Skip to content

MON-4472: Migrate Prometheus targets discovering from Endpoints to EndpointsSlices #638

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
machine424 wants to merge 1 commit into
base: main
Choose a base branch
from
Open

MON-4472: Migrate Prometheus targets discovering from Endpoints to EndpointsSlices #638

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 8 additions & 0 deletions manifests/0000_90_openshift-apiserver-operator_01_prometheusrole.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,3 +20,11 @@ rules:
- get
- list
- watch
- apiGroups:
Copy link
Copy Markdown
Contributor

@p0lyn0mial p0lyn0mial Jan 30, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

could we remove rbac for endpoints ?

Copy link
Copy Markdown
Contributor Author

@machine424 machine424 Jan 30, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Choosing the conservative approach in case we forget to set serviceDiscoveryRole: EndpointSlice on some hidden ServiceMonitor and CI doesn’t warn us about it.
If we can be confident that no other ServiceMonitor needs/relies on those roles, we can safely remove the permissions for sure.

That being said, both resources should contain/provide the same data, RO rbac for endpoints will not really be more permissive...

Copy link
Copy Markdown
Contributor

@p0lyn0mial p0lyn0mial Feb 2, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

If we can be confident that no other ServiceMonitor needs/relies on those roles, we can safely remove the permissions for sure.

Are we planning to review these permissions in the future?
I just want to understand and confirm whether unused RBAC permissions will be removed later on.

Copy link
Copy Markdown
Contributor Author

@machine424 machine424 Feb 9, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

once we're confident that no other ServiceMonitor (that wasn't migrated in this PR) relies on those RBAC. Yes.

- discovery.k8s.io
resources:
- endpointslices
verbs:
- get
- list
- watch
1 change: 1 addition & 0 deletions manifests/0000_90_openshift-apiserver-operator_03_servicemonitor.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -31,3 +31,4 @@ spec:
selector:
matchLabels:
app: openshift-apiserver-operator
serviceDiscoveryRole: EndpointSlice
9 changes: 9 additions & 0 deletions manifests/0000_90_openshift-apiserver-operator_04_servicemonitor-apiserver.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,6 +19,14 @@ rules:
- get
- list
- watch
- apiGroups:
Copy link
Copy Markdown
Contributor

@p0lyn0mial p0lyn0mial Jan 30, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

could we remove rbac for endpoints ?

- discovery.k8s.io
resources:
- endpointslices
verbs:
- get
- list
- watch
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
Expand Down Expand Up @@ -90,3 +98,4 @@ spec:
selector:
matchLabels:
prometheus: openshift-apiserver
serviceDiscoveryRole: EndpointSlice
1 change: 1 addition & 0 deletions manifests/0000_90_openshift-apiserver-operator_05_check-endpoints_servicemonitor.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,3 +23,4 @@ spec:
selector:
matchLabels:
prometheus: openshift-apiserver-check-endpoints
serviceDiscoveryRole: EndpointSlice