Merge pull request openshift#2748 from ehearne-redhat/add-bespoke-service-account-monitoring-plugin

openshift-merge-bot[bot] · web-flow · commit 7261edb54a42 · 2025-11-22T02:58:32.000Z
OCPBUGS-65630: add monitoring-plugin service account to deployment.
diff --git a/Documentation/deps-versions.md b/Documentation/deps-versions.md
@@ -1,7 +1,7 @@
 |  OCP Version |                                   alertmanager                                   |                              kubeRbacProxy                               |                              kubeStateMetrics                               |                              kubernetesMetricsServer                              |                             monitoringPlugin                              |                              nodeExporter                              |                              promLabelProxy                               |                             prometheus                              |                              prometheusOperator                              |                             thanos                              |
 |--------------|----------------------------------------------------------------------------------|--------------------------------------------------------------------------|-----------------------------------------------------------------------------|-----------------------------------------------------------------------------------|---------------------------------------------------------------------------|------------------------------------------------------------------------|---------------------------------------------------------------------------|---------------------------------------------------------------------|------------------------------------------------------------------------------|-----------------------------------------------------------------|
-| release-4.22 | [0.29.0](https://github.com/openshift/prometheus-alertmanager/blob/release-4.22) | [0.19.1](https://github.com/openshift/kube-rbac-proxy/blob/release-4.22) | [2.17.0](https://github.com/openshift/kube-state-metrics/blob/release-4.22) | [0.8.0](https://github.com/openshift/kubernetes-metrics-server/blob/release-4.22) | [1.0.0](https://github.com/openshift/monitoring-plugin/blob/release-4.22) | [1.10.2](https://github.com/openshift/node_exporter/blob/release-4.22) | [0.12.1](https://github.com/openshift/prom-label-proxy/blob/release-4.22) | [3.6.0](https://github.com/openshift/prometheus/blob/release-4.22)  | [0.86.1](https://github.com/openshift/prometheus-operator/blob/release-4.22) | [0.39.2](https://github.com/openshift/thanos/blob/release-4.22) |
-| release-4.21 | [0.29.0](https://github.com/openshift/prometheus-alertmanager/blob/release-4.21) | [0.19.1](https://github.com/openshift/kube-rbac-proxy/blob/release-4.21) | [2.17.0](https://github.com/openshift/kube-state-metrics/blob/release-4.21) | [0.8.0](https://github.com/openshift/kubernetes-metrics-server/blob/release-4.21) | [1.0.0](https://github.com/openshift/monitoring-plugin/blob/release-4.21) | [1.10.2](https://github.com/openshift/node_exporter/blob/release-4.21) | [0.12.1](https://github.com/openshift/prom-label-proxy/blob/release-4.21) | [3.6.0](https://github.com/openshift/prometheus/blob/release-4.21)  | [0.86.1](https://github.com/openshift/prometheus-operator/blob/release-4.21) | [0.39.2](https://github.com/openshift/thanos/blob/release-4.21) |
+| release-4.22 | [0.29.0](https://github.com/openshift/prometheus-alertmanager/blob/release-4.22) | [0.19.1](https://github.com/openshift/kube-rbac-proxy/blob/release-4.22) | [2.17.0](https://github.com/openshift/kube-state-metrics/blob/release-4.22) | [0.8.0](https://github.com/openshift/kubernetes-metrics-server/blob/release-4.22) | [1.0.0](https://github.com/openshift/monitoring-plugin/blob/release-4.22) | [1.10.2](https://github.com/openshift/node_exporter/blob/release-4.22) | [0.12.1](https://github.com/openshift/prom-label-proxy/blob/release-4.22) | [3.6.0](https://github.com/openshift/prometheus/blob/release-4.22)  | [0.86.2](https://github.com/openshift/prometheus-operator/blob/release-4.22) | [0.39.2](https://github.com/openshift/thanos/blob/release-4.22) |
