Linux: Prometheus

mkdir -p /opt/docker/monitor/prometheus/certs
cd /opt/docker/monitor/prometheus/certs

# 1 SAN 扩展文件

cat > fd.ext <<'EOF'
basicConstraints = CA:FALSE
keyUsage = critical, digitalSignature, keyEncipherment
extendedKeyUsage = serverAuth, clientAuth
subjectAltName = DNS:*.xxx.com, DNS:xxx.com, DNS:prometheus, DNS:localhost, IP:<内网IP>, IP:<你的IP>, IP:127.0.0.1
EOF


# 2 私有 CA（100 年）

openssl genrsa -out ca.key 4096

openssl req -x509 -new -nodes -sha256 -days 36500 \
  -key ca.key -out ca.crt \
  -subj "/C=CN/ST=hangzhou/L=hangzhou/O=ops:prometheus/CN=ops-internal-ca" \
  -addext "basicConstraints=critical,CA:TRUE,pathlen:0" \
  -addext "keyUsage=critical,keyCertSign,cRLSign"

# CA 的 CN 不要和服务端证书的 CN 重名，否则部分工具链路校验会犯迷糊，这里用 ops-internal-ca。

# 3 服务端私钥 + CSR（用你给的 subj）

openssl genrsa -out tls.key 2048

openssl req -new -sha256 -key tls.key -out tls.csr \
  -subj "/C=CN/ST=hangzhou/L=hangzhou/O=ops:prometheus/CN=prometheus"

# 4 用 CA 签发

openssl x509 -req -sha256 -days 36500 \
  -in tls.csr \
  -CA ca.crt -CAkey ca.key -CAcreateserial \
  -extfile fd.ext \
  -out tls.crt

# 5 校验
# 看 SAN 有没有全进去
openssl x509 -in tls.crt -noout -text | grep -A2 'Subject Alternative Name'
openssl x509 -in tls.crt -noout -subject -issuer -dates
# 验签链
openssl verify -CAfile ca.crt tls.crt          # 应输出 tls.crt: OK
# 确认公私钥配对（两个 md5 必须一致）
openssl x509 -in tls.crt -noout -pubkey | openssl md5
openssl rsa  -in tls.key -pubout       | openssl md5

# 6 权限
chmod 600 ca.key tls.key
chmod 644 ca.crt tls.crt
rm -f tls.csr          # ca.key 请离线备份，别留在容器能读到的地方之外也别丢

#容器里 Prometheus 以 user: '0' 跑，root 能读 600 的 key，没问题。

mkdir monitor/prometheus/rulues -pv
cd monitor

# Prometheus 的 web.yml 只支持 bcrypt
# 生成密码-方法1
apt install apache2-utils -y
htpasswd -nBC 10 remote_writer   → 取冒号后面那串，注意 $ 在 yaml 单引号里是安全的
# 生成密码-方法2
docker run --rm httpd:alpine htpasswd -nBC 10 remote_writer
#生成密码-方法3
# 生成密码
cat p.py <<EOF
import getpass
import bcrypt

password = getpass.getpass("password: ")
hashed_password = bcrypt.hashpw(password.encode("utf-8"), bcrypt.gensalt())

print(hashed_password.decode())
EOF
python3 p.py # 输入密码

# 生成配置
cat > prometheus/web.yml <<\EOF
# https://prometheus.io/docs/prometheus/latest/configuration/https/
tls_server_config:
  cert_file: /etc/prometheus/certs/tls.crt
  key_file:  /etc/prometheus/certs/tls.key
  min_version: TLS12

basic_auth_users:
  admin: $2b$12$Bq/xxx
  remote_write: $2y$10$PX4xxxxx
EOF

# prometheus/alertmanager.yml
cat <<\EOF> prometheus/alertmanager.yml 
route:
  group_by: ['alertname']
  group_wait: 10s
  group_interval: 10s
  repeat_interval: 20m
  receiver: 'default-receiver'

receivers:
- name: default-receiver
EOF

# 黑盒监控
cat > prometheus/blackbox.yml <<EOF
modules:
  http_2xx:
    prober: http
    timeout: 5s
    http:
      preferred_ip_protocol: "ip4"
      valid_status_codes: [200, 401, 301, 302]
      method: GET
  http_post_2xx:
    http:
      method: POST
      preferred_ip_protocol: ip4
    prober: http
  tcp_connect:
    prober: tcp
    timeout: 5s
  icmp:
    prober: icmp
    timeout: 5s
EOF

# prometheus/prometheus.yml
cat > prometheus/prometheus.yml  <<\EOF
global:
  scrape_interval: 30s
  scrape_timeout: 10s
  evaluation_interval: 30s
  external_labels:
    cluster: aliyun

storage:
  tsdb:
    out_of_order_time_window: 30m   # 跨云网络抖动/重传时，乱序样本不被丢弃

alerting:
  alertmanagers:
  - follow_redirects: true
    scheme: http
    timeout: 10s
    api_version: v2
    static_configs:
    - targets:
      - alertmanager:9093

rule_files:
- /etc/prometheus-rules/*.yml

#https://grafana.com/docs/grafana-cloud/send-data/metrics/metrics-prometheus/prometheus-config-examples/docker-compose-linux/

#remote_write:
#  - url: '<Your Prometheus remote_write endpoint>'
#    basic_auth:
#      username: '<Your Grafana Username>'
#      password: '<Your Grafana API key>'


scrape_configs:
- job_name: 'prometheus'
  scrape_interval: 1m
  scheme: https
  static_configs:
  - targets: ['localhost:9090']
  tls_config:
    ca_file: /etc/prometheus/certs/ca.crt
    server_name: localhost
  basic_auth:
    username: admin
    password: xxx

- job_name: 'cadvisor'
  scrape_interval: 5s
  static_configs:
  - targets: ['cadvisor:8080']

- job_name: 'node'
  static_configs:
  - targets: ['node-exporter:9100']

- job_name: 'blackbox-exporter'
  static_configs:
  - targets: ['blackbox-exporter:9115']
- job_name: domain-url
  scrape_interval: 30s
  scrape_timeout: 20s
  metrics_path: /probe
  params:
    modelue: [http_2xx]
  static_configs:
  # 内网不互通
  #- targets:
  #    - http://argocd.xxx.com/login
  #  labels:
  #    bussiness: ops
  #    serverty: info
  - targets:
      - https://devgw.xxx.com/api/
    labels:
      bussiness: pt-dev
      service: web
      serverty: info
  relabel_configs:
  - source_labels: [__address__]
    target_label: __param_target
  - source_labels: [__param_target]
    target_label: instance
  - target_label: __address__
    replacement: blackbox-exporter:9115
  - source_labels: [instance]
    regex: https?://(.*)
    replacement: "$1"
    target_label: target

- job_name: 'mysql'
  static_configs:
  - targets: ['mysqld_exporter:9104']

- job_name: 'redis'
  static_configs:
  - targets: ['redis_exporter:9121']
EOF

cat > docker-compose.yml <<EOF
networks:
  monitor_net:
    name: monitor_net
    driver: bridge
    ipam:
      config:
        - subnet: 192.168.222.0/24

services:
  prometheus:
    image: prom/prometheus:v3.13.3
    container_name: prometheus
    hostname: prometheus
    restart: unless-stopped
    volumes:
      - ./prometheus/prometheus.yml:/etc/prometheus/prometheus.yml
      - ./prometheus/web.yml:/etc/prometheus/web.yml
      - ./prometheus/certs:/etc/prometheus/certs:ro
      - ./prometheus/rules:/etc/prometheus-rules
      - ./prometheus/data:/prometheus
    command:
      - '--config.file=/etc/prometheus/prometheus.yml'
      - '--web.config.file=/etc/prometheus/web.yml'
      - '--web.enable-remote-write-receiver'
      - '--storage.tsdb.path=/prometheus'
      - '--web.console.libraries=/etc/prometheus/console_libraries'
      - '--web.console.templates=/etc/prometheus/consoles'
      - '--web.enable-lifecycle'
      - '--storage.tsdb.retention.time=60d'
    user: '0'
    ports:
      - 9090:9090
    networks:
      - monitor_net

  alertmanager:
    hostname: alertmanager
    container_name: alertmanager
    image: prom/alertmanager:v0.34.0
    volumes:
      - ./prometheus/alertmanager.yml:/config/alertmanager.yml
    command:
      - "--config.file=/config/alertmanager.yml"
      - '--data.retention=240h'
    ports:
      - 9093:9093
    networks:
      - monitor_net
    restart: always

