chore(deps): update ghcr.io/scanopy/scanopy/server docker tag to v0.19.0

renovate-bot commented

2026-07-23 01:06:06 +00:00

Member

This PR contains the following updates:

Package	Update	Change
ghcr.io/scanopy/scanopy/server	minor	`v0.17.4` → `v0.19.0`

Release Notes

scanopy/scanopy (ghcr.io/scanopy/scanopy/server)

`v0.19.0`

Compare Source

This release features a bottom-up redesign of the topology view. All four views have simplified cards that feature prominent icons to make skimming the visualization easier than ever, while moving details to rich tooltips. The layout engine also produces simpler and more condensed diagrams.

New Features

Topology

Give every device type a distinct glyph and stack service badges on the card corner, making crowded topologies easier to read.
Restructure tooltips across topology cards, OS, tags, and scan outcomes, and keep every popover inside the viewport.
List workload guests with run state shown as a marker so you can spot stopped workloads at a glance (also available in the Application view).
Lay out linked cards in dependency order and draw every hop of a dependency through tag groups, so application flows read top to bottom.

Discovery

Record UniFi networks as VLANs and subnets, and show a subnet's VLANs in its tooltip and inspector so controller-managed segments appear in your topology.
Try credentials against containers behind bridge networks and probe their ports from the inside, revealing services that were previously invisible.
Add per-host SNMP check commands to device warnings, giving you a ready-to-run command for each affected device instead of generic guidance.
Detect Spring Boot, Celery, and Sidekiq workers as applications during discovery.
Rescan addresses your daemon can reach by route, so networks beyond its directly attached subnets get picked up.

Improvements

Speed up Proxmox and UniFi discovery by submitting guests, hosts, and subnets concurrently.
Serve OIDC provider logos from Scanopy itself, so sign-in pages no longer reach out to third-party servers.
Support images in release notes, so in-app announcements can show what's new.

Bug Fixes

Fix Layer 2 topologies that could fail to render by routing switch edges orthogonally.
Keep findings reported from inside a container attached to that container instead of its host.
Stop a scan from overwriting subnets and host overrides belonging to another scan's daemon.
Refresh Last seen on VLANs each time a scan reports them again.
Let an identified service replace its earlier placeholder entry rather than creating a duplicate.
Match UniFi Next-Gen Gateways so they're identified correctly.
Withhold only the credentials an older daemon can't use, instead of skipping the whole set.

`v0.18.2`

Compare Source

New Features

Add a terms review prompt that asks you to re-accept the terms when they change (#797).

Improvements

Add paging to grouped lists so large sets of results stay fast and easy to browse.
Show the release notes popup only for releases worth reading about, so minor updates no longer interrupt you.

`v0.18.1`

Compare Source

This release focuses on making discovery results actionable faster: scans now tell you when they've found something that needs credentials, and the entity tables got a productivity overhaul.

New Features

Prompt for credentials when a scan finds SNMP, Docker, or Podman integrations, so you can turn a bare port into full device or container detail in a couple of clicks.
Add SNMPv3 security levels and MD5 authentication, widening the range of devices Scanopy can poll.
Notify admins with an in-app banner when a new Scanopy release is available.

Improvements

Make entity tables faster to work with: keyboard shortcuts for create, delete and select-all, actions for the selected row right in the toolbar, and a clearer summary row.
Store list filters and search in the URL so you can bookmark or share a filtered view.
Apply your active filters to host and service exports, so what you download matches what you see.
Group credentials by integration by default and tidy the tag picker, making both easier to scan at a glance.
Show recent scan outcomes on the home page, including how many warnings each run produced and which ones you can resolve.

Bug Fixes

Fix containers and services losing their open ports after re-discovery, which could make hosts disappear from topology views (#784).
Fix daemons failing to reconnect when their saved identity went stale.
Fix daemon logging silently stopping when the log file could not be written, now falling back to standard output.

`v0.18.0`

Compare Source

This release focuses on a major improvement to Scanopy's tagging system, plus new ways to export your topology diagram.

New Features

Introduce tag groups as a first-class entity, letting you create, order and scope your own groups, filter by tag per view, and pick tags from chips in table column filters.
Export any topology view to draw.io or Visio, with host and device details carried along as shape data so your diagrams stay useful outside Scanopy (Business plan).
Add an in-app release notes modal and upgrade email, so you can see what changed and get the exact upgrade command for your deployment.
Detect Calibre, Calibre-Web and Dawarich during service discovery.

Improvements

Keep topology display and layout choices with each view, so switching views no longer resets how you had things arranged.
Speed up topology loading on large networks by building only the view you asked for and holding the existing layout steady while a scan runs.

Bug Fixes

Fix installs on machines where the architecture reports as amd64, which previously caused install.sh to bail out.
Fix older config.json files not being migrated in all cases when upgrading from earlier versions.
Stop profile updates from overwriting server-managed fields on your user account.
Fix retired Windows binaries sharing a single name, making them impossible to tell apart.
Fix quoted op:// secret references in .env files not being recognized.

`v0.17.22`

Compare Source

This release is built around finding and organizing things. A new global search palette spans every entity type, hosts and subnets now roll up into collapsible trees, and tags gained groups, icons and colours.

New Features

Add a global search palette on / that searches hosts, subnets, VLANs, sites, tags and more from one box (#2a2df43)
Group hosts by their virtualization tree and nest subnets inside their parents, so hypervisors, guests collapse into readable sections (#16df96)
Introduce tag groups, letting you define mutually exclusive sets like Status (#02e089)
Add asset tags to hosts, discovered automatically from ENTITY-MIB or entered by hand (#8c5226)
Make VLANs taggable and give them a full detail modal showing name, site and tags (#86fb61)

Improvements

Switch lists to table views by default and retire the card view, so every entity list looks and behaves the same (#da7025)
Rework entity modals with consistent layouts, paired short fields, floating icon and tag pickers, and caret navigation to step between entities without closing the dialog (#fa57f8)
Fold bulk actions into the list toolbar and float bulk tagging at the bottom of the list, making multi-select edits easier to reach (#4e74bf)
Unify page headers with larger titles, sub-tabs in the title row, and a sticky toolbar that keeps result counts and paging in view while you scroll (#e39be0)
Rename Network to Site and if-entries to interfaces throughout the UI for clearer, more familiar terminology (#f4ef4a)
Accept additional OIDC audiences and verify the authorized party, so SSO works with more identity provider configurations (#e19341)

Bug Fixes

Fix topology keyboard shortcuts and show the correct key hints for your operating system (#36b36e)
Persist Docker daemon configuration on its volume so settings survive container restarts and upgrades (#0d72c4)

`v0.17.21`

Compare Source

This release brings virtualization into the picture: Scanopy now talks to Proxmox VE, links guests to the hosts they run on, and surfaces virtualization details throughout the UI. Alongside that, tables, tags and the inspector all got more informative.

New Features

Add a Proxmox VE integration that discovers your nodes and guests, links each VM or container to the host it runs on, and shows guest type, OS, hostname and virtualization details in device details (#763).
Add table density and column resizing so you can fit more rows on screen or widen the columns you actually care about (#764).
Introduce collapsible inspector sections with metadata, making long entity panels easier to scan (#764).

Improvements

Give every tag a name and a tooltip, and collect hidden tags behind an (i) icon instead of dropping them, so you can see the full picture without crowding the row (#764).
Show port details in a hover popover on port chips, saving a trip into the host inspector (#764).

Bug Fixes

Fix host matching so devices proven to be the same hardware are merged, a second address behind one MAC is kept, and ipvlan guests are no longer confused with their host (#763).
Fix dependency editing so members added while editing are saved and the panel stays in edit mode as you change them (#763).
Keep long labels from pushing the "+N more" chip out of view and wrap labels that overflow their row (#764).

`v0.17.20`

Compare Source

This release is focused on knowing what your devices actually are — Scanopy now detects and displays operating systems across your network — plus a much more flexible entity table.

New Features

Detect host operating systems automatically from service banners, HTTP headers, mDNS, LLDP, SMB and container engines, ranking readings by source reliability so you see the most trustworthy answer (#761).
Show OS tags with platform icons throughout the app, including tooltips explaining how an OS was inferred (#761).
Report a daemon's operating system during handshake, so machines running a daemon no longer ask you to pick their OS manually (#761).
Sort, group and filter on every entity field, with filter and grouping controls available directly from table column headers and options drawn from the data in the tab you're viewing (#761).
Reorder entity table columns by dragging, with the full set of fields available to add (#761).

Improvements

Replace the integration picker with per-type setup hints that link straight to the relevant docs (#761).
Show an install-daemon prompt on the home page after you dismiss the onboarding checklist, so it's still easy to find (#761).
Fill in missing subnets, credentials and descriptions in the demo environment for a more realistic first look (#761).

`v0.17.19`

Compare Source

This release brings SSH and Wake-on-LAN into the credential system, plus a reworked credential picker and per-user date formatting.

New Features

Add SSH and Wake-on-LAN credential types, including an SSH login probe, per-OS script paths, and descriptions so you can tell similar credentials apart (#744).
Rework the credential picker with integration-first grouping, categories, checkboxes, expandable rows, and a total count, making it far easier to find the right credential on large installs (#746).
Add per-user date and time display settings that now apply consistently to every table and timestamp in the app (#743).

Improvements

Highlight every matching node when hovering a topology filter, and extend the staleness filter to cover IPs and containers (#742).
Use each daemon's recorded operating system when upgrading or reconfiguring it, so you no longer have to pick it manually (#749).
Truncate long modal titles and move tabs and steppers into the title row, giving dialogs more usable space (#753).
Show host pickers in pages with readable titles for IP-named hosts, so long lists are easier to scan (#747).

Bug Fixes

Fix missing creation dates on newly created client IDs (#756).

`v0.17.18`

Compare Source

New Features

Add sorting hosts by MAC address, so you can arrange each view the way that suits it rather than sharing one global order (#569).
Read configuration secrets from files via SCANOPY_<NAME>_FILE, making it easy to wire Scanopy up to Docker and Kubernetes secrets instead of plain environment variables.
Trust your operator CA bundle for outbound connections, so Scanopy can reach services behind an internal certificate authority without TLS errors.

Improvements

Record every port a neighbour advertises for a far end, giving you a more complete and accurate picture of multi-port links in topology.
Detect Cockpit, and correctly identify TrueNAS SCALE systems that don't expose SMB.
Retry the alternate scheme after a failed HTTP probe, so web services are identified more reliably during discovery.

Bug Fixes

Fix a crash on Windows when the daemon starts without Npcap installed.
Treat all-zero MAC addresses as no MAC, and correctly merge MAC addresses discovered on a rescan so hosts no longer show bogus hardware addresses.
Preserve server-provided ordering when paging through lists, instead of reshuffling results.
Draw the preview edge in the dependency tutorial so the step is actually demonstrable.

`v0.17.17`

Compare Source

This release focuses on better scan diagnostics — with a new Issues tab, clear end-of-scan reasons, and a raft of fixes for runs that used to hang forever.

