prometheus-pushgateway

Helm chart

Last changed

Request a free trial

Contact our team to test out this Helm chart and related images for free. Please also indicate any other images you would like to evaluate.

Tag:

# Default values for prometheus-pushgateway.

# This is a YAML-formatted file.

# Declare variables to be passed into your templates.

global:

imageRegistry: ""

imagePullSecrets: []

# Provide a name in place of prometheus-pushgateway for `app:` labels

nameOverride: ""

# Provide a name to substitute for the full names of resources

fullnameOverride: ""

# Provide a namespace to substitute for the namespace on resources

namespaceOverride: ""

image:

registry: ""

repository: cgr.dev/chainguard-private/prometheus-pushgateway

# if not set appVersion field from Chart.yaml is used

tag: latest@sha256:fee1e56f387e92867c8ea9c76ccf072aef9ebdf0137d4b71fc367f7dabca8db1

pullPolicy: IfNotPresent

# Optional pod imagePullSecrets

imagePullSecrets: []

service:

type: ClusterIP

port: 9091

targetPort: 9091

# nodePort: 32100

portName: http

# Optional - Can be used for headless if value is "None"

clusterIP: ""

ipDualStack:

enabled: false

ipFamilies: ["IPv6", "IPv4"]

ipFamilyPolicy: "PreferDualStack"

loadBalancerIP: ""

loadBalancerSourceRanges: []

# Whether to automatically mount a service account token into the pod

automountServiceAccountToken: true

# Optional deployment annotations

deploymentAnnotations: {}

# Optional pod annotations

podAnnotations: {}

# Optional pod labels

podLabels: {}

# Optional service annotations

serviceAnnotations: {}

# Optional service labels

serviceLabels: {}

# Optional serviceAccount labels

serviceAccountLabels: {}

# Optional persistentVolume labels

persistentVolumeLabels: {}

# Optional additional environment variables

extraVars: []

## Additional pushgateway container arguments

## example:

## extraArgs:

## - --persistence.file=/data/pushgateway.data

## - --persistence.interval=5m

extraArgs: []

## Additional InitContainers to initialize the pod

extraInitContainers: []

# Optional additional containers (sidecar)

extraContainers: []

# - name: oAuth2-proxy

# args:

# - -https-address=:9092

# - -upstream=http://localhost:9091

# - -skip-auth-regex=^/metrics

# - -openshift-delegate-urls={"/":{"group":"monitoring.coreos.com","resource":"prometheuses","verb":"get"}}

# image: openshift/oauth-proxy:v1.1.0

# ports:

# - containerPort: 9092

# name: proxy

# resources:

# limits:

# memory: 16Mi

# requests:

# memory: 4Mi

# cpu: 20m

# volumeMounts:

# - mountPath: /etc/prometheus/secrets/pushgateway-tls

# name: secret-pushgateway-tls

resources: {}

# We usually recommend not to specify default resources and to leave this as a conscious

# choice for the user. This also increases chances charts run on environments with little

# resources, such as Minikube. If you do want to specify resources, uncomment the following

# lines, adjust them as necessary, and remove the curly braces after 'resources:'.

# limits:

# cpu: 200m

# memory: 50Mi

# requests:

# cpu: 100m

# memory: 30Mi

# -- Sets web configuration

# To enable basic authentication, provide basicAuthUsers as a map

100

# If serviceMonitor.enabled is set, a secret with these credentials will be created

101

# and configured in serviceMonitor. serviceMonitor.basicAuth overrides this secret.

102

webConfiguration: {}

103

# basicAuthUsers:

104

# username: password

105

106

# Alternatively, reference an existing Secret that already holds the web

107

# configuration (e.g. managed by Sealed Secrets, Vault, ...) so that no

108

# credentials are kept in plaintext here. The Secret must contain a key named

109

# web-config.yaml, the file name Pushgateway expects. When existingSecret is

110

# set the chart-managed web-config Secret is not rendered, and the liveness and

111

# readiness probes switch to a tcpSocket check, because the chart cannot read

112

# the credentials to authenticate HTTP probes.

113

# existingSecret:

114

# name: pushgateway-web-config

115

116

liveness:

117

enabled: true

118

probe:

119

httpGet:

120

path: /-/healthy

121

port: 9091

122

scheme: HTTP

123

initialDelaySeconds: 10

124

timeoutSeconds: 10

125

readiness:

126

enabled: true

127

probe:

128

httpGet:

129

path: /-/ready

130

port: 9091

131

scheme: HTTP

132

initialDelaySeconds: 10

133

timeoutSeconds: 10

134

serviceAccount:

135

# Specifies whether a ServiceAccount should be created

136

create: true

137

# The name of the ServiceAccount to use.

138

# If not set and create is true, a name is generated using the fullname template

139

name:

140

## Configure ingress resource that allow you to access the

141

## pushgateway installation. Set up the URL

142

## ref: http://kubernetes.io/docs/user-guide/ingress/

143

144

ingress:

145

## Enable Ingress.

146

147

enabled: false

148

# AWS ALB requires path of /*

149

className: ""

150

path: /

151

pathType: ImplementationSpecific

152

## Extra paths to prepend to every host configuration. This is useful when working with annotation based services.

153

extraPaths: []

154

# - path: /*

155

# backend:

156

# serviceName: ssl-redirect

157

# servicePort: use-annotation

158

## Annotations.

159

160

# annotations:

161

# kubernetes.io/ingress.class: nginx

162

# kubernetes.io/tls-acme: 'true'

163

164

## Hostnames.

165

## Must be provided if Ingress is enabled.

166

167

# hosts:

168

# - pushgateway.domain.com

169

170

## TLS configuration.

171

## Secrets must be manually created in the namespace.

172

173

# tls:

174

# - secretName: pushgateway-tls

175

# hosts:

176

# - pushgateway.domain.com

177

178

## route (map) allows configuration of HTTPRoute resources

179

## Requires Gateway API resources and suitable controller installed within the cluster

180

## Ref. https://gateway-api.sigs.k8s.io/guides/http-routing/

181

route:

182

main:

183

## Enable this route

184

enabled: false

185

## ApiVersion set by default to "gateway.networking.k8s.io/v1"

186

apiVersion: ""

187

## kind set by default to HTTPRoute

188

kind: ""

189

## Annotations to attach to the HTTPRoute resource

190

annotations: {}

191

## Labels to attach to the HTTPRoute resource

192

labels: {}

193

## ParentRefs refers to resources this HTTPRoute is to be attached to (Gateways)

194

parentRefs: []

195

# - name: contour

196

# sectionName: http

197

198

## Hostnames (templated) defines a set of hostnames that should match against the HTTP Host

199

## header to select a HTTPRoute used to process the request

200

hostnames: []

201

# - my.example.com

202

203

## additionalRules (templated) allows adding custom rules to the route

204

additionalRules: []

205

## Filters define the filters that are applied to requests that match

206

## this rule

207

filters: []

208

## Matches define conditions used for matching the rule against incoming

209

## HTTP requests

210

matches:

211

- path:

212

type: PathPrefix

213

value: /

214

## httpsRedirect adds a filter for redirecting to https (HTTP 301 Moved Permanently).

215

## To redirect HTTP traffic to HTTPS, you need to have a Gateway with both HTTP and HTTPS listeners.

216

## Matches and filters do not take effect if enabled.

217

## Ref. https://gateway-api.sigs.k8s.io/guides/http-redirect-rewrite/

218

httpsRedirect: false

219

tolerations: []

220

# - effect: NoSchedule

221

# operator: Exists

222

223

## Node labels for pushgateway pod assignment

224

## Ref: https://kubernetes.io/docs/user-guide/node-selection/

225

226

nodeSelector: {}

227

replicaCount: 1

228

hostAliases: []

229

# - ip: "127.0.0.1"

230

# hostnames:

231

# - "foo.local"

232

# - "bar.local"

233

# - ip: "10.1.2.3"

234

# hostnames:

235

# - "foo.remote"

236

# - "bar.remote"

237

238

## When running more than one replica alongside with persistence, different volumes are needed

239

## per replica, since sharing a `persistence.file` across replicas does not keep metrics synced.

240

## For this purpose, you can enable the `runAsStatefulSet` to deploy the pushgateway as a

241

## StatefulSet instead of as a Deployment.

242

runAsStatefulSet: false

243

## Security context to be added to push-gateway pods

244

245

securityContext:

246

fsGroup: 65534

247

runAsUser: 65534

248

runAsNonRoot: true

249

## Security context to be added to push-gateway containers

250

## Having a separate variable as securityContext differs for pods and containers.

251

containerSecurityContext: {}

252

# allowPrivilegeEscalation: false

253

# readOnlyRootFilesystem: true

254

# runAsUser: 65534

255

# runAsNonRoot: true

256

257

## Affinity for pod assignment

258

## Ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity

259

affinity: {}

260

## Pod anti-affinity can prevent the scheduler from placing pushgateway replicas on the same node.

261

## The value "soft" means that the scheduler should *prefer* to not schedule two replica pods onto the same node but no guarantee is provided.

262

## The value "hard" means that the scheduler is *required* to not schedule two replica pods onto the same node.

263

## The default value "" will disable pod anti-affinity so that no anti-affinity rules will be configured (unless set in `affinity`).

264

265

podAntiAffinity: ""

266

## If anti-affinity is enabled sets the topologyKey to use for anti-affinity.

267

## This can be changed to, for example, failure-domain.beta.kubernetes.io/zone

268

269

podAntiAffinityTopologyKey: kubernetes.io/hostname

270

## Topology spread constraints for pods

271

## Ref: https://kubernetes.io/docs/concepts/workloads/pods/pod-topology-spread-constraints/

272

topologySpreadConstraints: []

273

# Enable this if you're using https://github.com/coreos/prometheus-operator

274

serviceMonitor:

275

enabled: false

276

namespace: monitoring

277

# telemetryPath: HTTP resource path from which to fetch metrics.

278

# Telemetry path, default /metrics, has to be prefixed accordingly if pushgateway sets a route prefix at start-up.

279

280

telemetryPath: "/metrics"

281

# Fallback to the prometheus default unless specified

282

interval: ""

283

## scheme: HTTP scheme to use for scraping. Can be used with `tlsConfig` for example if using istio mTLS.

284

scheme: ""

285

## Basic authentication

286

basicAuth: {}

287

## Bearer token file

288

bearerTokenFile: ""

289

## tlsConfig: TLS configuration to use when scraping the endpoint. For example if using istio mTLS.

290

## Of type: https://github.com/coreos/prometheus-operator/blob/master/Documentation/api.md#tlsconfig

291

tlsConfig: {}

292

# bearerTokenFile:

293

# Fallback to the prometheus default unless specified

294

scrapeTimeout: ""

295

## Used to pass Labels that are used by the Prometheus installed in your cluster to select Service Monitors to work with

296

## ref: https://github.com/coreos/prometheus-operator/blob/master/Documentation/api.md#prometheusspec

297

additionalLabels: {}

298

# Retain the job and instance labels of the metrics pushed to the Pushgateway

299

# [Scraping Pushgateway](https://github.com/prometheus/pushgateway#configure-the-pushgateway-as-a-target-to-scrape)

300

honorLabels: true

301

## Metric relabel configs to apply to samples before ingestion.

302

## [Metric Relabeling](https://prometheus.io/docs/prometheus/latest/configuration/configuration/#metric_relabel_configs)

303

metricRelabelings: []

304

# - action: keep

305

306

# sourceLabels: [__name__]

307

308

## Relabel configs to apply to samples before ingestion.

309

## [Relabeling](https://prometheus.io/docs/prometheus/latest/configuration/configuration/#relabel_config)

310

relabelings: []

311

# - sourceLabels: [__meta_kubernetes_pod_node_name]

312

# separator: ;

313

# regex: ^(.*)$

314

# targetLabel: nodename

315

# replacement: $1

316

# action: replace

317

# The values to set in the PodDisruptionBudget spec (minAvailable/maxUnavailable)

318

# If not set then a PodDisruptionBudget will not be created

319

podDisruptionBudget: {}

320

priorityClassName:

321

# Deployment Strategy type

322

strategy:

323

type: Recreate

324

persistentVolume:

325

## If true, pushgateway will create/use a Persistent Volume Claim

326

## If false, use emptyDir

327

328

enabled: false

329

## pushgateway data Persistent Volume access modes

330

## Must match those of existing PV or dynamic provisioner

331

## Ref: http://kubernetes.io/docs/user-guide/persistent-volumes/

332

333

accessModes:

334

- ReadWriteOnce

335

## pushgateway data Persistent Volume Claim annotations

336

337

annotations: {}

338

## pushgateway data Persistent Volume existing claim name

339

## Requires pushgateway.persistentVolume.enabled: true

340

## If defined, PVC must be created manually before volume will be bound

341

existingClaim: ""

342

## pushgateway data Persistent Volume mount root path

343

344

mountPath: /data

345

## pushgateway data Persistent Volume size

346

347

size: 2Gi

348

## pushgateway data Persistent Volume Storage Class

349

## If defined, storageClassName: <storageClass>

350

## If set to "-", storageClassName: "", which disables dynamic provisioning

351

## If undefined (the default) or set to null, no storageClassName spec is

352

## set, choosing the default provisioner. (gp2 on AWS, standard on

353

## GKE, AWS & OpenStack)

354

355

# storageClass: "-"

356

357

## Subdirectory of pushgateway data Persistent Volume to mount

358

## Useful if the volume's root directory is not empty

359

360

subPath: ""

361

extraVolumes: []

362

# - name: extra

363

# emptyDir: {}

364

extraVolumeMounts: []

365

# - name: extra

366

# mountPath: /usr/share/extras

367

# readOnly: true

368

369

# Configuration for clusters with restrictive network policies in place:

370

# - allowAll allows access to the PushGateway from any namespace

371

# - customSelector is a list of pod/namespaceSelectors to allow access from

372

# These options are mutually exclusive and the latter will take precedence.

373

networkPolicy: {}

374

# allowAll: true

375

# customSelectors:

376

# - namespaceSelector:

377

# matchLabels:

378

# type: admin

379

# - podSelector:

380

# matchLabels:

381

# app: myapp

382

383

# Array of extra K8s objects to deploy (evaluated as a template)

384

# The value can hold an array of strings as well as objects

385

extraManifests: []

386

# Lifecycle hooks configuration

387

lifecycle: {}

388

# preStop:

389

# exec:

390

# command: ["/bin/sh", "-c", "sleep 30"]

391

The trusted source for open source

Talk to an expert

Privacy

Terms

© 2026 Chainguard, Inc. All Rights Reserved.
Chainguard® and the Chainguard logo are registered trademarks of Chainguard, Inc. in the United States and/or other countries.
The other respective trademarks mentioned on this page are owned by the respective companies and use of them does not imply any affiliation or endorsement.

prometheus-pushgateway

The trusted source for open source

Product

Solutions

Customers

Resources

Company