  grafana:
    container_name: grafana
    image: grafana/grafana:13.0.8
    depends_on:
      - prometheus
    user: '0'
    ports:
      - 3000:3000
    volumes:
      - ./grafana-data:/var/lib/grafana
    networks:
      - monitor_net
    restart: always


  cadvisor:
    image: ghcr.io/google/cadvisor:v0.57.0
    hostname: cadvisor
    container_name: cadvisor
    #platform: linux/aarch64
    privileged: true
    volumes:
      - /:/rootfs:ro
      - /var/run:/var/run:ro
      - /sys:/sys:ro
      - /var/lib/docker/:/var/lib/docker:ro
      - /dev/disk/:/dev/disk:ro
      - /var/run/docker.sock:/var/run/docker.sock:ro
    command:
      - --docker_only=true
      - --housekeeping_interval=10s
      - --store_container_labels=false
      - --disable_metrics=percpu,sched,tcp,udp,hugetlb,referenced_memory,cpu_topology,resctrl
    ports:
      - 8080:8080
    networks:
      - monitor_net
    restart: unless-stopped


  node-exporter:
    image: prom/node-exporter:latest
    hostname: node-exporter
    container_name: node-exporter
    restart: unless-stopped
    volumes:
      - /proc:/host/proc:ro
      - /sys:/host/sys:ro
      - /:/rootfs:ro
    command:
      - '--path.procfs=/host/proc'
      - '--path.rootfs=/rootfs'
      - '--path.sysfs=/host/sys'
      - '--collector.filesystem.mount-points-exclude=^/(sys|proc|dev|host|etc)($$|/)'
    ports:
      - 9100:9100
    networks:
      - monitor_net

  blackbox-exporter:
      image: quay.io/prometheus/blackbox-exporter:latest
      hostname: blackbox-exporter
      container_name: blackbox-exporter
      restart: unless-stopped
      volumes:
      - ./prometheus/blackbox.yml:/etc/blackbox_exporter/config.yml
      command:
      - --config.file=/etc/blackbox_exporter/config.yml
      ports:
      - "9115:9115"
      networks:
      - monitor_net
      # 开启 icmp ping探测
      cap_add:
        - NET_RAW

#  mysqld_exporter:
#    image: prom/mysqld-exporter:v0.15.1
#    hostname: mysqld-exporter
#    container_name: mysqld_exporter
#    ports:
#      - 9104
#    command:
#      - "--mysqld.username=root:kot2LT4jgJEo2rsnvduF"
#      - "--mysqld.address=mysql-8-slots:3306"
#      - '--tls.insecure-skip-verify'
#    restart: always
#    networks:
#      - monitor_net
#
#  redis_exporter:
#    image: oliver006/redis_exporter:v1.62.0
#    container_name: redis_exporter
#    ports:
#      - 9121
#    command:
#      - "--redis.addr=redis://redis-stack-slots:6379"
#      - "--redis.password=OzTKYlJ9KvGZAkYf9B"
#      - '--debug'
#    restart: always
#    networks:
#      - monitor_net

#  debian:
#    image: debian:unstable-slim
#    container_name: debian
#    restart: always
#    tty: true
#    #entrypoint:
#    #  - cat
#    networks:
#      - monitor_net
EOF

docker compose up -d
docker compose logs --tail=50 prometheus


# 从 ECS 本机验证（带 CA 校验，不要用 -k）
curl --cacert /opt/docker/monitor/prometheus/certs/ca.crt \
     -u remote_writer:'你的密码' \
     https://10.14.0.219:9090/-/healthy

# 公网 IP 也应通过（SAN 里有）
curl --cacert ... -u ... https://<你的IP>:9090/-/healthy

如果日志里出现 tls: failed to find any PEM data in key input，说明 key 被加密了（生成时漏了 -nodes/用了 -aes256）。

- job_name: 'prometheus'
  scheme: https
  tls_config:
    ca_file: /etc/prometheus/certs/ca.crt
    server_name: prometheus
  basic_auth:
    username: remote_writer
    password: '你的密码'
  static_configs:
    - targets: ['prometheus:9090']

# 建一个 600 权限的密码文件
umask 077
printf 'admin:xxxpassword' > /opt/docker/monitor/.reload-cred
chmod 600 /opt/docker/monitor/.reload-cred

# 脚本内容
cat >reload-prom <<\EOF
#!/usr/bin/bash
# prometheus 重加载配置
ppath=/opt/docker/monitor
/usr/bin/curl -fsS --connect-timeout 5 -m 30 \
  -XPOST --cacert ${ppath}/prometheus/certs/tls.crt \
  -u "$(cat ${ppath}/.reload-cred)" \
  https://127.0.0.1:9090/-/reload \
  && echo "reload OK" || echo "reload FAILED"
EOF

chmod +x reload-prom
ln -sv /opt/docker/monitor/reload-prom /usr/local/bin
#这样普通用户 cat 脚本看不到密码

CLUSTER=eks-dev
REGION=ap-southeast-1
ACCOUNT=$(aws sts get-caller-identity --query Account --output text)

cat > yace-policy.json <<'EOF'
{
  "Version": "2012-10-17",
  "Statement": [{
    "Effect": "Allow",
    "Action": [
      "tag:GetResources",
      "cloudwatch:ListMetrics",
      "cloudwatch:GetMetricData",
      "cloudwatch:GetMetricStatistics",
      "iam:ListAccountAliases",
      "rds:DescribeDBInstances",
      "elasticache:DescribeCacheClusters",
      "mq:ListBrokers"
    ],
    "Resource": "*"
  }]
}
EOF

aws iam create-policy --policy-name YaceCloudWatchRead \
  --policy-document file://yace-policy.json

CLUSTER=eks-jp-test
REGION=ap-southeast-1
ACCOUNT=$(aws sts get-caller-identity --query Account --output text)

# 确认镜像
helm upgrade --install yace  \
  prometheus-community/yet-another-cloudwatch-exporter \
  --timeout 600s \
  --dry-run=client \
  --namespace monitoring --create-namespace |grep image

cat >yace.yaml <<EOF
apiVersion: v1
kind: ConfigMap
metadata:
  name: yace-config
  namespace: monitoring
data:
  config.yml: |
    apiVersion: v1alpha1
    sts-region: ap-southeast-1
    discovery:
      exportedTagsOnMetrics:
        AWS/RDS: [Name, Env]
        AWS/ElastiCache: [Name, Env]
      jobs:
        - type: AWS/RDS
          regions: [ap-southeast-1]
          period: 300
          length: 600
          metrics:
            - { name: CPUUtilization,      statistics: [Average, Maximum] }
            - { name: FreeableMemory,      statistics: [Average, Minimum] }
            - { name: FreeStorageSpace,    statistics: [Average, Minimum] }
            - { name: DatabaseConnections, statistics: [Average, Maximum] }
            - { name: ReadLatency,         statistics: [Average, Maximum] }
            - { name: WriteLatency,        statistics: [Average, Maximum] }
            - { name: ReadIOPS,            statistics: [Average] }
            - { name: WriteIOPS,           statistics: [Average] }
            - { name: ReplicaLag,          statistics: [Average, Maximum] }
            - { name: BurstBalance,        statistics: [Minimum] }
            - { name: DiskQueueDepth,      statistics: [Average] }
            - { name: SwapUsage, statistics: [Average] }

        - type: AWS/ElastiCache
          regions: [ap-southeast-1]
          period: 300
          length: 600
          metrics:
            - { name: CPUUtilization,        statistics: [Average, Maximum] }
            - { name: EngineCPUUtilization,  statistics: [Average, Maximum] }
            - { name: DatabaseMemoryUsagePercentage, statistics: [Average, Maximum] }
            - { name: CurrConnections,       statistics: [Average, Maximum] }
            - { name: ReplicationLag,        statistics: [Average, Maximum] }
            - { name: SwapUsage,             statistics: [Average] }
            - { name: Evictions,      statistics: [Sum, Average] }
            - { name: CacheHits,      statistics: [Sum] }
            - { name: CacheMisses,    statistics: [Sum, Average] }
            - { name: FreeableMemory, statistics: [Average, Minimum] }

        # Amazon MQ（RabbitMQ / ActiveMQ）
        - type: AWS/AmazonMQ
          regions: [ap-southeast-1]
          period: 300
          length: 600
          metrics:
            - { name: CpuUtilization,    statistics: [Average, Maximum] }
            - { name: SystemCpuUtilization,       statistics: [Average] }
            - { name: RabbitMQMemUsed,            statistics: [Average] }
            - { name: RabbitMQMemLimit,           statistics: [Average] }
            - { name: RabbitMQDiskFree,           statistics: [Average] }
            - { name: RabbitMQDiskFreeLimit,      statistics: [Average] }
            - { name: RabbitMQFdUsed,             statistics: [Average] }
            - { name: MessageCount,               statistics: [Average] }
            - { name: MessageReadyCount,          statistics: [Average] }
            - { name: MessageUnacknowledgedCount, statistics: [Average] }
            - { name: PublishRate,                statistics: [Average] }
            - { name: ConfirmRate,                statistics: [Average] }
            - { name: AckRate,                    statistics: [Average] }
            - { name: ConsumerCount,              statistics: [Average] }
            - { name: ConnectionCount,            statistics: [Average] }
            - { name: ChannelCount,               statistics: [Average] }
            - { name: QueueCount,                 statistics: [Average] }
            - { name: ExchangeCount,              statistics: [Average] }

        # 若 MQ 实为 MSK，改用 AWS/Kafka（CpuUser / KafkaDataLogsDiskUsed / SumOffsetLag ...）
        # 若为 SQS，改用 AWS/SQS（ApproximateNumberOfMessagesVisible / ApproximateAgeOfOldestMessage）
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: yace
  namespace: monitoring
  labels: { app: yace }
spec:
  replicas: 1          # 必须为 1：多副本会重复调 CloudWatch API，费用翻倍
  strategy: { type: Recreate }
  selector:
    matchLabels: { app: yace }
  template:
    metadata:
      labels: { app: yace }
      annotations:
        checksum/config: "REPLACE_ME"   # 改配置后改此值触发滚动，或 kubectl rollout restart
    spec:
      serviceAccountName: yace
      securityContext:
        runAsNonRoot: true
        runAsUser: 65534
        fsGroup: 65534
      containers:
        - name: yace
          image: quay.io/prometheuscommunity/yet-another-cloudwatch-exporter:v0.62.1
          args:
            - -config.file=/etc/yace/config.yml
            - -listen-address=:5000
            - -scraping-interval=300      # 后台轮询 CloudWatch 的周期（秒）
          ports:
            - { name: metrics, containerPort: 5000 }
          volumeMounts:
            - { name: config, mountPath: /etc/yace, readOnly: true }
          resources:
            requests: { cpu: 50m,  memory: 128Mi }
            limits:   { cpu: 500m, memory: 512Mi }
          readinessProbe:
            httpGet: { path: /metrics, port: metrics }
            initialDelaySeconds: 15
            periodSeconds: 20
            timeoutSeconds: 10
          securityContext:
            allowPrivilegeEscalation: false
            readOnlyRootFilesystem: true
            capabilities: { drop: ["ALL"] }
      volumes:
        - name: config
          configMap: { name: yace-config }
---
apiVersion: v1
kind: Service
metadata:
  name: yace
  namespace: monitoring
  labels: { app: yace }
spec:
  selector: { app: yace }
  ports:
    - { name: metrics, port: 5000, targetPort: metrics }
---
apiVersion: monitoring.coreos.com/v1
kind: ServiceMonitor
metadata:
  name: yace
  namespace: monitoring
  labels:
    app: yace
    release: kps        # 需匹配 kube-prometheus-stack 的 release 名，否则不被发现
spec:
  selector:
    matchLabels: { app: yace }
  endpoints:
    - port: metrics
      interval: 60s
      scrapeTimeout: 30s
EOF

kubectl -n monitoring get po
kubectl -n monitoring logs deploy/yace

# 验证
kubectl -n monitoring get pod -owide |grep yace
curl -s http://172.31.88.138:5000/metrics |grep -c '^aws_'
curl -s http://172.31.88.138:5000/metrics |grep -c '^aws_rds'

略

cat >exporter.yaml <<EOF
apiVersion: v1
data:
  sample-pwd-file.json: |-
    {
      "redis://redis6:6379": "",
      "rediss://user@clustercfg.xxxx.cache.amazonaws.com:6379": "passwordxx"
    }
kind: ConfigMap
metadata:
  name: redis-pwd-config
  namespace: monitoring
---
apiVersion: v1
kind: Service
metadata:
  name: redis-exporter
  namespace: monitoring
  #annotations:
  #  prometheus.io/scrape: "true"
  labels:
    app: redis-exporter
spec:
  selector:
    app: redis-exporter
  ports:
    - name: tcp-9121
      protocol: TCP
      port: 9121
      targetPort: 9121
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: redis-exporter
  namespace: monitoring
spec:
  replicas: 1
  selector:
    matchLabels:
      app: redis-exporter
  template:
    metadata:
      #annotations:
      #  prometheus.io/path: "/metrics"
      #  prometheus.io/port: "9121"
      #  prometheus.io/scrape: "true"
      labels:
        app: redis-exporter
    spec:
      #nodeSelector:
      #  type: ops-prod-prometheus
      #imagePullSecrets:
      #- name: docker-secret
      containers:
      - name: redis-exporter
        image: oliver006/redis_exporter:v1.91.1
        imagePullPolicy: IfNotPresent
        env:
        - name: REDIS_PASSWORD_FILE
          value: /data/sample-pwd-file.json
        resources:
          limits:
            cpu: 300m
            memory: 300Mi
          requests:
            cpu: 10m
            memory: 10Mi
        ports:
        - containerPort: 9121
        volumeMounts:
        - mountPath: /data
          name: redis-pwd-file
      volumes:
      - configMap:
          defaultMode: 420
          items:
          - key: sample-pwd-file.json
            path: sample-pwd-file.json
          name: redis-pwd-config
        name: redis-pwd-file
---
apiVersion: monitoring.coreos.com/v1
kind: ServiceMonitor
metadata:
  name: redis-exporter
  namespace: monitoring
  labels:
    app.kubernetes.io/name: redis-exporter
    app.kubernetes.io/instance: redis-exporter
    app.kubernetes.io/version: "1.91.1"
    app.kubernetes.io/component: exporter
    release: kps
spec:
  endpoints:
    - path: /metrics
      port: tcp-9121
      #interval: 15s
  namespaceSelector:
    matchNames:
      - monitoring
  selector:
    matchLabels:
      app: redis-exporter
EOF

cat >prometheus-additional.yaml <<EOF
#Redis
- job_name: 'redis-exporter-targets'
  static_configs:
  - targets:
    - rediss://user@clustercfg.xxx.cache.amazonaws.com:6379
    labels:
      dbtype: "db-redis"
  metrics_path: /scrape
  relabel_configs:
  - source_labels: [__address__]
    target_label: __param_target
  - source_labels: [__param_target]
    target_label: instance
  - target_label: __address__
    replacement: redis-exporter:9121

#EC2
- job_name: 'node-exporter'
  static_configs:
  - targets:
    - "x.x.x.x:9100"
    labels:
      business: jp-test
      type: ec2
      service: "ops-jmp"
EOF

# Update
kubectl -n monitoring create secret generic additional-scrape-configs \
        --from-file=prometheus-additional.yaml \
        --dry-run=client -oyaml|kubectl replace -f-


# helm
prometheus:
  agentMode: true                  # 开启转发器。不本地存储、省内存。不能查历史
  prometheusSpec:
    ...
    additionalScrapeConfigsSecret: # 静态配置
      enabled: true
      name: additional-scrape-configs
      key: prometheus-additional.yaml


helm upgrade --install -n monitoring kps \
     prometheus-community/kube-prometheus-stack \
     -f values-agent.yaml

- job_name: 'eks-cadvisor-via-apiserver'
  scheme: https
  tls_config: { ca_file: /etc/prometheus/eks/ca.crt }
  bearer_token_file: /etc/prometheus/eks/token
  kubernetes_sd_configs:
    - role: node
      api_server: https://XXXXX.gr7.ap-southeast-1.eks.amazonaws.com
      tls_config: { ca_file: /etc/prometheus/eks/ca.crt }
      bearer_token_file: /etc/prometheus/eks/token
  relabel_configs:
    - action: labelmap
      regex: __meta_kubernetes_node_label_(.+)
    - target_label: __address__
      replacement: XXXXX.gr7.ap-southeast-1.eks.amazonaws.com:443
    - sourceLabels: [__meta_kubernetes_node_name]
      regex: (.+)
      target_label: __metrics_path__
      replacement: /api/v1/nodes/${1}/proxy/metrics/cadvisor