kube-rbac-proxy example for Prometheus exporter

nginx-exporter-rbac-example.yaml

kind: Namespace
apiVersion: v1
metadata:
  name: example-app
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: kube-rbac-proxy
  namespace: example-app
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: kube-rbac-proxy
  namespace: example-app
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: kube-rbac-proxy
subjects:
- kind: ServiceAccount
  name: kube-rbac-proxy
  namespace: example-app
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: kube-rbac-proxy
  namespace: example-app
rules:
- apiGroups: ["authentication.k8s.io"]
  resources:
  - tokenreviews
  verbs: ["create"]
- apiGroups: ["authorization.k8s.io"]
  resources:
  - subjectaccessreviews
  verbs: ["create"]
---
apiVersion: v1
kind: Service
metadata:
  labels:
    app: kube-rbac-proxy
  name: kube-rbac-proxy
  namespace: example-app
spec:
  ports:
  - name: https
    port: 8443
    targetPort: https
  selector:
    app: kube-rbac-proxy
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: kube-rbac-proxy
  namespace: example-app
spec:
  replicas: 1
  selector:
    matchLabels:
      app: kube-rbac-proxy
  template:
    metadata:
      labels:
        app: kube-rbac-proxy
    spec:
      serviceAccountName: kube-rbac-proxy
      containers:
      - name: kube-rbac-proxy
        image: quay.io/brancz/kube-rbac-proxy:v0.13.1
        args:
        - "--secure-listen-address=0.0.0.0:8443"
        - "--upstream=http://127.0.0.1:9113/"
        - "--logtostderr=true"
        - "--v=10"
        ports:
        - containerPort: 8443
          hostIP: 127.0.0.1
          name: https
        securityContext:
          allowPrivilegeEscalation: false
      - name: nginx
        image: nginx:1.17.3
        volumeMounts:
          - name: nginx-config
            mountPath: /etc/nginx/conf.d/default.conf
            subPath: nginx.conf
        ports:
          - containerPort: 80
      - name: nginx-exporter
        image: quay.io/sysdig/nginx-exporter:latest
        args:
          - "-nginx.scrape-uri=http://localhost:80/nginx_status"
          - "-web.listen-address=127.0.0.1:9113"
        resources:
          limits:
            memory: "128Mi"
            cpu: "500m"
      volumes:
         - configMap:
             defaultMode: 420
             name: nginx-config
           name: nginx-config
---
apiVersion: v1
kind: ConfigMap
metadata:
  name: nginx-config
  namespace: example-app
data:
  nginx.conf: |
    server {
      listen       80;
      server_name  localhost;
      location /nginx_status {
        stub_status on;
        access_log  on;
        allow all;  # REPLACE with your access policy
      }
    }
---