kube-prometheus-stack

# Default values for kube-prometheus-stack.

# This is a YAML-formatted file.

# Declare variables to be passed into your templates.

## Provide a name in place of kube-prometheus-stack for `app:` labels

##

nameOverride: ""

## Override the deployment namespace

##

namespaceOverride: ""

## Provide a k8s version to auto dashboard import script example: kubeTargetVersionOverride: 1.26.6

##

kubeTargetVersionOverride: ""

## Allow kubeVersion to be overridden while creating the ingress

##

kubeVersionOverride: ""

## Provide a name to substitute for the full names of resources

##

fullnameOverride: ""

## Labels to apply to all resources

##

commonLabels: {}

# scmhash: abc123

# myLabel: aakkmd

## Install Prometheus Operator CRDs

##

crds:

enabled: true

## The CRD upgrade job mitigates the limitation of helm not being able to upgrade CRDs.

## The job will apply the CRDs to the cluster before the operator is deployed, using helm hooks.

## It deploys a corresponding clusterrole, clusterrolebinding and serviceaccount to apply the CRDs.

## This feature is in preview, off by default and may change in the future.

upgradeJob:

enabled: false

## Force apply the CRDs, taking ownership from the manager that installed them (e.g. helm).

## Required for the job to actually upgrade CRDs whose schema/version changed.

forceConflicts: true

image:

busybox:

registry: cgr.dev

repository: chainguard-private/busybox

tag: glibc-1.38.0-r3@sha256:82374f77edfec3d662c9c1531031c7be1c2d1fe8ea9191cb4424148ac71e0807

sha: ""

pullPolicy: IfNotPresent

kubectl:

registry: cgr.dev

repository: chainguard-private/kubectl

tag: 1.37.2-r1

sha: sha256:18af9c252f6ea399b0f513332a336cb8481b0270e30987179fc46b69dd286499

pullPolicy: IfNotPresent

env: {}

## Define resources requests and limits for single Pods.

## ref: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/

##

resources: {}

## Additional volumes

##

extraVolumes: []

## Additional volume mounts

##

extraVolumeMounts: []

## Define which Nodes the Pods are scheduled on.

## ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#nodeselector

##

nodeSelector:

kubernetes.io/os: linux

## Assign custom affinity rules to the upgrade-crd job

## ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/

##

affinity: {}

# nodeAffinity:

# requiredDuringSchedulingIgnoredDuringExecution:

# nodeSelectorTerms:

# - matchExpressions:

# - key: kubernetes.io/e2e-az-name

# operator: In

# values:

# - e2e-az1

# - e2e-az2

## If specified, the pod's tolerations.

## ref: https://kubernetes.io/docs/concepts/scheduling-eviction/taint-and-toleration/

##

tolerations: []

# - key: "key"

# operator: "Equal"

# value: "value"

# effect: "NoSchedule"

## If specified, the pod's topology spread constraints.

## ref: https://kubernetes.io/docs/concepts/scheduling-eviction/topology-spread-constraints/

##

topologySpreadConstraints: []

# - maxSkew: 1

# topologyKey: topology.kubernetes.io/zone

# whenUnsatisfiable: DoNotSchedule

# labelSelector:

# matchLabels:

# app: alertmanager

# ## Labels to add to the upgrade-crd job

# ##

labels: {}

## Annotations to add to the upgrade-crd job

##

annotations: {}

## Labels to add to the upgrade-crd pod

##

podLabels: {}

## Annotations to add to the upgrade-crd pod

##

podAnnotations: {}

## Service account for upgrade crd job to use.

## ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/

##

serviceAccount:

create: true

name: ""

annotations: {}

labels: {}

automountServiceAccountToken: true

## Automounting API credentials for upgrade crd job pod.

##

automountServiceAccountToken: true

## Container-specific security context configuration

## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/

##

containerSecurityContext:

allowPrivilegeEscalation: false

readOnlyRootFilesystem: true

capabilities:

drop:

- ALL

## SecurityContext holds pod-level security attributes and common container settings.

## This defaults to non root user with uid 1000 and gid 2000. *v1.PodSecurityContext false

## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/

##

podSecurityContext:

fsGroup: 65534

runAsGroup: 65534

runAsNonRoot: true

runAsUser: 65534

seccompProfile:

type: RuntimeDefault

## Custom rules to override "for" and "severity" in defaultRules

##

customRules: {}

# AlertmanagerFailedReload:

# for: 3m

# AlertmanagerMembersInconsistent:

# for: 5m

# severity: "warning"

## Create default rules for monitoring the cluster

##

defaultRules:

create: true

rules:

alertmanager: true

etcd: true

configReloaders: true

general: true

k8sContainerCpuUsageSecondsTotal: true

k8sContainerMemoryCache: true

k8sContainerMemoryRss: true

k8sContainerMemorySwap: true

k8sContainerResource: true

k8sContainerMemoryWorkingSetBytes: true

k8sPodOwner: true

kubeApiserverAvailability: true

kubeApiserverBurnrate: true

kubeApiserverHistogram: true

kubeApiserverSlos: true

kubeControllerManager: true

kubelet: true

kubeProxy: true

kubePrometheusGeneral: true

kubePrometheusNodeRecording: true

kubernetesApps: true

kubernetesResources: true

kubernetesStorage: true

kubernetesSystem: true

kubeSchedulerAlerting: true

kubeSchedulerRecording: true

kubeStateMetrics: true

network: true

node: true

nodeExporterAlerting: true

nodeExporterRecording: true

prometheus: true

prometheusOperator: true

windows: true

# Defines the operator for namespace selection in rules

# Use "=~" to include namespaces matching the pattern (default)

# Use "!~" to exclude namespaces matching the pattern

appNamespacesOperator: "=~"

## Reduce app namespace alert scope

appNamespacesTarget: ".*"

## Set keep_firing_for for all alerts

keepFiringFor: ""

## Labels for default rules

labels: {}

## Annotations for default rules

annotations: {}

## Additional labels for PrometheusRule alerts

additionalRuleLabels: {}

## Additional annotations for specific PrometheusRule alerts by alert name

additionalRuleAnnotations: {}

## Additional labels for specific PrometheusRule alert groups

additionalRuleGroupLabels:

alertmanager: {}

etcd: {}

configReloaders: {}

general: {}

k8sContainerCpuUsageSecondsTotal: {}

k8sContainerMemoryCache: {}

k8sContainerMemoryRss: {}

k8sContainerMemorySwap: {}

k8sContainerResource: {}

k8sPodOwner: {}

kubeApiserverAvailability: {}

kubeApiserverBurnrate: {}

kubeApiserverHistogram: {}

kubeApiserverSlos: {}

kubeControllerManager: {}

kubelet: {}

kubeProxy: {}

kubePrometheusGeneral: {}

kubePrometheusNodeRecording: {}

kubernetesApps: {}

kubernetesResources: {}

kubernetesStorage: {}

kubernetesSystem: {}

kubeSchedulerAlerting: {}

kubeSchedulerRecording: {}

kubeStateMetrics: {}

network: {}

node: {}

nodeExporterAlerting: {}

nodeExporterRecording: {}

prometheus: {}

prometheusOperator: {}

## Additional annotations for specific PrometheusRule alert groups

additionalRuleGroupAnnotations:

alertmanager: {}

etcd: {}

configReloaders: {}

general: {}

k8sContainerCpuUsageSecondsTotal: {}

k8sContainerMemoryCache: {}

k8sContainerMemoryRss: {}

k8sContainerMemorySwap: {}

k8sContainerResource: {}

k8sPodOwner: {}

kubeApiserverAvailability: {}

kubeApiserverBurnrate: {}

kubeApiserverHistogram: {}

kubeApiserverSlos: {}

kubeControllerManager: {}

kubelet: {}

kubeProxy: {}

kubePrometheusGeneral: {}

kubePrometheusNodeRecording: {}

kubernetesApps: {}

kubernetesResources: {}

kubernetesStorage: {}

kubernetesSystem: {}

kubeSchedulerAlerting: {}

kubeSchedulerRecording: {}

kubeStateMetrics: {}

network: {}

node: {}

nodeExporterAlerting: {}

nodeExporterRecording: {}

prometheus: {}

prometheusOperator: {}

additionalAggregationLabels: []

## Prefix for runbook URLs. Use this to override the first part of the runbookURLs that is common to all rules.

runbookUrl: "https://runbooks.prometheus-operator.dev/runbooks"

## Thresholds for kubelet certificate expiration alerts (in seconds)

kubeletServerCertificateExpiration:

warning: 604800 # 7 days

critical: 86400 # 1 day

kubeletClientCertificateExpiration:

warning: 604800 # 7 days

critical: 86400 # 1 day

node:

fsSelector: 'fstype!=""'

# fsSelector: 'fstype=~"ext[234]|btrfs|xfs|zfs"'

## Disabled PrometheusRule alerts

disabled: {}

# KubeAPIDown: true

# NodeRAIDDegraded: true

## Deprecated way to provide custom recording or alerting rules to be deployed into the cluster.

##

# additionalPrometheusRules: []

# - name: my-rule-file

# groups:

# - name: my_group

# rules:

# - record: my_record

# expr: 100 * my_record

## Provide custom recording or alerting rules to be deployed into the cluster.

##

additionalPrometheusRulesMap: {}

# rule-name:

# groups:

# - name: my_group

# rules:

# - record: my_record

# expr: 100 * my_record

##

global:

rbac:

create: true

## Create ClusterRoles that extend the existing view, edit and admin ClusterRoles to interact with prometheus-operator CRDs

## Ref: https://kubernetes.io/docs/reference/access-authn-authz/rbac/#aggregated-clusterroles

createAggregateClusterRoles: false

## Global image registry to use if it needs to be overridden for some specific use cases (e.g. local registries, custom images, ...)

