unkinben
55e41897ef
## Why The Consul SD job discovered **0 targets**. vmagent logs showed it reaching the puppet Consul fine (TLS/connectivity OK) but getting `403` on `GET /v1/agent/self`: the anonymous token `lacks permission 'agent:read'`. VictoriaMetrics calls `/v1/agent/self` only to auto-detect the datacenter; catalog/health reads (what SD actually needs) work anonymously. ## Fix Set `datacenter: au-syd1` on the consul_sd_config so VM skips the `agent/self` call. No consul token needed. ## Verify after sync vmagent `/targets` → `consul` job shows the puppet targets (haproxy/ceph/gitea/node/…) up. Reviewed-on: #240 Co-authored-by: Ben Vincent <ben@unkin.net> Co-committed-by: Ben Vincent <ben@unkin.net>
127 lines
4.2 KiB
YAML
127 lines
4.2 KiB
YAML
---
|
|
apiVersion: operator.victoriametrics.com/v1beta1
|
|
kind: VMAgent
|
|
metadata:
|
|
name: main
|
|
namespace: observability
|
|
spec:
|
|
replicaCount: 2
|
|
scrapeInterval: 15s
|
|
# Also consume VMServiceScrape / VMPodScrape / VMNodeScrape from every namespace
|
|
# (the operator auto-converts Prometheus ServiceMonitors -> VMServiceScrape).
|
|
selectAllByDefault: true
|
|
extraArgs:
|
|
loggerFormat: json
|
|
remoteWrite:
|
|
- url: http://vminsert-main.observability.svc.cluster.local:8480/insert/0/prometheus/
|
|
resources:
|
|
requests:
|
|
cpu: 500m
|
|
memory: 512Mi
|
|
limits:
|
|
cpu: "1"
|
|
memory: 2Gi
|
|
# Reflected Vault intermediate CA (unkin.net) for verifying puppet Consul + metrics targets.
|
|
volumes:
|
|
- name: vault-ca
|
|
secret:
|
|
secretName: vault-ca-cert
|
|
volumeMounts:
|
|
- name: vault-ca
|
|
mountPath: /etc/vmagent-tls
|
|
readOnly: true
|
|
inlineScrapeConfig: |
|
|
- job_name: vmagent
|
|
static_configs:
|
|
- targets: ["localhost:8429"]
|
|
- job_name: "kubernetes-apiservers"
|
|
kubernetes_sd_configs:
|
|
- role: endpoints
|
|
scheme: https
|
|
tls_config:
|
|
ca_file: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
|
|
insecure_skip_verify: true
|
|
bearer_token_file: /var/run/secrets/kubernetes.io/serviceaccount/token
|
|
relabel_configs:
|
|
- source_labels:
|
|
- __meta_kubernetes_namespace
|
|
- __meta_kubernetes_service_name
|
|
- __meta_kubernetes_endpoint_port_name
|
|
action: keep
|
|
regex: default;kubernetes;https
|
|
- job_name: "kubernetes-nodes"
|
|
scheme: https
|
|
tls_config:
|
|
ca_file: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
|
|
insecure_skip_verify: true
|
|
bearer_token_file: /var/run/secrets/kubernetes.io/serviceaccount/token
|
|
kubernetes_sd_configs:
|
|
- role: node
|
|
relabel_configs:
|
|
- action: labelmap
|
|
regex: __meta_kubernetes_node_label_(.+)
|
|
- job_name: "kubernetes-nodes-cadvisor"
|
|
scheme: https
|
|
tls_config:
|
|
ca_file: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
|
|
insecure_skip_verify: true
|
|
bearer_token_file: /var/run/secrets/kubernetes.io/serviceaccount/token
|
|
kubernetes_sd_configs:
|
|
- role: node
|
|
metrics_path: /metrics/cadvisor
|
|
relabel_configs:
|
|
- action: labelmap
|
|
regex: __meta_kubernetes_node_label_(.+)
|
|
- source_labels: [__metrics_path__]
|
|
target_label: metrics_path
|
|
metric_relabel_configs:
|
|
- action: replace
|
|
source_labels: [pod]
|
|
regex: '(.+)'
|
|
target_label: pod_name
|
|
replacement: '${1}'
|
|
- action: replace
|
|
source_labels: [container]
|
|
regex: '(.+)'
|
|
target_label: container_name
|
|
replacement: '${1}'
|
|
- action: replace
|
|
target_label: name
|
|
replacement: k8s_stub
|
|
- action: replace
|
|
source_labels: [id]
|
|
regex: '^/system\.slice/(.+)\.service$'
|
|
target_label: systemd_service_name
|
|
replacement: '${1}'
|
|
# puppet-prod Consul service discovery (same targets as the puppet vmagent).
|
|
# consul.service.consul resolves to the puppet Consul from in-cluster pods.
|
|
- job_name: consul
|
|
consul_sd_configs:
|
|
- server: consul.service.consul:443
|
|
scheme: https
|
|
# Set datacenter explicitly so VM does not call /v1/agent/self
|
|
# (which needs agent:read that the anonymous token lacks); catalog
|
|
# and health reads work anonymously.
|
|
datacenter: au-syd1
|
|
tls_config:
|
|
ca_file: /etc/vmagent-tls/ca.crt
|
|
relabel_configs:
|
|
- source_labels: [__meta_consul_tagpresent_metrics]
|
|
regex: "true"
|
|
action: keep
|
|
- source_labels: [__meta_consul_node, __meta_consul_service_port]
|
|
separator: ":"
|
|
target_label: __address__
|
|
replacement: "${1}:${2}"
|
|
action: replace
|
|
- source_labels: [__meta_consul_tag_metrics_scheme]
|
|
target_label: __scheme__
|
|
action: replace
|
|
- target_label: __metrics_path__
|
|
replacement: /metrics
|
|
- source_labels: [__meta_consul_tag_metrics_job]
|
|
target_label: job
|
|
action: replace
|
|
tls_config:
|
|
ca_file: /etc/vmagent-tls/ca.crt
|