diff --git a/k8s/operators/kube-prometheus/cluster-role-patch.yaml b/k8s/operators/kube-prometheus/cluster-role-patch.yaml
new file mode 100644
index 0000000..bebdefe
--- /dev/null
+++ b/k8s/operators/kube-prometheus/cluster-role-patch.yaml
@@ -0,0 +1,6 @@
+- op: add
+  path: /rules/-
+  value:
+    apiGroups: [""]
+    resources: [pods]
+    verbs: [list, get, watch]
diff --git a/k8s/operators/kube-prometheus/kustomization.yaml b/k8s/operators/kube-prometheus/kustomization.yaml
index ccd693d..a05321c 100644
--- a/k8s/operators/kube-prometheus/kustomization.yaml
+++ b/k8s/operators/kube-prometheus/kustomization.yaml
@@ -24,3 +24,13 @@ patches:
     target:
       kind: NetworkPolicy
       name: alertmanager-main
+
+  - path: prometheus-patch.yaml
+    target:
+      kind: Prometheus
+      name: k8s
+
+  - path: cluster-role-patch.yaml
+    target:
+      kind: ClusterRole
+      name: prometheus-k8s
diff --git a/k8s/operators/kube-prometheus/prometheus-patch.yaml b/k8s/operators/kube-prometheus/prometheus-patch.yaml
new file mode 100644
index 0000000..79f1bc3
--- /dev/null
+++ b/k8s/operators/kube-prometheus/prometheus-patch.yaml
@@ -0,0 +1,9 @@
+- op: add
+  path: /spec/additionalScrapeConfigs
+  value:
+    key: scrape-configs.yaml
+    name: additional-scrape-configs
+    optional: true
+- op: add
+  path: /spec/secrets
+  value: [scrape-secrets]