##

imageRegistry: ""

## Reference to one or more secrets to be used when pulling images

## ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/

##

imagePullSecrets: []

# - name: "image-pull-secret"

# or

# - "image-pull-secret"

windowsMonitoring:

## Deploys the windows-exporter and Windows-specific dashboards and rules (job name must be 'windows-exporter')

enabled: false

## Configuration for prometheus-windows-exporter

## ref: https://github.com/prometheus-community/helm-charts/tree/main/charts/prometheus-windows-exporter

##

prometheus-windows-exporter:

## Enable ServiceMonitor and set Kubernetes label to use as a job label

##

prometheus:

monitor:

enabled: true

jobLabel: jobLabel

releaseLabel: true

## Set job label to 'windows-exporter' as required by the default Prometheus rules and Grafana dashboards

##

podLabels:

jobLabel: windows-exporter

## Enable memory and container metrics as required by the default Prometheus rules and Grafana dashboards

##

config: |-

collectors:

enabled: '[defaults],memory,container'

## Configuration for alertmanager

## ref: https://prometheus.io/docs/alerting/alertmanager/

##

alertmanager:

## Deploy alertmanager

##

enabled: true

# Optional: Override the namespace where Alertmanager will be deployed.

namespaceOverride: ""

## Annotations for Alertmanager

##

annotations: {}

## Additional labels for Alertmanager

##

additionalLabels: {}

## API that Prometheus will use to communicate with alertmanager. Possible values are v1, v2

##

apiVersion: v2

## @param alertmanager.enableFeatures Enable access to Alertmanager disabled features.

##

enableFeatures: []

## Create dashboard configmap even if alertmanager deployment has been disabled

##

forceDeployDashboards: false

## Network Policy configuration

##

networkPolicy:

# -- Enable network policy for Alertmanager

enabled: false

# -- Define policy types. If egress is enabled, both Ingress and Egress will be used

# Valid values are ["Ingress"] or ["Ingress", "Egress"]

##

policyTypes:

- Ingress

# -- Gateway (formerly ingress controller) configuration

##

gateway:

# -- Gateway namespace

##

namespace: ""

# -- Gateway pod labels

##

podLabels: {}

# app.kubernetes.io/name: ingress-nginx

# -- Additional custom ingress rules

##

additionalIngress: []

# - from:

# - namespaceSelector:

# matchLabels:

# name: another-namespace

# podSelector:

# matchLabels:

# app: another-app

# - from:

# - podSelector:

# matchLabels:

# app.kubernetes.io/name: loki

# ports:

# - port: 9093

# protocol: TCP

# -- Configure egress rules

##

egress:

# -- Enable egress rules. When enabled, policyTypes will include Egress

##

enabled: false

# -- Custom egress rules

##

rules: []

# - to:

# - namespaceSelector: {}

# podSelector:

# matchLabels:

# name: smtp-relay

# ports:

# - port: 25

# protocol: TCP

# -- Enable rules for alertmanager cluster traffic

##

enableClusterRules: true

# -- Configure monitoring component rules

##

monitoringRules:

# -- Enable ingress from Prometheus

##

prometheus: true

# -- Enable ingress for config reloader metrics

##

configReloader: true

## Service account for Alertmanager to use.

## ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/

##

serviceAccount:

create: true

name: ""

annotations: {}

automountServiceAccountToken: true

## Configure pod disruption budgets for Alertmanager

## ref: https://kubernetes.io/docs/tasks/run-application/configure-pdb/#specifying-a-poddisruptionbudget

##

podDisruptionBudget:

enabled: false

minAvailable: 1

# maxUnavailable: ""

unhealthyPodEvictionPolicy: AlwaysAllow

## Enable vertical pod autoscaler support for Alertmanager

## ref: https://github.com/kubernetes/autoscaler/tree/master/vertical-pod-autoscaler

##

verticalPodAutoscaler:

enabled: false

# Recommender responsible for generating recommendation for the object.

# List should be empty (then the default recommender will generate the recommendation)

# or contain exactly one recommender.

# recommenders:

# - name: custom-recommender-performance

# List of resources that the vertical pod autoscaler can control. Defaults to cpu and memory

controlledResources: []

# Specifies which resource values should be controlled: RequestsOnly or RequestsAndLimits.

# controlledValues: RequestsAndLimits

# Define the max allowed resources for the pod

maxAllowed: {}

# cpu: 200m

# memory: 100Mi

# Define the min allowed resources for the pod

minAllowed: {}

# cpu: 200m

# memory: 100Mi

updatePolicy:

# Specifies whether recommended updates are applied when a Pod is started and whether recommended updates

# are applied during the life of a Pod. Possible values are "Off", "Initial", "Recreate", and "InPlaceOrRecreate".

updateMode: Recreate

## Alertmanager configuration directives

## ref: https://prometheus.io/docs/alerting/configuration/#configuration-file

## https://prometheus.io/webtools/alerting/routing-tree-editor/

##

config:

global:

resolve_timeout: 5m

inhibit_rules:

- source_matchers:

- 'severity = critical'

target_matchers:

- 'severity =~ warning|info'

equal:

- 'namespace'

- 'alertname'

- source_matchers:

- 'severity = warning'

target_matchers:

- 'severity = info'

equal:

- 'namespace'

- 'alertname'

- source_matchers:

- 'alertname = InfoInhibitor'

target_matchers:

- 'severity = info'

equal:

- 'namespace'

- target_matchers:

- 'alertname = InfoInhibitor'

route:

group_by: ['namespace']

group_wait: 30s

group_interval: 5m

repeat_interval: 12h

receiver: 'null'

routes:

- receiver: 'null'

matchers:

- alertname = "Watchdog"

receivers:

- name: 'null'

templates:

- '/etc/alertmanager/config/*.tmpl'

## Alertmanager configuration directives (as string type, preferred over the config hash map)

## stringConfig will be used only if tplConfig is true

## ref: https://prometheus.io/docs/alerting/configuration/#configuration-file

## https://prometheus.io/webtools/alerting/routing-tree-editor/

##

stringConfig: ""

## Pass the Alertmanager configuration directives through Helm's templating

## engine. If the Alertmanager configuration contains Alertmanager templates,

## they'll need to be properly escaped so that they are not interpreted by

## Helm

## ref: https://helm.sh/docs/developing_charts/#using-the-tpl-function

## https://prometheus.io/docs/alerting/configuration/#tmpl_string

## https://prometheus.io/docs/alerting/notifications/

## https://prometheus.io/docs/alerting/notification_examples/

tplConfig: false

## Alertmanager template files to format alerts

## By default, templateFiles are placed in /etc/alertmanager/config/ and if

## they have a .tmpl file suffix will be loaded. See config.templates above

## to change, add other suffixes. If adding other suffixes, be sure to update

## config.templates above to include those suffixes.

## ref: https://prometheus.io/docs/alerting/notifications/

## https://prometheus.io/docs/alerting/notification_examples/

##

templateFiles: {}

#

## An example template:

# template_1.tmpl: |-

# {{ define "cluster" }}{{ .ExternalURL | reReplaceAll ".*alertmanager\\.(.*)" "$1" }}{{ end }}

#

# {{ define "slack.myorg.text" }}

# {{- $root := . -}}

# {{ range .Alerts }}

# *Alert:* {{ .Annotations.summary }} - `{{ .Labels.severity }}`

# *Cluster:* {{ template "cluster" $root }}

# *Description:* {{ .Annotations.description }}

# *Graph:* <{{ .GeneratorURL }}|:chart_with_upwards_trend:>

# *Runbook:* <{{ .Annotations.runbook }}|:spiral_note_pad:>

# *Details:*

# {{ range .Labels.SortedPairs }} - *{{ .Name }}:* `{{ .Value }}`

# {{ end }}

# {{ end }}

# {{ end }}

ingress:

enabled: false

ingressClassName: ""

annotations: {}

labels: {}

## Override ingress to a different defined port on the service

# servicePort: 8081

## Override ingress to a different service then the default, this is useful if you need to

## point to a specific instance of the alertmanager (eg kube-prometheus-stack-alertmanager-0)

# serviceName: kube-prometheus-stack-alertmanager-0

## Hosts must be provided if Ingress is enabled.

##

hosts: []

# - alertmanager.domain.com

## Paths to use for ingress rules - one path should match the alertmanagerSpec.routePrefix

##

paths: []

# - /

## For Kubernetes >= 1.18 you should specify the pathType (determines how Ingress paths should be matched)

## See https://kubernetes.io/blog/2020/04/02/improvements-to-the-ingress-api-in-kubernetes-1.18/#better-path-matching-with-path-types

# pathType: ImplementationSpecific

## TLS configuration for Alertmanager Ingress

## Secret must be manually created in the namespace

##

tls: []

# - secretName: alertmanager-general-tls

# hosts:

# - alertmanager.example.com

# -- BETA: Configure the gateway routes for the chart here.

# More routes can be added by adding a dictionary key like the 'main' route.

# Be aware that this is an early beta of this feature,

# kube-prometheus-stack does not guarantee this works and is subject to change.

# Being BETA this can/will change in the future without notice, do not use unless you want to take that risk

# [[ref]](https://gateway-api.sigs.k8s.io/reference/api-spec/main/spec/#gatewaynetworkingk8siov1alpha2)

route:

main:

# -- Enables or disables the route

enabled: false

# -- Set the route apiVersion, e.g. gateway.networking.k8s.io/v1 or gateway.networking.k8s.io/v1alpha2

apiVersion: gateway.networking.k8s.io/v1

# -- Set the route kind

# Valid options are GRPCRoute, HTTPRoute, TCPRoute, TLSRoute, UDPRoute

kind: HTTPRoute

annotations: {}

labels: {}

hostnames: []

# - my-filter.example.com

parentRefs: []

# - name: acme-gw

# -- create http route for redirect (https://gateway-api.sigs.k8s.io/guides/http-redirect-rewrite/#http-to-https-redirects)

## Take care that you only enable this on the http listener of the gateway to avoid an infinite redirect.

## matches, filters and additionalRules will be ignored if this is set to true. Be are

httpsRedirect: false

matches:

- path:

type: PathPrefix

value: /

## Filters define the filters that are applied to requests that match this rule.

filters: []

## Timeouts for the generated HTTPRoute backend rule.

## Requires Gateway API CRDs and a controller that support HTTPRoute timeouts.

timeouts: {}

# request: 120s

# backendRequest: 60s

## Session persistence configuration for the route rule.

sessionPersistence: {}

# sessionName: route

# type: Cookie

# absoluteTimeout: 12h

# cookieConfig:

# lifetimeType: Permanent

## Additional custom rules that can be added to the route

additionalRules: []

## Configuration for Alertmanager secret

##

secret:

annotations: {}

## Configuration for creating an Ingress that will map to each Alertmanager replica service

## alertmanager.servicePerReplica must be enabled

##

ingressPerReplica:

enabled: false

ingressClassName: ""

annotations: {}

labels: {}

## Final form of the hostname for each per replica ingress is

## {{ ingressPerReplica.hostPrefix }}-{{ $replicaNumber }}.{{ ingressPerReplica.hostDomain }}

##

## Prefix for the per replica ingress that will have `-$replicaNumber`

## appended to the end

hostPrefix: ""

## Domain that will be used for the per replica ingress

hostDomain: ""

## Paths to use for ingress rules

##

paths: []

# - /

## For Kubernetes >= 1.18 you should specify the pathType (determines how Ingress paths should be matched)

## See https://kubernetes.io/blog/2020/04/02/improvements-to-the-ingress-api-in-kubernetes-1.18/#better-path-matching-with-path-types

# pathType: ImplementationSpecific

## Secret name containing the TLS certificate for alertmanager per replica ingress

## Secret must be manually created in the namespace

tlsSecretName: ""

## Separated secret for each per replica Ingress. Can be used together with cert-manager

##

tlsSecretPerReplica:

enabled: false

## Final form of the secret for each per replica ingress is

## {{ tlsSecretPerReplica.prefix }}-{{ $replicaNumber }}

##

prefix: "alertmanager"

## Configuration for creating a Gateway API route that will map to each Alertmanager replica service

## alertmanager.servicePerReplica must be enabled

##

routePerReplica:

main:

# -- Enables or disables the routePerReplica

enabled: false

# -- Set the route apiVersion, e.g. gateway.networking.k8s.io/v1 or gateway.networking.k8s.io/v1alpha2

apiVersion: gateway.networking.k8s.io/v1

# -- Set the route kind

# Valid options are GRPCRoute, HTTPRoute, TCPRoute, TLSRoute, UDPRoute

kind: HTTPRoute

annotations: {}

labels: {}

## Final form of the hostname for each per replica route is

## {{ routePerReplica.hostPrefix }}-{{ $replicaNumber }}.{{ routePerReplica.hostDomain }}

##

## Prefix for the per replica route that will have `-$replicaNumber` appended to the end

hostPrefix: ""

## Domain that will be used for the per replica route

hostDomain: ""

parentRefs: []

# - name: acme-gw

# -- create http route for redirect (https://gateway-api.sigs.k8s.io/guides/http-redirect-rewrite/#http-to-https-redirects)

## Take care that you only enable this on the http listener of the gateway to avoid an infinite redirect.

## matches, filters and additionalRules will be ignored if this is set to true.

httpsRedirect: false

## Filters define the filters that are applied to requests that match this rule.

filters: []

matches:

- path:

type: PathPrefix

value: /

## Timeouts for the generated HTTPRoute backend rule.

## Requires Gateway API CRDs and a controller that support HTTPRoute timeouts.

timeouts: {}

# request: 120s

# backendRequest: 60s

## Session persistence configuration for the route rule.

sessionPersistence: {}

# sessionName: route

# type: Cookie

# absoluteTimeout: 12h

# cookieConfig:

# lifetimeType: Permanent

## Additional custom rules that can be added to the route

additionalRules: []

## Configuration for Alertmanager service

##

service:

enabled: true

annotations: {}

labels: {}

clusterIP: ""

ipDualStack:

enabled: false

ipFamilies: ["IPv6", "IPv4"]

ipFamilyPolicy: "PreferDualStack"

## Port for Alertmanager Service to listen on

##

port: 9093

## Port for Alertmanager cluster communication

##

# clusterPort: 9094

## To be used with a proxy extraContainer port

##

targetPort: 9093

## Port to expose on each node

## Only used if service.type is 'NodePort'

##

nodePort: 30903

## List of IP addresses at which the Prometheus server service is available

## Ref: https://kubernetes.io/docs/concepts/services-networking/service/#external-ips

##

## Additional ports to open for Alertmanager service

##

additionalPorts: []

# - name: oauth-proxy

# port: 8081

# targetPort: 8081

# - name: oauth-metrics

# port: 8082

# targetPort: 8082

externalIPs: []

loadBalancerIP: ""

loadBalancerSourceRanges: []

## Denotes if this Service desires to route external traffic to node-local or cluster-wide endpoints

##

externalTrafficPolicy: Cluster

## If you want to make sure that connections from a particular client are passed to the same Pod each time

## Accepts 'ClientIP' or 'None'

##

sessionAffinity: None

## If you want to modify the ClientIP sessionAffinity timeout

## The value must be >0 && <=86400(for 1 day) if ServiceAffinity == "ClientIP"

##

sessionAffinityConfig:

clientIP:

timeoutSeconds: 10800

## Service type

##

type: ClusterIP

## Configuration for creating a separate Service for each statefulset Alertmanager replica

##

servicePerReplica:

enabled: false

annotations: {}

## Port for Alertmanager Service per replica to listen on

##

port: 9093

## To be used with a proxy extraContainer port

targetPort: 9093

## Port to expose on each node

## Only used if servicePerReplica.type is 'NodePort'

##

nodePort: 30904

## Loadbalancer source IP ranges

## Only used if servicePerReplica.type is "LoadBalancer"

loadBalancerSourceRanges: []

## Denotes if this Service desires to route external traffic to node-local or cluster-wide endpoints

##

externalTrafficPolicy: Cluster

## Service type

##

type: ClusterIP

## Configuration for creating a ServiceMonitor for AlertManager

##

serviceMonitor:

## If true, a ServiceMonitor will be created for the AlertManager service.

##

selfMonitor: true

## Scrape interval. If not set, the Prometheus default scrape interval is used.

##

interval: ""

## Additional labels

##

additionalLabels: {}

## ScrapeClass to use for this ServiceMonitor, as defined in prometheus.prometheusSpec.scrapeClasses.

## If not set, the default scrape class (if any) is used.

##

scrapeClass: ""

## SampleLimit defines per-scrape limit on number of scraped samples that will be accepted.

##

sampleLimit: 0

## TargetLimit defines a limit on the number of scraped targets that will be accepted.

##

targetLimit: 0

## Per-scrape limit on number of labels that will be accepted for a sample. Only valid in Prometheus versions 2.27.0 and newer.

##

labelLimit: 0

## Per-scrape limit on length of labels name that will be accepted for a sample. Only valid in Prometheus versions 2.27.0 and newer.

##

labelNameLengthLimit: 0

## Per-scrape limit on length of labels value that will be accepted for a sample. Only valid in Prometheus versions 2.27.0 and newer.

##

labelValueLengthLimit: 0

## proxyUrl: URL of a proxy that should be used for scraping.

##

proxyUrl: ""

## scheme: HTTP scheme to use for scraping. Can be used with `tlsConfig` for example if using istio mTLS.

scheme: ""

## enableHttp2: Whether to enable HTTP2.

## See https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api-reference/api.md#endpoint

enableHttp2: true

## tlsConfig: TLS configuration to use when scraping the endpoint. For example if using istio mTLS.

## Of type: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api-reference/api.md#tlsconfig

tlsConfig: {}

bearerTokenFile:

## MetricRelabelConfigs to apply to samples after scraping, but before ingestion.

## ref: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api-reference/api.md#relabelconfig

##

metricRelabelings: []

# - action: keep

# regex: 'kube_(daemonset|deployment|pod|namespace|node|statefulset).+'

# sourceLabels: [__name__]

## RelabelConfigs to apply to samples before scraping

## ref: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api-reference/api.md#relabelconfig

##

relabelings: []

# - sourceLabels: [__meta_kubernetes_pod_node_name]

# separator: ;

# regex: ^(.*)$

# targetLabel: nodename

# replacement: $1

# action: replace

## Additional Endpoints

##

additionalEndpoints: []

# - port: oauth-metrics

# path: /metrics

## Settings affecting alertmanagerSpec

## ref: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api-reference/api.md#alertmanagerspec

##

alertmanagerSpec:

## Statefulset's persistent volume claim retention policy

## whenDeleted and whenScaled determine whether

## statefulset's PVCs are deleted (true) or retained (false)

## on scaling down and deleting statefulset, respectively.

## Requires Kubernetes version 1.27.0+.

## Ref: https://kubernetes.io/docs/concepts/workloads/controllers/statefulset/#persistentvolumeclaim-retention

persistentVolumeClaimRetentionPolicy: {}

# whenDeleted: Retain

# whenScaled: Retain

## Standard object's metadata. More info: https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#metadata

## Metadata Labels and Annotations gets propagated to the Alertmanager pods.

##

podMetadata: {}

##

serviceName:

## Image of Alertmanager

##

image:

registry: cgr.dev

repository: chainguard-private/prometheus-alertmanager

tag: 0.34.2-r0

sha: sha256:e224581085925e647fae90b76ec8f3eb8a48cb33cfa7464552cb4d058edeb0a6

pullPolicy: IfNotPresent

## If true then the user will be responsible to provide a secret with alertmanager configuration

## So when true the config part will be ignored (including templateFiles) and the one in the secret will be used

##

useExistingSecret: false

## Secrets is a list of Secrets in the same namespace as the Alertmanager object, which shall be mounted into the

## Alertmanager Pods. The Secrets are mounted into /etc/alertmanager/secrets/.

##

secrets: []

## If false then the user will opt out of automounting API credentials.

##

automountServiceAccountToken: true

## ConfigMaps is a list of ConfigMaps in the same namespace as the Alertmanager object, which shall be mounted into the Alertmanager Pods.

## The ConfigMaps are mounted into /etc/alertmanager/configmaps/.

##

configMaps: []

## ConfigSecret is the name of a Kubernetes Secret in the same namespace as the Alertmanager object, which contains configuration for

## this Alertmanager instance. Defaults to 'alertmanager-' The secret is mounted into /etc/alertmanager/config.

##

# configSecret:

## WebTLSConfig defines the TLS parameters for HTTPS

## ref: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api-reference/api.md#alertmanagerwebspec

web: {}

## AlertmanagerConfigs to be selected to merge and configure Alertmanager with.

##

alertmanagerConfigSelector: {}

## Example which selects all alertmanagerConfig resources

## with label "alertconfig" with values any of "example-config" or "example-config-2"

# alertmanagerConfigSelector:

# matchExpressions:

# - key: alertconfig

# operator: In

# values:

# - example-config

# - example-config-2

#

## Example which selects all alertmanagerConfig resources with label "role" set to "example-config"

# alertmanagerConfigSelector:

# matchLabels:

# role: example-config

## Namespaces to be selected for AlertmanagerConfig discovery. If nil, only check own namespace.

##

alertmanagerConfigNamespaceSelector: {}

## Example which selects all namespaces

## with label "alertmanagerconfig" with values any of "example-namespace" or "example-namespace-2"

# alertmanagerConfigNamespaceSelector:

# matchExpressions:

# - key: alertmanagerconfig

# operator: In

# values:

# - example-namespace

# - example-namespace-2

## Example which selects all namespaces with label "alertmanagerconfig" set to "enabled"

# alertmanagerConfigNamespaceSelector:

# matchLabels:

# alertmanagerconfig: enabled

## AlermanagerConfig to be used as top level configuration

##

alertmanagerConfiguration: {}

## Example with select a global alertmanagerconfig

# alertmanagerConfiguration:

# name: global-alertmanager-Configuration

## Defines the strategy used by AlertmanagerConfig objects to match alerts. eg:

##

alertmanagerConfigMatcherStrategy: {}

## Example with use OnNamespace strategy

# alertmanagerConfigMatcherStrategy:

# type: OnNamespace

## Additional command line arguments to pass to Alertmanager (in addition to those generated by the chart)

additionalArgs: []

## Define Log Format

# Use logfmt (default) or json logging

logFormat: logfmt

## Log level for Alertmanager to be configured with.

##

logLevel: info

## Size is the expected size of the alertmanager cluster. The controller will eventually make the size of the

## running cluster equal to the expected size.

replicas: 1

## Time duration Alertmanager shall retain data for. Default is '120h', and must match the regular expression

## [0-9]+(ms|s|m|h) (milliseconds seconds minutes hours).

##

retention: 120h

## Storage is the definition of how storage will be used by the Alertmanager instances.

## ref: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/platform/storage.md

##

storage: {}

# volumeClaimTemplate:

# spec:

# storageClassName: gluster

# accessModes: ["ReadWriteOnce"]

# resources:

# requests:

# storage: 50Gi

# selector: {}

## The external URL the Alertmanager instances will be available under. This is necessary to generate correct URLs. This is necessary if Alertmanager is not served from root of a DNS name. string false

##

externalUrl:

## The route prefix Alertmanager registers HTTP handlers for. This is useful, if using ExternalURL and a proxy is rewriting HTTP routes of a request, and the actual ExternalURL is still true,

## but the server serves requests under a different route prefix. For example for use with kubectl proxy.

##

routePrefix: /

## scheme: HTTP scheme to use. Can be used with `tlsConfig` for example if using istio mTLS.

scheme: ""

## tlsConfig: TLS configuration to use when connect to the endpoint. For example if using istio mTLS.

## Of type: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api-reference/api.md#tlsconfig

tlsConfig: {}

## If set to true all actions on the underlying managed objects are not going to be performed, except for delete actions.

##

paused: false

## Define which Nodes the Pods are scheduled on.

## ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#nodeselector

##

nodeSelector:

kubernetes.io/os: linux

## Define resources requests and limits for single Pods.

## ref: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/

##

resources: {}

# requests:

# memory: 400Mi

## Pod anti-affinity can prevent the scheduler from placing Prometheus replicas on the same node.

## The default value "soft" means that the scheduler should *prefer* to not schedule two replica pods onto the same node but no guarantee is provided.

## The value "hard" means that the scheduler is *required* to not schedule two replica pods onto the same node.

## The value "" will disable pod anti-affinity so that no anti-affinity rules will be configured.

##

podAntiAffinity: "soft"

## If anti-affinity is enabled sets the topologyKey to use for anti-affinity.

## This can be changed to, for example, failure-domain.beta.kubernetes.io/zone

##

podAntiAffinityTopologyKey: kubernetes.io/hostname

## Assign custom affinity rules to the alertmanager instance

## ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/

##

affinity: {}

# nodeAffinity:

# requiredDuringSchedulingIgnoredDuringExecution:

# nodeSelectorTerms:

# - matchExpressions:

# - key: kubernetes.io/e2e-az-name

# operator: In

# values:

# - e2e-az1

# - e2e-az2

## If specified, the pod's tolerations.

## ref: https://kubernetes.io/docs/concepts/scheduling-eviction/taint-and-toleration/

##

tolerations: []

# - key: "key"

# operator: "Equal"

# value: "value"

# effect: "NoSchedule"

## If specified, the pod's topology spread constraints.

## ref: https://kubernetes.io/docs/concepts/scheduling-eviction/topology-spread-constraints/

##

topologySpreadConstraints: []

# - maxSkew: 1

# topologyKey: topology.kubernetes.io/zone

# whenUnsatisfiable: DoNotSchedule

# labelSelector:

# matchLabels:

# app: alertmanager

## SecurityContext holds pod-level security attributes and common container settings.

## This defaults to non root user with uid 1000 and gid 2000. *v1.PodSecurityContext false

## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/

##

securityContext:

runAsGroup: 2000

runAsNonRoot: true

runAsUser: 1000

fsGroup: 2000

seccompProfile:

type: RuntimeDefault

## Use the host's user namespace for Alertmanager pods.

## ref: https://kubernetes.io/docs/tasks/configure-pod-container/user-namespaces/

hostUsers: ~

## DNS configuration for Alertmanager.

## ref: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api-reference/api.md#monitoring.coreos.com/v1.PodDNSConfig

dnsConfig: {}

## DNS policy for Alertmanager.

## ref: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api-reference/api.md#dnspolicystring-alias

dnsPolicy: ""

## Enable hostNetwork for Alertmanager.

hostNetwork: ~

## ListenLocal makes the Alertmanager server listen on loopback, so that it does not bind against the Pod IP.

## Note this is only for the Alertmanager UI, not the gossip communication.

##

listenLocal: false

## Containers allows injecting additional containers. This is meant to allow adding an authentication proxy to an Alertmanager pod.

##

containers: []

# containers:

# - name: oauth-proxy

# image: quay.io/oauth2-proxy/oauth2-proxy:v7.15.5

# args:

# - --upstream=http://127.0.0.1:9093

# - --http-address=0.0.0.0:8081

# - --metrics-address=0.0.0.0:8082

# - ...

# ports:

# - containerPort: 8081

# name: oauth-proxy

# protocol: TCP

# - containerPort: 8082

# name: oauth-metrics

# protocol: TCP

# resources: {}

# Additional volumes on the output StatefulSet definition.

volumes: []

# Additional VolumeMounts on the output StatefulSet definition.

volumeMounts: []

## InitContainers allows injecting additional initContainers. This is meant to allow doing some changes

## (permissions, dir tree) on mounted volumes before starting prometheus

initContainers: []

## Priority class assigned to the Pods

##

priorityClassName: ""

## AdditionalPeers allows injecting a set of additional Alertmanagers to peer with to form a highly available cluster.

##

additionalPeers: []

## PortName to use for Alert Manager.

##

portName: "http-web"

## ClusterAdvertiseAddress is the explicit address to advertise in cluster. Needs to be provided for non RFC1918 [1] (public) addresses. [1] RFC1918: https://tools.ietf.org/html/rfc1918

##

clusterAdvertiseAddress: false

## clusterGossipInterval determines interval between gossip attempts.

## Needs to be specified as GoDuration, a time duration that can be parsed by Go's time.ParseDuration() (e.g. 45ms, 30s, 1m, 1h20m15s)

clusterGossipInterval: ""

## clusterPeerName defines the name this instance advertises to other cluster peers, defaulting to the pod name.

## Literal values and references to environment variables available in the container (e.g. "$(POD_NAME).$(NAMESPACE)") are both accepted.

## Requires Alertmanager >= v0.30.0.

clusterPeerName: ""

## clusterPeerTimeout determines timeout for cluster peering.

## Needs to be specified as GoDuration, a time duration that can be parsed by Go's time.ParseDuration() (e.g. 45ms, 30s, 1m, 1h20m15s)

clusterPeerTimeout: ""

## clusterPushpullInterval determines interval between pushpull attempts.

## Needs to be specified as GoDuration, a time duration that can be parsed by Go's time.ParseDuration() (e.g. 45ms, 30s, 1m, 1h20m15s)

clusterPushpullInterval: ""

## clusterLabel defines the identifier that uniquely identifies the Alertmanager cluster.

clusterLabel: ""

## ForceEnableClusterMode ensures Alertmanager does not deactivate the cluster mode when running with a single replica.

## Use case is e.g. spanning an Alertmanager cluster across Kubernetes clusters with a single replica in each.

forceEnableClusterMode: false

## Minimum number of seconds for which a newly created pod should be ready without any of its container crashing for it to

## be considered available. Defaults to 0 (pod will be considered available as soon as it is ready).

minReadySeconds: 0

## Pod management policy. Kubernetes default is OrderedReady but prometheus-operator default is Parallel.

## ref: https://kubernetes.io/docs/concepts/workloads/controllers/statefulset/#pod-management-policies

podManagementPolicy: ""

## Update strategy for the StatefulSet.

## ref: https://kubernetes.io/docs/concepts/workloads/controllers/statefulset/#update-strategies

updateStrategy: {}

# type: RollingUpdate

# rollingUpdate:

# maxUnavailable: 1

## Duration in seconds the pod needs to terminate gracefully.

## ref: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle/#pod-termination

terminationGracePeriodSeconds: ~

## EnableServiceLinks indicates whether information about services should be injected into the

## pod's environment variables. Uses the operator/Kubernetes default when left unset (~).

enableServiceLinks: ~

## Set the scheduler name to use for the Alertmanager pods.

schedulerName: ""

## Pods' hostAliases configuration

## ref: https://kubernetes.io/docs/concepts/services-networking/add-entries-to-pod-etc-hosts-with-host-aliases/

hostAliases: []

# - ip: 10.10.0.100

# hostnames:

# - a1.app.local

## Limits defines the Alertmanager limits command line flags. Requires Alertmanager >= v0.28.0.

## ref: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api-reference/api.md#monitoring.coreos.com/v1.AlertmanagerLimitsSpec

limits: {}

# maxSilences: 1000

# maxPerSilenceBytes: 1MB

## ClusterTLS defines the mutual TLS configuration for the Alertmanager cluster's gossip protocol.

## Requires Alertmanager >= v0.24.0.

## ref: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api-reference/api.md#monitoring.coreos.com/v1.ClusterTLSConfig

clusterTLS: {}

## Additional configuration which is not covered by the properties above. (passed through tpl)

additionalConfig: {}

## Additional configuration which is not covered by the properties above.

## Useful, if you need advanced templating inside alertmanagerSpec.

## Otherwise, use alertmanager.alertmanagerSpec.additionalConfig (passed through tpl)

additionalConfigString: ""

## ExtraSecret can be used to store various data in an extra secret

## (use it for example to store hashed basic auth credentials)

extraSecret:

## if not set, name will be auto generated

# name: ""

annotations: {}

data: {}

# auth: |

# foo:$apr1$OFG3Xybp$ckL0FHDAkoXYIlH9.cysT0

# someoneelse:$apr1$DMZX2Z4q$6SbQIfyuLQd.xmo/P0m2c.

## Using default values from https://github.com/grafana-community/helm-charts/blob/main/charts/grafana/values.yaml

##

grafana:

enabled: true

namespaceOverride: ""

## ForceDeployDatasources Create datasource configmap even if grafana deployment has been disabled

##

forceDeployDatasources: false

## ForceDeployDashboard Create dashboard configmap even if grafana deployment has been disabled

##

forceDeployDashboards: false

## Deploy default dashboards

##

defaultDashboardsEnabled: true

## Deploy GrafanaDashboard CRDs that reference dashboards from ConfigMaps when grafana-operator is used

## These settings control how dashboards are integrated with the Grafana Operator

## Note: With operator.datasourcesEnabled disabled, end users still need to create their own

## kind: GrafanaDatasource for Prometheus

## eg:

## apiVersion: grafana.integreatly.org/v1beta1

## kind: GrafanaDatasource

## metadata:

## name: prometheus

## annotations: {}

## spec:

## allowCrossNamespaceImport: true

## instanceSelector:

## matchLabels:

## app: grafana

## datasource:

## name: prometheus

## type: prometheus

## access: proxy

## url: http://prometheus-operated.prometheus-stack.svc.cluster.local:9090

## isDefault: true

## jsonData:

## "tlsSkipVerify": true

## "timeInterval": "5s"

##

operator:

## Enable references to ConfigMaps containing dashboards in GrafanaDashboard CRs

## Set to true to allow dashboards to be loaded from ConfigMap references

dashboardsConfigMapRefEnabled: false

## Provision GrafanaDatasource CRs instead of a file-based datasource ConfigMap

## Covers the default Prometheus datasource, the per-replica Prometheus datasources, the

## Alertmanager datasource and every entry of grafana.additionalDataSources

## An entry of grafana.additionalDataSources may carry `valuesFrom` and `plugins`, both are

## moved from the datasource to the CR spec

## grafana.additionalDataSourcesString, grafana.deleteDatasources and grafana.prune have no CR

## equivalent and keep using the ConfigMap

datasourcesEnabled: false

## Annotations for GrafanaDashboard Cr

##

annotations: {}

## Labels that should be matched kind: Grafana instance

## Example: { app: grafana, category: dashboard }

##

matchLabels: {}

## How frequently the operator should resync resources (in duration format)

## Controls how often dashboards are reconciled by the operator

##

resyncPeriod: 10m

## Which folder contains all dashboards in Grafana

## This folder will be created on the Root level

## Only one of 'folder', 'folderUID' or 'folderRef' can be set

##

folder: General

## Which UID of the target folder contains all dashboards in Grafana

## This allows you to use subfolder hierarchy

## Only one of 'folder', 'folderUID' or 'folderRef' can be set

##

folderUID: null

## Which GrafanaFolder reference contains all dashboards in Grafana

## This allows you to use subfolder hierarchy.

## Only one of 'folder', 'folderUID' or 'folderRef' can be set

##

folderRef: null

## Timezone for the default dashboards

## Other options are: browser or a specific timezone, i.e. Europe/Luxembourg

##

defaultDashboardsTimezone: utc

## Editable flag for the default dashboards

##

defaultDashboardsEditable: true

## Default interval for Grafana dashboards

##

defaultDashboardsInterval: 1m

# Administrator credentials when not using an existing secret (see below)

adminUser: admin

# adminPassword: strongpassword

# Use an existing secret for the admin user.

admin:

