github/x509-certificate-exporter
1
0
Fork 0
mirror of https://github.com/enix/x509-certificate-exporter.git synced 2026-08-18 19:47:28 +00:00
Code Issues Packages Projects Releases Wiki Activity

feat(chart): enforce strict values schema end-to-end

Browse Source
This commit is contained in:
Thibault VINCENT
2026-08-05 19:14:52 +02:00
committed by Thibault VINCENT
parent 647ce98f16
commit ff3552d77f
25 changed files with 670 additions and 198 deletions
Download Patch File Download Diff File Expand all files Collapse all files
chart/README.md
+3 -1
View File
@@ -408,6 +408,7 @@ exporter-toolkit is the recommended path on new installs.
| prometheusServiceMonitor.metricRelabelings | list | `[]` | Metric relabel config for the ServiceMonitor, see: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api.md#monitoring.coreos.com/v1.Endpoint |
| prometheusServiceMonitor.relabelings | list | `[]` | Relabel config for the ServiceMonitor, see: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api.md#monitoring.coreos.com/v1.Endpoint |
| prometheusServiceMonitor.scheme | string | `"http"` | Scheme config for the ServiceMonitor, see: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api.md#monitoring.coreos.com/v1.Endpoint |
| prometheusServiceMonitor.basicAuth | object | `{}` | BasicAuth credentials for the ServiceMonitor endpoint (Secret key selectors for `username` and `password`), see: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api.md#monitoring.coreos.com/v1.BasicAuth |
| prometheusServiceMonitor.tlsConfig | object | `{}` | Custom TLS configuration, see: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api.md#monitoring.coreos.com/v1.TLSConfig |
| prometheusPodMonitor.create | bool | `false` | Should a PodMonitor object be installed to scrape this exporter. For prometheus-operator (kube-prometheus) users. |
| prometheusPodMonitor.scrapeInterval | string | `"60s"` | Target scrape interval set in the PodMonitor |
@@ -416,6 +417,7 @@ exporter-toolkit is the recommended path on new installs.
| prometheusPodMonitor.metricRelabelings | list | `[]` | Metric relabel config for the PodMonitor, see: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api.md#monitoring.coreos.com/v1.Endpoint |
| prometheusPodMonitor.relabelings | list | `[]` | Relabel config for the PodMonitor, see: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api.md#monitoring.coreos.com/v1.Endpoint |
| prometheusPodMonitor.scheme | string | `"http"` | Scheme config for the PodMonitor, see: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api.md#monitoring.coreos.com/v1.Endpoint |
| prometheusPodMonitor.basicAuth | object | `{}` | BasicAuth credentials for the PodMonitor endpoint (Secret key selectors for `username` and `password`), see: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api.md#monitoring.coreos.com/v1.BasicAuth |
| prometheusPodMonitor.tlsConfig | object | `{}` | Custom TLS configuration, see: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api.md#monitoring.coreos.com/v1.TLSConfig |
| prometheusRules.create | bool | `true` | Should a PrometheusRule object be installed to alert on certificate expiration. For prometheus-operator (kube-prometheus) users. |
| prometheusRules.rulePrefix | string | `""` | Prefix prepended to the alert rule names of PrometheusRule rules |
@@ -469,7 +471,7 @@ exporter-toolkit is the recommended path on new installs.
| rbacProxy.tls.existingSecretName | string | `""` | Pre-provisioned Secret carrying `tls.crt` + `tls.key` for the kube-rbac-proxy serving cert. When empty, the chart auto-generates a self-signed cert at install time and reuses it across upgrades via `lookup`. Set this to a cert-manager-managed Secret (or similar) for a cert with a real chain you can rotate independently. |
| rbacProxy.image.registry | string | `"quay.io"` | kube-rbac-proxy image registry. Empty string opts out of the registry prefix and lets the CRI fall back to its configured default (typically docker.io). |
| rbacProxy.image.repository | string | `"brancz/kube-rbac-proxy"` | kube-rbac-proxy image repository |
| rbacProxy.image.tag | string | `"v0.22.0"` | kube-rbac-proxy image tag |
| rbacProxy.image.tag | string | `"v0.22.1"` | kube-rbac-proxy image tag |
| rbacProxy.image.digest | string | `""` | kube-rbac-proxy image digest. When set, takes precedence over `tag` (immutable reference) |
| rbacProxy.image.pullPolicy | string | `"IfNotPresent"` | kube-rbac-proxy image pull policy |
| rbacProxy.upstreamListenPort | int | `9091` | Listen port for the exporter running inside kube-rbac-proxy exposed Pods |
chart/templates/podmonitor.yaml
+4
View File
@@ -21,6 +21,10 @@ spec:
bearerTokenFile: /var/run/secrets/kubernetes.io/serviceaccount/token
{{- end }}
scheme: {{ .Values.prometheusPodMonitor.scheme }}
{{- with .Values.prometheusPodMonitor.basicAuth }}
basicAuth:
{{- . | toYaml | nindent 6 }}
{{- end }}
{{- with .Values.prometheusPodMonitor.tlsConfig }}
tlsConfig:
{{- . | toYaml | nindent 6 }}
chart/templates/servicemonitor.yaml
+4
View File
@@ -25,6 +25,10 @@ spec:
bearerTokenFile: /var/run/secrets/kubernetes.io/serviceaccount/token
{{- end }}
scheme: {{ .Values.prometheusServiceMonitor.scheme }}
{{- with .Values.prometheusServiceMonitor.basicAuth }}
basicAuth:
{{- . | toYaml | nindent 6 }}
{{- end }}
{{- with .Values.prometheusServiceMonitor.tlsConfig }}
tlsConfig:
{{- . | toYaml | nindent 6 }}
chart/values.schema.json
+289 -165
View File
@@ -84,7 +84,8 @@
"validating",
"apiservice",
"crdConversion"
]
],
"type": "object"
}
},
"required": [
@@ -114,29 +115,42 @@
},
"extraDeploy": {
"items": {
"required": []
"required": [],
"type": [
"object",
"string"
]
},
"type": "array"
},
"extraDeployVerbatim": {
"items": {
"required": []
"required": [],
"type": [
"object",
"string"
]
},
"type": "array"
},
"extraLabels": {
"additionalProperties": true,
"required": []
"additionalProperties": {
"type": "string"
},
"required": [],
"type": "object"
},
"extraVolumeMounts": {
"items": {
"required": []
"required": [],
"type": "object"
},
"type": "array"
},
"extraVolumes": {
"items": {
"required": []
"required": [],
"type": "object"
},
