kube-state-metrics
Helm chart
Request a free trial
Contact our team to test out this Helm chart and related images for free. Please also indicate any other images you would like to evaluate.
Tag:
1
# Default values for kube-state-metrics.
2
prometheusScrape: true
3
image:
4
registry: cgr.dev
5
repository: scratch-images/test-tmp/kube-state-metrics
6
# If unset use v + .Charts.appVersion
7
tag: 2.19.1-r6
8
sha: sha256:2bb32d86e7cd32c33cda3f6e661f97abb95b52d0dbc9c6278aa57d4789c822b8
9
pullPolicy: IfNotPresent
10
imagePullSecrets: []
11
# - name: "image-pull-secret"
12
13
global:
14
# To help compatibility with other charts which use global.imagePullSecrets.
15
# Allow either an array of {name: pullSecret} maps (k8s-style), or an array of strings (more common helm-style).
16
# global:
17
# imagePullSecrets:
18
# - name: pullSecret1
19
# - name: pullSecret2
20
# or
21
# global:
22
# imagePullSecrets:
23
# - pullSecret1
24
# - pullSecret2
25
imagePullSecrets: []
26
#
27
# Allow parent charts to override registry hostname
28
imageRegistry: ""
29
# If set to true, this will deploy kube-state-metrics as a StatefulSet and the data
30
# will be automatically sharded across <.Values.replicas> pods using the built-in
31
# autodiscovery feature: https://github.com/kubernetes/kube-state-metrics#automated-sharding
32
# This is an experimental feature and there are no stability guarantees.
33
autosharding:
34
enabled: false
35
replicas: 1
36
# Change the deployment strategy when autosharding is disabled.
37
# ref: https://kubernetes.io/docs/concepts/workloads/controllers/deployment/#strategy
38
# The default is "RollingUpdate" as per Kubernetes defaults.
39
# During a release, 'RollingUpdate' can lead to two running instances for a short period of time while 'Recreate' can create a small gap in data.
40
# updateStrategy: Recreate
41
42
# Number of old history to retain to allow rollback
43
# Default Kubernetes value is set to 10
44
revisionHistoryLimit: 10
45
# List of additional cli arguments to configure kube-state-metrics
46
# for example: --enable-gzip-encoding, --log-file, etc.
47
# all the possible args can be found here: https://github.com/kubernetes/kube-state-metrics/blob/main/docs/developer/cli-arguments.md
48
extraArgs: []
49
# If false then the user will opt out of automounting API credentials.
50
automountServiceAccountToken: true
51
service:
52
port: 8080
53
# Default to clusterIP for backward compatibility
54
type: ClusterIP
55
ipDualStack:
56
enabled: false
57
ipFamilies: ["IPv6", "IPv4"]
58
ipFamilyPolicy: "PreferDualStack"
59
nodePort: 0
60
loadBalancerIP: ""
61
# Only allow access to the loadBalancerIP from these IPs
62
loadBalancerSourceRanges: []
63
clusterIP: ""
64
annotations: {}
65
## Additional labels to add to all resources
66
customLabels: {}
67
# app: kube-state-metrics
68
69
## Override selector labels
70
selectorOverride: {}
71
## set to true to add the release label so scraping of the servicemonitor with kube-prometheus-stack works out of the box
72
releaseLabel: false
73
hostNetwork: false
74
## Use the host's user namespace for deployment.
75
## ref: https://kubernetes.io/docs/tasks/configure-pod-container/user-namespaces/
76
hostUsers: ~
77
rbac:
78
# If true, create & use RBAC resources
79
create: true
80
# Set to a rolename to use existing role - skipping role creating - but still doing serviceaccount and rolebinding to it, rolename set here.
81
# useExistingRole: your-existing-role
82
83
# If set to false - Run without Cluteradmin privs needed - ONLY works if namespace is also set (if useExistingRole is set this name is used as ClusterRole or Role to bind to)
84
useClusterRole: true
85
# Add permissions for CustomResources' apiGroups in Role/ClusterRole. Should be used in conjunction with Custom Resource State Metrics configuration
86
# Example:
87
# - apiGroups: ["monitoring.coreos.com"]
88
# resources: ["prometheuses"]
89
# verbs: ["list", "watch"]
90
extraRules: []
91
# Enable kube-state-metrics native request authn/authz on the metrics endpoints
92
# via the `--auth-filter` flag, as an alternative to running kube-rbac-proxy.
93
# When enabled, the `create` permissions on `tokenreviews` and
94
# `subjectaccessreviews` required by the filter are added to the (Cluster)Role
95
# automatically. Scrapers must authenticate; see the chart README and the
96
# kube-state-metrics docs on protecting metrics endpoints.
97
authFilter:
98
enabled: false
99
# Configure kube-rbac-proxy. When enabled, creates one kube-rbac-proxy container per exposed HTTP endpoint (metrics and telemetry if enabled).
100
# The requests are served through the same service but requests are then HTTPS.
101
kubeRBACProxy:
102
enabled: false
103
image:
104
registry: cgr.dev
105
repository: scratch-images/test-tmp/kube-rbac-proxy
106
tag: 0.22.1-r4
107
sha: sha256:fcfadb3b20b8846f7dd405c269506dd97da20c9a0c23a103191f10fc7d9bb42c
108
pullPolicy: IfNotPresent
109
# This set --ignore-paths=/livez,/readyz to kubeRBACProxy container args
110
# to allow the pod probes working properly with kubeRBACProxy enabled.
111
ignoreProbePaths: true
112
# List of additional cli arguments to configure kube-rbac-prxy
113
# for example: --tls-cipher-suites, --log-file, etc.
114
# all the possible args can be found here: https://github.com/brancz/kube-rbac-proxy#usage
115
extraArgs: []
116
## Specify security settings for a Container
117
## Allows overrides and additional options compared to (Pod) securityContext
118
## Ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-container
119
containerSecurityContext:
120
readOnlyRootFilesystem: true
121
allowPrivilegeEscalation: false
122
capabilities:
123
drop:
124
- ALL
125
# Configure specific upstream port for kube-state-metrics container
126
port: 9090
127
# Configure specific proxy endpoints port
128
# This port is for healthz on readinessProbe kube-rbac-proxy-http container
129
proxyEndpointsPort: 8888
130
resources: {}
131
# We usually recommend not to specify default resources and to leave this as a conscious
132
# choice for the user. This also increases chances charts run on environments with little
133
# resources, such as Minikube. If you do want to specify resources, uncomment the following
134
# lines, adjust them as necessary, and remove the curly braces after 'resources:'.
135
# limits:
136
# cpu: 100m
137
# memory: 64Mi
138
# requests:
139
# cpu: 10m
140
# memory: 32Mi
141
142
## volumeMounts enables mounting custom volumes in rbac-proxy containers
143
## Useful for TLS certificates and keys
144
volumeMounts: []
145
# - mountPath: /etc/tls
146
# name: kube-rbac-proxy-tls
147
# readOnly: true
148
serviceAccount:
149
# Specifies whether a ServiceAccount should be created, require rbac true
150
create: true
151
# The name of the ServiceAccount to use.
152
# If not set and create is true, a name is generated using the fullname template
153
name:
154
# Reference to one or more secrets to be used when pulling images
155
# ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/
156
imagePullSecrets: []
157
# ServiceAccount annotations.
158
# Use case: AWS EKS IAM roles for service accounts
159
# ref: https://docs.aws.amazon.com/eks/latest/userguide/specify-service-account-role.html
160
annotations: {}
161
# If false then the user will opt out of automounting API credentials.
162
automountServiceAccountToken: true
163
# Additional Environment variables
164
env: []
165
# - name: GOMAXPROCS
166
# valueFrom:
167
# resourceFieldRef:
168
# resource: limits.cpu
169
170
prometheus:
171
monitor:
172
enabled: false
173
annotations: {}
174
additionalLabels: {}
175
namespace: ""
176
namespaceSelector: []
177
jobLabel: ""
178
targetLabels: []
179
podTargetLabels: []
180
## SampleLimit defines per-scrape limit on number of scraped samples that will be accepted.
181
##
182
sampleLimit: 0
183
## TargetLimit defines a limit on the number of scraped targets that will be accepted.
184
##
185
targetLimit: 0
186
## Per-scrape limit on number of labels that will be accepted for a sample. Only valid in Prometheus versions 2.27.0 and newer.
187
##
188
labelLimit: 0
189
## Per-scrape limit on length of labels name that will be accepted for a sample. Only valid in Prometheus versions 2.27.0 and newer.
190
##
191
labelNameLengthLimit: 0
192
## Per-scrape limit on length of labels value that will be accepted for a sample. Only valid in Prometheus versions 2.27.0 and newer.
193
##
194
labelValueLengthLimit: 0
195
selectorOverride: {}
196
## kube-state-metrics endpoint
197
http:
198
interval: ""
199
scrapeTimeout: ""
200
proxyUrl: ""
201
## Whether to enable HTTP2 for servicemonitor
202
enableHttp2: false
203
honorLabels: false
204
metricRelabelings: []
205
relabelings: []
206
scheme: ""
207
## File to read bearer token for scraping targets
208
bearerTokenFile: ""
209
## Secret to mount to read bearer token for scraping targets. The secret needs
210
## to be in the same namespace as the service monitor and accessible by the
211
## Prometheus Operator
212
bearerTokenSecret: {}
213
# name: secret-name
214
# key: key-name
215
tlsConfig: {}
216
## selfMonitor endpoint
217
metrics:
218
interval: ""
219
scrapeTimeout: ""
220
proxyUrl: ""
221
## Whether to enable HTTP2 for servicemonitor
222
enableHttp2: false
223
honorLabels: false
224
metricRelabelings: []
225
relabelings: []
226
scheme: ""
227
## File to read bearer token for scraping targets
228
bearerTokenFile: ""
229
## Secret to mount to read bearer token for scraping targets. The secret needs
230
## to be in the same namespace as the service monitor and accessible by the
231
## Prometheus Operator
232
bearerTokenSecret: {}
233
# name: secret-name
234
# key: key-name
235
tlsConfig: {}
236
## Create a scrapeConfig resource for scraping the kube-state-metrics service. Use this instead of serviceMonitor
237
## to have more instances of kube-state-metrics safety.
238
scrapeconfig:
239
## To avoid duplicate metrics, first disable the serviceMonitor creation via prometheus.monitor.enabled=false
240
enabled: false
241
annotations: {}
242
additionalLabels: {}
243
jobName: kube-state-metrics
244
## SampleLimit defines per-scrape limit on number of scraped samples that will be accepted.
245
##
246
sampleLimit: 0
247
## TargetLimit defines a limit on the number of scraped targets that will be accepted.
248
##
249
targetLimit: 0
250
## Per-scrape limit on number of labels that will be accepted for a sample. Only valid in Prometheus versions 2.27.0 and newer.
251
##
252
labelLimit: 0
253
## Per-scrape limit on length of labels name that will be accepted for a sample. Only valid in Prometheus versions 2.27.0 and newer.
254
##
255
labelNameLengthLimit: 0
256
## Per-scrape limit on length of labels value that will be accepted for a sample. Only valid in Prometheus versions 2.27.0 and newer.
257
##
258
labelValueLengthLimit: 0
259
## StaticConfigLabels defines the labels to be used in the Prometheus static configuration for scraping.
260
staticConfigLabels: {}
261
scrapeInterval: ""
262
scrapeTimeout: ""
263
proxyUrl: ""
264
## Whether to enable HTTP2 for scrapeconfig
265
enableHttp2: false
266
honorLabels: true
267
metricRelabelings: []
268
relabelings: []
269
scheme: ""
270
tlsConfig: {}
271
## Configure network policy for kube-state-metrics
272
networkPolicy:
273
enabled: false
274
# egress:
275
# - {}
276
# ingress:
277
# - {}
278
# podSelector:
279
# matchLabels:
280
# app.kubernetes.io/name: kube-state-metrics
281
securityContext:
282
enabled: true
283
runAsGroup: 65534
284
runAsUser: 65534
285
fsGroup: 65534
286
runAsNonRoot: true
287
seccompProfile:
288
type: RuntimeDefault
289
## Specify security settings for a Container
290
## Allows overrides and additional options compared to (Pod) securityContext
291
## Ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-container
292
containerSecurityContext:
293
readOnlyRootFilesystem: true
294
allowPrivilegeEscalation: false
295
capabilities:
296
drop:
297
- ALL
298
## Node labels for pod assignment
299
## Ref: https://kubernetes.io/docs/user-guide/node-selection/
300
nodeSelector: {}
301
## Affinity settings for pod assignment
302
## Can be defined as either a dict or string. String is useful for `tpl` templating.
303
## Ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/
304
affinity: {}
305
# affinity: |
306
# podAntiAffinity:
307
# requiredDuringSchedulingIgnoredDuringExecution:
308
# - labelSelector:
309
# matchLabels:
310
# {{- include "kube-state-metrics.selectorLabels" . | indent 10 }}
311
# topologyKey: kubernetes.io/hostname
312
313
## Tolerations for pod assignment
314
## Ref: https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/
315
tolerations: []
316
## Topology spread constraints for pod assignment
317
## Ref: https://kubernetes.io/docs/concepts/workloads/pods/pod-topology-spread-constraints/
318
topologySpreadConstraints: []
319
# Annotations to be added to the deployment/statefulset
320
annotations: {}
321
# Labels to be added to the deployment/statefulset
322
labels: {}
323
# Annotations to be added to the pod
324
podAnnotations: {}
325
# Labels to be added to the pod
326
podLabels: {}
327
## Assign a PriorityClassName to pods if set
328
# priorityClassName: ""
329
330
# Ref: https://kubernetes.io/docs/tasks/run-application/configure-pdb/
331
podDisruptionBudget: {}
332
# Comma-separated list of metrics to be exposed.
333
# This list comprises of exact metric names and/or regex patterns.
334
# The allowlist and denylist are mutually exclusive.
335
metricAllowlist: []
336
# Comma-separated list of metrics not to be enabled.
337
# This list comprises of exact metric names and/or regex patterns.
338
# The allowlist and denylist are mutually exclusive.
339
metricDenylist: []
340
# Comma-separated list of additional Kubernetes label keys that will be used in the resource's
341
# labels metric. By default the metric contains only name and namespace labels.
342
# To include additional labels, provide a list of resource names in their plural form and Kubernetes
343
# label keys you would like to allow for them (Example: '=namespaces=[k8s-label-1,k8s-label-n,...],pods=[app],...)'.
344
# A single '*' can be provided per resource instead to allow any labels, but that has
345
# severe performance implications (Example: '=pods=[*]').
346
metricLabelsAllowlist: []
347
# - namespaces=[k8s-label-1,k8s-label-n]
348
349
# Comma-separated list of Kubernetes annotations keys that will be used in the resource'
350
# labels metric. By default the metric contains only name and namespace labels.
351
# To include additional annotations provide a list of resource names in their plural form and Kubernetes
352
# annotation keys you would like to allow for them (Example: '=namespaces=[kubernetes.io/team,...],pods=[kubernetes.io/team],...)'.
353
# A single '*' can be provided per resource instead to allow any annotations, but that has
354
# severe performance implications (Example: '=pods=[*]').
355
metricAnnotationsAllowList: []
356
# - pods=[k8s-annotation-1,k8s-annotation-n]
357
358
# Available collectors for kube-state-metrics.
359
# By default, all available resources are enabled, comment out to disable.
360
collectors:
361
- certificatesigningrequests
362
- configmaps
363
- cronjobs
364
- daemonsets
365
- deployments
366
- endpointslices
367
- horizontalpodautoscalers
368
- ingresses
369
- jobs
370
- leases
371
- limitranges
372
- mutatingwebhookconfigurations
373
- namespaces
374
- networkpolicies
375
- nodes
376
- persistentvolumeclaims
377
- persistentvolumes
378
- poddisruptionbudgets
379
- pods
380
- replicasets
381
- replicationcontrollers
382
- resourcequotas
383
- secrets
384
- services
385
- statefulsets
386
- storageclasses
387
- validatingwebhookconfigurations
388
- volumeattachments
389
# - ingressclasses
390
# - clusterrolebindings
391
# - clusterroles
392
# - roles
393
# - rolebindings
394
# - serviceaccounts
395
# Enabling kubeconfig will pass the --kubeconfig argument to the container
396
kubeconfig:
397
enabled: false
398
# base64 encoded kube-config file
399
secret:
400
# Enabling support for customResourceState, will create a configMap including your config that will be read from kube-state-metrics
401
customResourceState:
402
# Whether to enable support for CustomResourceStateMetrics.
403
enabled: false
404
# Whether to create the ConfigMap that holds the config.
405
create: true
406
# Name of the ConfigMap that holds the config. If empty, name will be generated based on the release name.
407
name: ""
408
# ConfigMap key that holds the config.
409
key: config.yaml
410
# Definition of the CustomResourceStateMetrics. Add (Cluster)Role permissions to list/watch the resources defined in the config to rbac.extraRules.
411
config: {}
412
# Enable only the release namespace for collecting resources. By default all namespaces are collected.
413
# If releaseNamespace and namespaces are both set a merged list will be collected.
414
releaseNamespace: false
415
# Comma-separated list(string) or yaml list of namespaces to be enabled for collecting resources. By default all namespaces are collected.
416
namespaces: ""
417
# Comma-separated list of namespaces not to be enabled. If namespaces and namespaces-denylist are both set,
418
# only namespaces that are excluded in namespaces-denylist will be used.
419
namespacesDenylist: ""
420
## Override the deployment namespace
421
##
422
namespaceOverride: ""
423
resources: {}
424
# We usually recommend not to specify default resources and to leave this as a conscious
425
# choice for the user. This also increases chances charts run on environments with little
426
# resources, such as Minikube. If you do want to specify resources, uncomment the following
427
# lines, adjust them as necessary, and remove the curly braces after 'resources:'.
428
# limits:
429
# cpu: 100m
430
# memory: 64Mi
431
# requests:
432
# cpu: 10m
433
# memory: 32Mi
434
435
# Enable self metrics configuration for service and Service Monitor
436
# Default values for telemetry configuration can be overridden
437
# If you set telemetryNodePort, you must also set service.type to NodePort
438
selfMonitor:
439
enabled: false
440
# telemetryHost: 0.0.0.0
441
# telemetryPort: 8081
442
# telemetryNodePort: 0
443
# Enable vertical pod autoscaler support for kube-state-metrics
444
verticalPodAutoscaler:
445
enabled: false
446
# Recommender responsible for generating recommendation for the object.
447
# List should be empty (then the default recommender will generate the recommendation)
448
# or contain exactly one recommender.
449
# recommenders: []
450
# - name: custom-recommender-performance
451
452
# List of resources that the vertical pod autoscaler can control. Defaults to cpu and memory
453
controlledResources: []
454
# Specifies which resource values should be controlled: RequestsOnly or RequestsAndLimits.
455
# controlledValues: RequestsAndLimits
456
457
# Define the max allowed resources for the pod
458
maxAllowed: {}
459
# cpu: 200m
460
# memory: 100Mi
461
# Define the min allowed resources for the pod
462
minAllowed: {}
463
# cpu: 200m
464
# memory: 100Mi
465
# updatePolicy:
466
# Specifies minimal number of replicas which need to be alive for VPA Updater to attempt pod eviction
467
# minReplicas: 1
468
# Specifies whether recommended updates are applied when a Pod is started and whether recommended updates
469
# are applied during the life of a Pod. Possible values are "Off", "Initial", "Recreate", and "Auto".
470
# updateMode: Auto
471
472
# volumeMounts are used to add custom volume mounts to deployment.
473
# See example below
474
volumeMounts: []
475
# - mountPath: /etc/config
476
# name: config-volume
477
478
# volumes are used to add custom volumes to deployment
479
# See example below
480
volumes: []
481
# - configMap:
482
# name: cm-for-volume
483
# name: config-volume
484
485
# Extra manifests to deploy as an array
486
extraManifests: []
487
# - apiVersion: v1
488
# kind: ConfigMap
489
# metadata:
490
# labels:
491
# name: prometheus-extra
492
# data:
493
# extra-data: "value"
494
495
## Containers allows injecting additional containers.
496
containers: []
497
# - name: crd-init
498
# image: kiwigrid/k8s-sidecar:latest
499
500
## InitContainers allows injecting additional initContainers.
501
initContainers: []
502
# - name: crd-sidecar
503
# image: kiwigrid/k8s-sidecar:latest
504
505
## dnsPolicy allows to change the default DNS configuration for the pod
506
## Ref: https://kubernetes.io/docs/concepts/services-networking/dns-pod-service/#pod-s-dns-policy
507
dnsPolicy: ClusterFirst
508
## dnsConfig allows setting up specific DNS configuration for the pod
509
## Ref: https://kubernetes.io/docs/concepts/services-networking/dns-pod-service/#pod-dns-config
510
dnsConfig: {}
511
## Settings for startup, liveness and readiness probes
512
## Ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/
513
##
514
515
## Startup probe can optionally be enabled.
516
##
517
startupProbe:
518
enabled: false
519
failureThreshold: 3
520
httpGet:
521
httpHeaders: []
522
scheme: http
523
initialDelaySeconds: 0
524
periodSeconds: 10
525
successThreshold: 1
526
timeoutSeconds: 5
527
## Liveness probe
528
##
529
livenessProbe:
530
failureThreshold: 3
531
httpGet:
532
httpHeaders: []
533
scheme: http
534
initialDelaySeconds: 5
535
periodSeconds: 10
536
successThreshold: 1
537
timeoutSeconds: 5
538
## Readiness probe
539
##
540
readinessProbe:
541
failureThreshold: 3
542
httpGet:
543
httpHeaders: []
544
scheme: http
545
initialDelaySeconds: 5
546
periodSeconds: 10
547
successThreshold: 1
548
timeoutSeconds: 5
549
The trusted source for open source
Talk to an expertProduct
Customers
© 2026 Chainguard, Inc. All Rights Reserved.
Chainguard® and the Chainguard logo are registered trademarks of Chainguard, Inc. in the United States and/or other countries.
The other respective trademarks mentioned on this page are owned by the respective companies and use of them does not imply any affiliation or endorsement.
Chainguard® and the Chainguard logo are registered trademarks of Chainguard, Inc. in the United States and/or other countries.
The other respective trademarks mentioned on this page are owned by the respective companies and use of them does not imply any affiliation or endorsement.