## Name of the secret. Can be templated.

existingSecret: ""

userKey: admin-user

passwordKey: admin-password

rbac:

## If true, Grafana PSPs will be created

##

pspEnabled: false

ingress:

## If true, Grafana Ingress will be created

##

enabled: false

## IngressClassName for Grafana Ingress.

## Should be provided if Ingress is enable.

##

# ingressClassName: nginx

## Annotations for Grafana Ingress

##

annotations: {}

# kubernetes.io/ingress.class: nginx

# kubernetes.io/tls-acme: "true"

## Labels to be added to the Ingress

##

labels: {}

## Hostnames.

## Must be provided if Ingress is enable.

##

# hosts:

# - grafana.domain.com

hosts: []

## Path for grafana ingress

path: /

## TLS configuration for grafana Ingress

## Secret must be manually created in the namespace

##

tls: []

# - secretName: grafana-general-tls

# hosts:

# - grafana.example.com

# # To make Grafana persistent (Using Statefulset)

# #

# persistence:

# enabled: true

# type: sts

# storageClassName: "storageClassName"

# accessModes:

# - ReadWriteOnce

# size: 20Gi

# finalizers:

# - kubernetes.io/pvc-protection

serviceAccount:

create: true

autoMount: true

sidecar:

dashboards:

enabled: true

label: grafana_dashboard

labelValue: "1"

# Allow discovery in all namespaces for dashboards

searchNamespace: ALL

# Support for new table panels, when enabled grafana auto migrates the old table panels to newer table panels

enableNewTablePanelSyntax: false

## Annotations for Grafana dashboard configmaps

##

annotations: {}

## Annotation the sidecar reads to decide in which Grafana folder a dashboard

## is stored. Requires `provider.foldersFromFilesStructure` to be enabled.

## ref: https://github.com/grafana/helm-charts/tree/main/charts/grafana#sidecar-for-dashboards

##

# folderAnnotation: grafana_folder

multicluster:

global:

enabled: false

etcd:

enabled: false

provider:

allowUiUpdates: false

## Let Grafana replicate the dashboard folder structure created by the sidecar,

## so dashboards are grouped into folders instead of the default one.

## Required when using `folderAnnotation` above.

##

# foldersFromFilesStructure: true

datasources:

enabled: true

defaultDatasourceEnabled: true

isDefaultDatasource: true

name: Prometheus

uid: prometheus

## Extra jsonData properties to add to the datasource

# extraJsonData:

# prometheusType: Prometheus

## URL of prometheus datasource

##

# url: http://prometheus-stack-prometheus:9090/

## Prometheus request timeout in seconds

# timeout: 30

## Query parameters to add, as a URL-encoded string,

## to query Prometheus

# customQueryParameters: ""

# If not defined, will use prometheus.prometheusSpec.scrapeInterval or its default

# defaultDatasourceScrapeInterval: 15s

## Annotations for Grafana datasource configmaps

##

annotations: {}

## Set method for HTTP to send query to datasource

httpMethod: POST

## Create datasource for each Pod of Prometheus StatefulSet;

## this uses by default the headless service `prometheus-operated` which is

## created by Prometheus Operator. In case you deployed your own Service for your

## Prometheus instance, you can specify it with the field `prometheusServiceName`

## ref: https://github.com/prometheus-operator/prometheus-operator/blob/0fee93e12dc7c2ea1218f19ae25ec6b893460590/pkg/prometheus/statefulset.go#L255-L286

createPrometheusReplicasDatasources: false

prometheusServiceName: prometheus-operated

label: grafana_datasource

labelValue: "1"

## Field with internal link pointing to existing data source in Grafana.

## Can be provisioned via additionalDataSources

exemplarTraceIdDestinations: {}

# datasourceUid: Jaeger

# traceIdLabelName: trace_id

# urlDisplayLabel: View traces

alertmanager:

enabled: true

name: Alertmanager

uid: alertmanager

handleGrafanaManagedAlerts: false

implementation: prometheus

extraConfigmapMounts: []

# - name: certs-configmap

# mountPath: /etc/grafana/ssl/

# configMap: certs-configmap

# readOnly: true

deleteDatasources: []

# - name: example-datasource

# orgId: 1

## Configure additional grafana datasources (passed through tpl)

## ref: https://grafana.com/docs/grafana/latest/administration/provisioning/#datasources

additionalDataSources: []

# - name: prometheus-sample

# access: proxy

# basicAuth: true

# secureJsonData:

# basicAuthPassword: pass

# basicAuthUser: daco

# editable: false

# jsonData:

# tlsSkipVerify: true

# orgId: 1

# type: prometheus

# url: https://{{ printf "%s-prometheus.svc" .Release.Name }}:9090

# version: 1

## Configure additional grafana datasources as a templated string (passed through tpl)

## Useful when you need Helm flow control or templating inside the datasource definition

additionalDataSourcesString: ""

# Flag to mark provisioned data sources for deletion if they are no longer configured.

# It takes no effect if data sources are already listed in the deleteDatasources section.

# ref: https://grafana.com/docs/grafana/latest/administration/provisioning/#example-data-source-configuration-file

prune: false

## Passed to grafana subchart and used by servicemonitor below

##

service:

portName: http-web

ipFamilies: []

ipFamilyPolicy: ""

serviceMonitor:

# If true, a ServiceMonitor CRD is created for a prometheus operator

# https://github.com/prometheus-operator/prometheus-operator

#

enabled: true

# Path to use for scraping metrics. Might be different if server.root_url is set

# in grafana.ini

# path: /metrics

# namespace: monitoring (defaults to use the namespace this chart is deployed to)

# labels for the ServiceMonitor

# labels: {}

# Extra scrape settings.

# interval: ""

# scheme: http

# tlsConfig: {}

# scrapeTimeout: 30s

## RelabelConfigs to apply to samples before scraping

## ref: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api-reference/api.md#relabelconfig

##

# relabelings: []

# - sourceLabels: [__meta_kubernetes_pod_node_name]

# separator: ;

# regex: ^(.*)$

# targetLabel: nodename

# replacement: $1

# action: replace

## Flag to disable all the kubernetes component scrapers

##

kubernetesServiceMonitors:

enabled: true

## Component scraping the kube api server

##

kubeApiServer:

enabled: true

## TLS configuration of the ServiceMonitor endpoint. Rendered as-is, so any field of the

## Prometheus Operator SafeTLSConfig type can be set here.

## ref: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api-reference/api.md#monitoring.coreos.com/v1.SafeTLSConfig

##

tlsConfig:

serverName: kubernetes

insecureSkipVerify: false

ca:

configMap:

name: kube-root-ca.crt

key: ca.crt

serviceMonitor:

enabled: true

## Scrape interval. If not set, the Prometheus default scrape interval is used.

##

interval: ""

## Bearer credentials used to scrape this component. Rendered as-is, so any field of the

## Prometheus Operator SafeAuthorization type can be set here. Set to null to scrape without

## authentication.

## ref: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api-reference/api.md#monitoring.coreos.com/v1.SafeAuthorization

##

authorization:

type: Bearer

credentials:

name: '{{ include "kube-prometheus-stack.prometheus.tokenSecretName" . }}'

key: token

## ScrapeClass to use for this ServiceMonitor, as defined in prometheus.prometheusSpec.scrapeClasses.

## If not set, the default scrape class (if any) is used.

##

scrapeClass: ""

## SampleLimit defines per-scrape limit on number of scraped samples that will be accepted.

##

sampleLimit: 0

## TargetLimit defines a limit on the number of scraped targets that will be accepted.

##

targetLimit: 0

## Per-scrape limit on number of labels that will be accepted for a sample. Only valid in Prometheus versions 2.27.0 and newer.

##

labelLimit: 0

## Per-scrape limit on length of labels name that will be accepted for a sample. Only valid in Prometheus versions 2.27.0 and newer.

##

labelNameLengthLimit: 0

## Per-scrape limit on length of labels value that will be accepted for a sample. Only valid in Prometheus versions 2.27.0 and newer.

##

labelValueLengthLimit: 0

## proxyUrl: URL of a proxy that should be used for scraping.

##

proxyUrl: ""

jobLabel: component

selector:

matchLabels:

component: apiserver

provider: kubernetes

## MetricRelabelConfigs to apply to samples after scraping, but before ingestion.

## ref: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api-reference/api.md#relabelconfig

##

metricRelabelings:

# Drop excessively noisy apiserver buckets.

- action: drop

regex: (etcd_request|apiserver_request_slo|apiserver_request_sli|apiserver_request)_duration_seconds_bucket;(0\.15|0\.2|0\.3|0\.35|0\.4|0\.45|0\.6|0\.7|0\.8|0\.9|1\.25|1\.5|1\.75|2|3|3\.5|4|4\.5|6|7|8|9|15|20|40|45|50)(\.0)?

sourceLabels:

- __name__

- le

# - action: keep

# regex: 'kube_(daemonset|deployment|pod|namespace|node|statefulset).+'

# sourceLabels: [__name__]

## RelabelConfigs to apply to samples before scraping

## ref: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api-reference/api.md#relabelconfig

##

relabelings: []

# - sourceLabels:

# - __meta_kubernetes_namespace

# - __meta_kubernetes_service_name

# - __meta_kubernetes_endpoint_port_name

# action: keep

# regex: default;kubernetes;https

# - targetLabel: __address__

# replacement: kubernetes.default.svc:443

## Additional labels

##

additionalLabels: {}

# foo: bar

## defines the labels which are transferred from the associated Kubernetes Service object onto the ingested metrics.

## https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api-reference/api.md#servicemonitor

targetLabels: []

## Override the job label used for the apiserver.

## This allows users who scrape apiserver metrics under a different job name (e.g. k3s-server via PushProx)

## to align the recording rules and alerts with their actual job label.

jobNameOverride: ""

## Component scraping the kubelet and kubelet-hosted cAdvisor

##

kubelet:

enabled: true

namespace: kube-system

# Overrides the job selector in Grafana dashboards and Prometheus rules

# For k3s clusters, change to k3s-server

jobNameOverride: ""

serviceMonitor:

enabled: true

## Enable scraping /metrics from kubelet's service

kubelet: true

## Attach metadata to discovered targets. Requires Prometheus v2.45 for endpoints created by the operator.

##

attachMetadata:

node: false

## Scrape interval. If not set, the Prometheus default scrape interval is used.

##

interval: ""

## If true, Prometheus use (respect) labels provided by exporter.

##

honorLabels: true

## If true, Prometheus ingests metrics with timestamp provided by exporter. If false, Prometheus ingests metrics with timestamp of scrape.