"type": "array"
},
@@ -152,16 +166,22 @@
"additionalProperties": false,
"properties": {
"annotations": {
"additionalProperties": true,
"required": []
"additionalProperties": {
"type": "string"
},
"required": [],
"type": "object"
},
"createDashboard": {
"default": false,
"type": "boolean"
},
"extraLabels": {
"additionalProperties": true,
"required": []
"additionalProperties": {
"type": "string"
},
"required": [],
"type": "object"
},
"sidecarLabel": {
"default": "grafana_dashboard",
@@ -188,15 +208,22 @@
"properties": {
"affinity": {
"additionalProperties": true,
"required": []
"required": [],
"type": "object"
},
"annotations": {
"additionalProperties": true,
"required": []
"additionalProperties": {
"type": "string"
},
"required": [],
"type": "object"
},
"daemonSets": {
"additionalProperties": true,
"required": []
"additionalProperties": {
"type": "object"
},
"required": [],
"type": "object"
},
"debugMode": {
"default": false,
@@ -204,19 +231,22 @@
},
"env": {
"items": {
"required": []
"required": [],
"type": "object"
},
"type": "array"
},
"extraVolumeMounts": {
"items": {
"required": []
"required": [],
"type": "object"
},
"type": "array"
},
"extraVolumes": {
"items": {
"required": []
"required": [],
"type": "object"
},
"type": "array"
},
@@ -236,23 +266,34 @@
},
"livenessProbe": {
"additionalProperties": true,
"required": []
"required": [],
"type": "object"
},
"nodeSelector": {
"additionalProperties": true,
"required": []
"additionalProperties": {
"type": "string"
},
"required": [],
"type": "object"
},
"podAnnotations": {
"additionalProperties": true,
"required": []
"additionalProperties": {
"type": "string"
},
"required": [],
"type": "object"
},
"podExtraLabels": {
"additionalProperties": true,
"required": []
"additionalProperties": {
"type": "string"
},
"required": [],
"type": "object"
},
"podSecurityContext": {
"additionalProperties": true,
"required": []
"required": [],
"type": "object"
},
"priorityClassName": {
"default": "",
@@ -260,7 +301,8 @@
},
"readinessProbe": {
"additionalProperties": true,
"required": []
"required": [],
"type": "object"
},
"refreshInterval": {
"default": "300s",
@@ -268,7 +310,8 @@
},
"resources": {
"additionalProperties": true,
"required": []
"required": [],
"type": "object"
},
"restartPolicy": {
"default": "Always",
@@ -287,7 +330,8 @@
},
"securityContext": {
"additionalProperties": true,
"required": []
"required": [],
"type": "object"
},
"skipSymlinks": {
"default": false,
@@ -295,35 +339,37 @@
},
"tolerations": {
"items": {
"required": []
"required": [],
"type": "object"
},
"type": "array"
},
"updateStrategy": {
"additionalProperties": true,
"required": []
"required": [],
"type": "object"
},
"watchDirectories": {
"items": {
"required": []
"type": "string"
},
"type": "array"
},
"watchFiles": {
"items": {
"required": []
"type": "string"
},
"type": "array"
},
"watchKubeconfFiles": {
"items": {
"required": []
"type": "string"
},
"type": "array"
},
"watchSpecificExtensionDirectories": {
"items": {
"required": []
"type": "string"
},
"type": "array"
}
@@ -332,15 +378,7 @@
"debugMode",
"skipSymlinks",
"refreshInterval",
"tolerations",
"priorityClassName",
"extraVolumes",
"extraVolumeMounts",
"watchDirectories",
"watchSpecificExtensionDirectories",
"watchFiles",
"watchKubeconfFiles",
"env"
"priorityClassName"
],
"type": "object"
},
@@ -388,7 +426,8 @@
},
"imagePullSecrets": {
"items": {
"required": []
"required": [],
"type": "object"
},
"type": "array"
},
@@ -407,12 +446,18 @@
"additionalProperties": false,
"properties": {
"annotations": {
"additionalProperties": true,
"required": []
"additionalProperties": {
"type": "string"
},
"required": [],
"type": "object"
},
"extraLabels": {
"additionalProperties": true,
"required": []
"additionalProperties": {
"type": "string"
},
"required": [],
"type": "object"
},
"image": {
"additionalProperties": false,
@@ -453,15 +498,18 @@
},
"podSecurityContext": {
"additionalProperties": true,
"required": []
"required": [],
"type": "object"
},
"resources": {
"additionalProperties": true,
"required": []
"required": [],
"type": "object"
},
"securityContext": {
"additionalProperties": true,
"required": []
"required": [],
"type": "object"
}
},
"required": [
@@ -478,49 +526,65 @@
"type": "string"
},
"podAnnotations": {
"additionalProperties": true,
"required": []
"additionalProperties": {
"type": "string"
},
"required": [],
"type": "object"
},
"podExtraLabels": {
"additionalProperties": true,
"required": []
"additionalProperties": {
"type": "string"
},
"required": [],
"type": "object"
},
"podListenPort": {
"default": "9793",
"default": 9793,
"maximum": 65535,
"minimum": 1,
"required": []
"type": "integer"
},
"priorityClassName": {
"default": "",
"type": "string"
},
"probeListenPort": {
"default": "0",
"default": 0,
"maximum": 65535,
"minimum": 0,
"required": []
"type": "integer"
},
"prometheusPodMonitor": {
"additionalProperties": true,
"additionalProperties": false,
"properties": {
"basicAuth": {
"additionalProperties": true,
"required": [],
"type": "object"
},
"create": {
"default": false,
"type": "boolean"
},
"extraLabels": {
"additionalProperties": true,
"required": []
"additionalProperties": {
"type": "string"
},
"required": [],
"type": "object"
},
"metricRelabelings": {
"items": {
"required": []
"required": [],
"type": "object"
},
"type": "array"
},
"relabelings": {
"items": {
"required": []
"required": [],
"type": "object"
},
"type": "array"
},
@@ -542,16 +606,16 @@
},
"tlsConfig": {
"additionalProperties": true,
"required": []
"required": [],
"type": "object"
}
},
"required": [
"create",
"scrapeInterval",
"scrapeTimeout",
"metricRelabelings",
"relabelings"
]
"scrapeTimeout"
],
"type": "object"
},
"prometheusRules": {
"additionalProperties": false,
@@ -564,12 +628,18 @@
"type": "object"
},
"alertExtraAnnotations": {
"additionalProperties": true,
"required": []
"additionalProperties": {
"type": "string"
},
"required": [],
"type": "object"
},
"alertExtraLabels": {
"additionalProperties": true,
"required": []
"additionalProperties": {
"type": "string"
},
"required": [],
"type": "object"
},
"alertForOverrides": {
"additionalProperties": {
@@ -657,9 +727,9 @@
"type": "boolean"
