From ffa0580f9372e584d33418fe08aeecc4bb5a845f Mon Sep 17 00:00:00 2001 From: Vasily Sliouniaev Date: Sat, 15 Dec 2018 08:40:48 +0000 Subject: [PATCH] [stable/prometheus-operator] Update to v0.26.0, address setting empty selectors (#9647) * Option to set empty servicemonitor, rules selector Signed-off-by: Vasily * Update to 0.26 operator Signed-off-by: Vasily * Remove spaces to fix lint Signed-off-by: Vasily --- stable/prometheus-operator/Chart.yaml | 4 +- stable/prometheus-operator/README.md | 10 ++-- .../prometheus-operator/ci/test-values.yaml | 51 ++++++++++++------- .../templates/prometheus/prometheus.yaml | 7 +-- stable/prometheus-operator/values.yaml | 28 ++++++++-- 5 files changed, 68 insertions(+), 32 deletions(-) diff --git a/stable/prometheus-operator/Chart.yaml b/stable/prometheus-operator/Chart.yaml index 3244ce6860..f82fe14d3c 100644 --- a/stable/prometheus-operator/Chart.yaml +++ b/stable/prometheus-operator/Chart.yaml @@ -9,8 +9,8 @@ name: prometheus-operator sources: - https://github.com/coreos/prometheus-operator - https://coreos.com/operators/prometheus -version: 0.1.30 -appVersion: "0.25.0" +version: 0.1.31 +appVersion: 0.26.0 home: https://github.com/coreos/prometheus-operator keywords: - operator diff --git a/stable/prometheus-operator/README.md b/stable/prometheus-operator/README.md index b8a9b1219a..7fa3359c26 100644 --- a/stable/prometheus-operator/README.md +++ b/stable/prometheus-operator/README.md @@ -86,12 +86,12 @@ The following tables lists the configurable parameters of the prometheus-operato | `prometheusOperator.tolerations` | Tolerations for use with node taints https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/ | `[]` | | `prometheusOperator.affinity` | Assign the prometheus operator to run on specific nodes https://kubernetes.io/docs/concepts/configuration/assign-pod-node/ | `{}` | | `prometheusOperator.image.repository` | Repository for prometheus operator image | `quay.io/coreos/prometheus-operator` | -| `prometheusOperator.image.tag` | Tag for prometheus operator image | `v0.25.0` | +| `prometheusOperator.image.tag` | Tag for prometheus operator image | `v0.26.0` | | `prometheusOperator.image.pullPolicy` | Pull policy for prometheus operator image | `IfNotPresent` | | `prometheusOperator.configmapReloadImage.repository` | Repository for configmapReload image | `quay.io/coreos/configmap-reload` | | `prometheusOperator.configmapReloadImage.tag` | Tag for configmapReload image | `v0.0.1` | | `prometheusOperator.prometheusConfigReloaderImage.repository` | Repository for config-reloader image | `quay.io/coreos/prometheus-config-reloader` | -| `prometheusOperator.prometheusConfigReloaderImage.tag` | Tag for config-reloader image | `v0.25.0` | +| `prometheusOperator.prometheusConfigReloaderImage.tag` | Tag for config-reloader image | `v0.26.0` | | `prometheusOperator.hyperkubeImage.repository` | Repository for hyperkube image used to perform maintenance tasks | `gcr.io/google-containers/hyperkube` | | `prometheusOperator.hyperkubeImage.tag` | Tag for hyperkube image used to perform maintenance tasks | `v1.12.1` | | `prometheusOperator.hyperkubeImage.repository` | Image pull policy for hyperkube image used to perform maintenance tasks | `IfNotPresent` | @@ -117,6 +117,7 @@ The following tables lists the configurable parameters of the prometheus-operato | `prometheus.service.annotations` | Prometheus Service Annotations | `{}` | | `prometheus.additionalServiceMonitors` | List of `serviceMonitor` objects to create. See https://github.com/coreos/prometheus-operator/blob/master/Documentation/api.md#servicemonitorspec | `[]` | | `prometheus.prometheusSpec.podMetadata` | Standard object’s metadata. More info: https://github.com/kubernetes/community/blob/master/contributors/devel/api-conventions.md#metadata Metadata Labels and Annotations gets propagated to the prometheus pods. | `{}` | +| `prometheus.prometheusSpec.serviceMonitorSelecorNilUsesHelmValues` | If true, a nil or {} value for prometheus.prometheusSpec.serviceMonitorSelector will cause the prometheus resource to be created with selectors based on values in the helm deployment, which will also match the servicemonitors created | `true` | | `prometheus.prometheusSpec.serviceMonitorSelector` | ServiceMonitors to be selected for target discovery. | `{}` | | `prometheus.prometheusSpec.serviceMonitorNamespaceSelector` | Namespaces to be selected for ServiceMonitor discovery. If nil, only check own namespace. | `{}` | | `prometheus.prometheusSpec.image.repository` | Base image to use for a Prometheus deployment. | `quay.io/prometheus/prometheus` | @@ -131,6 +132,7 @@ The following tables lists the configurable parameters of the prometheus-operato | `prometheus.prometheusSpec.externalUrl` | The external URL the Prometheus instances will be available under. This is necessary to generate correct URLs. This is necessary if Prometheus is not served from root of a DNS name. | `""` | | `prometheus.prometheusSpec.routePrefix` | The route prefix Prometheus registers HTTP handlers for. This is useful, if using ExternalURL and a proxy is rewriting HTTP routes of a request, and the actual ExternalURL is still true, but the server serves requests under a different route prefix. For example for use with `kubectl proxy`. | `/` | | `prometheus.prometheusSpec.storageSpec` | Storage spec to specify how storage shall be used. | `{}` | +| `prometheus.prometheusSpec.ruleSelectorNilUsesHelmValues` | If true, a nil or {} value for prometheus.prometheusSpec.ruleSelector will cause the prometheus resource to be created with selectors based on values in the helm deployment, which will also match the PrometheusRule resources created. | `true` | | `prometheus.prometheusSpec.ruleSelector` | A selector to select which PrometheusRules to mount for loading alerting rules from. Until (excluding) Prometheus Operator v0.24.0 Prometheus Operator will migrate any legacy rule ConfigMaps to PrometheusRule custom resources selected by RuleSelector. Make sure it does not match any config maps that you do not want to be migrated. | `{}` | | `prometheus.prometheusSpec.ruleNamespaceSelector` | Namespaces to be selected for PrometheusRules discovery. If unspecified, only the same namespace as the Prometheus object is in is used. | `{}` | | `prometheus.prometheusSpec.alertingEndpoints` | Alertmanagers to which alerts will be sent https://github.com/coreos/prometheus-operator/blob/master/Documentation/api.md#alertmanagerendpoints Default configuration will connect to the alertmanager deployed as part of this release | `[]` | @@ -142,7 +144,7 @@ The following tables lists the configurable parameters of the prometheus-operato | `prometheus.prometheusSpec.tolerations` | If specified, the pod's tolerations. | `[]` | | `prometheus.prometheusSpec.remoteWrite` | If specified, the remote_write spec. This is an experimental feature, it may change in any upcoming release in a breaking way. | `[]` | | `prometheus.prometheusSpec.remoteRead` | If specified, the remote_read spec. This is an experimental feature, it may change in any upcoming release in a breaking way. | `[]` | -| `prometheus.prometheusSpec.securityContext` | SecurityContext holds pod-level security attributes and common container settings. This defaults to non root user with uid 1000 and gid 2000 for Prometheus >v2.0 and default PodSecurityContext for other versions. | `{}` | +| `prometheus.prometheusSpec.securityContext` | SecurityContext holds pod-level security attributes and common container settings. This defaults to non root user with uid 1000 and gid 2000 in order to support migration from operator version <0.26. | `{"runAsNonRoot": true, "runAsUser": 1000, "fsGroup": 2000}` | | `prometheus.prometheusSpec.listenLocal` | ListenLocal makes the Prometheus server listen on loopback, so that it does not bind against the Pod IP. | `false` | | `prometheus.prometheusSpec.containers` | Containers allows injecting additional containers. This is meant to allow adding an authentication proxy to a Prometheus pod. |`[]`| | `prometheus.prometheusSpec.additionalScrapeConfigs` | AdditionalScrapeConfigs allows specifying additional Prometheus scrape configurations. Scrape configurations are appended to the configurations generated by the Prometheus Operator. Job configurations must have the form as specified in the official Prometheus documentation: https://prometheus.io/docs/prometheus/latest/configuration/configuration/#. As scrape configs are appended, the user is responsible to make sure it is valid. Note that using this feature may expose the possibility to break upgrades of Prometheus. It is advised to review Prometheus release notes to ensure that no incompatible scrape configs are going to break Prometheus after the upgrade. | `{}` | @@ -186,7 +188,7 @@ The following tables lists the configurable parameters of the prometheus-operato | `alertmanager.alertmanagerSpec.resources` | Define resources requests and limits for single Pods. | `{}` | | `alertmanager.alertmanagerSpec.podAntiAffinity` | Pod anti-affinity can prevent the scheduler from placing Prometheus replicas on the same node. The default value "soft" means that the scheduler should *prefer* to not schedule two replica pods onto the same node but no guarantee is provided. The value "hard" means that the scheduler is *required* to not schedule two replica pods onto the same node. The value "" will disable pod anti-affinity so that no anti-affinity rules will be configured. | `""` | | `alertmanager.alertmanagerSpec.tolerations` | If specified, the pod's tolerations. | `[]` | -| `alertmanager.alertmanagerSpec.securityContext` | SecurityContext holds pod-level security attributes and common container settings. This defaults to non root user with uid 1000 and gid 2000. | `{}` | +| `alertmanager.alertmanagerSpec.securityContext` | SecurityContext holds pod-level security attributes and common container settings. This defaults to non root user with uid 1000 and gid 2000 in order to support migration from operator version < 0.26 | `{"runAsNonRoot": true, "runAsUser": 1000, "fsGroup": 2000}` | | `alertmanager.alertmanagerSpec.listenLocal` | ListenLocal makes the Alertmanager server listen on loopback, so that it does not bind against the Pod IP. Note this is only for the Alertmanager UI, not the gossip communication. | `false` | | `alertmanager.alertmanagerSpec.containers` | Containers allows injecting additional containers. This is meant to allow adding an authentication proxy to an Alertmanager pod. | `[]` | | `alertmanager.alertmanagerSpec.priorityClassName` | Priority class assigned to the Pods | `""` | diff --git a/stable/prometheus-operator/ci/test-values.yaml b/stable/prometheus-operator/ci/test-values.yaml index 637b11f60c..2f690e6544 100644 --- a/stable/prometheus-operator/ci/test-values.yaml +++ b/stable/prometheus-operator/ci/test-values.yaml @@ -129,7 +129,6 @@ alertmanager: ## service: annotations: {} - ## Port to expose on each node ## Only used if service.type is 'NodePort' ## @@ -178,7 +177,7 @@ alertmanager: replicas: 1 ## Time duration