842 Commits

Author SHA1 Message Date
Prometheus Operator Bot
7b602e1372 [bot] [main] Automated version update 2022-02-07 07:40:53 +00:00
Arthur Silva Sens
db61b3e18e
Merge pull request #1591 from paulfantom/automountServiceAccountToken
disable injecting unnecessary variables allowing access to k8s API
2022-02-05 18:28:33 +00:00
Paweł Krupa (paulfantom)
3429bc77a4 disable injecting unnecessary variables allowing access to k8s API 2022-02-04 14:08:52 +01:00
Paweł Krupa
3436e1a92e
Merge pull request #1612 from ArthurSens/remove-hostport 2022-02-04 12:58:13 +01:00
ArthurSens
fb92a6dbe0 Document better why we use hostPort on node-exporter
Signed-off-by: ArthurSens <arthursens2005@gmail.com>
2022-02-03 15:47:43 +00:00
Arunprasad Rajkumar
0eabbb5d0c
Sanitize all regex denylist in ksm-lite addon
This is a follow up fix of https://github.com/prometheus-operator/kube-prometheus/pull/1613. @simonpasquier recommended to sanitize all denylist metrics.

Signed-off-by: Arunprasad Rajkumar <arajkuma@redhat.com>
2022-02-03 19:52:44 +05:30
Arunprasad Rajkumar
f16277e8e0
Sanitize regex denylist in ksm-lite addon
The following metrics are missing from kube-state-metrics:
- kube_pod_container_status_terminated_reason
- kube_pod_init_container_status_terminated_reason
- kube_pod_status_scheduled_time

Previously, some metrics were removed from kube-state-metrics by adding the following --metric-denylist argument to the kube-state-metrics container

```
--metric-denylist=
kube_.+_created,
kube_.+_metadata_resource_version,
kube_replicaset_metadata_generation,
kube_replicaset_status_observed_generation,
kube_pod_restart_policy,
kube_pod_init_container_status_terminated,
kube_pod_init_container_status_running,
kube_pod_container_status_terminated,
kube_pod_container_status_running,
kube_pod_completion_time,
kube_pod_status_scheduled
```

--metric-denylist: Comma-separated list of metrics not to be enabled. This list comprises of exact metric names and/or regex patterns. The allowlist and denylist are mutually exclusive.

However, all the list of metrics is managed as RegEx, thus "kube_pod_container_status_terminated" denies .*kube_pod_container_status_terminated.*, that's why kube_pod_init_container_status_terminated_reason is missing

Co-authored-by: Florian Gleizes <fgleizes@redhat.com>
Signed-off-by: Arunprasad Rajkumar <arajkuma@redhat.com>
2022-02-03 17:50:22 +05:30
Arthur Silva Sens
755d27bb46
Merge pull request #1610 from ArthurSens/as/linux-hardening
Drop Linux capabilities
2022-02-02 12:56:21 +00:00
Paweł Krupa (paulfantom)
86ac6f79b1 jsonnet: filter out kube-proxy alerts when kube-proxy is disabled
Signed-off-by: Paweł Krupa (paulfantom) <pawel@krupa.net.pl>
2022-02-01 16:22:48 +01:00
Arthur Silva Sens
931af3241d Drop Linux capabilities
Signed-off-by: GitHub <noreply@github.com>
2022-02-01 09:25:21 +00:00
ArthurSens
e5610b2e8d Address FIXME
Signed-off-by: ArthurSens <arthursens2005@gmail.com>
2022-01-31 17:25:00 +00:00
Prometheus Operator Bot
dad37c968d [bot] [main] Automated version update 2022-01-31 17:04:19 +00:00
Arthur Silva Sens
57c46a2861 components/*: Forbid write access to root filesystem
Signed-off-by: GitHub <noreply@github.com>
2022-01-27 16:03:58 +00:00
Paweł Krupa
b68f3f0f07
Merge pull request #1556 from arajkumar/fix-thanos-sidecar-selector 2022-01-27 13:06:59 +01:00
Arthur Silva Sens
4d004393e1
Merge pull request #1593 from prometheus-operator/as/forbid-privilege-scalation
Explicitly declare allowPrivilegeEscalation to false in all components
2022-01-24 10:38:33 +00:00
Arthur Silva Sens
b60b302499 Explicitly declare allowPrivilegeEscalation to false
Although containers that do not run as privileged already have this set to false by kubernetes
Kubespace [asks us](https://hub.armo.cloud/docs/c-0016) to explicitly declare it to false where not needed.

Signed-off-by: Arthur Silva Sens <arthursens2005@gmail.com>
2022-01-24 10:31:43 +00:00
Prometheus Operator Bot
ef40bc5759 [bot] [main] Automated version update 2022-01-24 07:43:49 +00:00
Philip Gough
f2559e0ced
Merge pull request #1566 from primeroz/fix/do-not-add-namespace-to-clusterwide-resources
Hide namespace for prometheus clusterRole and clusterRolebinding
2022-01-10 11:19:31 +00:00
Andrei Nistor
1d3dbe61cb
Inhibit info alerts unless other alerts fire (#1507)
* Inhibit info alerts unless other alerts fire

* Fix nits
2022-01-10 10:37:43 +01:00
Arunprasad Rajkumar
b7a135a101
Fix thanos sidecar selector
Previous PR[1] which deprecated `thanosSelector` accidentally broke the
usage of it. This commit restores the old behaviour along with newly
introduced `thanos` config variable.

[1] https://github.com/prometheus-operator/kube-prometheus/pull/1543

Co-authored-by: Pawe? Krupa <pawel@krupa.net.pl>
Signed-off-by: Arunprasad Rajkumar <arajkuma@redhat.com>
2022-01-05 16:23:24 +05:30
Paweł Krupa
529739d5ef
Merge pull request #1572 from ArthurSens/as/projected-psp 2022-01-04 13:37:13 +01:00
ArthurSens
f4a5ff3e3b addon/podsecuritypolicies: Add projected volumes permission
Signed-off-by: ArthurSens <arthursens2005@gmail.com>
2022-01-04 12:24:05 +00:00
Francesco Ciocchetti
f7738d7434
Set namespace to null for clusterwide resources and generate manifests 2022-01-04 10:03:14 +01:00
paulfantom
ec40014ac3 jsonnet: add grafana-mixin
Signed-off-by: paulfantom <pawel@krupa.net.pl>
Signed-off-by: Paweł Krupa (paulfantom) <pawel@krupa.net.pl>
2022-01-04 09:14:43 +01:00
Prometheus Operator Bot
8aca1fb1cb [bot] [main] Automated version update 2021-12-20 14:15:02 +00:00
Prometheus Operator Bot
245427cafb [bot] [main] Automated version update 2021-12-20 07:41:04 +00:00
Philip Gough
2a135c38d7 jsonnet: Track latest deps 2021-12-17 12:31:25 +00:00
Philip Gough
480cb2ced4 jsonnet: Pin deps for 0.10 2021-12-17 11:38:05 +00:00
Philip Gough
16bc5d63b3 jsonnet: Drop deprecated coredns_cache_misses_total
Deprecated via https://github.com/coredns/coredns/pull/4781
2021-12-16 18:07:14 +00:00
Philip Gough
1263e1cba3 jsonnet: Drop deprecated apiserver_longrunning_gauge and apiserver_registered_watchers metrics
Drop deprecated metric to fix failing test.

Dropped via https://github.com/kubernetes/kubernetes/pull/103793
2021-12-16 17:08:01 +00:00
Paweł Krupa
3c8103b34c
Merge pull request #1543 from arajkumar/add-thanos-targetgroup 2021-12-16 10:08:37 +01:00
Arunprasad Rajkumar
1ff5273f87
Deprecate thanosSelector and keep until 0.10.0
Signed-off-by: Arunprasad Rajkumar <arajkuma@redhat.com>
2021-12-13 16:23:37 +05:30
Prometheus Operator Bot
b40f0aa68c [bot] [main] Automated version update 2021-12-13 07:41:10 +00:00
Arunprasad Rajkumar
1fb864ec21
Remove thanosSelector and expose mixin._config.thanos config variable for thanos sidecar
This commit removes existing `thanosSelector` and exposes a single config variable `mixin._config.thanos` to customize thanos sidecar mixins. It follows same structure as d2d74dac98/mixin/config.libsonnet

Signed-off-by: Arunprasad Rajkumar <arajkuma@redhat.com>
2021-12-10 08:56:44 +05:30
sweetpotatoman
bd9e2d4d2d Security: Upgrade Grafana Version, Fixes CVE-2021-43798 2021-12-09 11:33:34 +08:00
Prometheus Operator Bot
0a339a710a [bot] [main] Automated version update 2021-12-06 07:40:35 +00:00
junot
bd95a19cc3 fix default empty groups for k8s PrometheusRule 2021-12-03 14:08:59 +08:00
Paweł Krupa
431b662602
Merge pull request #1497 from paulfantom/k3s-mountpoints 2021-11-28 12:40:10 +01:00
Paweł Krupa
974b37e620
Merge pull request #1520 from PaytmLabs/feature/recommended-instance-label 2021-11-25 12:42:03 +01:00
Paweł Krupa
0f6faaacde
Merge pull request #1501 from ArthurSens/as/strip-limits-refactor 2021-11-24 13:15:07 +01:00
Maxime Brunet
5e375b394b
Use recommended instance label for Prometheus/Alertmanager resources 2021-11-23 13:12:31 -08:00
Maxime Brunet
80d04a1d53
addons: Always use proper values scope for namespace 2021-11-22 17:10:17 -08:00
Arthur Silva Sens
fcd8d01fa1
Merge pull request #1506 from ArthurSens/as/split-doc-customization
docs/customizations: Move customization examples to dedicated folder
2021-11-22 18:25:56 -03:00
Prometheus Operator Bot
a9054030d7 [bot] [main] Automated version update 2021-11-22 07:40:23 +00:00
ArthurSens
af00060d9c docs/customizations: Move customization examples to dedicated folder
With the objective of improving our README, customization examples are being moved to a dedicated folder under `docs/`.

Signed-off-by: ArthurSens <arthursens2005@gmail.com>
2021-11-18 18:57:22 +00:00
Andrei Nistor
30175b5e3c Use matchers in routing tree 2021-11-16 14:14:35 +02:00
Andrei Nistor
72f6ff3758 Refactor deprecated inhibit rules matchers 2021-11-15 18:45:19 +02:00
ArthurSens
42e7df4d70 jsonnet/addons/strip-limits: Simplify logic
Since `release-0.8` resources has become a first-class object to all components of kube-prometheus. Therefore, we're simplifying this addon to reflect those changes.

Signed-off-by: ArthurSens <arthursens2005@gmail.com>
2021-11-15 14:38:15 +00:00
Prometheus Operator Bot
cb946bf72e [bot] [main] Automated version update 2021-11-15 07:40:21 +00:00
paulfantom
947965d77b jsonnet: exclude k3s containerd mountpoints 2021-11-10 18:27:58 +01:00