values.yaml

# Default values for caas kube-prometheus-stack.
# This is a YAML-formatted file.
# Declare variables to be passed into your templates.

caas:
  # -- whether a kubecost ingress policy for kube-state-metrics is needed
  clusterCosts: true
  # -- whether the cluster needs defaultEgress installed
  defaultEgress: false
  # -- whether a dynatrace ingress policy for kube-state-metrics is needed
  dynatrace: true
  # -- whether a longhorn network egress policy is needed for longhorn monitoring
  longhorn: true
  fullnameOverride: ""
  nameOverride: ""
  # -- overrides the default namespace for caas related resources
  namespaceOverride: ""
  # -- whether the cluster has Prometheus-Auth  installed
  prometheusAuth: true
  rbac:
    # -- create a namespaces ServiceAccount
    enabled: true
    serviceAccount:
      create: true
      name: rancher-monitoring
  grafana:
    dashboards:
      # -- whether to deploy the nginx ingress controller dashboard
      nginxIngress: true
      # -- whether to deploy the rancher cluster dashboards
      rancherCluster: true
      # -- whether to deploy the rancher home dashboard
      rancherHome: true
      # -- whether to deploy the rancher k8s components dashboard
      rancherK8sComponents: true
      # -- whether to deploy the rancher nodes dashboard
      rancherNodes: true
      # -- whether to deploy the rancher performance dashboard
      rancherPerformance: true
      # -- whether to deploy the rancher pods dashboard
      rancherPods: true
      # -- whether to deploy the rancher workloads dashboard
      rancherWorkloads: true
      # -- whether to deploy the rancher longhorn dashboard
      longhorn: true
global:
  cattle:
    clusterId: local
    clusterName: local
    # projectId: &projectId p-xxxxx
    systemDefaultRegistry: "mtr.devops.telekom.de"
  imageRegistry: mtr.devops.telekom.de

kube-prometheus-stack:
  ## -- Provide custom recording or alerting rules to be deployed into the cluster.
  #  -- Full set of values and pre-defined for caas
  #  -- ref: https://github.com/prometheus-community/helm-charts/blob/main/charts/kube-prometheus-stack/values.yaml
  ##
  alertmanager:
    alertmanagerSpec:
      alertmanagerConfigNamespaceSelector: {}
      alertmanagerConfigSelector:
        matchExpressions:
        - key: release
          operator: In
          values:
          - rancher-monitoring
      #alertmanagerConfigNamespaceSelector:
      #  matchLabels:
      #    "field.cattle.io/projectId": *projectId
      clusterAdvertiseAddress: false
      externalUrl:
      forceEnableClusterMode: false
      image:
        registry: mtr.devops.telekom.de
        repository: kubeprometheusstack/alertmanager
        tag: v0.27.0
      listenLocal: false
      logFormat: logfmt
      logLevel: info
      paused: false
      replicas: 1
      resources:
        limits:
          cpu: 800m
          memory: 750Mi
        requests:
          cpu: 100m
          memory: 200Mi
      retention: 120h
      # volumeClaimTemplate:
      #   spec:
      #     storageClassName: gluster
      #     accessModes: ["ReadWriteOnce"]
      #     resources:
      #       requests:
      #         storage: 50Gi
      #     selector: {}
      routePrefix: /
      securityContext:
        fsGroup: 2000
        supplementalGroups:
        - 1000
      storage: {}
      volumeMounts: []
      volumes: []
    apiVersion: v2
    config:
      global:
        resolve_timeout: 5m
      inhibit_rules:
      - equal:
        - "namespace"
        - "alertname"
        source_matchers:
        - "severity = critical"
        target_matchers:
        - "severity =~ warning|info"
      - equal:
        - "namespace"
        - "alertname"
        source_matchers:
        - "severity = warning"
        target_matchers:
        - "severity = info"
      - equal:
        - "namespace"
        source_matchers:
        - "alertname = InfoInhibitor"
        target_matchers:
        - "severity = info"
      receivers:
      - name: "null"
      route:
        group_by: [ "namespace" ]
        group_interval: 5m
        group_wait: 30s
        receiver: "null"
        repeat_interval: 12h
        routes:
        - matchers:
          - alertname =~ "InfoInhibitor|Watchdog"
          receiver: "null"
      templates:
      - "/etc/alertmanager/config/*.tmpl"
    enabled: true
    service:
      annotations: {}
      clusterIP: ""
      externalIPs: []
      externalTrafficPolicy: Cluster
      labels: {}
      loadBalancerIP: ""
      loadBalancerSourceRanges: []
      port: 9093
      targetPort: 9093
      type: ClusterIP
    serviceAccount:
      create: true
    serviceMonitor:
      interval: "30s"
      selfMonitor: true
    servicePerReplica:
      enabled: false
