Declarative Prometheus SA Token Secret

jsonnet/kube-prometheus/components/prometheus.libsonnet

@@ -164,6 +164,18 @@ function(params) {
     automountServiceAccountToken: true,
   },
 
+  serviceAccountToken: {
+    apiVersion: 'v1',
+    kind: 'Secret',
+    metadata: p._metadata {
+      name: p._metadata.name + '-token',
+      annotations: {
+        'kubernetes.io/service-account.name': p.serviceAccount.metadata.name,
+      },
+    },
+    type: 'kubernetes.io/service-account-token',
+  },
+
   service: {
     apiVersion: 'v1',
     kind: 'Service',

kustomization.yaml

@@ -62,6 +62,7 @@ resources:
 - ./manifests/prometheus-roleSpecificNamespaces.yaml
 - ./manifests/prometheus-service.yaml
 - ./manifests/prometheus-serviceAccount.yaml
+- ./manifests/prometheus-serviceAccountToken.yaml
 - ./manifests/prometheus-serviceMonitor.yaml
 - ./manifests/prometheusAdapter-apiService.yaml
 - ./manifests/prometheusAdapter-clusterRole.yaml

manifests/prometheus-serviceAccountToken.yaml

@@ -0,0 +1,14 @@
+apiVersion: v1
+kind: Secret
+metadata:
+  annotations:
+    kubernetes.io/service-account.name: prometheus-k8s
+  labels:
+    app.kubernetes.io/component: prometheus
+    app.kubernetes.io/instance: k8s
+    app.kubernetes.io/name: prometheus
+    app.kubernetes.io/part-of: kube-prometheus
+    app.kubernetes.io/version: 2.47.0
+  name: prometheus-k8s-token
+  namespace: monitoring
+type: kubernetes.io/service-account-token