},
"criticalDaysLeft": {
"default": "14",
"default": 14,
"minimum": 0,
"required": []
"type": "integer"
},
"crlNeedsRefreshSeverity": {
"default": "warning",
@@ -680,9 +750,9 @@
"required": []
},
"crlWarningDaysLeft": {
"default": "7",
"default": 7,
"minimum": 0,
"required": []
"type": "integer"
},
"disableBuiltinAlertGroup": {
"default": false,
@@ -690,13 +760,17 @@
},
"extraAlertGroups": {
"items": {
"required": []
"required": [],
"type": "object"
},
"type": "array"
},
"extraLabels": {
"additionalProperties": true,
"required": []
"additionalProperties": {
"type": "string"
},
"required": [],
"type": "object"
},
"keystorePassphraseFailuresSeverity": {
"default": "warning",
@@ -757,9 +831,9 @@
"required": []
},
"warningDaysLeft": {
"default": "28",
"default": 28,
"minimum": 0,
"required": []
"type": "integer"
}
},
"required": [
@@ -772,35 +846,47 @@
"alertOnCertificateError",
"alertOnCertificateNotYetValid",
"alertOnCertificateCollision",
"disableBuiltinAlertGroup",
"extraAlertGroups"
"disableBuiltinAlertGroup"
],
"type": "object"
},
"prometheusServiceMonitor": {
"additionalProperties": true,
"additionalProperties": false,
"properties": {
"basicAuth": {
"additionalProperties": true,
"required": [],
"type": "object"
},
"create": {
"default": true,
"type": "boolean"
},
"extraAnnotations": {
"additionalProperties": true,
"required": []
"additionalProperties": {
"type": "string"
},
"required": [],
"type": "object"
},
"extraLabels": {
"additionalProperties": true,
"required": []
"additionalProperties": {
"type": "string"
},
"required": [],
"type": "object"
},
"metricRelabelings": {
"items": {
"required": []
"required": [],
"type": "object"
},
"type": "array"
},
"relabelings": {
"items": {
"required": []
"required": [],
"type": "object"
},
"type": "array"
},
@@ -822,16 +908,16 @@
},
"tlsConfig": {
"additionalProperties": true,
"required": []
"required": [],
"type": "object"
}
},
"required": [
"create",
"scrapeInterval",
"scrapeTimeout",
"metricRelabelings",
"relabelings"
]
"scrapeTimeout"
],
"type": "object"
},
"psp": {
"additionalProperties": false,
@@ -857,16 +943,25 @@
"additionalProperties": false,
"properties": {
"clusterRoleAnnotations": {
"additionalProperties": true,
"required": []
"additionalProperties": {
"type": "string"
},
"required": [],
"type": "object"
},
"clusterRoleBindingAnnotations": {
"additionalProperties": true,
"required": []
"additionalProperties": {
"type": "string"
},
"required": [],
"type": "object"
},
"serviceAccountAnnotations": {
"additionalProperties": true,
"required": []
"additionalProperties": {
"type": "string"
},
"required": [],
"type": "object"
},
"serviceAccountName": {
"default": "",
@@ -884,16 +979,25 @@
"additionalProperties": false,
"properties": {
"clusterRoleAnnotations": {
"additionalProperties": true,
"required": []
"additionalProperties": {
"type": "string"
},
"required": [],
"type": "object"
},
"clusterRoleBindingAnnotations": {
"additionalProperties": true,
"required": []
"additionalProperties": {
"type": "string"
},
"required": [],
"type": "object"
},
"serviceAccountAnnotations": {
"additionalProperties": true,
"required": []
"additionalProperties": {
"type": "string"
},
"required": [],
"type": "object"
},
"serviceAccountName": {
"default": "",
@@ -948,7 +1052,7 @@
"type": "string"
},
"tag": {
"default": "v0.22.0",
"default": "v0.22.1",
"type": "string"
}
},
@@ -961,11 +1065,13 @@
},
"resources": {
"additionalProperties": true,
"required": []
"required": [],
"type": "object"
},
"securityContext": {
"additionalProperties": true,
"required": []
"required": [],
"type": "object"
},
"tls": {
"additionalProperties": false,
@@ -981,10 +1087,10 @@
"type": "object"
},
"upstreamListenPort": {
"default": "9091",
"default": 9091,
"maximum": 65535,
"minimum": 1,
"required": []
"type": "integer"
}
},
"required": [
@@ -999,11 +1105,15 @@
"properties": {
"affinity": {
"additionalProperties": true,
"required": []
"required": [],
"type": "object"
},
"annotations": {
"additionalProperties": true,
"required": []
"additionalProperties": {
"type": "string"
},
"required": [],
"type": "object"
},
"cache": {
"additionalProperties": false,
@@ -1013,9 +1123,9 @@
"type": "boolean"
},
"maxDuration": {
"default": "300",
"default": 300,
"minimum": 1,
"required": []
"type": "integer"
}
},
"required": [
@@ -1025,7 +1135,7 @@
},
"configMapKeys": {
"items": {
"required": []
"type": "string"
},
"type": "array"
},
@@ -1039,7 +1149,8 @@
},
"env": {
"items": {
"required": []
"required": [],
"type": "object"
},
"type": "array"
},
@@ -1115,19 +1226,21 @@
},
"extraArgs": {
"items": {
"required": []
"type": "string"
},
"type": "array"
},
"extraVolumeMounts": {
"items": {
"required": []
"required": [],
"type": "object"
},
"type": "array"
},
"extraVolumes": {
"items": {
"required": []
"required": [],
"type": "object"
},
"type": "array"
},
@@ -1185,18 +1298,18 @@
"additionalProperties": false,
"properties": {
"burstQueries": {
"default": "10",
"default": 10,
"minimum": 1,
"required": []
"type": "integer"
},
"enabled": {
"default": false,
"type": "boolean"
},
"queriesPerSecond": {
"default": "5",
"default": 5,
"minimum": 0,
"required": []
"type": "number"
}
},
"required": [
@@ -1205,29 +1318,40 @@
"type": "object"
},
"listPageSize": {
"default": "0",
"default": 0,
"minimum": 0,
"required": []
"type": "integer"
},
"livenessProbe": {
"additionalProperties": true,
"required": []
"required": [],
"type": "object"
},
"nodeSelector": {
"additionalProperties": true,
"required": []
"additionalProperties": {
"type": "string"
},
"required": [],
"type": "object"
},
"podAnnotations": {
"additionalProperties": true,
"required": []
"additionalProperties": {
"type": "string"
},
"required": [],
"type": "object"
},
"podExtraLabels": {
"additionalProperties": true,
"required": []
"additionalProperties": {
"type": "string"
},
"required": [],
"type": "object"
},
"podSecurityContext": {
"additionalProperties": true,
"required": []
"required": [],
"type": "object"
},
"priorityClassName": {
"default": "",
@@ -1235,16 +1359,18 @@
},
"readinessProbe": {
"additionalProperties": true,
"required": []
"required": [],
"type": "object"
},
"replicas": {