    templateFiles:
      rancher_defaults.tmpl: '{{- define "slack.rancher.text" -}} #magic___^_^___line       #magic___^_^___line #magic___^_^___line {{ template "rancher.text_multiple" . }} #magic___^_^___line       #magic___^_^___line #magic___^_^___line {{- end -}} #magic___^_^___line       #magic___^_^___line #magic___^_^___line {{- define "webex.text_multiple" -}} #magic___^_^___line       #magic___^_^___line #magic___^_^___line {{- range .Alerts }} #magic___^_^___line       #magic___^_^___line #magic___^_^___line {{ template "webex.text_single" . }} #magic___^_^___line       #magic___^_^___line #magic___^_^___line {{- end }} #magic___^_^___line       #magic___^_^___line #magic___^_^___line {{- if .ExternalURL }} #magic___^_^___line       #magic___^_^___line #magic___^_^___line AlertManager: <{{ .ExternalURL }}> #magic___^_^___line       #magic___^_^___line #magic___^_^___line {{- end }} #magic___^_^___line       #magic___^_^___line #magic___^_^___line {{- end -}} #magic___^_^___line       #magic___^_^___line #magic___^_^___line {{- define "webex.text_single" -}} #magic___^_^___line       #magic___^_^___line #magic___^_^___line {{- if .Labels.alertname }} #magic___^_^___line       #magic___^_^___line #magic___^_^___line ## [ALERT - {{ .Labels.alertname }}] #magic___^_^___line       #magic___^_^___line #magic___^_^___line {{- else }} #magic___^_^___line       #magic___^_^___line #magic___^_^___line ## [ALERT] #magic___^_^___line       #magic___^_^___line #magic___^_^___line {{- end }} #magic___^_^___line       #magic___^_^___line #magic___^_^___line {{- if .Labels.severity }} #magic___^_^___line       #magic___^_^___line #magic___^_^___line ### Severity: `{{ .Labels.severity }}` #magic___^_^___line       #magic___^_^___line #magic___^_^___line {{- end }} #magic___^_^___line       #magic___^_^___line #magic___^_^___line {{- if .Labels.cluster }} #magic___^_^___line       #magic___^_^___line #magic___^_^___line ### Cluster:  {{ .Labels.cluster }} #magic___^_^___line       #magic___^_^___line #magic___^_^___line {{- end }} #magic___^_^___line       #magic___^_^___line #magic___^_^___line {{- if .Annotations.summary }} #magic___^_^___line       #magic___^_^___line #magic___^_^___line ### Summary: {{ .Annotations.summary }} #magic___^_^___line       #magic___^_^___line #magic___^_^___line {{- end }} #magic___^_^___line       #magic___^_^___line #magic___^_^___line {{- if .Annotations.message }} #magic___^_^___line       #magic___^_^___line #magic___^_^___line Message:  {{ .Annotations.message }} #magic___^_^___line       #magic___^_^___line #magic___^_^___line {{- end }} #magic___^_^___line       #magic___^_^___line #magic___^_^___line {{- if .Annotations.description }} #magic___^_^___line       #magic___^_^___line #magic___^_^___line Description:  {{ .Annotations.description }} #magic___^_^___line       #magic___^_^___line #magic___^_^___line {{- end }} #magic___^_^___line       #magic___^_^___line #magic___^_^___line {{- if .Annotations.runbook_url }} #magic___^_^___line       #magic___^_^___line #magic___^_^___line Runbook URL: <{{ .Annotations.runbook_url }}|:spiral_note_pad:> #magic___^_^___line       #magic___^_^___line #magic___^_^___line {{- end }} #magic___^_^___line       #magic___^_^___line #magic___^_^___line {{- with .Labels }} #magic___^_^___line       #magic___^_^___line #magic___^_^___line {{- with .Remove (stringSlice "alertname" "severity" "cluster") }} #magic___^_^___line       #magic___^_^___line #magic___^_^___line {{- if gt (len .) 0 }} #magic___^_^___line       #magic___^_^___line #magic___^_^___line Additional Labels: #magic___^_^___line   {{- range .SortedPairs }} #magic___^_^___line   • {{ .Name }}: `{{ .Value }}` #magic___^_^___line   {{- end }} #magic___^_^___line {{- end }} #magic___^_^___line       #magic___^_^___line #magic___^_^___line {{- end }} #magic___^_^___line       #magic___^_^___line #magic___^_^___line {{- end }} #magic___^_^___line       #magic___^_^___line #magic___^_^___line {{- with .Annotations }} #magic___^_^___line       #magic___^_^___line #magic___^_^___line {{- with .Remove (stringSlice "summary" "message" "description" "runbook_url") }} #magic___^_^___line       #magic___^_^___line #magic___^_^___line {{- if gt (len .) 0 }} #magic___^_^___line       #magic___^_^___line #magic___^_^___line ## Additional Annotations:* #magic___^_^___line   {{- range .SortedPairs }} #magic___^_^___line   • {{ .Name }}: `{{ .Value }}` #magic___^_^___line   {{- end }} #magic___^_^___line {{- end }} #magic___^_^___line       #magic___^_^___line #magic___^_^___line {{- end }} #magic___^_^___line       #magic___^_^___line #magic___^_^___line {{- end }} #magic___^_^___line       #magic___^_^___line #magic___^_^___line       #magic___^_^___line #magic___^_^___line {{- end -}} #magic___^_^___line       #magic___^_^___line #magic___^_^___line {{- define "rancher.text_multiple" -}} #magic___^_^___line       #magic___^_^___line #magic___^_^___line *[GROUP - Details]*  #magic___^_^___line       #magic___^_^___line #magic___^_^___line One or more alarms in this group have triggered a notification. #magic___^_^___line       #magic___^_^___line #magic___^_^___line       #magic___^_^___line #magic___^_^___line {{- if gt (len .GroupLabels.Values) 0 }} #magic___^_^___line       #magic___^_^___line #magic___^_^___line *Group Labels:* #magic___^_^___line   {{- range .GroupLabels.SortedPairs }} #magic___^_^___line   • *{{ .Name }}:* `{{ .Value }}` #magic___^_^___line   {{- end }} #magic___^_^___line {{- end }} #magic___^_^___line       #magic___^_^___line #magic___^_^___line {{- if .ExternalURL }} #magic___^_^___line       #magic___^_^___line #magic___^_^___line *Link to AlertManager:* {{ .ExternalURL }} #magic___^_^___line       #magic___^_^___line #magic___^_^___line {{- end }} #magic___^_^___line       #magic___^_^___line #magic___^_^___line       #magic___^_^___line #magic___^_^___line {{- range .Alerts }} #magic___^_^___line       #magic___^_^___line #magic___^_^___line {{ template "rancher.text_single" . }} #magic___^_^___line       #magic___^_^___line #magic___^_^___line {{- end }} #magic___^_^___line       #magic___^_^___line #magic___^_^___line {{- end -}} #magic___^_^___line       #magic___^_^___line #magic___^_^___line       #magic___^_^___line #magic___^_^___line {{- define "rancher.text_single" -}} #magic___^_^___line       #magic___^_^___line #magic___^_^___line {{- if .Labels.alertname }} #magic___^_^___line       #magic___^_^___line #magic___^_^___line *[ALERT - {{ .Labels.alertname }}]* #magic___^_^___line       #magic___^_^___line #magic___^_^___line {{- else }} #magic___^_^___line       #magic___^_^___line #magic___^_^___line *[ALERT]* #magic___^_^___line       #magic___^_^___line #magic___^_^___line {{- end }} #magic___^_^___line       #magic___^_^___line #magic___^_^___line {{- if .Labels.severity }} #magic___^_^___line       #magic___^_^___line #magic___^_^___line *Severity:* `{{ .Labels.severity }}` #magic___^_^___line       #magic___^_^___line #magic___^_^___line {{- end }} #magic___^_^___line       #magic___^_^___line #magic___^_^___line {{- if .Labels.cluster }} #magic___^_^___line       #magic___^_^___line #magic___^_^___line *Cluster:*  {{ .Labels.cluster }} #magic___^_^___line       #magic___^_^___line #magic___^_^___line {{- end }} #magic___^_^___line       #magic___^_^___line #magic___^_^___line {{- if .Annotations.summary }} #magic___^_^___line       #magic___^_^___line #magic___^_^___line *Summary:* {{ .Annotations.summary }} #magic___^_^___line       #magic___^_^___line #magic___^_^___line {{- end }} #magic___^_^___line       #magic___^_^___line #magic___^_^___line {{- if .Annotations.message }} #magic___^_^___line       #magic___^_^___line #magic___^_^___line *Message:* {{ .Annotations.message }} #magic___^_^___line       #magic___^_^___line #magic___^_^___line {{- end }} #magic___^_^___line       #magic___^_^___line #magic___^_^___line {{- if .Annotations.description }} #magic___^_^___line       #magic___^_^___line #magic___^_^___line *Description:* {{ .Annotations.description }} #magic___^_^___line       #magic___^_^___line #magic___^_^___line {{- end }} #magic___^_^___line       #magic___^_^___line #magic___^_^___line {{- if .Annotations.runbook_url }} #magic___^_^___line       #magic___^_^___line #magic___^_^___line *Runbook URL:* <{{ .Annotations.runbook_url }}|:spiral_note_pad:> #magic___^_^___line       #magic___^_^___line #magic___^_^___line {{- end }} #magic___^_^___line       #magic___^_^___line #magic___^_^___line {{- with .Labels }} #magic___^_^___line       #magic___^_^___line #magic___^_^___line {{- with .Remove (stringSlice "alertname" "severity" "cluster") }} #magic___^_^___line       #magic___^_^___line #magic___^_^___line {{- if gt (len .) 0 }} #magic___^_^___line       #magic___^_^___line #magic___^_^___line *Additional Labels:* #magic___^_^___line   {{- range .SortedPairs }} #magic___^_^___line   • *{{ .Name }}:* `{{ .Value }}` #magic___^_^___line   {{- end }} #magic___^_^___line {{- end }} #magic___^_^___line       #magic___^_^___line #magic___^_^___line {{- end }} #magic___^_^___line       #magic___^_^___line #magic___^_^___line {{- end }} #magic___^_^___line       #magic___^_^___line #magic___^_^___line {{- with .Annotations }} #magic___^_^___line       #magic___^_^___line #magic___^_^___line {{- with .Remove (stringSlice "summary" "message" "description" "runbook_url") }} #magic___^_^___line       #magic___^_^___line #magic___^_^___line {{- if gt (len .) 0 }} #magic___^_^___line       #magic___^_^___line #magic___^_^___line *Additional Annotations:* #magic___^_^___line   {{- range .SortedPairs }} #magic___^_^___line   • *{{ .Name }}:* `{{ .Value }}` #magic___^_^___line   {{- end }} #magic___^_^___line {{- end }} #magic___^_^___line       #magic___^_^___line #magic___^_^___line {{- end }} #magic___^_^___line       #magic___^_^___line #magic___^_^___line {{- end }} #magic___^_^___line       #magic___^_^___line #magic___^_^___line {{- end -}}'
  coreDns:
    enabled: true

  ## -- Default rules for monitoring the cluster
  defaultRules:
    appNamespacesTarget: ".*"
    create: true
    rules:
      alertmanager: true
      configReloaders: true
      etcd: false
      general: true
      k8s: true
      kubeApiserverAvailability: true
      kubeApiserverBurnrate: true
      kubeApiserverHistogram: true
      kubeApiserverSlos: true
      kubeControllerManager: true
      kubePrometheusGeneral: true
      kubePrometheusNodeRecording: true
      kubeProxy: true
      kubeScheduler: true
      kubeStateMetrics: true
      kubelet: true
      kubernetesApps: true
      kubernetesResources: true
      kubernetesStorage: true
      kubernetesSystem: true
      network: true
      node: true
      nodeExporterAlerting: true
      nodeExporterRecording: true
      prometheus: true
      prometheusOperator: true
    runbookUrl: "https://runbooks.prometheus-operator.dev/runbooks"
  fullnameOverride: "rancher-monitoring"
  global:
    rbac:
      create: true
      createAggregateClusterRoles: false
      pspEnabled: false
  grafana:
    adminPassword: prom-operator
    containerSecurityContext:
      allowPrivilegeEscalation: false
      capabilities:
        drop:
        - ALL
      privileged: false
      readOnlyRootFilesystem: true
      runAsGroup: 472
      runAsUser: 472
    createConfigmap: true
    datasources:
      datasources.yaml:
        apiVersion: 1
        datasources:
        - access: proxy
          isDefault: true
          name: Prometheus
          type: prometheus
          url: http://prometheus-operated:9090
    defaultDashboardsEnabled: true
    defaultDashboardsTimezone: utc
    enabled: true
    extraContainerVolumes:
    - emptyDir: {}
      name: nginx-home
    - configMap:
        items:
        - key: nginx.conf
          mode: 438
          path: nginx.conf
        name: nginx-proxy-config-rancher-monitoring-grafana
      name: grafana-nginx
    extraContainers: |
      - name: grafana-proxy
        args:
        - nginx
        - -g
        - daemon off;
        - -c
        - /nginx/nginx.conf
        image: mtr.devops.telekom.de/kubeprometheusstack/nginx:1.23.2-alpine
        ports:
        - containerPort: 8080
          name: nginx-http
          protocol: TCP
        resources:
          limits:
            cpu: 100m
            memory: 100Mi
          requests:
            cpu: 50m
            memory: 50Mi
        securityContext:
          allowPrivilegeEscalation: false
          capabilities:
            drop:
            - ALL
          privileged: false
          runAsUser: 101
          runAsGroup: 101
          readOnlyRootFilesystem: true
        volumeMounts:
        - mountPath: /nginx
          name: grafana-nginx
        - mountPath: /var/cache/nginx
          name: nginx-home
    forceDeployDashboards: true
    forceDeployDatasources: true
    fullnameOverride: rancher-monitoring-grafana
    grafana.ini:
      analytics:
        check_for_updates: false
      auth:
        disable_login_form: false
      auth.anonymous:
        enabled: true
        org_role: Viewer
      auth.basic:
        enabled: false
      log:
        level: info
      security:
        # -- Required to embed dashboards in Rancher Cluster Overview Dashboard on Cluster Explorer
        allow_embedding: true
      users:
        auto_assign_org_role: Viewer
    image:
      repository: kubeprometheusstack/grafana
      tag: 10.4.1
    initChownData:
      enabled: false
    nameOverride: rancher-monitoring-grafana
    namespaceOverride: ""
    rbac:
      create: false
      namespaced: true
      pspEnabled: false
    resources:
      limits:
        cpu: 600m
        memory: 600Mi
      requests:
        cpu: 200m
        memory: 200Mi
    securityContext:
      fsGroup: 472
      runAsGroup: 472
      runAsUser: 472
      supplementalGroups:
      - 472
    service:
      port: 80
      portName: nginx-http
      targetPort: 8080
    serviceAccount:
      create: false
      name: rancher-monitoring
    serviceMonitor:
      enabled: true
      interval: "30s"
      labels:
        release: rancher-monitoring
      path: "/metrics"
      scheme: http
      scrapeTimeout: 30s

    sidecar:
      dashboards:
        annotations: {}
        enabled: true
        label: grafana_dashboard
        labelValue: "1"
        multicluster:
          etcd:
            enabled: false
          global:
            enabled: false
        provider:
          allowUiUpdates: false
        searchNamespace: "cattle-monitoring-system"
      datasources:
        createPrometheusReplicasDatasources: false
        defaultDatasourceEnabled: false
        enabled: true
        label: grafana_datasource
        labelValue: "1"
        searchNamespace: ""
      image:
        repository: kubeprometheusstack/k8s-sidecar
        tag: 1.24.6
      plugins:
        searchNamespace: ""
      resources:
        limits:
          cpu: 100m
          memory: 100Mi
        requests:
          cpu: 50m
          memory: 50Mi
      securityContext:
        allowPrivilegeEscalation: false
        capabilities:
          drop:
          - ALL
        privileged: false
        readOnlyRootFilesystem: true
        runAsGroup: 472
        runAsUser: 472
    testFramework:
      enabled: false
  kube-state-metrics:
    honorLabels: true
    image:
      registry: mtr.devops.telekom.de
      repository: kubeprometheusstack/kube-state-metrics
      tag: v2.10.0
    prometheus:
      monitor:
        enabled: true
        honorLabels: true
    rbac:
      create: true
    releaseLabel: true
    selfMonitor:
      enabled: true
  kubeApiServer:
    enabled: true
  kubeControllerManager:
    enabled: false
  kubeDns:
    enabled: false
  kubeEtcd:
    enabled: false
  kubeProxy:
    enabled: false
  kubeScheduler:
    enabled: false
  kubeStateMetrics:
    enabled: true
  kubelet:
    enabled: false
  nameOverride: "rancher-monitoring"
  nodeExporter:
    enabled: true
    operatingSystems:
      darwin:
        enabled: false
  prometheus:
    additionalRulesForClusterRole:
    - apiGroups:
      - ""
      resources:
      - configmaps
      - namespaces
      - nodes
      - nodes/metrics
      - services
      - endpoints
      - pods
      - secrets
      verbs:
      - get
      - list
      - watch
    - apiGroups:
      - networking.k8s.io
      resources:
      - ingresses
      verbs:
      - get
      - list
      - watch
    - nonResourceURLs:
      - /metrics
      - /metrics/cadvisor
      verbs:
      - get
    - apiGroups:
      - authentication.k8s.io
      resources:
      - tokenreviews
      verbs:
      - get
      - list
      - create
      - update
      - delete
      - watch
    - apiGroups:
      - authorization.k8s.io
      resources:
      - subjectaccessreviews
      verbs:
      - get
      - list
      - create
      - update
      - delete
      - watch
    enabled: true
    ingress:
      annotations: {}
      enabled: false
      hosts: []
      labels: {}
      paths: []
      tls: []
    ingressPerReplica:
      enabled: false
    prometheusSpec:
      additionalScrapeConfigs: []
      containers:
      - args:
        - --proxy-url=http://127.0.0.1:9090
        - --listen-address=$(POD_IP):9091
        - --filter-reader-labels=prometheus
        - --filter-reader-labels=prometheus_replica
        - --log.debug=true
        command:
        - prometheus-auth
        env:
        - name: POD_IP
          valueFrom:
            fieldRef:
              fieldPath: status.podIP
        image: mtr.devops.telekom.de/caas/prometheus-auth:0.6.0
        name: prometheus-agent
        ports:
        - containerPort: 9091
          name: http-auth
          protocol: TCP
        resources:
          limits:
            cpu: 2000m
            memory: 2000Mi
          requests:
            cpu: 200m
            memory: 500Mi
      disableCompaction: false
      enableAdminAPI: false
      enableRemoteWriteReceiver: false
      enforcedLabelLimit: false
      enforcedLabelNameLengthLimit: false
      enforcedLabelValueLengthLimit: false
      enforcedNamespaceLabel: ""
      enforcedSampleLimit: false
      enforcedTargetLimit: false
      evaluationInterval: "30s"
      excludedFromEnforcement: []
      externalLabels: {}
      externalUrl: ""
      ignoreNamespaceSelectors: false
      image:
        registry: mtr.devops.telekom.de
        repository: kubeprometheusstack/prometheus
        tag: v2.51.2
      listenLocal: false
      logFormat: logfmt
      logLevel: info
      overrideHonorLabels: false
      overrideHonorTimestamps: false
      #podMonitorNamespaceSelector:
      #  matchLabels:
      #    "field.cattle.io/projectId": *projectId
      #probeNamespaceSelector:
      #  matchLabels:
      #    "field.cattle.io/projectId": *projectId
      paused: false
      podAntiAffinityTopologyKey: kubernetes.io/hostname
      podMonitorNamespaceSelector: {}
      podMonitorSelector:
        matchExpressions:
        - key: release
          operator: In
          values:
          - rancher-monitoring
      portName: "http-web"
      prometheusExternalLabelName: ""
      prometheusExternalLabelNameClear: false
      prometheusRulesExcludedFromEnforce: []
      query: {}
      queryLogFile: false
      remoteRead: []
      remoteWrite: []
      remoteWriteDashboards: false
      replicaExternalLabelName: ""
      replicaExternalLabelNameClear: false
      replicas: 1
      resources:
        limits:
          cpu: 2000m
          memory: 4000Mi
        requests:
          cpu: 400m
          memory: 400Mi
      retention: 10d
      #retentionSize: ""
      routePrefix: /
      ruleNamespaceSelector: {}
      #ruleNamespaceSelector:
      #  matchLabels:
      #    "field.cattle.io/projectId": *projectId
      ruleSelector:
        matchExpressions:
        - key: release
          operator: In
          values:
          - rancher-monitoring
      scrapeInterval: "30s"
      scrapeTimeout: "10s"
      securityContext:
        fsGroup: 2000
        supplementalGroups:
        - 1000
      serviceMonitorNamespaceSelector: {}
      serviceMonitorSelector:
        matchExpressions:
        - key: release
          operator: In
          values:
          - rancher-monitoring
      #serviceMonitorNamespaceSelector:
      #  matchLabels:
      #    "field.cattle.io/projectId": *projectId
      shards: 1
      storageSpec: {}
      ## Using PersistentVolumeClaim
      ##
      #  volumeClaimTemplate:
      #    spec:
      #      storageClassName: gluster
      #      accessModes: ["ReadWriteOnce"]
      #      resources:
      #        requests:
      #          storage: 50Gi
      #    selector: {}
      ## Using tmpfs volume
      ##
      #  emptyDir:
      #    medium: Memory
      tsdb:
        outOfOrderTimeWindow: 0s
      volumeMounts: []
      volumes: []
      walCompression: true
    service:
      additionalPorts:
      - name: http-auth
        port: 9091
        protocol: TCP
        targetPort: http-auth
      annotations: {}
      clusterIP: ""
      externalIPs: []
      externalTrafficPolicy: Cluster
      labels: {}
      port: 9090
      publishNotReadyAddresses: false
      targetPort: 9090
      type: ClusterIP
    serviceAccount:
      create: true
      name: rancher-monitoring
    serviceMonitor:
      interval: "30s"
      metricRelabelings: []
      relabelings: []
      scheme: ""
      selfMonitor: true
      tlsConfig: {}
    servicePerReplica:
      enabled: false
  prometheus-node-exporter:
    image:
      pullPolicy: Always
      registry: mtr.devops.telekom.de
      repository: kubeprometheusstack/node-exporter
    prometheus:
      monitor:
        enabled: true
    rbac:
      pspEnabled: false
    releaseLabel: true
    service:
      port: 9796
      targetPort: 9796
  prometheusOperator:
    admissionWebhooks:
      patch:
        image:
          pullPolicy: Always
          registry: mtr.devops.telekom.de
          repository: kubeprometheusstack/kube-webhook-certgen
          tag: v20221220-controller-v1.5.1-58-g787ea74b6
        resources:
          limits:
            cpu: 300m
            memory: 400Mi
          requests:
            cpu: 100m
            memory: 100Mi
        securityContext:
          runAsGroup: 2000
          runAsNonRoot: true
          runAsUser: 2000
          seccompProfile:
            type: RuntimeDefault
    image:
      pullPolicy: Always
      registry: mtr.devops.telekom.de
      repository: kubeprometheusstack/prometheus-operator
      tag: v0.68.0
    prometheusConfigReloader:
      image:
        registry: mtr.devops.telekom.de
        repository: kubeprometheusstack/prometheus-config-reloader
  thanosRuler:
    enabled: false

# refer to Rancher specific things,holding as sub charts in https://github.com/rancher/charts/tree/release-v2.7/charts/rancher-monitoring/102.0.2%2Bup40.1.2/charts
# try to adapt from kps components, or copy the sub chart content here
rkeControllerManager:
  clients:
    https:
      enabled: true
      insecureSkipVerify: true
      useServiceAccountCredentials: true
    nodeSelector:
      node-role.kubernetes.io/controlplane: "true"
    port: 10011
    tolerations:
    - effect: "NoExecute"
      operator: "Exists"
    - effect: "NoSchedule"
      operator: "Exists"
    useLocalhost: true
  component: kube-controller-manager
  enabled: true
  kubeVersionOverrides:
  - constraint: "< 1.22"
    values:
      clients:
        https:
          enabled: false
          insecureSkipVerify: false
          useServiceAccountCredentials: false
      metricsPort: 10252 # default to insecure port in k8s < 1.22
  metricsPort: 10257 # default to secure port as of k8s >= 1.22
  serviceMonitor:
    endpoints:
    - port: metrics
      honorLabels: true
      # -- Relabeling to keep only the needed metrics
      # -- for the grafana dashboards. If additional metrics
      # -- are needed, they should be added to this regex.
      metricRelabelings:
      - action: keep
        regex: "process_(start_time_seconds|cpu_seconds_total|resident_memory_bytes)|storage_operation_duration_seconds_(bucket|count)|rest_client_(request_duration_seconds_bucket|requests_total)|workqueue_(queue_duration_seconds_bucket|depth|adds_total)|up|go_goroutines"
        sourceLabels:
        - __name__

rkeEtcd:
  enabled: true
  metricsPort: 2379
  component: kube-etcd
  clients:
    port: 10014
    https:
      authenticationMethod:
        authorization:
          enabled: false
        bearerTokenFile:
          enabled: false
        bearerTokenSecret:
          enabled: false
      enabled: true
      certDir: /etc/kubernetes/ssl
      certFile: kube-etcd-*.pem
      keyFile: kube-etcd-*-key.pem
      caCertFile: kube-ca.pem
      seLinuxOptions:
        # Gives rkeEtcd permissions to read files in /etc/kubernetes/*
        # Type is defined in https://github.com/rancher/rancher-selinux
        type: rke_kubereader_t
    nodeSelector:
      node-role.kubernetes.io/etcd: "true"
    tolerations:
    - effect: "NoExecute"
      operator: "Exists"
    - effect: "NoSchedule"
      operator: "Exists"
  serviceMonitor:
    endpoints:
    - port: metrics
      honorLabels: true
      # -- Relabeling to keep only the needed metrics
      # -- for the grafana dashboards. If additional metrics
      # -- are needed, they should be added to this regex.
      metricRelabelings:
      - action: keep
        regex: "grpc_server_(handled_total|started_total)|up|process_(start_time_seconds|cpu_seconds_total|resident_memory_bytes)|go_goroutines|etcd_disk_(backend_commit_duration_seconds_bucket|wal_fsync_duration_seconds_bucket)|etcd_server_proposals_(pending|failed_total|applied_total|committed_total)|etcd_network_client_grpc_(sent_bytes_total|received_bytes_total)|etcd_mvcc_db_total_size_in_bytes"
        sourceLabels:
        - __name__

rkeIngressNginx:
  enabled: false
  clients:
    nodeSelector:
      node-role.kubernetes.io/worker: "true"
    port: 10015
    tolerations:
    - effect: "NoExecute"
      operator: "Exists"
    - effect: "NoSchedule"
      operator: "Exists"
    useLocalhost: true
  component: ingress-nginx
  metricsPort: 10254

rkeProxy:
  enabled: true
  metricsPort: 10249
  component: kube-proxy
  clients:
    port: 10013
    useLocalhost: true
    tolerations:
    - effect: "NoExecute"
      operator: "Exists"
    - effect: "NoSchedule"
      operator: "Exists"
  serviceMonitor:
    endpoints:
    - port: metrics
      honorLabels: true
      # -- Relabeling to keep only the needed metrics
      # -- for the grafana dashboards. If additional metrics
      # -- are needed, they should be added to this regex.
      metricRelabelings:
      - action: keep
        regex: "process_(start_time_seconds|cpu_seconds_total|resident_memory_bytes)|rest_client_(request_duration_seconds_bucket|requests_total)|workqueue_(queue_duration_seconds_bucket|depth|adds_total)|up|go_goroutines"
        sourceLabels:
        - __name__

rkeScheduler:
  clients:
    https:
      enabled: true
      insecureSkipVerify: true
      useServiceAccountCredentials: true
      authenticationMethod:
        authorization:
          enabled: false
        bearerTokenFile:
          enabled: false
        bearerTokenSecret:
          enabled: false

    nodeSelector:
      node-role.kubernetes.io/controlplane: "true"
    port: 10012
    tolerations:
    - effect: "NoExecute"
      operator: "Exists"
    - effect: "NoSchedule"
      operator: "Exists"
    useLocalhost: true
  component: kube-scheduler
  enabled: true
  kubeVersionOverrides:
  - constraint: "< 1.23"
    values:
      clients:
        https:
          enabled: false
          insecureSkipVerify: false
          useServiceAccountCredentials: false
      metricsPort: 10251 # default to insecure port in k8s < 1.23
  metricsPort: 10259
  serviceMonitor:
    endpoints:
    - port: metrics
      honorLabels: true
      # -- Relabeling to keep only the needed metrics
      # -- for the grafana dashboards. If additional metrics
      # -- are needed, they should be added to this regex.
      metricRelabelings:
      - action: keep
        regex: "process_(start_time_seconds|cpu_seconds_total|resident_memory_bytes)|rest_client_(request_duration_seconds_bucket|requests_total)|workqueue_(queue_duration_seconds_bucket|depth|adds_total)|up|go_goroutines"
        sourceLabels:
        - __name__

hardenedKubelet:
  enabled: true
  metricsPort: 10250
  component: kubelet
  clients:
    port: 10015
    useLocalhost: true
    https:
      enabled: true
      useServiceAccountCredentials: true
      insecureSkipVerify: true
      authenticationMethod:
        authorization:
          enabled: false
        bearerTokenFile:
          enabled: false
        bearerTokenSecret:
          enabled: false
    rbac:
      additionalRules:
      - nonResourceURLs: [ "/metrics/cadvisor" ]
        verbs: [ "get" ]
      - apiGroups: [ "" ]
        resources: [ "nodes/metrics" ]
        verbs: [ "get" ]
    tolerations:
    - effect: "NoExecute"
      operator: "Exists"
    - effect: "NoSchedule"
      operator: "Exists"
  serviceMonitor:
    bearerTokenFile: /var/run/secrets/kubernetes.io/serviceaccount/token
    endpoints:
    - port: metrics
      honorLabels: true
      relabelings:
      - sourceLabels: [ __metrics_path__ ]
        targetLabel: metrics_path
      metricRelabelings:
      - action: keep
        regex: "up|go_goroutines|storage_operation_(duration_seconds_bucket|duration_seconds_count)|rest_client_(request_duration_seconds_bucket|requests_total)|workqueue_(queue_duration_seconds_bucket|depth|adds_total)|process_(start_time_seconds|cpu_seconds_total|resident_memory_bytes)|kubelet_pod_(worker_duration_seconds_bucket|start_duration_seconds_bucket|worker_duration_seconds_count|start_duration_seconds_count)|kubelet_cgroup_manager_(duration_seconds_bucket|duration_seconds_count)|kubelet_runtime_operations_(duration_seconds_bucket|total|errors_total)|kubelet_volume_stats_(inodes_used|inodes|available_bytes|capacity_bytes|used_bytes)|kubelet_pleg_relist_(duration_seconds_bucket|interval_seconds_bucket|duration_seconds_count)|kubelet_running_(containers|pods)|kubelet_node_name|volume_manager_total_volumes"
        sourceLabels:
        - __name__
    - port: metrics
      path: /metrics/cadvisor
      honorLabels: true
      relabelings:
      - sourceLabels: [ __metrics_path__ ]
        targetLabel: metrics_path
      metricRelabelings:
      - action: keep
        regex: "up|container_network_(transmit_bytes_total|transmit_bytes_total|receive_errors_total|receive_packets_dropped_total|receive_bytes_total|receive_packets_total|transmit_packets_dropped_total|transmit_packets_total|transmit_errors_total)|container_memory_(cache|rss|working_set_bytes|usage_bytes)|container_fs_(reads_total|writes_total|reads_bytes_total|writes_bytes_total)|container_cpu_(system_seconds_total|usage_seconds_total|user_seconds_total|cfs_periods_total|cfs_throttled_periods_total|cfs_throttled_seconds_total)|node_namespace_pod_container:(container_memory_working_set_bytes|container_memory_cache|container_memory_rss)|machine_(cpu_cores|memory_bytes)"
        sourceLabels:
        - __name__
    - port: metrics
      path: /metrics/probes
      honorLabels: true
      relabelings:
      - sourceLabels: [ __metrics_path__ ]
        targetLabel: metrics_path
      metricRelabelings:
      - action: keep
        regex: process_(start_time_seconds|cpu_seconds_total|resident_memory_bytes)
        sourceLabels:
        - __name__