panxiao81
88a02ababa
Reorganize the brownfield repository, remove retired and generated artifacts, harden ignore rules, and record the GitOps/IaC redesign.
30 lines
975 B
YAML
30 lines
975 B
YAML
# Enables vmagent scrape-config hot-reload. The operator-generated Role grants the
|
|
# vmagent-main SA secrets [get,watch] but omits [list], which its config-reloader's
|
|
# informer requires — so scrape-config changes stall until vmagent restarts.
|
|
# This supplementary, namespace-scoped Role covers secrets get/list/watch so the
|
|
# reloader works regardless of the operator Role. Scope: Secrets in `monitoring` only.
|
|
# See README-reload.md for background.
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: Role
|
|
metadata:
|
|
name: vmagent-main-secret-lister
|
|
namespace: monitoring
|
|
rules:
|
|
- apiGroups: [""]
|
|
resources: ["secrets"]
|
|
verbs: ["get", "list", "watch"]
|
|
---
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: RoleBinding
|
|
metadata:
|
|
name: vmagent-main-secret-lister
|
|
namespace: monitoring
|
|
roleRef:
|
|
apiGroup: rbac.authorization.k8s.io
|
|
kind: Role
|
|
name: vmagent-main-secret-lister
|
|
subjects:
|
|
- kind: ServiceAccount
|
|
name: vmagent-main
|
|
namespace: monitoring
|