"default": "1",
"default": 1,
"minimum": 1,
"required": []
"type": "integer"
},
"resources": {
"additionalProperties": true,
"required": []
"required": [],
"type": "object"
},
"restartPolicy": {
"default": "Always",
@@ -1381,19 +1507,22 @@
],
"type": "object"
},
"required": []
"type": "array"
},
"securityContext": {
"additionalProperties": true,
"required": []
"required": [],
"type": "object"
},
"strategy": {
"additionalProperties": true,
"required": []
"required": [],
"type": "object"
},
"tolerations": {
"items": {
"required": []
"required": [],
"type": "object"
},
"type": "array"
}
@@ -1401,15 +1530,9 @@
"required": [
"enabled",
"debugMode",
"tolerations",
"priorityClassName",
"extraVolumes",
"extraVolumeMounts",
"configMapKeys",
"extraArgs",
"cache",
"kubeApiRateLimits",
"env"
"kubeApiRateLimits"
],
"type": "object"
},
@@ -1417,26 +1540,32 @@
"additionalProperties": false,
"properties": {
"annotations": {
"additionalProperties": true,
"required": []
"additionalProperties": {
"type": "string"
},
"required": [],
"type": "object"
},
"create": {
"default": true,
"type": "boolean"
},
"extraLabels": {
"additionalProperties": true,
"required": []
"additionalProperties": {
"type": "string"
},
"required": [],
"type": "object"
},
"headless": {
"default": true,
"type": "boolean"
},
"port": {
"default": "9793",
"default": 9793,
"maximum": 65535,
"minimum": 1,
"required": []
"type": "integer"
}
},
"required": [
@@ -1471,9 +1600,6 @@
"nameOverride",
"fullnameOverride",
"namespaceOverride",
"extraDeploy",
"extraDeployVerbatim",
"imagePullSecrets",
"image",
"migration",
"exposePerCertificateErrorMetrics",
@@ -1492,8 +1618,6 @@
"service",
"prometheusRules",
"priorityClassName",
"extraVolumes",
"extraVolumeMounts",
"psp",
"rbac",
"rbacProxy"
chart/values.yaml
+207 -32
View File
@@ -7,11 +7,23 @@ fullnameOverride: ""
# -- Override the deployment namespace
namespaceOverride: ""
# @schema
# type: array
# items: {type: [object, string]}
# @schema
# -- Additional objects to deploy with the release
extraDeploy: []
# @schema
# type: array
# items: {type: [object, string]}
# @schema
# -- Same as `extraDeploy` but objects won't go through the templating engine
extraDeployVerbatim: []
# @schema
# type: array
# items: {type: object}
# @schema
# -- Specify docker-registry secret names as an array
imagePullSecrets: []
@@ -52,16 +64,19 @@ migration:
# -- kubectl image pull policy
pullPolicy: IfNotPresent
# @schema
# additionalProperties: true
# type: object
# additionalProperties: {type: string}
# @schema
# -- Annotations added to Helm hook Pods
annotations: {}
# @schema
# additionalProperties: true
# type: object
# additionalProperties: {type: string}
# @schema
# -- Additional labels added to Helm hook Pods
extraLabels: {}
# @schema
# type: object
# additionalProperties: true
# properties: {}
# @schema
@@ -75,6 +90,7 @@ migration:
cpu: 20m
memory: 20Mi
# @schema
# type: object
# additionalProperties: true
# properties: {}
# @schema
@@ -85,6 +101,7 @@ migration:
seccompProfile:
type: RuntimeDefault
# @schema
# type: object
# additionalProperties: true
# properties: {}
# @schema
@@ -129,13 +146,15 @@ grafana:
# -- ConfigMap label value the Grafana sidecar is looking for
sidecarLabelValue: "1"
# @schema
# additionalProperties: true
# type: object
# additionalProperties: {type: string}
# @schema
# -- Annotations added to the Grafana dashboard ConfigMap (example in `values.yaml`)
annotations: {}
# k8s-sidecar-target-directory: "/tmp/dashboards/Example"
# @schema
# additionalProperties: true
# type: object
# additionalProperties: {type: string}
# @schema
# -- Additional labels added to the Grafana dashboard ConfigMap
extraLabels: {}
@@ -144,13 +163,15 @@ secretsExporter:
# -- Should the TLS Secrets exporter be running
enabled: true
# @schema
# additionalProperties: true
# type: object
# additionalProperties: {type: string}
# @schema
# -- Additional Deployment annotations
annotations: {}
# -- Should debug messages be produced by the TLS Secrets exporter
debugMode: false
# @schema
# type: integer
# minimum: 1
# @schema
# -- Desired number of TLS Secrets exporter Pods
@@ -161,6 +182,7 @@ secretsExporter:
# -- restartPolicy for Pods of the TLS Secrets exporter
restartPolicy: Always
# @schema
# type: object
# additionalProperties: true
# @schema
# -- DeploymentStrategy for the TLS Secrets exporter
@@ -171,6 +193,7 @@ secretsExporter:
# -- (int) Number of old ReplicaSets to retain for rollback
revisionHistoryLimit:
# @schema
# type: object
# additionalProperties: true
# properties: {}
# @schema
@@ -184,6 +207,7 @@ secretsExporter:
cpu: 20m
memory: 20Mi
# @schema
# type: object
# additionalProperties: true
# properties: {}
# @schema
@@ -193,6 +217,7 @@ secretsExporter:
initialDelaySeconds: 5
periodSeconds: 3
# @schema
# type: object
# additionalProperties: true
# properties: {}
# @schema
@@ -202,13 +227,19 @@ secretsExporter:
initialDelaySeconds: 5
periodSeconds: 3
# @schema
# additionalProperties: true
# type: object
# additionalProperties: {type: string}
# @schema
# -- Node selector for Pods of the TLS Secrets exporter
nodeSelector: {}
# @schema
# type: array
# items: {type: object}
# @schema
# -- Tolerations for Pods of the TLS Secrets exporter
tolerations: []
# @schema
# type: object
# additionalProperties: true
# @schema
# -- Affinity for Pods of the TLS Secrets exporter
@@ -216,16 +247,19 @@ secretsExporter:
# -- PriorityClassName for Pods of the TLS Secrets exporter
priorityClassName: ""
# @schema
# additionalProperties: true
# type: object
# additionalProperties: {type: string}
# @schema
# -- Additional labels added to Pods of the TLS Secrets exporter
podExtraLabels: {}
# @schema
# additionalProperties: true
# type: object
# additionalProperties: {type: string}
# @schema
# -- Annotations added to Pods of the TLS Secrets exporter
podAnnotations: {}
# @schema
# type: object
# additionalProperties: true
# properties: {}
# @schema
@@ -236,6 +270,7 @@ secretsExporter:
seccompProfile:
type: RuntimeDefault
# @schema
# type: object
# additionalProperties: true
# properties: {}
# @schema
@@ -249,12 +284,21 @@ secretsExporter:
capabilities:
drop:
- ALL