+| release-4.21 | [0.29.0](https://github.com/openshift/prometheus-alertmanager/blob/release-4.21) | [0.19.1](https://github.com/openshift/kube-rbac-proxy/blob/release-4.21) | [2.17.0](https://github.com/openshift/kube-state-metrics/blob/release-4.21) | [0.8.0](https://github.com/openshift/kubernetes-metrics-server/blob/release-4.21) | [1.0.0](https://github.com/openshift/monitoring-plugin/blob/release-4.21) | [1.10.2](https://github.com/openshift/node_exporter/blob/release-4.21) | [0.12.1](https://github.com/openshift/prom-label-proxy/blob/release-4.21) | [3.6.0](https://github.com/openshift/prometheus/blob/release-4.21)  | [0.86.2](https://github.com/openshift/prometheus-operator/blob/release-4.21) | [0.39.2](https://github.com/openshift/thanos/blob/release-4.21) |
 | release-4.20 | [0.28.1](https://github.com/openshift/prometheus-alertmanager/blob/release-4.20) | [0.19.1](https://github.com/openshift/kube-rbac-proxy/blob/release-4.20) | [2.16.0](https://github.com/openshift/kube-state-metrics/blob/release-4.20) | [0.8.0](https://github.com/openshift/kubernetes-metrics-server/blob/release-4.20) | [1.0.0](https://github.com/openshift/monitoring-plugin/blob/release-4.20) | [1.9.1](https://github.com/openshift/node_exporter/blob/release-4.20)  | [0.12.0](https://github.com/openshift/prom-label-proxy/blob/release-4.20) | [3.5.0](https://github.com/openshift/prometheus/blob/release-4.20)  | [0.85.0](https://github.com/openshift/prometheus-operator/blob/release-4.20) | [0.39.2](https://github.com/openshift/thanos/blob/release-4.20) |
 | release-4.19 | [0.28.1](https://github.com/openshift/prometheus-alertmanager/blob/release-4.19) | [0.19.0](https://github.com/openshift/kube-rbac-proxy/blob/release-4.19) | [2.15.0](https://github.com/openshift/kube-state-metrics/blob/release-4.19) | [0.7.2](https://github.com/openshift/kubernetes-metrics-server/blob/release-4.19) | [1.0.0](https://github.com/openshift/monitoring-plugin/blob/release-4.19) | [1.9.1](https://github.com/openshift/node_exporter/blob/release-4.19)  | [0.11.0](https://github.com/openshift/prom-label-proxy/blob/release-4.19) | [3.2.1](https://github.com/openshift/prometheus/blob/release-4.19)  | [0.81.0](https://github.com/openshift/prometheus-operator/blob/release-4.19) | [0.37.2](https://github.com/openshift/thanos/blob/release-4.19) |
 | release-4.18 | [0.27.0](https://github.com/openshift/prometheus-alertmanager/blob/release-4.18) | [0.18.1](https://github.com/openshift/kube-rbac-proxy/blob/release-4.18) | [2.13.0](https://github.com/openshift/kube-state-metrics/blob/release-4.18) | [0.7.2](https://github.com/openshift/kubernetes-metrics-server/blob/release-4.18) | [1.0.0](https://github.com/openshift/monitoring-plugin/blob/release-4.18) | [1.8.2](https://github.com/openshift/node_exporter/blob/release-4.18)  | [0.11.0](https://github.com/openshift/prom-label-proxy/blob/release-4.18) | [2.55.1](https://github.com/openshift/prometheus/blob/release-4.18) | [0.78.2](https://github.com/openshift/prometheus-operator/blob/release-4.18) | [0.36.1](https://github.com/openshift/thanos/blob/release-4.18) |
diff --git a/assets/admission-webhook/deployment.yaml b/assets/admission-webhook/deployment.yaml
@@ -5,7 +5,7 @@ metadata:
     app.kubernetes.io/managed-by: cluster-monitoring-operator
     app.kubernetes.io/name: prometheus-operator-admission-webhook
     app.kubernetes.io/part-of: openshift-monitoring
-    app.kubernetes.io/version: 0.86.1
+    app.kubernetes.io/version: 0.86.2