##

honorTimestamps: true

## If true, defines whether Prometheus tracks staleness of the metrics that have an explicit timestamp present in scraped data. Has no effect if `honorTimestamps` is false.

## We recommend enabling this if you want the best possible accuracy for container_ metrics scraped from cadvisor.

## For more details see: https://github.com/prometheus-community/helm-charts/pull/5063#issuecomment-2545374849

trackTimestampsStaleness: true

## ScrapeClass to use for this ServiceMonitor, as defined in prometheus.prometheusSpec.scrapeClasses.

## If not set, the default scrape class (if any) is used.

##

scrapeClass: ""

## SampleLimit defines per-scrape limit on number of scraped samples that will be accepted.

##

sampleLimit: 0

## TargetLimit defines a limit on the number of scraped targets that will be accepted.

##

targetLimit: 0

## Per-scrape limit on number of labels that will be accepted for a sample. Only valid in Prometheus versions 2.27.0 and newer.

##

labelLimit: 0

## Per-scrape limit on length of labels name that will be accepted for a sample. Only valid in Prometheus versions 2.27.0 and newer.

##

labelNameLengthLimit: 0

## Per-scrape limit on length of labels value that will be accepted for a sample. Only valid in Prometheus versions 2.27.0 and newer.

##

labelValueLengthLimit: 0

## proxyUrl: URL of a proxy that should be used for scraping.

##

proxyUrl: ""

## Enable scraping the kubelet over https. For requirements to enable this see

## https://github.com/prometheus-operator/prometheus-operator/issues/926

##

https: true

## Bearer credentials used to scrape this component. Rendered as-is, so any field of the

## Prometheus Operator SafeAuthorization type can be set here. Set to null to scrape without

## authentication.

## ref: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api-reference/api.md#monitoring.coreos.com/v1.SafeAuthorization

##

authorization:

type: Bearer

credentials:

name: '{{ include "kube-prometheus-stack.prometheus.tokenSecretName" . }}'

key: token

## TLS configuration of the ServiceMonitor endpoint. Only applies when scraping over https.

## Rendered as-is, so any field of the Prometheus Operator SafeTLSConfig type can be set here.

## insecureSkipVerify is enabled by default because the kubelet serving certificate deployed by

## kubeadm is self-signed.

## ref: https://kubernetes.io/docs/tasks/administer-cluster/kubeadm/kubeadm-certs/#kubelet-serving-certs

## ref: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api-reference/api.md#monitoring.coreos.com/v1.SafeTLSConfig

##

tlsConfig:

insecureSkipVerify: true

ca:

configMap:

name: kube-root-ca.crt

key: ca.crt

## Enable scraping /metrics/probes from kubelet's service

##

probes: true

## Enable scraping /metrics/resource from kubelet's service

## This is disabled by default because container metrics are already exposed by cAdvisor

##

resource: false

# From kubernetes 1.18, /metrics/resource/v1alpha1 renamed to /metrics/resource

resourcePath: "/metrics/resource/v1alpha1"

## Configure the scrape interval for resource metrics. This is configured to the default Kubelet cAdvisor

## minimum housekeeping interval in order to avoid missing samples. Note, this value is ignored

## if kubelet.serviceMonitor.interval is not empty.

resourceInterval: 10s

## Enable scraping /metrics/cadvisor from kubelet's service

##

cAdvisor: true

## Configure the scrape interval for cAdvisor. This is configured to the default Kubelet cAdvisor

## minimum housekeeping interval in order to avoid missing samples. Note, this value is ignored

## if kubelet.serviceMonitor.interval is not empty.

cAdvisorInterval: 10s

## MetricRelabelConfigs to apply to samples after scraping, but before ingestion.

## ref: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api-reference/api.md#relabelconfig

##

cAdvisorMetricRelabelings:

# Drop less useful container CPU metrics.

- sourceLabels: [__name__]

action: drop

regex: 'container_cpu_(cfs_throttled_seconds_total|load_average_10s|system_seconds_total|user_seconds_total)'

# Drop less useful container / always zero filesystem metrics.

- sourceLabels: [__name__]

action: drop

regex: 'container_fs_(io_current|io_time_seconds_total|io_time_weighted_seconds_total|reads_merged_total|sector_reads_total|sector_writes_total|writes_merged_total)'

# Drop less useful container memory metrics. container_memory_swap is kept because the

# k8s.rules.container_memory_swap recording rule and the "Memory Usage (Swap)" columns

# of the Compute Resources dashboards are built on it.

- sourceLabels: [__name__]

action: drop

regex: 'container_memory_mapped_file'

# Drop less useful container process metrics.

- sourceLabels: [__name__]

action: drop

regex: 'container_(file_descriptors|tasks_state|threads_max)'

# Drop container_memory_failures_total{scope="hierarchy"} metrics,

# we only need the container scope.

- sourceLabels: [__name__, scope]

action: drop

regex: 'container_memory_failures_total;hierarchy'

# Drop container_network_... metrics that match various interfaces that

# correspond to CNI and similar interfaces. This avoids capturing network

# metrics for host network containers.

- sourceLabels: [__name__, interface]

action: drop

regex: 'container_network_.*;(cali|cilium|cni|lxc|nodelocaldns|tunl).*'

# Drop container spec metrics that overlap with kube-state-metrics.

- sourceLabels: [__name__]

action: drop

regex: 'container_spec.*'

# Drop cgroup metrics with no pod.

- sourceLabels: [id, pod]

action: drop

regex: '.+;'

# - sourceLabels: [__name__, image]

# separator: ;

# regex: container_([a-z_]+);

# replacement: $1

# action: drop

# - sourceLabels: [__name__]

# separator: ;

# regex: container_(network_tcp_usage_total|network_udp_usage_total|tasks_state|cpu_load_average_10s)

# replacement: $1

# action: drop

## MetricRelabelConfigs to apply to samples after scraping, but before ingestion.

## ref: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api-reference/api.md#relabelconfig

##

probesMetricRelabelings: []

# - sourceLabels: [__name__, image]

# separator: ;

# regex: container_([a-z_]+);

# replacement: $1

# action: drop

# - sourceLabels: [__name__]

# separator: ;

# regex: container_(network_tcp_usage_total|network_udp_usage_total|tasks_state|cpu_load_average_10s)

# replacement: $1

# action: drop

## RelabelConfigs to apply to samples before scraping

## ref: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api-reference/api.md#relabelconfig

##

## metrics_path is required to match upstream rules and charts

cAdvisorRelabelings:

- action: replace

sourceLabels: [__metrics_path__]

targetLabel: metrics_path

# - sourceLabels: [__meta_kubernetes_pod_node_name]

# separator: ;

# regex: ^(.*)$

# targetLabel: nodename

# replacement: $1

# action: replace

## RelabelConfigs to apply to samples before scraping

## ref: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api-reference/api.md#relabelconfig

##

probesRelabelings:

- action: replace

sourceLabels: [__metrics_path__]

targetLabel: metrics_path

# - sourceLabels: [__meta_kubernetes_pod_node_name]

# separator: ;

# regex: ^(.*)$

# targetLabel: nodename

# replacement: $1

# action: replace

## RelabelConfigs to apply to samples before scraping

## ref: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api-reference/api.md#relabelconfig

##

resourceRelabelings:

- action: replace

sourceLabels: [__metrics_path__]

targetLabel: metrics_path

# - sourceLabels: [__meta_kubernetes_pod_node_name]

# separator: ;

# regex: ^(.*)$

# targetLabel: nodename

# replacement: $1

# action: replace

## MetricRelabelConfigs to apply to samples after scraping, but before ingestion.

## ref: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api-reference/api.md#relabelconfig

##

metricRelabelings:

# Reduce bucket cardinality of kubelet storage operations.

- action: drop

sourceLabels: [__name__, le]

regex: (csi_operations|storage_operation_duration)_seconds_bucket;(0.25|2.5|15|25|120|600)(\.0)?

# - sourceLabels: [__name__, image]

# separator: ;

# regex: container_([a-z_]+);

# replacement: $1

# action: drop

# - sourceLabels: [__name__]

# separator: ;

# regex: container_(network_tcp_usage_total|network_udp_usage_total|tasks_state|cpu_load_average_10s)

# replacement: $1

# action: drop

## RelabelConfigs to apply to samples before scraping

## ref: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api-reference/api.md#relabelconfig

##

## metrics_path is required to match upstream rules and charts

relabelings:

- action: replace

sourceLabels: [__metrics_path__]

targetLabel: metrics_path

# - sourceLabels: [__meta_kubernetes_pod_node_name]

# separator: ;

# regex: ^(.*)$

# targetLabel: nodename

# replacement: $1

# action: replace

## Additional labels

##

additionalLabels: {}

# foo: bar

## defines the labels which are transferred from the associated Kubernetes Service object onto the ingested metrics.

## https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api-reference/api.md#servicemonitor

targetLabels: []

## Component scraping the kube controller manager

##

kubeControllerManager:

enabled: true

# Overrides the job selector in Grafana dashboards and Prometheus rules

# For k3s clusters, change to k3s-server

jobNameOverride: ""

## If your kube controller manager is not deployed as a pod, specify IPs it can be found on

##

endpoints: []

# - 10.141.4.22

# - 10.141.4.23

# - 10.141.4.24

## If using kubeControllerManager.endpoints only the port and targetPort are used

##

service:

enabled: true

## If null or unset, the value is determined dynamically based on target Kubernetes version due to change

## of default port in Kubernetes 1.22.

##

port: null

targetPort: null

ipDualStack:

enabled: false

ipFamilies: ["IPv6", "IPv4"]

ipFamilyPolicy: "PreferDualStack"

# selector:

# component: kube-controller-manager

serviceMonitor:

enabled: true

## Scrape interval. If not set, the Prometheus default scrape interval is used.

##

interval: ""

## ScrapeClass to use for this ServiceMonitor, as defined in prometheus.prometheusSpec.scrapeClasses.

## If not set, the default scrape class (if any) is used.

##

scrapeClass: ""

## SampleLimit defines per-scrape limit on number of scraped samples that will be accepted.

##

sampleLimit: 0

## TargetLimit defines a limit on the number of scraped targets that will be accepted.

##

targetLimit: 0

## Per-scrape limit on number of labels that will be accepted for a sample. Only valid in Prometheus versions 2.27.0 and newer.

##

labelLimit: 0

## Per-scrape limit on length of labels name that will be accepted for a sample. Only valid in Prometheus versions 2.27.0 and newer.

##

labelNameLengthLimit: 0

## Per-scrape limit on length of labels value that will be accepted for a sample. Only valid in Prometheus versions 2.27.0 and newer.

