Created
March 17, 2019 11:30
-
-
Save zryfish/433f64b7b8c4826e309fb2e5f30d4608 to your computer and use it in GitHub Desktop.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # Source: istio/charts/prometheus/templates/configmap.yaml | |
| apiVersion: v1 | |
| kind: ConfigMap | |
| metadata: | |
| name: prometheus | |
| namespace: istio-system | |
| labels: | |
| app: prometheus | |
| chart: prometheus-1.0.6 | |
| release: istio | |
| heritage: Tiller | |
| data: | |
| prometheus.yml: |- | |
| global: | |
| scrape_interval: 15s | |
| scrape_configs: | |
| - job_name: 'istio-mesh' | |
| # Override the global default and scrape targets from this job every 5 seconds. | |
| scrape_interval: 5s | |
| kubernetes_sd_configs: | |
| - role: endpoints | |
| namespaces: | |
| names: | |
| - istio-system | |
| relabel_configs: | |
| - source_labels: [__meta_kubernetes_service_name, __meta_kubernetes_endpoint_port_name] | |
| action: keep | |
| regex: istio-telemetry;prometheus | |
| # Scrape config for envoy stats | |
| - job_name: 'envoy-stats' | |
| metrics_path: /stats/prometheus | |
| kubernetes_sd_configs: | |
| - role: pod | |
| relabel_configs: | |
| - source_labels: [__meta_kubernetes_pod_container_port_name] | |
| action: keep | |
| regex: '.*-envoy-prom' | |
| - source_labels: [__address__, __meta_kubernetes_pod_annotation_prometheus_io_port] | |
| action: replace | |
| regex: ([^:]+)(?::\d+)?;(\d+) | |
| replacement: $1:15090 | |
| target_label: __address__ | |
| - action: labelmap | |
| regex: __meta_kubernetes_pod_label_(.+) | |
| - source_labels: [__meta_kubernetes_namespace] | |
| action: replace | |
| target_label: namespace | |
| - source_labels: [__meta_kubernetes_pod_name] | |
| action: replace | |
| target_label: pod_name | |
| metric_relabel_configs: | |
| # Exclude some of the envoy metrics that have massive cardinality | |
| # This list may need to be pruned further moving forward, as informed | |
| # by performance and scalability testing. | |
| - source_labels: [ cluster_name ] | |
| regex: '(outbound|inbound|prometheus_stats).*' | |
| action: drop | |
| - source_labels: [ tcp_prefix ] | |
| regex: '(outbound|inbound|prometheus_stats).*' | |
| action: drop | |
| - source_labels: [ listener_address ] | |
| regex: '(.+)' | |
| action: drop | |
| - source_labels: [ http_conn_manager_listener_prefix ] | |
| regex: '(.+)' | |
| action: drop | |
| - source_labels: [ http_conn_manager_prefix ] | |
| regex: '(.+)' | |
| action: drop | |
| - source_labels: [ __name__ ] | |
| regex: 'envoy_tls.*' | |
| action: drop | |
| - source_labels: [ __name__ ] | |
| regex: 'envoy_tcp_downstream.*' | |
| action: drop | |
| - source_labels: [ __name__ ] | |
| regex: 'envoy_http_(stats|admin).*' | |
| action: drop | |
| - source_labels: [ __name__ ] | |
| regex: 'envoy_cluster_(lb|retry|bind|internal|max|original).*' | |
| action: drop | |
| - job_name: 'istio-policy' | |
| # Override the global default and scrape targets from this job every 5 seconds. | |
| scrape_interval: 5s | |
| # metrics_path defaults to '/metrics' | |
| # scheme defaults to 'http'. | |
| kubernetes_sd_configs: | |
| - role: endpoints | |
| namespaces: | |
| names: | |
| - istio-system | |
| relabel_configs: | |
| - source_labels: [__meta_kubernetes_service_name, __meta_kubernetes_endpoint_port_name] | |
| action: keep | |
| regex: istio-policy;http-monitoring | |
| - job_name: 'istio-telemetry' | |
| # Override the global default and scrape targets from this job every 5 seconds. | |
| scrape_interval: 5s | |
| # metrics_path defaults to '/metrics' | |
| # scheme defaults to 'http'. | |
| kubernetes_sd_configs: | |
| - role: endpoints | |
| namespaces: | |
| names: | |
| - istio-system | |
| relabel_configs: | |
| - source_labels: [__meta_kubernetes_service_name, __meta_kubernetes_endpoint_port_name] | |
