enable k8s scraping by annotation servicemonitors are too hard

k8s/operators/kube-prometheus/cluster-role-patch.yaml

@@ -0,0 +1,6 @@
+- op: add
+  path: /rules/-
+  value:
+    apiGroups: [""]
+    resources: [pods]
+    verbs: [list, get, watch]

k8s/operators/kube-prometheus/kustomization.yaml

@@ -24,3 +24,13 @@ patches:
     target:
       kind: NetworkPolicy
       name: alertmanager-main
+
+  - path: prometheus-patch.yaml
+    target:
+      kind: Prometheus
+      name: k8s
+
+  - path: cluster-role-patch.yaml
+    target:
+      kind: ClusterRole
+      name: prometheus-k8s

k8s/operators/kube-prometheus/prometheus-patch.yaml

@@ -0,0 +1,9 @@
+- op: add
+  path: /spec/additionalScrapeConfigs
+  value:
+    key: scrape-configs.yaml
+    name: additional-scrape-configs
+    optional: true
+- op: add
+  path: /spec/secrets
+  value: [scrape-secrets]