Use scrapeClass for service monitors

As documented in [1], the platform Prometheus servers are configured
with a scrape class named `tls-client-certificate-auth` which
automatically injects the client certificate and key files for mutual
TLS into the scrape configuration of the service.

This commit also removes the `namespaceSelector` field of the operator's
service monitor: it isn't required when the service monitor and service
are located in the same namespace. It also adjusts the `jobLabel` value
to refer to the `app` label of the service.

[1] https://rhobs-handbook.netlify.app/products/openshiftmonitoring/collecting_metrics.md/#configuring-prometheus-to-scrape-metrics

Signed-off-by: Simon Pasquier <[email protected]>

Author: simonpasquier

manifests/0000_90_kube-apiserver-operator_03_servicemonitor.yaml

@@ -9,8 +9,7 @@ metadata:
     exclude.release.openshift.io/internal-openshift-hosted: "true"
 spec:
   endpoints:
-  - bearerTokenFile: /var/run/secrets/kubernetes.io/serviceaccount/token
-    interval: 30s
+  - interval: 30s
     metricRelabelings:
     - action: drop
       regex: etcd_(debugging|disk|request|server).*
@@ -19,14 +18,9 @@ spec:
     port: https
     scheme: https
     tlsConfig:
-      caFile: /etc/prometheus/configmaps/serving-certs-ca-bundle/service-ca.crt
       serverName: metrics.openshift-kube-apiserver-operator.svc
-      certFile: /etc/prometheus/secrets/metrics-client-certs/tls.crt
-      keyFile: /etc/prometheus/secrets/metrics-client-certs/tls.key
-  jobLabel: component
-  namespaceSelector:
-    matchNames:
-    - openshift-kube-apiserver-operator
+  jobLabel: app
+  scrapeClass: tls-client-certificate-auth
   selector:
     matchLabels:
       app: kube-apiserver-operator

manifests/0000_90_kube-apiserver-operator_04_servicemonitor-apiserver.yaml

@@ -48,8 +48,7 @@ metadata:
     exclude.release.openshift.io/internal-openshift-hosted: "true"
 spec:
   endpoints:
-  - bearerTokenFile: /var/run/secrets/kubernetes.io/serviceaccount/token
-    interval: 30s
+  - interval: 30s
     metricRelabelings:
     - action: drop
       regex: etcd_(debugging|disk|server).*
@@ -109,12 +108,11 @@ spec:
     tlsConfig:
       caFile: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
       serverName: kubernetes
-      certFile: /etc/prometheus/secrets/metrics-client-certs/tls.crt
-      keyFile: /etc/prometheus/secrets/metrics-client-certs/tls.key
   jobLabel: component
   namespaceSelector:
     matchNames:
     - default
+  scrapeClass: tls-client-certificate-auth
   selector:
     matchLabels:
       component: apiserver