| action: keep | |
| regex: istio-telemetry;http-monitoring | |
| - job_name: 'pilot' | |
| # Override the global default and scrape targets from this job every 5 seconds. | |
| scrape_interval: 5s | |
| # metrics_path defaults to '/metrics' | |
| # scheme defaults to 'http'. | |
| kubernetes_sd_configs: | |
| - role: endpoints | |
| namespaces: | |
| names: | |
| - istio-system | |
| relabel_configs: | |
| - source_labels: [__meta_kubernetes_service_name, __meta_kubernetes_endpoint_port_name] | |
| action: keep | |
| regex: istio-pilot;http-monitoring | |
| - job_name: 'galley' | |
| # Override the global default and scrape targets from this job every 5 seconds. | |
| scrape_interval: 5s | |
| # metrics_path defaults to '/metrics' | |
| # scheme defaults to 'http'. | |
| kubernetes_sd_configs: | |
| - role: endpoints | |
| namespaces: | |
| names: | |
| - istio-system | |
| relabel_configs: | |
| - source_labels: [__meta_kubernetes_service_name, __meta_kubernetes_endpoint_port_name] | |
| action: keep | |
| regex: istio-galley;http-monitoring | |
| # scrape config for API servers | |
| - job_name: 'kubernetes-apiservers' | |
| kubernetes_sd_configs: | |
| - role: endpoints | |
| namespaces: | |
| names: | |
| - default | |
| scheme: https | |
| tls_config: | |
| ca_file: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt | |
| bearer_token_file: /var/run/secrets/kubernetes.io/serviceaccount/token | |
| relabel_configs: | |
| - source_labels: [__meta_kubernetes_service_name, __meta_kubernetes_endpoint_port_name] | |
| action: keep | |
| regex: kubernetes;https | |
| # scrape config for nodes (kubelet) | |
| - job_name: 'kubernetes-nodes' | |
| scheme: https | |
| tls_config: | |
| ca_file: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt | |
| bearer_token_file: /var/run/secrets/kubernetes.io/serviceaccount/token | |
| kubernetes_sd_configs: | |
| - role: node | |
| relabel_configs: | |
| - action: labelmap | |
| regex: __meta_kubernetes_node_label_(.+) | |
| - target_label: __address__ | |
| replacement: kubernetes.default.svc:443 | |
| - source_labels: [__meta_kubernetes_node_name] | |
| regex: (.+) | |
| target_label: __metrics_path__ | |
| replacement: /api/v1/nodes/${1}/proxy/metrics | |
| # Scrape config for Kubelet cAdvisor. | |
| # | |
| # This is required for Kubernetes 1.7.3 and later, where cAdvisor metrics | |
| # (those whose names begin with 'container_') have been removed from the | |
| # Kubelet metrics endpoint. This job scrapes the cAdvisor endpoint to | |
| # retrieve those metrics. | |
| # | |
| # In Kubernetes 1.7.0-1.7.2, these metrics are only exposed on the cAdvisor | |
| # HTTP endpoint; use "replacement: /api/v1/nodes/${1}:4194/proxy/metrics" | |
| # in that case (and ensure cAdvisor's HTTP server hasn't been disabled with | |
| # the --cadvisor-port=0 Kubelet flag). | |
| # | |
| # This job is not necessary and should be removed in Kubernetes 1.6 and | |
| # earlier versions, or it will cause the metrics to be scraped twice. | |
| - job_name: 'kubernetes-cadvisor' | |
| scheme: https | |
| tls_config: | |
| ca_file: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt | |
| bearer_token_file: /var/run/secrets/kubernetes.io/serviceaccount/token | |
| kubernetes_sd_configs: | |
| - role: node | |
| relabel_configs: | |
| - action: labelmap | |
| regex: __meta_kubernetes_node_label_(.+) | |
| - target_label: __address__ | |
| replacement: kubernetes.default.svc:443 | |
| - source_labels: [__meta_kubernetes_node_name] | |
| regex: (.+) | |
| target_label: __metrics_path__ | |
| replacement: /api/v1/nodes/${1}/proxy/metrics/cadvisor | |
| # scrape config for service endpoints. | |
| - job_name: 'kubernetes-service-endpoints' | |
| kubernetes_sd_configs: | |
| - role: endpoints | |
| relabel_configs: | |
