[SECURITY] Disable KSM Metrics related to K8s Secret resources

Signed-off-by: gsmith-sas <[email protected]>

CHANGELOG.md

@@ -2,6 +2,8 @@
 
 ## Unreleased
 * **Metrics**
+  * [SECURITY] Metrics (collected by Kube State Metrics) related to Kubernetes Secret have been disabled 
+to eliminate the need to grant `list` permission (for Secret resources) to the KSM ClusterRole (see PR#XXX)
   * [CHANGE] The `create_logging_datasource.sh` script now uses the OpenSearch datasource plugin
 rather the Elasticsearch datasource plugin when creating the **ViyaLogs** datasource in Grafana.
 The plugin is downloaded and installed if it is not already in place.

monitoring/values-prom-operator.yaml

@@ -83,6 +83,42 @@ kube-state-metrics:
   extraArgs:
   - --metric-labels-allowlist=nodes=[*],namespaces=[*],pods=[*],deployments=[*],statefulsets=[*],daemonsets=[*],jobs=[*]
 
+  # Available collectors for kube-state-metrics.
+  # By default, all available resources are enabled, comment out to disable.
+  collectors:
+    - certificatesigningrequests
+    - configmaps
+    - cronjobs
+    - daemonsets
+    - deployments
+    - endpoints
+    - horizontalpodautoscalers
+    - ingresses
+    - jobs
+    - leases
+    - limitranges
+    - mutatingwebhookconfigurations
+    - namespaces
+    - networkpolicies
+    - nodes
+    - persistentvolumeclaims
+    - persistentvolumes
+    - poddisruptionbudgets
+    - pods
+    - replicasets
+    - replicationcontrollers
+    - resourcequotas
+    ## Metrics on Secrets disabled to
+    ## eliminate need for granting 
+    ## 'list' permission to ClusterRole
+    #- secrets
+    - services
+    - statefulsets
+    - storageclasses
+    - validatingwebhookconfigurations
+    - volumeattachments
+
+
 # ==========
 # Prometheus
 # ==========