# @schema
# type: array
# items: {type: object}
# @schema
# -- Additional volumes added to Pods of the TLS Secrets exporter (combined with global `extraVolumes`)
extraVolumes: []
# @schema
# type: array
# items: {type: object}
# @schema
# -- Additional volume mounts added to Pod containers of the TLS Secrets exporter (combined with global `extraVolumeMounts`)
extraVolumeMounts: []
# @schema
# type: array
# items:
# type: object
# additionalProperties: false
@@ -315,6 +359,10 @@ secretsExporter:
- type: kubernetes.io/tls
key: tls.crt
# @schema
# type: array
# items: {type: string}
# @schema
# -- If the exporter should watch for certificates in ConfigMaps, just specify the keys it needs to watch. E.g.: `configMapKeys: ["tls.crt"]`
# @default -- see `values.yaml`
configMapKeys: []
@@ -391,6 +439,10 @@ secretsExporter:
# @schema
# -- Expose selected labels from Kubernetes ConfigMaps as Prometheus labels. Same caveat as `exposeSecretLabels` — keep the list to slow-changing identifiers and avoid high-cardinality values.
exposeConfigMapLabels: []
# @schema
# type: array
# items: {type: string}
# @schema
# -- Additional arguments to append to the exporter command line. E.g.: `--watch-file="/extra-cert/tls.crt"`.
extraArgs: []
@@ -398,6 +450,7 @@ secretsExporter:
# -- Enable caching of Kubernetes objects to prevent scraping timeouts
enabled: true
# @schema
# type: integer
# minimum: 1
# @schema
# -- Maximum time an object can stay in cache unrefreshed (seconds) - it will be at least half of that
@@ -407,17 +460,20 @@ secretsExporter:
# -- Should requests to the Kubernetes API server be rate-limited
enabled: false
# @schema
# type: number
# minimum: 0
# @schema
# -- Maximum rate of queries sent to the API server (per second)
queriesPerSecond: 5
# @schema
# type: integer
# minimum: 1
# @schema
# -- Burst bucket size for queries sent to the API server
burstQueries: 10
# @schema
# type: integer
# minimum: 0
# @schema
# -- Page size used by the paginated initial LIST against the
@@ -430,6 +486,10 @@ secretsExporter:
# memory-constrained pods. `0` keeps the built-in default.
listPageSize: 0
# @schema
# type: array
# items: {type: object}
# @schema
# -- Additional environment variables for containers
env: []
# - name: GOMAXPROCS
@@ -439,6 +499,7 @@ cabundlesExporter:
# -- Should the cluster-wide caBundle exporter be active. Watches inline `caBundle` PEM fields of admission resources (and other API discovery resources) cluster-wide and emits one series per (resource, webhook entry). Opt-in because it requires cluster-scoped get+list+watch on the corresponding API groups.
enabled: false
# @schema
# type: object
# additionalProperties: false
# @schema
# -- Per-resource opt-in. Each true flag adds the corresponding rule to the ClusterRole and starts the matching informer. Toggle off the resource kinds you don't use to keep the RBAC scope minimal.
@@ -484,7 +545,8 @@ cabundlesExporter:
hostPathsExporter:
# @schema
# additionalProperties: true
# type: object
# additionalProperties: {type: string}
# @schema
# -- Additional DaemonSet annotations
annotations: {}
@@ -500,6 +562,7 @@ hostPathsExporter:
# -- restartPolicy for Pods of hostPath exporters (default for all hostPathsExporter.daemonSets)
restartPolicy: Always
# @schema
# type: object
# additionalProperties: true
# @schema
# -- updateStrategy for DaemonSets of hostPath exporters (default for all hostPathsExporter.daemonSets)
@@ -510,6 +573,7 @@ hostPathsExporter:
# -- (int) Number of old ReplicaSets to retain for rollback (default for all hostPathsExporter.daemonSets)
revisionHistoryLimit:
# @schema
# type: object
# additionalProperties: true
# properties: {}
# @schema
@@ -523,6 +587,7 @@ hostPathsExporter:
cpu: 10m
memory: 20Mi
# @schema
# type: object
# additionalProperties: true
# properties: {}
# @schema
@@ -532,6 +597,7 @@ hostPathsExporter:
initialDelaySeconds: 5
periodSeconds: 3
# @schema
# type: object
# additionalProperties: true
# properties: {}
# @schema
@@ -541,13 +607,19 @@ hostPathsExporter:
initialDelaySeconds: 5
periodSeconds: 3
# @schema
# additionalProperties: true
# type: object
# additionalProperties: {type: string}
# @schema
# -- Node selector for Pods of hostPath exporters (default for all hostPathsExporter.daemonSets)
nodeSelector: {}
# @schema
# type: array
# items: {type: object}
# @schema
# -- Tolerations for Pods of hostPath exporters (default for all hostPathsExporter.daemonSets)
tolerations: []
# @schema
# type: object
# additionalProperties: true
# @schema
# -- Affinity for Pods of hostPath exporters (default for all hostPathsExporter.daemonSets)
@@ -555,16 +627,19 @@ hostPathsExporter:
# -- PriorityClassName for Pods of hostPath exporters
priorityClassName: ""
# @schema
# additionalProperties: true
# type: object
# additionalProperties: {type: string}
# @schema
# -- Additional labels added to Pods of hostPath exporters (default for all hostPathsExporter.daemonSets)
podExtraLabels: {}
# @schema
# additionalProperties: true
# type: object
# additionalProperties: {type: string}
# @schema
# -- Annotations added to Pods of hostPath exporters (default for all hostPathsExporter.daemonSets)
podAnnotations: {}
# @schema
# type: object
# additionalProperties: true
# properties: {}
# @schema
@@ -574,6 +649,7 @@ hostPathsExporter:
seccompProfile:
type: RuntimeDefault
# @schema
# type: object
# additionalProperties: true
# properties: {}
# @schema
@@ -587,8 +663,16 @@ hostPathsExporter:
capabilities:
drop:
- ALL
# @schema
# type: array
# items: {type: object}
# @schema
# -- Additional volumes added to Pods of hostPath exporters (default for all hostPathsExporter.daemonSets ; combined with global `extraVolumes`)
extraVolumes: []
# @schema
# type: array
# items: {type: object}
# @schema
# -- Additional volume mounts added to Pod containers of hostPath exporters (default for all hostPathsExporter.daemonSets ; combined with global `extraVolumeMounts`)
extraVolumeMounts: []
@@ -598,27 +682,49 @@ hostPathsExporter:
# @schema
# -- Type for HostPath volumes used with watched paths. Can be set to `""` or null to use Kubernetes defaults. May be required with RKE if Pods don't start.