| - source_labels: [__meta_kubernetes_service_annotation_prometheus_io_scrape] | |
| action: keep | |
| regex: true | |
| - source_labels: [__meta_kubernetes_service_annotation_prometheus_io_scheme] | |
| action: replace | |
| target_label: __scheme__ | |
| regex: (https?) | |
| - source_labels: [__meta_kubernetes_service_annotation_prometheus_io_path] | |
| action: replace | |
| target_label: __metrics_path__ | |
| regex: (.+) | |
| - source_labels: [__address__, __meta_kubernetes_service_annotation_prometheus_io_port] | |
| action: replace | |
| target_label: __address__ | |
| regex: ([^:]+)(?::\d+)?;(\d+) | |
| replacement: $1:$2 | |
| - action: labelmap | |
| regex: __meta_kubernetes_service_label_(.+) | |
| - source_labels: [__meta_kubernetes_namespace] | |
| action: replace | |
| target_label: kubernetes_namespace | |
| - source_labels: [__meta_kubernetes_service_name] | |
| action: replace | |
| target_label: kubernetes_name | |
| - job_name: 'kubernetes-pods' | |
| kubernetes_sd_configs: | |
| - role: pod | |
| relabel_configs: # If first two labels are present, pod should be scraped by the istio-secure job. | |
| - source_labels: [__meta_kubernetes_pod_annotation_prometheus_io_scrape] | |
| action: keep | |
| regex: true | |
| - source_labels: [__meta_kubernetes_pod_annotation_sidecar_istio_io_status] | |
| action: drop | |
| regex: (.+) | |
| - source_labels: [__meta_kubernetes_pod_annotation_istio_mtls] | |
| action: drop | |
| regex: (true) | |
| - source_labels: [__meta_kubernetes_pod_annotation_prometheus_io_path] | |
| action: replace | |
| target_label: __metrics_path__ | |
| regex: (.+) | |
| - source_labels: [__address__, __meta_kubernetes_pod_annotation_prometheus_io_port] | |
| action: replace | |
| regex: ([^:]+)(?::\d+)?;(\d+) | |
| replacement: $1:$2 | |
| target_label: __address__ | |
| - action: labelmap | |
| regex: __meta_kubernetes_pod_label_(.+) | |
| - source_labels: [__meta_kubernetes_namespace] | |
| action: replace | |
| target_label: namespace | |
| - source_labels: [__meta_kubernetes_pod_name] | |
| action: replace | |
| target_label: pod_name | |
| - job_name: 'kubernetes-pods-istio-secure' | |
| scheme: https | |
| tls_config: | |
| ca_file: /etc/istio-certs/root-cert.pem | |
| cert_file: /etc/istio-certs/cert-chain.pem | |
| key_file: /etc/istio-certs/key.pem | |
| insecure_skip_verify: true # prometheus does not support secure naming. | |
| kubernetes_sd_configs: | |
| - role: pod | |
| relabel_configs: | |
| - source_labels: [__meta_kubernetes_pod_annotation_prometheus_io_scrape] | |
| action: keep | |
| regex: true | |
| # sidecar status annotation is added by sidecar injector and | |
| # istio_workload_mtls_ability can be specifically placed on a pod to indicate its ability to receive mtls traffic. | |
| - source_labels: [__meta_kubernetes_pod_annotation_sidecar_istio_io_status, __meta_kubernetes_pod_annotation_istio_mtls] | |
| action: keep | |
| regex: (([^;]+);([^;]*))|(([^;]*);(true)) | |
| - source_labels: [__meta_kubernetes_pod_annotation_prometheus_io_path] | |
| action: replace | |
| target_label: __metrics_path__ | |
| regex: (.+) | |
| - source_labels: [__address__] # Only keep address that is host:port | |
| action: keep # otherwise an extra target with ':443' is added for https scheme | |
| regex: ([^:]+):(\d+) | |
| - source_labels: [__address__, __meta_kubernetes_pod_annotation_prometheus_io_port] | |
| action: replace | |
| regex: ([^:]+)(?::\d+)?;(\d+) | |
| replacement: $1:$2 | |
| target_label: __address__ | |
| - action: labelmap | |
| regex: __meta_kubernetes_pod_label_(.+) | |
| - source_labels: [__meta_kubernetes_namespace] | |
| action: replace | |
| target_label: namespace | |
| - source_labels: [__meta_kubernetes_pod_name] | |
| action: replace | |
| target_label: pod_name |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment