update gen tools version (#689)

Signed-off-by: LiZhenCheng9527 <lizhencheng6@huawei.com>

Author: LiZhenCheng9527

Makefile.tools.mk

@@ -29,7 +29,7 @@ register-gen@v  	:= k8s.io/code-generator/cmd/register-gen@v0.25.2
 deepcopy-gen@v  	:= k8s.io/code-generator/cmd/deepcopy-gen@v0.25.2
 controller-gen@v 	:= sigs.k8s.io/controller-tools/cmd/controller-gen@v0.14.0
 kustomize@v       	:= sigs.k8s.io/kustomize/kustomize/v4@v4.5.5
-jb@v                := github.com/jsonnet-bundler/jsonnet-bundler/cmd/jb@v0.5.1
+jb@v                := github.com/jsonnet-bundler/jsonnet-bundler/cmd/jb@v0.6.0
 gojsontoyaml@v      := github.com/brancz/gojsontoyaml@v0.1.0
 jsonnet@v           := github.com/google/go-jsonnet/cmd/jsonnet@v0.18.0
 

hack/gen-prom.sh

@@ -11,7 +11,7 @@ JB="${REPO_ROOT}/.tools/jb"
 PROM_OUT_PATH=${REPO_ROOT}/out/prom
 PROM_JSONNET_FILE=${REPO_ROOT}/$1
 PROM_MANIFESTS_PATH=${REPO_ROOT}/${2}
-KUBE_PROM_VER=${KUBE_PROM_VER:-v0.10.0}
+KUBE_PROM_VER=${KUBE_PROM_VER:-v0.12.0}
 
 echo 'begin to generate prom manifests'
 echo "jsonnet: ${PROM_JSONNET_FILE}"

manifests/profiles/prom-thanos/kube-state-metrics-clusterRole.yaml

@@ -5,7 +5,7 @@ metadata:
     app.kubernetes.io/component: exporter
     app.kubernetes.io/name: kube-state-metrics
     app.kubernetes.io/part-of: kube-prometheus
-    app.kubernetes.io/version: 2.3.0
+    app.kubernetes.io/version: 2.7.0
   name: kube-state-metrics
 rules:
 - apiGroups:
@@ -16,6 +16,7 @@ rules:
   - nodes
   - pods
   - services
+  - serviceaccounts
   - resourcequotas
   - replicationcontrollers
   - limitranges
@@ -97,6 +98,7 @@ rules:
   - networking.k8s.io
   resources:
   - networkpolicies
+  - ingressclasses
   - ingresses
   verbs:
   - list
@@ -108,3 +110,13 @@ rules:
   verbs:
   - list
   - watch
+- apiGroups:
+  - rbac.authorization.k8s.io
+  resources:
+  - clusterrolebindings
+  - clusterroles
+  - rolebindings
+  - roles
+  verbs:
+  - list
+  - watch

manifests/profiles/prom-thanos/kube-state-metrics-clusterRoleBinding.yaml

@@ -5,7 +5,7 @@ metadata:
     app.kubernetes.io/component: exporter
     app.kubernetes.io/name: kube-state-metrics
     app.kubernetes.io/part-of: kube-prometheus
-    app.kubernetes.io/version: 2.3.0
+    app.kubernetes.io/version: 2.7.0
   name: kube-state-metrics
 roleRef:
   apiGroup: rbac.authorization.k8s.io

manifests/profiles/prom-thanos/kube-state-metrics-deployment.yaml

@@ -5,7 +5,7 @@ metadata:
     app.kubernetes.io/component: exporter
     app.kubernetes.io/name: kube-state-metrics
     app.kubernetes.io/part-of: kube-prometheus
-    app.kubernetes.io/version: 2.3.0
+    app.kubernetes.io/version: 2.7.0
   name: kube-state-metrics
   namespace: monitoring
 spec:
@@ -23,15 +23,16 @@ spec:
         app.kubernetes.io/component: exporter
         app.kubernetes.io/name: kube-state-metrics
         app.kubernetes.io/part-of: kube-prometheus
-        app.kubernetes.io/version: 2.3.0
+        app.kubernetes.io/version: 2.7.0
     spec:
+      automountServiceAccountToken: true
       containers:
       - args:
         - --host=127.0.0.1
         - --port=8081
         - --telemetry-host=127.0.0.1
         - --telemetry-port=8082
-        image: k8s.gcr.io/kube-state-metrics/kube-state-metrics:v2.3.0
+        image: registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.7.0
         name: kube-state-metrics
         resources:
           limits:
@@ -41,13 +42,18 @@ spec:
             cpu: 10m
             memory: 190Mi
         securityContext:
+          allowPrivilegeEscalation: false
+          capabilities:
+            drop:
+            - ALL
+          readOnlyRootFilesystem: true
           runAsUser: 65534
       - args:
         - --logtostderr
         - --secure-listen-address=:8443
         - --tls-cipher-suites=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305
         - --upstream=http://127.0.0.1:8081/
-        image: quay.io/brancz/kube-rbac-proxy:v0.11.0
+        image: quay.io/brancz/kube-rbac-proxy:v0.14.0
         name: kube-rbac-proxy-main
         ports:
         - containerPort: 8443
@@ -60,6 +66,11 @@ spec:
             cpu: 20m
             memory: 20Mi
         securityContext:
+          allowPrivilegeEscalation: false
+          capabilities:
+            drop:
+            - ALL
+          readOnlyRootFilesystem: true
           runAsGroup: 65532
           runAsNonRoot: true
           runAsUser: 65532
@@ -68,7 +79,7 @@ spec:
         - --secure-listen-address=:9443
         - --tls-cipher-suites=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305
         - --upstream=http://127.0.0.1:8082/
-        image: quay.io/brancz/kube-rbac-proxy:v0.11.0
+        image: quay.io/brancz/kube-rbac-proxy:v0.14.0
         name: kube-rbac-proxy-self
         ports:
         - containerPort: 9443
@@ -81,6 +92,11 @@ spec:
             cpu: 10m
             memory: 20Mi
         securityContext:
+          allowPrivilegeEscalation: false
+          capabilities:
+            drop:
+            - ALL
+          readOnlyRootFilesystem: true
           runAsGroup: 65532
           runAsNonRoot: true
           runAsUser: 65532

manifests/profiles/prom-thanos/kube-state-metrics-networkPolicy.yaml

@@ -0,0 +1,31 @@
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  labels:
+    app.kubernetes.io/component: exporter
+    app.kubernetes.io/name: kube-state-metrics
+    app.kubernetes.io/part-of: kube-prometheus
+    app.kubernetes.io/version: 2.7.0
+  name: kube-state-metrics
+  namespace: monitoring
+spec:
+  egress:
+  - {}
+  ingress:
+  - from:
+    - podSelector:
+        matchLabels:
+          app.kubernetes.io/name: prometheus
+    ports:
+    - port: 8443
+      protocol: TCP
+    - port: 9443
+      protocol: TCP
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/component: exporter
+      app.kubernetes.io/name: kube-state-metrics
+      app.kubernetes.io/part-of: kube-prometheus
+  policyTypes:
+  - Egress
+  - Ingress

manifests/profiles/prom-thanos/kube-state-metrics-prometheusRule.yaml

@@ -5,7 +5,7 @@ metadata:
     app.kubernetes.io/component: exporter
     app.kubernetes.io/name: kube-state-metrics
     app.kubernetes.io/part-of: kube-prometheus
-    app.kubernetes.io/version: 2.3.0
+    app.kubernetes.io/version: 2.7.0
     prometheus: thanos
     role: alert-rules
   name: kube-state-metrics-rules

manifests/profiles/prom-thanos/kube-state-metrics-service.yaml

@@ -5,7 +5,7 @@ metadata:
     app.kubernetes.io/component: exporter
     app.kubernetes.io/name: kube-state-metrics
     app.kubernetes.io/part-of: kube-prometheus
-    app.kubernetes.io/version: 2.3.0
+    app.kubernetes.io/version: 2.7.0
   name: kube-state-metrics
   namespace: monitoring
 spec:

manifests/profiles/prom-thanos/kube-state-metrics-serviceAccount.yaml

@@ -1,10 +1,11 @@
 apiVersion: v1
+automountServiceAccountToken: false
 kind: ServiceAccount
 metadata:
   labels:
     app.kubernetes.io/component: exporter
     app.kubernetes.io/name: kube-state-metrics
     app.kubernetes.io/part-of: kube-prometheus
-    app.kubernetes.io/version: 2.3.0
+    app.kubernetes.io/version: 2.7.0
   name: kube-state-metrics
   namespace: monitoring

manifests/profiles/prom-thanos/kube-state-metrics-serviceMonitor.yaml

@@ -5,14 +5,19 @@ metadata:
     app.kubernetes.io/component: exporter
     app.kubernetes.io/name: kube-state-metrics
     app.kubernetes.io/part-of: kube-prometheus
-    app.kubernetes.io/version: 2.3.0
+    app.kubernetes.io/version: 2.7.0
   name: kube-state-metrics
   namespace: monitoring
 spec:
   endpoints:
   - bearerTokenFile: /var/run/secrets/kubernetes.io/serviceaccount/token
     honorLabels: true
     interval: 30s
+    metricRelabelings:
+    - action: drop
+      regex: kube_endpoint_address_not_ready|kube_endpoint_address_available
+      sourceLabels:
+      - __name__
     port: https-main
     relabelings:
     - action: labeldrop