Deploy Prometheus + Grafana on Kubernetes: Namespace Isolated Stack
Tags:
PrometheusGrafanaKubernetesRBACkubekanvas
Created by:
Siddiqui
101 uses
Managing cluster-wide monitoring requires extensive administrative permissions that introduce security risks in multi-tenant environments. Engineers deploy Prometheus on Kubernetes within a single namespace to isolate metric collection and lock down RBAC access rules. This namespace isolated Prometheus stack establishes a secure, localized monitoring loop using a lightweight Prometheus Kubernetes template.
| Component | Type | Port | Role |
|---|---|---|---|
| Prometheus Server | Deployment & Service | 9090 | Pulls, stores, and exposes PromQL metrics |
| Grafana | Deployment & Service | 3000 | Provides visual dashboards and identity management |
| Alertmanager | Deployment & Service | 9093 | Deduplicates and routes triggered alert definitions |
| Node Exporter | DaemonSet & Service | 9100 | Collects underlying host hardware operating metrics |
| Kube-State-Metrics | Deployment & Service | 8080 | Generates localized metrics about object states |
| Grafana Ingress | Ingress | 80 | Routes external HTTP requests to the Grafana service |
| Prometheus Local Role | Role & RoleBinding | None | Restricts service account operations to the local namespace |
The architecture confines all data flow within a single namespace. The Prometheus data retrieval worker pulls metrics from Node Exporter, Kube-State-Metrics, and local pods. Scraped data populates an internal time series database. An NGINX Ingress routes external client traffic strictly to the Grafana pod. Grafana queries the local Prometheus server internally via Kubernetes DNS services. Localized Role and RoleBinding objects enforce strict namespace isolation boundaries.
This template configures a localized monitoring stack consisting of Prometheus, Grafana, Alertmanager, and resource exporters bound within a namespace sandbox. The deployment enforces strict security parameters by utilizing namespaced RBAC configurations and restricted ingress rules.