   name: prometheus-operator-admission-webhook
   namespace: openshift-monitoring
 spec:
@@ -27,7 +27,7 @@ spec:
         app.kubernetes.io/managed-by: cluster-monitoring-operator
         app.kubernetes.io/name: prometheus-operator-admission-webhook
         app.kubernetes.io/part-of: openshift-monitoring
-        app.kubernetes.io/version: 0.86.1
+        app.kubernetes.io/version: 0.86.2
     spec:
       affinity:
         podAntiAffinity:
diff --git a/assets/admission-webhook/pod-disruption-budget.yaml b/assets/admission-webhook/pod-disruption-budget.yaml
@@ -5,7 +5,7 @@ metadata:
     app.kubernetes.io/managed-by: cluster-monitoring-operator
     app.kubernetes.io/name: prometheus-operator-admission-webhook
     app.kubernetes.io/part-of: openshift-monitoring
-    app.kubernetes.io/version: 0.86.1
+    app.kubernetes.io/version: 0.86.2
   name: prometheus-operator-admission-webhook
   namespace: openshift-monitoring
 spec:
diff --git a/assets/admission-webhook/service-account.yaml b/assets/admission-webhook/service-account.yaml
@@ -6,6 +6,6 @@ metadata:
     app.kubernetes.io/managed-by: cluster-monitoring-operator
     app.kubernetes.io/name: prometheus-operator-admission-webhook
     app.kubernetes.io/part-of: openshift-monitoring
-    app.kubernetes.io/version: 0.86.1
+    app.kubernetes.io/version: 0.86.2
   name: prometheus-operator-admission-webhook
   namespace: openshift-monitoring
diff --git a/assets/admission-webhook/service.yaml b/assets/admission-webhook/service.yaml
@@ -8,7 +8,7 @@ metadata:
     app.kubernetes.io/managed-by: cluster-monitoring-operator
     app.kubernetes.io/name: prometheus-operator-admission-webhook
     app.kubernetes.io/part-of: openshift-monitoring
-    app.kubernetes.io/version: 0.86.1
+    app.kubernetes.io/version: 0.86.2
   name: prometheus-operator-admission-webhook
   namespace: openshift-monitoring
 spec:
diff --git a/assets/monitoring-plugin/deployment.yaml b/assets/monitoring-plugin/deployment.yaml
@@ -43,7 +43,7 @@ spec:
             namespaces:
             - openshift-monitoring
             topologyKey: kubernetes.io/hostname
-      automountServiceAccountToken: false
+      automountServiceAccountToken: true
       containers:
       - args:
         - --config-path=/opt/app-root/web/dist
@@ -87,6 +87,7 @@ spec:
         runAsNonRoot: true
         seccompProfile:
           type: RuntimeDefault
+      serviceAccountName: monitoring-plugin
       volumes:
       - name: monitoring-plugin-cert
         secret:
diff --git a/assets/prometheus-operator-user-workload/cluster-role-binding.yaml b/assets/prometheus-operator-user-workload/cluster-role-binding.yaml
@@ -6,7 +6,7 @@ metadata:
     app.kubernetes.io/managed-by: cluster-monitoring-operator
     app.kubernetes.io/name: prometheus-operator
     app.kubernetes.io/part-of: openshift-monitoring
-    app.kubernetes.io/version: 0.86.1
+    app.kubernetes.io/version: 0.86.2
   name: prometheus-user-workload-operator
 roleRef:
   apiGroup: rbac.authorization.k8s.io
diff --git a/assets/prometheus-operator-user-workload/cluster-role.yaml b/assets/prometheus-operator-user-workload/cluster-role.yaml
@@ -6,7 +6,7 @@ metadata:
     app.kubernetes.io/managed-by: cluster-monitoring-operator
     app.kubernetes.io/name: prometheus-operator
     app.kubernetes.io/part-of: openshift-monitoring
-    app.kubernetes.io/version: 0.86.1
+    app.kubernetes.io/version: 0.86.2
   name: prometheus-user-workload-operator
 rules:
 - apiGroups:
diff --git a/assets/prometheus-operator-user-workload/deployment.yaml b/assets/prometheus-operator-user-workload/deployment.yaml
@@ -6,7 +6,7 @@ metadata:
     app.kubernetes.io/managed-by: cluster-monitoring-operator
     app.kubernetes.io/name: prometheus-operator
     app.kubernetes.io/part-of: openshift-monitoring
-    app.kubernetes.io/version: 0.86.1
+    app.kubernetes.io/version: 0.86.2
