serviceMonitorKubeScheduler: enable TLS

assets/prometheus-k8s/service-monitor-kube-scheduler.yaml

@@ -7,15 +7,13 @@ metadata:
   namespace: openshift-monitoring
 spec:
   endpoints:
-  - interval: 30s
+  - bearerTokenFile: /var/run/secrets/kubernetes.io/serviceaccount/token
+    interval: 30s
     port: https
-    relabelings:
-    - action: replace
-      regex: (.+)(?::\d+)
-      replacement: $1:10251
-      sourceLabels:
-      - __address__
-      targetLabel: __address__
+    scheme: https
+    tlsConfig:
+      caFile: /etc/prometheus/configmaps/serving-certs-ca-bundle/service-ca.crt
+      serverName: scheduler.openshift-kube-scheduler.svc
   jobLabel: null
   namespaceSelector:
     matchNames:

jsonnet/prometheus.jsonnet

@@ -316,27 +316,14 @@ local namespacesRole =
           endpoints:
             std.map(
               function(a) a {
-
-                //TODO(brancz): Once OpenShift is based on Kubernetes 1.12 the
-                //scheduler will serve metrics on a secure port, then the below
-                //commented out code is what we will need without the relabel
-                //configs.
-
-                //bearerTokenFile: '/var/run/secrets/kubernetes.io/serviceaccount/token',
+                bearerTokenFile: '/var/run/secrets/kubernetes.io/serviceaccount/token',
                 interval: '30s',
                 port: 'https',
-                //scheme: 'https',
-                //tlsConfig: {
-                //  caFile: '/etc/prometheus/configmaps/serving-certs-ca-bundle/service-ca.crt',
-                //  serverName: 'scheduler.openshift-kube-scheduler.svc',
-                //},
-                relabelings: [{
-                  sourceLabels: ['__address__'],
-                  action: 'replace',
-                  targetLabel: '__address__',
-                  regex: '(.+)(?::\\d+)',
-                  replacement: '$1:10251',
-                }],
+                scheme: 'https',
+                tlsConfig: {
+                  caFile: '/etc/prometheus/configmaps/serving-certs-ca-bundle/service-ca.crt',
+                  serverName: 'scheduler.openshift-kube-scheduler.svc',
+                },
               },
               super.endpoints,
             ),