Add Grafana container user. Cleanup.

base_operator_stack.jsonnet

@@ -92,6 +92,11 @@ local vars = import 'vars.jsonnet';
       spec+: {
         template+: {
           spec+: {
+            securityContext: {
+              runAsUser: 472,
+              fsGroup: 472,
+              runAsNonRoot: true,
+            },
             volumes:
               std.map(
                 function(v)

main.jsonnet

@@ -5,8 +5,6 @@ local kp = (import 'kube-prometheus/kube-prometheus.libsonnet')
            + (import 'kube-prometheus/kube-prometheus-anti-affinity.libsonnet')
            + (import 'kube-prometheus/kube-prometheus-kops-coredns.libsonnet')
            + (import 'kube-prometheus/kube-prometheus-kubeadm.libsonnet')
-           // Use http Kubelet targets. Comment to revert to https
-           //  + (import 'kube-prometheus/kube-prometheus-insecure-kubelet.libsonnet')
            // Additional modules are loaded dynamically from vars.jsonnet
            + utils.join_objects([module.file for module in vars.modules if module.enabled])
            // Load K3s customized modules
@@ -19,12 +17,13 @@ local kp = (import 'kube-prometheus/kube-prometheus.libsonnet')
 
 // Generate core modules
 { ['00namespace-' + name]: kp.kubePrometheus[name] for name in std.objectFields(kp.kubePrometheus) }
+// First generate operator resources except the serviceMonitors
 {
   ['0prometheus-operator-' + name]: kp.prometheusOperator[name]
   for name in std.filter((function(name) name != 'serviceMonitor'), std.objectFields(kp.prometheusOperator))
-} +
+}
 // serviceMonitor is separated so that it can be created after the CRDs are ready
-{ 'prometheus-operator-serviceMonitor': kp.prometheusOperator.serviceMonitor } +
+{ 'prometheus-operator-serviceMonitor': kp.prometheusOperator.serviceMonitor }
 { ['prometheus-adapter-' + name]: kp.prometheusAdapter[name] for name in std.objectFields(kp.prometheusAdapter) }
 { ['prometheus-' + name]: kp.prometheus[name] for name in std.objectFields(kp.prometheus) }
 { ['alertmanager-' + name]: kp.alertmanager[name] for name in std.objectFields(kp.alertmanager) }

utils.libsonnet

@@ -223,7 +223,6 @@ local k = import 'ksonnet/ksonnet.beta.4/k.libsonnet';
       },
     };
     std.mergePatch(s, t)
-    // s + t
   ),