kube-prometheus-stack

Helm chart

Last changed

Request a free trial

Contact our team to test out this Helm chart and related images for free. Please also indicate any other images you would like to evaluate.

Tag:

# Default values for kube-prometheus-stack.

# This is a YAML-formatted file.

# Declare variables to be passed into your templates.

## Provide a name in place of kube-prometheus-stack for `app:` labels

nameOverride: ""

## Override the deployment namespace

namespaceOverride: ""

## Provide a k8s version to auto dashboard import script example: kubeTargetVersionOverride: 1.26.6

kubeTargetVersionOverride: ""

## Allow kubeVersion to be overridden while creating the ingress

kubeVersionOverride: ""

## Provide a name to substitute for the full names of resources

fullnameOverride: ""

## Labels to apply to all resources

commonLabels: {}

# scmhash: abc123

# myLabel: aakkmd

## Install Prometheus Operator CRDs

crds:

enabled: true

## The CRD upgrade job mitigates the limitation of helm not being able to upgrade CRDs.

## The job will apply the CRDs to the cluster before the operator is deployed, using helm hooks.

## It deploys a corresponding clusterrole, clusterrolebinding and serviceaccount to apply the CRDs.

## This feature is in preview, off by default and may change in the future.

upgradeJob:

enabled: false

forceConflicts: false

image:

busybox:

registry: cgr.dev

repository: scratch-images/test-tmp/busybox

tag: glibc-1.37.0-r61@sha256:4f399a5baa0b754857bd8ccd5878d7748ded9b25978eb760ea5d2f3e64ef36ab

sha: ""

pullPolicy: IfNotPresent

kubectl:

registry: cgr.dev

repository: scratch-images/test-tmp/kubectl

tag: 1.36.3-r1

sha: sha256:a56de917c0c555cd0bf7fccdd953ef26b87276392963b9562a483ed67e373901

pullPolicy: IfNotPresent

env: {}

## Define resources requests and limits for single Pods.

## ref: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/

resources: {}

## Additional volumes

extraVolumes: []

## Additional volume mounts

extraVolumeMounts: []

## Define which Nodes the Pods are scheduled on.

## ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#nodeselector

nodeSelector: {}

## Assign custom affinity rules to the upgrade-crd job

## ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/

affinity: {}

# nodeAffinity:

# requiredDuringSchedulingIgnoredDuringExecution:

# nodeSelectorTerms:

# - matchExpressions:

# - key: kubernetes.io/e2e-az-name

# operator: In

# values:

# - e2e-az1

# - e2e-az2

## If specified, the pod's tolerations.

## ref: https://kubernetes.io/docs/concepts/scheduling-eviction/taint-and-toleration/

tolerations: []

# - key: "key"

# operator: "Equal"

# value: "value"

# effect: "NoSchedule"

## If specified, the pod's topology spread constraints.

## ref: https://kubernetes.io/docs/concepts/scheduling-eviction/topology-spread-constraints/

topologySpreadConstraints: []

# - maxSkew: 1

# topologyKey: topology.kubernetes.io/zone

# whenUnsatisfiable: DoNotSchedule

# labelSelector:

# matchLabels:

# app: alertmanager

# ## Labels to add to the upgrade-crd job

100

# ##

101

labels: {}

102

## Annotations to add to the upgrade-crd job

103

104

annotations: {}

105

## Labels to add to the upgrade-crd pod

106

107

podLabels: {}

108

## Annotations to add to the upgrade-crd pod

109

110

podAnnotations: {}

111

## Service account for upgrade crd job to use.

112

## ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/

113

114

serviceAccount:

115

create: true

116

117

annotations: {}

118

labels: {}

119

automountServiceAccountToken: true

120

## Automounting API credentials for upgrade crd job pod.

121

122

automountServiceAccountToken: true

123

## Container-specific security context configuration

124

## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/

125

126

containerSecurityContext:

127

allowPrivilegeEscalation: false

128

readOnlyRootFilesystem: true

129

capabilities:

130

drop:

131

- ALL

132

## SecurityContext holds pod-level security attributes and common container settings.

133

## This defaults to non root user with uid 1000 and gid 2000. *v1.PodSecurityContext false

134

## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/

135

136

podSecurityContext:

137

fsGroup: 65534

138

runAsGroup: 65534

139

runAsNonRoot: true

140

runAsUser: 65534

141

seccompProfile:

142

type: RuntimeDefault

143

## Custom rules to override "for" and "severity" in defaultRules

144

145

customRules: {}

146

# AlertmanagerFailedReload:

147

# for: 3m

148

# AlertmanagerMembersInconsistent:

149

# for: 5m

150

# severity: "warning"

151

152

## Create default rules for monitoring the cluster

153

154

defaultRules:

155

create: true

156

rules:

157

alertmanager: true

158

etcd: true

159

configReloaders: true

160

general: true

161

k8sContainerCpuUsageSecondsTotal: true

162

k8sContainerMemoryCache: true

163

k8sContainerMemoryRss: true

164

k8sContainerMemorySwap: true

165

k8sContainerResource: true

166

k8sContainerMemoryWorkingSetBytes: true

167

k8sPodOwner: true

168

kubeApiserverAvailability: true

169

kubeApiserverBurnrate: true

170

kubeApiserverHistogram: true

171

kubeApiserverSlos: true

172

kubeControllerManager: true

173

kubelet: true

174

kubeProxy: true

175

kubePrometheusGeneral: true

176

kubePrometheusNodeRecording: true

177

kubernetesApps: true

178

kubernetesResources: true

179

kubernetesStorage: true

180

kubernetesSystem: true

181

kubeSchedulerAlerting: true

182

kubeSchedulerRecording: true

183

kubeStateMetrics: true

184

network: true

185

node: true

186

nodeExporterAlerting: true

187

nodeExporterRecording: true

188

prometheus: true

189

prometheusOperator: true

190

windows: true

191

# Defines the operator for namespace selection in rules

192

# Use "=~" to include namespaces matching the pattern (default)

193

# Use "!~" to exclude namespaces matching the pattern

194

appNamespacesOperator: "=~"

195

## Reduce app namespace alert scope

196

appNamespacesTarget: ".*"

197

## Set keep_firing_for for all alerts

198

keepFiringFor: ""

199

## Labels for default rules

200

labels: {}

201

## Annotations for default rules

202

annotations: {}

203

## Additional labels for PrometheusRule alerts

204

additionalRuleLabels: {}

205

## Additional annotations for specific PrometheusRule alerts by alert name

206

additionalRuleAnnotations: {}

207

## Additional labels for specific PrometheusRule alert groups

208

additionalRuleGroupLabels:

209

alertmanager: {}

210

etcd: {}

211

configReloaders: {}

212

general: {}

213

k8sContainerCpuUsageSecondsTotal: {}

214

k8sContainerMemoryCache: {}

215

k8sContainerMemoryRss: {}

216

k8sContainerMemorySwap: {}

217

k8sContainerResource: {}

218

k8sPodOwner: {}

219

kubeApiserverAvailability: {}

220

kubeApiserverBurnrate: {}

221

kubeApiserverHistogram: {}

222

kubeApiserverSlos: {}

223

kubeControllerManager: {}

224

kubelet: {}

225

kubeProxy: {}

226

kubePrometheusGeneral: {}

227

kubePrometheusNodeRecording: {}

228

kubernetesApps: {}

229

kubernetesResources: {}

230

kubernetesStorage: {}

231

kubernetesSystem: {}

232

kubeSchedulerAlerting: {}

233

kubeSchedulerRecording: {}

234

kubeStateMetrics: {}

235

network: {}

236

node: {}

237

nodeExporterAlerting: {}

238

nodeExporterRecording: {}

239

prometheus: {}

240

prometheusOperator: {}

241

## Additional annotations for specific PrometheusRule alert groups

242

additionalRuleGroupAnnotations:

243

alertmanager: {}

244

etcd: {}

245

configReloaders: {}

246

general: {}

247

k8sContainerCpuUsageSecondsTotal: {}

248

k8sContainerMemoryCache: {}

249

k8sContainerMemoryRss: {}

250

k8sContainerMemorySwap: {}

251

k8sContainerResource: {}

252

k8sPodOwner: {}

253

kubeApiserverAvailability: {}

254

kubeApiserverBurnrate: {}

255

kubeApiserverHistogram: {}

256

kubeApiserverSlos: {}

257

kubeControllerManager: {}

258

kubelet: {}

259

kubeProxy: {}

260

kubePrometheusGeneral: {}

261

kubePrometheusNodeRecording: {}

262

kubernetesApps: {}

263

kubernetesResources: {}

264

kubernetesStorage: {}

265

kubernetesSystem: {}

266

kubeSchedulerAlerting: {}

267

kubeSchedulerRecording: {}

268

kubeStateMetrics: {}

269

network: {}

270

node: {}

271

nodeExporterAlerting: {}

272

nodeExporterRecording: {}

273

prometheus: {}

274

prometheusOperator: {}

275

additionalAggregationLabels: []

276

## Prefix for runbook URLs. Use this to override the first part of the runbookURLs that is common to all rules.

277

runbookUrl: "https://runbooks.prometheus-operator.dev/runbooks"

278

## Thresholds for kubelet certificate expiration alerts (in seconds)

279

kubeletServerCertificateExpiration:

280

warning: 604800 # 7 days

281

critical: 86400 # 1 day

282

kubeletClientCertificateExpiration:

283

warning: 604800 # 7 days

284

critical: 86400 # 1 day

285

node:

286

fsSelector: 'fstype!=""'

287

# fsSelector: 'fstype=~"ext[234]|btrfs|xfs|zfs"'

288

## Disabled PrometheusRule alerts

289

disabled: {}

290

# KubeAPIDown: true

291

# NodeRAIDDegraded: true

292

## Deprecated way to provide custom recording or alerting rules to be deployed into the cluster.

293

294

# additionalPrometheusRules: []

295

# - name: my-rule-file

296

# groups:

297

# - name: my_group

298

# rules:

299

# - record: my_record

300

# expr: 100 * my_record

301

302

## Provide custom recording or alerting rules to be deployed into the cluster.

303

304

additionalPrometheusRulesMap: {}

305

# rule-name:

306

# groups:

307

# - name: my_group

308

# rules:

309

# - record: my_record

310

# expr: 100 * my_record

311

312

313

global:

314

rbac:

315

create: true

316

## Create ClusterRoles that extend the existing view, edit and admin ClusterRoles to interact with prometheus-operator CRDs

317

## Ref: https://kubernetes.io/docs/reference/access-authn-authz/rbac/#aggregated-clusterroles

318

createAggregateClusterRoles: false

319

## Global image registry to use if it needs to be overridden for some specific use cases (e.g. local registries, custom images, ...)

320

321

imageRegistry: ""

322

## Reference to one or more secrets to be used when pulling images

323

## ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/

324

325

imagePullSecrets: []

326

# - name: "image-pull-secret"

327

# or

328

# - "image-pull-secret"

329

windowsMonitoring:

330

## Deploys the windows-exporter and Windows-specific dashboards and rules (job name must be 'windows-exporter')

331

enabled: false

332

## Configuration for prometheus-windows-exporter

333

## ref: https://github.com/prometheus-community/helm-charts/tree/main/charts/prometheus-windows-exporter

334

335

prometheus-windows-exporter:

336

## Enable ServiceMonitor and set Kubernetes label to use as a job label

337

338

prometheus:

339

monitor:

340

enabled: true

341

jobLabel: jobLabel

342

releaseLabel: true

343

## Set job label to 'windows-exporter' as required by the default Prometheus rules and Grafana dashboards

344

345

podLabels:

346

jobLabel: windows-exporter

347

## Enable memory and container metrics as required by the default Prometheus rules and Grafana dashboards

348

349

config: |-

350

collectors:

351

enabled: '[defaults],memory,container'

352

## Configuration for alertmanager

353

## ref: https://prometheus.io/docs/alerting/alertmanager/

354

355

alertmanager:

356

## Deploy alertmanager

357

358

enabled: true

359

# Optional: Override the namespace where Alertmanager will be deployed.

360

namespaceOverride: ""

361

## Annotations for Alertmanager

362

363

annotations: {}

364

## Additional labels for Alertmanager

365

366

additionalLabels: {}

367

## API that Prometheus will use to communicate with alertmanager. Possible values are v1, v2

368

369

apiVersion: v2

370

## @param alertmanager.enableFeatures Enable access to Alertmanager disabled features.

371

372

enableFeatures: []

373

## Create dashboard configmap even if alertmanager deployment has been disabled

374

375

forceDeployDashboards: false

376

## Network Policy configuration

377

378

networkPolicy:

379

# -- Enable network policy for Alertmanager

380

enabled: false

381

# -- Define policy types. If egress is enabled, both Ingress and Egress will be used

382

# Valid values are ["Ingress"] or ["Ingress", "Egress"]

383

384

policyTypes:

385

- Ingress

386

# -- Gateway (formerly ingress controller) configuration

387

388

gateway:

389

# -- Gateway namespace

390

391

namespace: ""

392

# -- Gateway pod labels

393

394

podLabels: {}

395

# app.kubernetes.io/name: ingress-nginx

396

# -- Additional custom ingress rules

397

398

additionalIngress: []

399

# - from:

400

# - namespaceSelector:

401

# matchLabels:

402

# name: another-namespace

403

# podSelector:

404

# matchLabels:

405

# app: another-app

406

# - from:

407

# - podSelector:

408

# matchLabels:

409

# app.kubernetes.io/name: loki

410

# ports:

411

# - port: 9093

412

# protocol: TCP

413

414

# -- Configure egress rules

415

416

egress:

417

# -- Enable egress rules. When enabled, policyTypes will include Egress

418

419

enabled: false

420

# -- Custom egress rules

421

422

rules: []

423

# - to:

424

# - namespaceSelector: {}

425

# podSelector:

426

# matchLabels:

427

# name: smtp-relay

428

# ports:

429

# - port: 25

430

# protocol: TCP

431

# -- Enable rules for alertmanager cluster traffic

432

433

enableClusterRules: true

434

# -- Configure monitoring component rules

435

436

monitoringRules:

437

# -- Enable ingress from Prometheus

438

439

prometheus: true

440

# -- Enable ingress for config reloader metrics

441

442

configReloader: true

443

## Service account for Alertmanager to use.

444

## ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/

445

446

serviceAccount:

447

create: true

448

449

annotations: {}

450

automountServiceAccountToken: true

451

## Configure pod disruption budgets for Alertmanager

452

## ref: https://kubernetes.io/docs/tasks/run-application/configure-pdb/#specifying-a-poddisruptionbudget

453

454

podDisruptionBudget:

455

enabled: false

456

minAvailable: 1

457

# maxUnavailable: ""

458

unhealthyPodEvictionPolicy: AlwaysAllow

459

## Enable vertical pod autoscaler support for Alertmanager

460

## ref: https://github.com/kubernetes/autoscaler/tree/master/vertical-pod-autoscaler

461

462

verticalPodAutoscaler:

463

enabled: false

464

# Recommender responsible for generating recommendation for the object.

465

# List should be empty (then the default recommender will generate the recommendation)

466

# or contain exactly one recommender.

467

# recommenders:

468

# - name: custom-recommender-performance

469

470

# List of resources that the vertical pod autoscaler can control. Defaults to cpu and memory

471

controlledResources: []

472

# Specifies which resource values should be controlled: RequestsOnly or RequestsAndLimits.

473

# controlledValues: RequestsAndLimits

474

475

# Define the max allowed resources for the pod

476

maxAllowed: {}

477

# cpu: 200m

478

# memory: 100Mi

479

# Define the min allowed resources for the pod

480

minAllowed: {}

481

# cpu: 200m

482

# memory: 100Mi

483

484

updatePolicy:

485

# Specifies whether recommended updates are applied when a Pod is started and whether recommended updates

486

# are applied during the life of a Pod. Possible values are "Off", "Initial", "Recreate", and "InPlaceOrRecreate".

487

updateMode: Recreate

488

## Alertmanager configuration directives

489

## ref: https://prometheus.io/docs/alerting/configuration/#configuration-file

490

## https://prometheus.io/webtools/alerting/routing-tree-editor/

491

492

config:

493

global:

494

resolve_timeout: 5m

495

inhibit_rules:

496

- source_matchers:

497

- 'severity = critical'

498

target_matchers:

499

- 'severity =~ warning|info'

500

equal:

501

- 'namespace'

502

- 'alertname'

503

- source_matchers:

504

- 'severity = warning'

505

target_matchers:

506

- 'severity = info'

507

equal:

508

- 'namespace'

509

- 'alertname'

510

- source_matchers:

511

- 'alertname = InfoInhibitor'

512

target_matchers:

513

- 'severity = info'

514

equal:

515

- 'namespace'

516

- target_matchers:

517

- 'alertname = InfoInhibitor'

518

route:

519

group_by: ['namespace']

520

group_wait: 30s

521

group_interval: 5m

522

repeat_interval: 12h

523

receiver: 'null'

524

routes:

525

- receiver: 'null'

526

matchers:

527

- alertname = "Watchdog"

528

receivers:

529

- name: 'null'

530

templates:

531

- '/etc/alertmanager/config/*.tmpl'

532

## Alertmanager configuration directives (as string type, preferred over the config hash map)

533

## stringConfig will be used only if tplConfig is true

534

## ref: https://prometheus.io/docs/alerting/configuration/#configuration-file

535

## https://prometheus.io/webtools/alerting/routing-tree-editor/

536

537

stringConfig: ""

538

## Pass the Alertmanager configuration directives through Helm's templating

539

## engine. If the Alertmanager configuration contains Alertmanager templates,

540

## they'll need to be properly escaped so that they are not interpreted by

541

## Helm

542

## ref: https://helm.sh/docs/developing_charts/#using-the-tpl-function

543

## https://prometheus.io/docs/alerting/configuration/#tmpl_string

544

## https://prometheus.io/docs/alerting/notifications/

545

## https://prometheus.io/docs/alerting/notification_examples/

546

tplConfig: false

547

## Alertmanager template files to format alerts

548

## By default, templateFiles are placed in /etc/alertmanager/config/ and if

549

## they have a .tmpl file suffix will be loaded. See config.templates above

550

## to change, add other suffixes. If adding other suffixes, be sure to update

551

## config.templates above to include those suffixes.

552

## ref: https://prometheus.io/docs/alerting/notifications/

553

## https://prometheus.io/docs/alerting/notification_examples/

554

555

templateFiles: {}

556

557

## An example template:

558

# template_1.tmpl: |-

559

# {{ define "cluster" }}{{ .ExternalURL | reReplaceAll ".*alertmanager\\.(.*)" "$1" }}{{ end }}

560

561

# {{ define "slack.myorg.text" }}

562

# {{- $root := . -}}

563

# {{ range .Alerts }}

564

# *Alert:* {{ .Annotations.summary }} - `{{ .Labels.severity }}`

565

# *Cluster:* {{ template "cluster" $root }}

566

# *Description:* {{ .Annotations.description }}

567

# *Graph:* <{{ .GeneratorURL }}|:chart_with_upwards_trend:>

568

# *Runbook:* <{{ .Annotations.runbook }}|:spiral_note_pad:>

569

# *Details:*

570

# {{ range .Labels.SortedPairs }} - *{{ .Name }}:* `{{ .Value }}`

571

# {{ end }}

572

# {{ end }}

573

# {{ end }}

574

575

ingress:

576

enabled: false

577

ingressClassName: ""

578

annotations: {}

579

labels: {}

580

## Override ingress to a different defined port on the service

581

# servicePort: 8081

582

## Override ingress to a different service then the default, this is useful if you need to

583

## point to a specific instance of the alertmanager (eg kube-prometheus-stack-alertmanager-0)

584

# serviceName: kube-prometheus-stack-alertmanager-0

585

586

## Hosts must be provided if Ingress is enabled.

587

588

hosts: []

589

# - alertmanager.domain.com

590

591

## Paths to use for ingress rules - one path should match the alertmanagerSpec.routePrefix

592

593

paths: []

594

# - /

595

596

## For Kubernetes >= 1.18 you should specify the pathType (determines how Ingress paths should be matched)

597

## See https://kubernetes.io/blog/2020/04/02/improvements-to-the-ingress-api-in-kubernetes-1.18/#better-path-matching-with-path-types

598

# pathType: ImplementationSpecific

599

600

## TLS configuration for Alertmanager Ingress

601

## Secret must be manually created in the namespace

602

603

tls: []

604

# - secretName: alertmanager-general-tls

605

# hosts:

606

# - alertmanager.example.com

607

# -- BETA: Configure the gateway routes for the chart here.

608

# More routes can be added by adding a dictionary key like the 'main' route.

609

# Be aware that this is an early beta of this feature,

610

# kube-prometheus-stack does not guarantee this works and is subject to change.

611

# Being BETA this can/will change in the future without notice, do not use unless you want to take that risk

612

# [[ref]](https://gateway-api.sigs.k8s.io/reference/spec/#gateway.networking.k8s.io%2fv1alpha2)

613

route:

614

main:

615

# -- Enables or disables the route

616

enabled: false

617

# -- Set the route apiVersion, e.g. gateway.networking.k8s.io/v1 or gateway.networking.k8s.io/v1alpha2

618

apiVersion: gateway.networking.k8s.io/v1

619

# -- Set the route kind

620

# Valid options are GRPCRoute, HTTPRoute, TCPRoute, TLSRoute, UDPRoute

621

kind: HTTPRoute

622

annotations: {}

623

labels: {}

624

hostnames: []

625

# - my-filter.example.com

626

parentRefs: []

627

# - name: acme-gw

628

629

# -- create http route for redirect (https://gateway-api.sigs.k8s.io/guides/http-redirect-rewrite/#http-to-https-redirects)

630

## Take care that you only enable this on the http listener of the gateway to avoid an infinite redirect.

631

## matches, filters and additionalRules will be ignored if this is set to true. Be are

632

httpsRedirect: false

633

matches:

634

- path:

635

type: PathPrefix

636

value: /

637

## Filters define the filters that are applied to requests that match this rule.

638

filters: []

639

## Session persistence configuration for the route rule.

640

sessionPersistence: {}

641

# sessionName: route

642

# type: Cookie

643

# absoluteTimeout: 12h

644

# cookieConfig:

645

# lifetimeType: Permanent

646

647

## Additional custom rules that can be added to the route

648

additionalRules: []

649

## Configuration for Alertmanager secret

650

651

secret:

652

annotations: {}

653

## Configuration for creating an Ingress that will map to each Alertmanager replica service

654

## alertmanager.servicePerReplica must be enabled

655

656

ingressPerReplica:

657

enabled: false

658

ingressClassName: ""

659

annotations: {}

660

labels: {}

661

## Final form of the hostname for each per replica ingress is

662

## {{ ingressPerReplica.hostPrefix }}-{{ $replicaNumber }}.{{ ingressPerReplica.hostDomain }}

663

664

## Prefix for the per replica ingress that will have `-$replicaNumber`

665

## appended to the end

666

hostPrefix: ""

667

## Domain that will be used for the per replica ingress

668

hostDomain: ""

669

## Paths to use for ingress rules

670

671

paths: []

672

# - /

673

674

## For Kubernetes >= 1.18 you should specify the pathType (determines how Ingress paths should be matched)

675

## See https://kubernetes.io/blog/2020/04/02/improvements-to-the-ingress-api-in-kubernetes-1.18/#better-path-matching-with-path-types

676

# pathType: ImplementationSpecific

677

678

## Secret name containing the TLS certificate for alertmanager per replica ingress

679

## Secret must be manually created in the namespace

680

tlsSecretName: ""

681

## Separated secret for each per replica Ingress. Can be used together with cert-manager

682

683

tlsSecretPerReplica:

684

enabled: false

685

## Final form of the secret for each per replica ingress is

686

## {{ tlsSecretPerReplica.prefix }}-{{ $replicaNumber }}

687

688

prefix: "alertmanager"

689

## Configuration for creating a Gateway API route that will map to each Alertmanager replica service

690

## alertmanager.servicePerReplica must be enabled

691

692

routePerReplica:

693

main:

694

# -- Enables or disables the routePerReplica

695

enabled: false

696

# -- Set the route apiVersion, e.g. gateway.networking.k8s.io/v1 or gateway.networking.k8s.io/v1alpha2

697

apiVersion: gateway.networking.k8s.io/v1

698

# -- Set the route kind

699

# Valid options are GRPCRoute, HTTPRoute, TCPRoute, TLSRoute, UDPRoute

700

kind: HTTPRoute

701

annotations: {}

702

labels: {}

703

## Final form of the hostname for each per replica route is

704

## {{ routePerReplica.hostPrefix }}-{{ $replicaNumber }}.{{ routePerReplica.hostDomain }}

705

706

## Prefix for the per replica route that will have `-$replicaNumber` appended to the end

707

hostPrefix: ""

708

## Domain that will be used for the per replica route

709

hostDomain: ""

710

parentRefs: []

711

# - name: acme-gw

712

713

# -- create http route for redirect (https://gateway-api.sigs.k8s.io/guides/http-redirect-rewrite/#http-to-https-redirects)

714

## Take care that you only enable this on the http listener of the gateway to avoid an infinite redirect.

715

## matches, filters and additionalRules will be ignored if this is set to true.

716

httpsRedirect: false

717

## Filters define the filters that are applied to requests that match this rule.

718

filters: []

719

matches:

720

- path:

721

type: PathPrefix

722

value: /

723

## Session persistence configuration for the route rule.

724

sessionPersistence: {}

725

# sessionName: route

726

# type: Cookie

727

# absoluteTimeout: 12h

728

# cookieConfig:

729

# lifetimeType: Permanent

730

731

## Additional custom rules that can be added to the route

732

additionalRules: []

733

## Configuration for Alertmanager service

734

735

service:

736

enabled: true

737

annotations: {}

738

labels: {}

739

clusterIP: ""

740

ipDualStack:

741

enabled: false

742

ipFamilies: ["IPv6", "IPv4"]

743

ipFamilyPolicy: "PreferDualStack"

744

## Port for Alertmanager Service to listen on

745

746

port: 9093

747

## Port for Alertmanager cluster communication

748

749

# clusterPort: 9094

750

## To be used with a proxy extraContainer port

751

752

targetPort: 9093

753

## Port to expose on each node

754

## Only used if service.type is 'NodePort'

755

756

nodePort: 30903

757

## List of IP addresses at which the Prometheus server service is available

758

## Ref: https://kubernetes.io/docs/concepts/services-networking/service/#external-ips

759

760

761

## Additional ports to open for Alertmanager service

762

763

additionalPorts: []

764

# - name: oauth-proxy

765

# port: 8081

766

# targetPort: 8081

767

# - name: oauth-metrics

768

# port: 8082

769

# targetPort: 8082

770

771

externalIPs: []

772

loadBalancerIP: ""

773

loadBalancerSourceRanges: []

774

## Denotes if this Service desires to route external traffic to node-local or cluster-wide endpoints

775

776

externalTrafficPolicy: Cluster

777

## If you want to make sure that connections from a particular client are passed to the same Pod each time

778

## Accepts 'ClientIP' or 'None'

779

780

sessionAffinity: None

781

## If you want to modify the ClientIP sessionAffinity timeout

782

## The value must be >0 && <=86400(for 1 day) if ServiceAffinity == "ClientIP"

783

784

sessionAffinityConfig:

785

clientIP:

786

timeoutSeconds: 10800

787

## Service type

788

789

type: ClusterIP

790

## Configuration for creating a separate Service for each statefulset Alertmanager replica

791

792

servicePerReplica:

793

enabled: false

794

annotations: {}

795

## Port for Alertmanager Service per replica to listen on

796

797

port: 9093

798

## To be used with a proxy extraContainer port

799

targetPort: 9093

800

## Port to expose on each node

801

## Only used if servicePerReplica.type is 'NodePort'

802

803

nodePort: 30904

804

## Loadbalancer source IP ranges

805

## Only used if servicePerReplica.type is "LoadBalancer"

806

loadBalancerSourceRanges: []

807

## Denotes if this Service desires to route external traffic to node-local or cluster-wide endpoints

808

809

externalTrafficPolicy: Cluster

810

## Service type

811

812

type: ClusterIP

813

## Configuration for creating a ServiceMonitor for AlertManager

814

815

serviceMonitor:

816

## If true, a ServiceMonitor will be created for the AlertManager service.

817

818

selfMonitor: true

819

## Scrape interval. If not set, the Prometheus default scrape interval is used.

820

821

interval: ""

822

## Additional labels

823

824

additionalLabels: {}

825

## SampleLimit defines per-scrape limit on number of scraped samples that will be accepted.

826

827

sampleLimit: 0

828

## TargetLimit defines a limit on the number of scraped targets that will be accepted.

829

830

targetLimit: 0

831

## Per-scrape limit on number of labels that will be accepted for a sample. Only valid in Prometheus versions 2.27.0 and newer.

832

833

labelLimit: 0

834

## Per-scrape limit on length of labels name that will be accepted for a sample. Only valid in Prometheus versions 2.27.0 and newer.

835

836

labelNameLengthLimit: 0

837

## Per-scrape limit on length of labels value that will be accepted for a sample. Only valid in Prometheus versions 2.27.0 and newer.

838

839

labelValueLengthLimit: 0

840

## proxyUrl: URL of a proxy that should be used for scraping.

841

842

proxyUrl: ""

843

## scheme: HTTP scheme to use for scraping. Can be used with `tlsConfig` for example if using istio mTLS.

844

scheme: ""

845

## enableHttp2: Whether to enable HTTP2.

846

## See https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api-reference/api.md#endpoint

847

enableHttp2: true

848

## tlsConfig: TLS configuration to use when scraping the endpoint. For example if using istio mTLS.

849

## Of type: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api-reference/api.md#tlsconfig

850

tlsConfig: {}

851

bearerTokenFile:

852

## MetricRelabelConfigs to apply to samples after scraping, but before ingestion.

853

## ref: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api-reference/api.md#relabelconfig

854

855

metricRelabelings: []

856

# - action: keep

857

858

# sourceLabels: [__name__]

859

860

## RelabelConfigs to apply to samples before scraping

861

## ref: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api-reference/api.md#relabelconfig

862

863

relabelings: []

864

# - sourceLabels: [__meta_kubernetes_pod_node_name]

865

# separator: ;

866

# regex: ^(.*)$

867

# targetLabel: nodename

868

# replacement: $1

869

# action: replace

870

871

## Additional Endpoints

872

873

additionalEndpoints: []

874

# - port: oauth-metrics

875

# path: /metrics

876

## Settings affecting alertmanagerSpec

877

## ref: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api-reference/api.md#alertmanagerspec

878

879

alertmanagerSpec:

880

## Statefulset's persistent volume claim retention policy

881

## whenDeleted and whenScaled determine whether

882

## statefulset's PVCs are deleted (true) or retained (false)

883

## on scaling down and deleting statefulset, respectively.

884

## Requires Kubernetes version 1.27.0+.

885

## Ref: https://kubernetes.io/docs/concepts/workloads/controllers/statefulset/#persistentvolumeclaim-retention

886

persistentVolumeClaimRetentionPolicy: {}

887

# whenDeleted: Retain

888

# whenScaled: Retain

889

890

## Standard object's metadata. More info: https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#metadata

891

## Metadata Labels and Annotations gets propagated to the Alertmanager pods.

892

893

podMetadata: {}

894

895

serviceName:

896

## Image of Alertmanager

897

898

image:

899

registry: cgr.dev

900

repository: scratch-images/test-tmp/prometheus-alertmanager

901

tag: 0.33.1-r4

902

sha: sha256:139891c51c212ac5aa962ab4dacf4064bc6c24c7be43ef0357f0a089da01f027

903

pullPolicy: IfNotPresent

904

## If true then the user will be responsible to provide a secret with alertmanager configuration

905

## So when true the config part will be ignored (including templateFiles) and the one in the secret will be used

906

907

useExistingSecret: false

908

## Secrets is a list of Secrets in the same namespace as the Alertmanager object, which shall be mounted into the

909

## Alertmanager Pods. The Secrets are mounted into /etc/alertmanager/secrets/.

910

911

secrets: []

912

## If false then the user will opt out of automounting API credentials.

913

914

automountServiceAccountToken: true

915

## ConfigMaps is a list of ConfigMaps in the same namespace as the Alertmanager object, which shall be mounted into the Alertmanager Pods.

916

## The ConfigMaps are mounted into /etc/alertmanager/configmaps/.

917

918

configMaps: []

919

## ConfigSecret is the name of a Kubernetes Secret in the same namespace as the Alertmanager object, which contains configuration for

920

## this Alertmanager instance. Defaults to 'alertmanager-' The secret is mounted into /etc/alertmanager/config.

921

922

# configSecret:

923

924

## WebTLSConfig defines the TLS parameters for HTTPS

925

## ref: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api-reference/api.md#alertmanagerwebspec

926

web: {}

927

## AlertmanagerConfigs to be selected to merge and configure Alertmanager with.

928

929

alertmanagerConfigSelector: {}

930

## Example which selects all alertmanagerConfig resources

931

## with label "alertconfig" with values any of "example-config" or "example-config-2"

932

# alertmanagerConfigSelector:

933

# matchExpressions:

934

# - key: alertconfig

935

# operator: In

936

# values:

937

# - example-config

938

# - example-config-2

939

940

## Example which selects all alertmanagerConfig resources with label "role" set to "example-config"

941

# alertmanagerConfigSelector:

942

# matchLabels:

943

# role: example-config

944

945

## Namespaces to be selected for AlertmanagerConfig discovery. If nil, only check own namespace.

946

947

alertmanagerConfigNamespaceSelector: {}

948

## Example which selects all namespaces

949

## with label "alertmanagerconfig" with values any of "example-namespace" or "example-namespace-2"

950

# alertmanagerConfigNamespaceSelector:

951

# matchExpressions:

952

# - key: alertmanagerconfig

953

# operator: In

954

# values:

955

# - example-namespace

956

# - example-namespace-2

957

958

## Example which selects all namespaces with label "alertmanagerconfig" set to "enabled"

959

# alertmanagerConfigNamespaceSelector:

960

# matchLabels:

961

# alertmanagerconfig: enabled

962

963

## AlermanagerConfig to be used as top level configuration

964

965

alertmanagerConfiguration: {}

966

## Example with select a global alertmanagerconfig

967

# alertmanagerConfiguration:

968

# name: global-alertmanager-Configuration

969

970

## Defines the strategy used by AlertmanagerConfig objects to match alerts. eg:

971

972

alertmanagerConfigMatcherStrategy: {}

973

## Example with use OnNamespace strategy

974

# alertmanagerConfigMatcherStrategy:

975

# type: OnNamespace

976

977

## Additional command line arguments to pass to Alertmanager (in addition to those generated by the chart)

978

additionalArgs: []

979

## Define Log Format

980

# Use logfmt (default) or json logging

981

logFormat: logfmt

982

## Log level for Alertmanager to be configured with.

983

984

logLevel: info

985

## Size is the expected size of the alertmanager cluster. The controller will eventually make the size of the

986

## running cluster equal to the expected size.

987

replicas: 1

988

## Time duration Alertmanager shall retain data for. Default is '120h', and must match the regular expression

989

## [0-9]+(ms|s|m|h) (milliseconds seconds minutes hours).

990

991

retention: 120h

992

## Storage is the definition of how storage will be used by the Alertmanager instances.

993

## ref: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/platform/storage.md

994

995

storage: {}

996

# volumeClaimTemplate:

997

# spec:

998

# storageClassName: gluster

999

# accessModes: ["ReadWriteOnce"]

1000

# resources:

1001

# requests:

1002

# storage: 50Gi

1003

# selector: {}

1004

1005

## The external URL the Alertmanager instances will be available under. This is necessary to generate correct URLs. This is necessary if Alertmanager is not served from root of a DNS name. string false

1006

1007

externalUrl:

1008

## The route prefix Alertmanager registers HTTP handlers for. This is useful, if using ExternalURL and a proxy is rewriting HTTP routes of a request, and the actual ExternalURL is still true,

1009

## but the server serves requests under a different route prefix. For example for use with kubectl proxy.

1010

1011

routePrefix: /

1012

## scheme: HTTP scheme to use. Can be used with `tlsConfig` for example if using istio mTLS.

1013

scheme: ""

1014

## tlsConfig: TLS configuration to use when connect to the endpoint. For example if using istio mTLS.

1015

## Of type: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api-reference/api.md#tlsconfig

1016

tlsConfig: {}

1017

## If set to true all actions on the underlying managed objects are not going to be performed, except for delete actions.

1018

1019

paused: false

1020

## Define which Nodes the Pods are scheduled on.

1021

## ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#nodeselector

1022

1023

nodeSelector: {}

1024

## Define resources requests and limits for single Pods.

1025

## ref: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/

1026

1027

resources: {}

1028

# requests:

1029

# memory: 400Mi

1030

1031

## Pod anti-affinity can prevent the scheduler from placing Prometheus replicas on the same node.

1032

## The default value "soft" means that the scheduler should *prefer* to not schedule two replica pods onto the same node but no guarantee is provided.

1033

## The value "hard" means that the scheduler is *required* to not schedule two replica pods onto the same node.

1034

## The value "" will disable pod anti-affinity so that no anti-affinity rules will be configured.

1035

1036

podAntiAffinity: "soft"

1037

## If anti-affinity is enabled sets the topologyKey to use for anti-affinity.

1038

## This can be changed to, for example, failure-domain.beta.kubernetes.io/zone

1039

1040

podAntiAffinityTopologyKey: kubernetes.io/hostname

1041

## Assign custom affinity rules to the alertmanager instance

1042

## ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/

1043

1044

affinity: {}

1045

# nodeAffinity:

1046

# requiredDuringSchedulingIgnoredDuringExecution:

1047

# nodeSelectorTerms:

1048

# - matchExpressions:

1049

# - key: kubernetes.io/e2e-az-name

1050

# operator: In

1051

# values:

1052

# - e2e-az1

1053

# - e2e-az2

1054

1055

## If specified, the pod's tolerations.

1056

## ref: https://kubernetes.io/docs/concepts/scheduling-eviction/taint-and-toleration/

1057

1058

tolerations: []

1059

# - key: "key"

1060

# operator: "Equal"

1061

# value: "value"

1062

# effect: "NoSchedule"

1063

1064

## If specified, the pod's topology spread constraints.

1065

## ref: https://kubernetes.io/docs/concepts/scheduling-eviction/topology-spread-constraints/

1066

1067

topologySpreadConstraints: []

1068

# - maxSkew: 1

1069

# topologyKey: topology.kubernetes.io/zone

1070

# whenUnsatisfiable: DoNotSchedule

1071

# labelSelector:

1072

# matchLabels:

1073

# app: alertmanager

1074

1075

## SecurityContext holds pod-level security attributes and common container settings.

1076

## This defaults to non root user with uid 1000 and gid 2000. *v1.PodSecurityContext false

1077

## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/

1078

1079

securityContext:

1080

runAsGroup: 2000

1081

runAsNonRoot: true

1082

runAsUser: 1000

1083

fsGroup: 2000

1084

seccompProfile:

1085

type: RuntimeDefault

1086

## Use the host's user namespace for Alertmanager pods.

1087

## ref: https://kubernetes.io/docs/tasks/configure-pod-container/user-namespaces/

1088

hostUsers: ~

1089

## DNS configuration for Alertmanager.

1090

## ref: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api-reference/api.md#monitoring.coreos.com/v1.PodDNSConfig

1091

dnsConfig: {}

1092

## DNS policy for Alertmanager.

1093

## ref: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api-reference/api.md#dnspolicystring-alias

1094

dnsPolicy: ""

1095

## Enable hostNetwork for Alertmanager.

1096

hostNetwork: false

1097

## ListenLocal makes the Alertmanager server listen on loopback, so that it does not bind against the Pod IP.

1098

## Note this is only for the Alertmanager UI, not the gossip communication.

1099

1100

listenLocal: false

1101

## Containers allows injecting additional containers. This is meant to allow adding an authentication proxy to an Alertmanager pod.

1102

1103

containers: []

1104

# containers:

1105

# - name: oauth-proxy

1106

# image: quay.io/oauth2-proxy/oauth2-proxy:v7.15.3

1107

# args:

1108

# - --upstream=http://127.0.0.1:9093

1109

# - --http-address=0.0.0.0:8081

1110

# - --metrics-address=0.0.0.0:8082

1111

# - ...

1112

# ports:

1113

# - containerPort: 8081

1114

# name: oauth-proxy

1115

# protocol: TCP

1116

# - containerPort: 8082

1117

# name: oauth-metrics

1118

# protocol: TCP

1119

# resources: {}

1120

1121

# Additional volumes on the output StatefulSet definition.

1122

volumes: []

1123

# Additional VolumeMounts on the output StatefulSet definition.

1124

volumeMounts: []

1125

## InitContainers allows injecting additional initContainers. This is meant to allow doing some changes

1126

## (permissions, dir tree) on mounted volumes before starting prometheus

1127

initContainers: []

1128

## Priority class assigned to the Pods

1129

1130

priorityClassName: ""

1131

## AdditionalPeers allows injecting a set of additional Alertmanagers to peer with to form a highly available cluster.

1132

1133

additionalPeers: []

1134

## PortName to use for Alert Manager.

1135

1136

portName: "http-web"

1137

## ClusterAdvertiseAddress is the explicit address to advertise in cluster. Needs to be provided for non RFC1918 [1] (public) addresses. [1] RFC1918: https://tools.ietf.org/html/rfc1918

1138

1139

clusterAdvertiseAddress: false

1140

## clusterGossipInterval determines interval between gossip attempts.

1141

## Needs to be specified as GoDuration, a time duration that can be parsed by Go's time.ParseDuration() (e.g. 45ms, 30s, 1m, 1h20m15s)

1142

clusterGossipInterval: ""

1143

## clusterPeerTimeout determines timeout for cluster peering.

1144

## Needs to be specified as GoDuration, a time duration that can be parsed by Go's time.ParseDuration() (e.g. 45ms, 30s, 1m, 1h20m15s)

1145

clusterPeerTimeout: ""

1146

## clusterPushpullInterval determines interval between pushpull attempts.

1147

## Needs to be specified as GoDuration, a time duration that can be parsed by Go's time.ParseDuration() (e.g. 45ms, 30s, 1m, 1h20m15s)

1148

clusterPushpullInterval: ""

1149

## clusterLabel defines the identifier that uniquely identifies the Alertmanager cluster.

1150

clusterLabel: ""

1151

## ForceEnableClusterMode ensures Alertmanager does not deactivate the cluster mode when running with a single replica.

1152

## Use case is e.g. spanning an Alertmanager cluster across Kubernetes clusters with a single replica in each.

1153

forceEnableClusterMode: false

1154

## Minimum number of seconds for which a newly created pod should be ready without any of its container crashing for it to

1155

## be considered available. Defaults to 0 (pod will be considered available as soon as it is ready).

1156

minReadySeconds: 0

1157

## Pod management policy. Kubernetes default is OrderedReady but prometheus-operator default is Parallel.

1158

## ref: https://kubernetes.io/docs/concepts/workloads/controllers/statefulset/#pod-management-policies

1159

podManagementPolicy: ""

1160

## Update strategy for the StatefulSet.

1161

## ref: https://kubernetes.io/docs/concepts/workloads/controllers/statefulset/#update-strategies

1162

updateStrategy: {}

1163

# type: RollingUpdate

1164

# rollingUpdate:

1165

# maxUnavailable: 1

1166

1167

## Duration in seconds the pod needs to terminate gracefully.

1168

## ref: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle/#pod-termination

1169

terminationGracePeriodSeconds: ~

1170

## EnableServiceLinks indicates whether information about services should be injected into the

1171

## pod's environment variables. Uses the operator/Kubernetes default when left unset (~).

1172

enableServiceLinks: ~

1173

## Set the scheduler name to use for the Alertmanager pods.

1174

schedulerName: ""

1175

## Pods' hostAliases configuration

1176

## ref: https://kubernetes.io/docs/concepts/services-networking/add-entries-to-pod-etc-hosts-with-host-aliases/

1177

hostAliases: []

1178

# - ip: 10.10.0.100

1179

# hostnames:

1180

# - a1.app.local

1181

1182

## Limits defines the Alertmanager limits command line flags. Requires Alertmanager >= v0.28.0.

1183

## ref: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api-reference/api.md#monitoring.coreos.com/v1.AlertmanagerLimitsSpec

1184

limits: {}

1185

# maxSilences: 1000

1186

# maxPerSilenceBytes: 1MB

1187

1188

## ClusterTLS defines the mutual TLS configuration for the Alertmanager cluster's gossip protocol.

1189

## Requires Alertmanager >= v0.24.0.

1190

## ref: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api-reference/api.md#monitoring.coreos.com/v1.ClusterTLSConfig

1191

clusterTLS: {}

1192

## Additional configuration which is not covered by the properties above. (passed through tpl)

1193

additionalConfig: {}

1194

## Additional configuration which is not covered by the properties above.

1195

## Useful, if you need advanced templating inside alertmanagerSpec.

1196

## Otherwise, use alertmanager.alertmanagerSpec.additionalConfig (passed through tpl)

1197

additionalConfigString: ""

1198

## ExtraSecret can be used to store various data in an extra secret

1199

## (use it for example to store hashed basic auth credentials)

1200

extraSecret:

1201

## if not set, name will be auto generated

1202

# name: ""

1203

annotations: {}

1204

data: {}

1205

# auth: |

1206

# foo:$apr1$OFG3Xybp$ckL0FHDAkoXYIlH9.cysT0

1207

# someoneelse:$apr1$DMZX2Z4q$6SbQIfyuLQd.xmo/P0m2c.

1208

## Using default values from https://github.com/grafana-community/helm-charts/blob/main/charts/grafana/values.yaml

1209

1210

grafana:

1211

enabled: true

1212

namespaceOverride: ""

1213

## ForceDeployDatasources Create datasource configmap even if grafana deployment has been disabled

1214

1215

forceDeployDatasources: false

1216

## ForceDeployDashboard Create dashboard configmap even if grafana deployment has been disabled

1217

1218

forceDeployDashboards: false

1219

## Deploy default dashboards

1220

1221

defaultDashboardsEnabled: true

1222

## Deploy GrafanaDashboard CRDs that reference dashboards from ConfigMaps when grafana-operator is used

1223

## These settings control how dashboards are integrated with the Grafana Operator

1224

## Note: End user still need to create is own kind: GrafanaDataSource for Prometheus

1225

## eg:

1226

## apiVersion: grafana.integreatly.org/v1beta1

1227

## kind: GrafanaDatasource

1228

## metadata:

1229

## name: prometheus

1230

## annotations: {}

1231

## spec:

1232

## allowCrossNamespaceImport: true

1233

## instanceSelector:

1234

## matchLabels:

1235

## app: grafana

1236

## datasource:

1237

## name: prometheus

1238

## type: prometheus

1239

## access: proxy

1240

## url: http://prometheus-operated.prometheus-stack.svc.cluster.local:9090

1241

## isDefault: true

1242

## jsonData:

1243

## "tlsSkipVerify": true

1244

## "timeInterval": "5s"

1245

1246

operator:

1247

## Enable references to ConfigMaps containing dashboards in GrafanaDashboard CRs

1248

## Set to true to allow dashboards to be loaded from ConfigMap references

1249

dashboardsConfigMapRefEnabled: false

1250

## Annotations for GrafanaDashboard Cr

1251

1252

annotations: {}

1253

## Labels that should be matched kind: Grafana instance

1254

## Example: { app: grafana, category: dashboard }

1255

1256

matchLabels: {}

1257

## How frequently the operator should resync resources (in duration format)

1258

## Controls how often dashboards are reconciled by the operator

1259

1260

resyncPeriod: 10m

1261

## Which folder contains all dashboards in Grafana

1262

## This folder will be created on the Root level

1263

## Only one of 'folder', 'folderUID' or 'folderRef' can be set

1264

1265

folder: General

1266

## Which UID of the target folder contains all dashboards in Grafana

1267

## This allows you to use subfolder hierarchy

1268

## Only one of 'folder', 'folderUID' or 'folderRef' can be set

1269

1270

folderUID: null

1271

## Which GrafanaFolder reference contains all dashboards in Grafana

1272

## This allows you to use subfolder hierarchy.

1273

## Only one of 'folder', 'folderUID' or 'folderRef' can be set

1274

1275

folderRef: null

1276

## Timezone for the default dashboards

1277

## Other options are: browser or a specific timezone, i.e. Europe/Luxembourg

1278

1279

defaultDashboardsTimezone: utc

1280

## Editable flag for the default dashboards

1281

1282

defaultDashboardsEditable: true

1283

## Default interval for Grafana dashboards

1284

1285

defaultDashboardsInterval: 1m

1286

# Administrator credentials when not using an existing secret (see below)

1287

adminUser: admin

1288

# adminPassword: strongpassword

1289

1290

# Use an existing secret for the admin user.

1291

admin:

1292

## Name of the secret. Can be templated.

1293

existingSecret: ""

1294

userKey: admin-user

1295

passwordKey: admin-password

1296

rbac:

1297

## If true, Grafana PSPs will be created

1298

1299

pspEnabled: false

1300

ingress:

1301

## If true, Grafana Ingress will be created

1302

1303

enabled: false

1304

## IngressClassName for Grafana Ingress.

1305

## Should be provided if Ingress is enable.

1306

1307

# ingressClassName: nginx

1308

1309

## Annotations for Grafana Ingress

1310

1311

annotations: {}

1312

# kubernetes.io/ingress.class: nginx

1313

# kubernetes.io/tls-acme: "true"

1314

1315

## Labels to be added to the Ingress

1316

1317

labels: {}

1318

## Hostnames.

1319

## Must be provided if Ingress is enable.

1320

1321

# hosts:

1322

# - grafana.domain.com

1323

hosts: []

1324

## Path for grafana ingress

1325

path: /

1326

## TLS configuration for grafana Ingress

1327

## Secret must be manually created in the namespace

1328

1329

tls: []

1330

# - secretName: grafana-general-tls

1331

# hosts:

1332

# - grafana.example.com

1333

# # To make Grafana persistent (Using Statefulset)

1334

# #

1335

# persistence:

1336

# enabled: true

1337

# type: sts

1338

# storageClassName: "storageClassName"

1339

# accessModes:

1340

# - ReadWriteOnce

1341

# size: 20Gi

1342

# finalizers:

1343

# - kubernetes.io/pvc-protection

1344

serviceAccount:

1345

create: true

1346

autoMount: true

1347

sidecar:

1348

dashboards:

1349

enabled: true

1350

label: grafana_dashboard

1351

labelValue: "1"

1352

# Allow discovery in all namespaces for dashboards

1353

searchNamespace: ALL

1354

# Support for new table panels, when enabled grafana auto migrates the old table panels to newer table panels

1355

enableNewTablePanelSyntax: false

1356

## Annotations for Grafana dashboard configmaps

1357

1358

annotations: {}

1359

multicluster:

1360

global:

1361

enabled: false

1362

etcd:

1363

enabled: false

1364

provider:

1365

allowUiUpdates: false

1366

datasources:

1367

enabled: true

1368

defaultDatasourceEnabled: true

1369

isDefaultDatasource: true

1370

1371

uid: prometheus

1372

## Extra jsonData properties to add to the datasource

1373

# extraJsonData:

1374

# prometheusType: Prometheus

1375

1376

## URL of prometheus datasource

1377

1378

# url: http://prometheus-stack-prometheus:9090/

1379

1380

## Prometheus request timeout in seconds

1381

# timeout: 30

1382

1383

## Query parameters to add, as a URL-encoded string,

1384

## to query Prometheus

1385

# customQueryParameters: ""

1386

1387

# If not defined, will use prometheus.prometheusSpec.scrapeInterval or its default

1388

# defaultDatasourceScrapeInterval: 15s

1389

1390

## Annotations for Grafana datasource configmaps

1391

1392

annotations: {}

1393

## Set method for HTTP to send query to datasource

1394

httpMethod: POST

1395

## Create datasource for each Pod of Prometheus StatefulSet;

1396

## this uses by default the headless service `prometheus-operated` which is

1397

## created by Prometheus Operator. In case you deployed your own Service for your

1398

## Prometheus instance, you can specify it with the field `prometheusServiceName`

1399

## ref: https://github.com/prometheus-operator/prometheus-operator/blob/0fee93e12dc7c2ea1218f19ae25ec6b893460590/pkg/prometheus/statefulset.go#L255-L286

1400

createPrometheusReplicasDatasources: false

1401

prometheusServiceName: prometheus-operated

1402

label: grafana_datasource

1403

labelValue: "1"

1404

## Field with internal link pointing to existing data source in Grafana.

1405

## Can be provisioned via additionalDataSources

1406

exemplarTraceIdDestinations: {}

1407

# datasourceUid: Jaeger

1408

# traceIdLabelName: trace_id

1409

# urlDisplayLabel: View traces

1410

alertmanager:

1411

enabled: true

1412

1413

uid: alertmanager

1414

handleGrafanaManagedAlerts: false

1415

implementation: prometheus

1416

extraConfigmapMounts: []

1417

# - name: certs-configmap

1418

# mountPath: /etc/grafana/ssl/

1419

# configMap: certs-configmap

1420

# readOnly: true

1421

1422

deleteDatasources: []

1423

# - name: example-datasource

1424

# orgId: 1

1425

1426

## Configure additional grafana datasources (passed through tpl)

1427

## ref: https://grafana.com/docs/grafana/latest/administration/provisioning/#datasources

1428

additionalDataSources: []

1429

# - name: prometheus-sample

1430

# access: proxy

1431

# basicAuth: true

1432

# secureJsonData:

1433

# basicAuthPassword: pass

1434

# basicAuthUser: daco

1435

# editable: false

1436

# jsonData:

1437

# tlsSkipVerify: true

1438

# orgId: 1

1439

# type: prometheus

1440

# url: https://{{ printf "%s-prometheus.svc" .Release.Name }}:9090

1441

# version: 1

1442

1443

## Configure additional grafana datasources as a templated string (passed through tpl)

1444

## Useful when you need Helm flow control or templating inside the datasource definition

1445

additionalDataSourcesString: ""

1446

# Flag to mark provisioned data sources for deletion if they are no longer configured.

1447

# It takes no effect if data sources are already listed in the deleteDatasources section.

1448

# ref: https://grafana.com/docs/grafana/latest/administration/provisioning/#example-data-source-configuration-file

1449

prune: false

1450

## Passed to grafana subchart and used by servicemonitor below

1451

1452

service:

1453

portName: http-web

1454

ipFamilies: []

1455

ipFamilyPolicy: ""

1456

serviceMonitor:

1457

# If true, a ServiceMonitor CRD is created for a prometheus operator

1458

# https://github.com/prometheus-operator/prometheus-operator

1459

1460

enabled: true

1461

# Path to use for scraping metrics. Might be different if server.root_url is set

1462

# in grafana.ini

1463

# path: /metrics

1464

1465

# namespace: monitoring (defaults to use the namespace this chart is deployed to)

1466

1467

# labels for the ServiceMonitor

1468

# labels: {}

1469

1470

# Extra scrape settings.

1471

# interval: ""

1472

# scheme: http

1473

# tlsConfig: {}

1474

# scrapeTimeout: 30s

1475

1476

## RelabelConfigs to apply to samples before scraping

1477

## ref: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api-reference/api.md#relabelconfig

1478

1479

# relabelings: []

1480

# - sourceLabels: [__meta_kubernetes_pod_node_name]

1481

# separator: ;

1482

# regex: ^(.*)$

1483

# targetLabel: nodename

1484

# replacement: $1

1485

# action: replace

1486

## Flag to disable all the kubernetes component scrapers

1487

1488

kubernetesServiceMonitors:

1489

enabled: true

1490

## Component scraping the kube api server

1491

1492

kubeApiServer:

1493

enabled: true

1494

tlsConfig:

1495

serverName: kubernetes

1496

insecureSkipVerify: false

1497

serviceMonitor:

1498

enabled: true

1499

## Scrape interval. If not set, the Prometheus default scrape interval is used.

1500

1501

interval: ""

1502

## SampleLimit defines per-scrape limit on number of scraped samples that will be accepted.

1503

1504

sampleLimit: 0

1505

## TargetLimit defines a limit on the number of scraped targets that will be accepted.

1506

1507

targetLimit: 0

1508

## Per-scrape limit on number of labels that will be accepted for a sample. Only valid in Prometheus versions 2.27.0 and newer.

1509

1510

labelLimit: 0

1511

## Per-scrape limit on length of labels name that will be accepted for a sample. Only valid in Prometheus versions 2.27.0 and newer.

1512

1513

labelNameLengthLimit: 0

1514

## Per-scrape limit on length of labels value that will be accepted for a sample. Only valid in Prometheus versions 2.27.0 and newer.

1515

1516

labelValueLengthLimit: 0

1517

## proxyUrl: URL of a proxy that should be used for scraping.

1518

1519

proxyUrl: ""

1520

jobLabel: component

1521

selector:

1522

matchLabels:

1523

component: apiserver

1524

provider: kubernetes

1525

## MetricRelabelConfigs to apply to samples after scraping, but before ingestion.

1526

## ref: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api-reference/api.md#relabelconfig

1527

1528

metricRelabelings:

1529

# Drop excessively noisy apiserver buckets.

1530

- action: drop

1531

regex: (etcd_request|apiserver_request_slo|apiserver_request_sli|apiserver_request)_duration_seconds_bucket;(0\.15|0\.2|0\.3|0\.35|0\.4|0\.45|0\.6|0\.7|0\.8|0\.9|1\.25|1\.5|1\.75|2|3|3\.5|4|4\.5|6|7|8|9|15|20|40|45|50)(\.0)?

1532

sourceLabels:

1533

- __name__

1534

- le

1535

# - action: keep

1536

1537

# sourceLabels: [__name__]

1538

1539

## RelabelConfigs to apply to samples before scraping

1540

## ref: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api-reference/api.md#relabelconfig

1541

1542

relabelings: []

1543

# - sourceLabels:

1544

# - __meta_kubernetes_namespace

1545

# - __meta_kubernetes_service_name

1546

# - __meta_kubernetes_endpoint_port_name

1547

# action: keep

1548

# regex: default;kubernetes;https

1549

# - targetLabel: __address__

1550

# replacement: kubernetes.default.svc:443

1551

1552

## Additional labels

1553

1554

additionalLabels: {}

1555

# foo: bar

1556

1557

## defines the labels which are transferred from the associated Kubernetes Service object onto the ingested metrics.

1558

## https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api-reference/api.md#servicemonitor

1559

targetLabels: []

1560

## Override the job label used for the apiserver.

1561

## This allows users who scrape apiserver metrics under a different job name (e.g. k3s-server via PushProx)

1562

## to align the recording rules and alerts with their actual job label.

1563

jobNameOverride: ""

1564

## Component scraping the kubelet and kubelet-hosted cAdvisor

1565

1566

kubelet:

1567

enabled: true

1568

namespace: kube-system

1569

# Overrides the job selector in Grafana dashboards and Prometheus rules

1570

# For k3s clusters, change to k3s-server

1571

jobNameOverride: ""

1572

serviceMonitor:

1573

enabled: true

1574

## Enable scraping /metrics from kubelet's service

1575

kubelet: true

1576

## Attach metadata to discovered targets. Requires Prometheus v2.45 for endpoints created by the operator.

1577

1578

attachMetadata:

1579

node: false

1580

## Scrape interval. If not set, the Prometheus default scrape interval is used.

1581

1582

interval: ""

1583

## If true, Prometheus use (respect) labels provided by exporter.

1584

1585

honorLabels: true

1586

## If true, Prometheus ingests metrics with timestamp provided by exporter. If false, Prometheus ingests metrics with timestamp of scrape.

1587

1588

honorTimestamps: true

1589

## If true, defines whether Prometheus tracks staleness of the metrics that have an explicit timestamp present in scraped data. Has no effect if `honorTimestamps` is false.

1590

## We recommend enabling this if you want the best possible accuracy for container_ metrics scraped from cadvisor.

1591

## For more details see: https://github.com/prometheus-community/helm-charts/pull/5063#issuecomment-2545374849

1592

trackTimestampsStaleness: true

1593

## SampleLimit defines per-scrape limit on number of scraped samples that will be accepted.

1594

1595

sampleLimit: 0

1596

## TargetLimit defines a limit on the number of scraped targets that will be accepted.

1597

1598

targetLimit: 0

1599

## Per-scrape limit on number of labels that will be accepted for a sample. Only valid in Prometheus versions 2.27.0 and newer.

1600

1601

labelLimit: 0

1602

## Per-scrape limit on length of labels name that will be accepted for a sample. Only valid in Prometheus versions 2.27.0 and newer.

1603

1604

labelNameLengthLimit: 0

1605

## Per-scrape limit on length of labels value that will be accepted for a sample. Only valid in Prometheus versions 2.27.0 and newer.

1606

1607

labelValueLengthLimit: 0

1608

## proxyUrl: URL of a proxy that should be used for scraping.

1609

1610

proxyUrl: ""

1611

## Enable scraping the kubelet over https. For requirements to enable this see

1612

## https://github.com/prometheus-operator/prometheus-operator/issues/926

1613

1614

https: true

1615

## Skip TLS certificate validation when scraping.

1616

## This is enabled by default because kubelet serving certificate deployed by kubeadm is by default self-signed

1617

## ref: https://kubernetes.io/docs/tasks/administer-cluster/kubeadm/kubeadm-certs/#kubelet-serving-certs

1618

1619

insecureSkipVerify: true

1620

## Enable scraping /metrics/probes from kubelet's service

1621

1622

probes: true

1623

## Enable scraping /metrics/resource from kubelet's service

1624

## This is disabled by default because container metrics are already exposed by cAdvisor

1625

1626

resource: false

1627

# From kubernetes 1.18, /metrics/resource/v1alpha1 renamed to /metrics/resource

1628

resourcePath: "/metrics/resource/v1alpha1"

1629

## Configure the scrape interval for resource metrics. This is configured to the default Kubelet cAdvisor

1630

## minimum housekeeping interval in order to avoid missing samples. Note, this value is ignored

1631

## if kubelet.serviceMonitor.interval is not empty.

1632

resourceInterval: 10s

1633

## Enable scraping /metrics/cadvisor from kubelet's service

1634

1635

cAdvisor: true

1636

## Configure the scrape interval for cAdvisor. This is configured to the default Kubelet cAdvisor

1637

## minimum housekeeping interval in order to avoid missing samples. Note, this value is ignored

1638

## if kubelet.serviceMonitor.interval is not empty.

1639

cAdvisorInterval: 10s

1640

## MetricRelabelConfigs to apply to samples after scraping, but before ingestion.

1641

## ref: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api-reference/api.md#relabelconfig

1642

1643

cAdvisorMetricRelabelings:

1644

# Drop less useful container CPU metrics.

1645

- sourceLabels: [__name__]

1646

action: drop

1647

regex: 'container_cpu_(cfs_throttled_seconds_total|load_average_10s|system_seconds_total|user_seconds_total)'

1648

# Drop less useful container / always zero filesystem metrics.

1649

- sourceLabels: [__name__]

1650

action: drop

1651

1652

# Drop less useful / always zero container memory metrics.

1653

- sourceLabels: [__name__]

1654

action: drop

1655

regex: 'container_memory_(mapped_file|swap)'

1656

# Drop less useful container process metrics.

1657

- sourceLabels: [__name__]

1658

action: drop

1659

regex: 'container_(file_descriptors|tasks_state|threads_max)'

1660

# Drop container_memory_failures_total{scope="hierarchy"} metrics,

1661

# we only need the container scope.

1662

- sourceLabels: [__name__, scope]

1663

action: drop

1664

regex: 'container_memory_failures_total;hierarchy'

1665

# Drop container_network_... metrics that match various interfaces that

1666

# correspond to CNI and similar interfaces. This avoids capturing network

1667

# metrics for host network containers.

1668

- sourceLabels: [__name__, interface]

1669

action: drop

1670

1671

# Drop container spec metrics that overlap with kube-state-metrics.

1672

- sourceLabels: [__name__]

1673

action: drop

1674

regex: 'container_spec.*'

1675

# Drop cgroup metrics with no pod.

1676

- sourceLabels: [id, pod]

1677

action: drop

1678

regex: '.+;'

1679

# - sourceLabels: [__name__, image]

1680

# separator: ;

1681

# regex: container_([a-z_]+);

1682

# replacement: $1

1683

# action: drop

1684

# - sourceLabels: [__name__]

1685

# separator: ;

1686

# regex: container_(network_tcp_usage_total|network_udp_usage_total|tasks_state|cpu_load_average_10s)

1687

# replacement: $1

1688

# action: drop

1689

1690

## MetricRelabelConfigs to apply to samples after scraping, but before ingestion.

1691

## ref: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api-reference/api.md#relabelconfig

1692

1693

probesMetricRelabelings: []

1694

# - sourceLabels: [__name__, image]

1695

# separator: ;

1696

# regex: container_([a-z_]+);

1697

# replacement: $1

1698

# action: drop

1699

# - sourceLabels: [__name__]

1700

# separator: ;

1701

# regex: container_(network_tcp_usage_total|network_udp_usage_total|tasks_state|cpu_load_average_10s)

1702

# replacement: $1

1703

# action: drop

1704

1705

## RelabelConfigs to apply to samples before scraping

1706

## ref: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api-reference/api.md#relabelconfig

1707

1708

## metrics_path is required to match upstream rules and charts

1709

cAdvisorRelabelings:

1710

- action: replace

1711

sourceLabels: [__metrics_path__]

1712

targetLabel: metrics_path

1713

# - sourceLabels: [__meta_kubernetes_pod_node_name]

1714

# separator: ;

1715

# regex: ^(.*)$

1716

# targetLabel: nodename

1717

# replacement: $1

1718

# action: replace

1719

1720

## RelabelConfigs to apply to samples before scraping

1721

## ref: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api-reference/api.md#relabelconfig

1722

1723

probesRelabelings:

1724

- action: replace

1725

sourceLabels: [__metrics_path__]

1726

targetLabel: metrics_path

1727

# - sourceLabels: [__meta_kubernetes_pod_node_name]

1728

# separator: ;

1729

# regex: ^(.*)$

1730

# targetLabel: nodename

1731

# replacement: $1

1732

# action: replace

1733

1734

## RelabelConfigs to apply to samples before scraping

1735

## ref: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api-reference/api.md#relabelconfig

1736

1737

resourceRelabelings:

1738

- action: replace

1739

sourceLabels: [__metrics_path__]

1740

targetLabel: metrics_path

1741

# - sourceLabels: [__meta_kubernetes_pod_node_name]

1742

# separator: ;

1743

# regex: ^(.*)$

1744

# targetLabel: nodename

1745

# replacement: $1

1746

# action: replace

1747

1748

## MetricRelabelConfigs to apply to samples after scraping, but before ingestion.

1749

## ref: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api-reference/api.md#relabelconfig

1750

1751

metricRelabelings:

1752

# Reduce bucket cardinality of kubelet storage operations.

1753

- action: drop

1754

sourceLabels: [__name__, le]

1755

regex: (csi_operations|storage_operation_duration)_seconds_bucket;(0.25|2.5|15|25|120|600)(\.0)?

1756

# - sourceLabels: [__name__, image]

1757

# separator: ;

1758

# regex: container_([a-z_]+);

1759

# replacement: $1

1760

# action: drop

1761

# - sourceLabels: [__name__]

1762

# separator: ;

1763

# regex: container_(network_tcp_usage_total|network_udp_usage_total|tasks_state|cpu_load_average_10s)

1764

# replacement: $1

1765

# action: drop

1766

1767

## RelabelConfigs to apply to samples before scraping

1768

## ref: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api-reference/api.md#relabelconfig

1769

1770

## metrics_path is required to match upstream rules and charts

1771

relabelings:

1772

- action: replace

1773

sourceLabels: [__metrics_path__]

1774

targetLabel: metrics_path

1775

# - sourceLabels: [__meta_kubernetes_pod_node_name]

1776

# separator: ;

1777

# regex: ^(.*)$

1778

# targetLabel: nodename

1779

# replacement: $1

1780

# action: replace

1781

1782

## Additional labels

1783

1784

additionalLabels: {}

1785

# foo: bar

1786

1787

## defines the labels which are transferred from the associated Kubernetes Service object onto the ingested metrics.

1788

## https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api-reference/api.md#servicemonitor

1789

targetLabels: []

1790

## Component scraping the kube controller manager

1791

1792

kubeControllerManager:

1793

enabled: true

1794

# Overrides the job selector in Grafana dashboards and Prometheus rules

1795

# For k3s clusters, change to k3s-server

1796

jobNameOverride: ""

1797

## If your kube controller manager is not deployed as a pod, specify IPs it can be found on

1798

1799

endpoints: []

1800

# - 10.141.4.22

1801

# - 10.141.4.23

1802

# - 10.141.4.24

1803

1804

## If using kubeControllerManager.endpoints only the port and targetPort are used

1805

1806

service:

1807

enabled: true

1808

## If null or unset, the value is determined dynamically based on target Kubernetes version due to change

1809

## of default port in Kubernetes 1.22.

1810

1811

port: null

1812

targetPort: null

1813

ipDualStack:

1814

enabled: false

1815

ipFamilies: ["IPv6", "IPv4"]

1816

ipFamilyPolicy: "PreferDualStack"

1817

# selector:

1818

# component: kube-controller-manager

1819

serviceMonitor:

1820

enabled: true

1821

## Scrape interval. If not set, the Prometheus default scrape interval is used.

1822

1823

interval: ""

1824

## SampleLimit defines per-scrape limit on number of scraped samples that will be accepted.

1825

1826

sampleLimit: 0

1827

## TargetLimit defines a limit on the number of scraped targets that will be accepted.

1828

1829

targetLimit: 0

1830

## Per-scrape limit on number of labels that will be accepted for a sample. Only valid in Prometheus versions 2.27.0 and newer.

1831

1832

labelLimit: 0

1833

## Per-scrape limit on length of labels name that will be accepted for a sample. Only valid in Prometheus versions 2.27.0 and newer.

1834

1835

labelNameLengthLimit: 0

1836

## Per-scrape limit on length of labels value that will be accepted for a sample. Only valid in Prometheus versions 2.27.0 and newer.

1837

1838

labelValueLengthLimit: 0

1839

## proxyUrl: URL of a proxy that should be used for scraping.

1840

1841

proxyUrl: ""

1842

## port: Name of the port the metrics will be scraped from

1843

1844

port: http-metrics

1845

jobLabel: jobLabel

1846

selector: {}

1847

# matchLabels:

1848

# component: kube-controller-manager

1849

1850

## Enable scraping kube-controller-manager over https.

1851

## Requires proper certs (not self-signed) and delegated authentication/authorization checks.

1852

## If null or unset, the value is determined dynamically based on target Kubernetes version.

1853

1854

https: null

1855

# Skip TLS certificate validation when scraping

1856

insecureSkipVerify: null

1857

# Name of the server to use when validating TLS certificate

1858

serverName: null

1859

## MetricRelabelConfigs to apply to samples after scraping, but before ingestion.

1860

## ref: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api-reference/api.md#relabelconfig

1861

1862

metricRelabelings: []

1863

# - action: keep

1864

1865

# sourceLabels: [__name__]

1866

1867

## RelabelConfigs to apply to samples before scraping

1868

## ref: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api-reference/api.md#relabelconfig

1869

1870

relabelings: []

1871

# - sourceLabels: [__meta_kubernetes_pod_node_name]

1872

# separator: ;

1873

# regex: ^(.*)$

1874

# targetLabel: nodename

1875

# replacement: $1

1876

# action: replace

1877

1878

## Additional labels

1879

1880

additionalLabels: {}

1881

# foo: bar

1882

1883

## defines the labels which are transferred from the associated Kubernetes Service object onto the ingested metrics.

1884

## https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api-reference/api.md#servicemonitor

1885

targetLabels: []

1886

## Component scraping coreDns. Use either this or kubeDns

1887

1888

coreDns:

1889

enabled: true

1890

service:

1891

enabled: true

1892

port: 9153

1893

targetPort: 9153

1894

ipDualStack:

1895

enabled: false

1896

ipFamilies: ["IPv6", "IPv4"]

1897

ipFamilyPolicy: "PreferDualStack"

1898

# selector:

1899

# k8s-app: kube-dns

1900

serviceMonitor:

1901

enabled: true

1902

## Scrape interval. If not set, the Prometheus default scrape interval is used.

1903

1904

interval: ""

1905

## SampleLimit defines per-scrape limit on number of scraped samples that will be accepted.

1906

1907

sampleLimit: 0

1908

## TargetLimit defines a limit on the number of scraped targets that will be accepted.

1909

1910

targetLimit: 0

1911

## Per-scrape limit on number of labels that will be accepted for a sample. Only valid in Prometheus versions 2.27.0 and newer.

1912

1913

labelLimit: 0

1914

## Per-scrape limit on length of labels name that will be accepted for a sample. Only valid in Prometheus versions 2.27.0 and newer.

1915

1916

labelNameLengthLimit: 0

1917

## Per-scrape limit on length of labels value that will be accepted for a sample. Only valid in Prometheus versions 2.27.0 and newer.

1918

1919

labelValueLengthLimit: 0

1920

## proxyUrl: URL of a proxy that should be used for scraping.

1921

1922

proxyUrl: ""

1923

## port: Name of the port the metrics will be scraped from

1924

1925

port: http-metrics

1926

jobLabel: jobLabel

1927

selector: {}

1928

# matchLabels:

1929

# k8s-app: kube-dns

1930

1931

## MetricRelabelConfigs to apply to samples after scraping, but before ingestion.

1932

## ref: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api-reference/api.md#relabelconfig

1933

1934

metricRelabelings: []

1935

# - action: keep

1936

1937

# sourceLabels: [__name__]

1938

1939

## RelabelConfigs to apply to samples before scraping

1940

## ref: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api-reference/api.md#relabelconfig

1941

1942

relabelings: []

1943

# - sourceLabels: [__meta_kubernetes_pod_node_name]

1944

# separator: ;

1945

# regex: ^(.*)$

1946

# targetLabel: nodename

1947

# replacement: $1

1948

# action: replace

1949

1950

## Additional labels

1951

1952

additionalLabels: {}

1953

# foo: bar

1954

1955

## defines the labels which are transferred from the associated Kubernetes Service object onto the ingested metrics.

1956

## https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api-reference/api.md#servicemonitor

1957

targetLabels: []

1958

## File containing bearer token to be used when scraping targets

1959

## Empty value do not send any bearer token.

1960

1961

bearerTokenFile: /var/run/secrets/kubernetes.io/serviceaccount/token

1962

## Component scraping kubeDns. Use either this or coreDns

1963

1964

kubeDns:

1965

enabled: false

1966

service:

1967

dnsmasq:

1968

port: 10054

1969

targetPort: 10054

1970

skydns:

1971

port: 10055

1972

targetPort: 10055

1973

ipDualStack:

1974

enabled: false

1975

ipFamilies: ["IPv6", "IPv4"]

1976

ipFamilyPolicy: "PreferDualStack"

1977

# selector:

1978

# k8s-app: kube-dns

1979

serviceMonitor:

1980

## Scrape interval. If not set, the Prometheus default scrape interval is used.

1981

1982

interval: ""

1983

## SampleLimit defines per-scrape limit on number of scraped samples that will be accepted.

1984

1985

sampleLimit: 0

1986

## TargetLimit defines a limit on the number of scraped targets that will be accepted.

1987

1988

targetLimit: 0

1989

## Per-scrape limit on number of labels that will be accepted for a sample. Only valid in Prometheus versions 2.27.0 and newer.

1990

1991

labelLimit: 0

1992

## Per-scrape limit on length of labels name that will be accepted for a sample. Only valid in Prometheus versions 2.27.0 and newer.

1993

1994

labelNameLengthLimit: 0

1995

## Per-scrape limit on length of labels value that will be accepted for a sample. Only valid in Prometheus versions 2.27.0 and newer.

1996

1997

labelValueLengthLimit: 0

1998

## proxyUrl: URL of a proxy that should be used for scraping.

1999

2000

proxyUrl: ""

2001

jobLabel: jobLabel

2002

selector: {}

2003

# matchLabels:

2004

# k8s-app: kube-dns

2005

2006

## MetricRelabelConfigs to apply to samples after scraping, but before ingestion.

2007

## ref: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api-reference/api.md#relabelconfig

2008

2009

metricRelabelings: []

2010

# - action: keep

2011

2012

# sourceLabels: [__name__]

2013

2014

## RelabelConfigs to apply to samples before scraping

2015

## ref: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api-reference/api.md#relabelconfig

2016

2017

relabelings: []

2018

# - sourceLabels: [__meta_kubernetes_pod_node_name]

2019

# separator: ;

2020

# regex: ^(.*)$

2021

# targetLabel: nodename

2022

# replacement: $1

2023

# action: replace

2024

2025

## MetricRelabelConfigs to apply to samples after scraping, but before ingestion.

2026

## ref: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api-reference/api.md#relabelconfig

2027

2028

dnsmasqMetricRelabelings: []

2029

# - action: keep

2030

2031

# sourceLabels: [__name__]

2032

2033

## RelabelConfigs to apply to samples before scraping

2034

## ref: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api-reference/api.md#relabelconfig

2035

2036

dnsmasqRelabelings: []

2037

# - sourceLabels: [__meta_kubernetes_pod_node_name]

2038

# separator: ;

2039

# regex: ^(.*)$

2040

# targetLabel: nodename

2041

# replacement: $1

2042

# action: replace

2043

2044

## Additional labels

2045

2046

additionalLabels: {}

2047

# foo: bar

2048

2049

## defines the labels which are transferred from the associated Kubernetes Service object onto the ingested metrics.

2050

## https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api-reference/api.md#servicemonitor

2051

targetLabels: []

2052

## File containing bearer token to be used when scraping targets

2053

## Empty value do not send any bearer token.

2054

2055

bearerTokenFile: /var/run/secrets/kubernetes.io/serviceaccount/token

2056

## Component scraping etcd

2057

2058

kubeEtcd:

2059

enabled: true

2060

## If your etcd is not deployed as a pod, specify IPs it can be found on

2061

2062

endpoints: []

2063

# - 10.141.4.22

2064

# - 10.141.4.23

2065

# - 10.141.4.24

2066

2067

## Etcd service. If using kubeEtcd.endpoints only the port and targetPort are used

2068

2069

service:

2070

enabled: true

2071

port: 2381

2072

targetPort: 2381

2073

ipDualStack:

2074

enabled: false

2075

ipFamilies: ["IPv6", "IPv4"]

2076

ipFamilyPolicy: "PreferDualStack"

2077

# selector:

2078

# component: etcd

2079

## Configure secure access to the etcd cluster by loading a secret into prometheus and

2080

## specifying security configuration below. For example, with a secret named etcd-client-cert

2081

2082

## serviceMonitor:

2083

## scheme: https

2084

## insecureSkipVerify: false

2085

## serverName: localhost

2086

## caFile: /etc/prometheus/secrets/etcd-client-cert/etcd-ca

2087

## certFile: /etc/prometheus/secrets/etcd-client-cert/etcd-client

2088

## keyFile: /etc/prometheus/secrets/etcd-client-cert/etcd-client-key

2089

2090

serviceMonitor:

2091

enabled: true

2092

## Scrape interval. If not set, the Prometheus default scrape interval is used.

2093

2094

interval: ""

2095

## SampleLimit defines per-scrape limit on number of scraped samples that will be accepted.

2096

2097

sampleLimit: 0

2098

## TargetLimit defines a limit on the number of scraped targets that will be accepted.

2099

2100

targetLimit: 0

2101

## Per-scrape limit on number of labels that will be accepted for a sample. Only valid in Prometheus versions 2.27.0 and newer.

2102

2103

labelLimit: 0

2104

## Per-scrape limit on length of labels name that will be accepted for a sample. Only valid in Prometheus versions 2.27.0 and newer.

2105

2106

labelNameLengthLimit: 0

2107

## Per-scrape limit on length of labels value that will be accepted for a sample. Only valid in Prometheus versions 2.27.0 and newer.

2108

2109

labelValueLengthLimit: 0

2110

## proxyUrl: URL of a proxy that should be used for scraping.

2111

2112

proxyUrl: ""

2113

scheme: http

2114

insecureSkipVerify: false

2115

serverName: ""

2116

caFile: ""

2117

certFile: ""

2118

keyFile: ""

2119

## port: Name of the port the metrics will be scraped from

2120

2121

port: http-metrics

2122

jobLabel: jobLabel

2123

selector: {}

2124

# matchLabels:

2125

# component: etcd

2126

2127

## MetricRelabelConfigs to apply to samples after scraping, but before ingestion.

2128

## ref: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api-reference/api.md#relabelconfig

2129

2130

metricRelabelings: []

2131

# - action: keep

2132

2133

# sourceLabels: [__name__]

2134

2135

## RelabelConfigs to apply to samples before scraping

2136

## ref: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api-reference/api.md#relabelconfig

2137

2138

relabelings: []

2139

# - sourceLabels: [__meta_kubernetes_pod_node_name]

2140

# separator: ;

2141

# regex: ^(.*)$

2142

# targetLabel: nodename

2143

# replacement: $1

2144

# action: replace

2145

2146

## Additional labels

2147

2148

additionalLabels: {}

2149

# foo: bar

2150

2151

## defines the labels which are transferred from the associated Kubernetes Service object onto the ingested metrics.

2152

## https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api-reference/api.md#servicemonitor

2153

targetLabels: []

2154

## File containing bearer token to be used when scraping targets

2155

## Empty value do not send any bearer token.

2156

2157

bearerTokenFile: /var/run/secrets/kubernetes.io/serviceaccount/token

2158

## Component scraping kube scheduler

2159

2160

kubeScheduler:

2161

enabled: true

2162

# Overrides the job selector in Grafana dashboards and Prometheus rules

2163

# For k3s clusters, change to k3s-server

2164

jobNameOverride: ""

2165

## If your kube scheduler is not deployed as a pod, specify IPs it can be found on

2166

2167

endpoints: []

2168

# - 10.141.4.22

2169

# - 10.141.4.23

2170

# - 10.141.4.24

2171

2172

## If using kubeScheduler.endpoints only the port and targetPort are used

2173

2174

service:

2175

enabled: true

2176

## If null or unset, the value is determined dynamically based on target Kubernetes version due to change

2177

## of default port in Kubernetes 1.23.

2178

2179

port: null

2180

targetPort: null

2181

ipDualStack:

2182

enabled: false

2183

ipFamilies: ["IPv6", "IPv4"]

2184

ipFamilyPolicy: "PreferDualStack"

2185

# selector:

2186

# component: kube-scheduler

2187

serviceMonitor:

2188

enabled: true

2189

## Scrape interval. If not set, the Prometheus default scrape interval is used.

2190

2191

interval: ""

2192

## SampleLimit defines per-scrape limit on number of scraped samples that will be accepted.

2193

2194

sampleLimit: 0

2195

## TargetLimit defines a limit on the number of scraped targets that will be accepted.

2196

2197

targetLimit: 0

2198

## Per-scrape limit on number of labels that will be accepted for a sample. Only valid in Prometheus versions 2.27.0 and newer.

2199

2200

labelLimit: 0

2201

## Per-scrape limit on length of labels name that will be accepted for a sample. Only valid in Prometheus versions 2.27.0 and newer.

2202

2203

labelNameLengthLimit: 0

2204

## Per-scrape limit on length of labels value that will be accepted for a sample. Only valid in Prometheus versions 2.27.0 and newer.

2205

2206

labelValueLengthLimit: 0

2207

## proxyUrl: URL of a proxy that should be used for scraping.

2208

2209

proxyUrl: ""

2210

## Enable scraping kube-scheduler over https.

2211

## Requires proper certs (not self-signed) and delegated authentication/authorization checks.

2212

## If null or unset, the value is determined dynamically based on target Kubernetes version.

2213

2214

https: null

2215

## port: Name of the port the metrics will be scraped from

2216

2217

port: http-metrics

2218

jobLabel: jobLabel

2219

selector: {}

2220

# matchLabels:

2221

# component: kube-scheduler

2222

2223

## Skip TLS certificate validation when scraping

2224

insecureSkipVerify: null

2225

## Name of the server to use when validating TLS certificate

2226

serverName: null

2227

## MetricRelabelConfigs to apply to samples after scraping, but before ingestion.

2228

## ref: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api-reference/api.md#relabelconfig

2229

2230

metricRelabelings: []

2231

# - action: keep

2232

2233

# sourceLabels: [__name__]

2234

2235

## RelabelConfigs to apply to samples before scraping

2236

## ref: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api-reference/api.md#relabelconfig

2237

2238

relabelings: []

2239

# - sourceLabels: [__meta_kubernetes_pod_node_name]

2240

# separator: ;

2241

# regex: ^(.*)$

2242

# targetLabel: nodename

2243

# replacement: $1

2244

# action: replace

2245

2246

## Additional labels

2247

2248

additionalLabels: {}

2249

# foo: bar

2250

2251

## defines the labels which are transferred from the associated Kubernetes Service object onto the ingested metrics.

2252

## https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api-reference/api.md#servicemonitor

2253

targetLabels: []

2254

resource:

2255

## Enable scraping /metrics/resource from kube-scheduler

2256

## https://kubernetes.io/docs/concepts/cluster-administration/system-metrics/#kube-scheduler-metrics

2257

enabled: false

2258

## Scrape interval. If not set, the Prometheus default scrape interval is used.

2259

2260

interval: ""

2261

## MetricRelabelConfigs to apply to samples after scraping, but before ingestion.

2262

## ref: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api-reference/api.md#relabelconfig

2263

2264

metricRelabelings: []

2265

# - action: keep

2266

2267

# sourceLabels: [__name__]

2268

2269

## RelabelConfigs to apply to samples before scraping

2270

## ref: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api-reference/api.md#relabelconfig

2271

2272

relabelings: []

2273

# - sourceLabels: [__meta_kubernetes_pod_node_name]

2274

# separator: ;

2275

# regex: ^(.*)$

2276

# targetLabel: nodename

2277

# replacement: $1

2278

# action: replace

2279

## Component scraping kube proxy

2280

2281

kubeProxy:

2282

enabled: true

2283

# Overrides the job selector in Grafana dashboards and Prometheus rules

2284

# For k3s clusters, change to k3s-server

2285

jobNameOverride: ""

2286

## If your kube proxy is not deployed as a pod, specify IPs it can be found on

2287

2288

endpoints: []

2289

# - 10.141.4.22

2290

# - 10.141.4.23

2291

# - 10.141.4.24

2292

2293

service:

2294

enabled: true

2295

port: 10249

2296

targetPort: 10249

2297

ipDualStack:

2298

enabled: false

2299

ipFamilies: ["IPv6", "IPv4"]

2300

ipFamilyPolicy: "PreferDualStack"

2301

# selector:

2302

# k8s-app: kube-proxy

2303

serviceMonitor:

2304

enabled: true

2305

## Scrape interval. If not set, the Prometheus default scrape interval is used.

2306

2307

interval: ""

2308

## SampleLimit defines per-scrape limit on number of scraped samples that will be accepted.

2309

2310

sampleLimit: 0

2311

## TargetLimit defines a limit on the number of scraped targets that will be accepted.

2312

2313

targetLimit: 0

2314

## Per-scrape limit on number of labels that will be accepted for a sample. Only valid in Prometheus versions 2.27.0 and newer.

2315

2316

labelLimit: 0

2317

## Per-scrape limit on length of labels name that will be accepted for a sample. Only valid in Prometheus versions 2.27.0 and newer.

2318

2319

labelNameLengthLimit: 0

2320

## Per-scrape limit on length of labels value that will be accepted for a sample. Only valid in Prometheus versions 2.27.0 and newer.

2321

2322

labelValueLengthLimit: 0

2323

## proxyUrl: URL of a proxy that should be used for scraping.

2324

2325

proxyUrl: ""

2326

## port: Name of the port the metrics will be scraped from

2327

2328

port: http-metrics

2329

jobLabel: jobLabel

2330

selector: {}

2331

# matchLabels:

2332

# k8s-app: kube-proxy

2333

2334

## Enable scraping kube-proxy over https.

2335

## Requires proper certs (not self-signed) and delegated authentication/authorization checks

2336

2337

https: false

2338

## MetricRelabelConfigs to apply to samples after scraping, but before ingestion.

2339

## ref: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api-reference/api.md#relabelconfig

2340

2341

metricRelabelings: []

2342

# - action: keep

2343

2344

# sourceLabels: [__name__]

2345

2346

## RelabelConfigs to apply to samples before scraping

2347

## ref: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api-reference/api.md#relabelconfig

2348

2349

relabelings: []

2350

# - action: keep

2351

2352

# sourceLabels: [__name__]

2353

2354

## Additional labels

2355

2356

additionalLabels: {}

2357

# foo: bar

2358

2359

## defines the labels which are transferred from the associated Kubernetes Service object onto the ingested metrics.

2360

## https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api-reference/api.md#servicemonitor

2361

targetLabels: []

2362

## File containing bearer token to be used when scraping targets

2363

## Empty value do not send any bearer token.

2364

2365

bearerTokenFile: /var/run/secrets/kubernetes.io/serviceaccount/token

2366

## Component scraping kube state metrics

2367

2368

kubeStateMetrics:

2369

enabled: true

2370

## Configuration for kube-state-metrics subchart

2371

2372

kube-state-metrics:

2373

## set to true to add the release label so scraping of the servicemonitor with kube-prometheus-stack works out of the box

2374

releaseLabel: true

2375

## Enable scraping via kubernetes-service-endpoints

2376

## Disabled by default as we service monitor is enabled below

2377

2378

prometheusScrape: false

2379

prometheus:

2380

monitor:

2381

## Enable scraping via service monitor

2382

## Disable to prevent duplication if you enable prometheusScrape above

2383

enabled: true

2384

## kube-state-metrics endpoint

2385

http:

2386

## Keep labels from scraped data, overriding server-side labels

2387

honorLabels: true

2388

## selfMonitor endpoint

2389

metrics:

2390

## Keep labels from scraped data, overriding server-side labels

2391

honorLabels: true

2392

## Deploy node exporter as a daemonset to all nodes

2393

2394

nodeExporter:

2395

enabled: true

2396

operatingSystems:

2397

linux:

2398

enabled: true

2399

aix:

2400

enabled: true

2401

darwin:

2402

enabled: true

2403

## ForceDeployDashboard Create dashboard configmap even if nodeExporter deployment has been disabled

2404

2405

forceDeployDashboards: false

2406

## Configuration for prometheus-node-exporter subchart

2407

2408

prometheus-node-exporter:

2409

namespaceOverride: ""

2410

podLabels:

2411

## Add the 'node-exporter' label to be used by serviceMonitor and podMonitor to match standard common usage in rules and grafana dashboards

2412

2413

jobLabel: node-exporter

2414

releaseLabel: true

2415

extraArgs:

2416

2417

2418

service:

2419

portName: http-metrics

2420

ipDualStack:

2421

enabled: false

2422

ipFamilies: ["IPv6", "IPv4"]

2423

ipFamilyPolicy: "PreferDualStack"

2424

labels:

2425

jobLabel: node-exporter

2426

image:

2427

distroless: true

2428

prometheus:

2429

monitor:

2430

enabled: true

2431

jobLabel: jobLabel

2432

## Scrape interval. If not set, the Prometheus default scrape interval is used.

2433

2434

interval: ""

2435

## SampleLimit defines per-scrape limit on number of scraped samples that will be accepted.

2436

2437

sampleLimit: 0

2438

## TargetLimit defines a limit on the number of scraped targets that will be accepted.

2439

2440

targetLimit: 0

2441

## Per-scrape limit on number of labels that will be accepted for a sample. Only valid in Prometheus versions 2.27.0 and newer.

2442

2443

labelLimit: 0

2444

## Per-scrape limit on length of labels name that will be accepted for a sample. Only valid in Prometheus versions 2.27.0 and newer.

2445

2446

labelNameLengthLimit: 0

2447

## Per-scrape limit on length of labels value that will be accepted for a sample. Only valid in Prometheus versions 2.27.0 and newer.

2448

2449

labelValueLengthLimit: 0

2450

## How long until a scrape request times out. If not set, the Prometheus default scape timeout is used.

2451

2452

scrapeTimeout: ""

2453

## proxyUrl: URL of a proxy that should be used for scraping.

2454

2455

proxyUrl: ""

2456

## MetricRelabelConfigs to apply to samples after scraping, but before ingestion.

2457

## ref: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api-reference/api.md#relabelconfig

2458

2459

metricRelabelings: []

2460

# - sourceLabels: [__name__]

2461

# separator: ;

2462

# regex: ^node_mountstats_nfs_(event|operations|transport)_.+

2463

# replacement: $1

2464

# action: drop

2465

2466

## RelabelConfigs to apply to samples before scraping

2467

## ref: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api-reference/api.md#relabelconfig

2468

2469

relabelings: []

2470

# - sourceLabels: [__meta_kubernetes_pod_node_name]

2471

# separator: ;

2472

# regex: ^(.*)$

2473

# targetLabel: nodename

2474

# replacement: $1

2475

# action: replace

2476

## Attach node metadata to discovered targets. Requires Prometheus v2.35.0 and above.

2477

2478

# attachMetadata:

2479

# node: false

2480

2481

podMonitor:

2482

enabled: false

2483

jobLabel: jobLabel

2484

rbac:

2485

## If true, create PSPs for node-exporter

2486

2487

pspEnabled: false

2488

## Manages Prometheus and Alertmanager components

2489

2490

prometheusOperator:

2491

enabled: true

2492

## Use '{{ template "kube-prometheus-stack.fullname" . }}-operator' by default

2493

fullnameOverride: ""

2494

## Number of old replicasets to retain ##

2495

## The default value is 10, 0 will garbage-collect old replicasets ##

2496

revisionHistoryLimit: 10

2497

## Strategy of the deployment

2498

2499

strategy: {}

2500

## Prometheus-Operator v0.39.0 and later support TLS natively.

2501

2502

tls:

2503

enabled: true

2504

# Value must match version names from https://pkg.go.dev/crypto/tls#pkg-constants

2505

tlsMinVersion: VersionTLS13

2506

# The default webhook port is 10250 in order to work out-of-the-box in GKE private clusters and avoid adding firewall rules.

2507

internalPort: 10250

2508

## Liveness probe for the prometheusOperator deployment

2509

2510

livenessProbe:

2511

enabled: true

2512

failureThreshold: 3

2513

initialDelaySeconds: 0

2514

periodSeconds: 10

2515

successThreshold: 1

2516

timeoutSeconds: 1

2517

## Readiness probe for the prometheusOperator deployment

2518

2519

readinessProbe:

2520

enabled: true

2521

failureThreshold: 3

2522

initialDelaySeconds: 0

2523

periodSeconds: 10

2524

successThreshold: 1

2525

timeoutSeconds: 1

2526

## Admission webhook support for PrometheusRules resources added in Prometheus Operator 0.30 can be enabled to prevent incorrectly formatted

2527

## rules from making their way into prometheus and potentially preventing the container from starting

2528

admissionWebhooks:

2529

## Valid values: Fail, Ignore, IgnoreOnInstallOnly

2530

## IgnoreOnInstallOnly - If Release.IsInstall returns "true", set "Ignore" otherwise "Fail"

2531

failurePolicy: ""

2532

## The default timeoutSeconds is 10 and the maximum value is 30.

2533

timeoutSeconds: 10

2534

enabled: true

2535

## A PEM encoded CA bundle which will be used to validate the webhook's server certificate.

2536

## If unspecified, system trust roots on the apiserver are used.

2537

caBundle: ""

2538

## If enabled, generate a self-signed certificate, then patch the webhook configurations with the generated data.

2539

## On chart upgrades (or if the secret exists) the cert will not be re-generated. You can use this to provide your own

2540

## certs ahead of time if you wish.

2541

2542

annotations: {}

2543

# argocd.argoproj.io/hook: PreSync

2544

# argocd.argoproj.io/hook-delete-policy: HookSucceeded

2545

2546

namespaceSelector: {}

2547

objectSelector: {}

2548

matchConditions: {}

2549

mutatingWebhookConfiguration:

2550

annotations: {}

2551

# argocd.argoproj.io/hook: PreSync

2552

validatingWebhookConfiguration:

2553

annotations: {}

2554

# argocd.argoproj.io/hook: PreSync

2555

deployment:

2556

enabled: false

2557

## Number of replicas

2558

2559

replicas: 1

2560

## Strategy of the deployment

2561

2562

strategy: {}

2563

# Ref: https://kubernetes.io/docs/tasks/run-application/configure-pdb/

2564

podDisruptionBudget:

2565

enabled: false

2566

minAvailable: 1

2567

# maxUnavailable: ""

2568

unhealthyPodEvictionPolicy: AlwaysAllow

2569

## Number of old replicasets to retain ##

2570

## The default value is 10, 0 will garbage-collect old replicasets ##

2571

revisionHistoryLimit: 10

2572

## Prometheus-Operator v0.39.0 and later support TLS natively.

2573

2574

tls:

2575

enabled: true

2576

# Value must match version names from https://pkg.go.dev/crypto/tls#pkg-constants

2577

tlsMinVersion: VersionTLS13

2578

# The default webhook port is 10250 in order to work out-of-the-box in GKE private clusters and avoid adding firewall rules.

2579

internalPort: 10250

2580

## Service account for Prometheus Operator Webhook to use.

2581

## ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/

2582

2583

serviceAccount:

2584

annotations: {}

2585

automountServiceAccountToken: false

2586

create: true

2587

2588

## Configuration for Prometheus operator Webhook service

2589

2590

service:

2591

annotations: {}

2592

labels: {}

2593

clusterIP: ""

2594

ipDualStack:

2595

enabled: false

2596

ipFamilies: ["IPv6", "IPv4"]

2597

ipFamilyPolicy: "PreferDualStack"

2598

## Port to expose on each node

2599

## Only used if service.type is 'NodePort'

2600

2601

nodePort: 31080

2602

nodePortTls: 31443

2603

## Additional ports to open for Prometheus operator Webhook service

2604

## ref: https://kubernetes.io/docs/concepts/services-networking/service/#multi-port-services

2605

2606

additionalPorts: []

2607

## Loadbalancer IP

2608

## Only use if service.type is "LoadBalancer"

2609

2610

loadBalancerIP: ""

2611

loadBalancerSourceRanges: []

2612

## Denotes if this Service desires to route external traffic to node-local or cluster-wide endpoints

2613

2614

externalTrafficPolicy: Cluster

2615

## Service type

2616

## NodePort, ClusterIP, LoadBalancer

2617

2618

type: ClusterIP

2619

## List of IP addresses at which the Prometheus server service is available

2620

## Ref: https://kubernetes.io/docs/concepts/services-networking/service/#external-ips

2621

2622

externalIPs: []

2623

# ## Labels to add to the operator webhook deployment

2624

# ##

2625

labels: {}

2626

## Annotations to add to the operator webhook deployment

2627

2628

annotations: {}

2629

## Labels to add to the operator webhook pod

2630

2631

podLabels: {}

2632

## Annotations to add to the operator webhook pod

2633

2634

podAnnotations: {}

2635

## Assign a PriorityClassName to pods if set

2636

# priorityClassName: ""

2637

2638

## Define Log Format

2639

# Use logfmt (default) or json logging

2640

# logFormat: logfmt

2641

2642

## Decrease log verbosity to errors only

2643

# logLevel: error

2644

2645

## Prometheus-operator webhook image

2646

2647

image:

2648

registry: cgr.dev

2649

repository: scratch-images/test-tmp/prometheus-admission-webhook

2650

# if not set appVersion field from Chart.yaml is used

2651

tag: 0.93.0-r0

2652

sha: sha256:e3bac30c7adb3f205f6213c8a2114e2a081a2d50237ea416b26ecdc78fc20c89

2653

pullPolicy: IfNotPresent

2654

## Define Log Format

2655

# Use logfmt (default) or json logging

2656

# logFormat: logfmt

2657

2658

## Decrease log verbosity to errors only

2659

# logLevel: error

2660

2661

## PromQL parser options to enable for the admission webhook when validating PrometheusRule resources.

2662

## The options are passed to the prometheus-operator admission-webhook binary as a comma-separated --promql-options value.

2663

## Requires prometheus-operator admission-webhook v0.91.0 or newer.

2664

## Valid values: experimental-functions, duration-expression-parsing, extended-range-selectors, binop-fill-modifiers.

2665

2666

promqlOptions: []

2667

## Liveness probe

2668

2669

livenessProbe:

2670

enabled: true

2671

failureThreshold: 3

2672

initialDelaySeconds: 30

2673

periodSeconds: 10

2674

successThreshold: 1

2675

timeoutSeconds: 1

2676

## Readiness probe

2677

2678

readinessProbe:

2679

enabled: true

2680

failureThreshold: 3

2681

initialDelaySeconds: 5

2682

periodSeconds: 10

2683

successThreshold: 1

2684

timeoutSeconds: 1

2685

## Resource limits & requests

2686

2687

resources: {}

2688

# limits:

2689

# cpu: 200m

2690

# memory: 200Mi

2691

# requests:

2692

# cpu: 100m

2693

# memory: 100Mi

2694

2695

# Required for use in managed kubernetes clusters (such as AWS EKS) with custom CNI (such as calico),

2696

# because control-plane managed by AWS cannot communicate with pods' IP CIDR and admission webhooks are not working

2697

2698

hostNetwork: false

2699

## Define which Nodes the Pods are scheduled on.

2700

## ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#nodeselector

2701

2702

nodeSelector: {}

2703

## Tolerations for use with node taints

2704

## ref: https://kubernetes.io/docs/concepts/scheduling-eviction/taint-and-toleration/

2705

2706

tolerations: []

2707

# - key: "key"

2708

# operator: "Equal"

2709

# value: "value"

2710

# effect: "NoSchedule"

2711

2712

## Assign custom affinity rules to the prometheus operator

2713

## ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/

2714

2715

affinity: {}

2716

# nodeAffinity:

2717

# requiredDuringSchedulingIgnoredDuringExecution:

2718

# nodeSelectorTerms:

2719

# - matchExpressions:

2720

# - key: kubernetes.io/e2e-az-name

2721

# operator: In

2722

# values:

2723

# - e2e-az1

2724

# - e2e-az2

2725

dnsConfig: {}

2726

# nameservers:

2727

# - 1.2.3.4

2728

# searches:

2729

# - ns1.svc.cluster-domain.example

2730

# - my.dns.search.suffix

2731

# options:

2732

# - name: ndots

2733

# value: "2"

2734

# - name: edns0

2735

securityContext:

2736

fsGroup: 65534

2737

runAsGroup: 65534

2738

runAsNonRoot: true

2739

runAsUser: 65534

2740

seccompProfile:

2741

type: RuntimeDefault

2742

## Container-specific security context configuration

2743

## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/

2744

2745

containerSecurityContext:

2746

allowPrivilegeEscalation: false

2747

readOnlyRootFilesystem: true

2748

capabilities:

2749

drop:

2750

- ALL

2751

## If false then the user will opt out of automounting API credentials.

2752

2753

automountServiceAccountToken: true

2754

patch:

2755

enabled: true

2756

image:

2757

registry: cgr.dev

2758

repository: chainguard-private/kube-webhook-certgen

2759

tag: latest

2760

sha: sha256:99df4526d0c504c11b5f1a5577be6dcea42ab5d027c3f07a19e7b649e3e220a4

2761

pullPolicy: IfNotPresent

2762

resources: {}

2763

## Provide a priority class name to the webhook patching job

2764

2765

priorityClassName: ""

2766

ttlSecondsAfterFinished: 60

2767

annotations: {}

2768

# argocd.argoproj.io/hook: PreSync

2769

# argocd.argoproj.io/hook-delete-policy: HookSucceeded

2770

podAnnotations: {}

2771

nodeSelector: {}

2772

affinity: {}

2773

tolerations: []

2774

## SecurityContext holds pod-level security attributes and common container settings.

2775

## This defaults to non root user with uid 2000 and gid 2000. *v1.PodSecurityContext false

2776

## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/

2777

2778

securityContext:

2779

runAsGroup: 2000

2780

runAsNonRoot: true

2781

runAsUser: 2000

2782

seccompProfile:

2783

type: RuntimeDefault

2784

## Service account for Prometheus Operator Webhook Job Patch to use.

2785

## ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/

2786

2787

serviceAccount:

2788

create: true

2789

annotations: {}

2790

automountServiceAccountToken: true

2791

# Security context for create job container

2792

createSecretJob:

2793

securityContext:

2794

allowPrivilegeEscalation: false

2795

readOnlyRootFilesystem: true

2796

capabilities:

2797

drop:

2798

- ALL

2799

# Security context for patch job container

2800

patchWebhookJob:

2801

securityContext:

2802

allowPrivilegeEscalation: false

2803

readOnlyRootFilesystem: true

2804

capabilities:

2805

drop:

2806

- ALL

2807

# Use certmanager to generate webhook certs

2808

certManager:

2809

enabled: false

2810

# self-signed root certificate

2811

rootCert:

2812

duration: "" # default to be 5y

2813

# -- Set the revisionHistoryLimit on the Certificate. See

2814

# https://cert-manager.io/docs/reference/api-docs/#cert-manager.io/v1.CertificateSpec

2815

# Defaults to nil.

2816

revisionHistoryLimit:

2817

admissionCert:

2818

duration: "" # default to be 1y

2819

# -- Set the revisionHistoryLimit on the Certificate. See

2820

# https://cert-manager.io/docs/reference/api-docs/#cert-manager.io/v1.CertificateSpec

2821

# Defaults to nil.

2822

revisionHistoryLimit:

2823

# issuerRef:

2824

# name: "issuer"

2825

# kind: "ClusterIssuer"

2826

## Namespaces to scope the interaction of the Prometheus Operator and the apiserver (allow list).

2827

## This is mutually exclusive with denyNamespaces. Setting this to an empty object will disable the configuration

2828

2829

namespaces: {}

2830

# releaseNamespace: true

2831

# additional:

2832

# - kube-system

2833

2834

## Namespaces not to scope the interaction of the Prometheus Operator (deny list).

2835

2836

denyNamespaces: []

2837

## Filter namespaces to look for prometheus-operator custom resources

2838

2839

alertmanagerInstanceNamespaces: []

2840

alertmanagerConfigNamespaces: []

2841

prometheusInstanceNamespaces: []

2842

thanosRulerInstanceNamespaces: []

2843

## The clusterDomain value will be added to the cluster.peer option of the alertmanager.

2844

## Without this specified option cluster.peer will have value alertmanager-monitoring-alertmanager-0.alertmanager-operated:9094 (default value)

2845

## With this specified option cluster.peer will have value alertmanager-monitoring-alertmanager-0.alertmanager-operated.namespace.svc.cluster-domain:9094

2846

2847

# clusterDomain: "cluster.local"

2848

networkPolicy:

2849

## Enable creation of NetworkPolicy resources.

2850

2851

enabled: false

2852

## Flavor of the network policy to use.

2853

# Can be:

2854

# * kubernetes for networking.k8s.io/v1/NetworkPolicy

2855

# * cilium for cilium.io/v2/CiliumNetworkPolicy

2856

flavor: kubernetes

2857

# cilium:

2858

# egress:

2859

2860

## match labels used in selector

2861

# matchLabels: {}

2862

## Service account for Prometheus Operator to use.

2863

## ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/

2864

2865

serviceAccount:

2866

create: true

2867

2868

automountServiceAccountToken: true

2869

annotations: {}

2870

# -- terminationGracePeriodSeconds for container lifecycle hook

2871

terminationGracePeriodSeconds: 30

2872

# -- Specify lifecycle hooks for the controller

2873

lifecycle: {}

2874

## Configuration for Prometheus operator service

2875

2876

service:

2877

annotations: {}

2878

labels: {}

2879

clusterIP: ""

2880

ipDualStack:

2881

enabled: false

2882

ipFamilies: ["IPv6", "IPv4"]

2883

ipFamilyPolicy: "PreferDualStack"

2884

## Port to expose on each node

2885

## Only used if service.type is 'NodePort'

2886

2887

nodePort: 30080

2888

nodePortTls: 30443

2889

## Additional ports to open for Prometheus operator service

2890

## ref: https://kubernetes.io/docs/concepts/services-networking/service/#multi-port-services

2891

2892

additionalPorts: []

2893

## Loadbalancer IP

2894

## Only use if service.type is "LoadBalancer"

2895

2896

loadBalancerIP: ""

2897

loadBalancerSourceRanges: []

2898

## Denotes if this Service desires to route external traffic to node-local or cluster-wide endpoints

2899

2900

externalTrafficPolicy: Cluster

2901

## Service type

2902

## NodePort, ClusterIP, LoadBalancer

2903

2904

type: ClusterIP

2905

## List of IP addresses at which the Prometheus server service is available

2906

## Ref: https://kubernetes.io/docs/concepts/services-networking/service/#external-ips

2907

2908

externalIPs: []

2909

# ## Labels to add to the operator deployment

2910

# ##

2911

labels: {}

2912

## Annotations to add to the operator deployment

2913

2914

annotations: {}

2915

## Labels to add to the operator pod

2916

2917

podLabels: {}

2918

## Annotations to add to the operator pod

2919

2920

podAnnotations: {}

2921

## Assign a podDisruptionBudget to the operator

2922

2923

podDisruptionBudget:

2924

enabled: false

2925

minAvailable: 1

2926

# maxUnavailable: ""

2927

unhealthyPodEvictionPolicy: AlwaysAllow

2928

## Assign a PriorityClassName to pods if set

2929

# priorityClassName: ""

2930

2931

## Define Log Format

2932

# Use logfmt (default) or json logging

2933

# logFormat: logfmt

2934

2935

## Decrease log verbosity to errors only

2936

# logLevel: error

2937

kubeletService:

2938

## If true, the operator will create and maintain a service for scraping kubelets

2939

## ref: https://github.com/prometheus-operator/prometheus-operator/blob/main/helm/prometheus-operator/README.md

2940

2941

enabled: true

2942

namespace: kube-system

2943

selector: ""

2944

## Use '{{ template "kube-prometheus-stack.fullname" . }}-kubelet' by default

2945

2946

## Create Endpoints objects for kubelet targets.

2947

kubeletEndpointsEnabled: true

2948

## Create EndpointSlice objects for kubelet targets.

2949

kubeletEndpointSliceEnabled: false

2950

## Extra arguments to pass to prometheusOperator

2951

# https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/platform/operator.md

2952

extraArgs: []

2953

# - --labels="cluster=talos-cluster"

2954

2955

## Create a servicemonitor for the operator

2956

2957

serviceMonitor:

2958

## If true, create a serviceMonitor for prometheus operator

2959

2960

selfMonitor: true

2961

## Labels for ServiceMonitor

2962

additionalLabels: {}

2963

## Scrape interval. If not set, the Prometheus default scrape interval is used.

2964

2965

interval: ""

2966

## SampleLimit defines per-scrape limit on number of scraped samples that will be accepted.

2967

2968

sampleLimit: 0

2969

## TargetLimit defines a limit on the number of scraped targets that will be accepted.

2970

2971

targetLimit: 0

2972

## Per-scrape limit on number of labels that will be accepted for a sample. Only valid in Prometheus versions 2.27.0 and newer.

2973

2974

labelLimit: 0

2975

## Per-scrape limit on length of labels name that will be accepted for a sample. Only valid in Prometheus versions 2.27.0 and newer.

2976

2977

labelNameLengthLimit: 0

2978

## Per-scrape limit on length of labels value that will be accepted for a sample. Only valid in Prometheus versions 2.27.0 and newer.

2979

2980

labelValueLengthLimit: 0

2981

## Scrape timeout. If not set, the Prometheus default scrape timeout is used.

2982

scrapeTimeout: ""

2983

## Metric relabel configs to apply to samples before ingestion.

2984

2985

metricRelabelings: []

2986

# - action: keep

2987

2988

# sourceLabels: [__name__]

2989

2990

# relabel configs to apply to samples before ingestion.

2991

2992

relabelings: []

2993

# - sourceLabels: [__meta_kubernetes_pod_node_name]

2994

# separator: ;

2995

# regex: ^(.*)$

2996

# targetLabel: nodename

2997

# replacement: $1

2998

# action: replace

2999

## Resource limits & requests

3000

3001

resources: {}

3002

# limits:

3003

# cpu: 200m

3004

# memory: 200Mi

3005

# requests:

3006

# cpu: 100m

3007

# memory: 100Mi

3008

3009

## Operator Environment

3010

## env:

3011

## VARIABLE: value

3012

env:

3013

GOGC: "30"

3014

# Required for use in managed kubernetes clusters (such as AWS EKS) with custom CNI (such as calico),

3015

# because control-plane managed by AWS cannot communicate with pods' IP CIDR and admission webhooks are not working

3016

3017

hostNetwork: false

3018

## Define which Nodes the Pods are scheduled on.

3019

## ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#nodeselector

3020

3021

nodeSelector: {}

3022

## Tolerations for use with node taints

3023

## ref: https://kubernetes.io/docs/concepts/scheduling-eviction/taint-and-toleration/

3024

3025

tolerations: []

3026

# - key: "key"

3027

# operator: "Equal"

3028

# value: "value"

3029

# effect: "NoSchedule"

3030

3031

## Assign custom affinity rules to the prometheus operator

3032

## ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/

3033

3034

affinity: {}

3035

# nodeAffinity:

3036

# requiredDuringSchedulingIgnoredDuringExecution:

3037

# nodeSelectorTerms:

3038

# - matchExpressions:

3039

# - key: kubernetes.io/e2e-az-name

3040

# operator: In

3041

# values:

3042

# - e2e-az1

3043

# - e2e-az2

3044

dnsConfig: {}

3045

# nameservers:

3046

# - 1.2.3.4

3047

# searches:

3048

# - ns1.svc.cluster-domain.example

3049

# - my.dns.search.suffix

3050

# options:

3051

# - name: ndots

3052

# value: "2"

3053

# - name: edns0

3054

securityContext:

3055

fsGroup: 65534

3056

runAsGroup: 65534

3057

runAsNonRoot: true

3058

runAsUser: 65534

3059

seccompProfile:

3060

type: RuntimeDefault

3061

## Setup hostUsers for prometheus-operator

3062

## ref: https://kubernetes.io/docs/tasks/configure-pod-container/user-namespaces/

3063

hostUsers: ~

3064

## Container-specific security context configuration

3065

## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/

3066

3067

containerSecurityContext:

3068

allowPrivilegeEscalation: false

3069

readOnlyRootFilesystem: true

3070

capabilities:

3071

drop:

3072

- ALL

3073

# Enable vertical pod autoscaler support for prometheus-operator

3074

verticalPodAutoscaler:

3075

enabled: false

3076

# Recommender responsible for generating recommendation for the object.

3077

# List should be empty (then the default recommender will generate the recommendation)

3078

# or contain exactly one recommender.

3079

# recommenders:

3080

# - name: custom-recommender-performance

3081

3082

# List of resources that the vertical pod autoscaler can control. Defaults to cpu and memory

3083

controlledResources: []

3084

# Specifies which resource values should be controlled: RequestsOnly or RequestsAndLimits.

3085

# controlledValues: RequestsAndLimits

3086

3087

# Define the max allowed resources for the pod

3088

maxAllowed: {}

3089

# cpu: 200m

3090

# memory: 100Mi

3091

# Define the min allowed resources for the pod

3092

minAllowed: {}

3093

# cpu: 200m

3094

# memory: 100Mi

3095

3096

updatePolicy:

3097

# Specifies minimal number of replicas which need to be alive for VPA Updater to attempt pod eviction

3098

# minReplicas: 1

3099

# Specifies whether recommended updates are applied when a Pod is started and whether recommended updates

3100

# are applied during the life of a Pod. Possible values are "Off", "Initial", "Recreate", and "InPlaceOrRecreate".

3101

updateMode: Recreate

3102

## Prometheus-operator image

3103

3104

image:

3105

registry: cgr.dev

3106

repository: scratch-images/test-tmp/prometheus-operator

3107

# if not set appVersion field from Chart.yaml is used

3108

tag: 0.93.0-r0

3109

sha: sha256:bc7f300de27170cce8cf7fa65772a82ba0f6f0af58cf1265a90f263ea129a2a9

3110

pullPolicy: IfNotPresent

3111

## Prometheus image to use for prometheuses managed by the operator

3112

3113

# prometheusDefaultBaseImage: prometheus/prometheus

3114

3115

## Prometheus image registry to use for prometheuses managed by the operator

3116

3117

# prometheusDefaultBaseImageRegistry: quay.io

3118

3119

## Alertmanager image to use for alertmanagers managed by the operator

3120

3121

# alertmanagerDefaultBaseImage: prometheus/alertmanager

3122

3123

## Alertmanager image registry to use for alertmanagers managed by the operator

3124

3125

# alertmanagerDefaultBaseImageRegistry: quay.io

3126

3127

## Prometheus-config-reloader

3128

3129

prometheusConfigReloader:

3130

image:

3131

registry: cgr.dev

3132

repository: scratch-images/test-tmp/prometheus-config-reloader

3133

# if not set appVersion field from Chart.yaml is used

3134

tag: 0.93.0-r0

3135

sha: sha256:e6326d4f15c4b917e9ebd73b1af5a0d3497477bd9cedc1fe4b3570bc87e7a996

3136

# add prometheus config reloader liveness and readiness probe. Default: false

3137

enableProbe: false

3138

# resource config for prometheusConfigReloader

3139

resources: {}

3140

# requests:

3141

# cpu: 200m

3142

# memory: 50Mi

3143

# limits:

3144

# cpu: 200m

3145

# memory: 50Mi

3146

## Thanos side-car image when configured

3147

3148

thanosImage:

3149

registry: cgr.dev

3150

repository: scratch-images/test-tmp/thanos

3151

tag: 0.42.4-r0

3152

sha: sha256:9d6a1276c8426c91a524c82a34c6a36f22ceb478f3658e471234915971ae7253

3153

## Set a Label Selector to filter watched prometheus and prometheusAgent

3154

3155

prometheusInstanceSelector: ""

3156

## Set a Label Selector to filter watched alertmanager

3157

3158

alertmanagerInstanceSelector: ""

3159

## Set a Label Selector to filter watched thanosRuler

3160

thanosRulerInstanceSelector: ""

3161

## Set a Field Selector to filter watched secrets

3162

3163

secretFieldSelector: "type!=kubernetes.io/dockercfg,type!=kubernetes.io/service-account-token,type!=helm.sh/release.v1"

3164

## Feature gates to enable/disable operator features, rendered as --feature-gates=<key>=<value>.

3165

## See https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api-reference/feature-gates.md

3166

## Example:

3167

## featureGates:

3168

## PrometheusAgentDaemonSet: true

3169

## StatusForConfigurationResources: true

3170

featureGates: {}

3171

## If false then the user will opt out of automounting API credentials.

3172

3173

automountServiceAccountToken: true

3174

## Additional volumes

3175

3176

extraVolumes: []

3177

## Additional volume mounts

3178

3179

extraVolumeMounts: []

3180

## Deploy a Prometheus instance

3181

3182

prometheus:

3183

enabled: true

3184

## Toggle prometheus into agent mode

3185

## Note many of features described below (e.g. rules, query, alerting, remote read, thanos) will not work in agent mode.

3186

## ref: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/platform/prometheus-agent.md

3187

3188

agentMode: false

3189

## Annotations for Prometheus

3190

3191

annotations: {}

3192

## Additional labels for Prometheus

3193

3194

additionalLabels: {}

3195

## Configure network policy for the prometheus

3196

networkPolicy:

3197

enabled: false

3198

## Flavor of the network policy to use.

3199

# Can be:

3200

# * kubernetes for networking.k8s.io/v1/NetworkPolicy

3201

# * cilium for cilium.io/v2/CiliumNetworkPolicy

3202

flavor: kubernetes

3203

namespace:

3204

# cilium:

3205

# endpointSelector:

3206

# egress:

3207

# ingress:

3208

3209

# egress:

3210

# - {}

3211

# ingress:

3212

# - {}

3213

# podSelector:

3214

# matchLabels:

3215

# app: prometheus

3216

## Service account for Prometheuses to use.

3217

## ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/

3218

3219

serviceAccount:

3220

create: true

3221

3222

annotations: {}

3223

automountServiceAccountToken: true

3224

# Service for thanos service discovery on sidecar

3225

# Enable this can make Thanos Query can use

3226

# `--store=dnssrv+_grpc._tcp.${kube-prometheus-stack.fullname}-thanos-discovery.${namespace}.svc.cluster.local` to discovery

3227

# Thanos sidecar on prometheus nodes

3228

# (Please remember to change ${kube-prometheus-stack.fullname} and ${namespace}. Not just copy and paste!)

3229

thanosService:

3230

enabled: false

3231

annotations: {}

3232

labels: {}

3233

## Denotes if this Service desires to route external traffic to node-local or cluster-wide endpoints

3234

3235

externalTrafficPolicy: Cluster

3236

## Service type

3237

3238

type: ClusterIP

3239

## Service dual stack

3240

3241

ipDualStack:

3242

enabled: false

3243

ipFamilies: ["IPv6", "IPv4"]

3244

ipFamilyPolicy: "PreferDualStack"

3245

## gRPC port config

3246

portName: grpc

3247

port: 10901

3248

targetPort: "grpc"

3249

## HTTP port config (for metrics)

3250

httpPortName: http

3251

httpPort: 10902

3252

targetHttpPort: "http"

3253

## ClusterIP to assign

3254

# Default is to make this a headless service ("None")

3255

clusterIP: "None"

3256

## Port to expose on each node, if service type is NodePort

3257

3258

nodePort: 30901

3259

httpNodePort: 30902

3260

# ServiceMonitor to scrape Sidecar metrics

3261

# Needs thanosService to be enabled as well

3262

thanosServiceMonitor:

3263

enabled: false

3264

interval: ""

3265

## Additional labels

3266

3267

additionalLabels: {}

3268

## scheme: HTTP scheme to use for scraping. Can be used with `tlsConfig` for example if using istio mTLS.

3269

scheme: ""

3270

## tlsConfig: TLS configuration to use when scraping the endpoint. For example if using istio mTLS.

3271

## Of type: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api-reference/api.md#tlsconfig

3272

tlsConfig: {}

3273

bearerTokenFile:

3274

## Metric relabel configs to apply to samples before ingestion.

3275

metricRelabelings: []

3276

## relabel configs to apply to samples before ingestion.

3277

relabelings: []

3278

# Service for external access to sidecar

3279

# Enabling this creates a service to expose thanos-sidecar outside the cluster.

3280

thanosServiceExternal:

3281

enabled: false

3282

annotations: {}

3283

labels: {}

3284

loadBalancerIP: ""

3285

loadBalancerSourceRanges: []

3286

## gRPC port config

3287

portName: grpc

3288

port: 10901

3289

targetPort: "grpc"

3290

## HTTP port config (for metrics)

3291

httpPortName: http

3292

httpPort: 10902

3293

targetHttpPort: "http"

3294

## Denotes if this Service desires to route external traffic to node-local or cluster-wide endpoints

3295

3296

externalTrafficPolicy: Cluster

3297

## Service type

3298

3299

type: LoadBalancer

3300

## Port to expose on each node

3301

3302

nodePort: 30901

3303

httpNodePort: 30902

3304

## Configuration for Prometheus service

3305

3306

service:

3307

enabled: true

3308

annotations: {}

3309

labels: {}

3310

clusterIP: ""

3311

ipDualStack:

3312

enabled: false

3313

ipFamilies: ["IPv6", "IPv4"]

3314

ipFamilyPolicy: "PreferDualStack"

3315

## Port for Prometheus Service to listen on

3316

3317

port: 9090

3318

## To be used with a proxy extraContainer port

3319

targetPort: 9090

3320

## Port for Prometheus Reloader to listen on

3321

3322

reloaderWebPort: 8080

3323

## Port to expose for Prometheus Reloader

3324

## Only used if service.type is 'NodePort'

3325

3326

reloaderWebNodePort: null

3327

## List of IP addresses at which the Prometheus server service is available

3328

## Ref: https://kubernetes.io/docs/concepts/services-networking/service/#external-ips

3329

3330

externalIPs: []

3331

## Port to expose on each node

3332

## Only used if service.type is 'NodePort'

3333

3334

nodePort: 30090

3335

## Loadbalancer IP

3336

## Only use if service.type is "LoadBalancer"

3337

loadBalancerIP: ""

3338

loadBalancerSourceRanges: []

3339

## Denotes if this Service desires to route external traffic to node-local or cluster-wide endpoints

3340

3341

externalTrafficPolicy: Cluster

3342

## Service type

3343

3344

type: ClusterIP

3345

## Additional ports to open for Prometheus service

3346

3347

additionalPorts: []

3348

# additionalPorts:

3349

# - name: oauth-proxy

3350

# port: 8081

3351

# targetPort: 8081

3352

# - name: oauth-metrics

3353

# port: 8082

3354

# targetPort: 8082

3355

3356

## Consider that all endpoints are considered "ready" even if the Pods themselves are not

3357

## Ref: https://kubernetes.io/docs/reference/kubernetes-api/service-resources/service-v1/#ServiceSpec

3358

publishNotReadyAddresses: false

3359

## If you want to make sure that connections from a particular client are passed to the same Pod each time

3360

## Accepts 'ClientIP' or 'None'

3361

3362

sessionAffinity: None

3363

## If you want to modify the ClientIP sessionAffinity timeout

3364

## The value must be >0 && <=86400(for 1 day) if ServiceAffinity == "ClientIP"

3365

3366

sessionAffinityConfig:

3367

clientIP:

3368

timeoutSeconds: 10800

3369

## Configuration for creating a separate Service for each statefulset Prometheus replica

3370

3371

servicePerReplica:

3372

enabled: false

3373

annotations: {}

3374

## Port for Prometheus Service per replica to listen on

3375

3376

port: 9090

3377

## To be used with a proxy extraContainer port

3378

targetPort: 9090

3379

## Port to expose on each node

3380

## Only used if servicePerReplica.type is 'NodePort'

3381

3382

nodePort: 30091

3383

## Loadbalancer source IP ranges

3384

## Only used if servicePerReplica.type is "LoadBalancer"

3385

loadBalancerSourceRanges: []

3386

## Denotes if this Service desires to route external traffic to node-local or cluster-wide endpoints

3387

3388

externalTrafficPolicy: Cluster

3389

## Service type

3390

3391

type: ClusterIP

3392

## Service dual stack

3393

3394

ipDualStack:

3395

enabled: false

3396

ipFamilies: ["IPv6", "IPv4"]

3397

ipFamilyPolicy: "PreferDualStack"

3398

## Configure pod disruption budgets for Prometheus

3399

## ref: https://kubernetes.io/docs/tasks/run-application/configure-pdb/#specifying-a-poddisruptionbudget

3400

3401

podDisruptionBudget:

3402

enabled: false

3403

minAvailable: 1

3404

# maxUnavailable: ""

3405

unhealthyPodEvictionPolicy: AlwaysAllow

3406

## Enable vertical pod autoscaler support for Prometheus

3407

## ref: https://github.com/kubernetes/autoscaler/tree/master/vertical-pod-autoscaler

3408

3409

verticalPodAutoscaler:

3410

enabled: false

3411

# Recommender responsible for generating recommendation for the object.

3412

# List should be empty (then the default recommender will generate the recommendation)

3413

# or contain exactly one recommender.

3414

# recommenders:

3415

# - name: custom-recommender-performance

3416

3417

# List of resources that the vertical pod autoscaler can control. Defaults to cpu and memory

3418

controlledResources: []

3419

# Specifies which resource values should be controlled: RequestsOnly or RequestsAndLimits.

3420

# controlledValues: RequestsAndLimits

3421

3422

# Define the max allowed resources for the pod

3423

maxAllowed: {}

3424

# cpu: 200m

3425

# memory: 100Mi

3426

# Define the min allowed resources for the pod

3427

minAllowed: {}

3428

# cpu: 200m

3429

# memory: 100Mi

3430

3431

updatePolicy:

3432

# Specifies whether recommended updates are applied when a Pod is started and whether recommended updates

3433

# are applied during the life of a Pod. Possible values are "Off", "Initial", "Recreate", and "InPlaceOrRecreate".

3434

updateMode: Recreate

3435

# Ingress exposes thanos sidecar outside the cluster

3436

thanosIngress:

3437

enabled: false

3438

ingressClassName: ""

3439

annotations: {}

3440

labels: {}

3441

servicePort: 10901

3442

## Port to expose on each node

3443

## Only used if service.type is 'NodePort'

3444

3445

nodePort: 30901

3446

## Hosts must be provided if Ingress is enabled.

3447

3448

hosts: []

3449

# - thanos-gateway.domain.com

3450

3451

## Paths to use for ingress rules

3452

3453

paths: []

3454

# - /

3455

3456

## For Kubernetes >= 1.18 you should specify the pathType (determines how Ingress paths should be matched)

3457

## See https://kubernetes.io/blog/2020/04/02/improvements-to-the-ingress-api-in-kubernetes-1.18/#better-path-matching-with-path-types

3458

# pathType: ImplementationSpecific

3459

3460

## TLS configuration for Thanos Ingress

3461

## Secret must be manually created in the namespace

3462

3463

tls: []

3464

# - secretName: thanos-gateway-tls

3465

# hosts:

3466

# - thanos-gateway.domain.com

3467

3468

## ExtraSecret can be used to store various data in an extra secret

3469

## (use it for example to store hashed basic auth credentials)

3470

extraSecret:

3471

## if not set, name will be auto generated

3472

# name: ""

3473

annotations: {}

3474

data: {}

3475

# auth: |

3476

# foo:$apr1$OFG3Xybp$ckL0FHDAkoXYIlH9.cysT0

3477

# someoneelse:$apr1$DMZX2Z4q$6SbQIfyuLQd.xmo/P0m2c.

3478

3479

ingress:

3480

enabled: false

3481

ingressClassName: ""

3482

annotations: {}

3483

labels: {}

3484

## Redirect ingress to an additional defined port on the service

3485

# servicePort: 8081

3486

3487

## Hostnames.

3488

## Must be provided if Ingress is enabled.

3489

3490

# hosts:

3491

# - prometheus.domain.com

3492

hosts: []

3493

## Paths to use for ingress rules - one path should match the prometheusSpec.routePrefix

3494

3495

paths: []

3496

# - /

3497

3498

## For Kubernetes >= 1.18 you should specify the pathType (determines how Ingress paths should be matched)

3499

## See https://kubernetes.io/blog/2020/04/02/improvements-to-the-ingress-api-in-kubernetes-1.18/#better-path-matching-with-path-types

3500

# pathType: ImplementationSpecific

3501

3502

## TLS configuration for Prometheus Ingress

3503

## Secret must be manually created in the namespace

3504

3505

tls: []

3506

# - secretName: prometheus-general-tls

3507

# hosts:

3508

# - prometheus.example.com

3509

# -- BETA: Configure the gateway routes for the chart here.

3510

# More routes can be added by adding a dictionary key like the 'main' route.

3511

# Be aware that this is an early beta of this feature,

3512

# kube-prometheus-stack does not guarantee this works and is subject to change.

3513

# Being BETA this can/will change in the future without notice, do not use unless you want to take that risk

3514

# [[ref]](https://gateway-api.sigs.k8s.io/reference/spec/#gateway.networking.k8s.io%2fv1alpha2)

3515

route:

3516

main:

3517

# -- Enables or disables the route

3518

enabled: false

3519

# -- Set the route apiVersion, e.g. gateway.networking.k8s.io/v1 or gateway.networking.k8s.io/v1alpha2

3520

apiVersion: gateway.networking.k8s.io/v1

3521

# -- Set the route kind

3522

# Valid options are GRPCRoute, HTTPRoute, TCPRoute, TLSRoute, UDPRoute

3523

kind: HTTPRoute

3524

annotations: {}

3525

labels: {}

3526

hostnames: []

3527

# - my-filter.example.com

3528

parentRefs: []

3529

# - name: acme-gw

3530

3531

# -- create http route for redirect (https://gateway-api.sigs.k8s.io/guides/http-redirect-rewrite/#http-to-https-redirects)

3532

## Take care that you only enable this on the http listener of the gateway to avoid an infinite redirect.

3533

## matches, filters and additionalRules will be ignored if this is set to true. Be are

3534

httpsRedirect: false

3535

matches:

3536

- path:

3537

type: PathPrefix

3538

value: /

3539

## Filters define the filters that are applied to requests that match this rule.

3540

filters: []

3541

## Session persistence configuration for the route rule.

3542

sessionPersistence: {}

3543

# sessionName: route

3544

# type: Cookie

3545

# absoluteTimeout: 12h

3546

# cookieConfig:

3547

# lifetimeType: Permanent

3548

3549

## Additional custom rules that can be added to the route

3550

additionalRules: []

3551

## Configuration for creating an Ingress that will map to each Prometheus replica service

3552

## prometheus.servicePerReplica must be enabled

3553

3554

ingressPerReplica:

3555

enabled: false

3556

ingressClassName: ""

3557

annotations: {}

3558

labels: {}

3559

## Final form of the hostname for each per replica ingress is

3560

## {{ ingressPerReplica.hostPrefix }}-{{ $replicaNumber }}.{{ ingressPerReplica.hostDomain }}

3561

3562

## Prefix for the per replica ingress that will have `-$replicaNumber`

3563

## appended to the end

3564

hostPrefix: ""

3565

## Domain that will be used for the per replica ingress

3566

hostDomain: ""

3567

## Paths to use for ingress rules

3568

3569

paths: []

3570

# - /

3571

3572

## For Kubernetes >= 1.18 you should specify the pathType (determines how Ingress paths should be matched)

3573

## See https://kubernetes.io/blog/2020/04/02/improvements-to-the-ingress-api-in-kubernetes-1.18/#better-path-matching-with-path-types

3574

# pathType: ImplementationSpecific

3575

3576

## Secret name containing the TLS certificate for Prometheus per replica ingress

3577

## Secret must be manually created in the namespace

3578

tlsSecretName: ""

3579

## Separated secret for each per replica Ingress. Can be used together with cert-manager

3580

3581

tlsSecretPerReplica:

3582

enabled: false

3583

## Final form of the secret for each per replica ingress is

3584

## {{ tlsSecretPerReplica.prefix }}-{{ $replicaNumber }}

3585

3586

prefix: "prometheus"

3587

## Configuration for creating a Gateway API route that will map to each Prometheus replica service

3588

## prometheus.servicePerReplica must be enabled

3589

3590

routePerReplica:

3591

main:

3592

# -- Enables or disables the routePerReplica

3593

enabled: false

3594

# -- Set the route apiVersion, e.g. gateway.networking.k8s.io/v1 or gateway.networking.k8s.io/v1alpha2

3595

apiVersion: gateway.networking.k8s.io/v1

3596

# -- Set the route kind

3597

# Valid options are GRPCRoute, HTTPRoute, TCPRoute, TLSRoute, UDPRoute

3598

kind: HTTPRoute

3599

annotations: {}

3600

labels: {}

3601

## Final form of the hostname for each per replica route is

3602

## {{ routePerReplica.hostPrefix }}-{{ $replicaNumber }}.{{ routePerReplica.hostDomain }}

3603

3604

## Prefix for the per replica route that will have `-$replicaNumber` appended to the end

3605

hostPrefix: ""

3606

## Domain that will be used for the per replica route

3607

hostDomain: ""

3608

parentRefs: []

3609

# - name: acme-gw

3610

3611

# -- create http route for redirect (https://gateway-api.sigs.k8s.io/guides/http-redirect-rewrite/#http-to-https-redirects)

3612

## Take care that you only enable this on the http listener of the gateway to avoid an infinite redirect.

3613

## matches, filters and additionalRules will be ignored if this is set to true.

3614

httpsRedirect: false

3615

## Filters define the filters that are applied to requests that match this rule.

3616

filters: []

3617

matches:

3618

- path:

3619

type: PathPrefix

3620

value: /

3621

## Session persistence configuration for the route rule.

3622

sessionPersistence: {}

3623

# sessionName: route

3624

# type: Cookie

3625

# absoluteTimeout: 12h

3626

# cookieConfig:

3627

# lifetimeType: Permanent

3628

3629

## Additional custom rules that can be added to the route

3630

additionalRules: []

3631

serviceMonitor:

3632

## If true, create a serviceMonitor for prometheus

3633

3634

selfMonitor: true

3635

## Scrape interval. If not set, the Prometheus default scrape interval is used.

3636

3637

interval: ""

3638

## Additional labels

3639

3640

additionalLabels: {}

3641

## SampleLimit defines per-scrape limit on number of scraped samples that will be accepted.

3642

3643

sampleLimit: 0

3644

## TargetLimit defines a limit on the number of scraped targets that will be accepted.

3645

3646

targetLimit: 0

3647

## Per-scrape limit on number of labels that will be accepted for a sample. Only valid in Prometheus versions 2.27.0 and newer.

3648

3649

labelLimit: 0

3650

## Per-scrape limit on length of labels name that will be accepted for a sample. Only valid in Prometheus versions 2.27.0 and newer.

3651

3652

labelNameLengthLimit: 0

3653

## Per-scrape limit on length of labels value that will be accepted for a sample. Only valid in Prometheus versions 2.27.0 and newer.

3654

3655

labelValueLengthLimit: 0

3656

## scheme: HTTP scheme to use for scraping. Can be used with `tlsConfig` for example if using istio mTLS.

3657

scheme: ""

3658

## tlsConfig: TLS configuration to use when scraping the endpoint. For example if using istio mTLS.

3659

## Of type: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api-reference/api.md#tlsconfig

3660

tlsConfig: {}

3661

bearerTokenFile:

3662

## Metric relabel configs to apply to samples before ingestion.

3663

3664

metricRelabelings: []

3665

# - action: keep

3666

3667

# sourceLabels: [__name__]

3668

3669

# relabel configs to apply to samples before ingestion.

3670

3671

relabelings: []

3672

# - sourceLabels: [__meta_kubernetes_pod_node_name]

3673

# separator: ;

3674

# regex: ^(.*)$

3675

# targetLabel: nodename

3676

# replacement: $1

3677

# action: replace

3678

3679

## Additional Endpoints

3680

3681

additionalEndpoints: []

3682

# - port: oauth-metrics

3683

# path: /metrics

3684

## Settings affecting prometheusSpec

3685

## ref: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api-reference/api.md#prometheusspec

3686

3687

prometheusSpec:

3688

## Statefulset's persistent volume claim retention policy

3689

## whenDeleted and whenScaled determine whether

3690

## statefulset's PVCs are deleted (true) or retained (false)

3691

## on scaling down and deleting statefulset, respectively.

3692

## Requires Kubernetes version 1.27.0+.

3693

## Ref: https://kubernetes.io/docs/concepts/workloads/controllers/statefulset/#persistentvolumeclaim-retention

3694

persistentVolumeClaimRetentionPolicy: {}

3695

# whenDeleted: Retain

3696

# whenScaled: Retain

3697

3698

## If true, pass --storage.tsdb.max-block-duration=2h to prometheus. This is already done if using Thanos

3699

3700

disableCompaction: false

3701

## AutomountServiceAccountToken indicates whether a service account token should be automatically mounted in the pod,

3702

## If the field isn't set, the operator mounts the service account token by default.

3703

## Warning: be aware that by default, Prometheus requires the service account token for Kubernetes service discovery,

3704

## It is possible to use strategic merge patch to project the service account token into the 'prometheus' container.

3705

automountServiceAccountToken: true

3706

## APIServerConfig

3707

## ref: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api-reference/api.md#apiserverconfig

3708

3709

apiserverConfig: {}

3710

## Allows setting additional arguments for the Prometheus container

3711

## ref: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api-reference/api.md#monitoring.coreos.com/v1.Prometheus

3712

additionalArgs: []

3713

## Convert all classic histograms to native histograms with custom buckets.

3714

## This corresponds to the 'convert_classic_histograms_to_nhcb' field in Prometheus configuration.

3715

3716

convertClassicHistogramsToNHCB: false

3717

## Enable scraping of classic histograms that are also exposed as native histograms.

3718

## This corresponds to the 'always_scrape_classic_histograms' field in Prometheus configuration.

3719

3720

scrapeClassicHistograms: false

3721

## Enable scraping of native histograms.

3722

## This corresponds to the 'scrape_native_histograms' field in Prometheus configuration.

3723

3724

scrapeNativeHistograms: false

3725

## File to which scrape failures are logged.

3726

## Reloading the configuration will reopen the file.

3727

## Defaults to empty (disabled)

3728

## ref: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api-reference/api.md#monitoring.coreos.com/v1.Prometheus

3729

3730

scrapeFailureLogFile: ""

3731

## Interval between consecutive scrapes.

3732

## Defaults to 30s.

3733

## ref: https://github.com/prometheus-operator/prometheus-operator/blob/release-0.44/pkg/prometheus/promcfg.go#L180-L183

3734

3735

scrapeInterval: ""

3736

## Number of seconds to wait for target to respond before erroring

3737

3738

scrapeTimeout: ""

3739

## List of scrape classes to expose to scraping objects such as

3740

## PodMonitors, ServiceMonitors, Probes and ScrapeConfigs.

3741

3742

scrapeClasses: []

3743

# - name: istio-mtls

3744

# default: false

3745

# tlsConfig:

3746

# caFile: /etc/prometheus/secrets/istio.default/root-cert.pem

3747

# certFile: /etc/prometheus/secrets/istio.default/cert-chain.pem

3748

3749

## PodTargetLabels are appended to the `spec.podTargetLabels` field of all PodMonitor and ServiceMonitor objects.

3750

3751

podTargetLabels: []

3752

# - customlabel

3753

3754

## Interval between consecutive evaluations.

3755

3756

evaluationInterval: ""

3757

## ListenLocal makes the Prometheus server listen on loopback, so that it does not bind against the Pod IP.

3758

3759

listenLocal: false

3760

## enableOTLPReceiver enables the OTLP receiver for Prometheus.

3761

enableOTLPReceiver: false

3762

## EnableAdminAPI enables Prometheus the administrative HTTP API which includes functionality such as deleting time series.

3763

## This is disabled by default.

3764

## ref: https://prometheus.io/docs/prometheus/latest/querying/api/#tsdb-admin-apis

3765

3766

enableAdminAPI: false

3767

## Sets version of Prometheus overriding the Prometheus version as derived

3768

## from the image tag. Useful in cases where the tag does not follow semver v2.

3769

version: ""

3770

## WebTLSConfig defines the TLS parameters for HTTPS

3771

## ref: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api-reference/api.md#webtlsconfig

3772

web: {}

3773

## Exemplars related settings that are runtime reloadable.

3774

## It requires to enable the exemplar storage feature to be effective.

3775

exemplars: {}

3776

## Maximum number of exemplars stored in memory for all series.

3777

## If not set, Prometheus uses its default value.

3778

## A value of zero or less than zero disables the storage.

3779

# maxSize: 100000

3780

3781

# EnableFeatures API enables access to Prometheus disabled features.

3782

# ref: https://prometheus.io/docs/prometheus/latest/feature_flags/

3783

enableFeatures: []

3784

# - exemplar-storage

3785

3786

## https://prometheus.io/docs/guides/opentelemetry

3787

3788

otlp: {}

3789

# promoteResourceAttributes: []

3790

# keepIdentifyingResourceAttributes: false

3791

# translationStrategy: NoUTF8EscapingWithSuffixes

3792

# convertHistogramsToNHCB: false

3793

3794

3795

serviceName:

3796

## Image of Prometheus.

3797

3798

image:

3799

registry: cgr.dev

3800

repository: scratch-images/test-tmp/prometheus

3801

tag: 3.12.0-r7

3802

sha: sha256:45028032dca2fe1e1ea2e58702d1e77076de53aa4a66ff6544a3605d0f1b23a7

3803

pullPolicy: IfNotPresent

3804

## Tolerations for use with node taints

3805

## ref: https://kubernetes.io/docs/concepts/scheduling-eviction/taint-and-toleration/

3806

3807

tolerations: []

3808

# - key: "key"

3809

# operator: "Equal"

3810

# value: "value"

3811

# effect: "NoSchedule"

3812

3813

## If specified, the pod's topology spread constraints.

3814

## ref: https://kubernetes.io/docs/concepts/scheduling-eviction/topology-spread-constraints/

3815

3816

topologySpreadConstraints: []

3817

# - maxSkew: 1

3818

# topologyKey: topology.kubernetes.io/zone

3819

# whenUnsatisfiable: DoNotSchedule

3820

# labelSelector:

3821

# matchLabels:

3822

# app: prometheus

3823

3824

## Disable alerting

3825

3826

disableAlerting: false

3827

## Alertmanagers to which alerts will be sent

3828

## ref: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api-reference/api.md#alertmanagerendpoints

3829

3830

## Default configuration will connect to the alertmanager deployed as part of this release

3831

3832

alertingEndpoints: []

3833

# - name: ""

3834

# namespace: ""

3835

# port: http

3836

# scheme: http

3837

# pathPrefix: ""

3838

# tlsConfig: {}

3839

# bearerTokenFile: ""

3840

# apiVersion: v2

3841

3842

## External labels to add to any time series or alerts when communicating with external systems

3843

3844

externalLabels: {}

3845

## enable --web.enable-remote-write-receiver flag on prometheus-server

3846

3847

enableRemoteWriteReceiver: false

3848

## Name of the external label used to denote replica name

3849

3850

replicaExternalLabelName: ""

3851

## If true, the Operator won't add the external label used to denote replica name

3852

3853

replicaExternalLabelNameClear: false

3854

## Name of the external label used to denote Prometheus instance name

3855

3856

prometheusExternalLabelName: ""

3857

## If true, the Operator won't add the external label used to denote Prometheus instance name

3858

3859

prometheusExternalLabelNameClear: false

3860

## External URL at which Prometheus will be reachable.

3861

3862

externalUrl: ""

3863

## Define which Nodes the Pods are scheduled on.

3864

## ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#nodeselector

3865

3866

nodeSelector: {}

3867

## Secrets is a list of Secrets in the same namespace as the Prometheus object, which shall be mounted into the Prometheus Pods.

3868

## The Secrets are mounted into /etc/prometheus/secrets/. Secrets changes after initial creation of a Prometheus object are not

3869

## reflected in the running Pods. To change the secrets mounted into the Prometheus Pods, the object must be deleted and recreated

3870

## with the new list of secrets.

3871

3872

secrets: []

3873

## ConfigMaps is a list of ConfigMaps in the same namespace as the Prometheus object, which shall be mounted into the Prometheus Pods.

3874

## The ConfigMaps are mounted into /etc/prometheus/configmaps/.

3875

3876

configMaps: []

3877

## QuerySpec defines the query command line flags when starting Prometheus.

3878

## ref: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api-reference/api.md#queryspec

3879

3880

query: {}

3881

## If nil, select own namespace. Namespaces to be selected for PrometheusRules discovery.

3882

ruleNamespaceSelector: {}

3883

## Example which selects PrometheusRules in namespaces with label "prometheus" set to "somelabel"

3884

# ruleNamespaceSelector:

3885

# matchLabels:

3886

# prometheus: somelabel

3887

3888

## If true, a nil or {} value for prometheus.prometheusSpec.ruleSelector will cause the

3889

## prometheus resource to be created with selectors based on values in the helm deployment,

3890

## which will also match the PrometheusRule resources created

3891

3892

ruleSelectorNilUsesHelmValues: true

3893

## PrometheusRules to be selected for target discovery.

3894

## If {}, select all PrometheusRules

3895

3896

ruleSelector: {}

3897

## Example which select all PrometheusRules resources

3898

## with label "prometheus" with values any of "example-rules" or "example-rules-2"

3899

# ruleSelector:

3900

# matchExpressions:

3901

# - key: prometheus

3902

# operator: In

3903

# values:

3904

# - example-rules

3905

# - example-rules-2

3906

3907

## Example which select all PrometheusRules resources with label "role" set to "example-rules"

3908

# ruleSelector:

3909

# matchLabels:

3910

# role: example-rules

3911

3912

## If true, a nil or {} value for prometheus.prometheusSpec.serviceMonitorSelector will cause the

3913

## prometheus resource to be created with selectors based on values in the helm deployment,

3914

## which will also match the servicemonitors created

3915

3916

serviceMonitorSelectorNilUsesHelmValues: true

3917

## ServiceMonitors to be selected for target discovery.

3918

## If {}, select all ServiceMonitors

3919

3920

serviceMonitorSelector: {}

3921

## Example which selects ServiceMonitors with label "prometheus" set to "somelabel"

3922

# serviceMonitorSelector:

3923

# matchLabels:

3924

# prometheus: somelabel

3925

3926

## Namespaces to be selected for ServiceMonitor discovery.

3927

3928

serviceMonitorNamespaceSelector: {}

3929

## Example which selects ServiceMonitors in namespaces with label "prometheus" set to "somelabel"

3930

# serviceMonitorNamespaceSelector:

3931

# matchLabels:

3932

# prometheus: somelabel

3933

3934

## If true, a nil or {} value for prometheus.prometheusSpec.podMonitorSelector will cause the

3935

## prometheus resource to be created with selectors based on values in the helm deployment,

3936

## which will also match the podmonitors created

3937

3938

podMonitorSelectorNilUsesHelmValues: true

3939

## PodMonitors to be selected for target discovery.

3940

## If {}, select all PodMonitors

3941

3942

podMonitorSelector: {}

3943

## Example which selects PodMonitors with label "prometheus" set to "somelabel"

3944

# podMonitorSelector:

3945

# matchLabels:

3946

# prometheus: somelabel

3947

3948

## If nil, select own namespace. Namespaces to be selected for PodMonitor discovery.

3949

podMonitorNamespaceSelector: {}

3950

## Example which selects PodMonitor in namespaces with label "prometheus" set to "somelabel"

3951

# podMonitorNamespaceSelector:

3952

# matchLabels:

3953

# prometheus: somelabel

3954

3955

## If true, a nil or {} value for prometheus.prometheusSpec.probeSelector will cause the

3956

## prometheus resource to be created with selectors based on values in the helm deployment,

3957

## which will also match the probes created

3958

3959

probeSelectorNilUsesHelmValues: true

3960

## Probes to be selected for target discovery.

3961

## If {}, select all Probes

3962

3963

probeSelector: {}

3964

## Example which selects Probes with label "prometheus" set to "somelabel"

3965

# probeSelector:

3966

# matchLabels:

3967

# prometheus: somelabel

3968

3969

## If nil, select own namespace. Namespaces to be selected for Probe discovery.

3970

probeNamespaceSelector: {}

3971

## Example which selects Probe in namespaces with label "prometheus" set to "somelabel"

3972

# probeNamespaceSelector:

3973

# matchLabels:

3974

# prometheus: somelabel

3975

3976

## If true, a nil or {} value for prometheus.prometheusSpec.scrapeConfigSelector will cause the

3977

## prometheus resource to be created with selectors based on values in the helm deployment,

3978

## which will also match the scrapeConfigs created

3979

3980

## If null and scrapeConfigSelector is also null, exclude field from the prometheusSpec

3981

## (keeping downward compatibility with older versions of CRD)

3982

3983

scrapeConfigSelectorNilUsesHelmValues: true

3984

## scrapeConfigs to be selected for target discovery.

3985

## If {}, select all scrapeConfigs

3986

3987

scrapeConfigSelector: {}

3988

## Example which selects scrapeConfigs with label "prometheus" set to "somelabel"

3989

# scrapeConfigSelector:

3990

# matchLabels:

3991

# prometheus: somelabel

3992

3993

## If nil, select own namespace. Namespaces to be selected for scrapeConfig discovery.

3994

## If null, exclude the field from the prometheusSpec (keeping downward compatibility with older versions of CRD)

3995

scrapeConfigNamespaceSelector: {}

3996

## Example which selects scrapeConfig in namespaces with label "prometheus" set to "somelabel"

3997

# scrapeConfigNamespaceSelector:

3998

# matchLabels:

3999

# prometheus: somelabel

4000

4001

## How long to retain metrics

4002

4003

retention: 10d

4004

## Maximum size of metrics

4005

## Unit format should be in the form of "50GiB"

4006

retentionSize: ""

4007

## Allow out-of-order/out-of-bounds samples ingested into Prometheus for a specified duration

4008

## See https://prometheus.io/docs/prometheus/latest/configuration/configuration/#tsdb

4009

tsdb:

4010

outOfOrderTimeWindow: 0s

4011

## Enable compression of the write-ahead log using Snappy.

4012

4013

walCompression: true

4014

## If true, the Operator won't process any Prometheus configuration changes

4015

4016

paused: false

4017

## Number of replicas of each shard to deploy for a Prometheus deployment.

4018

## Number of replicas multiplied by shards is the total number of Pods created.

4019

4020

replicas: 1

4021

## EXPERIMENTAL: Number of shards to distribute targets onto.

4022

## Number of replicas multiplied by shards is the total number of Pods created.

4023

## Note that scaling down shards will not reshard data onto remaining instances, it must be manually moved.

4024

## Increasing shards will not reshard data either but it will continue to be available from the same instances.

4025

## To query globally use Thanos sidecar and Thanos querier or remote write data to a central location.

4026

## Sharding is done on the content of the `__address__` target meta-label.

4027

## Set shards to null to omit spec.shards from the Prometheus custom resource (the operator then

4028

## defaults to 1 shard). Omitting the field lets an external autoscaler such as an HPA or a KEDA

4029

## ScaledObject own spec.shards through the /scale subresource without Helm reverting it.

4030

4031

shards: 1

4032

## Log level for Prometheus be configured in

4033

4034

logLevel: info

4035

## Log format for Prometheus be configured in

4036

4037

logFormat: logfmt

4038

## Prefix used to register routes, overriding externalUrl route.

4039

## Useful for proxies that rewrite URLs.

4040

4041

routePrefix: /

4042

## Standard object's metadata. More info: https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#metadata

4043

## Metadata Labels and Annotations gets propagated to the prometheus pods.

4044

4045

podMetadata: {}

4046

# labels:

4047

# app: prometheus

4048

# k8s-app: prometheus

4049

4050

## Pod anti-affinity can prevent the scheduler from placing Prometheus replicas on the same node.

4051

## The default value "soft" means that the scheduler should *prefer* to not schedule two replica pods onto the same node but no guarantee is provided.

4052

## The value "hard" means that the scheduler is *required* to not schedule two replica pods onto the same node.

4053

## The value "" will disable pod anti-affinity so that no anti-affinity rules will be configured.

4054

podAntiAffinity: "soft"

4055

## If anti-affinity is enabled sets the topologyKey to use for anti-affinity.

4056

## This can be changed to, for example, failure-domain.beta.kubernetes.io/zone

4057

4058

podAntiAffinityTopologyKey: kubernetes.io/hostname

4059

## Assign custom affinity rules to the prometheus instance

4060

## ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/

4061

4062

affinity: {}

4063

# nodeAffinity:

4064

# requiredDuringSchedulingIgnoredDuringExecution:

4065

# nodeSelectorTerms:

4066

# - matchExpressions:

4067

# - key: kubernetes.io/e2e-az-name

4068

# operator: In

4069

# values:

4070

# - e2e-az1

4071

# - e2e-az2

4072

4073

## The remote_read spec configuration for Prometheus.

4074

## ref: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api-reference/api.md#remotereadspec

4075

remoteRead: []

4076

# - url: http://remote1/read

4077

## additionalRemoteRead is appended to remoteRead

4078

additionalRemoteRead: []

4079

## The remote_write spec configuration for Prometheus.

4080

## ref: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api-reference/api.md#remotewritespec

4081

remoteWrite: []

4082

# - url: http://remote1/push

4083

## additionalRemoteWrite is appended to remoteWrite

4084

additionalRemoteWrite: []

4085

## Enable/Disable Grafana dashboards provisioning for prometheus remote write feature

4086

remoteWriteDashboards: false

4087

## Resource limits & requests

4088

4089

resources: {}

4090

# requests:

4091

# memory: 400Mi

4092

4093

## Prometheus StorageSpec for persistent data

4094

## ref: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/platform/storage.md

4095

4096

storageSpec: {}

4097

## Using PersistentVolumeClaim

4098

4099

# volumeClaimTemplate:

4100

# spec:

4101

# storageClassName: gluster

4102

# accessModes: ["ReadWriteOnce"]

4103

# resources:

4104

# requests:

4105

# storage: 50Gi

4106

# selector: {}

4107

4108

## Using tmpfs volume

4109

4110

# emptyDir:

4111

# medium: Memory

4112

4113

# Additional volumes on the output StatefulSet definition.

4114

volumes: []

4115

# Additional VolumeMounts on the output StatefulSet definition.

4116

volumeMounts: []

4117

## AdditionalScrapeConfigs allows specifying additional Prometheus scrape configurations. Scrape configurations

4118

## are appended to the configurations generated by the Prometheus Operator. Job configurations must have the form

4119

## as specified in the official Prometheus documentation:

4120

## https://prometheus.io/docs/prometheus/latest/configuration/configuration/#scrape_config. As scrape configs are

4121

## appended, the user is responsible to make sure it is valid. Note that using this feature may expose the possibility

4122

## to break upgrades of Prometheus. It is advised to review Prometheus release notes to ensure that no incompatible

4123

## scrape configs are going to break Prometheus after the upgrade.

4124

## AdditionalScrapeConfigs can be defined as a list or as a templated string.

4125

4126

## The scrape configuration example below will find master nodes, provided they have the name .*mst.*, relabel the

4127

## port to 2379 and allow etcd scraping provided it is running on all Kubernetes master nodes

4128

4129

additionalScrapeConfigs: []

4130

# - job_name: kube-etcd

4131

# kubernetes_sd_configs:

4132

# - role: node

4133

# scheme: https

4134

# tls_config:

4135

# ca_file: /etc/prometheus/secrets/etcd-client-cert/etcd-ca

4136

# cert_file: /etc/prometheus/secrets/etcd-client-cert/etcd-client

4137

# key_file: /etc/prometheus/secrets/etcd-client-cert/etcd-client-key

4138

# relabel_configs:

4139

# - action: labelmap

4140

# regex: __meta_kubernetes_node_label_(.+)

4141

# - source_labels: [__address__]

4142

# action: replace

4143

# target_label: __address__

4144

# regex: ([^:;]+):(\d+)

4145

# replacement: ${1}:2379

4146

# - source_labels: [__meta_kubernetes_node_name]

4147

# action: keep

4148

# regex: .*mst.*

4149

# - source_labels: [__meta_kubernetes_node_name]

4150

# action: replace

4151

# target_label: node

4152

# regex: (.*)

4153

# replacement: ${1}

4154

# metric_relabel_configs:

4155

4156

# action: labeldrop

4157

4158

## If scrape config contains a repetitive section, you may want to use a template.

4159

## In the following example, you can see how to define `gce_sd_configs` for multiple zones

4160

# additionalScrapeConfigs: |

4161

# - job_name: "node-exporter"

4162

# gce_sd_configs:

4163

# {{range $zone := .Values.gcp_zones}}

4164

# - project: "project1"

4165

# zone: "{{$zone}}"

4166

# port: 9100

4167

# {{end}}

4168

# relabel_configs:

4169

# ...

4170

4171

## If additional scrape configurations are already deployed in a single secret file you can use this section.

4172

## Expected values are the secret name and key

4173

## Cannot be used with additionalScrapeConfigs

4174

additionalScrapeConfigsSecret: {}

4175

# enabled: false

4176

# name:

4177

# key:

4178

4179

## additionalPrometheusSecretsAnnotations allows to add annotations to the kubernetes secret. This can be useful

4180

## when deploying via spinnaker to disable versioning on the secret, strategy.spinnaker.io/versioned: 'false'

4181

additionalPrometheusSecretsAnnotations: {}

4182

## AdditionalAlertManagerConfigs allows for manual configuration of alertmanager jobs in the form as specified

4183

## in the official Prometheus documentation https://prometheus.io/docs/prometheus/latest/configuration/configuration/#alertmanager_config.

4184

## AlertManager configurations specified are appended to the configurations generated by the Prometheus Operator.

4185

## As AlertManager configs are appended, the user is responsible to make sure it is valid. Note that using this

4186

## feature may expose the possibility to break upgrades of Prometheus. It is advised to review Prometheus release

4187

## notes to ensure that no incompatible AlertManager configs are going to break Prometheus after the upgrade.

4188

4189

additionalAlertManagerConfigs: []

4190

# - consul_sd_configs:

4191

# - server: consul.dev.test:8500

4192

# scheme: http

4193

# datacenter: dev

4194

# tag_separator: ','

4195

# services:

4196

# - metrics-prometheus-alertmanager

4197

4198

## If additional alertmanager configurations are already deployed in a single secret, or you want to manage

4199

## them separately from the helm deployment, you can use this section.

4200

## Expected values are the secret name and key

4201

## Cannot be used with additionalAlertManagerConfigs

4202

additionalAlertManagerConfigsSecret: {}

4203

# name:

4204

# key:

4205

# optional: false

4206

4207

## AdditionalAlertRelabelConfigs allows specifying Prometheus alert relabel configurations. Alert relabel configurations specified are appended

4208

## to the configurations generated by the Prometheus Operator. Alert relabel configurations specified must have the form as specified in the

4209

## official Prometheus documentation: https://prometheus.io/docs/prometheus/latest/configuration/configuration/#alert_relabel_configs.

4210

## As alert relabel configs are appended, the user is responsible to make sure it is valid. Note that using this feature may expose the

4211

## possibility to break upgrades of Prometheus. It is advised to review Prometheus release notes to ensure that no incompatible alert relabel

4212

## configs are going to break Prometheus after the upgrade.

4213

4214

additionalAlertRelabelConfigs: []

4215

# - separator: ;

4216

# regex: prometheus_replica

4217

# replacement: $1

4218

# action: labeldrop

4219

4220

## If additional alert relabel configurations are already deployed in a single secret, or you want to manage

4221

## them separately from the helm deployment, you can use this section.

4222

## Expected values are the secret name and key

4223

## Cannot be used with additionalAlertRelabelConfigs

4224

additionalAlertRelabelConfigsSecret: {}

4225

# name:

4226

# key:

4227

4228

## SecurityContext holds pod-level security attributes and common container settings.

4229

## This defaults to non root user with uid 1000 and gid 2000.

4230

## https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api-reference/api.md

4231

4232

securityContext:

4233

runAsGroup: 2000

4234

runAsNonRoot: true

4235

runAsUser: 1000

4236

fsGroup: 2000

4237

seccompProfile:

4238

type: RuntimeDefault

4239

## DNS configuration for Prometheus.

4240

## ref: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api-reference/api.md#monitoring.coreos.com/v1.PodDNSConfig

4241

dnsConfig: {}

4242

## DNS policy for Prometheus.

4243

## ref: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api-reference/api.md#dnspolicystring-alias

4244

dnsPolicy: ""

4245

## Priority class assigned to the Pods

4246

4247

priorityClassName: ""

4248

## Thanos configuration allows configuring various aspects of a Prometheus server in a Thanos environment.

4249

## This section is experimental, it may change significantly without deprecation notice in any release.

4250

## This is experimental and may change significantly without backward compatibility in any release.

4251

## ref: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api-reference/api.md#thanosspec

4252

4253

thanos: {}

4254

# image: quay.io/thanos/thanos

4255

# secretProviderClass:

4256

# provider: gcp

4257

# parameters:

4258

# secrets: |

4259

# - resourceName: "projects/$PROJECT_ID/secrets/testsecret/versions/latest"

4260

# fileName: "objstore.yaml"

4261

## ObjectStorageConfig configures object storage in Thanos.

4262

# objectStorageConfig:

4263

# # use existing secret, if configured, objectStorageConfig.secret will not be used

4264

# existingSecret: {}

4265

# # name: ""

4266

# # key: ""

4267

# # will render objectStorageConfig secret data and configure it to be used by Thanos custom resource,

4268

# # ignored when prometheusspec.thanos.objectStorageConfig.existingSecret is set

4269

# # https://thanos.io/tip/thanos/storage.md/#s3

4270

# secret: {}

4271

# # type: S3

4272

# # config:

4273

# # bucket: ""

4274

# # endpoint: ""

4275

# # region: ""

4276

# # access_key: ""

4277

# # secret_key: ""

4278

4279

## Containers allows injecting additional containers. This is meant to allow adding an authentication proxy to a Prometheus pod.

4280

## if using proxy extraContainer update targetPort with proxy container port

4281

containers: []

4282

# containers:

4283

# - name: oauth-proxy

4284

# image: quay.io/oauth2-proxy/oauth2-proxy:v7.15.3

4285

# args:

4286

# - --upstream=http://127.0.0.1:9090

4287

# - --http-address=0.0.0.0:8081

4288

# - --metrics-address=0.0.0.0:8082

4289

# - ...

4290

# ports:

4291

# - containerPort: 8081

4292

# name: oauth-proxy

4293

# protocol: TCP

4294

# - containerPort: 8082

4295

# name: oauth-metrics

4296

# protocol: TCP

4297

# resources: {}

4298

4299

## InitContainers allows injecting additional initContainers. This is meant to allow doing some changes

4300

## (permissions, dir tree) on mounted volumes before starting prometheus

4301

initContainers: []

4302

## PortName to use for Prometheus.

4303

4304

portName: "http-web"

4305

## ArbitraryFSAccessThroughSMs configures whether configuration based on a service monitor can access arbitrary files

4306

## on the file system of the Prometheus container e.g. bearer token files.

4307

arbitraryFSAccessThroughSMs: false

4308

## OverrideHonorLabels if set to true overrides all user configured honor_labels. If HonorLabels is set in ServiceMonitor

4309

## or PodMonitor to true, this overrides honor_labels to false.

4310

overrideHonorLabels: false

4311

## OverrideHonorTimestamps allows to globally enforce honoring timestamps in all scrape configs.

4312

overrideHonorTimestamps: false

4313

## When ignoreNamespaceSelectors is set to true, namespaceSelector from all PodMonitor, ServiceMonitor and Probe objects will be ignored,

4314

## they will only discover targets within the namespace of the PodMonitor, ServiceMonitor and Probe object,

4315

## and servicemonitors will be installed in the default service namespace.

4316

## Defaults to false.

4317

ignoreNamespaceSelectors: false

4318

## EnforcedNamespaceLabel enforces adding a namespace label of origin for each alert and metric that is user created.

4319

## The label value will always be the namespace of the object that is being created.

4320

## Disabled by default

4321

enforcedNamespaceLabel: ""

4322

## PrometheusRulesExcludedFromEnforce - list of prometheus rules to be excluded from enforcing of adding namespace labels.

4323

## Works only if enforcedNamespaceLabel set to true. Make sure both ruleNamespace and ruleName are set for each pair

4324

## Deprecated, use `excludedFromEnforcement` instead

4325

prometheusRulesExcludedFromEnforce: []

4326

## ExcludedFromEnforcement - list of object references to PodMonitor, ServiceMonitor, Probe and PrometheusRule objects

4327

## to be excluded from enforcing a namespace label of origin.

4328

## Works only if enforcedNamespaceLabel set to true.

4329

## See https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api-reference/api.md#objectreference

4330

excludedFromEnforcement: []

4331

## QueryLogFile specifies the file to which PromQL queries are logged. Note that this location must be writable,

4332

## and can be persisted using an attached volume. Alternatively, the location can be set to a stdout location such

4333

## as /dev/stdout to log querie information to the default Prometheus log stream. This is only available in versions

4334

## of Prometheus >= 2.16.0. For more details, see the Prometheus docs (https://prometheus.io/docs/guides/query-log/)

4335

queryLogFile: false

4336

# Use to set global sample_limit for Prometheus. This act as default SampleLimit for ServiceMonitor or/and PodMonitor.

4337

# Set to 'false' to disable global sample_limit. or set to a number to override the default value.

4338

sampleLimit: false

4339

## TargetLimit defines a global limit on the number of scraped targets. 0 means no limit.

4340

targetLimit: 0

4341

## Per-scrape limit on number of labels that will be accepted for a sample. 0 means no limit.

4342

labelLimit: 0

4343

## Per-scrape limit on length of labels name that will be accepted for a sample. 0 means no limit.

4344

labelNameLengthLimit: 0

4345

## Per-scrape limit on length of labels value that will be accepted for a sample. 0 means no limit.

4346

labelValueLengthLimit: 0

4347

## Per-scrape limit on the number of targets dropped by relabeling that will be kept in memory. 0 means no limit.

4348

keepDroppedTargets: 0

4349

## BodySizeLimit defines a global limit on the size of uncompressed response body that will be accepted. Example: 100MB.

4350

bodySizeLimit: ""

4351

## EnforcedBodySizeLimit defines the maximum size of uncompressed response body that will be accepted, overriding any

4352

## value set per ServiceMonitor/PodMonitor. Example: 100MB. Empty means no limit.

4353

enforcedBodySizeLimit: ""

4354

# EnforcedKeepDroppedTargetsLimit defines on the number of targets dropped by relabeling that will be kept in memory.

4355

# The value overrides any spec.keepDroppedTargets set by ServiceMonitor, PodMonitor, Probe objects unless spec.keepDroppedTargets

4356

# is greater than zero and less than spec.enforcedKeepDroppedTargets. 0 means no limit.

4357

enforcedKeepDroppedTargets: 0

4358

## EnforcedSampleLimit defines global limit on number of scraped samples that will be accepted. This overrides any SampleLimit

4359

## set per ServiceMonitor or/and PodMonitor. It is meant to be used by admins to enforce the SampleLimit to keep overall

4360

## number of samples/series under the desired limit. Note that if SampleLimit is lower that value will be taken instead.

4361

enforcedSampleLimit: false

4362

## EnforcedTargetLimit defines a global limit on the number of scraped targets. This overrides any TargetLimit set

4363

## per ServiceMonitor or/and PodMonitor. It is meant to be used by admins to enforce the TargetLimit to keep the overall

4364

## number of targets under the desired limit. Note that if TargetLimit is lower, that value will be taken instead, except

4365

## if either value is zero, in which case the non-zero value will be used. If both values are zero, no limit is enforced.

4366

enforcedTargetLimit: false

4367

## Per-scrape limit on number of labels that will be accepted for a sample. If more than this number of labels are present

4368

## post metric-relabeling, the entire scrape will be treated as failed. 0 means no limit. Only valid in Prometheus versions

4369

## 2.27.0 and newer.

4370

enforcedLabelLimit: false

4371

## Per-scrape limit on length of labels name that will be accepted for a sample. If a label name is longer than this number

4372

## post metric-relabeling, the entire scrape will be treated as failed. 0 means no limit. Only valid in Prometheus versions

4373

## 2.27.0 and newer.

4374

enforcedLabelNameLengthLimit: false

4375

## Per-scrape limit on length of labels value that will be accepted for a sample. If a label value is longer than this

4376

## number post metric-relabeling, the entire scrape will be treated as failed. 0 means no limit. Only valid in Prometheus

4377

## versions 2.27.0 and newer.

4378

enforcedLabelValueLengthLimit: false

4379

## AllowOverlappingBlocks enables vertical compaction and vertical query merge in Prometheus. This is still experimental

4380

## in Prometheus so it may change in any upcoming release.

4381

allowOverlappingBlocks: false

4382

## Specifies the validation scheme for metric and label names.

4383

## Supported values are: Legacy, UTF8

4384

nameValidationScheme: ""

4385

## Minimum number of seconds for which a newly created pod should be ready without any of its container crashing for it to

4386

## be considered available. Defaults to 0 (pod will be considered available as soon as it is ready).

4387

minReadySeconds: 0

4388

## Duration in seconds the pod needs to terminate gracefully.

4389

## ref: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle/#pod-termination

4390

terminationGracePeriodSeconds: ~

4391

# Required for use in managed kubernetes clusters (such as AWS EKS) with custom CNI (such as calico),

4392

# because control-plane managed by AWS cannot communicate with pods' IP CIDR and admission webhooks are not working

4393

# Use the host's network namespace if true. Make sure to understand the security implications if you want to enable it.

4394

# When hostNetwork is enabled, this will set dnsPolicy to ClusterFirstWithHostNet automatically.

4395

hostNetwork: false

4396

## Use the host's user namespace for Prometheus pods.

4397

## ref: https://kubernetes.io/docs/tasks/configure-pod-container/user-namespaces/

4398

hostUsers: ~

4399

# HostAlias holds the mapping between IP and hostnames that will be injected

4400

# as an entry in the pod's hosts file.

4401

hostAliases: []

4402

# - ip: 10.10.0.100

4403

# hostnames:

4404

# - a1.app.local

4405

# - b1.app.local

4406

4407

## TracingConfig configures tracing in Prometheus.

4408

## See https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api-reference/api.md#prometheustracingconfig

4409

tracingConfig: {}

4410

## Defines the service discovery role used to discover targets from ServiceMonitor objects and Alertmanager endpoints.

4411

## If set, the value should be either "Endpoints" or "EndpointSlice". If unset, the operator assumes the "Endpoints" role.

4412

serviceDiscoveryRole: ""

4413

## EnableServiceLinks indicates whether information about services should be injected into the pod's environment

4414

## variables. Uses the operator/Kubernetes default when left unset (~).

4415

enableServiceLinks: ~

4416

## Set the scheduler name to use for the Prometheus pods.

4417

schedulerName: ""

4418

## Specifies the character escaping scheme applied to metric and label names.

4419

## Supported values are: AllowUTF8, Underscores, Dots, Values

4420

nameEscapingScheme: ""

4421

## Defines the strategy used to reload the Prometheus configuration.

4422

## Supported values are: HTTP, ProcessSignal

4423

reloadStrategy: ""

4424

## Defines the offset the rule evaluation timestamp of the rule evaluation queries is shifted backwards.

4425

## ref: https://github.com/prometheus-community/helm-charts/issues/5843

4426

ruleQueryOffset: ""

4427

## RuntimeConfig configures the values for the Prometheus process behavior.

4428

runtime: {}

4429

# goGC: 75

4430

4431

## Defines the sharding strategy applied by the operator.

4432

## ref: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api-reference/api.md#monitoring.coreos.com/v1.ShardingStrategy

4433

shardingStrategy: {}

4434

## Defines the retention policy for the resources of stale shards after a scale-down.

4435

## ref: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api-reference/api.md#monitoring.coreos.com/v1.ShardRetentionPolicy

4436

shardRetentionPolicy: {}

4437

## List of the protobuf message versions to accept when receiving the remote writes. Example: [V1.0, V2.0].

4438

remoteWriteReceiverMessageVersions: []

4439

## Pod management policy. Kubernetes default is OrderedReady but prometheus-operator default is Parallel.

4440

## ref: https://kubernetes.io/docs/concepts/workloads/controllers/statefulset/#pod-management-policies

4441

podManagementPolicy: ""

4442

## Update strategy for the StatefulSet.

4443

## ref: https://kubernetes.io/docs/concepts/workloads/controllers/statefulset/#update-strategies

4444

updateStrategy: {}

4445

# type: RollingUpdate

4446

# rollingUpdate:

4447

# maxUnavailable: 1

4448

4449

## Additional configuration which is not covered by the properties above. (passed through tpl)

4450

additionalConfig: {}

4451

## Additional configuration which is not covered by the properties above.

4452

## Useful, if you need advanced templating inside alertmanagerSpec.

4453

## Otherwise, use prometheus.prometheusSpec.additionalConfig (passed through tpl)

4454

additionalConfigString: ""

4455

## Defines the maximum time that the `prometheus` container's startup probe

4456

## will wait before being considered failed. The startup probe will return

4457

## success after the WAL replay is complete. If set, the value should be

4458

## greater than 60 (seconds). Otherwise it will be equal to 900 seconds (15

4459

## minutes).

4460

maximumStartupDurationSeconds: 0

4461

## Set default scrapeProtocols for Prometheus instances

4462

## https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api-reference/api.md#scrapeprotocolstring-alias

4463

scrapeProtocols: []

4464

additionalRulesForClusterRole: []

4465

# - apiGroups: [ "" ]

4466

# resources:

4467

# - nodes/proxy

4468

# verbs: [ "get", "list", "watch" ]

4469

4470

additionalServiceMonitors: []

4471

## Name of the ServiceMonitor to create

4472

4473

# - name: ""

4474

4475

## Additional labels to set used for the ServiceMonitorSelector. Together with standard labels from

4476

## the chart

4477

4478

# additionalLabels: {}

4479

4480

## Service label for use in assembling a job name of the form <label value>-<port>

4481

## If no label is specified, the service name is used.

4482

4483

# jobLabel: ""

4484

4485

## labels to transfer from the kubernetes service to the target

4486

4487

# targetLabels: []

4488

4489

## labels to transfer from the kubernetes pods to the target

4490

4491

# podTargetLabels: []

4492

4493

## Label selector for services to which this ServiceMonitor applies

4494

4495

# selector: {}

4496

## Example which selects all services to be monitored

4497

## with label "monitoredby" with values any of "example-service-1" or "example-service-2"

4498

# matchExpressions:

4499

# - key: "monitoredby"

4500

# operator: In

4501

# values:

4502

# - example-service-1

4503

# - example-service-2

4504

4505

## label selector for services

4506

4507

# matchLabels: {}

4508

4509

## Namespaces from which services are selected

4510

4511

# namespaceSelector:

4512

## Match any namespace

4513

4514

# any: false

4515

4516

## Explicit list of namespace names to select

4517

4518

# matchNames: []

4519

4520

## Endpoints of the selected service to be monitored

4521

4522

# endpoints: []

4523

## Name of the endpoint's service port

4524

## Mutually exclusive with targetPort

4525

# - port: ""

4526

4527

## Name or number of the endpoint's target port

4528

## Mutually exclusive with port

4529

# - targetPort: ""

4530

4531

## File containing bearer token to be used when scraping targets

4532

4533

# bearerTokenFile: ""

4534

4535

## Interval at which metrics should be scraped

4536

4537

# interval: 30s

4538

4539

## HTTP path to scrape for metrics

4540

4541

# path: /metrics

4542

4543

## HTTP scheme to use for scraping

4544

4545

# scheme: http

4546

4547

## TLS configuration to use when scraping the endpoint

4548

4549

# tlsConfig:

4550

4551

## Path to the CA file

4552

4553

# caFile: ""

4554

4555

## Path to client certificate file

4556

4557

# certFile: ""

4558

4559

## Skip certificate verification

4560

4561

# insecureSkipVerify: false

4562

4563

## Path to client key file

4564

4565

# keyFile: ""

4566

4567

## Server name used to verify host name

4568

4569

# serverName: ""

4570

4571

## MetricRelabelConfigs to apply to samples after scraping, but before ingestion.

4572

## ref: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api-reference/api.md#relabelconfig

4573

4574

# metricRelabelings: []

4575

# - action: keep

4576

4577

# sourceLabels: [__name__]

4578

4579

## RelabelConfigs to apply to samples before scraping

4580

## ref: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api-reference/api.md#relabelconfig

4581

4582

# relabelings: []

4583

# - sourceLabels: [__meta_kubernetes_pod_node_name]

4584

# separator: ;

4585

# regex: ^(.*)$

4586

# targetLabel: nodename

4587

# replacement: $1

4588

# action: replace

4589

4590

## Fallback scrape protocol used by Prometheus for scraping metrics

4591

## ref: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api-reference/api.md#monitoring.coreos.com/v1.ScrapeProtocol

4592

4593

# fallbackScrapeProtocol: ""

4594

4595

## Attaches node metadata to the discovered targets

4596

## ref: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api-reference/api.md#monitoring.coreos.com/v1.AttachMetadata

4597

4598

# attachMetadata:

4599

# node: true

4600

additionalPodMonitors: []

4601

## Name of the PodMonitor to create

4602

4603

# - name: ""

4604

## Additional labels to set used for the PodMonitorSelector. Together with standard labels from

4605

## the chart

4606

4607

# additionalLabels: {}

4608

4609

## Pod label for use in assembling a job name of the form <label value>-<port>

4610

## If no label is specified, the pod endpoint name is used.

4611

4612

# jobLabel: ""

4613

4614

## Label selector for pods to which this PodMonitor applies

4615

4616

# selector: {}

4617

## Example which selects all Pods to be monitored

4618

## with label "monitoredby" with values any of "example-pod-1" or "example-pod-2"

4619

# matchExpressions:

4620

# - key: "monitoredby"

4621

# operator: In

4622

# values:

4623

# - example-pod-1

4624

# - example-pod-2

4625

4626

## label selector for pods

4627

4628

# matchLabels: {}

4629

4630

## PodTargetLabels transfers labels on the Kubernetes Pod onto the target.

4631

4632

# podTargetLabels: {}

4633

4634

## SampleLimit defines per-scrape limit on number of scraped samples that will be accepted.

4635

4636

# sampleLimit: 0

4637

4638

## Namespaces from which pods are selected

4639

4640

# namespaceSelector:

4641

## Match any namespace

4642

4643

# any: false

4644

4645

## Explicit list of namespace names to select

4646

4647

# matchNames: []

4648

4649

## Endpoints of the selected pods to be monitored

4650

## https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api-reference/api.md#podmetricsendpoint

4651

4652

# podMetricsEndpoints: []

4653

4654

## Fallback scrape protocol used by Prometheus for scraping metrics

4655

## ref: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api-reference/api.md#monitoring.coreos.com/v1.ScrapeProtocol

4656

4657

# fallbackScrapeProtocol: ""

4658

4659

## Attaches node metadata to the discovered targets

4660

## ref: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api-reference/api.md#monitoring.coreos.com/v1.AttachMetadata

4661

4662

# attachMetadata:

4663

# node: true

4664

4665

## Configuration for thanosRuler

4666

## ref: https://thanos.io/tip/components/rule.md/

4667

4668

thanosRuler:

4669

## Deploy thanosRuler

4670

4671

enabled: false

4672

## Annotations for ThanosRuler

4673

4674

annotations: {}

4675

## Service account for ThanosRuler to use.

4676

## ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/

4677

4678

serviceAccount:

4679

create: true

4680

4681

annotations: {}

4682

## Configure pod disruption budgets for ThanosRuler

4683

## ref: https://kubernetes.io/docs/tasks/run-application/configure-pdb/#specifying-a-poddisruptionbudget

4684

4685

podDisruptionBudget:

4686

enabled: false

4687

minAvailable: 1

4688

# maxUnavailable: ""

4689

unhealthyPodEvictionPolicy: AlwaysAllow

4690

ingress:

4691

enabled: false

4692

ingressClassName: ""

4693

annotations: {}

4694

labels: {}

4695

## Hosts must be provided if Ingress is enabled.

4696

4697

hosts: []

4698

# - thanosruler.domain.com

4699

4700

## Paths to use for ingress rules - one path should match the thanosruler.routePrefix

4701

4702

paths: []

4703

# - /

4704

4705

## For Kubernetes >= 1.18 you should specify the pathType (determines how Ingress paths should be matched)

4706

## See https://kubernetes.io/blog/2020/04/02/improvements-to-the-ingress-api-in-kubernetes-1.18/#better-path-matching-with-path-types

4707

# pathType: ImplementationSpecific

4708

4709

## TLS configuration for ThanosRuler Ingress

4710

## Secret must be manually created in the namespace

4711

4712

tls: []

4713

# - secretName: thanosruler-general-tls

4714

# hosts:

4715

# - thanosruler.example.com

4716

# -- BETA: Configure the gateway routes for the chart here.

4717

# More routes can be added by adding a dictionary key like the 'main' route.

4718

# Be aware that this is an early beta of this feature,

4719

# kube-prometheus-stack does not guarantee this works and is subject to change.

4720

# Being BETA this can/will change in the future without notice, do not use unless you want to take that risk

4721

# [[ref]](https://gateway-api.sigs.k8s.io/reference/spec/#gateway.networking.k8s.io%2fv1alpha2)

4722

route:

4723

main:

4724

# -- Enables or disables the route

4725

enabled: false

4726

# -- Set the route apiVersion, e.g. gateway.networking.k8s.io/v1 or gateway.networking.k8s.io/v1alpha2

4727

apiVersion: gateway.networking.k8s.io/v1

4728

# -- Set the route kind

4729

# Valid options are GRPCRoute, HTTPRoute, TCPRoute, TLSRoute, UDPRoute

4730

kind: HTTPRoute

4731

annotations: {}

4732

labels: {}

4733

hostnames: []

4734

# - my-filter.example.com

4735

parentRefs: []

4736

# - name: acme-gw

4737

4738

# -- create http route for redirect (https://gateway-api.sigs.k8s.io/guides/http-redirect-rewrite/#http-to-https-redirects)

4739

## Take care that you only enable this on the http listener of the gateway to avoid an infinite redirect.

4740

## matches, filters and additionalRules will be ignored if this is set to true. Be are

4741

httpsRedirect: false

4742

matches:

4743

- path:

4744

type: PathPrefix

4745

value: /

4746

## Filters define the filters that are applied to requests that match this rule.

4747

filters: []

4748

## Session persistence configuration for the route rule.

4749

sessionPersistence: {}

4750

# sessionName: route

4751

# type: Cookie

4752

# absoluteTimeout: 12h

4753

# cookieConfig:

4754

# lifetimeType: Permanent

4755

4756

## Additional custom rules that can be added to the route

4757

additionalRules: []

4758

## Configuration for ThanosRuler service

4759

4760

service:

4761

enabled: true

4762

annotations: {}

4763

labels: {}

4764

clusterIP: ""

4765

ipDualStack:

4766

enabled: false

4767

ipFamilies: ["IPv6", "IPv4"]

4768

ipFamilyPolicy: "PreferDualStack"

4769

## Port for ThanosRuler Service to listen on

4770

4771

port: 10902

4772

## To be used with a proxy extraContainer port

4773

4774

targetPort: 10902

4775

## Port to expose on each node

4776

## Only used if service.type is 'NodePort'

4777

4778

nodePort: 30905

4779

## List of IP addresses at which the Prometheus server service is available

4780

## Ref: https://kubernetes.io/docs/concepts/services-networking/service/#external-ips

4781

4782

4783

## Additional ports to open for ThanosRuler service

4784

additionalPorts: []

4785

externalIPs: []

4786

loadBalancerIP: ""

4787

loadBalancerSourceRanges: []

4788

## Denotes if this Service desires to route external traffic to node-local or cluster-wide endpoints

4789

4790

externalTrafficPolicy: Cluster

4791

## Service type

4792

4793

type: ClusterIP

4794

## Configuration for creating a ServiceMonitor for the ThanosRuler service

4795

4796

serviceMonitor:

4797

## If true, create a serviceMonitor for thanosRuler

4798

4799

selfMonitor: true

4800

## Scrape interval. If not set, the Prometheus default scrape interval is used.

4801

4802

interval: ""

4803

## Additional labels

4804

4805

additionalLabels: {}

4806

## SampleLimit defines per-scrape limit on number of scraped samples that will be accepted.

4807

4808

sampleLimit: 0

4809

## TargetLimit defines a limit on the number of scraped targets that will be accepted.

4810

4811

targetLimit: 0

4812

## Per-scrape limit on number of labels that will be accepted for a sample. Only valid in Prometheus versions 2.27.0 and newer.

4813

4814

labelLimit: 0

4815

## Per-scrape limit on length of labels name that will be accepted for a sample. Only valid in Prometheus versions 2.27.0 and newer.

4816

4817

labelNameLengthLimit: 0

4818

## Per-scrape limit on length of labels value that will be accepted for a sample. Only valid in Prometheus versions 2.27.0 and newer.

4819

4820

labelValueLengthLimit: 0

4821

## proxyUrl: URL of a proxy that should be used for scraping.

4822

4823

proxyUrl: ""

4824

## scheme: HTTP scheme to use for scraping. Can be used with `tlsConfig` for example if using istio mTLS.

4825

scheme: ""

4826

## tlsConfig: TLS configuration to use when scraping the endpoint. For example if using istio mTLS.

4827

## Of type: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api-reference/api.md#tlsconfig

4828

tlsConfig: {}

4829

bearerTokenFile:

4830

## MetricRelabelConfigs to apply to samples after scraping, but before ingestion.

4831

## ref: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api-reference/api.md#relabelconfig

4832

4833

metricRelabelings: []

4834

# - action: keep

4835

4836

# sourceLabels: [__name__]

4837

4838

## RelabelConfigs to apply to samples before scraping

4839

## ref: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api-reference/api.md#relabelconfig

4840

4841

relabelings: []

4842

# - sourceLabels: [__meta_kubernetes_pod_node_name]

4843

# separator: ;

4844

# regex: ^(.*)$

4845

# targetLabel: nodename

4846

# replacement: $1

4847

# action: replace

4848

4849

## Additional Endpoints

4850

4851

additionalEndpoints: []

4852

# - port: oauth-metrics

4853

# path: /metrics

4854

## Settings affecting thanosRulerpec

4855

## ref: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api-reference/api.md#thanosrulerspec

4856

4857

thanosRulerSpec:

4858

## Standard object's metadata. More info: https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#metadata

4859

## Metadata Labels and Annotations gets propagated to the ThanosRuler pods.

4860

4861

podMetadata: {}

4862

4863

serviceName:

4864

## Image of ThanosRuler

4865

4866

image:

4867

registry: cgr.dev

4868

repository: scratch-images/test-tmp/thanos

4869

tag: 0.42.4-r0

4870

sha: sha256:9d6a1276c8426c91a524c82a34c6a36f22ceb478f3658e471234915971ae7253

4871

## Namespaces to be selected for PrometheusRules discovery.

4872

## If nil, select own namespace. Namespaces to be selected for ServiceMonitor discovery.

4873

## See https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api-reference/api.md#namespaceselector for usage

4874

4875

ruleNamespaceSelector: {}

4876

## If true, a nil or {} value for thanosRuler.thanosRulerSpec.ruleSelector will cause the

4877

## prometheus resource to be created with selectors based on values in the helm deployment,

4878

## which will also match the PrometheusRule resources created

4879

4880

ruleSelectorNilUsesHelmValues: true

4881

## PrometheusRules to be selected for target discovery.

4882

## If {}, select all PrometheusRules

4883

4884

ruleSelector: {}

4885

## Example which select all PrometheusRules resources

4886

## with label "prometheus" with values any of "example-rules" or "example-rules-2"

4887

# ruleSelector:

4888

# matchExpressions:

4889

# - key: prometheus

4890

# operator: In

4891

# values:

4892

# - example-rules

4893

# - example-rules-2

4894

4895

## Example which select all PrometheusRules resources with label "role" set to "example-rules"

4896

# ruleSelector:

4897

# matchLabels:

4898

# role: example-rules

4899

4900

## Define Log Format

4901

# Use logfmt (default) or json logging

4902

logFormat: logfmt

4903

## Log level for ThanosRuler to be configured with.

4904

4905

logLevel: info

4906

## Size is the expected size of the thanosRuler cluster. The controller will eventually make the size of the

4907

## running cluster equal to the expected size.

4908

replicas: 1

4909

## Time duration ThanosRuler shall retain data for. Default is '24h', and must match the regular expression

4910

## [0-9]+(ms|s|m|h) (milliseconds seconds minutes hours).

4911

4912

retention: 24h

4913

## Interval between consecutive evaluations.

4914

4915

evaluationInterval: ""

4916

## Storage is the definition of how storage will be used by the ThanosRuler instances.

4917

## ref: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/platform/storage.md

4918

4919

storage: {}

4920

# volumeClaimTemplate:

4921

# spec:

4922

# storageClassName: gluster

4923

# accessModes: ["ReadWriteOnce"]

4924

# resources:

4925

# requests:

4926

# storage: 50Gi

4927

# selector: {}

4928

4929

## AlertmanagerConfig define configuration for connecting to alertmanager.

4930

## Only available with Thanos v0.10.0 and higher. Maps to the alertmanagers.config Thanos Ruler arg.

4931

alertmanagersConfig:

4932

# use existing secret, if configured, alertmanagersConfig.secret will not be used

4933

existingSecret: {}

4934

# name: ""

4935

# key: ""

4936

# will render alertmanagersConfig secret data and configure it to be used by Thanos Ruler custom resource, ignored when alertmanagersConfig.existingSecret is set

4937

# https://thanos.io/tip/components/rule.md/#alertmanager

4938

secret: {}

4939

# alertmanagers:

4940

# - api_version: v2

4941

# http_config:

4942

# basic_auth:

4943

# username: some_user

4944

# password: some_pass

4945

# static_configs:

4946

# - alertmanager.thanos.io

4947

# scheme: http

4948

# timeout: 10s

4949

## DEPRECATED. Define URLs to send alerts to Alertmanager. For Thanos v0.10.0 and higher, alertmanagersConfig should be used instead.

4950

## Note: this field will be ignored if alertmanagersConfig is specified. Maps to the alertmanagers.url Thanos Ruler arg.

4951

# alertmanagersUrl:

4952

4953

## The external URL the Thanos Ruler instances will be available under. This is necessary to generate correct URLs. This is necessary if Thanos Ruler is not served from root of a DNS name. string false

4954

4955

externalPrefix:

4956

## If true, http://{{ template "kube-prometheus-stack.thanosRuler.name" . }}.{{ template "kube-prometheus-stack.namespace" . }}:{{ .Values.thanosRuler.service.port }}

4957

## will be used as value for externalPrefix

4958

externalPrefixNilUsesHelmValues: true

4959

## The route prefix ThanosRuler registers HTTP handlers for. This is useful, if using ExternalURL and a proxy is rewriting HTTP routes of a request, and the actual ExternalURL is still true,

4960

## but the server serves requests under a different route prefix. For example for use with kubectl proxy.

4961

4962

routePrefix: /

4963

## ObjectStorageConfig configures object storage in Thanos

4964

objectStorageConfig:

4965

# use existing secret, if configured, objectStorageConfig.secret will not be used

4966

existingSecret: {}

4967

# name: ""

4968

# key: ""

4969

# will render objectStorageConfig secret data and configure it to be used by Thanos Ruler custom resource, ignored when objectStorageConfig.existingSecret is set

4970

# https://thanos.io/tip/thanos/storage.md/#s3

4971

secret: {}

4972

# type: S3

4973

# config:

4974

# bucket: ""

4975

# endpoint: ""

4976

# region: ""

4977

# access_key: ""

4978

# secret_key: ""

4979

## Labels by name to drop before sending to alertmanager

4980

## Maps to the --alert.label-drop flag of thanos ruler.

4981

alertDropLabels: []

4982

## QueryEndpoints defines Thanos querier endpoints from which to query metrics.

4983

## Maps to the --query flag of thanos ruler.

4984

queryEndpoints: []

4985

## Define configuration for connecting to thanos query instances. If this is defined, the queryEndpoints field will be ignored.

4986

## Maps to the query.config CLI argument. Only available with thanos v0.11.0 and higher.

4987

queryConfig:

4988

# use existing secret, if configured, queryConfig.secret will not be used

4989

existingSecret: {}

4990

# name: ""

4991

# key: ""

4992

# render queryConfig secret data and configure it to be used by Thanos Ruler custom resource, ignored when queryConfig.existingSecret is set

4993

# https://thanos.io/tip/components/rule.md/#query-api

4994

secret: {}

4995

# - http_config:

4996

# basic_auth:

4997

# username: some_user

4998

# password: some_pass

4999

# static_configs:

5000

# - URL

5001

# scheme: http

5002

# timeout: 10s

5003

## Labels configure the external label pairs to ThanosRuler. A default replica

5004

## label `thanos_ruler_replica` will be always added as a label with the value

5005

## of the pod's name and it will be dropped in the alerts.

5006

labels: {}

5007

## If set to true all actions on the underlying managed objects are not going to be performed, except for delete actions.

5008

5009

paused: false

5010

## Allows setting additional arguments for the ThanosRuler container

5011

## ref: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api-reference/api.md#thanosruler

5012

5013

additionalArgs: []

5014

# - name: remote-write.config

5015

# value: |-

5016

# "remote_write":

5017

# - "name": "receiver-0"

5018

# "remote_timeout": "30s"

5019

# "url": "http://thanos-receiver-0.thanos-receiver:8081/api/v1/receive"

5020

5021

## Define which Nodes the Pods are scheduled on.

5022

## ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#nodeselector

5023

5024

nodeSelector: {}

5025

## Define resources requests and limits for single Pods.

5026

## ref: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/

5027

5028

resources: {}

5029

# requests:

5030

# memory: 400Mi

5031

5032

## Pod anti-affinity can prevent the scheduler from placing Prometheus replicas on the same node.

5033

## The default value "soft" means that the scheduler should *prefer* to not schedule two replica pods onto the same node but no guarantee is provided.

5034

## The value "hard" means that the scheduler is *required* to not schedule two replica pods onto the same node.

5035

## The value "" will disable pod anti-affinity so that no anti-affinity rules will be configured.

5036

5037

podAntiAffinity: "soft"

5038

## If anti-affinity is enabled sets the topologyKey to use for anti-affinity.

5039

## This can be changed to, for example, failure-domain.beta.kubernetes.io/zone

5040

5041

podAntiAffinityTopologyKey: kubernetes.io/hostname

5042

## Assign custom affinity rules to the thanosRuler instance

5043

## ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/

5044

5045

affinity: {}

5046

# nodeAffinity:

5047

# requiredDuringSchedulingIgnoredDuringExecution:

5048

# nodeSelectorTerms:

5049

# - matchExpressions:

5050

# - key: kubernetes.io/e2e-az-name

5051

# operator: In

5052

# values:

5053

# - e2e-az1

5054

# - e2e-az2

5055

5056

## If specified, the pod's tolerations.

5057

## ref: https://kubernetes.io/docs/concepts/scheduling-eviction/taint-and-toleration/

5058

5059

tolerations: []

5060

# - key: "key"

5061

# operator: "Equal"

5062

# value: "value"

5063

# effect: "NoSchedule"

5064

5065

## If specified, the pod's topology spread constraints.

5066

## ref: https://kubernetes.io/docs/concepts/scheduling-eviction/topology-spread-constraints/

5067

5068

topologySpreadConstraints: []

5069

# - maxSkew: 1

5070

# topologyKey: topology.kubernetes.io/zone

5071

# whenUnsatisfiable: DoNotSchedule

5072

# labelSelector:

5073

# matchLabels:

5074

# app: thanos-ruler

5075

5076

## SecurityContext holds pod-level security attributes and common container settings.

5077

## This defaults to non root user with uid 1000 and gid 2000. *v1.PodSecurityContext false

5078

## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/

5079

5080

securityContext:

5081

runAsGroup: 2000

5082

runAsNonRoot: true

5083

runAsUser: 1000

5084

fsGroup: 2000

5085

seccompProfile:

5086

type: RuntimeDefault

5087

## Use the host's user namespace for ThanosRuler pods.

5088

## ref: https://kubernetes.io/docs/tasks/configure-pod-container/user-namespaces/

5089

hostUsers: ~

5090

## ListenLocal makes the ThanosRuler server listen on loopback, so that it does not bind against the Pod IP.

5091

## Note this is only for the ThanosRuler UI, not the gossip communication.

5092

5093

listenLocal: false

5094

## Containers allows injecting additional containers. This is meant to allow adding an authentication proxy to an ThanosRuler pod.

5095

5096

containers: []

5097

## Additional environment variables to set on the ThanosRuler container.

5098

## This is rendered through the Prometheus Operator strategic merge patch.

5099

5100

extraEnv: []

5101

# - name: EXAMPLE

5102

# value: test

5103

5104

# Additional volumes on the output StatefulSet definition.

5105

volumes: []

5106

# Additional VolumeMounts on the output StatefulSet definition.

5107

volumeMounts: []

5108

## InitContainers allows injecting additional initContainers. This is meant to allow doing some changes

5109

## (permissions, dir tree) on mounted volumes before starting prometheus

5110

initContainers: []

5111

## Priority class assigned to the Pods

5112

5113

priorityClassName: ""

5114

## PortName to use for ThanosRuler.

5115

5116

portName: "web"

5117

## Duration in seconds the pod needs to terminate gracefully.

5118

## ref: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle/#pod-termination

5119

terminationGracePeriodSeconds: ~

5120

## WebTLSConfig defines the TLS parameters for HTTPS

5121

## ref: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api-reference/api.md#thanosrulerwebspec

5122

web: {}

5123

## Pod management policy. Kubernetes default is OrderedReady but prometheus-operator default is Parallel.

5124

## ref: https://kubernetes.io/docs/concepts/workloads/controllers/statefulset/#pod-management-policies

5125

podManagementPolicy: ""

5126

## Update strategy for the StatefulSet.

5127

## ref: https://kubernetes.io/docs/concepts/workloads/controllers/statefulset/#update-strategies

5128

updateStrategy: {}

5129

# type: RollingUpdate

5130

# rollingUpdate:

5131

# maxUnavailable: 1

5132

5133

## Version of Thanos Ruler to deploy. Overrides the version derived from the image tag when set.

5134

version: ""

5135

## Image pull policy for the Thanos Ruler container.

5136

imagePullPolicy: ""

5137

## EnableFeatures API enables access to Thanos Ruler disabled features.

5138

enableFeatures: []

5139

## EnableServiceLinks indicates whether information about services should be injected into the

5140

## pod's environment variables. Uses the operator/Kubernetes default when left unset (~).

5141

enableServiceLinks: ~

5142

## Minimum number of seconds for which a newly created pod should be ready without any of its

5143

## containers crashing/restarting for it to be considered available.

5144

minReadySeconds: ~

5145

## Defines the DNS configuration for the pods.

5146

dnsConfig: {}

5147

# nameservers:

5148

# - 1.2.3.4

5149

# searches:

5150

# - ns1.svc.cluster-domain.example

5151

# options:

5152

# - name: ndots

5153

# value: "2"

5154

5155

## Defines the DNS policy for the pods.

5156

dnsPolicy: ""

5157

## Pods' hostAliases configuration

5158

## ref: https://kubernetes.io/docs/concepts/services-networking/add-entries-to-pod-etc-hosts-with-host-aliases/

5159

hostAliases: []

5160

# - ip: 10.10.0.100

5161

# hostnames:

5162

# - a1.app.local

5163

5164

## Defines the list of remote write configurations. When not empty, the Thanos Ruler operates in stateless mode.

5165

## ref: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api-reference/api.md#monitoring.coreos.com/v1.RemoteWriteSpec

5166

remoteWrite: []

5167

## Configures tracing for Thanos Ruler. Maps to the tracing.config CLI argument.

5168

tracingConfig:

5169

# use existing secret, if configured, tracingConfig.secret will not be used

5170

existingSecret: {}

5171

# name: ""

5172

# key: ""

5173

# render tracingConfig secret data and configure it to be used by Thanos Ruler custom resource, ignored when tracingConfig.existingSecret is set

5174

secret: {}

5175

## Path to a tracing configuration file on disk (e.g. mounted through a volume). Takes precedence over tracingConfig.

5176

tracingConfigFile: ""

5177

## Configures alert relabeling for Thanos Ruler. Maps to the alert.relabel-config CLI argument.

5178

alertRelabelConfigs:

5179

# use existing secret, if configured, alertRelabelConfigs.secret will not be used

5180

existingSecret: {}

5181

# name: ""

5182

# key: ""

5183

# render alertRelabelConfigs secret data and configure it to be used by Thanos Ruler custom resource, ignored when alertRelabelConfigs.existingSecret is set

5184

secret: {}

5185

## Path to an alert relabel configuration file on disk. Takes precedence over alertRelabelConfigs.

5186

alertRelabelConfigFile: ""

5187

## Configures the gRPC server TLS for Thanos Ruler.

5188

## ref: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api-reference/api.md#monitoring.coreos.com/v1.TLSConfig

5189

grpcServerTlsConfig: {}

5190

## Path to an object storage configuration file on disk. Takes precedence over objectStorageConfig.

5191

objectStorageConfigFile: ""

5192

## Number of concurrent rule evaluations.

5193

ruleConcurrentEval: ~

5194

## Maximum time to tolerate outage for restoring "for" state of alert.

5195

ruleOutageTolerance: ""

5196

## Minimum duration between alert and restored "for" state. Maintained only for alerts with a configured "for"

5197

## time greater than the grace period.

5198

ruleGracePeriod: ""

5199

## The default rule group's query offset duration to shift the evaluation time of rules backwards.

5200

## ref: https://github.com/prometheus-community/helm-charts/issues/5843

5201

ruleQueryOffset: ""

5202

## Minimum amount of time to wait before resending an alert to Alertmanager.

5203

resendDelay: ""

5204

## EnforcedNamespaceLabel enforces adding a namespace label of origin for each alert and metric.

5205

enforcedNamespaceLabel: ""

5206

## List of references to PrometheusRule objects to be excluded from enforcement (requires enforcedNamespaceLabel).

5207

## Can be a list of objects, or a string that is passed through tpl.

5208

excludedFromEnforcement: []

5209

## Additional configuration which is not covered by the properties above. (passed through tpl)

5210

additionalConfig: {}

5211

## Additional configuration which is not covered by the properties above.

5212

## Useful, if you need advanced templating

5213

additionalConfigString: ""

5214

## ExtraSecret can be used to store various data in an extra secret

5215

## (use it for example to store hashed basic auth credentials)

5216

extraSecret:

5217

## if not set, name will be auto generated

5218

# name: ""

5219

annotations: {}

5220

data: {}

5221

# auth: |

5222

# foo:$apr1$OFG3Xybp$ckL0FHDAkoXYIlH9.cysT0

5223

# someoneelse:$apr1$DMZX2Z4q$6SbQIfyuLQd.xmo/P0m2c.

5224

## Setting to true produces cleaner resource names, but requires a data migration because the name of the persistent volume changes. Therefore this should only be set once on initial installation.

5225

5226

cleanPrometheusOperatorObjectNames: false

5227

## Extra manifests to deploy. Can be of type dict or list.

5228

## If dict, keys are ignored and only values are used.

5229

## Items contained within extraObjects can be defined as dict or string and are passed through tpl.

5230

extraManifests: null

5231

# - apiVersion: v1

5232

# kind: ConfigMap

5233

# metadata:

5234

# labels:

5235

# name: prometheus-extra

5236

# data:

5237

# extra-data: "value"

5238

5239

# can also be defined as a string, useful for templating field names

5240

# - |

5241

# apiVersion: v1

5242

# kind: Secret

5243

# type: Opaque

5244

# metadata:

5245

# name: super-secret

5246

# labels:

5247

# {{- range $key, $value := .Values.commonLabels }}

5248

# {{ $key }}: {{ $value }}

5249

# {{- end }}

5250

# data:

5251

# plaintext: Zm9vYmFy

5252

# templated: '{{ print "foobar" | upper | b64enc }}'

5253

The trusted source for open source

Talk to an expert

Privacy

Terms

© 2026 Chainguard, Inc. All Rights Reserved.
Chainguard® and the Chainguard logo are registered trademarks of Chainguard, Inc. in the United States and/or other countries.
The other respective trademarks mentioned on this page are owned by the respective companies and use of them does not imply any affiliation or endorsement.

kube-prometheus-stack

The trusted source for open source

Product

Solutions

Customers

Resources

Company