Paweł Krupa

@raptorsun kube-rbac-proxy realizes 2 functions: TLS termination and access restriction. As such moving TLS termination to node_exporter won't allow us to remove kube-rbac-proxy sidecar. Additionally enabling TLS termination in node_exporter...

The issue is about removing kube-rbac-proxy, using node_exporter buillt-in mechanisms for TLS termination **and** auth. It needs a bit of exploratory work to determine if this is even possible.

`thanos-sidecar.libsonnet` is an example on `release-0.8` branch and there is no such example for `release-0.7`. Those branches are incompatible with each other and we have migration guide in https://github.com/prometheus-operator/kube-prometheus/blob/main/docs/migration-guide.md. >...

There is no metric called `node_namespace_pod_container`. If you mean `namespace_pod_container:container_cpu_usage_seconds_total:sum_rate` then it was changed to `namespace_pod_container:container_cpu_usage_seconds_total:sum_irate` in https://github.com/kubernetes-monitoring/kubernetes-mixin. Although it might have been a mistake as per https://github.com/kubernetes-monitoring/kubernetes-mixin/issues/679. Feel free...

Can you share more about sig scalability requirements about this? I cannot find anything much info related to use of affinity vs topologySpreadConstraints. The only thing I found is [KEP...

> Are we concerned about the Kubernetes Scheduler performance? I would say yes. If we can improve our users' environments by using a better performing feature, we should use it....

This is possible to implement but not trivial. As far as I can see there are two ways: 1. Automate recreation of grafana pod on config change 2. Use [grafana...

Few things: - everything grafana-related should be in https://github.com/prometheus-operator/kube-prometheus/blob/main/jsonnet/kube-prometheus/components/grafana.libsonnet - grafana configuration is optional (as seen in https://github.com/prometheus-operator/kube-prometheus/blob/main/jsonnet/kube-prometheus/components/grafana.libsonnet#L69), so reloader sidecar should be too. I would suggest experimenting with config...

Sorry for long silence. I agree with @simonpasquier that we should unify this behavior between Alertmanager and Prometheus by defaulting to use `spec.version`. We only need to remember that there...

Currently what you wrote is what is expected. Potentially after https://github.com/brancz/kubernetes-grafana/pull/117 is merged, we can make this simpler and allow modifying only one parameter.