##

labelValueLengthLimit: 0

## proxyUrl: URL of a proxy that should be used for scraping.

##

proxyUrl: ""

## port: Name of the port the metrics will be scraped from

##

port: http-metrics

jobLabel: jobLabel

selector: {}

# matchLabels:

# component: kube-controller-manager

## Enable scraping kube-controller-manager over https.

## Requires proper certs (not self-signed) and delegated authentication/authorization checks.

## If null or unset, the value is determined dynamically based on target Kubernetes version.

##

https: null

## Bearer credentials used to scrape this component. Rendered as-is, so any field of the

## Prometheus Operator SafeAuthorization type can be set here. Set to null to scrape without

## authentication.

## ref: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api-reference/api.md#monitoring.coreos.com/v1.SafeAuthorization

##

authorization:

type: Bearer

credentials:

name: '{{ include "kube-prometheus-stack.prometheus.tokenSecretName" . }}'

key: token

## TLS configuration of the ServiceMonitor endpoint. Only applies when scraping over https.

## Rendered as-is, so any field of the Prometheus Operator SafeTLSConfig type can be set here.

## ref: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api-reference/api.md#monitoring.coreos.com/v1.SafeTLSConfig

##

tlsConfig:

insecureSkipVerify: true

ca:

configMap:

name: kube-root-ca.crt

key: ca.crt

## MetricRelabelConfigs to apply to samples after scraping, but before ingestion.

## ref: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api-reference/api.md#relabelconfig

##

metricRelabelings: []

# - action: keep

# regex: 'kube_(daemonset|deployment|pod|namespace|node|statefulset).+'

# sourceLabels: [__name__]

## RelabelConfigs to apply to samples before scraping

## ref: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api-reference/api.md#relabelconfig

##

relabelings: []

# - sourceLabels: [__meta_kubernetes_pod_node_name]

# separator: ;

# regex: ^(.*)$

# targetLabel: nodename

# replacement: $1

# action: replace

## Additional labels

##

additionalLabels: {}

# foo: bar

## defines the labels which are transferred from the associated Kubernetes Service object onto the ingested metrics.

## https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api-reference/api.md#servicemonitor

targetLabels: []

## Component scraping coreDns. Use either this or kubeDns

##

coreDns:

enabled: true

service:

enabled: true

port: 9153

targetPort: 9153

ipDualStack:

enabled: false

ipFamilies: ["IPv6", "IPv4"]

ipFamilyPolicy: "PreferDualStack"

# selector:

# k8s-app: kube-dns

serviceMonitor:

enabled: true

## Scrape interval. If not set, the Prometheus default scrape interval is used.

##

interval: ""

## ScrapeClass to use for this ServiceMonitor, as defined in prometheus.prometheusSpec.scrapeClasses.

## If not set, the default scrape class (if any) is used.

##

scrapeClass: ""

## SampleLimit defines per-scrape limit on number of scraped samples that will be accepted.

##

sampleLimit: 0

## TargetLimit defines a limit on the number of scraped targets that will be accepted.

##

targetLimit: 0

## Per-scrape limit on number of labels that will be accepted for a sample. Only valid in Prometheus versions 2.27.0 and newer.

##

labelLimit: 0

## Per-scrape limit on length of labels name that will be accepted for a sample. Only valid in Prometheus versions 2.27.0 and newer.

##

labelNameLengthLimit: 0

## Per-scrape limit on length of labels value that will be accepted for a sample. Only valid in Prometheus versions 2.27.0 and newer.

##

labelValueLengthLimit: 0

## proxyUrl: URL of a proxy that should be used for scraping.

##

proxyUrl: ""

## port: Name of the port the metrics will be scraped from

##

port: http-metrics

jobLabel: jobLabel

selector: {}

# matchLabels:

# k8s-app: kube-dns

## MetricRelabelConfigs to apply to samples after scraping, but before ingestion.

## ref: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api-reference/api.md#relabelconfig

##

metricRelabelings: []

# - action: keep

# regex: 'kube_(daemonset|deployment|pod|namespace|node|statefulset).+'

# sourceLabels: [__name__]

## RelabelConfigs to apply to samples before scraping

## ref: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api-reference/api.md#relabelconfig

##

relabelings: []

# - sourceLabels: [__meta_kubernetes_pod_node_name]

# separator: ;

# regex: ^(.*)$

# targetLabel: nodename

# replacement: $1

# action: replace

## Additional labels

##

additionalLabels: {}

# foo: bar

## defines the labels which are transferred from the associated Kubernetes Service object onto the ingested metrics.

## https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api-reference/api.md#servicemonitor

targetLabels: []

## Bearer credentials used to scrape this component. Rendered as-is, so any field of the

## Prometheus Operator SafeAuthorization type can be set here. Set to null to scrape without

## authentication.

## ref: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api-reference/api.md#monitoring.coreos.com/v1.SafeAuthorization

##

authorization:

type: Bearer

credentials:

name: '{{ include "kube-prometheus-stack.prometheus.tokenSecretName" . }}'

key: token

## Component scraping kubeDns. Use either this or coreDns

##

kubeDns:

enabled: false

service:

dnsmasq:

port: 10054

targetPort: 10054

skydns:

port: 10055

targetPort: 10055

ipDualStack:

enabled: false

ipFamilies: ["IPv6", "IPv4"]

ipFamilyPolicy: "PreferDualStack"

# selector:

# k8s-app: kube-dns

serviceMonitor:

## Scrape interval. If not set, the Prometheus default scrape interval is used.

##

interval: ""

## ScrapeClass to use for this ServiceMonitor, as defined in prometheus.prometheusSpec.scrapeClasses.

## If not set, the default scrape class (if any) is used.

##

scrapeClass: ""

## SampleLimit defines per-scrape limit on number of scraped samples that will be accepted.

##

sampleLimit: 0

## TargetLimit defines a limit on the number of scraped targets that will be accepted.

##

targetLimit: 0

## Per-scrape limit on number of labels that will be accepted for a sample. Only valid in Prometheus versions 2.27.0 and newer.

##

labelLimit: 0

## Per-scrape limit on length of labels name that will be accepted for a sample. Only valid in Prometheus versions 2.27.0 and newer.

##

labelNameLengthLimit: 0

## Per-scrape limit on length of labels value that will be accepted for a sample. Only valid in Prometheus versions 2.27.0 and newer.

##

labelValueLengthLimit: 0

## proxyUrl: URL of a proxy that should be used for scraping.

##

proxyUrl: ""

jobLabel: jobLabel

selector: {}

# matchLabels:

# k8s-app: kube-dns

## MetricRelabelConfigs to apply to samples after scraping, but before ingestion.

## ref: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api-reference/api.md#relabelconfig

##

metricRelabelings: []

# - action: keep

# regex: 'kube_(daemonset|deployment|pod|namespace|node|statefulset).+'

# sourceLabels: [__name__]

## RelabelConfigs to apply to samples before scraping

## ref: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api-reference/api.md#relabelconfig

##

relabelings: []

# - sourceLabels: [__meta_kubernetes_pod_node_name]

# separator: ;

# regex: ^(.*)$

# targetLabel: nodename

# replacement: $1

# action: replace

## MetricRelabelConfigs to apply to samples after scraping, but before ingestion.

## ref: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api-reference/api.md#relabelconfig

##

dnsmasqMetricRelabelings: []

# - action: keep

# regex: 'kube_(daemonset|deployment|pod|namespace|node|statefulset).+'

# sourceLabels: [__name__]

## RelabelConfigs to apply to samples before scraping

## ref: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api-reference/api.md#relabelconfig

##

dnsmasqRelabelings: []

# - sourceLabels: [__meta_kubernetes_pod_node_name]

# separator: ;

# regex: ^(.*)$

# targetLabel: nodename

# replacement: $1

# action: replace

## Additional labels

##

additionalLabels: {}

# foo: bar

## defines the labels which are transferred from the associated Kubernetes Service object onto the ingested metrics.

## https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api-reference/api.md#servicemonitor

targetLabels: []

## Bearer credentials used to scrape this component. Rendered as-is, so any field of the

## Prometheus Operator SafeAuthorization type can be set here. Set to null to scrape without

## authentication.

## ref: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api-reference/api.md#monitoring.coreos.com/v1.SafeAuthorization

##

authorization:

type: Bearer

credentials:

name: '{{ include "kube-prometheus-stack.prometheus.tokenSecretName" . }}'

key: token

## Component scraping etcd

##

kubeEtcd:

enabled: true

## If your etcd is not deployed as a pod, specify IPs it can be found on

##

endpoints: []

# - 10.141.4.22

# - 10.141.4.23

# - 10.141.4.24

## Etcd service. If using kubeEtcd.endpoints only the port and targetPort are used

##

service:

enabled: true

port: 2381

targetPort: 2381

ipDualStack:

enabled: false

ipFamilies: ["IPv6", "IPv4"]

ipFamilyPolicy: "PreferDualStack"

# selector:

# component: etcd

## Configure secure access to the etcd cluster by referencing a secret holding the client

## certificate. For example, with a secret named etcd-client-cert

##

## serviceMonitor:

## scheme: https

## tlsConfig:

## insecureSkipVerify: false

## serverName: localhost

## ca:

## secret:

## name: etcd-client-cert

## key: etcd-ca

## cert:

## secret:

## name: etcd-client-cert

## key: etcd-client

## keySecret:

## name: etcd-client-cert

## key: etcd-client-key

##

serviceMonitor:

enabled: true

## Scrape interval. If not set, the Prometheus default scrape interval is used.

##

interval: ""

## ScrapeClass to use for this ServiceMonitor, as defined in prometheus.prometheusSpec.scrapeClasses.

## If not set, the default scrape class (if any) is used.

##

scrapeClass: ""

## SampleLimit defines per-scrape limit on number of scraped samples that will be accepted.

##

sampleLimit: 0

## TargetLimit defines a limit on the number of scraped targets that will be accepted.

##

targetLimit: 0

## Per-scrape limit on number of labels that will be accepted for a sample. Only valid in Prometheus versions 2.27.0 and newer.

##

labelLimit: 0

## Per-scrape limit on length of labels name that will be accepted for a sample. Only valid in Prometheus versions 2.27.0 and newer.

##

labelNameLengthLimit: 0

## Per-scrape limit on length of labels value that will be accepted for a sample. Only valid in Prometheus versions 2.27.0 and newer.

