ServiceMonitor 添加配置

![](/media/202311/2023-11-03_003750_9996890.10427930536389007.png)

# demo
```
apiVersion: apps/v1
kind: Deployment
metadata:
  name: example-app
  namespace: demo
spec:
  replicas: 3
  selector:
    matchLabels:
      app: example-app
  template:
    metadata:
      labels:
        app: example-app
    spec:
      containers:
      - name: example-app
        image: fabxc/instrumented_app
        ports:
        - name: web
          containerPort: 8080
---
kind: Service
apiVersion: v1
metadata:
  name: example-app
  namespace: demo
  labels:
    app: example-app
spec:
  selector:
    app: example-app
  ports:
  - name: web
    port: 8080
```
创建 ServiceMonitor
```
apiVersion: monitoring.coreos.com/v1
kind: ServiceMonitor
metadata:
  name: example-app
  namespace: demo
  labels:
    group: demo
spec:
  selector:
    matchLabels:
      app: example-app
  endpoints:
  - port: web
```
# 采坑
在默认配置中，此 ServiceMonitor 会因为 Kubenertes RBAC 集群权限问题，导致 ServiceMonitor不生效，表现为在Prometheus 的 targets 中看不到该 ServiceMonitor 的 targets。
查看StatefulSet工作负载 prometheus-k8s 的状态，查看日志，看到如下报错:

```
services is forbidden: User "system:serviceaccount:monitoring:prometheus-k8s" cannot list services in the namespace monitoring
```
这是因为默认只配置了get权限 。解决办法是修改如下的 ClusterRole,编辑 prometheus-k8s 角色，kubectl apply 如下内容:
```
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  labels:
    app.kubernetes.io/component: prometheus
    app.kubernetes.io/name: prometheus
    app.kubernetes.io/part-of: kube-prometheus
    app.kubernetes.io/version: 2.29.1
  name: prometheus-k8s
rules:
- apiGroups:
  - ""
  resources:
  - nodes/metrics
  - services
  - endpoints
  - pods
  verbs:
  - get
  - list
  - watch
- nonResourceURLs:
  - /metrics
  verbs:
  - get
```
修改后重启 StatefulSet: prometheus-k8s; ServiceMonitor就会找到对应 Service 资源的 labels 选择器的Endpoint资源, 并且会被 Prometheus Operator 自动配置为 Prometheus 的 targets。