fix(monitoring): allow parca Prometheus to reach parca-analytics' Thanos pods (#477)

Confirmed: "Error scraping target: Get \"http://100.64.2.7:9090/metrics\":
context deadline exceeded" — Cilium's default-deny was silently dropping
scrape traffic from the parca Prometheus into parca-analytics's namespace,
timing out rather than refusing. Its serviceMonitorSelector/
serviceMonitorNamespaceSelector are wide open, so it was already
discovering the thanos-query/thanos-sidecar/thanos-store ServiceMonitors
there; it just couldn't reach the pods. Adds a matching ingress rule to
each of the three NetworkPolicies (thanos-query, thanos-store, and the
prometheus-parca-analytics pod that hosts the sidecar container) allowing
parca's pod on their metrics ports.

Author: metalmatze

monitoring/environments/scaleway-parca-demo/main.jsonnet

@@ -36,10 +36,46 @@ local kubeThanos = m.kubeThanos({
             }],
             ports: [{ port: 'http', protocol: 'TCP' }],
           },
+          {
+            // Scraped by the parca Prometheus (parca-analytics does not scrape itself).
+            from: [{
+              namespaceSelector: { matchLabels: { 'kubernetes.io/metadata.name': 'monitoring' } },
+              podSelector: {
+                matchLabels: {
+                  'app.kubernetes.io/component': 'prometheus',
+                  'app.kubernetes.io/instance': 'parca',
+                  'app.kubernetes.io/name': 'prometheus',
+                  'app.kubernetes.io/part-of': 'kube-prometheus',
+                },
+              },
+            }],
+            ports: [{ port: 'http', protocol: 'TCP' }],
+          },
         ],
       },
     },
   },
+  store+: {
+    networkPolicy+: {
+      spec+: {
+        ingress+: [{
+          // Scraped by the parca Prometheus (parca-analytics does not scrape itself).
+          from: [{
+            namespaceSelector: { matchLabels: { 'kubernetes.io/metadata.name': 'monitoring' } },
+            podSelector: {
+              matchLabels: {
+                'app.kubernetes.io/component': 'prometheus',
+                'app.kubernetes.io/instance': 'parca',
+                'app.kubernetes.io/name': 'prometheus',
+                'app.kubernetes.io/part-of': 'kube-prometheus',
+              },
+            },
+          }],
+          ports: [{ port: 'http' }],
+        }],
+      },
+    },
+  },
 };
 
 local prometheuses = [
@@ -434,7 +470,9 @@ local prometheuses = [
               },
             },
           }],
-          ports: [{ port: 'web' }, { port: 'reloader-web' }],
+          // web/reloader-web are this Prometheus' own metrics; http is the
+          // Thanos sidecar's, which runs as a container on the same pod.
+          ports: [{ port: 'web' }, { port: 'reloader-web' }, { port: 'http' }],
         }],
       },
     },