hostPathVolumeType: Directory
# @schema
# type: array
# items: {type: string}
# @schema
# -- [SEE README] List of directory paths of the host to scan for PEM encoded certificate files to be watched and exported as metrics. Each entry is a literal directory (scanned one level deep, default) or a shell-glob pattern with `**` for recursion — e.g. `/var/lib/kubelet/pods/**/*.crt` walks every Pod's volume subtree. The static prefix before any `*`/`?`/`[`/`**` is what gets mounted from the host, so a recursive pattern still binds the smallest containing directory rather than the whole filesystem.
watchDirectories: []
# @schema
# type: array
# items: {type: string}
# @schema
# -- [SEE README] List of directory paths of the host to scan for specific extension files to be watched and exported as metrics (one level deep)
watchSpecificExtensionDirectories: []
# @schema
# type: array
# items: {type: string}
# @schema
# -- [SEE README] List of file paths of the host for PEM encoded certificates to be watched and exported as metrics (one level deep)
watchFiles: []
# @schema
# type: array
# items: {type: string}
# @schema
# -- [SEE README] List of Kubeconf file paths of the host to scan for embedded certificates to export metrics about
watchKubeconfFiles: []
# @schema
# type: array
# items: {type: object}
# @schema
# -- Additional environment variables for containers
env: []
# - name: GOMAXPROCS
# value: "1"
# @schema
# additionalProperties: true
# type: object
# additionalProperties: {type: object}
# @schema
# -- [SEE README] Map to define one or many DaemonSets running hostPath exporters. Key is used as a name ; value is a map to override all default settings set by `hostPathsExporter.*`.
daemonSets: {}
# @schema
# type: integer
# minimum: 1
# maximum: 65535
# @schema
@@ -626,6 +732,7 @@ hostPathsExporter:
podListenPort: 9793
# @schema
# type: integer
# minimum: 0
# maximum: 65535
# @schema
@@ -656,24 +763,28 @@ service:
# -- Should the Service be headless (`clusterIP: None`).
headless: true
# @schema
# type: integer
# minimum: 1
# maximum: 65535
# @schema
# -- TCP port to expose the Service on
port: 9793
# @schema
# additionalProperties: true
# type: object
# additionalProperties: {type: string}
# @schema
# -- Annotations to add to the Service
annotations: {}
# @schema
# additionalProperties: true
# type: object
# additionalProperties: {type: string}
# @schema
# -- Additional labels to add to the Service
extraLabels: {}
# @schema
# additionalProperties: true
# type: object
# additionalProperties: false
# @schema
prometheusServiceMonitor:
# -- Should a ServiceMonitor object be installed to scrape this exporter. For prometheus-operator (kube-prometheus) users.
@@ -683,17 +794,27 @@ prometheusServiceMonitor:
# -- Target scrape timeout set in the ServiceMonitor
scrapeTimeout: 30s
# @schema
# additionalProperties: true
# type: object
# additionalProperties: {type: string}
# @schema
# -- Additional labels to add to ServiceMonitor objects
extraLabels: {}
# @schema
# additionalProperties: true
# type: object
# additionalProperties: {type: string}
# @schema
# -- Additional annotations to add to ServiceMonitor objects
extraAnnotations: {}
# @schema
# type: array
# items: {type: object}
# @schema
# -- Metric relabel config for the ServiceMonitor, see: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api.md#monitoring.coreos.com/v1.Endpoint
metricRelabelings: []
# @schema
# type: array
# items: {type: object}
# @schema
# -- Relabel config for the ServiceMonitor, see: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api.md#monitoring.coreos.com/v1.Endpoint
relabelings: []
# @schema
@@ -702,13 +823,21 @@ prometheusServiceMonitor:
# -- Scheme config for the ServiceMonitor, see: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api.md#monitoring.coreos.com/v1.Endpoint
scheme: http
# @schema
# type: object
# additionalProperties: true
# @schema
# -- BasicAuth credentials for the ServiceMonitor endpoint (Secret key selectors for `username` and `password`), see: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api.md#monitoring.coreos.com/v1.BasicAuth
basicAuth: {}
# @schema
# type: object
# additionalProperties: true
# @schema
# -- Custom TLS configuration, see: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api.md#monitoring.coreos.com/v1.TLSConfig
tlsConfig: {}
# @schema
# additionalProperties: true
# type: object
# additionalProperties: false
# @schema
prometheusPodMonitor:
# -- Should a PodMonitor object be installed to scrape this exporter. For prometheus-operator (kube-prometheus) users.
@@ -718,12 +847,21 @@ prometheusPodMonitor:
# -- Target scrape timeout set in the PodMonitor
scrapeTimeout: 30s
# @schema
# additionalProperties: true
# type: object
# additionalProperties: {type: string}
# @schema
# -- Additional labels to add to PodMonitor objects
extraLabels: {}
# @schema
# type: array
# items: {type: object}
# @schema
# -- Metric relabel config for the PodMonitor, see: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api.md#monitoring.coreos.com/v1.Endpoint
metricRelabelings: []
# @schema
# type: array
# items: {type: object}
# @schema
# -- Relabel config for the PodMonitor, see: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api.md#monitoring.coreos.com/v1.Endpoint
relabelings: []
# @schema
@@ -732,6 +870,13 @@ prometheusPodMonitor:
# -- Scheme config for the PodMonitor, see: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api.md#monitoring.coreos.com/v1.Endpoint
scheme: http
# @schema
# type: object
# additionalProperties: true
# @schema
# -- BasicAuth credentials for the PodMonitor endpoint (Secret key selectors for `username` and `password`), see: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api.md#monitoring.coreos.com/v1.BasicAuth
basicAuth: {}
# @schema
# type: object
# additionalProperties: true
# @schema
# -- Custom TLS configuration, see: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api.md#monitoring.coreos.com/v1.TLSConfig
@@ -743,17 +888,20 @@ prometheusRules:
# -- Prefix prepended to the alert rule names of PrometheusRule rules
rulePrefix: ""
# @schema
# additionalProperties: true
# type: object
# additionalProperties: {type: string}
# @schema
# -- Additional labels to add to PrometheusRule objects
extraLabels: {}
# @schema
# additionalProperties: true
# type: object
# additionalProperties: {type: string}
# @schema
# -- Additional labels to add to PrometheusRule rules
alertExtraLabels: {}
# @schema
# additionalProperties: true
# type: object
# additionalProperties: {type: string}
# @schema
# -- Additional annotations to add to PrometheusRule rules
alertExtraAnnotations: {}
@@ -821,11 +969,13 @@ prometheusRules:
# -- Severity for the CertificateExpiration alerting rule
certificateExpirationsSeverity: critical
# @schema
# type: integer
# minimum: 0
# @schema
# -- Raise a warning alert when fewer than this many days are left before a certificate expiration (cert-manager would renew Let's Encrypt certs before day 29)
warningDaysLeft: 28
# @schema
# type: integer
# minimum: 0
# @schema
# -- Raise a critical alert when fewer than this many days are left before a certificate expiration (two weeks to deal with ACME rate limiting should this be an issue)
@@ -850,6 +1000,7 @@ prometheusRules:
# underlying `x509_crl_*` series only exist when a CRL is actually
# observed, so installations that don't watch any CRL get no alerts.
# @schema
# type: integer
# minimum: 0
# @schema
# -- Raise a warning alert when fewer than this many days are left before a CRL reaches its nextUpdate. CRLs are typically refreshed daily to weekly; 7 days gives a comfortable margin for a publisher running on a weekly cadence.
@@ -867,6 +1018,10 @@ prometheusRules:
# -- Skip all built-in alerts when using extraAlertGroups
disableBuiltinAlertGroup: false
# @schema
# type: array
# items: {type: object}
# @schema
# -- Additional alert groups for custom configuration (example in `values.yaml`)
extraAlertGroups: []
# - name: x509-certificate-exporter.custom
@@ -916,19 +1071,22 @@ prometheusRules:
# CertificateError: "1m"
# @schema
# additionalProperties: true
# type: object
# additionalProperties: {type: string}
# @schema
# -- Additional labels added to all chart objects
extraLabels: {}
# @schema
# additionalProperties: true
# type: object
# additionalProperties: {type: string}
# @schema
# -- Additional labels added to all Pods
podExtraLabels: {}
# @schema
# additionalProperties: true
# type: object
# additionalProperties: {type: string}
# @schema
# -- Annotations added to all Pods
podAnnotations: {}
@@ -938,9 +1096,17 @@ podAnnotations: {}
# -- PriorityClassName set for all Pods by default (can be overridden with `secretsExporter` and `hostPathsExporter` specific values)
priorityClassName: ""
# @schema
# type: array
# items: {type: object}
# @schema
# -- Additional volumes added to all Pods (see also the `secretsExporter` and `hostPathsExporter` variants)
extraVolumes: []
# @schema
# type: array
# items: {type: object}
# @schema
# -- Additional volume mounts added to all Pod containers (see also the `secretsExporter` and `hostPathsExporter` variants)
extraVolumeMounts: []
@@ -959,17 +1125,20 @@ rbac:
# -- Name of the ServiceAccount for the Secrets exporter (required if `rbac.create=false`)
serviceAccountName:
# @schema
# additionalProperties: true
# type: object
# additionalProperties: {type: string}
# @schema
# -- Annotations added to the ServiceAccount for the Secrets exporter
serviceAccountAnnotations: {}
# @schema
# additionalProperties: true
# type: object
# additionalProperties: {type: string}
# @schema
# -- Annotations added to the ClusterRole for the Secrets exporter
clusterRoleAnnotations: {}
# @schema
# additionalProperties: true
# type: object
# additionalProperties: {type: string}
# @schema
# -- Annotations added to the ClusterRoleBinding for the Secrets exporter
clusterRoleBindingAnnotations: {}
@@ -981,17 +1150,20 @@ rbac:
# -- Name of the ServiceAccount for hostPath exporters (required if `rbac.create=false`)
serviceAccountName:
# @schema
# additionalProperties: true
# type: object
# additionalProperties: {type: string}
# @schema
# -- Annotations added to the ServiceAccount for the hostPath exporters
serviceAccountAnnotations: {}
# @schema
# additionalProperties: true
# type: object
# additionalProperties: {type: string}
# @schema
# -- Annotations added to the ClusterRole for the hostPath exporters
clusterRoleAnnotations: {}
# @schema
# additionalProperties: true
# type: object
# additionalProperties: {type: string}
# @schema
# -- Annotations added to the ClusterRoleBinding for the hostPath exporters
clusterRoleBindingAnnotations: {}
@@ -1025,12 +1197,14 @@ rbacProxy:
# -- kube-rbac-proxy image pull policy
pullPolicy: IfNotPresent
# @schema
# type: integer
# minimum: 1
# maximum: 65535
# @schema
# -- Listen port for the exporter running inside kube-rbac-proxy exposed Pods
upstreamListenPort: 9091
# @schema
# type: object
# additionalProperties: true
# properties: {}
# @schema
@@ -1044,6 +1218,7 @@ rbacProxy:
cpu: 10m
memory: 20Mi
# @schema
# type: object
# additionalProperties: true
# properties: {}
# @schema
test/schema/invalid/daemonsets-scalar-value.expect.txt
+1
View File
@@ -0,0 +1 @@
at '/hostPathsExporter/daemonSets/edge'
