExpressions({ key: 'k8s-app', operator: 'Exists' }),
+          nodeSelector: { 'beta.kubernetes.io/os': 'linux' },
+          ruleSelector: selector.withMatchLabels({
+            role: 'alert-rules',
+            prometheus: 'k8s',
+          }),
+          resources: resources,
+          alerting: {
+            alertmanagers: [
+              {
+                namespace: $._config.namespace,
+                name: 'alertmanager-main',
+                port: 'web',
+              },
+            ],
+          },
+        },
+      },
+    serviceMonitorPrometheus:
+      {
+        apiVersion: 'monitoring.coreos.com/v1',
+        kind: 'ServiceMonitor',
+        metadata: {
+          name: 'prometheus',
+          namespace: $._config.namespace,
+          labels: {
+            'k8s-app': 'prometheus',
+          },
+        },
+        spec: {
+          selector: {
+            matchLabels: {
+              prometheus: 'k8s',
+            },
+          },
+          namespaceSelector: {
+            matchNames: [
+              'monitoring',
+            ],
+          },
+          endpoints: [
+            {
+              port: 'web',
+              interval: '30s',
+            },
+          ],
+        },
+      },
+    serviceMonitorPrometheusOperator:
+      {
+        apiVersion: 'monitoring.coreos.com/v1',
+        kind: 'ServiceMonitor',
+        metadata: {
+          name: 'prometheus-operator',
+          namespace: $._config.namespace,
+          labels: {
+            'k8s-app': 'prometheus-operator',
+          },
+        },
+        spec: {
+          endpoints: [
+            {
+              port: 'http',
+            },
+          ],
+          selector: {
+            matchLabels: {
+              'k8s-app': 'prometheus-operator',
+            },
+          },
+        },
+      },
+    serviceMonitorKubeScheduler:
+      {
+        apiVersion: 'monitoring.coreos.com/v1',
+        kind: 'ServiceMonitor',
+        metadata: {
+          name: 'kube-scheduler',
+          namespace: $._config.namespace,
+          labels: {
+            'k8s-app': 'kube-scheduler',
+          },
+        },
+        spec: {
+          jobLabel: 'k8s-app',
+          endpoints: [
+            {
+              port: 'http-metrics',
+              interval: '30s',
+            },
+          ],
+          selector: {
+            matchLabels: {
+              'k8s-app': 'kube-scheduler',
+            },
+          },
+          namespaceSelector: {
+            matchNames: [
+              'kube-system',
+            ],
+          },
+        },
+      },
+    serviceMonitorKubelet:
+      {
+        apiVersion: 'monitoring.coreos.com/v1',
+        kind: 'ServiceMonitor',
+        metadata: {
+          name: 'kubelet',
+          namespace: $._config.namespace,
+          labels: {
+            'k8s-app': 'kubelet',
+          },
+        },
+        spec: {
+          jobLabel: 'k8s-app',
+          endpoints: [
+            {
+              port: 'https-metrics',
+              scheme: 'https',
+              interval: '30s',
+              tlsConfig: {
+                insecureSkipVerify: true,
+              },
+              bearerTokenFile: '/var/run/secrets/kubernetes.io/serviceaccount/token',
+            },
+            {
+              port: 'https-metrics',
+              scheme: 'https',
+              path: '/metrics/cadvisor',
+              interval: '30s',
+              honorLabels: true,
+              tlsConfig: {
+                insecureSkipVerify: true,
+              },
+              bearerTokenFile: '/var/run/secrets/kubernetes.io/serviceaccount/token',
+            },
+          ],
+          selector: {
+            matchLabels: {
+              'k8s-app': 'kubelet',
+            },
+          },
+          namespaceSelector: {
+            matchNames: [
+              'kube-system',
+            ],
+          },
+        },
+      },
+    serviceMonitorKubeControllerManager:
+      {
+        apiVersion: 'monitoring.coreos.com/v1',
+        kind: 'ServiceMonitor',
+        metadata: {
+          name: 'kube-controller-manager',
+          namespace: $._config.namespace,
+          labels: {
+            'k8s-app': 'kube-controller-manager',
+          },
+        },
+        spec: {
+          jobLabel: 'k8s-app',
+          endpoints: [
+            {
+              port: 'http-metrics',
+              interval: '30s',
+            },
+          ],
+          selector: {
+            matchLabels: {
+              'k8s-app': 'kube-controller-manager',
+            },
+          },
+          namespaceSelector: {
+            matchNames: [
+              'kube-system',
+            ],
+          },
+        },
+      },
+    serviceMonitorApiserver:
+      {
+        apiVersion: 'monitoring.coreos.com/v1',
+        kind: 'ServiceMonitor',
+        metadata: {
+          name: 'kube-apiserver',
+          namespace: $._config.namespace,
+          labels: {
+            'k8s-app': 'apiserver',
+          },
+        },
+        spec: {
+          jobLabel: 'component',
+          selector: {
+            matchLabels: {
+              component: 'apiserver',
+              provider: 'kubernetes',
+            },
+          },
+          namespaceSelector: {
+            matchNames: [
+              'default',
+            ],
+          },
+          endpoints: [
+            {
+              port: 'https',
+              interval: '30s',
+              scheme: 'https',
+              tlsConfig: {
+                caFile: '/var/run/secrets/kubernetes.io/serviceaccount/ca.crt',
+                serverName: 'kubernetes',
+              },
+              bearerTokenFile: '/var/run/secrets/kubernetes.io/serviceaccount/token',
+            },
+          ],
+        },
+      },
+    serviceMonitorCoreDNS:
+      {
+        apiVersion: 'monitoring.coreos.com/v1',
+        kind: 'ServiceMonitor',
+        metadata: {
+          name: 'coredns',
+          namespace: $._config.namespace,
+          labels: {
+            'k8s-app': 'coredns',
+          },
+        },
+        spec: {
+          jobLabel: 'k8s-app',
+          selector: {
+            matchLabels: {
+              'k8s-app': 'coredns',
+              component: 'metrics',
+            },
+          },
+          namespaceSelector: {
+            matchNames: [
+              'kube-system',
+            ],
+          },
+          endpoints: [
+            {
+              port: 'http-metrics',
+              interval: '15s',
+              bearerTokenFile: '/var/run/secrets/kubernetes.io/serviceaccount/token',
+            },
+          ],
+        },
+      },
+  },
+}