##

labelValueLengthLimit: 0

## proxyUrl: URL of a proxy that should be used for scraping.

##

proxyUrl: ""

scheme: http

## TLS configuration of the ServiceMonitor endpoint. Only applies when scheme is https.

## Rendered as-is, so any field of the Prometheus Operator SafeTLSConfig type can be set here.

## etcd requires client certificates, see the commented example above.

## ref: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api-reference/api.md#monitoring.coreos.com/v1.SafeTLSConfig

##

tlsConfig:

insecureSkipVerify: false

## port: Name of the port the metrics will be scraped from

##

port: http-metrics

jobLabel: jobLabel

selector: {}

# matchLabels:

# component: etcd

## MetricRelabelConfigs to apply to samples after scraping, but before ingestion.

## ref: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api-reference/api.md#relabelconfig

##

metricRelabelings: []

# - action: keep

# regex: 'kube_(daemonset|deployment|pod|namespace|node|statefulset).+'

# sourceLabels: [__name__]

## RelabelConfigs to apply to samples before scraping

## ref: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api-reference/api.md#relabelconfig

##

relabelings: []

# - sourceLabels: [__meta_kubernetes_pod_node_name]

# separator: ;

# regex: ^(.*)$

# targetLabel: nodename

# replacement: $1

# action: replace

## Additional labels

##

additionalLabels: {}

# foo: bar

## defines the labels which are transferred from the associated Kubernetes Service object onto the ingested metrics.

## https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api-reference/api.md#servicemonitor

targetLabels: []

## Bearer credentials used to scrape this component. Rendered as-is, so any field of the

## Prometheus Operator SafeAuthorization type can be set here. Set to null to scrape without

## authentication.

## ref: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api-reference/api.md#monitoring.coreos.com/v1.SafeAuthorization

##

authorization:

type: Bearer

credentials:

name: '{{ include "kube-prometheus-stack.prometheus.tokenSecretName" . }}'

key: token

## Component scraping kube scheduler

##

kubeScheduler:

enabled: true

# Overrides the job selector in Grafana dashboards and Prometheus rules

# For k3s clusters, change to k3s-server

jobNameOverride: ""

## If your kube scheduler is not deployed as a pod, specify IPs it can be found on

##

endpoints: []

# - 10.141.4.22

# - 10.141.4.23

# - 10.141.4.24

## If using kubeScheduler.endpoints only the port and targetPort are used

##

service:

enabled: true

## If null or unset, the value is determined dynamically based on target Kubernetes version due to change

## of default port in Kubernetes 1.23.

##

port: null

targetPort: null

ipDualStack:

enabled: false

ipFamilies: ["IPv6", "IPv4"]

ipFamilyPolicy: "PreferDualStack"

# selector:

# component: kube-scheduler

serviceMonitor:

enabled: true

## Scrape interval. If not set, the Prometheus default scrape interval is used.

##

interval: ""

## ScrapeClass to use for this ServiceMonitor, as defined in prometheus.prometheusSpec.scrapeClasses.

## If not set, the default scrape class (if any) is used.

##

scrapeClass: ""

## SampleLimit defines per-scrape limit on number of scraped samples that will be accepted.

##

sampleLimit: 0

## TargetLimit defines a limit on the number of scraped targets that will be accepted.

##

targetLimit: 0

## Per-scrape limit on number of labels that will be accepted for a sample. Only valid in Prometheus versions 2.27.0 and newer.

##

labelLimit: 0

## Per-scrape limit on length of labels name that will be accepted for a sample. Only valid in Prometheus versions 2.27.0 and newer.

##

labelNameLengthLimit: 0

## Per-scrape limit on length of labels value that will be accepted for a sample. Only valid in Prometheus versions 2.27.0 and newer.

##

labelValueLengthLimit: 0

## proxyUrl: URL of a proxy that should be used for scraping.

##

proxyUrl: ""

## Enable scraping kube-scheduler over https.

## Requires proper certs (not self-signed) and delegated authentication/authorization checks.

## If null or unset, the value is determined dynamically based on target Kubernetes version.

##

https: null

## port: Name of the port the metrics will be scraped from

##

port: http-metrics

jobLabel: jobLabel

selector: {}

# matchLabels:

# component: kube-scheduler

## Bearer credentials used to scrape this component. Rendered as-is, so any field of the

## Prometheus Operator SafeAuthorization type can be set here. Set to null to scrape without

## authentication.

## ref: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api-reference/api.md#monitoring.coreos.com/v1.SafeAuthorization

##

authorization:

type: Bearer

credentials:

name: '{{ include "kube-prometheus-stack.prometheus.tokenSecretName" . }}'

key: token

## TLS configuration of the ServiceMonitor endpoint. Only applies when scraping over https.

## Rendered as-is, so any field of the Prometheus Operator SafeTLSConfig type can be set here.

## ref: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api-reference/api.md#monitoring.coreos.com/v1.SafeTLSConfig

##

tlsConfig:

insecureSkipVerify: true

ca:

configMap:

name: kube-root-ca.crt

key: ca.crt

## MetricRelabelConfigs to apply to samples after scraping, but before ingestion.

## ref: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api-reference/api.md#relabelconfig

##

metricRelabelings: []

# - action: keep

# regex: 'kube_(daemonset|deployment|pod|namespace|node|statefulset).+'

# sourceLabels: [__name__]

## RelabelConfigs to apply to samples before scraping

## ref: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api-reference/api.md#relabelconfig

##

relabelings: []

# - sourceLabels: [__meta_kubernetes_pod_node_name]

# separator: ;

# regex: ^(.*)$

# targetLabel: nodename

# replacement: $1

# action: replace

## Additional labels

##

additionalLabels: {}

# foo: bar

## defines the labels which are transferred from the associated Kubernetes Service object onto the ingested metrics.

## https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api-reference/api.md#servicemonitor

targetLabels: []

resource:

## Enable scraping /metrics/resource from kube-scheduler

## https://kubernetes.io/docs/concepts/cluster-administration/system-metrics/#kube-scheduler-metrics

enabled: false

## Scrape interval. If not set, the Prometheus default scrape interval is used.

##

interval: ""

## MetricRelabelConfigs to apply to samples after scraping, but before ingestion.

## ref: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api-reference/api.md#relabelconfig

##

metricRelabelings: []

# - action: keep

# regex: 'kube_(daemonset|deployment|pod|namespace|node|statefulset).+'

# sourceLabels: [__name__]

## RelabelConfigs to apply to samples before scraping

## ref: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api-reference/api.md#relabelconfig

##

relabelings: []

# - sourceLabels: [__meta_kubernetes_pod_node_name]

# separator: ;

# regex: ^(.*)$

# targetLabel: nodename

# replacement: $1

# action: replace

## Component scraping kube proxy

##

kubeProxy:

enabled: true

# Overrides the job selector in Grafana dashboards and Prometheus rules

# For k3s clusters, change to k3s-server

jobNameOverride: ""

## If your kube proxy is not deployed as a pod, specify IPs it can be found on

##

endpoints: []

# - 10.141.4.22

# - 10.141.4.23

# - 10.141.4.24

service:

enabled: true

port: 10249

targetPort: 10249

ipDualStack:

enabled: false

ipFamilies: ["IPv6", "IPv4"]

ipFamilyPolicy: "PreferDualStack"

# selector:

# k8s-app: kube-proxy

serviceMonitor:

enabled: true

## Scrape interval. If not set, the Prometheus default scrape interval is used.

##

interval: ""

## ScrapeClass to use for this ServiceMonitor, as defined in prometheus.prometheusSpec.scrapeClasses.

## If not set, the default scrape class (if any) is used.

##

scrapeClass: ""

## SampleLimit defines per-scrape limit on number of scraped samples that will be accepted.

##

sampleLimit: 0

## TargetLimit defines a limit on the number of scraped targets that will be accepted.

##

targetLimit: 0

## Per-scrape limit on number of labels that will be accepted for a sample. Only valid in Prometheus versions 2.27.0 and newer.

##

labelLimit: 0

## Per-scrape limit on length of labels name that will be accepted for a sample. Only valid in Prometheus versions 2.27.0 and newer.

##

labelNameLengthLimit: 0

## Per-scrape limit on length of labels value that will be accepted for a sample. Only valid in Prometheus versions 2.27.0 and newer.

##

labelValueLengthLimit: 0

## proxyUrl: URL of a proxy that should be used for scraping.

##

proxyUrl: ""

## port: Name of the port the metrics will be scraped from

##

port: http-metrics

jobLabel: jobLabel

selector: {}

# matchLabels:

# k8s-app: kube-proxy

## Enable scraping kube-proxy over https.

## Requires proper certs (not self-signed) and delegated authentication/authorization checks

##

https: false

## TLS configuration of the ServiceMonitor endpoint. Only applies when scraping over https.

## Rendered as-is, so any field of the Prometheus Operator SafeTLSConfig type can be set here.

## ref: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api-reference/api.md#monitoring.coreos.com/v1.SafeTLSConfig

##

tlsConfig:

ca:

configMap:

name: kube-root-ca.crt

key: ca.crt

## MetricRelabelConfigs to apply to samples after scraping, but before ingestion.

## ref: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api-reference/api.md#relabelconfig

##

metricRelabelings: []

# - action: keep

# regex: 'kube_(daemonset|deployment|pod|namespace|node|statefulset).+'

# sourceLabels: [__name__]

## RelabelConfigs to apply to samples before scraping

## ref: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api-reference/api.md#relabelconfig

##

relabelings: []

# - action: keep

# regex: 'kube_(daemonset|deployment|pod|namespace|node|statefulset).+'

# sourceLabels: [__name__]

## Additional labels

##

additionalLabels: {}

# foo: bar

## defines the labels which are transferred from the associated Kubernetes Service object onto the ingested metrics.

## https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api-reference/api.md#servicemonitor

targetLabels: []

## Bearer credentials used to scrape this component. Rendered as-is, so any field of the

## Prometheus Operator SafeAuthorization type can be set here. Set to null to scrape without

## authentication.

## ref: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api-reference/api.md#monitoring.coreos.com/v1.SafeAuthorization

##

authorization:

type: Bearer

credentials:

name: '{{ include "kube-prometheus-stack.prometheus.tokenSecretName" . }}'

key: token

## Component scraping kube state metrics

##

kubeStateMetrics:

enabled: true

## Configuration for kube-state-metrics subchart

##

kube-state-metrics:

## set to true to add the release label so scraping of the servicemonitor with kube-prometheus-stack works out of the box

releaseLabel: true

## Enable scraping via kubernetes-service-endpoints

## Disabled by default as we service monitor is enabled below

##

prometheusScrape: false

prometheus:

monitor:

## Enable scraping via service monitor

## Disable to prevent duplication if you enable prometheusScrape above

enabled: true

## kube-state-metrics endpoint

http:

## Keep labels from scraped data, overriding server-side labels

honorLabels: true

## selfMonitor endpoint

metrics:

## Keep labels from scraped data, overriding server-side labels

honorLabels: true

## Deploy node exporter as a daemonset to all nodes

##

nodeExporter:

enabled: true

operatingSystems:

linux:

enabled: true

aix:

enabled: true

darwin:

enabled: true

## ForceDeployDashboard Create dashboard configmap even if nodeExporter deployment has been disabled

##

forceDeployDashboards: false

## Configuration for prometheus-node-exporter subchart

##

prometheus-node-exporter:

## Enable scraping via kubernetes-service-endpoints

## Disabled by default as service monitor is enabled below

##

prometheusScrape: false

namespaceOverride: ""

podLabels:

## Add the 'node-exporter' label to be used by serviceMonitor and podMonitor to match standard common usage in rules and grafana dashboards

##

jobLabel: node-exporter

releaseLabel: true

extraArgs:

- --collector.filesystem.mount-points-exclude=^/(dev|proc|sys|run/containerd/.+|var/lib/docker/.+|var/lib/kubelet/.+)($|/)

- --collector.filesystem.fs-types-exclude=^(autofs|binfmt_misc|bpf|cgroup2?|configfs|debugfs|devpts|devtmpfs|fusectl|hugetlbfs|iso9660|mqueue|nsfs|overlay|proc|procfs|pstore|rpc_pipefs|securityfs|selinuxfs|squashfs|sysfs|tracefs|erofs)$

service:

portName: http-metrics

ipDualStack:

enabled: false

ipFamilies: ["IPv6", "IPv4"]

ipFamilyPolicy: "PreferDualStack"

labels:

jobLabel: node-exporter

image:

distroless: true

prometheus: