k8s集成kube-prometheus

https://github.com/prometheus-operator/kube-prometheus
---
注：在release-0.11版本之后新增了NetworkPolicy
默认是允许自己访问，如果了解NetworkPolicy可以修改一下默认的规则，可以用查看 ls *networkPolicy*，如果不修改的话则会影响到修改NodePort类型也无法访问
如果不会Networkpolicy可以直接删除就行。
```
kubectl delete networkpolicy --all -n monitoring
```

https://blog.csdn.net/weixin_45444133/article/details/120434811
---
## 推荐模板

![](/media/202308/2023-08-11_102519_0763260.5409705486354585.png)
https://grafana.com/grafana/dashboards/13105-1-k8s-for-prometheus-dashboard-20211010/

https://grafana.com/grafana/dashboards/16098-1-node-exporter-for-prometheus-dashboard-cn-0417-job/

## 修改类型为 NodePort
为了可以从外部访问prometheus，alertmanager，grafana，我们这里修改promethes，alertmanager，grafana的service类型为NodePort类型。
* 修改prometheus的service
```
cat prometheus-service.yaml 
apiVersion: v1
kind: Service
metadata:
  labels:
    app.kubernetes.io/component: prometheus
    app.kubernetes.io/name: prometheus
    app.kubernetes.io/part-of: kube-prometheus
    app.kubernetes.io/version: 2.29.1
    prometheus: k8s
  name: prometheus-k8s
  namespace: monitoring
spec:
  type: NodePort # 新增
  ports:
  - name: web
    port: 9090
    nodePort: 30090 # 新增
    targetPort: web
  selector:
    app: prometheus
    app.kubernetes.io/component: prometheus
    app.kubernetes.io/name: prometheus
    app.kubernetes.io/part-of: kube-prometheus
    prometheus: k8s
  sessionAffinity: ClientIP
```
* 修改alertmanager的service
```
apiVersion: v1
kind: Service
metadata:
  labels:
    alertmanager: main
    app.kubernetes.io/component: alert-router
    app.kubernetes.io/name: alertmanager
    app.kubernetes.io/part-of: kube-prometheus
    app.kubernetes.io/version: 0.22.2
  name: alertmanager-main
  namespace: monitoring
spec:
  type: NodePort # 新增
  ports:
  - name: web
    port: 9093
    nodePort: 30093  # 新增
    targetPort: web
  selector:
    alertmanager: main
    app: alertmanager
    app.kubernetes.io/component: alert-router
    app.kubernetes.io/name: alertmanager
    app.kubernetes.io/part-of: kube-prometheus
  sessionAffinity: ClientIP
```
* 修改grafana的service
```
cat grafana-service.yaml
apiVersion: v1
kind: Service
metadata:
  labels:
    app.kubernetes.io/component: grafana
    app.kubernetes.io/name: grafana
    app.kubernetes.io/part-of: kube-prometheus
    app.kubernetes.io/version: 8.1.1
  name: grafana
  namespace: monitoring
spec:
  type: NodePort # 新增
  ports:
  - name: http
    port: 3000
    nodePort: 32000 # 新增
    targetPort: http
  selector:
    app.kubernetes.io/component: grafana
    app.kubernetes.io/name: grafana
    app.kubernetes.io/part-of: kube-prometheus
```
## 通过Ingres访问Prometheus
```
cat > prometheus-ingress.yaml << 'EOF'
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  namespace: monitoring
  name: prometheus-ingress
spec:
  ingressClassName: nginx
  rules:
  - host: grafana.davidops.info  # 访问 Grafana 域名
    http:
      paths:
      - pathType: Prefix
        path: "/"
        backend:
          service:
            name: grafana
            port:
              number: 3000
  - host: prometheus.davidops.info  # 访问 Prometheus 域名
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: prometheus-k8s 
            port:
              number: 9090
  - host: alertmanager.davidops.info  # 访问 alertmanager 域名
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: alertmanager-main
            port:
              number: 9093
EOF
```

## grafana 集成ldap
https://grafana.com/docs/grafana/latest/setup-grafana/configure-security/configure-authentication/ldap/
```
# vim ./grafana-config.yaml
apiVersion: v1
kind: Secret
metadata:
  labels:
    app.kubernetes.io/component: grafana
    app.kubernetes.io/name: grafana
    app.kubernetes.io/part-of: kube-prometheus
    app.kubernetes.io/version: 9.5.3
  name: grafana-config
  namespace: monitoring
stringData:
  grafana.ini: |
    [date_formats]
    default_timezone = UTC
    [auth.ldap]
    enabled = true
    config_file = /etc/grafana/ldap.toml
    allow_sign_up = true
  ldap.toml: |
    [[servers]]
    host = "129.168.1.116"
    port = 389
    use_ssl = false
    start_tls = false
    ssl_skip_verify = false
    bind_dn = "cn=admin,dc=leg,dc=cg"
    bind_password = 'admin'
    search_filter = "(cn=%s)"
    search_base_dns = ["ou=People,dc=leg,dc=cg"]
    [servers.attributes]
    member_of = "memberOf"
    email =  "email"
```

# 自定义配置
https://www.cnblogs.com/koktlzz/p/15268185.html
https://ytool.cloud/logs/prometheus/operator.html