a714912cb6
- Add query_cluster_resources() for real CPU/RAM from Prometheus - Wire into build_response() replacing hardcoded zeros - Fix NetworkPolicy: add ports 8080/9100/9400 for KSM/node-exporter/dcgm - Add CiliumNetworkPolicy for hostNetwork pod scraping - Add SubscribeClusterPods stub to unblock proto addition from Task 5 Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
24 lines
697 B
YAML
24 lines
697 B
YAML
# CiliumNetworkPolicy: allow Prometheus to reach hostNetwork pods (node-exporter).
|
|
#
|
|
# Vanilla K8s NetworkPolicy ipBlock rules don't match traffic to hostNetwork
|
|
# pods because Cilium assigns them the 'host'/'remote-node' identity, not 'world'.
|
|
# This CiliumNetworkPolicy uses toEntities to cover that gap.
|
|
apiVersion: cilium.io/v2
|
|
kind: CiliumNetworkPolicy
|
|
metadata:
|
|
name: prometheus-host-access
|
|
namespace: foxhunt
|
|
spec:
|
|
endpointSelector:
|
|
matchLabels:
|
|
app.kubernetes.io/name: prometheus
|
|
app.kubernetes.io/part-of: foxhunt
|
|
egress:
|
|
- toEntities:
|
|
- host
|
|
- remote-node
|
|
toPorts:
|
|
- ports:
|
|
- port: "9100"
|
|
protocol: TCP
|