Changed the service name and added even more permissions.

roles/openshift-apps/application-monitoring/files/prometheus-operator/example/rbac/prometheus/prometheus-cluster-role.yaml

@@ -3,6 +3,18 @@ kind: ClusterRole
 metadata:
   name: prometheus
 rules:
+- apiGroups:
+  - authentication.k8s.io
+  resources:
+  - tokenreviews
+  verbs:
+  - create
+- apiGroups:
+  - authorization.k8s.io
+  resources:
+  - subjectaccessreviews
+  verbs:
+  - create
 - apiGroups: [""]
   resources:
   - nodes
@@ -13,6 +25,7 @@ rules:
 - apiGroups: [""]
   resources:
   - configmaps
+  - namespaces # Required to get through the alertmanager oauth proxy
   verbs: ["get"]
 - nonResourceURLs: ["*"]
   verbs: ["get"]

roles/openshift-apps/bodhi/files/servicemonitor.yml

@@ -3,11 +3,11 @@ kind: ServiceMonitor
 metadata:
   labels:
     monitoring-key: 'cpe'
-  name: bodhi-web
+  name: bodhi-service
 spec:
   endpoints:
     - path: /metrics
       port: web
   selector:
     matchLabels:
-      service: web
+      app: bodhi