categraf/k8s/scrape_with_cafile.yaml

global:
  scrape_interval: 15s
  external_labels:
    cluster: test
    replica: 0

scrape_configs:
  #- job_name: "categraf-out"
  #  static_configs:
  #    - targets: ["172.16.6.171:8080"]

  - job_name: "apiserver"
    metrics_path: "/metrics"
    kubernetes_sd_configs:
      - role: endpoints
        # apiserver lvs address or service ip:port eg, https://172.31.0.1:443
        api_server: "https://${KUBERNETES_SERVICE_HOST}:${KUBERNETES_SERVICE_PORT_HTTPS}"
        tls_config:
          #eg. /etc/kubernetes/pki/ca.crt
          ca_file: /path/to/apiserver/ca.crt
          #eg /etc/kubernetes/pki/apiserver-kubelet-client.crt
          cert_file: /path/to/apiserver/client.crt
          # /etc/kubernetes/pki/apiserver-kubelet-client.key
          key_file: /path/to/apiserver/client.key
          insecure_skip_verify: true
    scheme: https
    tls_config:
      #eg. /etc/kubernetes/pki/ca.crt
      ca_file: /path/to/apiserver/ca.crt
      #eg /etc/kubernetes/pki/apiserver-kubelet-client.crt
      cert_file: /path/to/apiserver/client.crt
      # /etc/kubernetes/pki/apiserver-kubelet-client.key
      key_file: /path/to/apiserver/client.key
      insecure_skip_verify: true
    relabel_configs:
      - source_labels:
          [
            __meta_kubernetes_namespace,
            __meta_kubernetes_service_name,
            __meta_kubernetes_endpoint_port_name,
          ]
        action: keep
        regex: default;kubernetes;https

  - job_name: "conroller-manager"
    metrics_path: "/metrics"
    kubernetes_sd_configs:
      - role: endpoints
        # apiserver lvs address or service ip:port eg, https://172.31.0.1:443
        api_server: "https://${KUBERNETES_SERVICE_HOST}:${KUBERNETES_SERVICE_PORT_HTTPS}"
        tls_config:
          #eg. /etc/kubernetes/pki/ca.crt
          ca_file: /path/to/apiserver/ca.crt
          #eg /etc/kubernetes/pki/apiserver-kubelet-client.crt
          cert_file: /path/to/apiserver/client.crt
          # /etc/kubernetes/pki/apiserver-kubelet-client.key
          key_file: /path/to/apiserver/client.key
          insecure_skip_verify: true
    scheme: https
    tls_config:
      #eg. /etc/kubernetes/pki/ca.crt
      ca_file: /path/to/apiserver/ca.crt
      #eg /etc/kubernetes/pki/apiserver-kubelet-client.crt
      cert_file: /path/to/apiserver/client.crt
      # /etc/kubernetes/pki/apiserver-kubelet-client.key
      key_file: /path/to/apiserver/client.key
      insecure_skip_verify: true
    relabel_configs:
      - source_labels:
          [
            __meta_kubernetes_namespace,
            __meta_kubernetes_service_name,
            __meta_kubernetes_endpoint_port_name,
          ]
        action: keep
        regex: kube-system;kube-controller-manager;https

  - job_name: "scheduler"
    metrics_path: "/metrics"
    kubernetes_sd_configs:
      - role: endpoints
        # apiserver lvs address or service ip:port eg, https://172.31.0.1:443
        api_server: "https://${KUBERNETES_SERVICE_HOST}:${KUBERNETES_SERVICE_PORT_HTTPS}"
        tls_config:
          #eg. /etc/kubernetes/pki/ca.crt
          ca_file: /path/to/apiserver/ca.crt
          #eg /etc/kubernetes/pki/apiserver-kubelet-client.crt
          cert_file: /path/to/apiserver/client.crt
          # /etc/kubernetes/pki/apiserver-kubelet-client.key
          key_file: /path/to/apiserver/client.key
          insecure_skip_verify: true
    scheme: https
    tls_config:
      #eg. /etc/kubernetes/pki/ca.crt
      ca_file: /path/to/apiserver/ca.crt
      #eg /etc/kubernetes/pki/apiserver-kubelet-client.crt
      cert_file: /path/to/apiserver/client.crt
      # /etc/kubernetes/pki/apiserver-kubelet-client.key
      key_file: /path/to/apiserver/client.key
      insecure_skip_verify: true
    relabel_configs:
      - source_labels:
          [
            __meta_kubernetes_namespace,
            __meta_kubernetes_service_name,
            __meta_kubernetes_endpoint_port_name,
          ]
        action: keep
        regex: kube-system;kube-scheduler;https

  - job_name: "etcd"
    metrics_path: "/metrics"
    kubernetes_sd_configs:
      - role: endpoints
        api_server: "https://${KUBERNETES_SERVICE_HOST}:${KUBERNETES_SERVICE_PORT_HTTPS}"
        tls_config:
          #eg. /etc/kubernetes/pki/ca.crt
          ca_file: /path/to/apiserver/ca.crt
          #eg /etc/kubernetes/pki/apiserver-kubelet-client.crt
          cert_file: /path/to/apiserver/client.crt
          # /etc/kubernetes/pki/apiserver-kubelet-client.key
          key_file: /path/to/apiserver/client.key
          insecure_skip_verify: true
    scheme: https
    tls_config:
      #eg. /etc/kubernetes/pki/etcd/ca.crt
      ca_file: /path/to/etcd/ca.crt
      #eg. /etc/kubernetes/pki/apiserver-etcd-client.crt
      cert_file: /path/to/etcd/client.crt
      #eg. /etc/kubernetes/pki/apiserver-etcd-client.key
      key_file: /path/to/etcd/client.key
      insecure_skip_verify: true
    relabel_configs:
      - source_labels:
          [
            __meta_kubernetes_namespace,
            __meta_kubernetes_service_name,
            __meta_kubernetes_endpoint_port_name,
          ]
        action: keep
        regex: kube-system;etcd;https

  - job_name: "coredns"
    metrics_path: "/metrics"
    kubernetes_sd_configs:
      - role: endpoints
        # apiserver lvs address or service ip:port eg, https://172.31.0.1:443
        api_server: "https://${KUBERNETES_SERVICE_HOST}:${KUBERNETES_SERVICE_PORT_HTTPS}"
        tls_config:
          #eg. /etc/kubernetes/pki/ca.crt
          ca_file: /path/to/apiserver/ca.crt
          #eg /etc/kubernetes/pki/apiserver-kubelet-client.crt
          cert_file: /path/to/apiserver/client.crt
          # /etc/kubernetes/pki/apiserver-kubelet-client.key
          key_file: /path/to/apiserver/client.key
          insecure_skip_verify: true
    scheme: http
    relabel_configs:
      - source_labels:
          [
            __meta_kubernetes_namespace,
            __meta_kubernetes_service_name,
            __meta_kubernetes_endpoint_port_name,
          ]
        action: keep
        regex: kube-system;kube-dns;metrics

remote_write:
  - url: 'http://${NSERVER_ADDR}/prometheus/v1/write'