Fix Kubernetes access

Give the pods the proper authorization
Clarify the jobs endpoint names

manifests/monitoring/config.yaml

@@ -10,10 +10,9 @@ data:
     alerting:
     scrape_configs:
       # This scrapes endpoints on my servers
-      - job_name: prometheus
+      - job_name: node
         static_configs:
           - targets:
-              # Node exporters
               - "genesis.shire-zebra.ts.net:9100"
               - "isaiah.shire-zebra.ts.net:9100"
               - "jeremiah.shire-zebra.ts.net:9100"
@@ -22,7 +21,9 @@ data:
               - "exodus.shire-zebra.ts.net:9100"
               - "linode.shire-zebra.ts.net:9100"
               - "vm-gitlab.shire-zebra.ts.net:9100"
-              # Systemd exporters
+      - job_name: systemd
+        static_configs:
+          - targets:
               - "genesis.shire-zebra.ts.net:9558"
               - "isaiah.shire-zebra.ts.net:9558"
               - "jeremiah.shire-zebra.ts.net:9558"
@@ -31,7 +32,9 @@ data:
               - "exodus.shire-zebra.ts.net:9558"
               - "linode.shire-zebra.ts.net:9558"
               - "vm-gitlab.shire-zebra.ts.net:9558"
-              # Ping port
+      - job_name: ping
+        static_configs:
+          - targets:
               - "genesis.shire-zebra.ts.net:9427"
               - "isaiah.shire-zebra.ts.net:9427"
               - "jeremiah.shire-zebra.ts.net:9427"
@@ -40,56 +43,69 @@ data:
               - "exodus.shire-zebra.ts.net:9427"
               - "linode.shire-zebra.ts.net:9427"
               - "vm-gitlab.shire-zebra.ts.net:9427"
-              # Key port
+      - job_name: kea
+        static_configs:
+          - targets:
               - "genesis.shire-zebra.ts.net:9547"
-              # Dnsmasq port
+      - job_name: dnsmasq
+        static_configs:
+          - targets:
               - "genesis.shire-zebra.ts.net:9153"
-              # Graphite exporter
+      # Converter from TrueNAS
+      - job_name: graphite
+        static_configs:
+          - targets:
               - "hosea.shire-zebra.ts.net:9108"
       # This scrapes metrics from the Kubernetes kubelets
-      #- job_name: kubelet
-        #kubernetes_sd_configs:
-          #- role: node
-        #scheme: https
-        #tls_config:
-          #ca_file: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
-          #insecure_skip_verify: true
-      ## This scrapes metrics about the containers themselves
-      #- job_name: cadvisor
-        #kubernetes_sd_configs:
-          #- role: node
-        #scheme: https
-        #tls_config:
-          #ca_file: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
-          #insecure_skip_verify: true
-        #metrics_path: /metrics/cadvisor
-      ## This scrapes Service endpoints in Kubernetes
-      #- job_name: 'k8sservices'
-        #kubernetes_sd_configs:
-          #- role: endpoints
-        #relabel_configs:
-          #- source_labels:
-              #- __meta_kubernetes_namespace
-              #- __meta_kubernetes_service_name
-            #action: drop
-            #regex: "default;kubernetes"
-          #- source_labels:
-              #- __meta_kubernetes_namespace
-            #regex: default
-            #action: keep
-          #- source_labels:
-              #- __meta_kubernetes_service_name
-            #target_label: job
-      ## This scrapes any exposed pod port named "metrics", assuming that it is
-      ## a prometheus source
-      #- job_name: k8spods
-        #kubernetes_sd_configs:
-          #- role: pod
-        #relabel_configs:
-          #- source_labels:
-              #- __meta_kubernetes_pod_container_port_name
-            #regex: metrics
-            #action: keep
-          #- source_labels:
-              #- __meta_kubernetes_pod_container_name
-            #target_label: job
+      - job_name: kubelet
+        kubernetes_sd_configs:
+          - role: node
+        scheme: https
+        tls_config:
+          ca_file: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
+        authorization:
+          credentials_file: /var/run/secrets/kubernetes.io/serviceaccount/token
+      # This scrapes metrics about the containers themselves
+      - job_name: cadvisor
+        kubernetes_sd_configs:
+          - role: node
+        scheme: https
+        tls_config:
+          ca_file: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
+        metrics_path: /metrics/cadvisor
+        authorization:
+          credentials_file: /var/run/secrets/kubernetes.io/serviceaccount/token
+      # This scrapes Service endpoints in Kubernetes
+      - job_name: 'k8sservices'
+        kubernetes_sd_configs:
+          - role: endpoints
+        relabel_configs:
+          - source_labels:
+              - __meta_kubernetes_namespace
+              - __meta_kubernetes_service_name
+            action: drop
+            regex: "default;kubernetes"
+          - source_labels:
+              - __meta_kubernetes_namespace
+            regex: default
+            action: keep
+          - source_labels:
+              - __meta_kubernetes_service_name
+            target_label: job
+        authorization:
+          credentials_file: /var/run/secrets/kubernetes.io/serviceaccount/token
+      # This scrapes any exposed pod port named "metrics", assuming that it is
+      # a prometheus source
+      - job_name: k8spods
+        kubernetes_sd_configs:
+          - role: pod
+        relabel_configs:
+          - source_labels:
+              - __meta_kubernetes_pod_container_port_name
+            regex: metrics
+            action: keep
+          - source_labels:
+              - __meta_kubernetes_pod_container_name
+            target_label: job
+        authorization:
+          credentials_file: /var/run/secrets/kubernetes.io/serviceaccount/token

manifests/monitoring/deployment.yaml

@@ -22,6 +22,7 @@ spec:
         prometheus.io/scrape: "true"
         prometheus.io/port: "9090"
     spec:
+      serviceAccountName: prometheus
       containers:
         - name: prometheus
           image: prom/prometheus