Check whether Roles and RoleBindings can be used for Prometheus

added modul/theodolite label

See:

• https://github.com/prometheus-operator/prometheus-operator/issues/3544
• https://github.com/prometheus-operator/prometheus-operator/pull/4455

Above comment relates to Prometheus Operator. We have to distinguish between the ClusterRole(Binding)s for Prometheus and for Prometheus Operator.

For Prometheus, we currently need a ClusterRole because of the following rules:

• - nonResourceURLs: ["/metrics"]
    verbs: ["get"]

• - apiGroups: [""]
    resources:
    - nodes
    verbs: ["get", "list", "watch"]

We need to find out whether these rules really are required for Prometheus to work with Theodolite. For example, I expect nodes to be only required if node-level metrics are gathered, which we currently don't do with Theodolite.

Furthermore, we should explore whether we need all these rules at all since we use Prometheus Operator. Probably, we do in order to let Prometheus annotate metrics with fields such as the pod's IP.

https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/rbac.md#prometheus-rbac

mentioned in issue #370 (closed)

mentioned in merge request !268 (merged)

mentioned in commit 08bde667

closed with merge request !268 (merged)