test/schema/invalid/daemonsets-scalar-value.yaml
+6
View File
@@ -0,0 +1,6 @@
# `hostPathsExporter.daemonSets` is a map of override *objects* — a
# scalar value is always a config mistake (the chart would range over
# it and produce a broken DaemonSet).
hostPathsExporter:
daemonSets:
edge: "oops"
test/schema/invalid/extralabels-nonstring-value.expect.txt
+1
View File
@@ -0,0 +1 @@
at '/extraLabels/team'
test/schema/invalid/extralabels-nonstring-value.yaml
+4
View File
@@ -0,0 +1,4 @@
# Label maps are string→string: a numeric value renders an invalid K8s
# object (labels must be strings) — reject it at install time instead.
extraLabels:
team: 42
test/schema/invalid/podannotations-as-string.expect.txt
+1
View File
@@ -0,0 +1 @@
at '/podAnnotations'
test/schema/invalid/podannotations-as-string.yaml
+3
View File
@@ -0,0 +1,3 @@
# Annotation maps must be objects — a plain string here used to be
# accepted by the schema and blow up only at template-render time.
podAnnotations: "prometheus.io/scrape=true"
test/schema/invalid/podlistenport-string.expect.txt
+1
View File
@@ -0,0 +1 @@
at '/podListenPort'
test/schema/invalid/podlistenport-string.yaml
+4
View File
@@ -0,0 +1,4 @@
# Ports are `type: integer` now — a quoted value is a string and must
# be rejected, not coerced. `podListenPort: "9793"` used to render fine
# and break subtly wherever the chart does arithmetic on it.
podListenPort: "9793"
test/schema/invalid/replicas-string.expect.txt
+1
View File
@@ -0,0 +1 @@
at '/secretsExporter/replicas'
test/schema/invalid/replicas-string.yaml
+4
View File
@@ -0,0 +1,4 @@
# `replicas` is an integer — a quoted number is a string and must be
# rejected instead of coerced.
secretsExporter:
replicas: "2"
test/schema/invalid/servicemonitor-unknown-key.expect.txt
+2
View File
@@ -0,0 +1,2 @@
at '/prometheusServiceMonitor'
enbled
test/schema/invalid/servicemonitor-unknown-key.yaml
+5
View File
@@ -0,0 +1,5 @@
# `prometheusServiceMonitor` is now a closed object: a typoed key must
# be rejected instead of silently ignored — before 4.2.0 `enbled` here
# would deploy with the default and nobody would notice.
prometheusServiceMonitor:
enbled: false
test/schema/invalid/tolerations-string-item.expect.txt
+1
View File
@@ -0,0 +1 @@
at '/secretsExporter/tolerations/0'
test/schema/invalid/tolerations-string-item.yaml
+5
View File
@@ -0,0 +1,5 @@
# Tolerations are objects (K8s Toleration) — a bare string is a
# malformed entry that kubectl would reject much later.
secretsExporter:
tolerations:
- "node-role.kubernetes.io/control-plane"
test/schema/invalid/watchdirectories-nonstring-item.expect.txt
+1
View File
@@ -0,0 +1 @@
at '/hostPathsExporter/watchDirectories/0'
test/schema/invalid/watchdirectories-nonstring-item.yaml
+5
View File
@@ -0,0 +1,5 @@
# watch lists are arrays of path strings — a bare number is a typo'd
# path and must be rejected instead of being stringified downstream.
hostPathsExporter:
watchDirectories:
- 42
test/schema/valid/daemonsets-object-override.yaml
+12
View File
@@ -0,0 +1,12 @@
# Lock-down: daemonSets values are free-form override objects — any
# subset of the hostPathsExporter knobs must be accepted per entry.
hostPathsExporter:
daemonSets:
nodes:
debugMode: true
watchDirectories:
- /etc/kubernetes/pki
edge:
tolerations:
- operator: Exists
effect: NoSchedule
test/schema/valid/extradeploy-string-and-object.yaml
+23
View File
@@ -0,0 +1,23 @@
# Lock-down: extraDeploy accepts BOTH raw-string manifests (run through
# `tpl`) and structured objects — the template branches on `typeIs
# "string"`. A future schema tightening to objects-only would break the
# documented string form.
extraDeploy:
- |
apiVersion: v1
kind: ConfigMap
metadata:
name: {{ .Release.Name }}-extra
data: {}
- apiVersion: v1
kind: ConfigMap
metadata:
name: extra-object
data: {}
extraDeployVerbatim:
- |
apiVersion: v1
kind: ConfigMap
metadata:
name: verbatim-extra
data: {}
test/schema/valid/monitors-all-keys.yaml
+42
View File
@@ -0,0 +1,42 @@
# Lock-down: the complete declared key set of both monitor objects —
# they are closed structures now (additionalProperties: false), so this
# fixture fails if a template-consumed key ever goes missing from the
# schema.
prometheusServiceMonitor:
create: true
scrapeInterval: 30s
scrapeTimeout: 10s
extraLabels:
release: prom
extraAnnotations:
note: managed
metricRelabelings: []
relabelings: []
scheme: https
basicAuth:
username:
name: scrape-creds
key: username
password:
name: scrape-creds
key: password
tlsConfig:
insecureSkipVerify: true
prometheusPodMonitor:
create: true
scrapeInterval: 30s
scrapeTimeout: 10s
extraLabels:
release: prom
metricRelabelings: []
relabelings: []
scheme: https
basicAuth:
username:
name: scrape-creds
key: username
password:
name: scrape-creds
key: password
tlsConfig:
insecureSkipVerify: true
test/schema/valid/stringmaps-and-passthrough-arrays.yaml
+41
View File
@@ -0,0 +1,41 @@
# Lock-down for the 4.2.0 strictness pass: every newly-typed container
# keeps accepting its legitimate documented shape — string label/
# annotation maps, K8s object arrays (tolerations, env, volumes,
# relabelings), string path lists.
extraLabels:
team: platform
podAnnotations:
prometheus.io/scrape: "true"
secretsExporter:
nodeSelector:
kubernetes.io/os: linux
tolerations:
- key: node-role.kubernetes.io/control-plane
operator: Exists
effect: NoSchedule
env:
- name: GOMAXPROCS
value: "1"
extraArgs:
- --watch-file=/extra-cert/tls.crt
extraVolumes:
- name: extra-cert
secret:
secretName: extra-cert
extraVolumeMounts:
- name: extra-cert
mountPath: /extra-cert
readOnly: true
hostPathsExporter:
watchDirectories:
- /etc/kubernetes/pki
- /var/lib/kubelet/pods/**/*.crt
prometheusServiceMonitor:
extraLabels:
release: kube-prometheus-stack
metricRelabelings:
- action: labeldrop
regex: temporary_label
relabelings:
- sourceLabels: [__meta_kubernetes_pod_node_name]
targetLabel: node