kube-prometheus-stack

Helm chart

Last changed

Request a free trial

Contact our team to test out this Helm chart and related images for free. Please also indicate any other images you would like to evaluate.

Tag:

Compare:

# Default values for kube-prometheus-stack.

# This is a YAML-formatted file.

# Declare variables to be passed into your templates.

## Provide a name in place of kube-prometheus-stack for `app:` labels

nameOverride: ""

## Override the deployment namespace

namespaceOverride: ""

## Provide a k8s version to auto dashboard import script example: kubeTargetVersionOverride: 1.26.6

kubeTargetVersionOverride: ""

## Allow kubeVersion to be overridden while creating the ingress

kubeVersionOverride: ""

## Provide a name to substitute for the full names of resources

fullnameOverride: ""

## Labels to apply to all resources

commonLabels: {}

# scmhash: abc123

# myLabel: aakkmd

## Install Prometheus Operator CRDs

crds:

enabled: true

## The CRD upgrade job mitigates the limitation of helm not being able to upgrade CRDs.

## The job will apply the CRDs to the cluster before the operator is deployed, using helm hooks.

## It deploys a corresponding clusterrole, clusterrolebinding and serviceaccount to apply the CRDs.

## This feature is in preview, off by default and may change in the future.

upgradeJob:

enabled: false

## Force apply the CRDs, taking ownership from the manager that installed them (e.g. helm).

## Required for the job to actually upgrade CRDs whose schema/version changed.

forceConflicts: true

image:

busybox:

registry: cgr.dev

repository: chainguard-private/busybox

tag: glibc-1.38.0-r2@sha256:2a9dc729fa177c41c3fb59a2d6c4a8b0d5dc51f2f999854a3fa2b46171b72041

sha: ""

pullPolicy: IfNotPresent

kubectl:

registry: cgr.dev

repository: chainguard-private/kubectl

tag: 1.36.4-r10

sha: sha256:36594ea4557e5d63331cb9afc111d5a06a2848147489d3f643123929feecb1a9

pullPolicy: IfNotPresent

env: {}

## Define resources requests and limits for single Pods.

## ref: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/

resources: {}

## Additional volumes

extraVolumes: []

## Additional volume mounts

extraVolumeMounts: []

## Define which Nodes the Pods are scheduled on.

## ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#nodeselector

nodeSelector: {}

## Assign custom affinity rules to the upgrade-crd job

## ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/

affinity: {}

# nodeAffinity:

# requiredDuringSchedulingIgnoredDuringExecution:

# nodeSelectorTerms:

# - matchExpressions:

# - key: kubernetes.io/e2e-az-name

# operator: In

# values:

# - e2e-az1

# - e2e-az2

## If specified, the pod's tolerations.

## ref: https://kubernetes.io/docs/concepts/scheduling-eviction/taint-and-toleration/

tolerations: []

# - key: "key"

# operator: "Equal"

# value: "value"

# effect: "NoSchedule"

## If specified, the pod's topology spread constraints.

## ref: https://kubernetes.io/docs/concepts/scheduling-eviction/topology-spread-constraints/

topologySpreadConstraints: []

# - maxSkew: 1

# topologyKey: topology.kubernetes.io/zone

# whenUnsatisfiable: DoNotSchedule

# labelSelector:

# matchLabels:

# app: alertmanager

100

101

# ## Labels to add to the upgrade-crd job

102

# ##

103

labels: {}

104

## Annotations to add to the upgrade-crd job

105

106

annotations: {}

107

## Labels to add to the upgrade-crd pod

108

109

podLabels: {}

110

## Annotations to add to the upgrade-crd pod

111

112

podAnnotations: {}

113

## Service account for upgrade crd job to use.

114

## ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/

115

116

serviceAccount:

117

create: true

118

119

annotations: {}

120

labels: {}

121

automountServiceAccountToken: true

122

## Automounting API credentials for upgrade crd job pod.

123

124

automountServiceAccountToken: true

125

## Container-specific security context configuration

126

## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/

127

128

containerSecurityContext:

129

allowPrivilegeEscalation: false

130

readOnlyRootFilesystem: true

131

capabilities:

132

drop:

133

- ALL

134

## SecurityContext holds pod-level security attributes and common container settings.

135

## This defaults to non root user with uid 1000 and gid 2000. *v1.PodSecurityContext false

136

## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/

137

138

podSecurityContext:

139

fsGroup: 65534

140

runAsGroup: 65534

141

runAsNonRoot: true

142

runAsUser: 65534

143

seccompProfile:

144

type: RuntimeDefault

145

## Custom rules to override "for" and "severity" in defaultRules

146

147

customRules: {}

148

# AlertmanagerFailedReload:

149

# for: 3m

150

# AlertmanagerMembersInconsistent:

151

# for: 5m

152

# severity: "warning"

153

154

## Create default rules for monitoring the cluster

155

156

defaultRules:

157

create: true

158

rules:

159

alertmanager: true

160

etcd: true

161

configReloaders: true

162

general: true

163

k8sContainerCpuUsageSecondsTotal: true

164

k8sContainerMemoryCache: true

165

k8sContainerMemoryRss: true

166

k8sContainerMemorySwap: true

167

k8sContainerResource: true

168

k8sContainerMemoryWorkingSetBytes: true

169

k8sPodOwner: true

170

kubeApiserverAvailability: true

171

kubeApiserverBurnrate: true

172

kubeApiserverHistogram: true

173

kubeApiserverSlos: true

174

kubeControllerManager: true

175

kubelet: true

176

kubeProxy: true

177

kubePrometheusGeneral: true

178

kubePrometheusNodeRecording: true

179

kubernetesApps: true

180

kubernetesResources: true

181

kubernetesStorage: true

182

kubernetesSystem: true

183

kubeSchedulerAlerting: true

184

kubeSchedulerRecording: true

185

kubeStateMetrics: true

186

network: true

187

node: true

188

nodeExporterAlerting: true

189

nodeExporterRecording: true

190

prometheus: true

191

prometheusOperator: true

192

windows: true

193

# Defines the operator for namespace selection in rules

194

# Use "=~" to include namespaces matching the pattern (default)

195

# Use "!~" to exclude namespaces matching the pattern

196

appNamespacesOperator: "=~"

197

## Reduce app namespace alert scope

198

appNamespacesTarget: ".*"

199

## Set keep_firing_for for all alerts

200

keepFiringFor: ""

201

## Labels for default rules

202

labels: {}

203

## Annotations for default rules

204

annotations: {}

205

## Additional labels for PrometheusRule alerts

206

additionalRuleLabels: {}

207

## Additional annotations for specific PrometheusRule alerts by alert name

208

additionalRuleAnnotations: {}

209

## Additional labels for specific PrometheusRule alert groups

210

additionalRuleGroupLabels:

211

alertmanager: {}

212

etcd: {}

213

configReloaders: {}

214

general: {}

215

k8sContainerCpuUsageSecondsTotal: {}

216

k8sContainerMemoryCache: {}

217

k8sContainerMemoryRss: {}

218

k8sContainerMemorySwap: {}

219

k8sContainerResource: {}

220

k8sPodOwner: {}

221

kubeApiserverAvailability: {}

222

kubeApiserverBurnrate: {}

223

kubeApiserverHistogram: {}

224

kubeApiserverSlos: {}

225

kubeControllerManager: {}

226

kubelet: {}

227

kubeProxy: {}

228

kubePrometheusGeneral: {}

229

kubePrometheusNodeRecording: {}

230

kubernetesApps: {}

231

kubernetesResources: {}

232

kubernetesStorage: {}

233

kubernetesSystem: {}

234

kubeSchedulerAlerting: {}

235

kubeSchedulerRecording: {}

236

kubeStateMetrics: {}

237

network: {}

238

node: {}

239

nodeExporterAlerting: {}

240

nodeExporterRecording: {}

241

prometheus: {}

242

prometheusOperator: {}

243

## Additional annotations for specific PrometheusRule alert groups

244

additionalRuleGroupAnnotations:

245

alertmanager: {}

246

etcd: {}

247

configReloaders: {}

248

general: {}

249

k8sContainerCpuUsageSecondsTotal: {}

250

k8sContainerMemoryCache: {}

251

k8sContainerMemoryRss: {}

252

k8sContainerMemorySwap: {}

253

k8sContainerResource: {}

254

k8sPodOwner: {}

255

kubeApiserverAvailability: {}

256

kubeApiserverBurnrate: {}

257

kubeApiserverHistogram: {}

258

kubeApiserverSlos: {}

259

kubeControllerManager: {}

260

kubelet: {}

261

kubeProxy: {}

262

kubePrometheusGeneral: {}

263

kubePrometheusNodeRecording: {}

264

kubernetesApps: {}

265

kubernetesResources: {}

266

kubernetesStorage: {}

267

kubernetesSystem: {}

268

kubeSchedulerAlerting: {}

269

kubeSchedulerRecording: {}

270

kubeStateMetrics: {}

271

network: {}

272

node: {}

273

nodeExporterAlerting: {}

274

nodeExporterRecording: {}

275

prometheus: {}

276

prometheusOperator: {}

277

additionalAggregationLabels: []

278

## Prefix for runbook URLs. Use this to override the first part of the runbookURLs that is common to all rules.

279

runbookUrl: "https://runbooks.prometheus-operator.dev/runbooks"

280

## Thresholds for kubelet certificate expiration alerts (in seconds)

281

kubeletServerCertificateExpiration:

282

warning: 604800 # 7 days

283

critical: 86400 # 1 day

284

kubeletClientCertificateExpiration:

285

warning: 604800 # 7 days

286

critical: 86400 # 1 day

287

node:

288

fsSelector: 'fstype!=""'

289

# fsSelector: 'fstype=~"ext[234]|btrfs|xfs|zfs"'

290

## Disabled PrometheusRule alerts

291

disabled: {}

292

# KubeAPIDown: true

293

# NodeRAIDDegraded: true

294

## Deprecated way to provide custom recording or alerting rules to be deployed into the cluster.

295

296

# additionalPrometheusRules: []

297

# - name: my-rule-file

298

# groups:

299

# - name: my_group

300

# rules:

301

# - record: my_record

302

# expr: 100 * my_record

303

304

## Provide custom recording or alerting rules to be deployed into the cluster.

305

306

additionalPrometheusRulesMap: {}

307

# rule-name:

308

# groups:

309

# - name: my_group

310

# rules:

311

# - record: my_record

312

# expr: 100 * my_record

313

314

315

global:

316

rbac:

317

create: true

318

## Create ClusterRoles that extend the existing view, edit and admin ClusterRoles to interact with prometheus-operator CRDs

319

## Ref: https://kubernetes.io/docs/reference/access-authn-authz/rbac/#aggregated-clusterroles

320

createAggregateClusterRoles: false

321

## Global image registry to use if it needs to be overridden for some specific use cases (e.g. local registries, custom images, ...)

322

323

imageRegistry: ""

324

## Reference to one or more secrets to be used when pulling images

325

## ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/

326

327

imagePullSecrets: []

328

# - name: "image-pull-secret"

329

# or

330

# - "image-pull-secret"

331

windowsMonitoring:

332

## Deploys the windows-exporter and Windows-specific dashboards and rules (job name must be 'windows-exporter')

333

enabled: false

334

## Configuration for prometheus-windows-exporter

335

## ref: https://github.com/prometheus-community/helm-charts/tree/main/charts/prometheus-windows-exporter

336

337

prometheus-windows-exporter:

338

## Enable ServiceMonitor and set Kubernetes label to use as a job label

339

340

prometheus:

341

monitor:

342

enabled: true

343

jobLabel: jobLabel

344

releaseLabel: true

345

## Set job label to 'windows-exporter' as required by the default Prometheus rules and Grafana dashboards

346

347

podLabels:

348

jobLabel: windows-exporter

349

## Enable memory and container metrics as required by the default Prometheus rules and Grafana dashboards

350

351

config: |-

352

collectors:

353

enabled: '[defaults],memory,container'

354

## Configuration for alertmanager

355

## ref: https://prometheus.io/docs/alerting/alertmanager/

356

357

alertmanager:

358

## Deploy alertmanager

359

360

enabled: true

361

# Optional: Override the namespace where Alertmanager will be deployed.

362

namespaceOverride: ""

363

## Annotations for Alertmanager

364

365

annotations: {}

366

## Additional labels for Alertmanager

367

368

additionalLabels: {}

369

## API that Prometheus will use to communicate with alertmanager. Possible values are v1, v2

370

371

apiVersion: v2

372

## @param alertmanager.enableFeatures Enable access to Alertmanager disabled features.

373

374

enableFeatures: []

375

## Create dashboard configmap even if alertmanager deployment has been disabled

376

377

forceDeployDashboards: false

378

## Network Policy configuration

379

380

networkPolicy:

381

# -- Enable network policy for Alertmanager

382

enabled: false

383

# -- Define policy types. If egress is enabled, both Ingress and Egress will be used

384

# Valid values are ["Ingress"] or ["Ingress", "Egress"]

385

386

policyTypes:

387

- Ingress

388

# -- Gateway (formerly ingress controller) configuration

389

390

gateway:

391

# -- Gateway namespace

392

393

namespace: ""

394

# -- Gateway pod labels

395

396

podLabels: {}

397

# app.kubernetes.io/name: ingress-nginx

398

# -- Additional custom ingress rules

399

400

additionalIngress: []

401

# - from:

402

# - namespaceSelector:

403

# matchLabels:

404

# name: another-namespace

405

# podSelector:

406

# matchLabels:

407

# app: another-app

408

# - from:

409

# - podSelector:

410

# matchLabels:

411

# app.kubernetes.io/name: loki

412

# ports:

413

# - port: 9093

414

# protocol: TCP

415

416

# -- Configure egress rules

417

418

egress:

419

# -- Enable egress rules. When enabled, policyTypes will include Egress

420

421

enabled: false

422

# -- Custom egress rules

423

424

rules: []

425

# - to:

426

# - namespaceSelector: {}

427

# podSelector:

428

# matchLabels:

429

# name: smtp-relay

430

# ports:

431

# - port: 25

432

# protocol: TCP

433

# -- Enable rules for alertmanager cluster traffic

434

435

enableClusterRules: true

436

# -- Configure monitoring component rules

437

438

monitoringRules:

439

# -- Enable ingress from Prometheus

440

441

prometheus: true

442

# -- Enable ingress for config reloader metrics

443

444

configReloader: true

445

## Service account for Alertmanager to use.

446

## ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/

447

448

serviceAccount:

449

create: true

450

451

annotations: {}

452

automountServiceAccountToken: true

453

## Configure pod disruption budgets for Alertmanager

454

## ref: https://kubernetes.io/docs/tasks/run-application/configure-pdb/#specifying-a-poddisruptionbudget

455

456

podDisruptionBudget:

457

enabled: false

458

minAvailable: 1

459

# maxUnavailable: ""

460

unhealthyPodEvictionPolicy: AlwaysAllow

461

## Enable vertical pod autoscaler support for Alertmanager

462

## ref: https://github.com/kubernetes/autoscaler/tree/master/vertical-pod-autoscaler

463

464

verticalPodAutoscaler:

465

enabled: false

466

# Recommender responsible for generating recommendation for the object.

467

# List should be empty (then the default recommender will generate the recommendation)

468

# or contain exactly one recommender.

469

# recommenders:

470

# - name: custom-recommender-performance

471

472

# List of resources that the vertical pod autoscaler can control. Defaults to cpu and memory

473

controlledResources: []

474

# Specifies which resource values should be controlled: RequestsOnly or RequestsAndLimits.

475

# controlledValues: RequestsAndLimits

476

477

# Define the max allowed resources for the pod

478

maxAllowed: {}

479

# cpu: 200m

480

# memory: 100Mi

481

# Define the min allowed resources for the pod

482

minAllowed: {}

483

# cpu: 200m

484

# memory: 100Mi

485

486

updatePolicy:

487

# Specifies whether recommended updates are applied when a Pod is started and whether recommended updates

488

# are applied during the life of a Pod. Possible values are "Off", "Initial", "Recreate", and "InPlaceOrRecreate".

489

updateMode: Recreate

490

## Alertmanager configuration directives

491

## ref: https://prometheus.io/docs/alerting/configuration/#configuration-file

492

## https://prometheus.io/webtools/alerting/routing-tree-editor/

493

494

config:

495

global:

496

resolve_timeout: 5m

497

inhibit_rules:

498

- source_matchers:

499

- 'severity = critical'

500

target_matchers:

501

- 'severity =~ warning|info'

502

equal:

503

- 'namespace'

504

- 'alertname'

505

- source_matchers:

506

- 'severity = warning'

507

target_matchers:

508

- 'severity = info'

509

equal:

510

- 'namespace'

511

- 'alertname'

512

- source_matchers:

513

- 'alertname = InfoInhibitor'

514

target_matchers:

515

- 'severity = info'

516

equal:

517

- 'namespace'

518

- target_matchers:

519

- 'alertname = InfoInhibitor'

520

route:

521

group_by: ['namespace']

522

group_wait: 30s

523

group_interval: 5m

524

repeat_interval: 12h

525

receiver: 'null'

526

routes:

527

- receiver: 'null'

528

matchers:

529

- alertname = "Watchdog"

530

receivers:

531

- name: 'null'

532

templates:

533

- '/etc/alertmanager/config/*.tmpl'

534

## Alertmanager configuration directives (as string type, preferred over the config hash map)

535

## stringConfig will be used only if tplConfig is true

536

## ref: https://prometheus.io/docs/alerting/configuration/#configuration-file

537

## https://prometheus.io/webtools/alerting/routing-tree-editor/

538

539

stringConfig: ""

540

## Pass the Alertmanager configuration directives through Helm's templating

541

## engine. If the Alertmanager configuration contains Alertmanager templates,

542

## they'll need to be properly escaped so that they are not interpreted by

543

## Helm

544

## ref: https://helm.sh/docs/developing_charts/#using-the-tpl-function

545

## https://prometheus.io/docs/alerting/configuration/#tmpl_string

546

## https://prometheus.io/docs/alerting/notifications/

547

## https://prometheus.io/docs/alerting/notification_examples/

548

tplConfig: false

549

## Alertmanager template files to format alerts

550

## By default, templateFiles are placed in /etc/alertmanager/config/ and if

551

## they have a .tmpl file suffix will be loaded. See config.templates above

552

## to change, add other suffixes. If adding other suffixes, be sure to update

553

## config.templates above to include those suffixes.

554

## ref: https://prometheus.io/docs/alerting/notifications/

555

## https://prometheus.io/docs/alerting/notification_examples/

556

557

templateFiles: {}

558

559

## An example template:

560

# template_1.tmpl: |-

561

# {{ define "cluster" }}{{ .ExternalURL | reReplaceAll ".*alertmanager\\.(.*)" "$1" }}{{ end }}

562

563

# {{ define "slack.myorg.text" }}

564

# {{- $root := . -}}

565

# {{ range .Alerts }}

566

# *Alert:* {{ .Annotations.summary }} - `{{ .Labels.severity }}`

567

# *Cluster:* {{ template "cluster" $root }}

568

# *Description:* {{ .Annotations.description }}

569

# *Graph:* <{{ .GeneratorURL }}|:chart_with_upwards_trend:>

570

# *Runbook:* <{{ .Annotations.runbook }}|:spiral_note_pad:>

571

# *Details:*

572

# {{ range .Labels.SortedPairs }} - *{{ .Name }}:* `{{ .Value }}`

573

# {{ end }}

574

# {{ end }}

575

# {{ end }}

576

577

ingress:

578

enabled: false

579

ingressClassName: ""

580

annotations: {}

581

labels: {}

582

## Override ingress to a different defined port on the service

583

# servicePort: 8081

584

## Override ingress to a different service then the default, this is useful if you need to

585

## point to a specific instance of the alertmanager (eg kube-prometheus-stack-alertmanager-0)

586

# serviceName: kube-prometheus-stack-alertmanager-0

587

588

## Hosts must be provided if Ingress is enabled.

589

590

hosts: []

591

# - alertmanager.domain.com

592

593

## Paths to use for ingress rules - one path should match the alertmanagerSpec.routePrefix

594

595

paths: []

596

# - /

597

598

## For Kubernetes >= 1.18 you should specify the pathType (determines how Ingress paths should be matched)

599

## See https://kubernetes.io/blog/2020/04/02/improvements-to-the-ingress-api-in-kubernetes-1.18/#better-path-matching-with-path-types

600

# pathType: ImplementationSpecific

601

602

## TLS configuration for Alertmanager Ingress

603

## Secret must be manually created in the namespace

604

605

tls: []

606

# - secretName: alertmanager-general-tls

607

# hosts:

608

# - alertmanager.example.com

609

# -- BETA: Configure the gateway routes for the chart here.

610

# More routes can be added by adding a dictionary key like the 'main' route.

611

# Be aware that this is an early beta of this feature,

612

# kube-prometheus-stack does not guarantee this works and is subject to change.

613

# Being BETA this can/will change in the future without notice, do not use unless you want to take that risk

614

# [[ref]](https://gateway-api.sigs.k8s.io/reference/spec/#gateway.networking.k8s.io%2fv1alpha2)

615

route:

616

main:

617

# -- Enables or disables the route

618

enabled: false

619

# -- Set the route apiVersion, e.g. gateway.networking.k8s.io/v1 or gateway.networking.k8s.io/v1alpha2

620

apiVersion: gateway.networking.k8s.io/v1

621

# -- Set the route kind

622

# Valid options are GRPCRoute, HTTPRoute, TCPRoute, TLSRoute, UDPRoute

623

kind: HTTPRoute

624

annotations: {}

625

labels: {}

626

hostnames: []

627

# - my-filter.example.com

628

parentRefs: []

629

# - name: acme-gw

630

631

# -- create http route for redirect (https://gateway-api.sigs.k8s.io/guides/http-redirect-rewrite/#http-to-https-redirects)

632

## Take care that you only enable this on the http listener of the gateway to avoid an infinite redirect.

633

## matches, filters and additionalRules will be ignored if this is set to true. Be are

634

httpsRedirect: false

635

matches:

636

- path:

637

type: PathPrefix

638

value: /

639

## Filters define the filters that are applied to requests that match this rule.

640

filters: []

641

## Timeouts for the generated HTTPRoute backend rule.

642

## Requires Gateway API CRDs and a controller that support HTTPRoute timeouts.

643

timeouts: {}

644

# request: 120s

645

# backendRequest: 60s

646

647

## Session persistence configuration for the route rule.

648

sessionPersistence: {}

649

# sessionName: route

650

# type: Cookie

651

# absoluteTimeout: 12h

652

# cookieConfig:

653

# lifetimeType: Permanent

654

655

## Additional custom rules that can be added to the route

656

additionalRules: []

657

## Configuration for Alertmanager secret

658

659

secret:

660

annotations: {}

661

## Configuration for creating an Ingress that will map to each Alertmanager replica service

662

## alertmanager.servicePerReplica must be enabled

663

664

ingressPerReplica:

665

enabled: false

666

ingressClassName: ""

667

annotations: {}

668

labels: {}

669

## Final form of the hostname for each per replica ingress is

670

## {{ ingressPerReplica.hostPrefix }}-{{ $replicaNumber }}.{{ ingressPerReplica.hostDomain }}

671

672

## Prefix for the per replica ingress that will have `-$replicaNumber`

673

## appended to the end

674

hostPrefix: ""

675

## Domain that will be used for the per replica ingress

676

hostDomain: ""

677

## Paths to use for ingress rules

678

679

paths: []

680

# - /

681

682

## For Kubernetes >= 1.18 you should specify the pathType (determines how Ingress paths should be matched)

683

## See https://kubernetes.io/blog/2020/04/02/improvements-to-the-ingress-api-in-kubernetes-1.18/#better-path-matching-with-path-types

684

# pathType: ImplementationSpecific

685

686

## Secret name containing the TLS certificate for alertmanager per replica ingress

687

## Secret must be manually created in the namespace

688

tlsSecretName: ""

689

## Separated secret for each per replica Ingress. Can be used together with cert-manager

690

691

tlsSecretPerReplica:

692

enabled: false

693

## Final form of the secret for each per replica ingress is

694

## {{ tlsSecretPerReplica.prefix }}-{{ $replicaNumber }}

695

696

prefix: "alertmanager"

697

## Configuration for creating a Gateway API route that will map to each Alertmanager replica service

698

## alertmanager.servicePerReplica must be enabled

699

700

routePerReplica:

701

main:

702

# -- Enables or disables the routePerReplica

703

enabled: false

704

# -- Set the route apiVersion, e.g. gateway.networking.k8s.io/v1 or gateway.networking.k8s.io/v1alpha2

705

apiVersion: gateway.networking.k8s.io/v1

706

# -- Set the route kind

707

# Valid options are GRPCRoute, HTTPRoute, TCPRoute, TLSRoute, UDPRoute

708

kind: HTTPRoute

709

annotations: {}

710

labels: {}

711

## Final form of the hostname for each per replica route is

712

## {{ routePerReplica.hostPrefix }}-{{ $replicaNumber }}.{{ routePerReplica.hostDomain }}

713

714

## Prefix for the per replica route that will have `-$replicaNumber` appended to the end

715

hostPrefix: ""

716

## Domain that will be used for the per replica route

717

hostDomain: ""

718

parentRefs: []

719

# - name: acme-gw

720

721

# -- create http route for redirect (https://gateway-api.sigs.k8s.io/guides/http-redirect-rewrite/#http-to-https-redirects)

722

## Take care that you only enable this on the http listener of the gateway to avoid an infinite redirect.

723

## matches, filters and additionalRules will be ignored if this is set to true.

724

httpsRedirect: false

725

## Filters define the filters that are applied to requests that match this rule.

726

filters: []

727

matches:

728

- path:

729

type: PathPrefix

730

value: /

731

## Timeouts for the generated HTTPRoute backend rule.

732

## Requires Gateway API CRDs and a controller that support HTTPRoute timeouts.

733

timeouts: {}

734

# request: 120s

735

# backendRequest: 60s

736

737

## Session persistence configuration for the route rule.

738

sessionPersistence: {}

739

# sessionName: route

740

# type: Cookie

741

# absoluteTimeout: 12h

742

# cookieConfig:

743

# lifetimeType: Permanent

744

745

## Additional custom rules that can be added to the route

746

additionalRules: []

747

## Configuration for Alertmanager service

748

749

service:

750

enabled: true

751

annotations: {}

752

labels: {}

753

clusterIP: ""

754

ipDualStack:

755

enabled: false

756

ipFamilies: ["IPv6", "IPv4"]

757

ipFamilyPolicy: "PreferDualStack"

758

## Port for Alertmanager Service to listen on

759

760

port: 9093

761

## Port for Alertmanager cluster communication

762

763

# clusterPort: 9094

764

## To be used with a proxy extraContainer port

765

766

targetPort: 9093

767

## Port to expose on each node

768

## Only used if service.type is 'NodePort'

769

770

nodePort: 30903

771

## List of IP addresses at which the Prometheus server service is available

772

## Ref: https://kubernetes.io/docs/concepts/services-networking/service/#external-ips

773

774

775

## Additional ports to open for Alertmanager service

776

777

additionalPorts: []

778

# - name: oauth-proxy

779

# port: 8081

780

# targetPort: 8081

781

# - name: oauth-metrics

782

# port: 8082

783

# targetPort: 8082

784

785

externalIPs: []

786

loadBalancerIP: ""

787

loadBalancerSourceRanges: []

788

## Denotes if this Service desires to route external traffic to node-local or cluster-wide endpoints

789

790

externalTrafficPolicy: Cluster

791

## If you want to make sure that connections from a particular client are passed to the same Pod each time

792

## Accepts 'ClientIP' or 'None'

793

794

sessionAffinity: None

795

## If you want to modify the ClientIP sessionAffinity timeout

796

## The value must be >0 && <=86400(for 1 day) if ServiceAffinity == "ClientIP"

797

798

sessionAffinityConfig:

799

clientIP:

800

timeoutSeconds: 10800

801

## Service type

802

803

type: ClusterIP

804

## Configuration for creating a separate Service for each statefulset Alertmanager replica

805

806

servicePerReplica:

807

enabled: false

808

annotations: {}

809

## Port for Alertmanager Service per replica to listen on

810

811

port: 9093

812

## To be used with a proxy extraContainer port

813

targetPort: 9093

814

## Port to expose on each node

815

## Only used if servicePerReplica.type is 'NodePort'

816

817

nodePort: 30904

818

## Loadbalancer source IP ranges

819

## Only used if servicePerReplica.type is "LoadBalancer"

820

loadBalancerSourceRanges: []

821

## Denotes if this Service desires to route external traffic to node-local or cluster-wide endpoints

822

823

externalTrafficPolicy: Cluster

824

## Service type

825

826

type: ClusterIP

827

## Configuration for creating a ServiceMonitor for AlertManager

828

829

serviceMonitor:

830

## If true, a ServiceMonitor will be created for the AlertManager service.

831

832

selfMonitor: true

833

## Scrape interval. If not set, the Prometheus default scrape interval is used.

834

835

interval: ""

836

## Additional labels

837

838

additionalLabels: {}

839

## SampleLimit defines per-scrape limit on number of scraped samples that will be accepted.

840

841

sampleLimit: 0

842

## TargetLimit defines a limit on the number of scraped targets that will be accepted.

843

844

targetLimit: 0

845

## Per-scrape limit on number of labels that will be accepted for a sample. Only valid in Prometheus versions 2.27.0 and newer.

846

847

labelLimit: 0

848

## Per-scrape limit on length of labels name that will be accepted for a sample. Only valid in Prometheus versions 2.27.0 and newer.

849

850

labelNameLengthLimit: 0

851

## Per-scrape limit on length of labels value that will be accepted for a sample. Only valid in Prometheus versions 2.27.0 and newer.

852

853

labelValueLengthLimit: 0

854

## proxyUrl: URL of a proxy that should be used for scraping.

855

856

proxyUrl: ""

857

## scheme: HTTP scheme to use for scraping. Can be used with `tlsConfig` for example if using istio mTLS.

858

scheme: ""

859

## enableHttp2: Whether to enable HTTP2.

860

## See https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api-reference/api.md#endpoint

861

enableHttp2: true

862

## tlsConfig: TLS configuration to use when scraping the endpoint. For example if using istio mTLS.

863

## Of type: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api-reference/api.md#tlsconfig

864

tlsConfig: {}

865

bearerTokenFile:

866

## MetricRelabelConfigs to apply to samples after scraping, but before ingestion.

867

## ref: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api-reference/api.md#relabelconfig

868

869

metricRelabelings: []

870

# - action: keep

871

872

# sourceLabels: [__name__]

873

874

## RelabelConfigs to apply to samples before scraping

875

## ref: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api-reference/api.md#relabelconfig

876

877

relabelings: []

878

# - sourceLabels: [__meta_kubernetes_pod_node_name]

879

# separator: ;

880

# regex: ^(.*)$

881

# targetLabel: nodename

882

# replacement: $1

883

# action: replace

884

885

## Additional Endpoints

886

887

additionalEndpoints: []

888

# - port: oauth-metrics

889

# path: /metrics

890

## Settings affecting alertmanagerSpec

891

## ref: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api-reference/api.md#alertmanagerspec

892

893

alertmanagerSpec:

894

## Statefulset's persistent volume claim retention policy

895

## whenDeleted and whenScaled determine whether

896

## statefulset's PVCs are deleted (true) or retained (false)

897

## on scaling down and deleting statefulset, respectively.

898

## Requires Kubernetes version 1.27.0+.

899

## Ref: https://kubernetes.io/docs/concepts/workloads/controllers/statefulset/#persistentvolumeclaim-retention

900

persistentVolumeClaimRetentionPolicy: {}

901

# whenDeleted: Retain

902

# whenScaled: Retain

903

904

## Standard object's metadata. More info: https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#metadata

905

## Metadata Labels and Annotations gets propagated to the Alertmanager pods.

906

907

podMetadata: {}

908

909

serviceName:

910

## Image of Alertmanager

911

912

image:

913

registry: cgr.dev

914

repository: chainguard-private/prometheus-alertmanager

915

tag: 0.34.1-r0

916

sha: sha256:5ec106ba5746ddfaf1f9ec07634b184b903ef49ed896094b756f224264db0a9d

917

pullPolicy: IfNotPresent

918

## If true then the user will be responsible to provide a secret with alertmanager configuration

919

## So when true the config part will be ignored (including templateFiles) and the one in the secret will be used

920

921

useExistingSecret: false

922

## Secrets is a list of Secrets in the same namespace as the Alertmanager object, which shall be mounted into the

923

## Alertmanager Pods. The Secrets are mounted into /etc/alertmanager/secrets/.

924

925

secrets: []

926

## If false then the user will opt out of automounting API credentials.

927

928

automountServiceAccountToken: true

929

## ConfigMaps is a list of ConfigMaps in the same namespace as the Alertmanager object, which shall be mounted into the Alertmanager Pods.

930

## The ConfigMaps are mounted into /etc/alertmanager/configmaps/.

931

932

configMaps: []

933

## ConfigSecret is the name of a Kubernetes Secret in the same namespace as the Alertmanager object, which contains configuration for

934

## this Alertmanager instance. Defaults to 'alertmanager-' The secret is mounted into /etc/alertmanager/config.

935

936

# configSecret:

937

938

## WebTLSConfig defines the TLS parameters for HTTPS

939

## ref: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api-reference/api.md#alertmanagerwebspec

940

web: {}

941

## AlertmanagerConfigs to be selected to merge and configure Alertmanager with.

942

943

alertmanagerConfigSelector: {}

944

## Example which selects all alertmanagerConfig resources

945

## with label "alertconfig" with values any of "example-config" or "example-config-2"

946

# alertmanagerConfigSelector:

947

# matchExpressions:

948

# - key: alertconfig

949

# operator: In

950

# values:

951

# - example-config

952

# - example-config-2

953

954

## Example which selects all alertmanagerConfig resources with label "role" set to "example-config"

955

# alertmanagerConfigSelector:

956

# matchLabels:

957

# role: example-config

958

959

## Namespaces to be selected for AlertmanagerConfig discovery. If nil, only check own namespace.

960

961

alertmanagerConfigNamespaceSelector: {}

962

## Example which selects all namespaces

963

## with label "alertmanagerconfig" with values any of "example-namespace" or "example-namespace-2"

964

# alertmanagerConfigNamespaceSelector:

965

# matchExpressions:

966

# - key: alertmanagerconfig

967

# operator: In

968

# values:

969

# - example-namespace

970

# - example-namespace-2

971

972

## Example which selects all namespaces with label "alertmanagerconfig" set to "enabled"

973

# alertmanagerConfigNamespaceSelector:

974

# matchLabels:

975

# alertmanagerconfig: enabled

976

977

## AlermanagerConfig to be used as top level configuration

978

979

alertmanagerConfiguration: {}

980

## Example with select a global alertmanagerconfig

981

# alertmanagerConfiguration:

982

# name: global-alertmanager-Configuration

983

984

## Defines the strategy used by AlertmanagerConfig objects to match alerts. eg:

985

986

alertmanagerConfigMatcherStrategy: {}

987

## Example with use OnNamespace strategy

988

# alertmanagerConfigMatcherStrategy:

989

# type: OnNamespace

990

991

## Additional command line arguments to pass to Alertmanager (in addition to those generated by the chart)

992

additionalArgs: []

993

## Define Log Format

994

# Use logfmt (default) or json logging

995

logFormat: logfmt

996

## Log level for Alertmanager to be configured with.

997

998

logLevel: info

999

## Size is the expected size of the alertmanager cluster. The controller will eventually make the size of the

1000

## running cluster equal to the expected size.

1001

replicas: 1

1002

## Time duration Alertmanager shall retain data for. Default is '120h', and must match the regular expression

1003

## [0-9]+(ms|s|m|h) (milliseconds seconds minutes hours).

1004

1005

retention: 120h

1006

## Storage is the definition of how storage will be used by the Alertmanager instances.

1007

## ref: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/platform/storage.md

1008

1009

storage: {}

1010

# volumeClaimTemplate:

1011

# spec:

1012

# storageClassName: gluster

1013

# accessModes: ["ReadWriteOnce"]

1014

# resources:

1015

# requests:

1016

# storage: 50Gi

1017

# selector: {}

1018

1019

## The external URL the Alertmanager instances will be available under. This is necessary to generate correct URLs. This is necessary if Alertmanager is not served from root of a DNS name. string false

1020

1021

externalUrl:

1022

## The route prefix Alertmanager registers HTTP handlers for. This is useful, if using ExternalURL and a proxy is rewriting HTTP routes of a request, and the actual ExternalURL is still true,

1023

## but the server serves requests under a different route prefix. For example for use with kubectl proxy.

1024

1025

routePrefix: /

1026

## scheme: HTTP scheme to use. Can be used with `tlsConfig` for example if using istio mTLS.

1027

scheme: ""

1028

## tlsConfig: TLS configuration to use when connect to the endpoint. For example if using istio mTLS.

1029

## Of type: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api-reference/api.md#tlsconfig

1030

tlsConfig: {}

1031

## If set to true all actions on the underlying managed objects are not going to be performed, except for delete actions.

1032

1033

paused: false

1034

## Define which Nodes the Pods are scheduled on.

1035

## ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#nodeselector

1036

1037

nodeSelector: {}

1038

## Define resources requests and limits for single Pods.

1039

## ref: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/

1040

1041

resources: {}

1042

# requests:

1043

# memory: 400Mi

1044

1045

## Pod anti-affinity can prevent the scheduler from placing Prometheus replicas on the same node.

1046

## The default value "soft" means that the scheduler should *prefer* to not schedule two replica pods onto the same node but no guarantee is provided.

1047

## The value "hard" means that the scheduler is *required* to not schedule two replica pods onto the same node.

1048

## The value "" will disable pod anti-affinity so that no anti-affinity rules will be configured.

1049

1050

podAntiAffinity: "soft"

1051

## If anti-affinity is enabled sets the topologyKey to use for anti-affinity.

1052

## This can be changed to, for example, failure-domain.beta.kubernetes.io/zone

1053

1054

podAntiAffinityTopologyKey: kubernetes.io/hostname

1055

## Assign custom affinity rules to the alertmanager instance

1056

## ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/

1057

1058

affinity: {}

1059

# nodeAffinity:

1060

# requiredDuringSchedulingIgnoredDuringExecution:

1061

# nodeSelectorTerms:

1062

# - matchExpressions:

1063

# - key: kubernetes.io/e2e-az-name

1064

# operator: In

1065

# values:

1066

# - e2e-az1

1067

# - e2e-az2

1068

1069

## If specified, the pod's tolerations.

1070

## ref: https://kubernetes.io/docs/concepts/scheduling-eviction/taint-and-toleration/

1071

1072

tolerations: []

1073

# - key: "key"

1074

# operator: "Equal"

1075

# value: "value"

1076

# effect: "NoSchedule"

1077

1078

## If specified, the pod's topology spread constraints.

1079

## ref: https://kubernetes.io/docs/concepts/scheduling-eviction/topology-spread-constraints/

1080

1081

topologySpreadConstraints: []

1082

# - maxSkew: 1

1083

# topologyKey: topology.kubernetes.io/zone

1084

# whenUnsatisfiable: DoNotSchedule

1085

# labelSelector:

1086

# matchLabels:

1087

# app: alertmanager

1088

1089

## SecurityContext holds pod-level security attributes and common container settings.

1090

## This defaults to non root user with uid 1000 and gid 2000. *v1.PodSecurityContext false

1091

## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/

1092

1093

securityContext:

1094

runAsGroup: 2000

1095

runAsNonRoot: true

1096

runAsUser: 1000

1097

fsGroup: 2000

1098

seccompProfile:

1099

type: RuntimeDefault

1100

## Use the host's user namespace for Alertmanager pods.

1101

## ref: https://kubernetes.io/docs/tasks/configure-pod-container/user-namespaces/

1102

hostUsers: ~

1103

## DNS configuration for Alertmanager.

1104

## ref: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api-reference/api.md#monitoring.coreos.com/v1.PodDNSConfig

1105

dnsConfig: {}

1106

## DNS policy for Alertmanager.

1107

## ref: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api-reference/api.md#dnspolicystring-alias

1108

dnsPolicy: ""

1109

## Enable hostNetwork for Alertmanager.

1110

hostNetwork: false

1111

## ListenLocal makes the Alertmanager server listen on loopback, so that it does not bind against the Pod IP.

1112

## Note this is only for the Alertmanager UI, not the gossip communication.

1113

1114

listenLocal: false

1115

## Containers allows injecting additional containers. This is meant to allow adding an authentication proxy to an Alertmanager pod.

1116

1117

containers: []

1118

# containers:

1119

# - name: oauth-proxy

1120

# image: quay.io/oauth2-proxy/oauth2-proxy:v7.15.4

1121

# args:

1122

# - --upstream=http://127.0.0.1:9093

1123

# - --http-address=0.0.0.0:8081

1124

# - --metrics-address=0.0.0.0:8082

1125

# - ...

1126

# ports:

1127

# - containerPort: 8081

1128

# name: oauth-proxy

1129

# protocol: TCP

1130

# - containerPort: 8082

1131

# name: oauth-metrics

1132

# protocol: TCP

1133

# resources: {}

1134

1135

# Additional volumes on the output StatefulSet definition.

1136

volumes: []

1137

# Additional VolumeMounts on the output StatefulSet definition.

1138

volumeMounts: []

1139

## InitContainers allows injecting additional initContainers. This is meant to allow doing some changes

1140

## (permissions, dir tree) on mounted volumes before starting prometheus

1141

initContainers: []

1142

## Priority class assigned to the Pods

1143

1144

priorityClassName: ""

1145

## AdditionalPeers allows injecting a set of additional Alertmanagers to peer with to form a highly available cluster.

1146

1147

additionalPeers: []

1148

## PortName to use for Alert Manager.

1149

1150

portName: "http-web"

1151

## ClusterAdvertiseAddress is the explicit address to advertise in cluster. Needs to be provided for non RFC1918 [1] (public) addresses. [1] RFC1918: https://tools.ietf.org/html/rfc1918

1152

1153

clusterAdvertiseAddress: false

1154

## clusterGossipInterval determines interval between gossip attempts.

1155

## Needs to be specified as GoDuration, a time duration that can be parsed by Go's time.ParseDuration() (e.g. 45ms, 30s, 1m, 1h20m15s)

1156

clusterGossipInterval: ""

1157

## clusterPeerName defines the name this instance advertises to other cluster peers, defaulting to the pod name.

1158

## Literal values and references to environment variables available in the container (e.g. "$(POD_NAME).$(NAMESPACE)") are both accepted.

1159

## Requires Alertmanager >= v0.30.0.

1160

clusterPeerName: ""

1161

## clusterPeerTimeout determines timeout for cluster peering.

1162

## Needs to be specified as GoDuration, a time duration that can be parsed by Go's time.ParseDuration() (e.g. 45ms, 30s, 1m, 1h20m15s)

1163

clusterPeerTimeout: ""

1164

## clusterPushpullInterval determines interval between pushpull attempts.

1165

## Needs to be specified as GoDuration, a time duration that can be parsed by Go's time.ParseDuration() (e.g. 45ms, 30s, 1m, 1h20m15s)

1166

clusterPushpullInterval: ""

1167

## clusterLabel defines the identifier that uniquely identifies the Alertmanager cluster.

1168

clusterLabel: ""

1169

## ForceEnableClusterMode ensures Alertmanager does not deactivate the cluster mode when running with a single replica.

1170

## Use case is e.g. spanning an Alertmanager cluster across Kubernetes clusters with a single replica in each.

1171

forceEnableClusterMode: false

1172

## Minimum number of seconds for which a newly created pod should be ready without any of its container crashing for it to

1173

## be considered available. Defaults to 0 (pod will be considered available as soon as it is ready).

1174

minReadySeconds: 0

1175

## Pod management policy. Kubernetes default is OrderedReady but prometheus-operator default is Parallel.

1176

## ref: https://kubernetes.io/docs/concepts/workloads/controllers/statefulset/#pod-management-policies

1177

podManagementPolicy: ""

1178

## Update strategy for the StatefulSet.

1179

## ref: https://kubernetes.io/docs/concepts/workloads/controllers/statefulset/#update-strategies

1180

updateStrategy: {}

1181

# type: RollingUpdate

1182

# rollingUpdate:

1183

# maxUnavailable: 1

1184

1185

## Duration in seconds the pod needs to terminate gracefully.

1186

## ref: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle/#pod-termination

1187

terminationGracePeriodSeconds: ~

1188

## EnableServiceLinks indicates whether information about services should be injected into the

1189

## pod's environment variables. Uses the operator/Kubernetes default when left unset (~).

1190

enableServiceLinks: ~

1191

## Set the scheduler name to use for the Alertmanager pods.

1192

schedulerName: ""

1193

## Pods' hostAliases configuration

1194

## ref: https://kubernetes.io/docs/concepts/services-networking/add-entries-to-pod-etc-hosts-with-host-aliases/

1195

hostAliases: []

1196

# - ip: 10.10.0.100

1197

# hostnames:

1198

# - a1.app.local

1199

1200

## Limits defines the Alertmanager limits command line flags. Requires Alertmanager >= v0.28.0.

1201

## ref: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api-reference/api.md#monitoring.coreos.com/v1.AlertmanagerLimitsSpec

1202

limits: {}

1203

# maxSilences: 1000

1204

# maxPerSilenceBytes: 1MB

1205

1206

## ClusterTLS defines the mutual TLS configuration for the Alertmanager cluster's gossip protocol.

1207

## Requires Alertmanager >= v0.24.0.

1208

## ref: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api-reference/api.md#monitoring.coreos.com/v1.ClusterTLSConfig

1209

clusterTLS: {}

1210

## Additional configuration which is not covered by the properties above. (passed through tpl)

1211

additionalConfig: {}

1212

## Additional configuration which is not covered by the properties above.

1213

## Useful, if you need advanced templating inside alertmanagerSpec.

1214

## Otherwise, use alertmanager.alertmanagerSpec.additionalConfig (passed through tpl)

1215

additionalConfigString: ""

1216

## ExtraSecret can be used to store various data in an extra secret

1217

## (use it for example to store hashed basic auth credentials)

1218

extraSecret:

1219

## if not set, name will be auto generated

1220

# name: ""

1221

annotations: {}

1222

data: {}

1223

# auth: |

1224

# foo:$apr1$OFG3Xybp$ckL0FHDAkoXYIlH9.cysT0

1225

# someoneelse:$apr1$DMZX2Z4q$6SbQIfyuLQd.xmo/P0m2c.

1226

## Using default values from https://github.com/grafana-community/helm-charts/blob/main/charts/grafana/values.yaml

1227

1228

grafana:

1229

enabled: true

1230

namespaceOverride: ""

1231

## ForceDeployDatasources Create datasource configmap even if grafana deployment has been disabled

1232

1233

forceDeployDatasources: false

1234

## ForceDeployDashboard Create dashboard configmap even if grafana deployment has been disabled

1235

1236

forceDeployDashboards: false

1237

## Deploy default dashboards

1238

1239

defaultDashboardsEnabled: true

1240

## Deploy GrafanaDashboard CRDs that reference dashboards from ConfigMaps when grafana-operator is used

1241

## These settings control how dashboards are integrated with the Grafana Operator

1242

## Note: With operator.datasourcesEnabled disabled, end users still need to create their own

1243

## kind: GrafanaDatasource for Prometheus

1244

## eg:

1245

## apiVersion: grafana.integreatly.org/v1beta1

1246

## kind: GrafanaDatasource

1247

## metadata:

1248

## name: prometheus

1249

## annotations: {}

1250

## spec:

1251

## allowCrossNamespaceImport: true

1252

## instanceSelector:

1253

## matchLabels:

1254

## app: grafana

1255

## datasource:

1256

## name: prometheus

1257

## type: prometheus

1258

## access: proxy

1259

## url: http://prometheus-operated.prometheus-stack.svc.cluster.local:9090

1260

## isDefault: true

1261

## jsonData:

1262

## "tlsSkipVerify": true

1263

## "timeInterval": "5s"

1264

1265

operator:

1266

## Enable references to ConfigMaps containing dashboards in GrafanaDashboard CRs

1267

## Set to true to allow dashboards to be loaded from ConfigMap references

1268

dashboardsConfigMapRefEnabled: false

1269

## Provision GrafanaDatasource CRs instead of a file-based datasource ConfigMap

1270

## Covers the default Prometheus datasource, the per-replica Prometheus datasources, the

1271

## Alertmanager datasource and every entry of grafana.additionalDataSources

1272

## An entry of grafana.additionalDataSources may carry `valuesFrom` and `plugins`, both are

1273

## moved from the datasource to the CR spec

1274

## grafana.additionalDataSourcesString, grafana.deleteDatasources and grafana.prune have no CR

1275

## equivalent and keep using the ConfigMap

1276

datasourcesEnabled: false

1277

## Annotations for GrafanaDashboard Cr

1278

1279

annotations: {}

1280

## Labels that should be matched kind: Grafana instance

1281

## Example: { app: grafana, category: dashboard }

1282

1283

matchLabels: {}

1284

## How frequently the operator should resync resources (in duration format)

1285

## Controls how often dashboards are reconciled by the operator

1286

1287

resyncPeriod: 10m

1288

## Which folder contains all dashboards in Grafana

1289

## This folder will be created on the Root level

1290

## Only one of 'folder', 'folderUID' or 'folderRef' can be set

1291

1292

folder: General

1293

## Which UID of the target folder contains all dashboards in Grafana

1294

## This allows you to use subfolder hierarchy

1295

## Only one of 'folder', 'folderUID' or 'folderRef' can be set

1296

1297

folderUID: null

1298

## Which GrafanaFolder reference contains all dashboards in Grafana

1299

## This allows you to use subfolder hierarchy.

1300

## Only one of 'folder', 'folderUID' or 'folderRef' can be set

1301

1302

folderRef: null

1303

## Timezone for the default dashboards

1304

## Other options are: browser or a specific timezone, i.e. Europe/Luxembourg

1305

1306

defaultDashboardsTimezone: utc

1307

## Editable flag for the default dashboards

1308

1309

defaultDashboardsEditable: true

1310

## Default interval for Grafana dashboards

1311

1312

defaultDashboardsInterval: 1m

1313

# Administrator credentials when not using an existing secret (see below)

1314

adminUser: admin

1315

# adminPassword: strongpassword

1316

1317

# Use an existing secret for the admin user.

1318

admin:

1319

## Name of the secret. Can be templated.

1320

existingSecret: ""

1321

userKey: admin-user

1322

passwordKey: admin-password

1323

rbac:

1324

## If true, Grafana PSPs will be created

1325

1326

pspEnabled: false

1327

ingress:

1328

## If true, Grafana Ingress will be created

1329

1330

enabled: false

1331

## IngressClassName for Grafana Ingress.

1332

## Should be provided if Ingress is enable.

1333

1334

# ingressClassName: nginx

1335

1336

## Annotations for Grafana Ingress

1337

1338

annotations: {}

1339

# kubernetes.io/ingress.class: nginx

1340

# kubernetes.io/tls-acme: "true"

1341

1342

## Labels to be added to the Ingress

1343

1344

labels: {}

1345

## Hostnames.

1346

## Must be provided if Ingress is enable.

1347

1348

# hosts:

1349

# - grafana.domain.com

1350

hosts: []

1351

## Path for grafana ingress

1352

path: /

1353

## TLS configuration for grafana Ingress

1354

## Secret must be manually created in the namespace

1355

1356

tls: []

1357

# - secretName: grafana-general-tls

1358

# hosts:

1359

# - grafana.example.com

1360

# # To make Grafana persistent (Using Statefulset)

1361

# #

1362

# persistence:

1363

# enabled: true

1364

# type: sts

1365

# storageClassName: "storageClassName"

1366

# accessModes:

1367

# - ReadWriteOnce

1368

# size: 20Gi

1369

# finalizers:

1370

# - kubernetes.io/pvc-protection

1371

serviceAccount:

1372

create: true

1373

autoMount: true

1374

sidecar:

1375

dashboards:

1376

enabled: true

1377

label: grafana_dashboard

1378

labelValue: "1"

1379

# Allow discovery in all namespaces for dashboards

1380

searchNamespace: ALL

1381

# Support for new table panels, when enabled grafana auto migrates the old table panels to newer table panels

1382

enableNewTablePanelSyntax: false

1383

## Annotations for Grafana dashboard configmaps

1384

1385

annotations: {}

1386

## Annotation the sidecar reads to decide in which Grafana folder a dashboard

1387

## is stored. Requires `provider.foldersFromFilesStructure` to be enabled.

1388

## ref: https://github.com/grafana/helm-charts/tree/main/charts/grafana#sidecar-for-dashboards

1389

1390

# folderAnnotation: grafana_folder

1391

multicluster:

1392

global:

1393

enabled: false

1394

etcd:

1395

enabled: false

1396

provider:

1397

allowUiUpdates: false

1398

## Let Grafana replicate the dashboard folder structure created by the sidecar,

1399

## so dashboards are grouped into folders instead of the default one.

1400

## Required when using `folderAnnotation` above.

1401

1402

# foldersFromFilesStructure: true

1403

datasources:

1404

enabled: true

1405

defaultDatasourceEnabled: true

1406

isDefaultDatasource: true

1407

1408

uid: prometheus

1409

## Extra jsonData properties to add to the datasource

1410

# extraJsonData:

1411

# prometheusType: Prometheus

1412

1413

## URL of prometheus datasource

1414

1415

# url: http://prometheus-stack-prometheus:9090/

1416

1417

## Prometheus request timeout in seconds

1418

# timeout: 30

1419

1420

## Query parameters to add, as a URL-encoded string,

1421

## to query Prometheus

1422

# customQueryParameters: ""

1423

1424

# If not defined, will use prometheus.prometheusSpec.scrapeInterval or its default

1425

# defaultDatasourceScrapeInterval: 15s

1426

1427

## Annotations for Grafana datasource configmaps

1428

1429

annotations: {}

1430

## Set method for HTTP to send query to datasource

1431

httpMethod: POST

1432

## Create datasource for each Pod of Prometheus StatefulSet;

1433

## this uses by default the headless service `prometheus-operated` which is

1434

## created by Prometheus Operator. In case you deployed your own Service for your

1435

## Prometheus instance, you can specify it with the field `prometheusServiceName`

1436

## ref: https://github.com/prometheus-operator/prometheus-operator/blob/0fee93e12dc7c2ea1218f19ae25ec6b893460590/pkg/prometheus/statefulset.go#L255-L286

1437

createPrometheusReplicasDatasources: false

1438

prometheusServiceName: prometheus-operated

1439

label: grafana_datasource

1440

labelValue: "1"

1441

## Field with internal link pointing to existing data source in Grafana.

1442

## Can be provisioned via additionalDataSources

1443

exemplarTraceIdDestinations: {}

1444

# datasourceUid: Jaeger

1445

# traceIdLabelName: trace_id

1446

# urlDisplayLabel: View traces

1447

alertmanager:

1448

enabled: true

1449

1450

uid: alertmanager

1451

handleGrafanaManagedAlerts: false

1452

implementation: prometheus

1453

extraConfigmapMounts: []

1454

# - name: certs-configmap

1455

# mountPath: /etc/grafana/ssl/

1456

# configMap: certs-configmap

1457

# readOnly: true

1458

1459

deleteDatasources: []

1460

# - name: example-datasource

1461

# orgId: 1

1462

1463

## Configure additional grafana datasources (passed through tpl)

1464

## ref: https://grafana.com/docs/grafana/latest/administration/provisioning/#datasources

1465

additionalDataSources: []

1466

# - name: prometheus-sample

1467

# access: proxy

1468

# basicAuth: true

1469

# secureJsonData:

1470

# basicAuthPassword: pass

1471

# basicAuthUser: daco

1472

# editable: false

1473

# jsonData:

1474

# tlsSkipVerify: true

1475

# orgId: 1

1476

# type: prometheus

1477

# url: https://{{ printf "%s-prometheus.svc" .Release.Name }}:9090

1478

# version: 1

1479

1480

## Configure additional grafana datasources as a templated string (passed through tpl)

1481

## Useful when you need Helm flow control or templating inside the datasource definition

1482

additionalDataSourcesString: ""

1483

# Flag to mark provisioned data sources for deletion if they are no longer configured.

1484

# It takes no effect if data sources are already listed in the deleteDatasources section.

1485

# ref: https://grafana.com/docs/grafana/latest/administration/provisioning/#example-data-source-configuration-file

1486

prune: false

1487

## Passed to grafana subchart and used by servicemonitor below

1488

1489

service:

1490

portName: http-web

1491

ipFamilies: []

1492

ipFamilyPolicy: ""

1493

serviceMonitor:

1494

# If true, a ServiceMonitor CRD is created for a prometheus operator

1495

# https://github.com/prometheus-operator/prometheus-operator

1496

1497

enabled: true

1498

# Path to use for scraping metrics. Might be different if server.root_url is set

1499

# in grafana.ini

1500

# path: /metrics

1501

1502

# namespace: monitoring (defaults to use the namespace this chart is deployed to)

1503

1504

# labels for the ServiceMonitor

1505

# labels: {}

1506

1507

# Extra scrape settings.

1508

# interval: ""

1509

# scheme: http

1510

# tlsConfig: {}

1511

# scrapeTimeout: 30s

1512

1513

## RelabelConfigs to apply to samples before scraping

1514

## ref: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api-reference/api.md#relabelconfig

1515

1516

# relabelings: []

1517

# - sourceLabels: [__meta_kubernetes_pod_node_name]

1518

# separator: ;

1519

# regex: ^(.*)$

1520

# targetLabel: nodename

1521

# replacement: $1

1522

# action: replace

1523

## Flag to disable all the kubernetes component scrapers

1524

1525

kubernetesServiceMonitors:

1526

enabled: true

1527

## Component scraping the kube api server

1528

1529

kubeApiServer:

1530

enabled: true

1531

## TLS configuration of the ServiceMonitor endpoint. Rendered as-is, so any field of the

1532

## Prometheus Operator SafeTLSConfig type can be set here.

1533

## ref: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api-reference/api.md#monitoring.coreos.com/v1.SafeTLSConfig

1534

1535

tlsConfig:

1536

serverName: kubernetes

1537

insecureSkipVerify: false

1538

ca:

1539

configMap:

1540

1541

key: ca.crt

1542

serviceMonitor:

1543

enabled: true

1544

## Scrape interval. If not set, the Prometheus default scrape interval is used.

1545

1546

interval: ""

1547

## Bearer credentials used to scrape this component. Rendered as-is, so any field of the

1548

## Prometheus Operator SafeAuthorization type can be set here. Set to null to scrape without

1549

## authentication.

1550

## ref: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api-reference/api.md#monitoring.coreos.com/v1.SafeAuthorization

1551

1552

authorization:

1553

type: Bearer

1554

credentials:

1555

1556

key: token

1557

## SampleLimit defines per-scrape limit on number of scraped samples that will be accepted.

1558

1559

sampleLimit: 0

1560

## TargetLimit defines a limit on the number of scraped targets that will be accepted.

1561

1562

targetLimit: 0

1563

## Per-scrape limit on number of labels that will be accepted for a sample. Only valid in Prometheus versions 2.27.0 and newer.

1564

1565

labelLimit: 0

1566

## Per-scrape limit on length of labels name that will be accepted for a sample. Only valid in Prometheus versions 2.27.0 and newer.

1567

1568

labelNameLengthLimit: 0

1569

## Per-scrape limit on length of labels value that will be accepted for a sample. Only valid in Prometheus versions 2.27.0 and newer.

1570

1571

labelValueLengthLimit: 0

1572

## proxyUrl: URL of a proxy that should be used for scraping.

1573

1574

proxyUrl: ""

1575

jobLabel: component

1576

selector:

1577

matchLabels:

1578

component: apiserver

1579

provider: kubernetes

1580

## MetricRelabelConfigs to apply to samples after scraping, but before ingestion.

1581

## ref: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api-reference/api.md#relabelconfig

1582

1583

metricRelabelings:

1584

# Drop excessively noisy apiserver buckets.

1585

- action: drop

1586

regex: (etcd_request|apiserver_request_slo|apiserver_request_sli|apiserver_request)_duration_seconds_bucket;(0\.15|0\.2|0\.3|0\.35|0\.4|0\.45|0\.6|0\.7|0\.8|0\.9|1\.25|1\.5|1\.75|2|3|3\.5|4|4\.5|6|7|8|9|15|20|40|45|50)(\.0)?

1587

sourceLabels:

1588

- __name__

1589

- le

1590

# - action: keep

1591

1592

# sourceLabels: [__name__]

1593

1594

## RelabelConfigs to apply to samples before scraping

1595

## ref: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api-reference/api.md#relabelconfig

1596

1597

relabelings: []

1598

# - sourceLabels:

1599

# - __meta_kubernetes_namespace

1600

# - __meta_kubernetes_service_name

1601

# - __meta_kubernetes_endpoint_port_name

1602

# action: keep

1603

# regex: default;kubernetes;https

1604

# - targetLabel: __address__

1605

# replacement: kubernetes.default.svc:443

1606

1607

## Additional labels

1608

1609

additionalLabels: {}

1610

# foo: bar

1611

1612

## defines the labels which are transferred from the associated Kubernetes Service object onto the ingested metrics.

1613

## https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api-reference/api.md#servicemonitor

1614

targetLabels: []

1615

## Override the job label used for the apiserver.

1616

## This allows users who scrape apiserver metrics under a different job name (e.g. k3s-server via PushProx)

1617

## to align the recording rules and alerts with their actual job label.

1618

jobNameOverride: ""

1619

## Component scraping the kubelet and kubelet-hosted cAdvisor

1620

1621

kubelet:

1622

enabled: true

1623

namespace: kube-system

1624

# Overrides the job selector in Grafana dashboards and Prometheus rules

1625

# For k3s clusters, change to k3s-server

1626

jobNameOverride: ""

1627

serviceMonitor:

1628

enabled: true

1629

## Enable scraping /metrics from kubelet's service

1630

kubelet: true

1631

## Attach metadata to discovered targets. Requires Prometheus v2.45 for endpoints created by the operator.

1632

1633

attachMetadata:

1634

node: false

1635

## Scrape interval. If not set, the Prometheus default scrape interval is used.

1636

1637

interval: ""

1638

## If true, Prometheus use (respect) labels provided by exporter.

1639

1640

honorLabels: true

1641

## If true, Prometheus ingests metrics with timestamp provided by exporter. If false, Prometheus ingests metrics with timestamp of scrape.

1642

1643

honorTimestamps: true

1644

## If true, defines whether Prometheus tracks staleness of the metrics that have an explicit timestamp present in scraped data. Has no effect if `honorTimestamps` is false.

1645

## We recommend enabling this if you want the best possible accuracy for container_ metrics scraped from cadvisor.

1646

## For more details see: https://github.com/prometheus-community/helm-charts/pull/5063#issuecomment-2545374849

1647

trackTimestampsStaleness: true

1648

## SampleLimit defines per-scrape limit on number of scraped samples that will be accepted.

1649

1650

sampleLimit: 0

1651

## TargetLimit defines a limit on the number of scraped targets that will be accepted.

1652

1653

targetLimit: 0

1654

## Per-scrape limit on number of labels that will be accepted for a sample. Only valid in Prometheus versions 2.27.0 and newer.

1655

1656

labelLimit: 0

1657

## Per-scrape limit on length of labels name that will be accepted for a sample. Only valid in Prometheus versions 2.27.0 and newer.

1658

1659

labelNameLengthLimit: 0

1660

## Per-scrape limit on length of labels value that will be accepted for a sample. Only valid in Prometheus versions 2.27.0 and newer.

1661

1662

labelValueLengthLimit: 0

1663

## proxyUrl: URL of a proxy that should be used for scraping.

1664

1665

proxyUrl: ""

1666

## Enable scraping the kubelet over https. For requirements to enable this see

1667

## https://github.com/prometheus-operator/prometheus-operator/issues/926

1668

1669

https: true

1670

## Bearer credentials used to scrape this component. Rendered as-is, so any field of the

1671

## Prometheus Operator SafeAuthorization type can be set here. Set to null to scrape without

1672

## authentication.

1673

## ref: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api-reference/api.md#monitoring.coreos.com/v1.SafeAuthorization

1674

1675

authorization:

1676

type: Bearer

1677

credentials:

1678

1679

key: token

1680

## TLS configuration of the ServiceMonitor endpoint. Only applies when scraping over https.

1681

## Rendered as-is, so any field of the Prometheus Operator SafeTLSConfig type can be set here.

1682

## insecureSkipVerify is enabled by default because the kubelet serving certificate deployed by

1683

## kubeadm is self-signed.

1684

## ref: https://kubernetes.io/docs/tasks/administer-cluster/kubeadm/kubeadm-certs/#kubelet-serving-certs

1685

## ref: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api-reference/api.md#monitoring.coreos.com/v1.SafeTLSConfig

1686

1687

tlsConfig:

1688

insecureSkipVerify: true

1689

ca:

1690

configMap:

1691

1692

key: ca.crt

1693

## Enable scraping /metrics/probes from kubelet's service

1694

1695

probes: true

1696

## Enable scraping /metrics/resource from kubelet's service

1697

## This is disabled by default because container metrics are already exposed by cAdvisor

1698

1699

resource: false

1700

# From kubernetes 1.18, /metrics/resource/v1alpha1 renamed to /metrics/resource

1701

resourcePath: "/metrics/resource/v1alpha1"

1702

## Configure the scrape interval for resource metrics. This is configured to the default Kubelet cAdvisor

1703

## minimum housekeeping interval in order to avoid missing samples. Note, this value is ignored

1704

## if kubelet.serviceMonitor.interval is not empty.

1705

resourceInterval: 10s

1706

## Enable scraping /metrics/cadvisor from kubelet's service

1707

1708

cAdvisor: true

1709

## Configure the scrape interval for cAdvisor. This is configured to the default Kubelet cAdvisor

1710

## minimum housekeeping interval in order to avoid missing samples. Note, this value is ignored

1711

## if kubelet.serviceMonitor.interval is not empty.

1712

cAdvisorInterval: 10s

1713

## MetricRelabelConfigs to apply to samples after scraping, but before ingestion.

1714

## ref: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api-reference/api.md#relabelconfig

1715

1716

cAdvisorMetricRelabelings:

1717

# Drop less useful container CPU metrics.

1718

- sourceLabels: [__name__]

1719

action: drop

1720

regex: 'container_cpu_(cfs_throttled_seconds_total|load_average_10s|system_seconds_total|user_seconds_total)'

1721

# Drop less useful container / always zero filesystem metrics.

1722

- sourceLabels: [__name__]

1723

action: drop

1724

1725

# Drop less useful / always zero container memory metrics.

1726

- sourceLabels: [__name__]

1727

action: drop

1728

regex: 'container_memory_(mapped_file|swap)'

1729

# Drop less useful container process metrics.

1730

- sourceLabels: [__name__]

1731

action: drop

1732

regex: 'container_(file_descriptors|tasks_state|threads_max)'

1733

# Drop container_memory_failures_total{scope="hierarchy"} metrics,

1734

# we only need the container scope.

1735

- sourceLabels: [__name__, scope]

1736

action: drop

1737

regex: 'container_memory_failures_total;hierarchy'

1738

# Drop container_network_... metrics that match various interfaces that

1739

# correspond to CNI and similar interfaces. This avoids capturing network

1740

# metrics for host network containers.

1741

- sourceLabels: [__name__, interface]

1742

action: drop

1743

1744

# Drop container spec metrics that overlap with kube-state-metrics.

1745

- sourceLabels: [__name__]

1746

action: drop

1747

regex: 'container_spec.*'

1748

# Drop cgroup metrics with no pod.

1749

- sourceLabels: [id, pod]

1750

action: drop

1751

regex: '.+;'

1752

# - sourceLabels: [__name__, image]

1753

# separator: ;

1754

# regex: container_([a-z_]+);

1755

# replacement: $1

1756

# action: drop

1757

# - sourceLabels: [__name__]

1758

# separator: ;

1759

# regex: container_(network_tcp_usage_total|network_udp_usage_total|tasks_state|cpu_load_average_10s)

1760

# replacement: $1

1761

# action: drop

1762

1763

## MetricRelabelConfigs to apply to samples after scraping, but before ingestion.

1764

## ref: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api-reference/api.md#relabelconfig

1765

1766

probesMetricRelabelings: []

1767

# - sourceLabels: [__name__, image]

1768

# separator: ;

1769

# regex: container_([a-z_]+);

1770

# replacement: $1

1771

# action: drop

1772

# - sourceLabels: [__name__]

1773

# separator: ;

1774

# regex: container_(network_tcp_usage_total|network_udp_usage_total|tasks_state|cpu_load_average_10s)

1775

# replacement: $1

1776

# action: drop

1777

1778

## RelabelConfigs to apply to samples before scraping

1779

## ref: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api-reference/api.md#relabelconfig

1780

1781

## metrics_path is required to match upstream rules and charts

1782

cAdvisorRelabelings:

1783

- action: replace

1784

sourceLabels: [__metrics_path__]

1785

targetLabel: metrics_path

1786

# - sourceLabels: [__meta_kubernetes_pod_node_name]

1787

# separator: ;

1788

# regex: ^(.*)$

1789

# targetLabel: nodename

1790

# replacement: $1

1791

# action: replace

1792

1793

## RelabelConfigs to apply to samples before scraping

1794

## ref: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api-reference/api.md#relabelconfig

1795

1796

probesRelabelings:

1797

- action: replace

1798

sourceLabels: [__metrics_path__]

1799

targetLabel: metrics_path

1800

# - sourceLabels: [__meta_kubernetes_pod_node_name]

1801

# separator: ;

1802

# regex: ^(.*)$

1803

# targetLabel: nodename

1804

# replacement: $1

1805

# action: replace

1806

1807

## RelabelConfigs to apply to samples before scraping

1808

## ref: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api-reference/api.md#relabelconfig

1809

1810

resourceRelabelings:

1811

- action: replace

1812

sourceLabels: [__metrics_path__]

1813

targetLabel: metrics_path

1814

# - sourceLabels: [__meta_kubernetes_pod_node_name]

1815

# separator: ;

1816

# regex: ^(.*)$

1817

# targetLabel: nodename

1818

# replacement: $1

1819

# action: replace

1820

1821

## MetricRelabelConfigs to apply to samples after scraping, but before ingestion.

1822

## ref: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api-reference/api.md#relabelconfig

1823

1824

metricRelabelings:

1825

# Reduce bucket cardinality of kubelet storage operations.

1826

- action: drop

1827

sourceLabels: [__name__, le]

1828

regex: (csi_operations|storage_operation_duration)_seconds_bucket;(0.25|2.5|15|25|120|600)(\.0)?

1829

# - sourceLabels: [__name__, image]

1830

# separator: ;

1831

# regex: container_([a-z_]+);

1832

# replacement: $1

1833

# action: drop

1834

# - sourceLabels: [__name__]

1835

# separator: ;

1836

# regex: container_(network_tcp_usage_total|network_udp_usage_total|tasks_state|cpu_load_average_10s)

1837

# replacement: $1

1838

# action: drop

1839

1840

## RelabelConfigs to apply to samples before scraping

1841

## ref: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api-reference/api.md#relabelconfig

1842

1843

## metrics_path is required to match upstream rules and charts

1844

relabelings:

1845

- action: replace

1846

sourceLabels: [__metrics_path__]

1847

targetLabel: metrics_path

1848

# - sourceLabels: [__meta_kubernetes_pod_node_name]

1849

# separator: ;

1850

# regex: ^(.*)$

1851

# targetLabel: nodename

1852

# replacement: $1

1853

# action: replace

1854

1855

## Additional labels

1856

1857

additionalLabels: {}

1858

# foo: bar

1859

1860

## defines the labels which are transferred from the associated Kubernetes Service object onto the ingested metrics.

1861

## https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api-reference/api.md#servicemonitor

1862

targetLabels: []

1863

## Component scraping the kube controller manager

1864

1865

kubeControllerManager:

1866

enabled: true

1867

# Overrides the job selector in Grafana dashboards and Prometheus rules

1868

# For k3s clusters, change to k3s-server

1869

jobNameOverride: ""

1870

## If your kube controller manager is not deployed as a pod, specify IPs it can be found on

1871

1872

endpoints: []

1873

# - 10.141.4.22

1874

# - 10.141.4.23

1875

# - 10.141.4.24

1876

1877

## If using kubeControllerManager.endpoints only the port and targetPort are used

1878

1879

service:

1880

enabled: true

1881

## If null or unset, the value is determined dynamically based on target Kubernetes version due to change

1882

## of default port in Kubernetes 1.22.

1883

1884

port: null

1885

targetPort: null

1886

ipDualStack:

1887

enabled: false

1888

ipFamilies: ["IPv6", "IPv4"]

1889

ipFamilyPolicy: "PreferDualStack"

1890

# selector:

1891

# component: kube-controller-manager

1892

serviceMonitor:

1893

enabled: true

1894

## Scrape interval. If not set, the Prometheus default scrape interval is used.

1895

1896

interval: ""

1897

## SampleLimit defines per-scrape limit on number of scraped samples that will be accepted.

1898

1899

sampleLimit: 0

1900

## TargetLimit defines a limit on the number of scraped targets that will be accepted.

1901

1902

targetLimit: 0

1903

## Per-scrape limit on number of labels that will be accepted for a sample. Only valid in Prometheus versions 2.27.0 and newer.

1904

1905

labelLimit: 0

1906

## Per-scrape limit on length of labels name that will be accepted for a sample. Only valid in Prometheus versions 2.27.0 and newer.

1907

1908

labelNameLengthLimit: 0

1909

## Per-scrape limit on length of labels value that will be accepted for a sample. Only valid in Prometheus versions 2.27.0 and newer.

1910

1911

labelValueLengthLimit: 0

1912

## proxyUrl: URL of a proxy that should be used for scraping.

1913

1914

proxyUrl: ""

1915

## port: Name of the port the metrics will be scraped from

1916

1917

port: http-metrics

1918

jobLabel: jobLabel

1919

selector: {}

1920

# matchLabels:

1921

# component: kube-controller-manager

1922

1923

## Enable scraping kube-controller-manager over https.

1924

## Requires proper certs (not self-signed) and delegated authentication/authorization checks.

1925

## If null or unset, the value is determined dynamically based on target Kubernetes version.

1926

1927

https: null

1928

## Bearer credentials used to scrape this component. Rendered as-is, so any field of the

1929

## Prometheus Operator SafeAuthorization type can be set here. Set to null to scrape without

1930

## authentication.

1931

## ref: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api-reference/api.md#monitoring.coreos.com/v1.SafeAuthorization

1932

1933

authorization:

1934

type: Bearer

1935

credentials:

1936

1937

key: token

1938

## TLS configuration of the ServiceMonitor endpoint. Only applies when scraping over https.

1939

## Rendered as-is, so any field of the Prometheus Operator SafeTLSConfig type can be set here.

1940

## ref: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api-reference/api.md#monitoring.coreos.com/v1.SafeTLSConfig

1941

1942

tlsConfig:

1943

insecureSkipVerify: true

1944

ca:

1945

configMap:

1946

1947

key: ca.crt

1948

## MetricRelabelConfigs to apply to samples after scraping, but before ingestion.

1949

## ref: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api-reference/api.md#relabelconfig

1950

1951

metricRelabelings: []

1952

# - action: keep

1953

1954

# sourceLabels: [__name__]

1955

1956

## RelabelConfigs to apply to samples before scraping

1957

## ref: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api-reference/api.md#relabelconfig

1958

1959

relabelings: []

1960

# - sourceLabels: [__meta_kubernetes_pod_node_name]

1961

# separator: ;

1962

# regex: ^(.*)$

1963

# targetLabel: nodename

1964

# replacement: $1

1965

# action: replace

1966

1967

## Additional labels

1968

1969

additionalLabels: {}

1970

# foo: bar

1971

1972

## defines the labels which are transferred from the associated Kubernetes Service object onto the ingested metrics.

1973

## https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api-reference/api.md#servicemonitor

1974

targetLabels: []

1975

## Component scraping coreDns. Use either this or kubeDns

1976

1977

coreDns:

1978

enabled: true

1979

service:

1980

enabled: true

1981

port: 9153

1982

targetPort: 9153

1983

ipDualStack:

1984

enabled: false

1985

ipFamilies: ["IPv6", "IPv4"]

1986

ipFamilyPolicy: "PreferDualStack"

1987

# selector:

1988

# k8s-app: kube-dns

1989

serviceMonitor:

1990

enabled: true

1991

## Scrape interval. If not set, the Prometheus default scrape interval is used.

1992

1993

interval: ""

1994

## SampleLimit defines per-scrape limit on number of scraped samples that will be accepted.

1995

1996

sampleLimit: 0

1997

## TargetLimit defines a limit on the number of scraped targets that will be accepted.

1998

1999

targetLimit: 0

2000

## Per-scrape limit on number of labels that will be accepted for a sample. Only valid in Prometheus versions 2.27.0 and newer.

2001

2002

labelLimit: 0

2003

## Per-scrape limit on length of labels name that will be accepted for a sample. Only valid in Prometheus versions 2.27.0 and newer.

2004

2005

labelNameLengthLimit: 0

2006

## Per-scrape limit on length of labels value that will be accepted for a sample. Only valid in Prometheus versions 2.27.0 and newer.

2007

2008

labelValueLengthLimit: 0

2009

## proxyUrl: URL of a proxy that should be used for scraping.

2010

2011

proxyUrl: ""

2012

## port: Name of the port the metrics will be scraped from

2013

2014

port: http-metrics

2015

jobLabel: jobLabel

2016

selector: {}

2017

# matchLabels:

2018

# k8s-app: kube-dns

2019

2020

## MetricRelabelConfigs to apply to samples after scraping, but before ingestion.

2021

## ref: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api-reference/api.md#relabelconfig

2022

2023

metricRelabelings: []

2024

# - action: keep

2025

2026

# sourceLabels: [__name__]

2027

2028

## RelabelConfigs to apply to samples before scraping

2029

## ref: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api-reference/api.md#relabelconfig

2030

2031

relabelings: []

2032

# - sourceLabels: [__meta_kubernetes_pod_node_name]

2033

# separator: ;

2034

# regex: ^(.*)$

2035

# targetLabel: nodename

2036

# replacement: $1

2037

# action: replace

2038

2039

## Additional labels

2040

2041

additionalLabels: {}

2042

# foo: bar

2043

2044

## defines the labels which are transferred from the associated Kubernetes Service object onto the ingested metrics.

2045

## https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api-reference/api.md#servicemonitor

2046

targetLabels: []

2047

## Bearer credentials used to scrape this component. Rendered as-is, so any field of the

2048

## Prometheus Operator SafeAuthorization type can be set here. Set to null to scrape without

2049

## authentication.

2050

## ref: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api-reference/api.md#monitoring.coreos.com/v1.SafeAuthorization

2051

2052

authorization:

2053

type: Bearer

2054

credentials:

2055

2056

key: token

2057

## Component scraping kubeDns. Use either this or coreDns

2058

2059

kubeDns:

2060

enabled: false

2061

service:

2062

dnsmasq:

2063

port: 10054

2064

targetPort: 10054

2065

skydns:

2066

port: 10055

2067

targetPort: 10055

2068

ipDualStack:

2069

enabled: false

2070

ipFamilies: ["IPv6", "IPv4"]

2071

ipFamilyPolicy: "PreferDualStack"

2072

# selector:

2073

# k8s-app: kube-dns

2074

serviceMonitor:

2075

## Scrape interval. If not set, the Prometheus default scrape interval is used.

2076

2077

interval: ""

2078

## SampleLimit defines per-scrape limit on number of scraped samples that will be accepted.

2079

2080

sampleLimit: 0

2081

## TargetLimit defines a limit on the number of scraped targets that will be accepted.

2082

2083

targetLimit: 0

2084

## Per-scrape limit on number of labels that will be accepted for a sample. Only valid in Prometheus versions 2.27.0 and newer.

2085

2086

labelLimit: 0

2087

## Per-scrape limit on length of labels name that will be accepted for a sample. Only valid in Prometheus versions 2.27.0 and newer.

2088

2089

labelNameLengthLimit: 0

2090

## Per-scrape limit on length of labels value that will be accepted for a sample. Only valid in Prometheus versions 2.27.0 and newer.

2091

2092

labelValueLengthLimit: 0

2093

## proxyUrl: URL of a proxy that should be used for scraping.

2094

2095

proxyUrl: ""

2096

jobLabel: jobLabel

2097

selector: {}

2098

# matchLabels:

2099

# k8s-app: kube-dns

2100

2101

## MetricRelabelConfigs to apply to samples after scraping, but before ingestion.

2102

## ref: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api-reference/api.md#relabelconfig

2103

2104

metricRelabelings: []

2105

# - action: keep

2106

2107

# sourceLabels: [__name__]

2108

2109

## RelabelConfigs to apply to samples before scraping

2110

## ref: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api-reference/api.md#relabelconfig

2111

2112

relabelings: []

2113

# - sourceLabels: [__meta_kubernetes_pod_node_name]

2114

# separator: ;

2115

# regex: ^(.*)$

2116

# targetLabel: nodename

2117

# replacement: $1

2118

# action: replace

2119

2120

## MetricRelabelConfigs to apply to samples after scraping, but before ingestion.

2121

## ref: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api-reference/api.md#relabelconfig

2122

2123

dnsmasqMetricRelabelings: []

2124

# - action: keep

2125

2126

# sourceLabels: [__name__]

2127

2128

## RelabelConfigs to apply to samples before scraping

2129

## ref: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api-reference/api.md#relabelconfig

2130

2131

dnsmasqRelabelings: []

2132

# - sourceLabels: [__meta_kubernetes_pod_node_name]

2133

# separator: ;

2134

# regex: ^(.*)$

2135

# targetLabel: nodename

2136

# replacement: $1

2137

# action: replace

2138

2139

## Additional labels

2140

2141

additionalLabels: {}

2142

# foo: bar

2143

2144

## defines the labels which are transferred from the associated Kubernetes Service object onto the ingested metrics.

2145

## https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api-reference/api.md#servicemonitor

2146

targetLabels: []

2147

## Bearer credentials used to scrape this component. Rendered as-is, so any field of the

2148

## Prometheus Operator SafeAuthorization type can be set here. Set to null to scrape without

2149

## authentication.

2150

## ref: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api-reference/api.md#monitoring.coreos.com/v1.SafeAuthorization

2151

2152

authorization:

2153

type: Bearer

2154

credentials:

2155

2156

key: token

2157

## Component scraping etcd

2158

2159

kubeEtcd:

2160

enabled: true

2161

## If your etcd is not deployed as a pod, specify IPs it can be found on

2162

2163

endpoints: []

2164

# - 10.141.4.22

2165

# - 10.141.4.23

2166

# - 10.141.4.24

2167

2168

## Etcd service. If using kubeEtcd.endpoints only the port and targetPort are used

2169

2170

service:

2171

enabled: true

2172

port: 2381

2173

targetPort: 2381

2174

ipDualStack:

2175

enabled: false

2176

ipFamilies: ["IPv6", "IPv4"]

2177

ipFamilyPolicy: "PreferDualStack"

2178

# selector:

2179

# component: etcd

2180

## Configure secure access to the etcd cluster by referencing a secret holding the client

2181

## certificate. For example, with a secret named etcd-client-cert

2182

2183

## serviceMonitor:

2184

## scheme: https

2185

## tlsConfig:

2186

## insecureSkipVerify: false

2187

## serverName: localhost

2188

## ca:

2189

## secret:

2190

## name: etcd-client-cert

2191

## key: etcd-ca

2192

## cert:

2193

## secret:

2194

## name: etcd-client-cert

2195

## key: etcd-client

2196

## keySecret:

2197

## name: etcd-client-cert

2198

## key: etcd-client-key

2199

2200

serviceMonitor:

2201

enabled: true

2202

## Scrape interval. If not set, the Prometheus default scrape interval is used.

2203

2204

interval: ""

2205

## SampleLimit defines per-scrape limit on number of scraped samples that will be accepted.

2206

2207

sampleLimit: 0

2208

## TargetLimit defines a limit on the number of scraped targets that will be accepted.

2209

2210

targetLimit: 0

2211

## Per-scrape limit on number of labels that will be accepted for a sample. Only valid in Prometheus versions 2.27.0 and newer.

2212

2213

labelLimit: 0

2214

## Per-scrape limit on length of labels name that will be accepted for a sample. Only valid in Prometheus versions 2.27.0 and newer.

2215

2216

labelNameLengthLimit: 0

2217

## Per-scrape limit on length of labels value that will be accepted for a sample. Only valid in Prometheus versions 2.27.0 and newer.

2218

2219

labelValueLengthLimit: 0

2220

## proxyUrl: URL of a proxy that should be used for scraping.

2221

2222

proxyUrl: ""

2223

scheme: http

2224

## TLS configuration of the ServiceMonitor endpoint. Only applies when scheme is https.

2225

## Rendered as-is, so any field of the Prometheus Operator SafeTLSConfig type can be set here.

2226

## etcd requires client certificates, see the commented example above.

2227

## ref: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api-reference/api.md#monitoring.coreos.com/v1.SafeTLSConfig

2228

2229

tlsConfig:

2230

insecureSkipVerify: false

2231

## port: Name of the port the metrics will be scraped from

2232

2233

port: http-metrics

2234

jobLabel: jobLabel

2235

selector: {}

2236

# matchLabels:

2237

# component: etcd

2238

2239

## MetricRelabelConfigs to apply to samples after scraping, but before ingestion.

2240

## ref: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api-reference/api.md#relabelconfig

2241

2242

metricRelabelings: []

2243

# - action: keep

2244

2245

# sourceLabels: [__name__]

2246

2247

## RelabelConfigs to apply to samples before scraping

2248

## ref: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api-reference/api.md#relabelconfig

2249

2250

relabelings: []

2251

# - sourceLabels: [__meta_kubernetes_pod_node_name]

2252

# separator: ;

2253

# regex: ^(.*)$

2254

# targetLabel: nodename

2255

# replacement: $1

2256

# action: replace

2257

2258

## Additional labels

2259

2260

additionalLabels: {}

2261

# foo: bar

2262

2263

## defines the labels which are transferred from the associated Kubernetes Service object onto the ingested metrics.

2264

## https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api-reference/api.md#servicemonitor

2265

targetLabels: []

2266

## Bearer credentials used to scrape this component. Rendered as-is, so any field of the

2267

## Prometheus Operator SafeAuthorization type can be set here. Set to null to scrape without

2268

## authentication.

2269

## ref: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api-reference/api.md#monitoring.coreos.com/v1.SafeAuthorization

2270

2271

authorization:

2272

type: Bearer

2273

credentials:

2274

2275

key: token

2276

## Component scraping kube scheduler

2277

2278

kubeScheduler:

2279

enabled: true

2280

# Overrides the job selector in Grafana dashboards and Prometheus rules

2281

# For k3s clusters, change to k3s-server

2282

jobNameOverride: ""

2283

## If your kube scheduler is not deployed as a pod, specify IPs it can be found on

2284

2285

endpoints: []

2286

# - 10.141.4.22

2287

# - 10.141.4.23

2288

# - 10.141.4.24

2289

2290

## If using kubeScheduler.endpoints only the port and targetPort are used

2291

2292

service:

2293

enabled: true

2294

## If null or unset, the value is determined dynamically based on target Kubernetes version due to change

2295

## of default port in Kubernetes 1.23.

2296

2297

port: null

2298

targetPort: null

2299

ipDualStack:

2300

enabled: false

2301

ipFamilies: ["IPv6", "IPv4"]

2302

ipFamilyPolicy: "PreferDualStack"

2303

# selector:

2304

# component: kube-scheduler

2305

serviceMonitor:

2306

enabled: true

2307

## Scrape interval. If not set, the Prometheus default scrape interval is used.

2308

2309

interval: ""

2310

## SampleLimit defines per-scrape limit on number of scraped samples that will be accepted.

2311

2312

sampleLimit: 0

2313

## TargetLimit defines a limit on the number of scraped targets that will be accepted.

2314

2315

targetLimit: 0

2316

## Per-scrape limit on number of labels that will be accepted for a sample. Only valid in Prometheus versions 2.27.0 and newer.

2317

2318

labelLimit: 0

2319

## Per-scrape limit on length of labels name that will be accepted for a sample. Only valid in Prometheus versions 2.27.0 and newer.

2320

2321

labelNameLengthLimit: 0

2322

## Per-scrape limit on length of labels value that will be accepted for a sample. Only valid in Prometheus versions 2.27.0 and newer.

2323

2324

labelValueLengthLimit: 0

2325

## proxyUrl: URL of a proxy that should be used for scraping.

2326

2327

proxyUrl: ""

2328

## Enable scraping kube-scheduler over https.

2329

## Requires proper certs (not self-signed) and delegated authentication/authorization checks.

2330

## If null or unset, the value is determined dynamically based on target Kubernetes version.

2331

2332

https: null

2333

## port: Name of the port the metrics will be scraped from

2334

2335

port: http-metrics

2336

jobLabel: jobLabel

2337

selector: {}

2338

# matchLabels:

2339

# component: kube-scheduler

2340

2341

## Bearer credentials used to scrape this component. Rendered as-is, so any field of the

2342

## Prometheus Operator SafeAuthorization type can be set here. Set to null to scrape without

2343

## authentication.

2344

## ref: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api-reference/api.md#monitoring.coreos.com/v1.SafeAuthorization

2345

2346

authorization:

2347

type: Bearer

2348

credentials:

2349

2350

key: token

2351

## TLS configuration of the ServiceMonitor endpoint. Only applies when scraping over https.

2352

## Rendered as-is, so any field of the Prometheus Operator SafeTLSConfig type can be set here.

2353

## ref: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api-reference/api.md#monitoring.coreos.com/v1.SafeTLSConfig

2354

2355

tlsConfig:

2356

insecureSkipVerify: true

2357

ca:

2358

configMap:

2359

2360

key: ca.crt

2361

## MetricRelabelConfigs to apply to samples after scraping, but before ingestion.

2362

## ref: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api-reference/api.md#relabelconfig

2363

2364

metricRelabelings: []

2365

# - action: keep

2366

2367

# sourceLabels: [__name__]

2368

2369

## RelabelConfigs to apply to samples before scraping

2370

## ref: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api-reference/api.md#relabelconfig

2371

2372

relabelings: []

2373

# - sourceLabels: [__meta_kubernetes_pod_node_name]

2374

# separator: ;

2375

# regex: ^(.*)$

2376

# targetLabel: nodename

2377

# replacement: $1

2378

# action: replace

2379

2380

## Additional labels

2381

2382

additionalLabels: {}

2383

# foo: bar

2384

2385

## defines the labels which are transferred from the associated Kubernetes Service object onto the ingested metrics.

2386

## https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api-reference/api.md#servicemonitor

2387

targetLabels: []

2388

resource:

2389

## Enable scraping /metrics/resource from kube-scheduler

2390

## https://kubernetes.io/docs/concepts/cluster-administration/system-metrics/#kube-scheduler-metrics

2391

enabled: false

2392

## Scrape interval. If not set, the Prometheus default scrape interval is used.

2393

2394

interval: ""

2395

## MetricRelabelConfigs to apply to samples after scraping, but before ingestion.

2396

## ref: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api-reference/api.md#relabelconfig

2397

2398

metricRelabelings: []

2399

# - action: keep

2400

2401

# sourceLabels: [__name__]

2402

2403

## RelabelConfigs to apply to samples before scraping

2404

## ref: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api-reference/api.md#relabelconfig

2405

2406

relabelings: []

2407

# - sourceLabels: [__meta_kubernetes_pod_node_name]

2408

# separator: ;

2409

# regex: ^(.*)$

2410

# targetLabel: nodename

2411

# replacement: $1

2412

# action: replace

2413

## Component scraping kube proxy

2414

2415

kubeProxy:

2416

enabled: true

2417

# Overrides the job selector in Grafana dashboards and Prometheus rules

2418

# For k3s clusters, change to k3s-server

2419

jobNameOverride: ""

2420

## If your kube proxy is not deployed as a pod, specify IPs it can be found on

2421

2422

endpoints: []

2423

# - 10.141.4.22

2424

# - 10.141.4.23

2425

# - 10.141.4.24

2426

2427

service:

2428

enabled: true

2429

port: 10249

2430

targetPort: 10249

2431

ipDualStack:

2432

enabled: false

2433

ipFamilies: ["IPv6", "IPv4"]

2434

ipFamilyPolicy: "PreferDualStack"

2435

# selector:

2436

# k8s-app: kube-proxy

2437

serviceMonitor:

2438

enabled: true

2439

## Scrape interval. If not set, the Prometheus default scrape interval is used.

2440

2441

interval: ""

2442

## SampleLimit defines per-scrape limit on number of scraped samples that will be accepted.

2443

2444

sampleLimit: 0

2445

## TargetLimit defines a limit on the number of scraped targets that will be accepted.

2446

2447

targetLimit: 0

2448

## Per-scrape limit on number of labels that will be accepted for a sample. Only valid in Prometheus versions 2.27.0 and newer.

2449

2450

labelLimit: 0

2451

## Per-scrape limit on length of labels name that will be accepted for a sample. Only valid in Prometheus versions 2.27.0 and newer.

2452

2453

labelNameLengthLimit: 0

2454

## Per-scrape limit on length of labels value that will be accepted for a sample. Only valid in Prometheus versions 2.27.0 and newer.

2455

2456

labelValueLengthLimit: 0

2457

## proxyUrl: URL of a proxy that should be used for scraping.

2458

2459

proxyUrl: ""

2460

## port: Name of the port the metrics will be scraped from

2461

2462

port: http-metrics

2463

jobLabel: jobLabel

2464

selector: {}

2465

# matchLabels:

2466

# k8s-app: kube-proxy

2467

2468

## Enable scraping kube-proxy over https.

2469

## Requires proper certs (not self-signed) and delegated authentication/authorization checks

2470

2471

https: false

2472

## TLS configuration of the ServiceMonitor endpoint. Only applies when scraping over https.

2473

## Rendered as-is, so any field of the Prometheus Operator SafeTLSConfig type can be set here.

2474

## ref: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api-reference/api.md#monitoring.coreos.com/v1.SafeTLSConfig

2475

2476

tlsConfig:

2477

ca:

2478

configMap:

2479

2480

key: ca.crt

2481

## MetricRelabelConfigs to apply to samples after scraping, but before ingestion.

2482

## ref: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api-reference/api.md#relabelconfig

2483

2484

metricRelabelings: []

2485

# - action: keep

2486

2487

# sourceLabels: [__name__]

2488

2489

## RelabelConfigs to apply to samples before scraping

2490

## ref: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api-reference/api.md#relabelconfig

2491

2492

relabelings: []

2493

# - action: keep

2494

2495

# sourceLabels: [__name__]

2496

2497

## Additional labels

2498

2499

additionalLabels: {}

2500

# foo: bar

2501

2502

## defines the labels which are transferred from the associated Kubernetes Service object onto the ingested metrics.

2503

## https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api-reference/api.md#servicemonitor

2504

targetLabels: []

2505

## Bearer credentials used to scrape this component. Rendered as-is, so any field of the

2506

## Prometheus Operator SafeAuthorization type can be set here. Set to null to scrape without

2507

## authentication.

2508

## ref: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api-reference/api.md#monitoring.coreos.com/v1.SafeAuthorization

2509

2510

authorization:

2511

type: Bearer

2512

credentials:

2513

2514

key: token

2515

## Component scraping kube state metrics

2516

2517

kubeStateMetrics:

2518

enabled: true

2519

## Configuration for kube-state-metrics subchart

2520

2521

kube-state-metrics:

2522

## set to true to add the release label so scraping of the servicemonitor with kube-prometheus-stack works out of the box

2523

releaseLabel: true

2524

## Enable scraping via kubernetes-service-endpoints

2525

## Disabled by default as we service monitor is enabled below

2526

2527

prometheusScrape: false

2528

prometheus:

2529

monitor:

2530

## Enable scraping via service monitor

2531

## Disable to prevent duplication if you enable prometheusScrape above

2532

enabled: true

2533

## kube-state-metrics endpoint

2534

http:

2535

## Keep labels from scraped data, overriding server-side labels

2536

honorLabels: true

2537

## selfMonitor endpoint

2538

metrics:

2539

## Keep labels from scraped data, overriding server-side labels

2540

honorLabels: true

2541

## Deploy node exporter as a daemonset to all nodes

2542

2543

nodeExporter:

2544

enabled: true

2545

operatingSystems:

2546

linux:

2547

enabled: true

2548

aix:

2549

enabled: true

2550

darwin:

2551

enabled: true

2552

## ForceDeployDashboard Create dashboard configmap even if nodeExporter deployment has been disabled

2553

2554

forceDeployDashboards: false

2555

## Configuration for prometheus-node-exporter subchart

2556

2557

prometheus-node-exporter:

2558

namespaceOverride: ""

2559

podLabels:

2560

## Add the 'node-exporter' label to be used by serviceMonitor and podMonitor to match standard common usage in rules and grafana dashboards

2561

2562

jobLabel: node-exporter

2563

releaseLabel: true

2564

extraArgs:

2565

2566

2567

service:

2568

portName: http-metrics

2569

ipDualStack:

2570

enabled: false

2571

ipFamilies: ["IPv6", "IPv4"]

2572

ipFamilyPolicy: "PreferDualStack"

2573

labels:

2574

jobLabel: node-exporter

2575

image:

2576

distroless: true

2577

prometheus:

2578

monitor:

2579

enabled: true

2580

jobLabel: jobLabel

2581

## Scrape interval. If not set, the Prometheus default scrape interval is used.

2582

2583

interval: ""

2584

## SampleLimit defines per-scrape limit on number of scraped samples that will be accepted.

2585

2586

sampleLimit: 0

2587

## TargetLimit defines a limit on the number of scraped targets that will be accepted.

2588

2589

targetLimit: 0

2590

## Per-scrape limit on number of labels that will be accepted for a sample. Only valid in Prometheus versions 2.27.0 and newer.

2591

2592

labelLimit: 0

2593

## Per-scrape limit on length of labels name that will be accepted for a sample. Only valid in Prometheus versions 2.27.0 and newer.

2594

2595

labelNameLengthLimit: 0

2596

## Per-scrape limit on length of labels value that will be accepted for a sample. Only valid in Prometheus versions 2.27.0 and newer.

2597

2598

labelValueLengthLimit: 0

2599

## How long until a scrape request times out. If not set, the Prometheus default scape timeout is used.

2600

2601

scrapeTimeout: ""

2602

## proxyUrl: URL of a proxy that should be used for scraping.

2603

2604

proxyUrl: ""

2605

## MetricRelabelConfigs to apply to samples after scraping, but before ingestion.

2606

## ref: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api-reference/api.md#relabelconfig

2607

2608

metricRelabelings: []

2609

# - sourceLabels: [__name__]

2610

# separator: ;

2611

# regex: ^node_mountstats_nfs_(event|operations|transport)_.+

2612

# replacement: $1

2613

# action: drop

2614

2615

## RelabelConfigs to apply to samples before scraping

2616

## ref: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api-reference/api.md#relabelconfig

2617

2618

relabelings: []

2619

# - sourceLabels: [__meta_kubernetes_pod_node_name]

2620

# separator: ;

2621

# regex: ^(.*)$

2622

# targetLabel: nodename

2623

# replacement: $1

2624

# action: replace

2625

## Attach node metadata to discovered targets. Requires Prometheus v2.35.0 and above.

2626

2627

# attachMetadata:

2628

# node: false

2629

2630

podMonitor:

2631

enabled: false

2632

jobLabel: jobLabel

2633

rbac:

2634

## If true, create PSPs for node-exporter

2635

2636

pspEnabled: false

2637

## Manages Prometheus and Alertmanager components

2638

2639

prometheusOperator:

2640

enabled: true

2641

## Use '{{ template "kube-prometheus-stack.fullname" . }}-operator' by default

2642

fullnameOverride: ""

2643

## Number of old replicasets to retain ##

2644

## The default value is 10, 0 will garbage-collect old replicasets ##

2645

revisionHistoryLimit: 10

2646

## Strategy of the deployment

2647

2648

strategy: {}

2649

## Prometheus-Operator v0.39.0 and later support TLS natively.

2650

2651

tls:

2652

enabled: true

2653

# Value must match version names from https://pkg.go.dev/crypto/tls#pkg-constants

2654

tlsMinVersion: VersionTLS13

2655

# The default webhook port is 10250 in order to work out-of-the-box in GKE private clusters and avoid adding firewall rules.

2656

internalPort: 10250

2657

## Liveness probe for the prometheusOperator deployment

2658

2659

livenessProbe:

2660

enabled: true

2661

failureThreshold: 3

2662

initialDelaySeconds: 0

2663

periodSeconds: 10

2664

successThreshold: 1

2665

timeoutSeconds: 1

2666

## Readiness probe for the prometheusOperator deployment

2667

2668

readinessProbe:

2669

enabled: true

2670

failureThreshold: 3

2671

initialDelaySeconds: 0

2672

periodSeconds: 10

2673

successThreshold: 1

2674

timeoutSeconds: 1

2675

## Admission webhook support for PrometheusRules resources added in Prometheus Operator 0.30 can be enabled to prevent incorrectly formatted

2676

## rules from making their way into prometheus and potentially preventing the container from starting

2677

admissionWebhooks:

2678

## Valid values: Fail, Ignore, IgnoreOnInstallOnly

2679

## IgnoreOnInstallOnly - If Release.IsInstall returns "true", set "Ignore" otherwise "Fail"

2680

failurePolicy: ""

2681

## The default timeoutSeconds is 10 and the maximum value is 30.

2682

timeoutSeconds: 10

2683

enabled: true

2684

## A PEM encoded CA bundle which will be used to validate the webhook's server certificate.

2685

## If unspecified, system trust roots on the apiserver are used.

2686

caBundle: ""

2687

## If enabled, generate a self-signed certificate, then patch the webhook configurations with the generated data.

2688

## On chart upgrades (or if the secret exists) the cert will not be re-generated. You can use this to provide your own

2689

## certs ahead of time if you wish.

2690

2691

annotations: {}

2692

# argocd.argoproj.io/hook: PreSync

2693

# argocd.argoproj.io/hook-delete-policy: HookSucceeded

2694

2695

namespaceSelector: {}

2696

objectSelector: {}

2697

# Match conditions for admission webhooks.

2698

# Must be a list, for example:

2699

# - name: exclude-leases

2700

# expression: '!(request.resource.group == "coordination.k8s.io" && request.resource.resource == "leases")'

2701

matchConditions: []

2702

mutatingWebhookConfiguration:

2703

annotations: {}

2704

# argocd.argoproj.io/hook: PreSync

2705

validatingWebhookConfiguration:

2706

annotations: {}

2707

# argocd.argoproj.io/hook: PreSync

2708

deployment:

2709

enabled: false

2710

## Number of replicas

2711

2712

replicas: 1

2713

## Strategy of the deployment

2714

2715

strategy: {}

2716

# Ref: https://kubernetes.io/docs/tasks/run-application/configure-pdb/

2717

podDisruptionBudget:

2718

enabled: false

2719

minAvailable: 1

2720

# maxUnavailable: ""

2721

unhealthyPodEvictionPolicy: AlwaysAllow

2722

## Number of old replicasets to retain ##

2723

## The default value is 10, 0 will garbage-collect old replicasets ##

2724

revisionHistoryLimit: 10

2725

## Prometheus-Operator v0.39.0 and later support TLS natively.

2726

2727

tls:

2728

enabled: true

2729

# Value must match version names from https://pkg.go.dev/crypto/tls#pkg-constants

2730

tlsMinVersion: VersionTLS13

2731

# The default webhook port is 10250 in order to work out-of-the-box in GKE private clusters and avoid adding firewall rules.

2732

internalPort: 10250

2733

## Service account for Prometheus Operator Webhook to use.

2734

## ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/

2735

2736

serviceAccount:

2737

annotations: {}

2738

automountServiceAccountToken: false

2739

create: true

2740

2741

## Configuration for Prometheus operator Webhook service

2742

2743

service:

2744

annotations: {}

2745

labels: {}

2746

clusterIP: ""

2747

ipDualStack:

2748

enabled: false

2749

ipFamilies: ["IPv6", "IPv4"]

2750

ipFamilyPolicy: "PreferDualStack"

2751

## Port to expose on each node

2752

## Only used if service.type is 'NodePort'

2753

2754

nodePort: 31080

2755

nodePortTls: 31443

2756

## Additional ports to open for Prometheus operator Webhook service

2757

## ref: https://kubernetes.io/docs/concepts/services-networking/service/#multi-port-services

2758

2759

additionalPorts: []

2760

## Loadbalancer IP

2761

## Only use if service.type is "LoadBalancer"

2762

2763

loadBalancerIP: ""

2764

loadBalancerSourceRanges: []

2765

## Denotes if this Service desires to route external traffic to node-local or cluster-wide endpoints

2766

2767

externalTrafficPolicy: Cluster

2768

## Service type

2769

## NodePort, ClusterIP, LoadBalancer

2770

2771

type: ClusterIP

2772

## List of IP addresses at which the Prometheus server service is available

2773

## Ref: https://kubernetes.io/docs/concepts/services-networking/service/#external-ips

2774

2775

externalIPs: []

2776

# ## Labels to add to the operator webhook deployment

2777

# ##

2778

labels: {}

2779

## Annotations to add to the operator webhook deployment

2780

2781

annotations: {}

2782

## Labels to add to the operator webhook pod

2783

2784

podLabels: {}

2785

## Annotations to add to the operator webhook pod

2786

2787

podAnnotations: {}

2788

## Assign a PriorityClassName to pods if set

2789

# priorityClassName: ""

2790

2791

## Define Log Format

2792

# Use logfmt (default) or json logging

2793

# logFormat: logfmt

2794

2795

## Decrease log verbosity to errors only

2796

# logLevel: error

2797

2798

## Prometheus-operator webhook image

2799

2800

image:

2801

registry: cgr.dev

2802

repository: chainguard-private/prometheus-admission-webhook

2803

# if not set appVersion field from Chart.yaml is used

2804

tag: 0.94.0-r1

2805

sha: sha256:42e860ce845aff659b069ee42efa5beb1757df998aa86cf21cb160c895278e4c

2806

pullPolicy: IfNotPresent

2807

## Define Log Format

2808

# Use logfmt (default) or json logging

2809

# logFormat: logfmt

2810

2811

## Decrease log verbosity to errors only

2812

# logLevel: error

2813

2814

## PromQL parser options to enable for the admission webhook when validating PrometheusRule resources.

2815

## The options are passed to the prometheus-operator admission-webhook binary as a comma-separated --promql-options value.

2816

## Requires prometheus-operator admission-webhook v0.91.0 or newer.

2817

## Valid values: experimental-functions, duration-expression-parsing, extended-range-selectors, binop-fill-modifiers.

2818

2819

promqlOptions: []

2820

## Liveness probe

2821

2822

livenessProbe:

2823

enabled: true

2824

failureThreshold: 3

2825

initialDelaySeconds: 30

2826

periodSeconds: 10

2827

successThreshold: 1

2828

timeoutSeconds: 1

2829

## Readiness probe

2830

2831

readinessProbe:

2832

enabled: true

2833

failureThreshold: 3

2834

initialDelaySeconds: 5

2835

periodSeconds: 10

2836

successThreshold: 1

2837

timeoutSeconds: 1

2838

## Resource limits & requests

2839

2840

resources: {}

2841

# limits:

2842

# cpu: 200m

2843

# memory: 200Mi

2844

# requests:

2845

# cpu: 100m

2846

# memory: 100Mi

2847

2848

# Required for use in managed kubernetes clusters (such as AWS EKS) with custom CNI (such as calico),

2849

# because control-plane managed by AWS cannot communicate with pods' IP CIDR and admission webhooks are not working

2850

2851

hostNetwork: false

2852

## Define which Nodes the Pods are scheduled on.

2853

## ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#nodeselector

2854

2855

nodeSelector: {}

2856

## Tolerations for use with node taints

2857

## ref: https://kubernetes.io/docs/concepts/scheduling-eviction/taint-and-toleration/

2858

2859

tolerations: []

2860

# - key: "key"

2861

# operator: "Equal"

2862

# value: "value"

2863

# effect: "NoSchedule"

2864

2865

## Assign custom affinity rules to the prometheus operator

2866

## ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/

2867

2868

affinity: {}

2869

# nodeAffinity:

2870

# requiredDuringSchedulingIgnoredDuringExecution:

2871

# nodeSelectorTerms:

2872

# - matchExpressions:

2873

# - key: kubernetes.io/e2e-az-name

2874

# operator: In

2875

# values:

2876

# - e2e-az1

2877

# - e2e-az2

2878

dnsConfig: {}

2879

# nameservers:

2880

# - 1.2.3.4

2881

# searches:

2882

# - ns1.svc.cluster-domain.example

2883

# - my.dns.search.suffix

2884

# options:

2885

# - name: ndots

2886

# value: "2"

2887

# - name: edns0

2888

securityContext:

2889

fsGroup: 65534

2890

runAsGroup: 65534

2891

runAsNonRoot: true

2892

runAsUser: 65534

2893

seccompProfile:

2894

type: RuntimeDefault

2895

## Container-specific security context configuration

2896

## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/

2897

2898

containerSecurityContext:

2899

allowPrivilegeEscalation: false

2900

readOnlyRootFilesystem: true

2901

capabilities:

2902

drop:

2903

- ALL

2904

## If false then the user will opt out of automounting API credentials.

2905

2906

automountServiceAccountToken: true

2907

patch:

2908

enabled: true

2909

image:

2910

registry: cgr.dev

2911

repository: chainguard-private/kube-webhook-certgen

2912

tag: 1.15.10

2913

sha: sha256:c041b7736b0fc4c758f3d8e51f7874ab5ced2c128ade164b58c5faf36461e0a1

2914

pullPolicy: IfNotPresent

2915

resources: {}

2916

## Provide a priority class name to the webhook patching job

2917

2918

priorityClassName: ""

2919

ttlSecondsAfterFinished: 60

2920

annotations: {}

2921

# argocd.argoproj.io/hook: PreSync

2922

# argocd.argoproj.io/hook-delete-policy: HookSucceeded

2923

podAnnotations: {}

2924

nodeSelector: {}

2925

affinity: {}

2926

tolerations: []

2927

## SecurityContext holds pod-level security attributes and common container settings.

2928

## This defaults to non root user with uid 2000 and gid 2000. *v1.PodSecurityContext false

2929

## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/

2930

2931

securityContext:

2932

runAsGroup: 2000

2933

runAsNonRoot: true

2934

runAsUser: 2000

2935

seccompProfile:

2936

type: RuntimeDefault

2937

## Service account for Prometheus Operator Webhook Job Patch to use.

2938

## ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/

2939

2940

serviceAccount:

2941

create: true

2942

annotations: {}

2943

automountServiceAccountToken: true

2944

# Security context for create job container

2945

createSecretJob:

2946

securityContext:

2947

allowPrivilegeEscalation: false

2948

readOnlyRootFilesystem: true

2949

capabilities:

2950

drop:

2951

- ALL

2952

# Security context for patch job container

2953

patchWebhookJob:

2954

securityContext:

2955

allowPrivilegeEscalation: false

2956

readOnlyRootFilesystem: true

2957

capabilities:

2958

drop:

2959

- ALL

2960

# Use certmanager to generate webhook certs

2961

certManager:

2962

enabled: false

2963

# self-signed root certificate

2964

rootCert:

2965

duration: "" # default to be 5y

2966

# -- Set the revisionHistoryLimit on the Certificate. See

2967

# https://cert-manager.io/docs/reference/api-docs/#cert-manager.io/v1.CertificateSpec

2968

# Defaults to nil.

2969

revisionHistoryLimit:

2970

admissionCert:

2971

duration: "" # default to be 1y

2972

# -- Set the revisionHistoryLimit on the Certificate. See

2973

# https://cert-manager.io/docs/reference/api-docs/#cert-manager.io/v1.CertificateSpec

2974

# Defaults to nil.

2975

revisionHistoryLimit:

2976

# issuerRef:

2977

# name: "issuer"

2978

# kind: "ClusterIssuer"

2979

# -- Set the private key algorithm and size for the Certificate. See

2980

# https://cert-manager.io/docs/reference/api-docs/#cert-manager.io/v1.CertificatePrivateKey

2981

# Defaults to RSA 2048

2982

# privateKey:

2983

# algorithm: ECDSA

2984

# size: 384

2985

2986

## Namespaces to scope the interaction of the Prometheus Operator and the apiserver (allow list).

2987

## This is mutually exclusive with denyNamespaces. Setting this to an empty object will disable the configuration

2988

2989

namespaces: {}

2990

# releaseNamespace: true

2991

# additional:

2992

# - kube-system

2993

2994

## Namespaces not to scope the interaction of the Prometheus Operator (deny list).

2995

2996

denyNamespaces: []

2997

## Filter namespaces to look for prometheus-operator custom resources

2998

2999

alertmanagerInstanceNamespaces: []

3000

alertmanagerConfigNamespaces: []

3001

prometheusInstanceNamespaces: []

3002

thanosRulerInstanceNamespaces: []

3003

## The clusterDomain value will be added to the cluster.peer option of the alertmanager.

3004

## Without this specified option cluster.peer will have value alertmanager-monitoring-alertmanager-0.alertmanager-operated:9094 (default value)

3005

## With this specified option cluster.peer will have value alertmanager-monitoring-alertmanager-0.alertmanager-operated.namespace.svc.cluster-domain:9094

3006

3007

# clusterDomain: "cluster.local"

3008

networkPolicy:

3009

## Enable creation of NetworkPolicy resources.

3010

3011

enabled: false

3012

## Flavor of the network policy to use.

3013

# Can be:

3014

# * kubernetes for networking.k8s.io/v1/NetworkPolicy

3015

# * cilium for cilium.io/v2/CiliumNetworkPolicy

3016

flavor: kubernetes

3017

# cilium:

3018

# egress:

3019

3020

## match labels used in selector

3021

# matchLabels: {}

3022

## Service account for Prometheus Operator to use.

3023

## ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/

3024

3025

serviceAccount:

3026

create: true

3027

3028

automountServiceAccountToken: true

3029

annotations: {}

3030

# -- terminationGracePeriodSeconds for container lifecycle hook

3031

terminationGracePeriodSeconds: 30

3032

# -- Specify lifecycle hooks for the controller

3033

lifecycle: {}

3034

## Configuration for Prometheus operator service

3035

3036

service:

3037

annotations: {}

3038

labels: {}

3039

clusterIP: ""

3040

ipDualStack:

3041

enabled: false

3042

ipFamilies: ["IPv6", "IPv4"]

3043

ipFamilyPolicy: "PreferDualStack"

3044

## Port to expose on each node

3045

## Only used if service.type is 'NodePort'

3046

3047

nodePort: 30080

3048

nodePortTls: 30443

3049

## Additional ports to open for Prometheus operator service

3050

## ref: https://kubernetes.io/docs/concepts/services-networking/service/#multi-port-services

3051

3052

additionalPorts: []

3053

## Loadbalancer IP

3054

## Only use if service.type is "LoadBalancer"

3055

3056

loadBalancerIP: ""

3057

loadBalancerSourceRanges: []

3058

## Denotes if this Service desires to route external traffic to node-local or cluster-wide endpoints

3059

3060

externalTrafficPolicy: Cluster

3061

## Service type

3062

## NodePort, ClusterIP, LoadBalancer

3063

3064

type: ClusterIP

3065

## List of IP addresses at which the Prometheus server service is available

3066

## Ref: https://kubernetes.io/docs/concepts/services-networking/service/#external-ips

3067

3068

externalIPs: []

3069

# ## Labels to add to the operator deployment

3070

# ##

3071

labels: {}

3072

## Annotations to add to the operator deployment

3073

3074

annotations: {}

3075

## Labels to add to the operator pod

3076

3077

podLabels: {}

3078

## Annotations to add to the operator pod

3079

3080

podAnnotations: {}

3081

## Assign a podDisruptionBudget to the operator

3082

3083

podDisruptionBudget:

3084

enabled: false

3085

minAvailable: 1

3086

# maxUnavailable: ""

3087

unhealthyPodEvictionPolicy: AlwaysAllow

3088

## Assign a PriorityClassName to pods if set

3089

# priorityClassName: ""

3090

3091

## Define Log Format

3092

# Use logfmt (default) or json logging

3093

# logFormat: logfmt

3094

3095

## Decrease log verbosity to errors only

3096

# logLevel: error

3097

kubeletService:

3098

## If true, the operator will create and maintain a service for scraping kubelets

3099

## ref: https://github.com/prometheus-operator/prometheus-operator/blob/main/helm/prometheus-operator/README.md

3100

3101

enabled: true

3102

namespace: kube-system

3103

selector: ""

3104

## Use '{{ template "kube-prometheus-stack.fullname" . }}-kubelet' by default

3105

3106

## Create Endpoints objects for kubelet targets.

3107

kubeletEndpointsEnabled: true

3108

## Create EndpointSlice objects for kubelet targets.

3109

kubeletEndpointSliceEnabled: false

3110

## Extra arguments to pass to prometheusOperator

3111

# https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/platform/operator.md

3112

extraArgs: []

3113

# - --labels="cluster=talos-cluster"

3114

3115

## Create a servicemonitor for the operator

3116

3117

serviceMonitor:

3118

## If true, create a serviceMonitor for prometheus operator

3119

3120

selfMonitor: true

3121

## Labels for ServiceMonitor

3122

additionalLabels: {}

3123

## Scrape interval. If not set, the Prometheus default scrape interval is used.

3124

3125

interval: ""

3126

## SampleLimit defines per-scrape limit on number of scraped samples that will be accepted.

3127

3128

sampleLimit: 0

3129

## TargetLimit defines a limit on the number of scraped targets that will be accepted.

3130

3131

targetLimit: 0

3132

## Per-scrape limit on number of labels that will be accepted for a sample. Only valid in Prometheus versions 2.27.0 and newer.

3133

3134

labelLimit: 0

3135

## Per-scrape limit on length of labels name that will be accepted for a sample. Only valid in Prometheus versions 2.27.0 and newer.

3136

3137

labelNameLengthLimit: 0

3138

## Per-scrape limit on length of labels value that will be accepted for a sample. Only valid in Prometheus versions 2.27.0 and newer.

3139

3140

labelValueLengthLimit: 0

3141

## Scrape timeout. If not set, the Prometheus default scrape timeout is used.

3142

scrapeTimeout: ""

3143

## Metric relabel configs to apply to samples before ingestion.

3144

3145

metricRelabelings: []

3146

# - action: keep

3147

3148

# sourceLabels: [__name__]

3149

3150

# relabel configs to apply to samples before ingestion.

3151

3152

relabelings: []

3153

# - sourceLabels: [__meta_kubernetes_pod_node_name]

3154

# separator: ;

3155

# regex: ^(.*)$

3156

# targetLabel: nodename

3157

# replacement: $1

3158

# action: replace

3159

## Resource limits & requests

3160

3161

resources: {}

3162

# limits:

3163

# cpu: 200m

3164

# memory: 200Mi

3165

# requests:

3166

# cpu: 100m

3167

# memory: 100Mi

3168

3169

## Operator Environment

3170

## env:

3171

## VARIABLE: value

3172

env:

3173

GOGC: "30"

3174

# Required for use in managed kubernetes clusters (such as AWS EKS) with custom CNI (such as calico),

3175

# because control-plane managed by AWS cannot communicate with pods' IP CIDR and admission webhooks are not working

3176

3177

hostNetwork: false

3178

## Define which Nodes the Pods are scheduled on.

3179

## ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#nodeselector

3180

3181

nodeSelector: {}

3182

## Tolerations for use with node taints

3183

## ref: https://kubernetes.io/docs/concepts/scheduling-eviction/taint-and-toleration/

3184

3185

tolerations: []

3186

# - key: "key"

3187

# operator: "Equal"

3188

# value: "value"

3189

# effect: "NoSchedule"

3190

3191

## Assign custom affinity rules to the prometheus operator

3192

## ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/

3193

3194

affinity: {}

3195

# nodeAffinity:

3196

# requiredDuringSchedulingIgnoredDuringExecution:

3197

# nodeSelectorTerms:

3198

# - matchExpressions:

3199

# - key: kubernetes.io/e2e-az-name

3200

# operator: In

3201

# values:

3202

# - e2e-az1

3203

# - e2e-az2

3204

dnsConfig: {}

3205

# nameservers:

3206

# - 1.2.3.4

3207

# searches:

3208

# - ns1.svc.cluster-domain.example

3209

# - my.dns.search.suffix

3210

# options:

3211

# - name: ndots

3212

# value: "2"

3213

# - name: edns0

3214

securityContext:

3215

fsGroup: 65534

3216

runAsGroup: 65534

3217

runAsNonRoot: true

3218

runAsUser: 65534

3219

seccompProfile:

3220

type: RuntimeDefault

3221

## Setup hostUsers for prometheus-operator

3222

## ref: https://kubernetes.io/docs/tasks/configure-pod-container/user-namespaces/

3223

hostUsers: ~

3224

## Container-specific security context configuration

3225

## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/

3226

3227

containerSecurityContext:

3228

allowPrivilegeEscalation: false

3229

readOnlyRootFilesystem: true

3230

capabilities:

3231

drop:

3232

- ALL

3233

# Enable vertical pod autoscaler support for prometheus-operator

3234

verticalPodAutoscaler:

3235

enabled: false

3236

# Recommender responsible for generating recommendation for the object.

3237

# List should be empty (then the default recommender will generate the recommendation)

3238

# or contain exactly one recommender.

3239

# recommenders:

3240

# - name: custom-recommender-performance

3241

3242

# List of resources that the vertical pod autoscaler can control. Defaults to cpu and memory

3243

controlledResources: []

3244

# Specifies which resource values should be controlled: RequestsOnly or RequestsAndLimits.

3245

# controlledValues: RequestsAndLimits

3246

3247

# Define the max allowed resources for the pod

3248

maxAllowed: {}

3249

# cpu: 200m

3250

# memory: 100Mi

3251

# Define the min allowed resources for the pod

3252

minAllowed: {}

3253

# cpu: 200m

3254

# memory: 100Mi

3255

3256

updatePolicy:

3257

# Specifies minimal number of replicas which need to be alive for VPA Updater to attempt pod eviction

3258

# minReplicas: 1

3259

# Specifies whether recommended updates are applied when a Pod is started and whether recommended updates

3260

# are applied during the life of a Pod. Possible values are "Off", "Initial", "Recreate", and "InPlaceOrRecreate".

3261

updateMode: Recreate

3262

## Prometheus-operator image

3263

3264

image:

3265

registry: cgr.dev

3266

repository: chainguard-private/prometheus-operator

3267

# if not set appVersion field from Chart.yaml is used

3268

tag: 0.94.0-r1

3269

sha: sha256:f62c7b9e10d7b2ba6c496d608809ed554113b91d69e4d005e5f9b43542819e7a

3270

pullPolicy: IfNotPresent

3271

## Prometheus image to use for prometheuses managed by the operator

3272

3273

# prometheusDefaultBaseImage: prometheus/prometheus

3274

3275

## Prometheus image registry to use for prometheuses managed by the operator

3276

3277

# prometheusDefaultBaseImageRegistry: quay.io

3278

3279

## Alertmanager image to use for alertmanagers managed by the operator

3280

3281

# alertmanagerDefaultBaseImage: prometheus/alertmanager

3282

3283

## Alertmanager image registry to use for alertmanagers managed by the operator

3284

3285

# alertmanagerDefaultBaseImageRegistry: quay.io

3286

3287

## Prometheus-config-reloader

3288

3289

prometheusConfigReloader:

3290

image:

3291

registry: cgr.dev

3292

repository: chainguard-private/prometheus-config-reloader

3293

# if not set appVersion field from Chart.yaml is used

3294

tag: 0.94.0-r1

3295

sha: sha256:eeab8aac59c84e7b63522c882d0211a901f42be9e23d2ef31bdee5bc10451ed6

3296

# add prometheus config reloader liveness and readiness probe. Default: false

3297

enableProbe: false

3298

# resource config for prometheusConfigReloader

3299

resources: {}

3300

# requests:

3301

# cpu: 200m

3302

# memory: 50Mi

3303

# limits:

3304

# cpu: 200m

3305

# memory: 50Mi

3306

## Thanos side-car image when configured

3307

3308

thanosImage:

3309

registry: cgr.dev

3310

repository: chainguard-private/thanos

3311

tag: 0.42.4-r7

3312

sha: sha256:5b3801e1185d9ff3e0a11d15f8e94ea5b440676a423278cf17c6f9047b4ec77a

3313

## Set a Label Selector to filter watched prometheus and prometheusAgent

3314

3315

prometheusInstanceSelector: ""

3316

## Set a Label Selector to filter watched alertmanager

3317

3318

alertmanagerInstanceSelector: ""

3319

## Set a Label Selector to filter watched thanosRuler

3320

thanosRulerInstanceSelector: ""

3321

## Set a Field Selector to filter watched secrets

3322

## `kubernetes.io/service-account-token` secrets are no longer excluded, so that changes to the

3323

## secret the control-plane ServiceMonitors authenticate with trigger a reconciliation.

3324

3325

secretFieldSelector: "type!=kubernetes.io/dockercfg,type!=helm.sh/release.v1"

3326

## Feature gates to enable/disable operator features, rendered as --feature-gates=<key>=<value>.

3327

## See https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api-reference/feature-gates.md

3328

## Example:

3329

## featureGates:

3330

## PrometheusAgentDaemonSet: true

3331

## StatusForConfigurationResources: true

3332

featureGates: {}

3333

## If false then the user will opt out of automounting API credentials.

3334

3335

automountServiceAccountToken: true

3336

## Additional volumes

3337

3338

extraVolumes: []

3339

## Additional volume mounts

3340

3341

extraVolumeMounts: []

3342

## Deploy a Prometheus instance

3343

3344

prometheus:

3345

enabled: true

3346

## Toggle prometheus into agent mode

3347

## Note many of features described below (e.g. rules, query, alerting, remote read, thanos) will not work in agent mode.

3348

## ref: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/platform/prometheus-agent.md

3349

3350

agentMode: false

3351

## Annotations for Prometheus

3352

3353

annotations: {}

3354

## Additional labels for Prometheus

3355

3356

additionalLabels: {}

3357

## Configure network policy for the prometheus

3358

networkPolicy:

3359

enabled: false

3360

## Flavor of the network policy to use.

3361

# Can be:

3362

# * kubernetes for networking.k8s.io/v1/NetworkPolicy

3363

# * cilium for cilium.io/v2/CiliumNetworkPolicy

3364

flavor: kubernetes

3365

namespace:

3366

# cilium:

3367

# endpointSelector:

3368

# egress:

3369

# ingress:

3370

3371

# egress:

3372

# - {}

3373

# ingress:

3374

# - {}

3375

# podSelector:

3376

# matchLabels:

3377

# app: prometheus

3378

## Service account for Prometheuses to use.

3379

## ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/

3380

3381

serviceAccount:

3382

create: true

3383

3384

annotations: {}

3385

automountServiceAccountToken: true

3386

## Create a `kubernetes.io/service-account-token` Secret for the Prometheus service account.

3387

## The control-plane ServiceMonitors reference it by default, because ServiceMonitors can only

3388

## authenticate through a Secret and Kubernetes no longer creates one automatically.

3389

## The resulting token is long-lived and does not expire; disable this and set the

3390

## `authorization` values of the control-plane components if you manage the credential yourself.

3391

## Only rendered together with the service account, so it requires `prometheus.enabled` and

3392

## `create` above. Leaving a control-plane component on the default `authorization` while the

3393

## Secret is not rendered is a rendering error rather than a silently broken ServiceMonitor.

3394

## ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/#manually-create-an-api-token-for-a-serviceaccount

3395

3396

createTokenSecret: true

3397

# Service for thanos service discovery on sidecar

3398

# Enable this can make Thanos Query can use

3399

# `--store=dnssrv+_grpc._tcp.${kube-prometheus-stack.fullname}-thanos-discovery.${namespace}.svc.cluster.local` to discovery

3400

# Thanos sidecar on prometheus nodes

3401

# (Please remember to change ${kube-prometheus-stack.fullname} and ${namespace}. Not just copy and paste!)

3402

thanosService:

3403

enabled: false

3404

annotations: {}

3405

labels: {}

3406

## Denotes if this Service desires to route external traffic to node-local or cluster-wide endpoints

3407

3408

externalTrafficPolicy: Cluster

3409

## Service type

3410

3411

type: ClusterIP

3412

## Service dual stack

3413

3414

ipDualStack:

3415

enabled: false

3416

ipFamilies: ["IPv6", "IPv4"]

3417

ipFamilyPolicy: "PreferDualStack"

3418

## gRPC port config

3419

portName: grpc

3420

port: 10901

3421

targetPort: "grpc"

3422

## HTTP port config (for metrics)

3423

httpPortName: http

3424

httpPort: 10902

3425

targetHttpPort: "http"

3426

## ClusterIP to assign

3427

# Default is to make this a headless service ("None")

3428

clusterIP: "None"

3429

## Port to expose on each node, if service type is NodePort

3430

3431

nodePort: 30901

3432

httpNodePort: 30902

3433

# ServiceMonitor to scrape Sidecar metrics

3434

# Needs thanosService to be enabled as well

3435

thanosServiceMonitor:

3436

enabled: false

3437

interval: ""

3438

## Additional labels

3439

3440

additionalLabels: {}

3441

## scheme: HTTP scheme to use for scraping. Can be used with `tlsConfig` for example if using istio mTLS.

3442

scheme: ""

3443

## tlsConfig: TLS configuration to use when scraping the endpoint. For example if using istio mTLS.

3444

## Of type: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api-reference/api.md#tlsconfig

3445

tlsConfig: {}

3446

bearerTokenFile:

3447

## Metric relabel configs to apply to samples before ingestion.

3448

metricRelabelings: []

3449

## relabel configs to apply to samples before ingestion.

3450

relabelings: []

3451

# Service for external access to sidecar

3452

# Enabling this creates a service to expose thanos-sidecar outside the cluster.

3453

thanosServiceExternal:

3454

enabled: false

3455

annotations: {}

3456

labels: {}

3457

loadBalancerIP: ""

3458

loadBalancerSourceRanges: []

3459

## gRPC port config

3460

portName: grpc

3461

port: 10901

3462

targetPort: "grpc"

3463

## HTTP port config (for metrics)

3464

httpPortName: http

3465

httpPort: 10902

3466

targetHttpPort: "http"

3467

## Denotes if this Service desires to route external traffic to node-local or cluster-wide endpoints

3468

3469

externalTrafficPolicy: Cluster

3470

## Service type

3471

3472

type: LoadBalancer

3473

## Port to expose on each node

3474

3475

nodePort: 30901

3476

httpNodePort: 30902

3477

## Configuration for Prometheus service

3478

3479

service:

3480

enabled: true

3481

annotations: {}

3482

labels: {}

3483

clusterIP: ""

3484

ipDualStack:

3485

enabled: false

3486

ipFamilies: ["IPv6", "IPv4"]

3487

ipFamilyPolicy: "PreferDualStack"

3488

## Port for Prometheus Service to listen on

3489

3490

port: 9090

3491

## To be used with a proxy extraContainer port

3492

targetPort: 9090

3493

## Port for Prometheus Reloader to listen on

3494

3495

reloaderWebPort: 8080

3496

## Port to expose for Prometheus Reloader

3497

## Only used if service.type is 'NodePort'

3498

3499

reloaderWebNodePort: null

3500

## List of IP addresses at which the Prometheus server service is available

3501

## Ref: https://kubernetes.io/docs/concepts/services-networking/service/#external-ips

3502

3503

externalIPs: []

3504

## Port to expose on each node

3505

## Only used if service.type is 'NodePort'

3506

3507

nodePort: 30090

3508

## Loadbalancer IP

3509

## Only use if service.type is "LoadBalancer"

3510

loadBalancerIP: ""

3511

loadBalancerSourceRanges: []

3512

## Denotes if this Service desires to route external traffic to node-local or cluster-wide endpoints

3513

3514

externalTrafficPolicy: Cluster

3515

## Service type

3516

3517

type: ClusterIP

3518

## Additional ports to open for Prometheus service

3519

3520

additionalPorts: []

3521

# additionalPorts:

3522

# - name: oauth-proxy

3523

# port: 8081

3524

# targetPort: 8081

3525

# - name: oauth-metrics

3526

# port: 8082

3527

# targetPort: 8082

3528

3529

## Consider that all endpoints are considered "ready" even if the Pods themselves are not

3530

## Ref: https://kubernetes.io/docs/reference/kubernetes-api/service-resources/service-v1/#ServiceSpec

3531

publishNotReadyAddresses: false

3532

## If you want to make sure that connections from a particular client are passed to the same Pod each time

3533

## Accepts 'ClientIP' or 'None'

3534

3535

sessionAffinity: None

3536

## If you want to modify the ClientIP sessionAffinity timeout

3537

## The value must be >0 && <=86400(for 1 day) if ServiceAffinity == "ClientIP"

3538

3539

sessionAffinityConfig:

3540

clientIP:

3541

timeoutSeconds: 10800

3542

## Configuration for creating a separate Service for each statefulset Prometheus replica

3543

3544

servicePerReplica:

3545

enabled: false

3546

annotations: {}

3547

## Port for Prometheus Service per replica to listen on

3548

3549

port: 9090

3550

## To be used with a proxy extraContainer port

3551

targetPort: 9090

3552

## Port to expose on each node

3553

## Only used if servicePerReplica.type is 'NodePort'

3554

3555

nodePort: 30091

3556

## Loadbalancer source IP ranges

3557

## Only used if servicePerReplica.type is "LoadBalancer"

3558

loadBalancerSourceRanges: []

3559

## Denotes if this Service desires to route external traffic to node-local or cluster-wide endpoints

3560

3561

externalTrafficPolicy: Cluster

3562

## Service type

3563

3564

type: ClusterIP

3565

## Service dual stack

3566

3567

ipDualStack:

3568

enabled: false

3569

ipFamilies: ["IPv6", "IPv4"]

3570

ipFamilyPolicy: "PreferDualStack"

3571

## Configure pod disruption budgets for Prometheus

3572

## ref: https://kubernetes.io/docs/tasks/run-application/configure-pdb/#specifying-a-poddisruptionbudget

3573

3574

podDisruptionBudget:

3575

enabled: false

3576

minAvailable: 1

3577

# maxUnavailable: ""

3578

unhealthyPodEvictionPolicy: AlwaysAllow

3579

## Enable vertical pod autoscaler support for Prometheus

3580

## ref: https://github.com/kubernetes/autoscaler/tree/master/vertical-pod-autoscaler

3581

3582

verticalPodAutoscaler:

3583

enabled: false

3584

# Recommender responsible for generating recommendation for the object.

3585

# List should be empty (then the default recommender will generate the recommendation)

3586

# or contain exactly one recommender.

3587

# recommenders:

3588

# - name: custom-recommender-performance

3589

3590

# List of resources that the vertical pod autoscaler can control. Defaults to cpu and memory

3591

controlledResources: []

3592

# Specifies which resource values should be controlled: RequestsOnly or RequestsAndLimits.

3593

# controlledValues: RequestsAndLimits

3594

3595

# Define the max allowed resources for the pod

3596

maxAllowed: {}

3597

# cpu: 200m

3598

# memory: 100Mi

3599

# Define the min allowed resources for the pod

3600

minAllowed: {}

3601

# cpu: 200m

3602

# memory: 100Mi

3603

3604

updatePolicy:

3605

# Specifies whether recommended updates are applied when a Pod is started and whether recommended updates

3606

# are applied during the life of a Pod. Possible values are "Off", "Initial", "Recreate", and "InPlaceOrRecreate".

3607

updateMode: Recreate

3608

# Ingress exposes thanos sidecar outside the cluster

3609

thanosIngress:

3610

enabled: false

3611

ingressClassName: ""

3612

annotations: {}

3613

labels: {}

3614

servicePort: 10901

3615

## Port to expose on each node

3616

## Only used if service.type is 'NodePort'

3617

3618

nodePort: 30901

3619

## Hosts must be provided if Ingress is enabled.

3620

3621

hosts: []

3622

# - thanos-gateway.domain.com

3623

3624

## Paths to use for ingress rules

3625

3626

paths: []

3627

# - /

3628

3629

## For Kubernetes >= 1.18 you should specify the pathType (determines how Ingress paths should be matched)

3630

## See https://kubernetes.io/blog/2020/04/02/improvements-to-the-ingress-api-in-kubernetes-1.18/#better-path-matching-with-path-types

3631

# pathType: ImplementationSpecific

3632

3633

## TLS configuration for Thanos Ingress

3634

## Secret must be manually created in the namespace

3635

3636

tls: []

3637

# - secretName: thanos-gateway-tls

3638

# hosts:

3639

# - thanos-gateway.domain.com

3640

3641

## ExtraSecret can be used to store various data in an extra secret

3642

## (use it for example to store hashed basic auth credentials)

3643

extraSecret:

3644

## if not set, name will be auto generated

3645

# name: ""

3646

annotations: {}

3647

data: {}

3648

# auth: |

3649

# foo:$apr1$OFG3Xybp$ckL0FHDAkoXYIlH9.cysT0

3650

# someoneelse:$apr1$DMZX2Z4q$6SbQIfyuLQd.xmo/P0m2c.

3651

3652

ingress:

3653

enabled: false

3654

ingressClassName: ""

3655

annotations: {}

3656

labels: {}

3657

## Redirect ingress to an additional defined port on the service

3658

# servicePort: 8081

3659

3660

## Hostnames.

3661

## Must be provided if Ingress is enabled.

3662

3663

# hosts:

3664

# - prometheus.domain.com

3665

hosts: []

3666

## Paths to use for ingress rules - one path should match the prometheusSpec.routePrefix

3667

3668

paths: []

3669

# - /

3670

3671

## For Kubernetes >= 1.18 you should specify the pathType (determines how Ingress paths should be matched)

3672

## See https://kubernetes.io/blog/2020/04/02/improvements-to-the-ingress-api-in-kubernetes-1.18/#better-path-matching-with-path-types

3673

# pathType: ImplementationSpecific

3674

3675

## TLS configuration for Prometheus Ingress

3676

## Secret must be manually created in the namespace

3677

3678

tls: []

3679

# - secretName: prometheus-general-tls

3680

# hosts:

3681

# - prometheus.example.com

3682

# -- BETA: Configure the gateway routes for the chart here.

3683

# More routes can be added by adding a dictionary key like the 'main' route.

3684

# Be aware that this is an early beta of this feature,

3685

# kube-prometheus-stack does not guarantee this works and is subject to change.

3686

# Being BETA this can/will change in the future without notice, do not use unless you want to take that risk

3687

# [[ref]](https://gateway-api.sigs.k8s.io/reference/spec/#gateway.networking.k8s.io%2fv1alpha2)

3688

route:

3689

main:

3690

# -- Enables or disables the route

3691

enabled: false

3692

# -- Set the route apiVersion, e.g. gateway.networking.k8s.io/v1 or gateway.networking.k8s.io/v1alpha2

3693

apiVersion: gateway.networking.k8s.io/v1

3694

# -- Set the route kind

3695

# Valid options are GRPCRoute, HTTPRoute, TCPRoute, TLSRoute, UDPRoute

3696

kind: HTTPRoute

3697

annotations: {}

3698

labels: {}

3699

hostnames: []

3700

# - my-filter.example.com

3701

parentRefs: []

3702

# - name: acme-gw

3703

3704

# -- create http route for redirect (https://gateway-api.sigs.k8s.io/guides/http-redirect-rewrite/#http-to-https-redirects)

3705

## Take care that you only enable this on the http listener of the gateway to avoid an infinite redirect.

3706

## matches, filters and additionalRules will be ignored if this is set to true. Be are

3707

httpsRedirect: false

3708

matches:

3709

- path:

3710

type: PathPrefix

3711

value: /

3712

## Filters define the filters that are applied to requests that match this rule.

3713

filters: []

3714

## Timeouts for the generated HTTPRoute backend rule.

3715

## Requires Gateway API CRDs and a controller that support HTTPRoute timeouts.

3716

timeouts: {}

3717

# request: 120s

3718

# backendRequest: 60s

3719

3720

## Session persistence configuration for the route rule.

3721

sessionPersistence: {}

3722

# sessionName: route

3723

# type: Cookie

3724

# absoluteTimeout: 12h

3725

# cookieConfig:

3726

# lifetimeType: Permanent

3727

3728

## Additional custom rules that can be added to the route

3729

additionalRules: []

3730

## Configuration for creating an Ingress that will map to each Prometheus replica service

3731

## prometheus.servicePerReplica must be enabled

3732

3733

ingressPerReplica:

3734

enabled: false

3735

ingressClassName: ""

3736

annotations: {}

3737

labels: {}

3738

## Final form of the hostname for each per replica ingress is

3739

## {{ ingressPerReplica.hostPrefix }}-{{ $replicaNumber }}.{{ ingressPerReplica.hostDomain }}

3740

3741

## Prefix for the per replica ingress that will have `-$replicaNumber`

3742

## appended to the end

3743

hostPrefix: ""

3744

## Domain that will be used for the per replica ingress

3745

hostDomain: ""

3746

## Paths to use for ingress rules

3747

3748

paths: []

3749

# - /

3750

3751

## For Kubernetes >= 1.18 you should specify the pathType (determines how Ingress paths should be matched)

3752

## See https://kubernetes.io/blog/2020/04/02/improvements-to-the-ingress-api-in-kubernetes-1.18/#better-path-matching-with-path-types

3753

# pathType: ImplementationSpecific

3754

3755

## Secret name containing the TLS certificate for Prometheus per replica ingress

3756

## Secret must be manually created in the namespace

3757

tlsSecretName: ""

3758

## Separated secret for each per replica Ingress. Can be used together with cert-manager

3759

3760

tlsSecretPerReplica:

3761

enabled: false

3762

## Final form of the secret for each per replica ingress is

3763

## {{ tlsSecretPerReplica.prefix }}-{{ $replicaNumber }}

3764

3765

prefix: "prometheus"

3766

## Configuration for creating a Gateway API route that will map to each Prometheus replica service

3767

## prometheus.servicePerReplica must be enabled

3768

3769

routePerReplica:

3770

main:

3771

# -- Enables or disables the routePerReplica

3772

enabled: false

3773

# -- Set the route apiVersion, e.g. gateway.networking.k8s.io/v1 or gateway.networking.k8s.io/v1alpha2

3774

apiVersion: gateway.networking.k8s.io/v1

3775

# -- Set the route kind

3776

# Valid options are GRPCRoute, HTTPRoute, TCPRoute, TLSRoute, UDPRoute

3777

kind: HTTPRoute

3778

annotations: {}

3779

labels: {}

3780

## Final form of the hostname for each per replica route is

3781

## {{ routePerReplica.hostPrefix }}-{{ $replicaNumber }}.{{ routePerReplica.hostDomain }}

3782

3783

## Prefix for the per replica route that will have `-$replicaNumber` appended to the end

3784

hostPrefix: ""

3785

## Domain that will be used for the per replica route

3786

hostDomain: ""

3787

parentRefs: []

3788

# - name: acme-gw

3789

3790

# -- create http route for redirect (https://gateway-api.sigs.k8s.io/guides/http-redirect-rewrite/#http-to-https-redirects)

3791

## Take care that you only enable this on the http listener of the gateway to avoid an infinite redirect.

3792

## matches, filters and additionalRules will be ignored if this is set to true.

3793

httpsRedirect: false

3794

## Filters define the filters that are applied to requests that match this rule.

3795

filters: []

3796

matches:

3797

- path:

3798

type: PathPrefix

3799

value: /

3800

## Timeouts for the generated HTTPRoute backend rule.

3801

## Requires Gateway API CRDs and a controller that support HTTPRoute timeouts.

3802

timeouts: {}

3803

# request: 120s

3804

# backendRequest: 60s

3805

3806

## Session persistence configuration for the route rule.

3807

sessionPersistence: {}

3808

# sessionName: route

3809

# type: Cookie

3810

# absoluteTimeout: 12h

3811

# cookieConfig:

3812

# lifetimeType: Permanent

3813

3814

## Additional custom rules that can be added to the route

3815

additionalRules: []

3816

serviceMonitor:

3817

## If true, create a serviceMonitor for prometheus

3818

3819

selfMonitor: true

3820

## Scrape interval. If not set, the Prometheus default scrape interval is used.

3821

3822

interval: ""

3823

## Additional labels

3824

3825

additionalLabels: {}

3826

## SampleLimit defines per-scrape limit on number of scraped samples that will be accepted.

3827

3828

sampleLimit: 0

3829

## TargetLimit defines a limit on the number of scraped targets that will be accepted.

3830

3831

targetLimit: 0

3832

## Per-scrape limit on number of labels that will be accepted for a sample. Only valid in Prometheus versions 2.27.0 and newer.

3833

3834

labelLimit: 0

3835

## Per-scrape limit on length of labels name that will be accepted for a sample. Only valid in Prometheus versions 2.27.0 and newer.

3836

3837

labelNameLengthLimit: 0

3838

## Per-scrape limit on length of labels value that will be accepted for a sample. Only valid in Prometheus versions 2.27.0 and newer.

3839

3840

labelValueLengthLimit: 0

3841

## scheme: HTTP scheme to use for scraping. Can be used with `tlsConfig` for example if using istio mTLS.

3842

scheme: ""

3843

## tlsConfig: TLS configuration to use when scraping the endpoint. For example if using istio mTLS.

3844

## Of type: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api-reference/api.md#tlsconfig

3845

tlsConfig: {}

3846

bearerTokenFile:

3847

## Metric relabel configs to apply to samples before ingestion.

3848

3849

metricRelabelings: []

3850

# - action: keep

3851

3852

# sourceLabels: [__name__]

3853

3854

# relabel configs to apply to samples before ingestion.

3855

3856

relabelings: []

3857

# - sourceLabels: [__meta_kubernetes_pod_node_name]

3858

# separator: ;

3859

# regex: ^(.*)$

3860

# targetLabel: nodename

3861

# replacement: $1

3862

# action: replace

3863

3864

## Additional Endpoints

3865

3866

additionalEndpoints: []

3867

# - port: oauth-metrics

3868

# path: /metrics

3869

## Settings affecting prometheusSpec

3870

## ref: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api-reference/api.md#prometheusspec

3871

3872

prometheusSpec:

3873

## Statefulset's persistent volume claim retention policy

3874

## whenDeleted and whenScaled determine whether

3875

## statefulset's PVCs are deleted (true) or retained (false)

3876

## on scaling down and deleting statefulset, respectively.

3877

## Requires Kubernetes version 1.27.0+.

3878

## Ref: https://kubernetes.io/docs/concepts/workloads/controllers/statefulset/#persistentvolumeclaim-retention

3879

persistentVolumeClaimRetentionPolicy: {}

3880

# whenDeleted: Retain

3881

# whenScaled: Retain

3882

3883

## If true, pass --storage.tsdb.max-block-duration=2h to prometheus. This is already done if using Thanos

3884

3885

disableCompaction: false

3886

## AutomountServiceAccountToken indicates whether a service account token should be automatically mounted in the pod,

3887

## If the field isn't set, the operator mounts the service account token by default.

3888

## Warning: be aware that by default, Prometheus requires the service account token for Kubernetes service discovery,

3889

## It is possible to use strategic merge patch to project the service account token into the 'prometheus' container.

3890

automountServiceAccountToken: true

3891

## APIServerConfig

3892

## ref: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api-reference/api.md#apiserverconfig

3893

3894

apiserverConfig: {}

3895

## Allows setting additional arguments for the Prometheus container

3896

## ref: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api-reference/api.md#monitoring.coreos.com/v1.Prometheus

3897

additionalArgs: []

3898

## Convert all classic histograms to native histograms with custom buckets.

3899

## This corresponds to the 'convert_classic_histograms_to_nhcb' field in Prometheus configuration.

3900

3901

convertClassicHistogramsToNHCB: false

3902

## Enable scraping of classic histograms that are also exposed as native histograms.

3903

## This corresponds to the 'always_scrape_classic_histograms' field in Prometheus configuration.

3904

3905

scrapeClassicHistograms: false

3906

## Enable scraping of native histograms.

3907

## This corresponds to the 'scrape_native_histograms' field in Prometheus configuration.

3908

3909

scrapeNativeHistograms: false

3910

## File to which scrape failures are logged.

3911

## Reloading the configuration will reopen the file.

3912

## Defaults to empty (disabled)

3913

## ref: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api-reference/api.md#monitoring.coreos.com/v1.Prometheus

3914

3915

scrapeFailureLogFile: ""

3916

## Interval between consecutive scrapes.

3917

## Defaults to 30s.

3918

## ref: https://github.com/prometheus-operator/prometheus-operator/blob/release-0.44/pkg/prometheus/promcfg.go#L180-L183

3919

3920

scrapeInterval: ""

3921

## Number of seconds to wait for target to respond before erroring

3922

3923

scrapeTimeout: ""

3924

## List of scrape classes to expose to scraping objects such as

3925

## PodMonitors, ServiceMonitors, Probes and ScrapeConfigs.

3926

3927

scrapeClasses: []

3928

# - name: istio-mtls

3929

# default: false

3930

# tlsConfig:

3931

# caFile: /etc/prometheus/secrets/istio.default/root-cert.pem

3932

# certFile: /etc/prometheus/secrets/istio.default/cert-chain.pem

3933

3934

## PodTargetLabels are appended to the `spec.podTargetLabels` field of all PodMonitor and ServiceMonitor objects.

3935

3936

podTargetLabels: []

3937

# - customlabel

3938

3939

## Interval between consecutive evaluations.

3940

3941

evaluationInterval: ""

3942

## ListenLocal makes the Prometheus server listen on loopback, so that it does not bind against the Pod IP.

3943

3944

listenLocal: false

3945

## enableOTLPReceiver enables the OTLP receiver for Prometheus.

3946

enableOTLPReceiver: false

3947

## EnableAdminAPI enables Prometheus the administrative HTTP API which includes functionality such as deleting time series.

3948

## This is disabled by default.

3949

## ref: https://prometheus.io/docs/prometheus/latest/querying/api/#tsdb-admin-apis

3950

3951

enableAdminAPI: false

3952

## Sets version of Prometheus overriding the Prometheus version as derived

3953

## from the image tag. Useful in cases where the tag does not follow semver v2.

3954

version: ""

3955

## WebTLSConfig defines the TLS parameters for HTTPS

3956

## ref: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api-reference/api.md#webtlsconfig

3957

web: {}

3958

## Exemplars related settings that are runtime reloadable.

3959

## It requires to enable the exemplar storage feature to be effective.

3960

exemplars: {}

3961

## Maximum number of exemplars stored in memory for all series.

3962

## If not set, Prometheus uses its default value.

3963

## A value of zero or less than zero disables the storage.

3964

# maxSize: 100000

3965

3966

# EnableFeatures API enables access to Prometheus disabled features.

3967

# ref: https://prometheus.io/docs/prometheus/latest/feature_flags/

3968

enableFeatures: []

3969

# - exemplar-storage

3970

3971

## https://prometheus.io/docs/guides/opentelemetry

3972

3973

otlp: {}

3974

# promoteResourceAttributes: []

3975

# keepIdentifyingResourceAttributes: false

3976

# translationStrategy: NoUTF8EscapingWithSuffixes

3977

# convertHistogramsToNHCB: false

3978

3979

3980

serviceName:

3981

## Image of Prometheus.

3982

3983

image:

3984

registry: cgr.dev

3985

repository: chainguard-private/prometheus

3986

tag: 3.12.0-r13

3987

sha: sha256:94aadde22ca4f4bab9a44f977c9d8d89d44b3964231f6f67e196528dc934dd97

3988

pullPolicy: IfNotPresent

3989

## Tolerations for use with node taints

3990

## ref: https://kubernetes.io/docs/concepts/scheduling-eviction/taint-and-toleration/

3991

3992

tolerations: []

3993

# - key: "key"

3994

# operator: "Equal"

3995

# value: "value"

3996

# effect: "NoSchedule"

3997

3998

## If specified, the pod's topology spread constraints.

3999

## ref: https://kubernetes.io/docs/concepts/scheduling-eviction/topology-spread-constraints/

4000

4001

topologySpreadConstraints: []

4002

# - maxSkew: 1

4003

# topologyKey: topology.kubernetes.io/zone

4004

# whenUnsatisfiable: DoNotSchedule

4005

# labelSelector:

4006

# matchLabels:

4007

# app: prometheus

4008

4009

## Disable alerting

4010

4011

disableAlerting: false

4012

## Alertmanagers to which alerts will be sent

4013

## ref: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api-reference/api.md#alertmanagerendpoints

4014

4015

## Default configuration will connect to the alertmanager deployed as part of this release

4016

4017

alertingEndpoints: []

4018

# - name: ""

4019

# namespace: ""

4020

# port: http

4021

# scheme: http

4022

# pathPrefix: ""

4023

# tlsConfig: {}

4024

# bearerTokenFile: ""

4025

# apiVersion: v2

4026

4027

## External labels to add to any time series or alerts when communicating with external systems

4028

4029

externalLabels: {}

4030

## enable --web.enable-remote-write-receiver flag on prometheus-server

4031

4032

enableRemoteWriteReceiver: false

4033

## Name of the external label used to denote replica name

4034

4035

replicaExternalLabelName: ""

4036

## If true, the Operator won't add the external label used to denote replica name

4037

4038

replicaExternalLabelNameClear: false

4039

## Name of the external label used to denote Prometheus instance name

4040

4041

prometheusExternalLabelName: ""

4042

## If true, the Operator won't add the external label used to denote Prometheus instance name

4043

4044

prometheusExternalLabelNameClear: false

4045

## External URL at which Prometheus will be reachable.

4046

4047

externalUrl: ""

4048

## Define which Nodes the Pods are scheduled on.

4049

## ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#nodeselector

4050

4051

nodeSelector: {}

4052

## Secrets is a list of Secrets in the same namespace as the Prometheus object, which shall be mounted into the Prometheus Pods.

4053

## The Secrets are mounted into /etc/prometheus/secrets/. Secrets changes after initial creation of a Prometheus object are not

4054

## reflected in the running Pods. To change the secrets mounted into the Prometheus Pods, the object must be deleted and recreated

4055

## with the new list of secrets.

4056

4057

secrets: []

4058

## ConfigMaps is a list of ConfigMaps in the same namespace as the Prometheus object, which shall be mounted into the Prometheus Pods.

4059

## The ConfigMaps are mounted into /etc/prometheus/configmaps/.

4060

4061

configMaps: []

4062

## QuerySpec defines the query command line flags when starting Prometheus.

4063

## ref: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api-reference/api.md#queryspec

4064

4065

query: {}

4066

## If nil, select own namespace. Namespaces to be selected for PrometheusRules discovery.

4067

ruleNamespaceSelector: {}

4068

## Example which selects PrometheusRules in namespaces with label "prometheus" set to "somelabel"

4069

# ruleNamespaceSelector:

4070

# matchLabels:

4071

# prometheus: somelabel

4072

4073

## If true, a nil or {} value for prometheus.prometheusSpec.ruleSelector will cause the

4074

## prometheus resource to be created with selectors based on values in the helm deployment,

4075

## which will also match the PrometheusRule resources created

4076

4077

ruleSelectorNilUsesHelmValues: true

4078

## PrometheusRules to be selected for target discovery.

4079

## If {}, select all PrometheusRules

4080

4081

ruleSelector: {}

4082

## Example which select all PrometheusRules resources

4083

## with label "prometheus" with values any of "example-rules" or "example-rules-2"

4084

# ruleSelector:

4085

# matchExpressions:

4086

# - key: prometheus

4087

# operator: In

4088

# values:

4089

# - example-rules

4090

# - example-rules-2

4091

4092

## Example which select all PrometheusRules resources with label "role" set to "example-rules"

4093

# ruleSelector:

4094

# matchLabels:

4095

# role: example-rules

4096

4097

## If true, a nil or {} value for prometheus.prometheusSpec.serviceMonitorSelector will cause the

4098

## prometheus resource to be created with selectors based on values in the helm deployment,

4099

## which will also match the servicemonitors created

4100

4101

serviceMonitorSelectorNilUsesHelmValues: true

4102

## ServiceMonitors to be selected for target discovery.

4103

## If {}, select all ServiceMonitors

4104

4105

serviceMonitorSelector: {}

4106

## Example which selects ServiceMonitors with label "prometheus" set to "somelabel"

4107

# serviceMonitorSelector:

4108

# matchLabels:

4109

# prometheus: somelabel

4110

4111

## Namespaces to be selected for ServiceMonitor discovery.

4112

4113

serviceMonitorNamespaceSelector: {}

4114

## Example which selects ServiceMonitors in namespaces with label "prometheus" set to "somelabel"

4115

# serviceMonitorNamespaceSelector:

4116

# matchLabels:

4117

# prometheus: somelabel

4118

4119

## If true, a nil or {} value for prometheus.prometheusSpec.podMonitorSelector will cause the

4120

## prometheus resource to be created with selectors based on values in the helm deployment,

4121

## which will also match the podmonitors created

4122

4123

podMonitorSelectorNilUsesHelmValues: true

4124

## PodMonitors to be selected for target discovery.

4125

## If {}, select all PodMonitors

4126

4127

podMonitorSelector: {}

4128

## Example which selects PodMonitors with label "prometheus" set to "somelabel"

4129

# podMonitorSelector:

4130

# matchLabels:

4131

# prometheus: somelabel

4132

4133

## If nil, select own namespace. Namespaces to be selected for PodMonitor discovery.

4134

podMonitorNamespaceSelector: {}

4135

## Example which selects PodMonitor in namespaces with label "prometheus" set to "somelabel"

4136

# podMonitorNamespaceSelector:

4137

# matchLabels:

4138

# prometheus: somelabel

4139

4140

## If true, a nil or {} value for prometheus.prometheusSpec.probeSelector will cause the

4141

## prometheus resource to be created with selectors based on values in the helm deployment,

4142

## which will also match the probes created

4143

4144

probeSelectorNilUsesHelmValues: true

4145

## Probes to be selected for target discovery.

4146

## If {}, select all Probes

4147

4148

probeSelector: {}

4149

## Example which selects Probes with label "prometheus" set to "somelabel"

4150

# probeSelector:

4151

# matchLabels:

4152

# prometheus: somelabel

4153

4154

## If nil, select own namespace. Namespaces to be selected for Probe discovery.

4155

probeNamespaceSelector: {}

4156

## Example which selects Probe in namespaces with label "prometheus" set to "somelabel"

4157

# probeNamespaceSelector:

4158

# matchLabels:

4159

# prometheus: somelabel

4160

4161

## If true, a nil or {} value for prometheus.prometheusSpec.scrapeConfigSelector will cause the

4162

## prometheus resource to be created with selectors based on values in the helm deployment,

4163

## which will also match the scrapeConfigs created

4164

4165

## If null and scrapeConfigSelector is also null, exclude field from the prometheusSpec

4166

## (keeping downward compatibility with older versions of CRD)

4167

4168

scrapeConfigSelectorNilUsesHelmValues: true

4169

## scrapeConfigs to be selected for target discovery.

4170

## If {}, select all scrapeConfigs

4171

4172

scrapeConfigSelector: {}

4173

## Example which selects scrapeConfigs with label "prometheus" set to "somelabel"

4174

# scrapeConfigSelector:

4175

# matchLabels:

4176

# prometheus: somelabel

4177

4178

## If nil, select own namespace. Namespaces to be selected for scrapeConfig discovery.

4179

## If null, exclude the field from the prometheusSpec (keeping downward compatibility with older versions of CRD)

4180

scrapeConfigNamespaceSelector: {}

4181

## Example which selects scrapeConfig in namespaces with label "prometheus" set to "somelabel"

4182

# scrapeConfigNamespaceSelector:

4183

# matchLabels:

4184

# prometheus: somelabel

4185

4186

## How long to retain metrics

4187

4188

retention: 10d

4189

## Maximum size of metrics

4190

## Unit format should be in the form of "50GiB"

4191

retentionSize: ""

4192

## Maximum percentage of the data volume's capacity used by the metrics, between 0 and 100.

4193

## Requires Prometheus >= v3.11.0, ignored by older versions.

4194

retentionPercentage: ""

4195

## Allow out-of-order/out-of-bounds samples ingested into Prometheus for a specified duration

4196

## See https://prometheus.io/docs/prometheus/latest/configuration/configuration/#tsdb

4197

tsdb:

4198

outOfOrderTimeWindow: 0s

4199

## Per-chunk-type encoding overrides, requires Prometheus >= v3.13.0.

4200

chunkEncoding: {}

4201

# floats: Xor2

4202

4203

## Ratio of stale series in memory, between 0 and 1, at which stale series are compacted into persistent blocks.

4204

staleSeriesCompactionThreshold: ""

4205

## Enable compression of the write-ahead log using Snappy.

4206

4207

walCompression: true

4208

## If true, the Operator won't process any Prometheus configuration changes

4209

4210

paused: false

4211

## Number of replicas of each shard to deploy for a Prometheus deployment.

4212

## Number of replicas multiplied by shards is the total number of Pods created.

4213

4214

replicas: 1

4215

## EXPERIMENTAL: Number of shards to distribute targets onto.

4216

## Number of replicas multiplied by shards is the total number of Pods created.

4217

## Note that scaling down shards will not reshard data onto remaining instances, it must be manually moved.

4218

## Increasing shards will not reshard data either but it will continue to be available from the same instances.

4219

## To query globally use Thanos sidecar and Thanos querier or remote write data to a central location.

4220

## Sharding is done on the content of the `__address__` target meta-label.

4221

## Set shards to null to omit spec.shards from the Prometheus custom resource (the operator then

4222

## defaults to 1 shard). Omitting the field lets an external autoscaler such as an HPA or a KEDA

4223

## ScaledObject own spec.shards through the /scale subresource without Helm reverting it.

4224

4225

shards: 1

4226

## Log level for Prometheus be configured in

4227

4228

logLevel: info

4229

## Log format for Prometheus be configured in

4230

4231

logFormat: logfmt

4232

## Prefix used to register routes, overriding externalUrl route.

4233

## Useful for proxies that rewrite URLs.

4234

4235

routePrefix: /

4236

## Standard object's metadata. More info: https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#metadata

4237

## Metadata Labels and Annotations gets propagated to the prometheus pods.

4238

4239

podMetadata: {}

4240

# labels:

4241

# app: prometheus

4242

# k8s-app: prometheus

4243

4244

## Pod anti-affinity can prevent the scheduler from placing Prometheus replicas on the same node.

4245

## The default value "soft" means that the scheduler should *prefer* to not schedule two replica pods onto the same node but no guarantee is provided.

4246

## The value "hard" means that the scheduler is *required* to not schedule two replica pods onto the same node.

4247

## The value "" will disable pod anti-affinity so that no anti-affinity rules will be configured.

4248

podAntiAffinity: "soft"

4249

## If anti-affinity is enabled sets the topologyKey to use for anti-affinity.

4250

## This can be changed to, for example, failure-domain.beta.kubernetes.io/zone

4251

4252

podAntiAffinityTopologyKey: kubernetes.io/hostname

4253

## Assign custom affinity rules to the prometheus instance

4254

## ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/

4255

4256

affinity: {}

4257

# nodeAffinity:

4258

# requiredDuringSchedulingIgnoredDuringExecution:

4259

# nodeSelectorTerms:

4260

# - matchExpressions:

4261

# - key: kubernetes.io/e2e-az-name

4262

# operator: In

4263

# values:

4264

# - e2e-az1

4265

# - e2e-az2

4266

4267

## The remote_read spec configuration for Prometheus.

4268

## ref: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api-reference/api.md#remotereadspec

4269

remoteRead: []

4270

# - url: http://remote1/read

4271

## additionalRemoteRead is appended to remoteRead

4272

additionalRemoteRead: []

4273

## The remote_write spec configuration for Prometheus.

4274

## ref: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api-reference/api.md#remotewritespec

4275

remoteWrite: []

4276

# - url: http://remote1/push

4277

## additionalRemoteWrite is appended to remoteWrite

4278

additionalRemoteWrite: []

4279

## Enable/Disable Grafana dashboards provisioning for prometheus remote write feature

4280

remoteWriteDashboards: false

4281

## Resource limits & requests

4282

4283

resources: {}

4284

# requests:

4285

# memory: 400Mi

4286

4287

## Prometheus StorageSpec for persistent data

4288

## ref: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/platform/storage.md

4289

4290

storageSpec: {}

4291

## Using PersistentVolumeClaim

4292

4293

# volumeClaimTemplate:

4294

# spec:

4295

# storageClassName: gluster

4296

# accessModes: ["ReadWriteOnce"]

4297

# resources:

4298

# requests:

4299

# storage: 50Gi

4300

# selector: {}

4301

4302

## Using tmpfs volume

4303

4304

# emptyDir:

4305

# medium: Memory

4306

4307

# Additional volumes on the output StatefulSet definition.

4308

volumes: []

4309

# Additional VolumeMounts on the output StatefulSet definition.

4310

volumeMounts: []

4311

## AdditionalScrapeConfigs allows specifying additional Prometheus scrape configurations. Scrape configurations

4312

## are appended to the configurations generated by the Prometheus Operator. Job configurations must have the form

4313

## as specified in the official Prometheus documentation:

4314

## https://prometheus.io/docs/prometheus/latest/configuration/configuration/#scrape_config. As scrape configs are

4315

## appended, the user is responsible to make sure it is valid. Note that using this feature may expose the possibility

4316

## to break upgrades of Prometheus. It is advised to review Prometheus release notes to ensure that no incompatible

4317

## scrape configs are going to break Prometheus after the upgrade.

4318

## AdditionalScrapeConfigs can be defined as a list or as a templated string.

4319

4320

## The scrape configuration example below will find master nodes, provided they have the name .*mst.*, relabel the

4321

## port to 2379 and allow etcd scraping provided it is running on all Kubernetes master nodes

4322

4323

additionalScrapeConfigs: []

4324

# - job_name: kube-etcd

4325

# kubernetes_sd_configs:

4326

# - role: node

4327

# scheme: https

4328

# tls_config:

4329

# ca_file: /etc/prometheus/secrets/etcd-client-cert/etcd-ca

4330

# cert_file: /etc/prometheus/secrets/etcd-client-cert/etcd-client

4331

# key_file: /etc/prometheus/secrets/etcd-client-cert/etcd-client-key

4332

# relabel_configs:

4333

# - action: labelmap

4334

# regex: __meta_kubernetes_node_label_(.+)

4335

# - source_labels: [__address__]

4336

# action: replace

4337

# target_label: __address__

4338

# regex: ([^:;]+):(\d+)

4339

# replacement: ${1}:2379

4340

# - source_labels: [__meta_kubernetes_node_name]

4341

# action: keep

4342

# regex: .*mst.*

4343

# - source_labels: [__meta_kubernetes_node_name]

4344

# action: replace

4345

# target_label: node

4346

# regex: (.*)

4347

# replacement: ${1}

4348

# metric_relabel_configs:

4349

4350

# action: labeldrop

4351

4352

## If scrape config contains a repetitive section, you may want to use a template.

4353

## In the following example, you can see how to define `gce_sd_configs` for multiple zones

4354

# additionalScrapeConfigs: |

4355

# - job_name: "node-exporter"

4356

# gce_sd_configs:

4357

# {{range $zone := .Values.gcp_zones}}

4358

# - project: "project1"

4359

# zone: "{{$zone}}"

4360

# port: 9100

4361

# {{end}}

4362

# relabel_configs:

4363

# ...

4364

4365

## If additional scrape configurations are already deployed in a single secret file you can use this section.

4366

## Expected values are the secret name and key

4367

## Cannot be used with additionalScrapeConfigs

4368

additionalScrapeConfigsSecret: {}

4369

# enabled: false

4370

# name:

4371

# key:

4372

4373

## additionalPrometheusSecretsAnnotations allows to add annotations to the kubernetes secret. This can be useful

4374

## when deploying via spinnaker to disable versioning on the secret, strategy.spinnaker.io/versioned: 'false'

4375

additionalPrometheusSecretsAnnotations: {}

4376

## AdditionalAlertManagerConfigs allows for manual configuration of alertmanager jobs in the form as specified

4377

## in the official Prometheus documentation https://prometheus.io/docs/prometheus/latest/configuration/configuration/#alertmanager_config.

4378

## AlertManager configurations specified are appended to the configurations generated by the Prometheus Operator.

4379

## As AlertManager configs are appended, the user is responsible to make sure it is valid. Note that using this

4380

## feature may expose the possibility to break upgrades of Prometheus. It is advised to review Prometheus release

4381

## notes to ensure that no incompatible AlertManager configs are going to break Prometheus after the upgrade.

4382

4383

additionalAlertManagerConfigs: []

4384

# - consul_sd_configs:

4385

# - server: consul.dev.test:8500

4386

# scheme: http

4387

# datacenter: dev

4388

# tag_separator: ','

4389

# services:

4390

# - metrics-prometheus-alertmanager

4391

4392

## If additional alertmanager configurations are already deployed in a single secret, or you want to manage

4393

## them separately from the helm deployment, you can use this section.

4394

## Expected values are the secret name and key

4395

## Cannot be used with additionalAlertManagerConfigs

4396

additionalAlertManagerConfigsSecret: {}

4397

# name:

4398

# key:

4399

# optional: false

4400

4401

## AdditionalAlertRelabelConfigs allows specifying Prometheus alert relabel configurations. Alert relabel configurations specified are appended

4402

## to the configurations generated by the Prometheus Operator. Alert relabel configurations specified must have the form as specified in the

4403

## official Prometheus documentation: https://prometheus.io/docs/prometheus/latest/configuration/configuration/#alert_relabel_configs.

4404

## As alert relabel configs are appended, the user is responsible to make sure it is valid. Note that using this feature may expose the

4405

## possibility to break upgrades of Prometheus. It is advised to review Prometheus release notes to ensure that no incompatible alert relabel

4406

## configs are going to break Prometheus after the upgrade.

4407

4408

additionalAlertRelabelConfigs: []

4409

# - separator: ;

4410

# regex: prometheus_replica

4411

# replacement: $1

4412

# action: labeldrop

4413

4414

## If additional alert relabel configurations are already deployed in a single secret, or you want to manage

4415

## them separately from the helm deployment, you can use this section.

4416

## Expected values are the secret name and key

4417

## Cannot be used with additionalAlertRelabelConfigs

4418

additionalAlertRelabelConfigsSecret: {}

4419

# name:

4420

# key:

4421

4422

## SecurityContext holds pod-level security attributes and common container settings.

4423

## This defaults to non root user with uid 1000 and gid 2000.

4424

## https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api-reference/api.md

4425

4426

securityContext:

4427

runAsGroup: 2000

4428

runAsNonRoot: true

4429

runAsUser: 1000

4430

fsGroup: 2000

4431

seccompProfile:

4432

type: RuntimeDefault

4433

## DNS configuration for Prometheus.

4434

## ref: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api-reference/api.md#monitoring.coreos.com/v1.PodDNSConfig

4435

dnsConfig: {}

4436

## DNS policy for Prometheus.

4437

## ref: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api-reference/api.md#dnspolicystring-alias

4438

dnsPolicy: ""

4439

## Priority class assigned to the Pods

4440

4441

priorityClassName: ""

4442

## Thanos configuration allows configuring various aspects of a Prometheus server in a Thanos environment.

4443

## This section is experimental, it may change significantly without deprecation notice in any release.

4444

## This is experimental and may change significantly without backward compatibility in any release.

4445

## ref: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api-reference/api.md#thanosspec

4446

4447

thanos: {}

4448

# image: quay.io/thanos/thanos

4449

# secretProviderClass:

4450

# provider: gcp

4451

# parameters:

4452

# secrets: |

4453

# - resourceName: "projects/$PROJECT_ID/secrets/testsecret/versions/latest"

4454

# fileName: "objstore.yaml"

4455

## ObjectStorageConfig configures object storage in Thanos.

4456

# objectStorageConfig:

4457

# # use existing secret, if configured, objectStorageConfig.secret will not be used

4458

# existingSecret: {}

4459

# # name: ""

4460

# # key: ""

4461

# # will render objectStorageConfig secret data and configure it to be used by Thanos custom resource,

4462

# # ignored when prometheusspec.thanos.objectStorageConfig.existingSecret is set

4463

# # https://thanos.io/tip/thanos/storage.md/#s3

4464

# secret: {}

4465

# # type: S3

4466

# # config:

4467

# # bucket: ""

4468

# # endpoint: ""

4469

# # region: ""

4470

# # access_key: ""

4471

# # secret_key: ""

4472

4473

## Containers allows injecting additional containers. This is meant to allow adding an authentication proxy to a Prometheus pod.

4474

## if using proxy extraContainer update targetPort with proxy container port

4475

containers: []

4476

# containers:

4477

# - name: oauth-proxy

4478

# image: quay.io/oauth2-proxy/oauth2-proxy:v7.15.4

4479

# args:

4480

# - --upstream=http://127.0.0.1:9090

4481

# - --http-address=0.0.0.0:8081

4482

# - --metrics-address=0.0.0.0:8082

4483

# - ...

4484

# ports:

4485

# - containerPort: 8081

4486

# name: oauth-proxy

4487

# protocol: TCP

4488

# - containerPort: 8082

4489

# name: oauth-metrics

4490

# protocol: TCP

4491

# resources: {}

4492

4493

## InitContainers allows injecting additional initContainers. This is meant to allow doing some changes

4494

## (permissions, dir tree) on mounted volumes before starting prometheus

4495

initContainers: []

4496

## PortName to use for Prometheus.

4497

4498

portName: "http-web"

4499

## ArbitraryFSAccessThroughSMs configures whether configuration based on a service monitor can access arbitrary files

4500

## on the file system of the Prometheus container e.g. bearer token files.

4501

arbitraryFSAccessThroughSMs: false

4502

## OverrideHonorLabels if set to true overrides all user configured honor_labels. If HonorLabels is set in ServiceMonitor

4503

## or PodMonitor to true, this overrides honor_labels to false.

4504

overrideHonorLabels: false

4505

## OverrideHonorTimestamps allows to globally enforce honoring timestamps in all scrape configs.

4506

overrideHonorTimestamps: false

4507

## When ignoreNamespaceSelectors is set to true, namespaceSelector from all PodMonitor, ServiceMonitor and Probe objects will be ignored,

4508

## they will only discover targets within the namespace of the PodMonitor, ServiceMonitor and Probe object,

4509

## and servicemonitors will be installed in the default service namespace.

4510

## Defaults to false.

4511

ignoreNamespaceSelectors: false

4512

## EnforcedNamespaceLabel enforces adding a namespace label of origin for each alert and metric that is user created.

4513

## The label value will always be the namespace of the object that is being created.

4514

## Disabled by default

4515

enforcedNamespaceLabel: ""

4516

## PrometheusRulesExcludedFromEnforce - list of prometheus rules to be excluded from enforcing of adding namespace labels.

4517

## Works only if enforcedNamespaceLabel set to true. Make sure both ruleNamespace and ruleName are set for each pair

4518

## Deprecated, use `excludedFromEnforcement` instead

4519

prometheusRulesExcludedFromEnforce: []

4520

## ExcludedFromEnforcement - list of object references to PodMonitor, ServiceMonitor, Probe and PrometheusRule objects

4521

## to be excluded from enforcing a namespace label of origin.

4522

## Works only if enforcedNamespaceLabel set to true.

4523

## See https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api-reference/api.md#objectreference

4524

excludedFromEnforcement: []

4525

## QueryLogFile specifies the file to which PromQL queries are logged. Note that this location must be writable,

4526

## and can be persisted using an attached volume. Alternatively, the location can be set to a stdout location such

4527

## as /dev/stdout to log querie information to the default Prometheus log stream. This is only available in versions

4528

## of Prometheus >= 2.16.0. For more details, see the Prometheus docs (https://prometheus.io/docs/guides/query-log/)

4529

queryLogFile: false

4530

# Use to set global sample_limit for Prometheus. This act as default SampleLimit for ServiceMonitor or/and PodMonitor.

4531

# Set to 'false' to disable global sample_limit. or set to a number to override the default value.

4532

sampleLimit: false

4533

## TargetLimit defines a global limit on the number of scraped targets. 0 means no limit.

4534

targetLimit: 0

4535

## Per-scrape limit on number of labels that will be accepted for a sample. 0 means no limit.

4536

labelLimit: 0

4537

## Per-scrape limit on length of labels name that will be accepted for a sample. 0 means no limit.

4538

labelNameLengthLimit: 0

4539

## Per-scrape limit on length of labels value that will be accepted for a sample. 0 means no limit.

4540

labelValueLengthLimit: 0

4541

## Per-scrape limit on the number of targets dropped by relabeling that will be kept in memory. 0 means no limit.

4542

keepDroppedTargets: 0

4543

## BodySizeLimit defines a global limit on the size of uncompressed response body that will be accepted. Example: 100MB.

4544

bodySizeLimit: ""

4545

## EnforcedBodySizeLimit defines the maximum size of uncompressed response body that will be accepted, overriding any

4546

## value set per ServiceMonitor/PodMonitor. Example: 100MB. Empty means no limit.

4547

enforcedBodySizeLimit: ""

4548

# EnforcedKeepDroppedTargetsLimit defines on the number of targets dropped by relabeling that will be kept in memory.

4549

# The value overrides any spec.keepDroppedTargets set by ServiceMonitor, PodMonitor, Probe objects unless spec.keepDroppedTargets

4550

# is greater than zero and less than spec.enforcedKeepDroppedTargets. 0 means no limit.

4551

enforcedKeepDroppedTargets: 0

4552

## EnforcedSampleLimit defines global limit on number of scraped samples that will be accepted. This overrides any SampleLimit

4553

## set per ServiceMonitor or/and PodMonitor. It is meant to be used by admins to enforce the SampleLimit to keep overall

4554

## number of samples/series under the desired limit. Note that if SampleLimit is lower that value will be taken instead.

4555

enforcedSampleLimit: false

4556

## EnforcedTargetLimit defines a global limit on the number of scraped targets. This overrides any TargetLimit set

4557

## per ServiceMonitor or/and PodMonitor. It is meant to be used by admins to enforce the TargetLimit to keep the overall

4558

## number of targets under the desired limit. Note that if TargetLimit is lower, that value will be taken instead, except

4559

## if either value is zero, in which case the non-zero value will be used. If both values are zero, no limit is enforced.

4560

enforcedTargetLimit: false

4561

## Per-scrape limit on number of labels that will be accepted for a sample. If more than this number of labels are present

4562

## post metric-relabeling, the entire scrape will be treated as failed. 0 means no limit. Only valid in Prometheus versions

4563

## 2.27.0 and newer.

4564

enforcedLabelLimit: false

4565

## Per-scrape limit on length of labels name that will be accepted for a sample. If a label name is longer than this number

4566

## post metric-relabeling, the entire scrape will be treated as failed. 0 means no limit. Only valid in Prometheus versions

4567

## 2.27.0 and newer.

4568

enforcedLabelNameLengthLimit: false

4569

## Per-scrape limit on length of labels value that will be accepted for a sample. If a label value is longer than this

4570

## number post metric-relabeling, the entire scrape will be treated as failed. 0 means no limit. Only valid in Prometheus

4571

## versions 2.27.0 and newer.

4572

enforcedLabelValueLengthLimit: false

4573

## AllowOverlappingBlocks enables vertical compaction and vertical query merge in Prometheus. This is still experimental

4574

## in Prometheus so it may change in any upcoming release.

4575

allowOverlappingBlocks: false

4576

## Specifies the validation scheme for metric and label names.

4577

## Supported values are: Legacy, UTF8

4578

nameValidationScheme: ""

4579

## Minimum number of seconds for which a newly created pod should be ready without any of its container crashing for it to

4580

## be considered available. Defaults to 0 (pod will be considered available as soon as it is ready).

4581

minReadySeconds: 0

4582

## Duration in seconds the pod needs to terminate gracefully.

4583

## ref: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle/#pod-termination

4584

terminationGracePeriodSeconds: ~

4585

# Required for use in managed kubernetes clusters (such as AWS EKS) with custom CNI (such as calico),

4586

# because control-plane managed by AWS cannot communicate with pods' IP CIDR and admission webhooks are not working

4587

# Use the host's network namespace if true. Make sure to understand the security implications if you want to enable it.

4588

# When hostNetwork is enabled, this will set dnsPolicy to ClusterFirstWithHostNet automatically.

4589

hostNetwork: false

4590

## Use the host's user namespace for Prometheus pods.

4591

## ref: https://kubernetes.io/docs/tasks/configure-pod-container/user-namespaces/

4592

hostUsers: ~

4593

# HostAlias holds the mapping between IP and hostnames that will be injected

4594

# as an entry in the pod's hosts file.

4595

hostAliases: []

4596

# - ip: 10.10.0.100

4597

# hostnames:

4598

# - a1.app.local

4599

# - b1.app.local

4600

4601

## TracingConfig configures tracing in Prometheus.

4602

## See https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api-reference/api.md#prometheustracingconfig

4603

tracingConfig: {}

4604

## Defines the service discovery role used to discover targets from ServiceMonitor objects and Alertmanager endpoints.

4605

## If set, the value should be either "Endpoints" or "EndpointSlice". If unset, the operator assumes the "Endpoints" role.

4606

serviceDiscoveryRole: ""

4607

## EnableServiceLinks indicates whether information about services should be injected into the pod's environment

4608

## variables. Uses the operator/Kubernetes default when left unset (~).

4609

enableServiceLinks: ~

4610

## Set the scheduler name to use for the Prometheus pods.

4611

schedulerName: ""

4612

## Specifies the character escaping scheme applied to metric and label names.

4613

## Supported values are: AllowUTF8, Underscores, Dots, Values

4614

nameEscapingScheme: ""

4615

## Defines the strategy used to reload the Prometheus configuration.

4616

## Supported values are: HTTP, ProcessSignal

4617

reloadStrategy: ""

4618

## Defines the offset the rule evaluation timestamp of the rule evaluation queries is shifted backwards.

4619

## ref: https://github.com/prometheus-community/helm-charts/issues/5843

4620

ruleQueryOffset: ""

4621

## Configuration of the Prometheus rules' engine. Changing these triggers a restart of the pods.

4622

## ref: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api-reference/api.md#monitoring.coreos.com/v1.Rules

4623

rules: {}

4624

# alert:

4625

# forOutageTolerance: 1h

4626

# forGracePeriod: 10m

4627

# resendDelay: 1m

4628

4629

## RuntimeConfig configures the values for the Prometheus process behavior.

4630

runtime: {}

4631

# goGC: 75

4632

4633

## Defines the sharding strategy applied by the operator.

4634

## ref: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api-reference/api.md#monitoring.coreos.com/v1.ShardingStrategy

4635

shardingStrategy: {}

4636

## Defines the retention policy for the resources of stale shards after a scale-down.

4637

## ref: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api-reference/api.md#monitoring.coreos.com/v1.ShardRetentionPolicy

4638

shardRetentionPolicy: {}

4639

## List of the protobuf message versions to accept when receiving the remote writes. Example: [V1.0, V2.0].

4640

remoteWriteReceiverMessageVersions: []

4641

## Pod management policy. Kubernetes default is OrderedReady but prometheus-operator default is Parallel.

4642

## ref: https://kubernetes.io/docs/concepts/workloads/controllers/statefulset/#pod-management-policies

4643

podManagementPolicy: ""

4644

## Update strategy for the StatefulSet.

4645

## ref: https://kubernetes.io/docs/concepts/workloads/controllers/statefulset/#update-strategies

4646

updateStrategy: {}

4647

# type: RollingUpdate

4648

# rollingUpdate:

4649

# maxUnavailable: 1

4650

4651

## Additional configuration which is not covered by the properties above. (passed through tpl)

4652

additionalConfig: {}

4653

## Additional configuration which is not covered by the properties above.

4654

## Useful, if you need advanced templating inside alertmanagerSpec.

4655

## Otherwise, use prometheus.prometheusSpec.additionalConfig (passed through tpl)

4656

additionalConfigString: ""

4657

## Defines the maximum time that the `prometheus` container's startup probe

4658

## will wait before being considered failed. The startup probe will return

4659

## success after the WAL replay is complete. If set, the value should be

4660

## greater than 60 (seconds). Otherwise it will be equal to 900 seconds (15

4661

## minutes).

4662

maximumStartupDurationSeconds: 0

4663

## Set default scrapeProtocols for Prometheus instances

4664

## https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api-reference/api.md#scrapeprotocolstring-alias

4665

scrapeProtocols: []

4666

additionalRulesForClusterRole: []

4667

# - apiGroups: [ "" ]

4668

# resources:

4669

# - nodes/proxy

4670

# verbs: [ "get", "list", "watch" ]

4671

4672

additionalServiceMonitors: []

4673

## Name of the ServiceMonitor to create

4674

4675

# - name: ""

4676

4677

## Additional labels to set used for the ServiceMonitorSelector. Together with standard labels from

4678

## the chart

4679

4680

# additionalLabels: {}

4681

4682

## Service label for use in assembling a job name of the form <label value>-<port>

4683

## If no label is specified, the service name is used.

4684

4685

# jobLabel: ""

4686

4687

## labels to transfer from the kubernetes service to the target

4688

4689

# targetLabels: []

4690

4691

## labels to transfer from the kubernetes pods to the target

4692

4693

# podTargetLabels: []

4694

4695

## Label selector for services to which this ServiceMonitor applies

4696

4697

# selector: {}

4698

## Example which selects all services to be monitored

4699

## with label "monitoredby" with values any of "example-service-1" or "example-service-2"

4700

# matchExpressions:

4701

# - key: "monitoredby"

4702

# operator: In

4703

# values:

4704

# - example-service-1

4705

# - example-service-2

4706

4707

## label selector for services

4708

4709

# matchLabels: {}

4710

4711

## Namespaces from which services are selected

4712

4713

# namespaceSelector:

4714

## Match any namespace

4715

4716

# any: false

4717

4718

## Explicit list of namespace names to select

4719

4720

# matchNames: []

4721

4722

## Endpoints of the selected service to be monitored

4723

4724

# endpoints: []

4725

## Name of the endpoint's service port

4726

## Mutually exclusive with targetPort

4727

# - port: ""

4728

4729

## Name or number of the endpoint's target port

4730

## Mutually exclusive with port

4731

# - targetPort: ""

4732

4733

## File containing bearer token to be used when scraping targets

4734

4735

# bearerTokenFile: ""

4736

4737

## Interval at which metrics should be scraped

4738

4739

# interval: 30s

4740

4741

## HTTP path to scrape for metrics

4742

4743

# path: /metrics

4744

4745

## HTTP scheme to use for scraping

4746

4747

# scheme: http

4748

4749

## TLS configuration to use when scraping the endpoint

4750

4751

# tlsConfig:

4752

4753

## Path to the CA file

4754

4755

# caFile: ""

4756

4757

## Path to client certificate file

4758

4759

# certFile: ""

4760

4761

## Skip certificate verification

4762

4763

# insecureSkipVerify: false

4764

4765

## Path to client key file

4766

4767

# keyFile: ""

4768

4769

## Server name used to verify host name

4770

4771

# serverName: ""

4772

4773

## MetricRelabelConfigs to apply to samples after scraping, but before ingestion.

4774

## ref: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api-reference/api.md#relabelconfig

4775

4776

# metricRelabelings: []

4777

# - action: keep

4778

4779

# sourceLabels: [__name__]

4780

4781

## RelabelConfigs to apply to samples before scraping

4782

## ref: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api-reference/api.md#relabelconfig

4783

4784

# relabelings: []

4785

# - sourceLabels: [__meta_kubernetes_pod_node_name]

4786

# separator: ;

4787

# regex: ^(.*)$

4788

# targetLabel: nodename

4789

# replacement: $1

4790

# action: replace

4791

4792

## Fallback scrape protocol used by Prometheus for scraping metrics

4793

## ref: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api-reference/api.md#monitoring.coreos.com/v1.ScrapeProtocol

4794

4795

# fallbackScrapeProtocol: ""

4796

4797

## Attaches node metadata to the discovered targets

4798

## ref: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api-reference/api.md#monitoring.coreos.com/v1.AttachMetadata

4799

4800

# attachMetadata:

4801

# node: true

4802

additionalPodMonitors: []

4803

## Name of the PodMonitor to create

4804

4805

# - name: ""

4806

## Additional labels to set used for the PodMonitorSelector. Together with standard labels from

4807

## the chart

4808

4809

# additionalLabels: {}

4810

4811

## Pod label for use in assembling a job name of the form <label value>-<port>

4812

## If no label is specified, the pod endpoint name is used.

4813

4814

# jobLabel: ""

4815

4816

## Label selector for pods to which this PodMonitor applies

4817

4818

# selector: {}

4819

## Example which selects all Pods to be monitored

4820

## with label "monitoredby" with values any of "example-pod-1" or "example-pod-2"

4821

# matchExpressions:

4822

# - key: "monitoredby"

4823

# operator: In

4824

# values:

4825

# - example-pod-1

4826

# - example-pod-2

4827

4828

## label selector for pods

4829

4830

# matchLabels: {}

4831

4832

## PodTargetLabels transfers labels on the Kubernetes Pod onto the target.

4833

4834

# podTargetLabels: {}

4835

4836

## SampleLimit defines per-scrape limit on number of scraped samples that will be accepted.

4837

4838

# sampleLimit: 0

4839

4840

## Namespaces from which pods are selected

4841

4842

# namespaceSelector:

4843

## Match any namespace

4844

4845

# any: false

4846

4847

## Explicit list of namespace names to select

4848

4849

# matchNames: []

4850

4851

## Endpoints of the selected pods to be monitored

4852

## https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api-reference/api.md#podmetricsendpoint

4853

4854

# podMetricsEndpoints: []

4855

4856

## Fallback scrape protocol used by Prometheus for scraping metrics

4857

## ref: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api-reference/api.md#monitoring.coreos.com/v1.ScrapeProtocol

4858

4859

# fallbackScrapeProtocol: ""

4860

4861

## Attaches node metadata to the discovered targets

4862

## ref: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api-reference/api.md#monitoring.coreos.com/v1.AttachMetadata

4863

4864

# attachMetadata:

4865

# node: true

4866

4867

## Configuration for thanosRuler

4868

## ref: https://thanos.io/tip/components/rule.md/

4869

4870

thanosRuler:

4871

## Deploy thanosRuler

4872

4873

enabled: false

4874

## Annotations for ThanosRuler

4875

4876

annotations: {}

4877

## Service account for ThanosRuler to use.

4878

## ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/

4879

4880

serviceAccount:

4881

create: true

4882

4883

annotations: {}

4884

## Configure pod disruption budgets for ThanosRuler

4885

## ref: https://kubernetes.io/docs/tasks/run-application/configure-pdb/#specifying-a-poddisruptionbudget

4886

4887

podDisruptionBudget:

4888

enabled: false

4889

minAvailable: 1

4890

# maxUnavailable: ""

4891

unhealthyPodEvictionPolicy: AlwaysAllow

4892

ingress:

4893

enabled: false

4894

ingressClassName: ""

4895

annotations: {}

4896

labels: {}

4897

## Hosts must be provided if Ingress is enabled.

4898

4899

hosts: []

4900

# - thanosruler.domain.com

4901

4902

## Paths to use for ingress rules - one path should match the thanosruler.routePrefix

4903

4904

paths: []

4905

# - /

4906

4907

## For Kubernetes >= 1.18 you should specify the pathType (determines how Ingress paths should be matched)

4908

## See https://kubernetes.io/blog/2020/04/02/improvements-to-the-ingress-api-in-kubernetes-1.18/#better-path-matching-with-path-types

4909

# pathType: ImplementationSpecific

4910

4911

## TLS configuration for ThanosRuler Ingress

4912

## Secret must be manually created in the namespace

4913

4914

tls: []

4915

# - secretName: thanosruler-general-tls

4916

# hosts:

4917

# - thanosruler.example.com

4918

# -- BETA: Configure the gateway routes for the chart here.

4919

# More routes can be added by adding a dictionary key like the 'main' route.

4920

# Be aware that this is an early beta of this feature,

4921

# kube-prometheus-stack does not guarantee this works and is subject to change.

4922

# Being BETA this can/will change in the future without notice, do not use unless you want to take that risk

4923

# [[ref]](https://gateway-api.sigs.k8s.io/reference/spec/#gateway.networking.k8s.io%2fv1alpha2)

4924

route:

4925

main:

4926

# -- Enables or disables the route

4927

enabled: false

4928

# -- Set the route apiVersion, e.g. gateway.networking.k8s.io/v1 or gateway.networking.k8s.io/v1alpha2

4929

apiVersion: gateway.networking.k8s.io/v1

4930

# -- Set the route kind

4931

# Valid options are GRPCRoute, HTTPRoute, TCPRoute, TLSRoute, UDPRoute

4932

kind: HTTPRoute

4933

annotations: {}

4934

labels: {}

4935

hostnames: []

4936

# - my-filter.example.com

4937

parentRefs: []

4938

# - name: acme-gw

4939

4940

# -- create http route for redirect (https://gateway-api.sigs.k8s.io/guides/http-redirect-rewrite/#http-to-https-redirects)

4941

## Take care that you only enable this on the http listener of the gateway to avoid an infinite redirect.

4942

## matches, filters and additionalRules will be ignored if this is set to true. Be are

4943

httpsRedirect: false

4944

matches:

4945

- path:

4946

type: PathPrefix

4947

value: /

4948

## Filters define the filters that are applied to requests that match this rule.

4949

filters: []

4950

## Timeouts for the generated HTTPRoute backend rule.

4951

## Requires Gateway API CRDs and a controller that support HTTPRoute timeouts.

4952

timeouts: {}

4953

# request: 120s

4954

# backendRequest: 60s

4955

4956

## Session persistence configuration for the route rule.

4957

sessionPersistence: {}

4958

# sessionName: route

4959

# type: Cookie

4960

# absoluteTimeout: 12h

4961

# cookieConfig:

4962

# lifetimeType: Permanent

4963

4964

## Additional custom rules that can be added to the route

4965

additionalRules: []

4966

## Configuration for ThanosRuler service

4967

4968

service:

4969

enabled: true

4970

annotations: {}

4971

labels: {}

4972

clusterIP: ""

4973

ipDualStack:

4974

enabled: false

4975

ipFamilies: ["IPv6", "IPv4"]

4976

ipFamilyPolicy: "PreferDualStack"

4977

## Port for ThanosRuler Service to listen on

4978

4979

port: 10902

4980

## To be used with a proxy extraContainer port

4981

4982

targetPort: 10902

4983

## Port to expose on each node

4984

## Only used if service.type is 'NodePort'

4985

4986

nodePort: 30905

4987

## List of IP addresses at which the Prometheus server service is available

4988

## Ref: https://kubernetes.io/docs/concepts/services-networking/service/#external-ips

4989

4990

4991

## Additional ports to open for ThanosRuler service

4992

additionalPorts: []

4993

externalIPs: []

4994

loadBalancerIP: ""

4995

loadBalancerSourceRanges: []

4996

## Denotes if this Service desires to route external traffic to node-local or cluster-wide endpoints

4997

4998

externalTrafficPolicy: Cluster

4999

## Service type

5000

5001

type: ClusterIP

5002

## Configuration for creating a ServiceMonitor for the ThanosRuler service

5003

5004

serviceMonitor:

5005

## If true, create a serviceMonitor for thanosRuler

5006

5007

selfMonitor: true

5008

## Scrape interval. If not set, the Prometheus default scrape interval is used.

5009

5010

interval: ""

5011

## Additional labels

5012

5013

additionalLabels: {}

5014

## SampleLimit defines per-scrape limit on number of scraped samples that will be accepted.

5015

5016

sampleLimit: 0

5017

## TargetLimit defines a limit on the number of scraped targets that will be accepted.

5018

5019

targetLimit: 0

5020

## Per-scrape limit on number of labels that will be accepted for a sample. Only valid in Prometheus versions 2.27.0 and newer.

5021

5022

labelLimit: 0

5023

## Per-scrape limit on length of labels name that will be accepted for a sample. Only valid in Prometheus versions 2.27.0 and newer.

5024

5025

labelNameLengthLimit: 0

5026

## Per-scrape limit on length of labels value that will be accepted for a sample. Only valid in Prometheus versions 2.27.0 and newer.

5027

5028

labelValueLengthLimit: 0

5029

## proxyUrl: URL of a proxy that should be used for scraping.

5030

5031

proxyUrl: ""

5032

## scheme: HTTP scheme to use for scraping. Can be used with `tlsConfig` for example if using istio mTLS.

5033

scheme: ""

5034

## tlsConfig: TLS configuration to use when scraping the endpoint. For example if using istio mTLS.

5035

## Of type: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api-reference/api.md#tlsconfig

5036

tlsConfig: {}

5037

bearerTokenFile:

5038

## MetricRelabelConfigs to apply to samples after scraping, but before ingestion.

5039

## ref: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api-reference/api.md#relabelconfig

5040

5041

metricRelabelings: []

5042

# - action: keep

5043

5044

# sourceLabels: [__name__]

5045

5046

## RelabelConfigs to apply to samples before scraping

5047

## ref: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api-reference/api.md#relabelconfig

5048

5049

relabelings: []

5050

# - sourceLabels: [__meta_kubernetes_pod_node_name]

5051

# separator: ;

5052

# regex: ^(.*)$

5053

# targetLabel: nodename

5054

# replacement: $1

5055

# action: replace

5056

5057

## Additional Endpoints

5058

5059

additionalEndpoints: []

5060

# - port: oauth-metrics

5061

# path: /metrics

5062

## Settings affecting thanosRulerpec

5063

## ref: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api-reference/api.md#thanosrulerspec

5064

5065

thanosRulerSpec:

5066

## Standard object's metadata. More info: https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#metadata

5067

## Metadata Labels and Annotations gets propagated to the ThanosRuler pods.

5068

5069

podMetadata: {}

5070

5071

serviceName:

5072

## Image of ThanosRuler

5073

5074

image:

5075

registry: cgr.dev

5076

repository: chainguard-private/thanos

5077

tag: 0.42.4-r7

5078

sha: sha256:5b3801e1185d9ff3e0a11d15f8e94ea5b440676a423278cf17c6f9047b4ec77a

5079

## Namespaces to be selected for PrometheusRules discovery.

5080

## If nil, select own namespace. Namespaces to be selected for ServiceMonitor discovery.

5081

## See https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api-reference/api.md#namespaceselector for usage

5082

5083

ruleNamespaceSelector: {}

5084

## If true, a nil or {} value for thanosRuler.thanosRulerSpec.ruleSelector will cause the

5085

## prometheus resource to be created with selectors based on values in the helm deployment,

5086

## which will also match the PrometheusRule resources created

5087

5088

ruleSelectorNilUsesHelmValues: true

5089

## PrometheusRules to be selected for target discovery.

5090

## If {}, select all PrometheusRules

5091

5092

ruleSelector: {}

5093

## Example which select all PrometheusRules resources

5094

## with label "prometheus" with values any of "example-rules" or "example-rules-2"

5095

# ruleSelector:

5096

# matchExpressions:

5097

# - key: prometheus

5098

# operator: In

5099

# values:

5100

# - example-rules

5101

# - example-rules-2

5102

5103

## Example which select all PrometheusRules resources with label "role" set to "example-rules"

5104

# ruleSelector:

5105

# matchLabels:

5106

# role: example-rules

5107

5108

## Define Log Format

5109

# Use logfmt (default) or json logging

5110

logFormat: logfmt

5111

## Log level for ThanosRuler to be configured with.

5112

5113

logLevel: info

5114

## Size is the expected size of the thanosRuler cluster. The controller will eventually make the size of the

5115

## running cluster equal to the expected size.

5116

replicas: 1

5117

## Time duration ThanosRuler shall retain data for. Default is '24h', and must match the regular expression

5118

## [0-9]+(ms|s|m|h) (milliseconds seconds minutes hours).

5119

5120

retention: 24h

5121

## Interval between consecutive evaluations.

5122

5123

evaluationInterval: ""

5124

## Storage is the definition of how storage will be used by the ThanosRuler instances.

5125

## ref: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/platform/storage.md

5126

5127

storage: {}

5128

# volumeClaimTemplate:

5129

# spec:

5130

# storageClassName: gluster

5131

# accessModes: ["ReadWriteOnce"]

5132

# resources:

5133

# requests:

5134

# storage: 50Gi

5135

# selector: {}

5136

5137

## AlertmanagerConfig define configuration for connecting to alertmanager.

5138

## Only available with Thanos v0.10.0 and higher. Maps to the alertmanagers.config Thanos Ruler arg.

5139

alertmanagersConfig:

5140

# use existing secret, if configured, alertmanagersConfig.secret will not be used

5141

existingSecret: {}

5142

# name: ""

5143

# key: ""

5144

# will render alertmanagersConfig secret data and configure it to be used by Thanos Ruler custom resource, ignored when alertmanagersConfig.existingSecret is set

5145

# https://thanos.io/tip/components/rule.md/#alertmanager

5146

secret: {}

5147

# alertmanagers:

5148

# - api_version: v2

5149

# http_config:

5150

# basic_auth:

5151

# username: some_user

5152

# password: some_pass

5153

# static_configs:

5154

# - alertmanager.thanos.io

5155

# scheme: http

5156

# timeout: 10s

5157

## DEPRECATED. Define URLs to send alerts to Alertmanager. For Thanos v0.10.0 and higher, alertmanagersConfig should be used instead.

5158

## Note: this field will be ignored if alertmanagersConfig is specified. Maps to the alertmanagers.url Thanos Ruler arg.

5159

# alertmanagersUrl:

5160

5161

## The external URL the Thanos Ruler instances will be available under. This is necessary to generate correct URLs. This is necessary if Thanos Ruler is not served from root of a DNS name. string false

5162

5163

externalPrefix:

5164

## If true, http://{{ template "kube-prometheus-stack.thanosRuler.name" . }}.{{ template "kube-prometheus-stack.namespace" . }}:{{ .Values.thanosRuler.service.port }}

5165

## will be used as value for externalPrefix

5166

externalPrefixNilUsesHelmValues: true

5167

## The route prefix ThanosRuler registers HTTP handlers for. This is useful, if using ExternalURL and a proxy is rewriting HTTP routes of a request, and the actual ExternalURL is still true,

5168

## but the server serves requests under a different route prefix. For example for use with kubectl proxy.

5169

5170

routePrefix: /

5171

## ObjectStorageConfig configures object storage in Thanos

5172

objectStorageConfig:

5173

# use existing secret, if configured, objectStorageConfig.secret will not be used

5174

existingSecret: {}

5175

# name: ""

5176

# key: ""

5177

# will render objectStorageConfig secret data and configure it to be used by Thanos Ruler custom resource, ignored when objectStorageConfig.existingSecret is set

5178

# https://thanos.io/tip/thanos/storage.md/#s3

5179

secret: {}

5180

# type: S3

5181

# config:

5182

# bucket: ""

5183

# endpoint: ""

5184

# region: ""

5185

# access_key: ""

5186

# secret_key: ""

5187

## Labels by name to drop before sending to alertmanager

5188

## Maps to the --alert.label-drop flag of thanos ruler.

5189

alertDropLabels: []

5190

## QueryEndpoints defines Thanos querier endpoints from which to query metrics.

5191

## Maps to the --query flag of thanos ruler.

5192

queryEndpoints: []

5193

## Define configuration for connecting to thanos query instances. If this is defined, the queryEndpoints field will be ignored.

5194

## Maps to the query.config CLI argument. Only available with thanos v0.11.0 and higher.

5195

queryConfig:

5196

# use existing secret, if configured, queryConfig.secret will not be used

5197

existingSecret: {}

5198

# name: ""

5199

# key: ""

5200

# render queryConfig secret data and configure it to be used by Thanos Ruler custom resource, ignored when queryConfig.existingSecret is set

5201

# https://thanos.io/tip/components/rule.md/#query-api

5202

secret: {}

5203

# - http_config:

5204

# basic_auth:

5205

# username: some_user

5206

# password: some_pass

5207

# static_configs:

5208

# - URL

5209

# scheme: http

5210

# timeout: 10s

5211

## Labels configure the external label pairs to ThanosRuler. A default replica

5212

## label `thanos_ruler_replica` will be always added as a label with the value

5213

## of the pod's name and it will be dropped in the alerts.

5214

labels: {}

5215

## If set to true all actions on the underlying managed objects are not going to be performed, except for delete actions.

5216

5217

paused: false

5218

## Allows setting additional arguments for the ThanosRuler container

5219

## ref: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api-reference/api.md#thanosruler

5220

5221

additionalArgs: []

5222

# - name: remote-write.config

5223

# value: |-

5224

# "remote_write":

5225

# - "name": "receiver-0"

5226

# "remote_timeout": "30s"

5227

# "url": "http://thanos-receiver-0.thanos-receiver:8081/api/v1/receive"

5228

5229

## Define which Nodes the Pods are scheduled on.

5230

## ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#nodeselector

5231

5232

nodeSelector: {}

5233

## Define resources requests and limits for single Pods.

5234

## ref: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/

5235

5236

resources: {}

5237

# requests:

5238

# memory: 400Mi

5239

5240

## Pod anti-affinity can prevent the scheduler from placing Prometheus replicas on the same node.

5241

## The default value "soft" means that the scheduler should *prefer* to not schedule two replica pods onto the same node but no guarantee is provided.

5242

## The value "hard" means that the scheduler is *required* to not schedule two replica pods onto the same node.

5243

## The value "" will disable pod anti-affinity so that no anti-affinity rules will be configured.

5244

5245

podAntiAffinity: "soft"

5246

## If anti-affinity is enabled sets the topologyKey to use for anti-affinity.

5247

## This can be changed to, for example, failure-domain.beta.kubernetes.io/zone

5248

5249

podAntiAffinityTopologyKey: kubernetes.io/hostname

5250

## Assign custom affinity rules to the thanosRuler instance

5251

## ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/

5252

5253

affinity: {}

5254

# nodeAffinity:

5255

# requiredDuringSchedulingIgnoredDuringExecution:

5256

# nodeSelectorTerms:

5257

# - matchExpressions:

5258

# - key: kubernetes.io/e2e-az-name

5259

# operator: In

5260

# values:

5261

# - e2e-az1

5262

# - e2e-az2

5263

5264

## If specified, the pod's tolerations.

5265

## ref: https://kubernetes.io/docs/concepts/scheduling-eviction/taint-and-toleration/

5266

5267

tolerations: []

5268

# - key: "key"

5269

# operator: "Equal"

5270

# value: "value"

5271

# effect: "NoSchedule"

5272

5273

## If specified, the pod's topology spread constraints.

5274

## ref: https://kubernetes.io/docs/concepts/scheduling-eviction/topology-spread-constraints/

5275

5276

topologySpreadConstraints: []

5277

# - maxSkew: 1

5278

# topologyKey: topology.kubernetes.io/zone

5279

# whenUnsatisfiable: DoNotSchedule

5280

# labelSelector:

5281

# matchLabels:

5282

# app: thanos-ruler

5283

5284

## SecurityContext holds pod-level security attributes and common container settings.

5285

## This defaults to non root user with uid 1000 and gid 2000. *v1.PodSecurityContext false

5286

## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/

5287

5288

securityContext:

5289

runAsGroup: 2000

5290

runAsNonRoot: true

5291

runAsUser: 1000

5292

fsGroup: 2000

5293

seccompProfile:

5294

type: RuntimeDefault

5295

## Use the host's user namespace for ThanosRuler pods.

5296

## ref: https://kubernetes.io/docs/tasks/configure-pod-container/user-namespaces/

5297

hostUsers: ~

5298

## ListenLocal makes the ThanosRuler server listen on loopback, so that it does not bind against the Pod IP.

5299

## Note this is only for the ThanosRuler UI, not the gossip communication.

5300

5301

listenLocal: false

5302

## Containers allows injecting additional containers. This is meant to allow adding an authentication proxy to an ThanosRuler pod.

5303

5304

containers: []

5305

## Additional environment variables to set on the ThanosRuler container.

5306

## This is rendered through the Prometheus Operator strategic merge patch.

5307

5308

extraEnv: []

5309

# - name: EXAMPLE

5310

# value: test

5311

5312

# Additional volumes on the output StatefulSet definition.

5313

volumes: []

5314

# Additional VolumeMounts on the output StatefulSet definition.

5315

volumeMounts: []

5316

## InitContainers allows injecting additional initContainers. This is meant to allow doing some changes

5317

## (permissions, dir tree) on mounted volumes before starting prometheus

5318

initContainers: []

5319

## Priority class assigned to the Pods

5320

5321

priorityClassName: ""

5322

## PortName to use for ThanosRuler.

5323

5324

portName: "web"

5325

## Scheduler to use for Pod scheduling, defaulting to the Kubernetes default scheduler.

5326

5327

schedulerName: ""

5328

## Duration in seconds the pod needs to terminate gracefully.

5329

## ref: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle/#pod-termination

5330

terminationGracePeriodSeconds: ~

5331

## WebTLSConfig defines the TLS parameters for HTTPS

5332

## ref: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api-reference/api.md#thanosrulerwebspec

5333

web: {}

5334

## Pod management policy. Kubernetes default is OrderedReady but prometheus-operator default is Parallel.

5335

## ref: https://kubernetes.io/docs/concepts/workloads/controllers/statefulset/#pod-management-policies

5336

podManagementPolicy: ""

5337

## Update strategy for the StatefulSet.

5338

## ref: https://kubernetes.io/docs/concepts/workloads/controllers/statefulset/#update-strategies

5339

updateStrategy: {}

5340

# type: RollingUpdate

5341

# rollingUpdate:

5342

# maxUnavailable: 1

5343

5344

## Version of Thanos Ruler to deploy. Overrides the version derived from the image tag when set.

5345

version: ""

5346

## Image pull policy for the Thanos Ruler container.

5347

imagePullPolicy: ""

5348

## EnableFeatures API enables access to Thanos Ruler disabled features.

5349

enableFeatures: []

5350

## EnableServiceLinks indicates whether information about services should be injected into the

5351

## pod's environment variables. Uses the operator/Kubernetes default when left unset (~).

5352

enableServiceLinks: ~

5353

## Minimum number of seconds for which a newly created pod should be ready without any of its

5354

## containers crashing/restarting for it to be considered available.

5355

minReadySeconds: ~

5356

## Defines the DNS configuration for the pods.

5357

dnsConfig: {}

5358

# nameservers:

5359

# - 1.2.3.4

5360

# searches:

5361

# - ns1.svc.cluster-domain.example

5362

# options:

5363

# - name: ndots

5364

# value: "2"

5365

5366

## Defines the DNS policy for the pods.

5367

dnsPolicy: ""

5368

## Pods' hostAliases configuration

5369

## ref: https://kubernetes.io/docs/concepts/services-networking/add-entries-to-pod-etc-hosts-with-host-aliases/

5370

hostAliases: []

5371

# - ip: 10.10.0.100

5372

# hostnames:

5373

# - a1.app.local

5374

5375

## Defines the list of remote write configurations. When not empty, the Thanos Ruler operates in stateless mode.

5376

## ref: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api-reference/api.md#monitoring.coreos.com/v1.RemoteWriteSpec

5377

remoteWrite: []

5378

## Configures tracing for Thanos Ruler. Maps to the tracing.config CLI argument.

5379

tracingConfig:

5380

# use existing secret, if configured, tracingConfig.secret will not be used

5381

existingSecret: {}

5382

# name: ""

5383

# key: ""

5384

# render tracingConfig secret data and configure it to be used by Thanos Ruler custom resource, ignored when tracingConfig.existingSecret is set

5385

secret: {}

5386

## Path to a tracing configuration file on disk (e.g. mounted through a volume). Takes precedence over tracingConfig.

5387

tracingConfigFile: ""

5388

## Configures alert relabeling for Thanos Ruler. Maps to the alert.relabel-config CLI argument.

5389

alertRelabelConfigs:

5390

# use existing secret, if configured, alertRelabelConfigs.secret will not be used

5391

existingSecret: {}

5392

# name: ""

5393

# key: ""

5394

# render alertRelabelConfigs secret data and configure it to be used by Thanos Ruler custom resource, ignored when alertRelabelConfigs.existingSecret is set

5395

secret: {}

5396

## Path to an alert relabel configuration file on disk. Takes precedence over alertRelabelConfigs.

5397

alertRelabelConfigFile: ""

5398

## Configures the gRPC server TLS for Thanos Ruler.

5399

## ref: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api-reference/api.md#monitoring.coreos.com/v1.TLSConfig

5400

grpcServerTlsConfig: {}

5401

## Path to an object storage configuration file on disk. Takes precedence over objectStorageConfig.

5402

objectStorageConfigFile: ""

5403

## Number of concurrent rule evaluations.

5404

ruleConcurrentEval: ~

5405

## Maximum time to tolerate outage for restoring "for" state of alert.

5406

ruleOutageTolerance: ""

5407

## Minimum duration between alert and restored "for" state. Maintained only for alerts with a configured "for"

5408

## time greater than the grace period.

5409

ruleGracePeriod: ""

5410

## The default rule group's query offset duration to shift the evaluation time of rules backwards.

5411

## ref: https://github.com/prometheus-community/helm-charts/issues/5843

5412

ruleQueryOffset: ""

5413

## Minimum amount of time to wait before resending an alert to Alertmanager.

5414

resendDelay: ""

5415

## EnforcedNamespaceLabel enforces adding a namespace label of origin for each alert and metric.

5416

enforcedNamespaceLabel: ""

5417

## List of references to PrometheusRule objects to be excluded from enforcement (requires enforcedNamespaceLabel).

5418

## Can be a list of objects, or a string that is passed through tpl.

5419

excludedFromEnforcement: []

5420

## Additional configuration which is not covered by the properties above. (passed through tpl)

5421

additionalConfig: {}

5422

## Additional configuration which is not covered by the properties above.

5423

## Useful, if you need advanced templating

5424

additionalConfigString: ""

5425

## ExtraSecret can be used to store various data in an extra secret

5426

## (use it for example to store hashed basic auth credentials)

5427

extraSecret:

5428

## if not set, name will be auto generated

5429

# name: ""

5430

annotations: {}

5431

data: {}

5432

# auth: |

5433

# foo:$apr1$OFG3Xybp$ckL0FHDAkoXYIlH9.cysT0

5434

# someoneelse:$apr1$DMZX2Z4q$6SbQIfyuLQd.xmo/P0m2c.

5435

## Setting to true produces cleaner resource names, but requires a data migration because the name of the persistent volume changes. Therefore this should only be set once on initial installation.

5436

5437

cleanPrometheusOperatorObjectNames: false

5438

## Extra manifests to deploy. Can be of type dict or list.

5439

## If dict, keys are ignored and only values are used.

5440

## Items contained within extraObjects can be defined as dict or string and are passed through tpl.

5441

extraManifests: null

5442

# - apiVersion: v1

5443

# kind: ConfigMap

5444

# metadata:

5445

# labels:

5446

# name: prometheus-extra

5447

# data:

5448

# extra-data: "value"

5449

5450

# can also be defined as a string, useful for templating field names

5451

# - |

5452

# apiVersion: v1

5453

# kind: Secret

5454

# type: Opaque

5455

# metadata:

5456

# name: super-secret

5457

# labels:

5458

# {{- range $key, $value := .Values.commonLabels }}

5459

# {{ $key }}: {{ $value }}

5460

# {{- end }}

5461

# data:

5462

# plaintext: Zm9vYmFy

5463

# templated: '{{ print "foobar" | upper | b64enc }}'

5464

The trusted source for open source

Talk to an expert

Privacy

Terms

© 2026 Chainguard, Inc. All Rights Reserved.
Chainguard® and the Chainguard logo are registered trademarks of Chainguard, Inc. in the United States and/or other countries.
The other respective trademarks mentioned on this page are owned by the respective companies and use of them does not imply any affiliation or endorsement.

kube-prometheus-stack

The trusted source for open source

Product

Solutions

Customers

Resources

Company