Alertmanager shall retain data for. Default is '120h', and must match the regular expression - ## [0-9]+(ms|s|m|h|d|w|y) (milliseconds seconds minutes hours days weeks years). + ## [0-9]+(ms|s|m|h) (milliseconds seconds minutes hours). ## retention: 120h @@ -241,7 +240,10 @@ alertmanager: ## This defaults to non root user with uid 1000 and gid 2000. *v1.PodSecurityContext false ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/ ## - securityContext: {} + securityContext: + runAsNonRoot: true + runAsUser: 1000 + fsGroup: 2000 ## ListenLocal makes the Alertmanager server listen on loopback, so that it does not bind against the Pod IP. ## Note this is only for the Alertmanager UI, not the gossip communication. @@ -479,6 +481,9 @@ prometheusOperator: ## podLabels: {} + ## Assign a PriorityClassName to pods if set + # priorityClassName: "" + ## If true, the operator will create and maintain a service for scraping kubelets ## ref: https://github.com/coreos/prometheus-operator/blob/master/helm/prometheus-operator/README.md ## @@ -528,11 +533,15 @@ prometheusOperator: # - e2e-az1 # - e2e-az2 + securityContext: + runAsNonRoot: true + runAsUser: 65534 + ## Prometheus-operator image ## image: repository: quay.io/coreos/prometheus-operator - tag: v0.25.0 + tag: v0.26.0 pullPolicy: IfNotPresent ## Configmap-reload image to use for reloading configmaps @@ -545,7 +554,7 @@ prometheusOperator: ## prometheusConfigReloaderImage: repository: quay.io/coreos/prometheus-config-reloader - tag: v0.25.0 + tag: v0.26.0 ## Hyperkube image to use when cleaning up ## @@ -570,6 +579,8 @@ prometheus: ## Configuration for Prometheus service ## service: + annotations: {} + ## Port to expose on each node ## Only used if service.type is 'NodePort' ## @@ -619,17 +630,6 @@ prometheus: serviceMonitor: selfMonitor: true - service: - annotations: {} - - ## Node Port (only used if service type is NodePort) - ## - # nodePort: 30816 - - ## Service type - ## - type: ClusterIP - ## Settings affecting prometheusSpec ## ref: https://github.com/coreos/prometheus-operator/blob/master/Documentation/api.md#prometheusspec ## @@ -706,6 +706,12 @@ prometheus: ## ruleNamespaceSelector: {} + ## If true, a nil or {} value for prometheus.prometheusSpec.ruleSelector will cause the + ## prometheus resource to be created with selectors based on values in the helm deployment, + ## which will also match the PrometheusRule resources created + ## + ruleSelectorNilUsesHelmValues: true + ## Rules CRD selector ## ref: https://github.com/coreos/prometheus-operator/blob/master/Documentation/design.md ## If unspecified the release `app` and `release` will be used as the label selector @@ -727,8 +733,14 @@ prometheus: # matchLabels: # role: example-rules + ## If true, a nil or {} value for prometheus.prometheusSpec.serviceMonitorSelector will cause the + ## prometheus resource to be created with selectors based on values in the helm deployment, + ## which will also match the servicemonitors created + ## + serviceMonitorSelecorNilUsesHelmValues: true + ## serviceMonitorSelector will limit which servicemonitors are used to create scrape - ## configs in Prometheus. By default all are loaded + ## configs in Prometheus. See serviceMonitorSelectorUseHelmLabels ## serviceMonitorSelector: {} @@ -880,7 +892,10 @@ prometheus: ## This defaults to non root user with uid 1000 and gid 2000. ## https://github.com/coreos/prometheus-operator/blob/master/Documentation/api.md ## - securityContext: {} + securityContext: + runAsNonRoot: true + runAsUser: 1000 + fsGroup: 2000 ## Priority class assigned to the Pods ## diff --git a/stable/prometheus-operator/templates/prometheus/prometheus.yaml b/stable/prometheus-operator/templates/prometheus/prometheus.yaml index b1a01029ac..fc7a270eb1 100644 --- a/stable/prometheus-operator/templates/prometheus/prometheus.yaml +++ b/stable/prometheus-operator/templates/prometheus/prometheus.yaml @@ -68,7 +68,7 @@ spec: {{- if .Values.prometheus.prometheusSpec.serviceMonitorSelector }} serviceMonitorSelector: {{ toYaml .Values.prometheus.prometheusSpec.serviceMonitorSelector | indent 4 }} -{{ else}} +{{ else if .Values.prometheus.prometheusSpec.serviceMonitorSelecorNilUsesHelmValues }} serviceMonitorSelector: matchLabels: release: {{ .Release.Name | quote }} @@ -96,10 +96,11 @@ spec: ruleNamespaceSelector: {{ toYaml .Values.prometheus.prometheusSpec.ruleNamespaceSelector | indent 4 }} {{- end }} +{{- if .Values.prometheus.prometheusSpec.ruleSelector }} ruleSelector: - {{- if .Values.prometheus.prometheusSpec.ruleSelector }} {{ toYaml .Values.prometheus.prometheusSpec.ruleSelector | indent 4}} - {{- else }} +{{- else if .Values.prometheus.prometheusSpec.ruleSelectorNilUsesHelmValues }} + ruleSelector: matchLabels: app: {{ template "prometheus-operator.name" . }} release: {{ .Release.Name | quote }} diff --git a/stable/prometheus-operator/values.yaml b/stable/prometheus-operator/values.yaml index c7df45932f..0ecbba0191 100644 --- a/stable/prometheus-operator/values.yaml +++ b/stable/prometheus-operator/values.yaml @@ -240,7 +240,10 @@ alertmanager: ## This defaults to non root user with uid 1000 and gid 2000. *v1.PodSecurityContext false ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/ ## - securityContext: {} + securityContext: + runAsNonRoot: true + runAsUser: 1000 + fsGroup: 2000 ## ListenLocal makes the Alertmanager server listen on loopback, so that it does not bind against the Pod IP. ## Note this is only for the Alertmanager UI, not the gossip communication. @@ -538,7 +541,7 @@ prometheusOperator: ## image: repository: quay.io/coreos/prometheus-operator - tag: v0.25.0 + tag: v0.26.0 pullPolicy: IfNotPresent ## Configmap-reload image to use for reloading configmaps @@ -551,7 +554,7 @@ prometheusOperator: ## prometheusConfigReloaderImage: repository: quay.io/coreos/prometheus-config-reloader - tag: v0.25.0 + tag: v0.26.0 ## Hyperkube image to use when cleaning up ## @@ -703,6 +706,12 @@ prometheus: ## ruleNamespaceSelector: {} + ## If true, a nil or {} value for prometheus.prometheusSpec.ruleSelector will cause the + ## prometheus resource to be created with selectors based on values in the helm deployment, + ## which will also match the PrometheusRule resources created + ## + ruleSelectorNilUsesHelmValues: true + ## Rules CRD selector ## ref: https://github.com/coreos/prometheus-operator/blob/master/Documentation/design.md ## If unspecified the release `app` and `release` will be used as the label selector @@ -724,8 +733,14 @@ prometheus: # matchLabels: # role: example-rules + ## If true, a nil or {} value for prometheus.prometheusSpec.serviceMonitorSelector will cause the + ## prometheus resource to be created with selectors based on values in the helm deployment, + ## which will also match the servicemonitors created + ## + serviceMonitorSelecorNilUsesHelmValues: true + ## serviceMonitorSelector will limit which servicemonitors are used to create scrape - ## configs in Prometheus. By default all are loaded + ## configs in Prometheus. See serviceMonitorSelectorUseHelmLabels ## serviceMonitorSelector: {} @@ -877,7 +892,10 @@ prometheus: ## This defaults to non root user with uid 1000 and gid 2000. ## https://github.com/coreos/prometheus-operator/blob/master/Documentation/api.md ## - securityContext: {} + securityContext: + runAsNonRoot: true + runAsUser: 1000 + fsGroup: 2000 ## Priority class assigned to the Pods ##