   name: prometheus-operator
   namespace: openshift-user-workload-monitoring
 spec:
@@ -27,12 +27,12 @@ spec:
         app.kubernetes.io/managed-by: cluster-monitoring-operator
         app.kubernetes.io/name: prometheus-operator
         app.kubernetes.io/part-of: openshift-monitoring
-        app.kubernetes.io/version: 0.86.1
+        app.kubernetes.io/version: 0.86.2
     spec:
       automountServiceAccountToken: true
       containers:
       - args:
-        - --prometheus-config-reloader=quay.io/prometheus-operator/prometheus-config-reloader:v0.86.1
+        - --prometheus-config-reloader=quay.io/prometheus-operator/prometheus-config-reloader:v0.86.2
         - --kubelet-endpoints=true
         - --kubelet-endpointslice=true
         - --prometheus-instance-namespaces=openshift-user-workload-monitoring
diff --git a/assets/prometheus-operator-user-workload/service-account.yaml b/assets/prometheus-operator-user-workload/service-account.yaml
@@ -7,6 +7,6 @@ metadata:
     app.kubernetes.io/managed-by: cluster-monitoring-operator
     app.kubernetes.io/name: prometheus-operator
     app.kubernetes.io/part-of: openshift-monitoring
-    app.kubernetes.io/version: 0.86.1
+    app.kubernetes.io/version: 0.86.2
   name: prometheus-operator
   namespace: openshift-user-workload-monitoring
diff --git a/assets/prometheus-operator-user-workload/service-monitor.yaml b/assets/prometheus-operator-user-workload/service-monitor.yaml
@@ -6,7 +6,7 @@ metadata:
     app.kubernetes.io/managed-by: cluster-monitoring-operator
     app.kubernetes.io/name: prometheus-operator
     app.kubernetes.io/part-of: openshift-monitoring
-    app.kubernetes.io/version: 0.86.1
+    app.kubernetes.io/version: 0.86.2
   name: prometheus-operator
   namespace: openshift-user-workload-monitoring
 spec:
@@ -24,4 +24,4 @@ spec:
       app.kubernetes.io/component: controller
       app.kubernetes.io/name: prometheus-operator
       app.kubernetes.io/part-of: openshift-monitoring
-      app.kubernetes.io/version: 0.86.1
+      app.kubernetes.io/version: 0.86.2
diff --git a/assets/prometheus-operator-user-workload/service.yaml b/assets/prometheus-operator-user-workload/service.yaml
@@ -9,7 +9,7 @@ metadata:
     app.kubernetes.io/managed-by: cluster-monitoring-operator
     app.kubernetes.io/name: prometheus-operator
     app.kubernetes.io/part-of: openshift-monitoring
-    app.kubernetes.io/version: 0.86.1
+    app.kubernetes.io/version: 0.86.2
   name: prometheus-operator
   namespace: openshift-user-workload-monitoring
 spec:
diff --git a/assets/prometheus-operator/cluster-role-binding.yaml b/assets/prometheus-operator/cluster-role-binding.yaml
@@ -6,7 +6,7 @@ metadata:
     app.kubernetes.io/managed-by: cluster-monitoring-operator
     app.kubernetes.io/name: prometheus-operator
     app.kubernetes.io/part-of: openshift-monitoring
-    app.kubernetes.io/version: 0.86.1
+    app.kubernetes.io/version: 0.86.2
   name: prometheus-operator
 roleRef:
   apiGroup: rbac.authorization.k8s.io
diff --git a/assets/prometheus-operator/cluster-role.yaml b/assets/prometheus-operator/cluster-role.yaml
@@ -6,7 +6,7 @@ metadata:
     app.kubernetes.io/managed-by: cluster-monitoring-operator
     app.kubernetes.io/name: prometheus-operator
     app.kubernetes.io/part-of: openshift-monitoring
-    app.kubernetes.io/version: 0.86.1
+    app.kubernetes.io/version: 0.86.2
   name: prometheus-operator
 rules:
 - apiGroups:
diff --git a/assets/prometheus-operator/deployment.yaml b/assets/prometheus-operator/deployment.yaml
@@ -6,7 +6,7 @@ metadata:
     app.kubernetes.io/managed-by: cluster-monitoring-operator
     app.kubernetes.io/name: prometheus-operator
     app.kubernetes.io/part-of: openshift-monitoring
-    app.kubernetes.io/version: 0.86.1
+    app.kubernetes.io/version: 0.86.2
   name: prometheus-operator
   namespace: openshift-monitoring
 spec:
@@ -27,13 +27,13 @@ spec:
         app.kubernetes.io/managed-by: cluster-monitoring-operator
         app.kubernetes.io/name: prometheus-operator
         app.kubernetes.io/part-of: openshift-monitoring
-        app.kubernetes.io/version: 0.86.1
+        app.kubernetes.io/version: 0.86.2
     spec:
       automountServiceAccountToken: true
       containers:
       - args:
         - --kubelet-service=kube-system/kubelet
-        - --prometheus-config-reloader=quay.io/prometheus-operator/prometheus-config-reloader:v0.86.1
+        - --prometheus-config-reloader=quay.io/prometheus-operator/prometheus-config-reloader:v0.86.2
         - --kubelet-endpoints=true
         - --kubelet-endpointslice=true
         - --watch-referenced-objects-in-all-namespaces=true
diff --git a/assets/prometheus-operator/prometheus-rule.yaml b/assets/prometheus-operator/prometheus-rule.yaml
@@ -6,7 +6,7 @@ metadata:
     app.kubernetes.io/managed-by: cluster-monitoring-operator
     app.kubernetes.io/name: prometheus-operator
     app.kubernetes.io/part-of: openshift-monitoring
-    app.kubernetes.io/version: 0.86.1
+    app.kubernetes.io/version: 0.86.2
     prometheus: k8s
     role: alert-rules
   name: prometheus-operator-rules
diff --git a/assets/prometheus-operator/service-account.yaml b/assets/prometheus-operator/service-account.yaml
@@ -7,6 +7,6 @@ metadata:
     app.kubernetes.io/managed-by: cluster-monitoring-operator
     app.kubernetes.io/name: prometheus-operator
     app.kubernetes.io/part-of: openshift-monitoring
-    app.kubernetes.io/version: 0.86.1
+    app.kubernetes.io/version: 0.86.2
   name: prometheus-operator
   namespace: openshift-monitoring
diff --git a/assets/prometheus-operator/service-monitor.yaml b/assets/prometheus-operator/service-monitor.yaml
@@ -6,7 +6,7 @@ metadata:
     app.kubernetes.io/managed-by: cluster-monitoring-operator
     app.kubernetes.io/name: prometheus-operator
     app.kubernetes.io/part-of: openshift-monitoring
-    app.kubernetes.io/version: 0.86.1
+    app.kubernetes.io/version: 0.86.2
   name: prometheus-operator
   namespace: openshift-monitoring
 spec:
@@ -24,4 +24,4 @@ spec:
       app.kubernetes.io/component: controller
       app.kubernetes.io/name: prometheus-operator
       app.kubernetes.io/part-of: openshift-monitoring
-      app.kubernetes.io/version: 0.86.1
+      app.kubernetes.io/version: 0.86.2
diff --git a/assets/prometheus-operator/service.yaml b/assets/prometheus-operator/service.yaml
@@ -9,7 +9,7 @@ metadata:
     app.kubernetes.io/managed-by: cluster-monitoring-operator
     app.kubernetes.io/name: prometheus-operator
     app.kubernetes.io/part-of: openshift-monitoring
-    app.kubernetes.io/version: 0.86.1
+    app.kubernetes.io/version: 0.86.2
   name: prometheus-operator
   namespace: openshift-monitoring
 spec:
diff --git a/jsonnet/components/monitoring-plugin.libsonnet b/jsonnet/components/monitoring-plugin.libsonnet
@@ -168,7 +168,7 @@ function(params)
 
               },  // podAntiAffinity
             },  // affinity
-            automountServiceAccountToken: false,
+            automountServiceAccountToken: true,
             containers: [
               {  // monitoring-plugin container
                 name: $._config.name,
@@ -213,6 +213,7 @@ function(params)
             nodeSelector: { 'kubernetes.io/os': 'linux' },
             priorityClassName: 'system-cluster-critical',
             restartPolicy: 'Always',
+            serviceAccountName: 'monitoring-plugin',
             securityContext: {
               runAsNonRoot: true,
               seccompProfile: { type: 'RuntimeDefault' },
diff --git a/jsonnet/versions.yaml b/jsonnet/versions.yaml
@@ -22,5 +22,5 @@ versions:
     nodeExporter: 1.10.2
     promLabelProxy: 0.12.1
     prometheus: 3.6.0
-    prometheusOperator: 0.86.1
+    prometheusOperator: 0.86.2
     thanos: 0.39.2