New Features

Add an Issues tab that collects scan problems in one place, so you can see what went wrong without digging through the run history (#694).
Show why a scan ended and flag when a running scan stops reporting, so a stalled or degraded run is obvious at a glance instead of appearing to run indefinitely (#694).
Add one-click copying of a failed run's diagnostics, making it much faster to share details when you need help.

Improvements

Time out API requests the server never answers, so the interface no longer hangs waiting on a dead connection.
Show a proper translated message when the server is unreachable, instead of a raw or untranslated error.
Report API errors consistently across the app so failures always surface with a usable explanation.
Trim stray whitespace from typed email addresses and autofocus sign-in fields for faster logins.

Bug Fixes

Fix scans that could hang indefinitely by bounding waits in the discovery pipeline and adding a watchdog that cleans up sessions a daemon has lost or can no longer cancel (#694).
End discovery sessions whose daemon has disappeared, rather than leaving them stuck in a running state.
Fix cancelled scans leaving behind probes and senders that kept running after you stopped the scan.
Stop replayed scans correctly and prevent duplicate replays from being recorded.
Fix newer daemons being misidentified as legacy versions, which could cause scans to use the wrong behaviour.

`v0.17.16`

Compare Source

This release expands how Scanopy learns about your network neighbours, adding gNMI support for modern network operating systems and pulling LLDP data straight from the machine running the daemon.

New Features

Add gNMI as a discovery source, so devices running modern network operating systems can be scanned for interfaces and LLDP neighbours using a dedicated gNMI credential (#694).
Read LLDP neighbours from the daemon host itself via a local lldpd, so the machine running Scanopy appears in the topology with its own directly-connected links on Linux and other Unix systems (#697).

Improvements

Fall back to LLDP-V2-MIB during SNMP discovery when a device's classic neighbour table is empty, recovering links from switches that only publish the newer table (#696).
Warn when two integrations can reach the same device, making it clear why a host might be discovered twice or with conflicting details (#706).
Hide credential types that your server version can't yet handle, so you no longer configure a credential that silently does nothing (#711).

Bug Fixes

Fix network interfaces being duplicated or merged incorrectly by matching on the hardware address itself rather than where the reading came from.
Fix duplicate subnet entries that could appear when the same CIDR was discovered by different scans.
Fix stale readings sticking around when a newer scan produces a better-attributed value for the same property.

`v0.17.15`

Compare Source

This release digs into layer 2: Scanopy can now find devices that have no IP address at all, track multiple neighbours per interface, and show you exactly where each host's name and data came from.

New Features

Add PROFINET DCP discovery, so industrial devices with no IP address are found and placed on your topology alongside everything else (#701).
Support multiple LLDP/CDP neighbours per interface, giving accurate links on ports that see more than one neighbouring device (#702).
Redesign the host Details tab around a single name card that shows how the host was named, its description and tags, with renaming tucked behind an edit button (#705).
Mark hosts that were inferred from neighbour data rather than directly scanned, so you can tell what Scanopy actually reached (#707).

Improvements

Show filter chips for every active topology filter and make filters dismissable with Escape, so it's always clear why nodes are hidden (#708).
Flag partial LLDP walks in discovery results, so incomplete switch data is visible rather than silently trusted (#703).
Only prompt for L2 setup once there's data to act on, keeping the prompt out of the way during early scans (#710).

Bug Fixes

Fix SNMP error replies being parsed as table data, which could produce bogus interface and neighbour entries (#704).
Stop discarding valid LLDP/CDP neighbours when a switch walk finishes early (#703).
Resolve link ambiguity on interfaces that share a MAC address, using forwarding-table data to pick the right port (#706).
Fix interfaces rendering as "Interface null" in the topology and host views (#712).
Fix the L2 Physical view being reported as unavailable for hosts without an IP address (#713).
Fix dependency previews disappearing when dragging to a node that isn't currently rendered (#714).

`v0.17.14`

Compare Source

This release is mostly about making better sense of what discovery finds: neighbouring devices now turn into real hosts on your map, service detection has to prove what answered, and scan warnings are grouped, deduplicated and actionable.

New Features

Add automatic hosts for LLDP/CDP neighbours nothing has scanned yet — each far end is resolved by the address and port it advertises, and the address space behind unplaceable neighbours is inferred so they still land somewhere sensible on the map (#660).
Rework scan warnings so they are grouped by what they ask of you, with duplicates merged, related warnings nested, severe items clearly marked, and the whole run copyable exactly as recorded (#669).
Add detection for H.323, TFTP, MGCP, Beszel and four industrial protocols, so more of your network is identified by name instead of by port number (#673).
Let a MAC address identify a host when it comes from a trustworthy source, and rank discovered values by where they came from so the most reliable reading wins (#679).
Let a real reading correct an assumed subnet range, and report every unconfirmed range rather than only newly seen ones (#684).

Improvements

Speed up SNMP neighbour discovery by resolving all neighbours from a single read instead of one query per neighbour, and fall back to getnext for devices that stop answering getbulk (#691).
Simplify only the topology graphs that are big enough to need it, keep detail visible further out when zooming, and say clearly when detail stops being drawn (#692).
Apply field filters on the server for paginated entity tabs, so filtering large host and interface lists stays fast (#693).
Give hosts a consistent title everywhere, including hosts with no name, deleted hosts and collapsed containers, and badge hosts nothing has ever contacted (#681).

Bug Fixes

Fix a blank topology canvas caused by a render that never finished, and make the view fit correctly on load (#695).
Fix a 422 error that could interrupt host discovery (#666).
Stop controller devices being filed under the internet instead of their own network (#660).
Fix entity tabs scrolling sideways into blank space (#693).
Stop a superseded dialog from closing the one that replaced it (#681).
Correct Oracle TNS detection so those services are recognised reliably (#673).

`v0.17.13`

Compare Source

This release focuses on network discovery: Scanopy now finds devices through mDNS/DNS-SD, confirms liveness with more than one signal, and reports the machine it's running on like any other host.

New Features

Add mDNS/DNS-SD browsing to network discovery, so AirPlay speakers, printers, Chromecasts, and other advertised services show up automatically — announcements also count as proof a host is alive, and matching uses the full service record rather than just the service type.
Detect more hosts by adding ICMP echo as a second liveness signal alongside port probing, including endpoint-only ports that were previously skipped.
Collect interfaces from the host running the Scanopy daemon.
Expose hardware identity (model, serial, and related details) through the API so integrations and dashboards can read it.

Improvements

Give discovery scan warnings stable codes, making it easier to recognise and filter recurring issues across scans.
Report a diagnostic per credential and label the integration by name, so it's clear which credential failed and where.
Rename credential scope to "target" in the UI to match what you actually enter.

Bug Fixes

Fix the page scrolling behind the app shell, including phantom scroll height added by hidden tabs.
Fix LLDP scan warnings that lost host names or became unreadable when a host had gone away.
Fix interface details being overwritten instead of merged when multiple discovery methods report on the same host.

`v0.17.12`

Compare Source

This release sharpens SNMP discovery and topology accuracy — switches that answer per VLAN context are now reachable, LLDP links stay put, and when a device gives an incomplete answer, Scanopy surfaces more details on why for easier troubleshooting.

New Features

Add SNMPv3 context name support, so switches that expose per-VLAN or per-context data are discovered correctly instead of returning empty tables (#682).
Allow integrations to supply host names, so hosts imported from external sources arrive with meaningful names rather than bare IP addresses.
Ship the server as a single binary with migrations and the web UI built in, making deployments and upgrades a one-file affair.

Improvements

Report what a device actually claimed during a scan, including a clear explanation when an SNMP table read was cut short, so incomplete discovery is visible instead of silent.
Flag ambiguous neighbor identities as ambiguous rather than picking a link at random, and name which neighbor report went stale.

Bug Fixes

Fix password reset links returning a 404 instead of opening the reset page.
Restore Layer 2 port precision and stop valid LLDP links from being dropped from the topology.
Fix incorrect labels on topology nodes and links, and ensure link endpoints reflect the current topology rather than stale cached data.
Fix scan records occasionally missing their associated events.

`v0.17.11`

Compare Source

This release brings HPE Instant On networks into Scanopy.

New Features

Add HPE Instant On cloud portal integration, letting you pull sites, devices, and client details from Instant On into your topology by connecting your portal credentials; the setup screen clearly flags that it relies on an unofficial API that HPE could change at any time.

`v0.17.10`

Compare Source

This release focuses on more accurate SNMP-based topology discovery, plus the UniFi integration graduating to general availability.

New Features

Promote the UniFi integration to general availability (#675).

Improvements

Read SNMP bridge tables that devices return out of order, so switches with non-standard SNMP agents now contribute complete link data to your topology (#675).

Bug Fixes

Fix links being drawn to an arbitrary port when several ports on a switch share the same MAC address, which previously produced misleading connections in the topology view (#675).
Fix subnets appearing or disappearing incorrectly in the topology by deciding visibility based on how a subnet was discovered rather than how it was categorized (#675).

`v0.17.9`

Compare Source

This release brings a new table view for browsing your inventory, plus a large round of topology performance work that makes big graphs render faster and use far less memory.

New Features

Add a table view to every entity tab, with collapsible sections, tag-style values and consistent columns across hosts, networks, subnets, VLANs, daemons and credentials — it's now the default view, with a toggle to switch back to cards.
Apply the topology link-state filter on the server, so filtering large networks by link state is near-instant instead of reloading the whole graph.

Improvements

Speed up topology rendering substantially by measuring only the cards and containers that actually need it, reusing measurements across data refreshes, and skipping layouts that never get shown.
Cut the memory and DOM weight of every topology node, so large graphs stay responsive while panning and zooming.
Keep viewport culling working after the graph rebuilds, so scrolling around a big topology no longer stalls.
Preserve expanded container sizes across graph rebuilds and collapse changes, so nodes stop jumping around as you explore.
Skip the collapse animation on very large graphs so expanding and collapsing feels immediate.

Bug Fixes

Fix two causes of runaway topology node counts, along with a relayout loop triggered by emptied subcontainers.
Fix collapsed containers being sized by guesswork, which produced misaligned and degenerate nodes.
Fix container scans saving half-written hosts when discovery failed partway through.
Fix partial scans reporting that nothing was recorded when results had in fact been saved.
Fix LLDP neighbour discovery missing links on devices that report them without a time mark.
Fix ports appearing unlinked when the connection was only reported from one side.

`v0.17.8`

Compare Source

This release focuses on telling you why credentials used during a scan didn't work as expected — unused or unreachable credentials and missing SNMP data now explain themselves clearly in the UI instead of leaving you guessing or grepping logs.

New Features

Add an aggregated scan warnings summary that lists every credential Scanopy tried, flags the ones that were unreachable or never used, and says what kind of failure each attempt hit (#667).
Report the reason SNMP data is missing for a device — including the specific cause of a bridge-MIB shortfall — instead of silently returning empty results (#667).

Improvements

Improve SNMP collection resilience so a single malformed byte in a response no longer discards the entire device's data (#667).
Place UniFi-managed devices by their address space rather than the scan scope, putting them in the right spot on the map (#667).
Make hidden-entity filtering work consistently across entity types and redraw the topology immediately when you toggle it (#667).

Bug Fixes

Fix element cards being laid out at zero size, which left parts of the map invisible (#667).
Stop a device with no LLDP MIB from wiping out neighbour links discovered through other sources (#667).
Fix incorrect container-runtime edges drawn when subnets aren't containers (#667).
Fix unreadable text in the application wizard's service list when using light mode (#667).
Correct a stale claim about install artifacts on the daemon provisioning endpoint documentation (#667).

`v0.17.7`

Compare Source

This release focuses on smarter rescans and credential handling, making network discovery more flexible and responsive. We've also introduced integration for UniFi controllers (Beta) and tuned topology performance for faster visualizations.

New Features

Add single-host rescan, enabling you to refresh discovery for individual devices instead of the whole network (#201).
Introduce UniFi controller integration (Beta), allowing you to visualize UniFi-managed devices and leverage their network insights (#192).

Improvements

Improve topology layout and rendering speed by culling off-screen nodes at scale and halving layout work, so large maps load faster and remain responsive (#196).
Preload ELK layout engine on tab mount, cutting map visualization startup delays by about one second (#198).
Refine container collapsing rules for big networks, ensuring topologies are less cluttered by default if you have many grouped devices (#195).

Bug Fixes

Prevent per-host credential targets from reverting to broadcast settings when reopening discovery dialogs (#191).
Restrict daemon-host-only credentials to daemon hosts, so unintended assignments no longer cause discovery errors (#190).

`v0.17.6`

Compare Source

This release brings a more complete VLAN view and improved LLDP neighbour mapping — making topology exploration smoother and more informative.

New Features

Add view-only VLANs tab giving an organized overview of all detected VLANs in your environment (#646).
Draw LLDP neighbours that resolve directly to hosts, improving visibility for devices that advertise incomplete neighbour info (#653).
Add daemon version sunset lifecycle banner with sidebar indicator, prepping for clearer upgrade guidance as version support changes (#638).
Introduce new services definitions for Firefly III and Docmost, expanding out-of-box integrations (#652).

Improvements

Resolve LLDP neighbour vendors based on advertised identifiers, so device details are more accurate on topology maps (#656).
Improve demo data population by running in the background, reducing wait time and keeping the UI responsive (#654).
Accept MAC addresses in LLDP identifiers even if sent in unpadded ASCII format, covering more edge device types (#664).
Keep neighbour data discovered in partial topology walks, ensuring you see all available device links even if the scan is incomplete (#661).

Bug Fixes

Fix snapshot PhysicalLink edges and seed subnet-VLAN links, so topology graphs display accurate connections (#627).
Stop SNMP sessions from serving stale answers, keeping host information fresh after successive scans (#629).
Correct ipAddrTable override in SNMP test environments, improving scan reliability (#663).

`v0.17.5`

Compare Source

This release improves daemon lifecycle management, simplifies install workflows, and brings clarity to topology staleness tagging. Users will find daemon setup, edit, and key management noticeably smoother.

New Features

Add a unified daemon management modal, enabling easier installation, configuration, and legacy key handling from one place (#360).
Surface stale entities across digest, inventory, and topology views, providing clearer visibility for outdated network components (#359).

Improvements

Attach containers to every subnet they join and connect container bridge subnets to their host, for more accurate container-network visualization (#347).
Make multi-daemon installs more reliable on real hosts, ensuring that multiple daemons can be set up and managed concurrently (#337).

Bug Fixes

Fix duplicate host data loss caused by hung SNMP queries during discovery, improving scan reliability (#344).
Fix inflated scan ETA estimates when using multiple SNMP credentials, so scan duration predictions are more accurate (#343).

Configuration

📅 Schedule: (UTC)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate.

This PR contains the following updates: | Package | Update | Change | |---|---|---| | [ghcr.io/scanopy/scanopy/server](https://github.com/scanopy/scanopy) | minor | `v0.17.4` → `v0.19.0` | --- ### Release Notes <details> <summary>scanopy/scanopy (ghcr.io/scanopy/scanopy/server)</summary> ### [`v0.19.0`](https://github.com/scanopy/scanopy/releases/tag/v0.19.0) [Compare Source](https://github.com/scanopy/scanopy/compare/v0.18.2...v0.19.0) This release features a bottom-up redesign of the topology view. All four views have simplified cards that feature prominent icons to make skimming the visualization easier than ever, while moving details to rich tooltips. The layout engine also produces simpler and more condensed diagrams. ![The new topology view](https://scanopy.net/changelog/v0.19.0/topology-new.png) #### New Features ##### Topology - Give every device type a distinct glyph and stack service badges on the card corner, making crowded topologies easier to read. - Restructure tooltips across topology cards, OS, tags, and scan outcomes, and keep every popover inside the viewport. - List workload guests with run state shown as a marker so you can spot stopped workloads at a glance (also available in the Application view). - Lay out linked cards in dependency order and draw every hop of a dependency through tag groups, so application flows read top to bottom. ##### Discovery - Record UniFi networks as VLANs and subnets, and show a subnet's VLANs in its tooltip and inspector so controller-managed segments appear in your topology. - Try credentials against containers behind bridge networks and probe their ports from the inside, revealing services that were previously invisible. - Add per-host SNMP check commands to device warnings, giving you a ready-to-run command for each affected device instead of generic guidance. - Detect Spring Boot, Celery, and Sidekiq workers as applications during discovery. - Rescan addresses your daemon can reach by route, so networks beyond its directly attached subnets get picked up. #### Improvements - Speed up Proxmox and UniFi discovery by submitting guests, hosts, and subnets concurrently. - Serve OIDC provider logos from Scanopy itself, so sign-in pages no longer reach out to third-party servers. - Support images in release notes, so in-app announcements can show what's new. #### Bug Fixes - Fix Layer 2 topologies that could fail to render by routing switch edges orthogonally. - Keep findings reported from inside a container attached to that container instead of its host. - Stop a scan from overwriting subnets and host overrides belonging to another scan's daemon. - Refresh Last seen on VLANs each time a scan reports them again. - Let an identified service replace its earlier placeholder entry rather than creating a duplicate. - Match UniFi Next-Gen Gateways so they're identified correctly. - Withhold only the credentials an older daemon can't use, instead of skipping the whole set. ### [`v0.18.2`](https://github.com/scanopy/scanopy/releases/tag/v0.18.2) [Compare Source](https://github.com/scanopy/scanopy/compare/v0.18.1...v0.18.2) #### New Features - Add a terms review prompt that asks you to re-accept the terms when they change ([#797](https://github.com/scanopy/scanopy/pull/797)). #### Improvements - Add paging to grouped lists so large sets of results stay fast and easy to browse. - Show the release notes popup only for releases worth reading about, so minor updates no longer interrupt you. ### [`v0.18.1`](https://github.com/scanopy/scanopy/releases/tag/v0.18.1) [Compare Source](https://github.com/scanopy/scanopy/compare/v0.18.0...v0.18.1) This release focuses on making discovery results actionable faster: scans now tell you when they've found something that needs credentials, and the entity tables got a productivity overhaul. #### New Features - Prompt for credentials when a scan finds SNMP, Docker, or Podman integrations, so you can turn a bare port into full device or container detail in a couple of clicks. - Add SNMPv3 security levels and MD5 authentication, widening the range of devices Scanopy can poll. - Notify admins with an in-app banner when a new Scanopy release is available. #### Improvements - Make entity tables faster to work with: keyboard shortcuts for create, delete and select-all, actions for the selected row right in the toolbar, and a clearer summary row. - Store list filters and search in the URL so you can bookmark or share a filtered view. - Apply your active filters to host and service exports, so what you download matches what you see. - Group credentials by integration by default and tidy the tag picker, making both easier to scan at a glance. - Show recent scan outcomes on the home page, including how many warnings each run produced and which ones you can resolve. #### Bug Fixes - Fix containers and services losing their open ports after re-discovery, which could make hosts disappear from topology views ([#784](https://github.com/scanopy/scanopy/issues/784)). - Fix daemons failing to reconnect when their saved identity went stale. - Fix daemon logging silently stopping when the log file could not be written, now falling back to standard output. ### [`v0.18.0`](https://github.com/scanopy/scanopy/releases/tag/v0.18.0) [Compare Source](https://github.com/scanopy/scanopy/compare/v0.17.22...v0.18.0) This release focuses on a major improvement to Scanopy's tagging system, plus new ways to export your topology diagram. #### New Features - Introduce tag groups as a first-class entity, letting you create, order and scope your own groups, filter by tag per view, and pick tags from chips in table column filters. - Export any topology view to draw\.io or Visio, with host and device details carried along as shape data so your diagrams stay useful outside Scanopy (Business plan). - Add an in-app release notes modal and upgrade email, so you can see what changed and get the exact upgrade command for your deployment. - Detect Calibre, Calibre-Web and Dawarich during service discovery. #### Improvements - Keep topology display and layout choices with each view, so switching views no longer resets how you had things arranged. - Speed up topology loading on large networks by building only the view you asked for and holding the existing layout steady while a scan runs. #### Bug Fixes - Fix installs on machines where the architecture reports as `amd64`, which previously caused `install.sh` to bail out. - Fix older `config.json` files not being migrated in all cases when upgrading from earlier versions. - Stop profile updates from overwriting server-managed fields on your user account. - Fix retired Windows binaries sharing a single name, making them impossible to tell apart. - Fix quoted `op://` secret references in `.env` files not being recognized. ### [`v0.17.22`](https://github.com/scanopy/scanopy/releases/tag/v0.17.22) [Compare Source](https://github.com/scanopy/scanopy/compare/v0.17.21...v0.17.22) This release is built around finding and organizing things. A new global search palette spans every entity type, hosts and subnets now roll up into collapsible trees, and tags gained groups, icons and colours. #### New Features - Add a global search palette on `/` that searches hosts, subnets, VLANs, sites, tags and more from one box ([#2a2df43](https://github.com/scanopy/scanopy/pull/2)) - Group hosts by their virtualization tree and nest subnets inside their parents, so hypervisors, guests collapse into readable sections ([#16df96](https://github.com/scanopy/scanopy/pull/16)) - Introduce tag groups, letting you define mutually exclusive sets like Status ([#02e089](https://github.com/scanopy/scanopy/pull/5)) - Add asset tags to hosts, discovered automatically from ENTITY-MIB or entered by hand ([#8c5226](https://github.com/scanopy/scanopy/pull/8)) - Make VLANs taggable and give them a full detail modal showing name, site and tags ([#86fb61](https://github.com/scanopy/scanopy/pull/86)) #### Improvements - Switch lists to table views by default and retire the card view, so every entity list looks and behaves the same ([#da7025](https://github.com/scanopy/scanopy/pull/7)) - Rework entity modals with consistent layouts, paired short fields, floating icon and tag pickers, and caret navigation to step between entities without closing the dialog ([#fa57f8](https://github.com/scanopy/scanopy/pull/57)) - Fold bulk actions into the list toolbar and float bulk tagging at the bottom of the list, making multi-select edits easier to reach ([#4e74bf](https://github.com/scanopy/scanopy/pull/4)) - Unify page headers with larger titles, sub-tabs in the title row, and a sticky toolbar that keeps result counts and paging in view while you scroll ([#e39be0](https://github.com/scanopy/scanopy/pull/39)) - Rename Network to Site and if-entries to interfaces throughout the UI for clearer, more familiar terminology ([#f4ef4a](https://github.com/scanopy/scanopy/pull/4)) - Accept additional OIDC audiences and verify the authorized party, so SSO works with more identity provider configurations ([#e19341](https://github.com/scanopy/scanopy/pull/19)) #### Bug Fixes - Fix topology keyboard shortcuts and show the correct key hints for your operating system ([#36b36e](https://github.com/scanopy/scanopy/pull/36)) - Persist Docker daemon configuration on its volume so settings survive container restarts and upgrades ([#0d72c4](https://github.com/scanopy/scanopy/pull/72)) ### [`v0.17.21`](https://github.com/scanopy/scanopy/releases/tag/v0.17.21) [Compare Source](https://github.com/scanopy/scanopy/compare/v0.17.20...v0.17.21) This release brings virtualization into the picture: Scanopy now talks to Proxmox VE, links guests to the hosts they run on, and surfaces virtualization details throughout the UI. Alongside that, tables, tags and the inspector all got more informative. #### New Features - Add a Proxmox VE integration that discovers your nodes and guests, links each VM or container to the host it runs on, and shows guest type, OS, hostname and virtualization details in device details ([#763](https://github.com/scanopy/scanopy/pull/763)). - Add table density and column resizing so you can fit more rows on screen or widen the columns you actually care about ([#764](https://github.com/scanopy/scanopy/pull/764)). - Introduce collapsible inspector sections with metadata, making long entity panels easier to scan ([#764](https://github.com/scanopy/scanopy/pull/764)). #### Improvements - Give every tag a name and a tooltip, and collect hidden tags behind an (i) icon instead of dropping them, so you can see the full picture without crowding the row ([#764](https://github.com/scanopy/scanopy/pull/764)). - Show port details in a hover popover on port chips, saving a trip into the host inspector ([#764](https://github.com/scanopy/scanopy/pull/764)). #### Bug Fixes - Fix host matching so devices proven to be the same hardware are merged, a second address behind one MAC is kept, and ipvlan guests are no longer confused with their host ([#763](https://github.com/scanopy/scanopy/pull/763)). - Fix dependency editing so members added while editing are saved and the panel stays in edit mode as you change them ([#763](https://github.com/scanopy/scanopy/pull/763)). - Keep long labels from pushing the "+N more" chip out of view and wrap labels that overflow their row ([#764](https://github.com/scanopy/scanopy/pull/764)). ### [`v0.17.20`](https://github.com/scanopy/scanopy/releases/tag/v0.17.20) [Compare Source](https://github.com/scanopy/scanopy/compare/v0.17.19...v0.17.20) This release is focused on knowing what your devices actually are — Scanopy now detects and displays operating systems across your network — plus a much more flexible entity table. #### New Features - Detect host operating systems automatically from service banners, HTTP headers, mDNS, LLDP, SMB and container engines, ranking readings by source reliability so you see the most trustworthy answer ([#761](https://github.com/scanopy/scanopy/pull/761)). - Show OS tags with platform icons throughout the app, including tooltips explaining how an OS was inferred ([#761](https://github.com/scanopy/scanopy/pull/761)). - Report a daemon's operating system during handshake, so machines running a daemon no longer ask you to pick their OS manually ([#761](https://github.com/scanopy/scanopy/pull/761)). - Sort, group and filter on every entity field, with filter and grouping controls available directly from table column headers and options drawn from the data in the tab you're viewing ([#761](https://github.com/scanopy/scanopy/pull/761)). - Reorder entity table columns by dragging, with the full set of fields available to add ([#761](https://github.com/scanopy/scanopy/pull/761)). #### Improvements - Replace the integration picker with per-type setup hints that link straight to the relevant docs ([#761](https://github.com/scanopy/scanopy/pull/761)). - Show an install-daemon prompt on the home page after you dismiss the onboarding checklist, so it's still easy to find ([#761](https://github.com/scanopy/scanopy/pull/761)). - Fill in missing subnets, credentials and descriptions in the demo environment for a more realistic first look ([#761](https://github.com/scanopy/scanopy/pull/761)). ### [`v0.17.19`](https://github.com/scanopy/scanopy/releases/tag/v0.17.19) [Compare Source](https://github.com/scanopy/scanopy/compare/v0.17.18...v0.17.19) This release brings SSH and Wake-on-LAN into the credential system, plus a reworked credential picker and per-user date formatting. #### New Features - Add SSH and Wake-on-LAN credential types, including an SSH login probe, per-OS script paths, and descriptions so you can tell similar credentials apart ([#744](https://github.com/scanopy/scanopy/pull/744)). - Rework the credential picker with integration-first grouping, categories, checkboxes, expandable rows, and a total count, making it far easier to find the right credential on large installs ([#746](https://github.com/scanopy/scanopy/pull/746)). - Add per-user date and time display settings that now apply consistently to every table and timestamp in the app ([#743](https://github.com/scanopy/scanopy/pull/743)). #### Improvements - Highlight every matching node when hovering a topology filter, and extend the staleness filter to cover IPs and containers ([#742](https://github.com/scanopy/scanopy/pull/742)). - Use each daemon's recorded operating system when upgrading or reconfiguring it, so you no longer have to pick it manually ([#749](https://github.com/scanopy/scanopy/pull/749)). - Truncate long modal titles and move tabs and steppers into the title row, giving dialogs more usable space ([#753](https://github.com/scanopy/scanopy/pull/753)). - Show host pickers in pages with readable titles for IP-named hosts, so long lists are easier to scan ([#747](https://github.com/scanopy/scanopy/pull/747)). #### Bug Fixes - Fix missing creation dates on newly created client IDs ([#756](https://github.com/scanopy/scanopy/pull/756)). ### [`v0.17.18`](https://github.com/scanopy/scanopy/releases/tag/v0.17.18) [Compare Source](https://github.com/scanopy/scanopy/compare/v0.17.17...v0.17.18) #### New Features - Add sorting hosts by MAC address, so you can arrange each view the way that suits it rather than sharing one global order ([#569](https://github.com/scanopy/scanopy/issues/569)). - Read configuration secrets from files via `SCANOPY_<NAME>_FILE`, making it easy to wire Scanopy up to Docker and Kubernetes secrets instead of plain environment variables. - Trust your operator CA bundle for outbound connections, so Scanopy can reach services behind an internal certificate authority without TLS errors. #### Improvements - Record every port a neighbour advertises for a far end, giving you a more complete and accurate picture of multi-port links in topology. - Detect Cockpit, and correctly identify TrueNAS SCALE systems that don't expose SMB. - Retry the alternate scheme after a failed HTTP probe, so web services are identified more reliably during discovery. #### Bug Fixes - Fix a crash on Windows when the daemon starts without Npcap installed. - Treat all-zero MAC addresses as no MAC, and correctly merge MAC addresses discovered on a rescan so hosts no longer show bogus hardware addresses. - Preserve server-provided ordering when paging through lists, instead of reshuffling results. - Draw the preview edge in the dependency tutorial so the step is actually demonstrable. ### [`v0.17.17`](https://github.com/scanopy/scanopy/releases/tag/v0.17.17) [Compare Source](https://github.com/scanopy/scanopy/compare/v0.17.16...v0.17.17) This release focuses on better scan diagnostics — with a new Issues tab, clear end-of-scan reasons, and a raft of fixes for runs that used to hang forever. #### New Features - Add an Issues tab that collects scan problems in one place, so you can see what went wrong without digging through the run history ([#694](https://github.com/scanopy/scanopy/pull/694)). - Show why a scan ended and flag when a running scan stops reporting, so a stalled or degraded run is obvious at a glance instead of appearing to run indefinitely ([#694](https://github.com/scanopy/scanopy/pull/694)). - Add one-click copying of a failed run's diagnostics, making it much faster to share details when you need help. #### Improvements - Time out API requests the server never answers, so the interface no longer hangs waiting on a dead connection. - Show a proper translated message when the server is unreachable, instead of a raw or untranslated error. - Report API errors consistently across the app so failures always surface with a usable explanation. - Trim stray whitespace from typed email addresses and autofocus sign-in fields for faster logins. #### Bug Fixes - Fix scans that could hang indefinitely by bounding waits in the discovery pipeline and adding a watchdog that cleans up sessions a daemon has lost or can no longer cancel ([#694](https://github.com/scanopy/scanopy/pull/694)). - End discovery sessions whose daemon has disappeared, rather than leaving them stuck in a running state. - Fix cancelled scans leaving behind probes and senders that kept running after you stopped the scan. - Stop replayed scans correctly and prevent duplicate replays from being recorded. - Fix newer daemons being misidentified as legacy versions, which could cause scans to use the wrong behaviour. ### [`v0.17.16`](https://github.com/scanopy/scanopy/releases/tag/v0.17.16) [Compare Source](https://github.com/scanopy/scanopy/compare/v0.17.15...v0.17.16) This release expands how Scanopy learns about your network neighbours, adding gNMI support for modern network operating systems and pulling LLDP data straight from the machine running the daemon. #### New Features - Add gNMI as a discovery source, so devices running modern network operating systems can be scanned for interfaces and LLDP neighbours using a dedicated gNMI credential ([#694](https://github.com/scanopy/scanopy/pull/694)). - Read LLDP neighbours from the daemon host itself via a local lldpd, so the machine running Scanopy appears in the topology with its own directly-connected links on Linux and other Unix systems ([#697](https://github.com/scanopy/scanopy/pull/697)). #### Improvements - Fall back to LLDP-V2-MIB during SNMP discovery when a device's classic neighbour table is empty, recovering links from switches that only publish the newer table ([#696](https://github.com/scanopy/scanopy/pull/696)). - Warn when two integrations can reach the same device, making it clear why a host might be discovered twice or with conflicting details ([#706](https://github.com/scanopy/scanopy/pull/706)). - Hide credential types that your server version can't yet handle, so you no longer configure a credential that silently does nothing ([#711](https://github.com/scanopy/scanopy/pull/711)). #### Bug Fixes - Fix network interfaces being duplicated or merged incorrectly by matching on the hardware address itself rather than where the reading came from. - Fix duplicate subnet entries that could appear when the same CIDR was discovered by different scans. - Fix stale readings sticking around when a newer scan produces a better-attributed value for the same property. ### [`v0.17.15`](https://github.com/scanopy/scanopy/releases/tag/v0.17.15) [Compare Source](https://github.com/scanopy/scanopy/compare/v0.17.14...v0.17.15) This release digs into layer 2: Scanopy can now find devices that have no IP address at all, track multiple neighbours per interface, and show you exactly where each host's name and data came from. #### New Features - Add PROFINET DCP discovery, so industrial devices with no IP address are found and placed on your topology alongside everything else ([#701](https://github.com/scanopy/scanopy/pull/701)). - Support multiple LLDP/CDP neighbours per interface, giving accurate links on ports that see more than one neighbouring device ([#702](https://github.com/scanopy/scanopy/pull/702)). - Redesign the host Details tab around a single name card that shows how the host was named, its description and tags, with renaming tucked behind an edit button ([#705](https://github.com/scanopy/scanopy/pull/705)). - Mark hosts that were inferred from neighbour data rather than directly scanned, so you can tell what Scanopy actually reached ([#707](https://github.com/scanopy/scanopy/pull/707)). #### Improvements - Show filter chips for every active topology filter and make filters dismissable with Escape, so it's always clear why nodes are hidden ([#708](https://github.com/scanopy/scanopy/pull/708)). - Flag partial LLDP walks in discovery results, so incomplete switch data is visible rather than silently trusted ([#703](https://github.com/scanopy/scanopy/pull/703)). - Only prompt for L2 setup once there's data to act on, keeping the prompt out of the way during early scans ([#710](https://github.com/scanopy/scanopy/pull/710)). #### Bug Fixes - Fix SNMP error replies being parsed as table data, which could produce bogus interface and neighbour entries ([#704](https://github.com/scanopy/scanopy/pull/704)). - Stop discarding valid LLDP/CDP neighbours when a switch walk finishes early ([#703](https://github.com/scanopy/scanopy/pull/703)). - Resolve link ambiguity on interfaces that share a MAC address, using forwarding-table data to pick the right port ([#706](https://github.com/scanopy/scanopy/pull/706)). - Fix interfaces rendering as "Interface null" in the topology and host views ([#712](https://github.com/scanopy/scanopy/pull/712)). - Fix the L2 Physical view being reported as unavailable for hosts without an IP address ([#713](https://github.com/scanopy/scanopy/pull/713)). - Fix dependency previews disappearing when dragging to a node that isn't currently rendered ([#714](https://github.com/scanopy/scanopy/pull/714)). ### [`v0.17.14`](https://github.com/scanopy/scanopy/releases/tag/v0.17.14) [Compare Source](https://github.com/scanopy/scanopy/compare/v0.17.13...v0.17.14) This release is mostly about making better sense of what discovery finds: neighbouring devices now turn into real hosts on your map, service detection has to prove what answered, and scan warnings are grouped, deduplicated and actionable. #### New Features - Add automatic hosts for LLDP/CDP neighbours nothing has scanned yet — each far end is resolved by the address and port it advertises, and the address space behind unplaceable neighbours is inferred so they still land somewhere sensible on the map ([#660](https://github.com/scanopy/scanopy/pull/660)). - Rework scan warnings so they are grouped by what they ask of you, with duplicates merged, related warnings nested, severe items clearly marked, and the whole run copyable exactly as recorded ([#669](https://github.com/scanopy/scanopy/pull/669)). - Add detection for H.323, TFTP, MGCP, Beszel and four industrial protocols, so more of your network is identified by name instead of by port number ([#673](https://github.com/scanopy/scanopy/pull/673)). - Let a MAC address identify a host when it comes from a trustworthy source, and rank discovered values by where they came from so the most reliable reading wins ([#679](https://github.com/scanopy/scanopy/pull/679)). - Let a real reading correct an assumed subnet range, and report every unconfirmed range rather than only newly seen ones ([#684](https://github.com/scanopy/scanopy/pull/684)). #### Improvements - Speed up SNMP neighbour discovery by resolving all neighbours from a single read instead of one query per neighbour, and fall back to getnext for devices that stop answering getbulk ([#691](https://github.com/scanopy/scanopy/pull/691)). - Simplify only the topology graphs that are big enough to need it, keep detail visible further out when zooming, and say clearly when detail stops being drawn ([#692](https://github.com/scanopy/scanopy/pull/692)). - Apply field filters on the server for paginated entity tabs, so filtering large host and interface lists stays fast ([#693](https://github.com/scanopy/scanopy/pull/693)). - Give hosts a consistent title everywhere, including hosts with no name, deleted hosts and collapsed containers, and badge hosts nothing has ever contacted ([#681](https://github.com/scanopy/scanopy/pull/681)). #### Bug Fixes - Fix a blank topology canvas caused by a render that never finished, and make the view fit correctly on load ([#695](https://github.com/scanopy/scanopy/pull/695)). - Fix a 422 error that could interrupt host discovery ([#666](https://github.com/scanopy/scanopy/pull/666)). - Stop controller devices being filed under the internet instead of their own network ([#660](https://github.com/scanopy/scanopy/pull/660)). - Fix entity tabs scrolling sideways into blank space ([#693](https://github.com/scanopy/scanopy/pull/693)). - Stop a superseded dialog from closing the one that replaced it ([#681](https://github.com/scanopy/scanopy/pull/681)). - Correct Oracle TNS detection so those services are recognised reliably ([#673](https://github.com/scanopy/scanopy/pull/673)). ### [`v0.17.13`](https://github.com/scanopy/scanopy/releases/tag/v0.17.13) [Compare Source](https://github.com/scanopy/scanopy/compare/v0.17.12...v0.17.13) This release focuses on network discovery: Scanopy now finds devices through mDNS/DNS-SD, confirms liveness with more than one signal, and reports the machine it's running on like any other host. #### New Features - Add mDNS/DNS-SD browsing to network discovery, so AirPlay speakers, printers, Chromecasts, and other advertised services show up automatically — announcements also count as proof a host is alive, and matching uses the full service record rather than just the service type. - Detect more hosts by adding ICMP echo as a second liveness signal alongside port probing, including endpoint-only ports that were previously skipped. - Collect interfaces from the host running the Scanopy daemon. - Expose hardware identity (model, serial, and related details) through the API so integrations and dashboards can read it. #### Improvements - Give discovery scan warnings stable codes, making it easier to recognise and filter recurring issues across scans. - Report a diagnostic per credential and label the integration by name, so it's clear which credential failed and where. - Rename credential scope to "target" in the UI to match what you actually enter. #### Bug Fixes - Fix the page scrolling behind the app shell, including phantom scroll height added by hidden tabs. - Fix LLDP scan warnings that lost host names or became unreadable when a host had gone away. - Fix interface details being overwritten instead of merged when multiple discovery methods report on the same host. ### [`v0.17.12`](https://github.com/scanopy/scanopy/releases/tag/v0.17.12) [Compare Source](https://github.com/scanopy/scanopy/compare/v0.17.11...v0.17.12) This release sharpens SNMP discovery and topology accuracy — switches that answer per VLAN context are now reachable, LLDP links stay put, and when a device gives an incomplete answer, Scanopy surfaces more details on why for easier troubleshooting. #### New Features - Add SNMPv3 context name support, so switches that expose per-VLAN or per-context data are discovered correctly instead of returning empty tables ([#682](https://github.com/scanopy/scanopy/pull/682)). - Allow integrations to supply host names, so hosts imported from external sources arrive with meaningful names rather than bare IP addresses. - Ship the server as a single binary with migrations and the web UI built in, making deployments and upgrades a one-file affair. #### Improvements - Report what a device actually claimed during a scan, including a clear explanation when an SNMP table read was cut short, so incomplete discovery is visible instead of silent. - Flag ambiguous neighbor identities as ambiguous rather than picking a link at random, and name which neighbor report went stale. #### Bug Fixes - Fix password reset links returning a 404 instead of opening the reset page. - Restore Layer 2 port precision and stop valid LLDP links from being dropped from the topology. - Fix incorrect labels on topology nodes and links, and ensure link endpoints reflect the current topology rather than stale cached data. - Fix scan records occasionally missing their associated events. ### [`v0.17.11`](https://github.com/scanopy/scanopy/releases/tag/v0.17.11) [Compare Source](https://github.com/scanopy/scanopy/compare/v0.17.10...v0.17.11) This release brings HPE Instant On networks into Scanopy. #### New Features - Add HPE Instant On cloud portal integration, letting you pull sites, devices, and client details from Instant On into your topology by connecting your portal credentials; the setup screen clearly flags that it relies on an unofficial API that HPE could change at any time. ### [`v0.17.10`](https://github.com/scanopy/scanopy/releases/tag/v0.17.10) [Compare Source](https://github.com/scanopy/scanopy/compare/v0.17.9...v0.17.10) This release focuses on more accurate SNMP-based topology discovery, plus the UniFi integration graduating to general availability. #### New Features - Promote the UniFi integration to general availability ([#675](https://github.com/scanopy/scanopy/pull/675)). #### Improvements - Read SNMP bridge tables that devices return out of order, so switches with non-standard SNMP agents now contribute complete link data to your topology ([#675](https://github.com/scanopy/scanopy/pull/675)). #### Bug Fixes - Fix links being drawn to an arbitrary port when several ports on a switch share the same MAC address, which previously produced misleading connections in the topology view ([#675](https://github.com/scanopy/scanopy/pull/675)). - Fix subnets appearing or disappearing incorrectly in the topology by deciding visibility based on how a subnet was discovered rather than how it was categorized ([#675](https://github.com/scanopy/scanopy/pull/675)). ### [`v0.17.9`](https://github.com/scanopy/scanopy/releases/tag/v0.17.9) [Compare Source](https://github.com/scanopy/scanopy/compare/v0.17.8...v0.17.9) This release brings a new table view for browsing your inventory, plus a large round of topology performance work that makes big graphs render faster and use far less memory. #### New Features - Add a table view to every entity tab, with collapsible sections, tag-style values and consistent columns across hosts, networks, subnets, VLANs, daemons and credentials — it's now the default view, with a toggle to switch back to cards. - Apply the topology link-state filter on the server, so filtering large networks by link state is near-instant instead of reloading the whole graph. #### Improvements - Speed up topology rendering substantially by measuring only the cards and containers that actually need it, reusing measurements across data refreshes, and skipping layouts that never get shown. - Cut the memory and DOM weight of every topology node, so large graphs stay responsive while panning and zooming. - Keep viewport culling working after the graph rebuilds, so scrolling around a big topology no longer stalls. - Preserve expanded container sizes across graph rebuilds and collapse changes, so nodes stop jumping around as you explore. - Skip the collapse animation on very large graphs so expanding and collapsing feels immediate. #### Bug Fixes - Fix two causes of runaway topology node counts, along with a relayout loop triggered by emptied subcontainers. - Fix collapsed containers being sized by guesswork, which produced misaligned and degenerate nodes. - Fix container scans saving half-written hosts when discovery failed partway through. - Fix partial scans reporting that nothing was recorded when results had in fact been saved. - Fix LLDP neighbour discovery missing links on devices that report them without a time mark. - Fix ports appearing unlinked when the connection was only reported from one side. ### [`v0.17.8`](https://github.com/scanopy/scanopy/releases/tag/v0.17.8) [Compare Source](https://github.com/scanopy/scanopy/compare/v0.17.7...v0.17.8) This release focuses on telling you *why* credentials used during a scan didn't work as expected — unused or unreachable credentials and missing SNMP data now explain themselves clearly in the UI instead of leaving you guessing or grepping logs. #### New Features - Add an aggregated scan warnings summary that lists every credential Scanopy tried, flags the ones that were unreachable or never used, and says what kind of failure each attempt hit ([#667](https://github.com/scanopy/scanopy/pull/667)). - Report the reason SNMP data is missing for a device — including the specific cause of a bridge-MIB shortfall — instead of silently returning empty results ([#667](https://github.com/scanopy/scanopy/pull/667)). #### Improvements - Improve SNMP collection resilience so a single malformed byte in a response no longer discards the entire device's data ([#667](https://github.com/scanopy/scanopy/pull/667)). - Place UniFi-managed devices by their address space rather than the scan scope, putting them in the right spot on the map ([#667](https://github.com/scanopy/scanopy/pull/667)). - Make hidden-entity filtering work consistently across entity types and redraw the topology immediately when you toggle it ([#667](https://github.com/scanopy/scanopy/pull/667)). #### Bug Fixes - Fix element cards being laid out at zero size, which left parts of the map invisible ([#667](https://github.com/scanopy/scanopy/pull/667)). - Stop a device with no LLDP MIB from wiping out neighbour links discovered through other sources ([#667](https://github.com/scanopy/scanopy/pull/667)). - Fix incorrect container-runtime edges drawn when subnets aren't containers ([#667](https://github.com/scanopy/scanopy/pull/667)). - Fix unreadable text in the application wizard's service list when using light mode ([#667](https://github.com/scanopy/scanopy/pull/667)). - Correct a stale claim about install artifacts on the daemon provisioning endpoint documentation ([#667](https://github.com/scanopy/scanopy/pull/667)). ### [`v0.17.7`](https://github.com/scanopy/scanopy/releases/tag/v0.17.7) [Compare Source](https://github.com/scanopy/scanopy/compare/v0.17.6...v0.17.7) This release focuses on smarter rescans and credential handling, making network discovery more flexible and responsive. We've also introduced integration for UniFi controllers (Beta) and tuned topology performance for faster visualizations. #### New Features - Add single-host rescan, enabling you to refresh discovery for individual devices instead of the whole network ([#201](https://github.com/scanopy/scanopy/pull/201)). - Introduce UniFi controller integration (Beta), allowing you to visualize UniFi-managed devices and leverage their network insights ([#192](https://github.com/scanopy/scanopy/pull/192)). #### Improvements - Improve topology layout and rendering speed by culling off-screen nodes at scale and halving layout work, so large maps load faster and remain responsive ([#196](https://github.com/scanopy/scanopy/pull/196)). - Preload ELK layout engine on tab mount, cutting map visualization startup delays by about one second ([#198](https://github.com/scanopy/scanopy/pull/198)). - Refine container collapsing rules for big networks, ensuring topologies are less cluttered by default if you have many grouped devices ([#195](https://github.com/scanopy/scanopy/pull/195)). #### Bug Fixes - Prevent per-host credential targets from reverting to broadcast settings when reopening discovery dialogs ([#191](https://github.com/scanopy/scanopy/pull/191)). - Restrict daemon-host-only credentials to daemon hosts, so unintended assignments no longer cause discovery errors ([#190](https://github.com/scanopy/scanopy/pull/190)). ### [`v0.17.6`](https://github.com/scanopy/scanopy/releases/tag/v0.17.6) [Compare Source](https://github.com/scanopy/scanopy/compare/v0.17.5...v0.17.6) This release brings a more complete VLAN view and improved LLDP neighbour mapping — making topology exploration smoother and more informative. #### New Features - Add view-only VLANs tab giving an organized overview of all detected VLANs in your environment ([#646](https://github.com/scanopy/scanopy/pull/646)). - Draw LLDP neighbours that resolve directly to hosts, improving visibility for devices that advertise incomplete neighbour info ([#653](https://github.com/scanopy/scanopy/pull/653)). - Add daemon version sunset lifecycle banner with sidebar indicator, prepping for clearer upgrade guidance as version support changes ([#638](https://github.com/scanopy/scanopy/pull/638)). - Introduce new services definitions for Firefly III and Docmost, expanding out-of-box integrations ([#652](https://github.com/scanopy/scanopy/pull/652)). #### Improvements - Resolve LLDP neighbour vendors based on advertised identifiers, so device details are more accurate on topology maps ([#656](https://github.com/scanopy/scanopy/pull/656)). - Improve demo data population by running in the background, reducing wait time and keeping the UI responsive ([#654](https://github.com/scanopy/scanopy/pull/654)). - Accept MAC addresses in LLDP identifiers even if sent in unpadded ASCII format, covering more edge device types ([#664](https://github.com/scanopy/scanopy/pull/664)). - Keep neighbour data discovered in partial topology walks, ensuring you see all available device links even if the scan is incomplete ([#661](https://github.com/scanopy/scanopy/pull/661)). #### Bug Fixes - Fix snapshot PhysicalLink edges and seed subnet-VLAN links, so topology graphs display accurate connections ([#627](https://github.com/scanopy/scanopy/pull/627)). - Stop SNMP sessions from serving stale answers, keeping host information fresh after successive scans ([#629](https://github.com/scanopy/scanopy/pull/629)). - Correct ipAddrTable override in SNMP test environments, improving scan reliability ([#663](https://github.com/scanopy/scanopy/pull/663)). ### [`v0.17.5`](https://github.com/scanopy/scanopy/releases/tag/v0.17.5) [Compare Source](https://github.com/scanopy/scanopy/compare/v0.17.4...v0.17.5) This release improves daemon lifecycle management, simplifies install workflows, and brings clarity to topology staleness tagging. Users will find daemon setup, edit, and key management noticeably smoother. #### New Features - Add a unified daemon management modal, enabling easier installation, configuration, and legacy key handling from one place ([#360](https://github.com/scanopy/scanopy/pull/360)). - Surface stale entities across digest, inventory, and topology views, providing clearer visibility for outdated network components ([#359](https://github.com/scanopy/scanopy/pull/359)). #### Improvements - Attach containers to every subnet they join and connect container bridge subnets to their host, for more accurate container-network visualization ([#347](https://github.com/scanopy/scanopy/pull/347)). - Make multi-daemon installs more reliable on real hosts, ensuring that multiple daemons can be set up and managed concurrently ([#337](https://github.com/scanopy/scanopy/pull/337)). #### Bug Fixes - Fix duplicate host data loss caused by hung SNMP queries during discovery, improving scan reliability ([#344](https://github.com/scanopy/scanopy/pull/344)). - Fix inflated scan ETA estimates when using multiple SNMP credentials, so scan duration predictions are more accurate ([#343](https://github.com/scanopy/scanopy/pull/343)). </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate).

renovate-bot added 1 commit

2026-07-23 01:06:07 +00:00

chore(deps): update ghcr.io/scanopy/scanopy/server docker tag to v0.17.5

ci/crow/push/dns-test Pipeline failed

Details

ci/crow/push/tanka-test Pipeline was successful

Details

ci/crow/pr/dns-test Pipeline was successful

Details

ci/crow/pr/tanka-test Pipeline was successful

Details

ci/crow/pr/tanka-diff Pipeline failed

Details

a234e01341

ci-bot commented

2026-07-23 01:34:55 +00:00

Member

flate diff

data.envoy-gateway.yaml  (v1/ConfigMap/envoy-gateway/envoy-gateway-config)
  ± value change in multiline text (one insert, one deletion)
      apiVersion: gateway.envoyproxy.io/v1alpha1
      kind: EnvoyGateway
      extensionApis: {}
      gateway:

      [15 lines unchanged)]

                      containers:
                      - imagePullPolicy: IfNotPresent
                        name: envoy-ratelimit
          shutdownManager:
    -       image: mirror.gcr.io/envoyproxy/gateway:v1.8.3
    +       image: mirror.gcr.io/envoyproxy/gateway:v1.8.2
        type: Kubernetes


spec.template.spec.containers.envoy-gateway.image  (apps/v1/Deployment/envoy-gateway/envoy-gateway)
  ± value change
    - mirror.gcr.io/envoyproxy/gateway:v1.8.3
    + mirror.gcr.io/envoyproxy/gateway:v1.8.2

spec.template.spec.containers.envoy-gateway-certgen.image  (batch/v1/Job/envoy-gateway/envoy-gateway-gateway-helm-certgen)
  ± value change
    - mirror.gcr.io/envoyproxy/gateway:v1.8.3
    + mirror.gcr.io/envoyproxy/gateway:v1.8.2

Pipeline

## flate diff ``` data.envoy-gateway.yaml (v1/ConfigMap/envoy-gateway/envoy-gateway-config) ± value change in multiline text (one insert, one deletion) apiVersion: gateway.envoyproxy.io/v1alpha1 kind: EnvoyGateway extensionApis: {} gateway: [15 lines unchanged)] containers: - imagePullPolicy: IfNotPresent name: envoy-ratelimit shutdownManager: - image: mirror.gcr.io/envoyproxy/gateway:v1.8.3 + image: mirror.gcr.io/envoyproxy/gateway:v1.8.2 type: Kubernetes spec.template.spec.containers.envoy-gateway.image (apps/v1/Deployment/envoy-gateway/envoy-gateway) ± value change - mirror.gcr.io/envoyproxy/gateway:v1.8.3 + mirror.gcr.io/envoyproxy/gateway:v1.8.2 spec.template.spec.containers.envoy-gateway-certgen.image (batch/v1/Job/envoy-gateway/envoy-gateway-gateway-helm-certgen) ± value change - mirror.gcr.io/envoyproxy/gateway:v1.8.3 + mirror.gcr.io/envoyproxy/gateway:v1.8.2 ``` [Pipeline](https://ci.aether.earth/repos/4/pipeline/267)

renovate-bot changed title from ~~chore(deps): update ghcr.io/scanopy/scanopy/server docker tag to v0.17.5~~ to chore(deps): update ghcr.io/scanopy/scanopy/server docker tag to v0.17.6

2026-07-28 19:07:23 +00:00

renovate-bot changed title from ~~chore(deps): update ghcr.io/scanopy/scanopy/server docker tag to v0.17.6~~ to chore(deps): update ghcr.io/scanopy/scanopy/server docker tag to v0.17.7

2026-07-29 05:09:33 +00:00

renovate-bot changed title from ~~chore(deps): update ghcr.io/scanopy/scanopy/server docker tag to v0.17.7~~ to chore(deps): update ghcr.io/scanopy/scanopy/server docker tag to v0.17.8

2026-08-04 23:09:29 +00:00

renovate-bot force-pushed renovate/ghcr.io-scanopy-scanopy-server-0.x from 4afd798832 to 6e8561a5ae

2026-09-21 19:10:19 +00:00

Compare

renovate-bot changed title from ~~chore(deps): update ghcr.io/scanopy/scanopy/server docker tag to v0.17.8~~ to chore(deps): update ghcr.io/scanopy/scanopy/server docker tag to v0.17.16

2026-09-21 19:10:23 +00:00

renovate-bot changed title from ~~chore(deps): update ghcr.io/scanopy/scanopy/server docker tag to v0.17.16~~ to chore(deps): update ghcr.io/scanopy/scanopy/server docker tag to v0.17.17

2026-09-29 00:05:33 +00:00

renovate-bot force-pushed renovate/ghcr.io-scanopy-scanopy-server-0.x from 7f3ac5afb9 to 808a13fd07

ci/crow/pr/dns-test Pipeline was successful

Details

ci/crow/push/dns-test Pipeline was successful

Details

ci/crow/pr/tanka-test Pipeline was successful

Details

ci/crow/push/tanka-test Pipeline was successful

Details

ci/crow/pr/tanka-diff Pipeline was successful

Details

2026-10-01 05:05:38 +00:00

Compare

renovate-bot changed title from ~~chore(deps): update ghcr.io/scanopy/scanopy/server docker tag to v0.17.17~~ to chore(deps): update ghcr.io/scanopy/scanopy/server docker tag to v0.17.18

2026-10-01 05:05:41 +00:00

ci-bot commented

2026-10-01 05:08:13 +00:00

Member

flate diff

(root level)
+ one document added:
  apiVersion: v1
  kind: ServiceAccount
  metadata:
    name: bluesky-pds
    namespace: apps-bluesky-pds
    labels:
      app.kubernetes.io/instance: bluesky-pds
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: bluesky-pds
      helm.toolkit.fluxcd.io/name: bluesky-pds
      helm.toolkit.fluxcd.io/namespace: flux-system

(root level)
+ one document added:
  apiVersion: v1
  kind: PersistentVolumeClaim
  metadata:
    name: bluesky-pds-data
    namespace: apps-bluesky-pds
    labels:
      app.kubernetes.io/instance: bluesky-pds
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: bluesky-pds
      helm.toolkit.fluxcd.io/name: bluesky-pds
      helm.toolkit.fluxcd.io/namespace: flux-system
  spec:
    resources:
      requests:
        storage: 10Gi
    storageClassName: longhorn
    accessModes:
    - ReadWriteOnce

(root level)
+ one document added:
  apiVersion: v1
  kind: Service
  metadata:
    name: bluesky-pds
    namespace: apps-bluesky-pds
    labels:
      app.kubernetes.io/instance: bluesky-pds
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: bluesky-pds
      helm.toolkit.fluxcd.io/name: bluesky-pds
      helm.toolkit.fluxcd.io/namespace: flux-system
  spec:
    type: ClusterIP
    selector:
      app.kubernetes.io/instance: bluesky-pds
      app.kubernetes.io/name: bluesky-pds
    ports:
    - name: pds-port
      port: 3000
      protocol: TCP
      targetPort: pds-port

(root level)
+ one document added:
  apiVersion: apps/v1
  kind: Deployment
  metadata:
    name: bluesky-pds
    namespace: apps-bluesky-pds
    labels:
      app.kubernetes.io/instance: bluesky-pds
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: bluesky-pds
      helm.toolkit.fluxcd.io/name: bluesky-pds
      helm.toolkit.fluxcd.io/namespace: flux-system
  spec:
    replicas: 1
    selector:
      matchLabels:
        app.kubernetes.io/instance: bluesky-pds
        app.kubernetes.io/name: bluesky-pds
    strategy:
      type: Recreate
    template:
      metadata:
        labels:
          app.kubernetes.io/instance: bluesky-pds
          app.kubernetes.io/name: bluesky-pds
      spec:
        containers:
        - name: bluesky-pds
          image: "ghcr.io/bluesky-social/pds:0.4.158"
          imagePullPolicy: IfNotPresent
          resources: {}
          securityContext: {}
          livenessProbe:
            httpGet:
              path: /xrpc/_health
              port: pds-port
          ports:
          - name: pds-port
            containerPort: 3000
            protocol: TCP
          volumeMounts:
          - name: data
            mountPath: /pds
          env:
          - name: PDS_HOSTNAME
            value: pds.var.aether.earth
          - name: PDS_JWT_SECRET
            valueFrom:
              secretKeyRef:
                name: pds-sensitive
                key: jwtSecret
          - name: PDS_ADMIN_PASSWORD
            valueFrom:
              secretKeyRef:
                name: pds-sensitive
                key: adminPassword
          - name: PDS_PLC_ROTATION_KEY_K256_PRIVATE_KEY_HEX
            valueFrom:
              secretKeyRef:
                name: pds-sensitive
                key: plcRotationKey
          - name: PDS_EMAIL_SMTP_URL
            valueFrom:
              secretKeyRef:
                name: pds-sensitive
                key: emailSmtpUrl
          - name: PDS_DATA_DIRECTORY
            value: /pds
          - name: PDS_BLOBSTORE_DISK_LOCATION
            value: /pds/blocks
          - name: PDS_DID_PLC_URL
            value: "https://plc.directory"
          - name: PDS_BSKY_APP_VIEW_URL
            value: "https://api.bsky.app"
          - name: PDS_BSKY_APP_VIEW_DID
            value: "did:web:api.bsky.app"
          - name: PDS_REPORT_SERVICE_URL
            value: "https://mod.bsky.app"
          - name: PDS_REPORT_SERVICE_DID
            value: "did:plc:ar7c4by46qjdydhdevvrndac"
          - name: PDS_CRAWLERS
            value: "https://bsky.network"
          - name: LOG_ENABLED
            value:
          - name: PDS_EMAIL_FROM_ADDRESS
            value: atproto@aether.earth
        securityContext: {}
        serviceAccountName: bluesky-pds
        volumes:
        - name: data
          persistentVolumeClaim:
            claimName: bluesky-pds-data

(root level)
+ one document added:
  apiVersion: v1
  kind: ServiceAccount
  metadata:
    name: crowci-agent
    namespace: apps-crowci
    labels:
      app.kubernetes.io/instance: crowci
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: crow-server
      helm.toolkit.fluxcd.io/name: crowci
      helm.toolkit.fluxcd.io/namespace: flux-system

(root level)
+ one document added:
  apiVersion: v1
  kind: ServiceAccount
  metadata:
    name: crowci-server
    namespace: apps-crowci
    labels:
      app.kubernetes.io/instance: crowci
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: crow-server
      helm.toolkit.fluxcd.io/name: crowci
      helm.toolkit.fluxcd.io/namespace: flux-system

(root level)
+ one document added:
  apiVersion: v1
  kind: ConfigMap
  metadata:
    name: crowci-grafana-dashboards-crow-dashboard.json
    namespace: apps-crowci
    labels:
      app.kubernetes.io/instance: crowci
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: crow-server
      helm.toolkit.fluxcd.io/name: crowci
      helm.toolkit.fluxcd.io/namespace: flux-system
  data:
    crow-dashboard.json: |
      {
        "__inputs": [
          {
            "name": "DS_PROMETHEUS",
            "label": "Prometheus",
            "description": "",
            "type": "datasource",
            "pluginId": "prometheus",
            "pluginName": "Prometheus"
          }
        ],
        "__elements": {},
        "__requires": [
          {
            "type": "grafana",
            "id": "grafana",
            "name": "Grafana",
            "version": "10.0.0"
          },
          {
            "type": "datasource",
            "id": "prometheus",
            "name": "Prometheus",
            "version": "1.0.0"
          },
          {
            "type": "panel",
            "id": "timeseries",
            "name": "Time series",
            "version": ""
          },
          {
            "type": "panel",
            "id": "stat",
            "name": "Stat",
            "version": ""
          },
          {
            "type": "panel",
            "id": "heatmap",
            "name": "Heatmap",
            "version": ""
          }
        ],
        "annotations": {
          "list": [
            {
              "builtIn": 1,
              "datasource": {
                "type": "grafana",
                "uid": "-- Grafana --"
              },
              "enable": true,
              "hide": true,
              "iconColor": "rgba(0, 211, 255, 1)",
              "name": "Annotations & Alerts",
              "type": "dashboard"
            }
          ]
        },
        "editable": true,
        "fiscalYearStartMonth": 0,
        "graphTooltip": 1,
        "id": null,
        "links": [],
        "panels": [
          {
            "collapsed": false,
            "gridPos": { "h": 1, "w": 24, "x": 0, "y": 0 },
            "id": 100,
            "title": "Overview",
            "type": "row"
          },
          {
            "datasource": { "type": "prometheus", "uid": "${DS_PROMETHEUS}" },
            "fieldConfig": {
              "defaults": {
                "thresholds": {
                  "mode": "absolute",
                  "steps": [{ "color": "green", "value": null }]
                },
                "color": { "mode": "thresholds" }
              },
              "overrides": []
            },
            "gridPos": { "h": 4, "w": 4, "x": 0, "y": 1 },
            "id": 1,
            "options": {
              "reduceOptions": { "calcs": ["lastNotNull"], "fields": "", "values": false },
              "orientation": "auto",
              "textMode": "auto",
              "colorMode": "value",
              "graphMode": "none"
            },
            "title": "Total Pipelines",
            "type": "stat",
            "targets": [
              {
                "expr": "sum(crow_pipeline_total_count)",
                "legendFormat": "",
                "refId": "A"
              }
            ]
          },
          {
            "datasource": { "type": "prometheus", "uid": "${DS_PROMETHEUS}" },
            "fieldConfig": {
              "defaults": {
                "thresholds": {
                  "mode": "absolute",
                  "steps": [{ "color": "green", "value": null }]
                },
                "color": { "mode": "thresholds" }
              },
              "overrides": []
            },
            "gridPos": { "h": 4, "w": 4, "x": 4, "y": 1 },
            "id": 2,
            "options": {
              "reduceOptions": { "calcs": ["lastNotNull"], "fields": "", "values": false },
              "orientation": "auto",
              "textMode": "auto",
              "colorMode": "value",
              "graphMode": "none"
            },
            "title": "Total Repos",
            "type": "stat",
            "targets": [
              {
                "expr": "sum(crow_repo_count)",
                "legendFormat": "",
                "refId": "A"
              }
            ]
          },
          {
            "datasource": { "type": "prometheus", "uid": "${DS_PROMETHEUS}" },
            "fieldConfig": {
              "defaults": {
                "thresholds": {
                  "mode": "absolute",
                  "steps": [{ "color": "green", "value": null }]
                },
                "color": { "mode": "thresholds" }
              },
              "overrides": []
            },
            "gridPos": { "h": 4, "w": 4, "x": 8, "y": 1 },
            "id": 3,
            "options": {
              "reduceOptions": { "calcs": ["lastNotNull"], "fields": "", "values": false },
              "orientation": "auto",
              "textMode": "auto",
              "colorMode": "value",
              "graphMode": "none"
            },
            "title": "Total Users",
            "type": "stat",
            "targets": [
              {
                "expr": "sum(crow_user_count)",
                "legendFormat": "",
                "refId": "A"
              }
            ]
          },
          {
            "datasource": { "type": "prometheus", "uid": "${DS_PROMETHEUS}" },
            "fieldConfig": {
              "defaults": {
                "thresholds": {
                  "mode": "absolute",
                  "steps": [
                    { "color": "red", "value": null },
                    { "color": "green", "value": 1 }
                  ]
                },
                "color": { "mode": "thresholds" }
              },
              "overrides": []
            },
            "gridPos": { "h": 4, "w": 4, "x": 12, "y": 1 },
            "id": 4,
            "options": {
              "reduceOptions": { "calcs": ["lastNotNull"], "fields": "", "values": false },
              "orientation": "auto",
              "textMode": "auto",
              "colorMode": "value",
              "graphMode": "area"
            },
            "title": "Connected Agents",
            "type": "stat",
            "targets": [
              {
                "expr": "sum(crow_connected_agents)",
                "legendFormat": "",
                "refId": "A"
              }
            ]
          },
          {
            "datasource": { "type": "prometheus", "uid": "${DS_PROMETHEUS}" },
            "fieldConfig": {
              "defaults": {
                "thresholds": {
                  "mode": "absolute",
                  "steps": [{ "color": "green", "value": null }]
                },
                "color": { "mode": "thresholds" }
              },
              "overrides": []
            },
            "gridPos": { "h": 4, "w": 4, "x": 16, "y": 1 },
            "id": 5,
            "options": {
              "reduceOptions": { "calcs": ["lastNotNull"], "fields": "", "values": false },
              "orientation": "auto",
              "textMode": "auto",
              "colorMode": "value",
              "graphMode": "area"
            },
            "title": "Workers",
            "type": "stat",
            "targets": [
              {
                "expr": "sum(crow_worker_count)",
                "legendFormat": "",
                "refId": "A"
              }
            ]
          },
          {
            "datasource": { "type": "prometheus", "uid": "${DS_PROMETHEUS}" },
            "fieldConfig": {
              "defaults": {
                "thresholds": {
                  "mode": "absolute",
                  "steps": [
                    { "color": "green", "value": null },
                    { "color": "yellow", "value": 5 },
                    { "color": "red", "value": 20 }
                  ]
                },
                "color": { "mode": "thresholds" }
              },
              "overrides": []
            },
            "gridPos": { "h": 4, "w": 4, "x": 20, "y": 1 },
            "id": 6,
            "options": {
              "reduceOptions": { "calcs": ["lastNotNull"], "fields": "", "values": false },
              "orientation": "auto",
              "textMode": "auto",
              "colorMode": "value",
              "graphMode": "area"
            },
            "title": "Pending Steps",
            "type": "stat",
            "targets": [
              {
                "expr": "sum(crow_pending_steps)",
                "legendFormat": "",
                "refId": "A"
              }
            ]
          },
          {
            "collapsed": false,
            "gridPos": { "h": 1, "w": 24, "x": 0, "y": 5 },
            "id": 101,
            "title": "Pipeline Activity",
            "type": "row"
          },
          {
            "datasource": { "type": "prometheus", "uid": "${DS_PROMETHEUS}" },
            "fieldConfig": {
              "defaults": {
                "custom": {
                  "drawStyle": "line",
                  "lineInterpolation": "smooth",
                  "fillOpacity": 20,
                  "pointSize": 5,
                  "showPoints": "auto",
                  "stacking": { "mode": "none" },
                  "axisLabel": "pipelines/min"
                },
                "color": { "mode": "palette-classic" },
                "unit": "opm"
              },
              "overrides": [
                {
                  "matcher": { "id": "byName", "options": "success" },
                  "properties": [{ "id": "color", "value": { "fixedColor": "green", "mode": "fixed" } }]
                },
                {
                  "matcher": { "id": "byName", "options": "failure" },
                  "properties": [{ "id": "color", "value": { "fixedColor": "red", "mode": "fixed" } }]
                }
              ]
            },
            "gridPos": { "h": 8, "w": 12, "x": 0, "y": 6 },
            "id": 10,
            "options": {
              "tooltip": { "mode": "multi", "sort": "desc" },
              "legend": { "displayMode": "list", "placement": "bottom" }
            },
            "title": "Pipeline Rate",
            "type": "timeseries",
            "targets": [
              {
                "expr": "sum(rate(crow_pipeline_count{repo=~\"$repo\", branch=~\"$branch\", pipeline=\"total\", status=\"success\"}[$__rate_interval]))",
                "legendFormat": "success",
                "refId": "A"
              },
              {
                "expr": "sum(rate(crow_pipeline_count{repo=~\"$repo\", branch=~\"$branch\", pipeline=\"total\", status=\"failure\"}[$__rate_interval]))",
                "legendFormat": "failure",
                "refId": "B"
              }
            ]
          },
          {
            "datasource": { "type": "prometheus", "uid": "${DS_PROMETHEUS}" },
            "fieldConfig": {
              "defaults": {
                "custom": {
                  "drawStyle": "line",
                  "lineInterpolation": "smooth",
                  "fillOpacity": 10,
                  "pointSize": 5,
                  "showPoints": "auto",
                  "stacking": { "mode": "none" }
                },
                "color": { "mode": "palette-classic" },
                "unit": "s"
              },
              "overrides": []
            },
            "gridPos": { "h": 8, "w": 12, "x": 12, "y": 6 },
            "id": 11,
            "options": {
              "tooltip": { "mode": "multi", "sort": "desc" },
              "legend": { "displayMode": "list", "placement": "bottom" }
            },
            "title": "Pipeline Duration Percentiles",
            "type": "timeseries",
            "targets": [
              {
                "expr": "histogram_quantile(0.50, sum(rate(crow_pipeline_duration_seconds_bucket{repo=~\"$repo\", branch=~\"$branch\"}[$__rate_interval])) by (le))",
                "legendFormat": "p50",
                "refId": "A"
              },
              {
                "expr": "histogram_quantile(0.90, sum(rate(crow_pipeline_duration_seconds_bucket{repo=~\"$repo\", branch=~\"$branch\"}[$__rate_interval])) by (le))",
                "legendFormat": "p90",
                "refId": "B"
              },
              {
                "expr": "histogram_quantile(0.99, sum(rate(crow_pipeline_duration_seconds_bucket{repo=~\"$repo\", branch=~\"$branch\"}[$__rate_interval])) by (le))",
                "legendFormat": "p99",
                "refId": "C"
              }
            ]
          },
          {
            "datasource": { "type": "prometheus", "uid": "${DS_PROMETHEUS}" },
            "fieldConfig": {
              "defaults": {
                "color": { "mode": "palette-classic" },
                "custom": {
                  "drawStyle": "bars",
                  "fillOpacity": 80,
                  "stacking": { "mode": "normal" }
                },
                "unit": "short"
              },
              "overrides": [
                {
                  "matcher": { "id": "byRegexp", "options": ".*success" },
                  "properties": [{ "id": "color", "value": { "fixedColor": "green", "mode": "fixed" } }]
                },
                {
                  "matcher": { "id": "byRegexp", "options": ".*failure" },
                  "properties": [{ "id": "color", "value": { "fixedColor": "red", "mode": "fixed" } }]
                }
              ]
            },
            "gridPos": { "h": 8, "w": 12, "x": 0, "y": 14 },
            "id": 12,
            "options": {
              "tooltip": { "mode": "multi", "sort": "desc" },
              "legend": { "displayMode": "list", "placement": "bottom" }
            },
            "title": "Pipelines by Repo",
            "type": "timeseries",
            "targets": [
              {
                "expr": "sum by (repo) (increase(crow_pipeline_count{repo=~\"$repo\", branch=~\"$branch\", pipeline=\"total\", status=\"success\"}[$__rate_interval]))",
                "legendFormat": "{{repo}} success",
                "refId": "A"
              },
              {
                "expr": "sum by (repo) (increase(crow_pipeline_count{repo=~\"$repo\", branch=~\"$branch\", pipeline=\"total\", status=\"failure\"}[$__rate_interval]))",
                "legendFormat": "{{repo}} failure",
                "refId": "B"
              }
            ]
          },
          {
            "datasource": { "type": "prometheus", "uid": "${DS_PROMETHEUS}" },
            "fieldConfig": {
              "defaults": {
                "color": { "mode": "scheme", "schemeName": "YlOrRd" },
                "custom": {
                  "hideFrom": { "legend": false, "tooltip": false, "viz": false }
                }
              },
              "overrides": []
            },
            "gridPos": { "h": 8, "w": 12, "x": 12, "y": 14 },
            "id": 13,
            "options": {
              "calculate": false,
              "yAxis": { "unit": "s" },
              "color": { "mode": "scheme", "scheme": "YlOrRd" },
              "cellGap": 1
            },
            "title": "Pipeline Duration Heatmap",
            "type": "heatmap",
            "targets": [
              {
                "expr": "sum(rate(crow_pipeline_duration_seconds_bucket{repo=~\"$repo\", branch=~\"$branch\"}[$__rate_interval])) by (le)",
                "legendFormat": "{{le}}",
                "refId": "A"
              }
            ]
          },
          {
            "collapsed": false,
            "gridPos": { "h": 1, "w": 24, "x": 0, "y": 22 },
            "id": 102,
            "title": "Queue & Agents",
            "type": "row"
          },
          {
            "datasource": { "type": "prometheus", "uid": "${DS_PROMETHEUS}" },
            "fieldConfig": {
              "defaults": {
                "custom": {
                  "drawStyle": "line",
                  "lineInterpolation": "smooth",
                  "fillOpacity": 20,
                  "pointSize": 5,
                  "showPoints": "auto",
                  "stacking": { "mode": "none" }
                },
                "color": { "mode": "palette-classic" },
                "unit": "short"
              },
              "overrides": [
                {
                  "matcher": { "id": "byName", "options": "pending" },
                  "properties": [{ "id": "color", "value": { "fixedColor": "yellow", "mode": "fixed" } }]
                },
                {
                  "matcher": { "id": "byName", "options": "running" },
                  "properties": [{ "id": "color", "value": { "fixedColor": "green", "mode": "fixed" } }]
                },
                {
                  "matcher": { "id": "byName", "options": "waiting on deps" },
                  "properties": [{ "id": "color", "value": { "fixedColor": "orange", "mode": "fixed" } }]
                }
              ]
            },
            "gridPos": { "h": 8, "w": 12, "x": 0, "y": 23 },
            "id": 20,
            "options": {
              "tooltip": { "mode": "multi", "sort": "desc" },
              "legend": { "displayMode": "list", "placement": "bottom" }
            },
            "title": "Queue Depth",
            "type": "timeseries",
            "targets": [
              {
                "expr": "sum(crow_pending_steps)",
                "legendFormat": "pending",
                "refId": "A"
              },
              {
                "expr": "sum(crow_running_steps)",
                "legendFormat": "running",
                "refId": "B"
              },
              {
                "expr": "sum(crow_waiting_steps)",
                "legendFormat": "waiting on deps",
                "refId": "C"
              }
            ]
          },
          {
            "datasource": { "type": "prometheus", "uid": "${DS_PROMETHEUS}" },
            "fieldConfig": {
              "defaults": {
                "custom": {
                  "drawStyle": "line",
                  "lineInterpolation": "smooth",
                  "fillOpacity": 20,
                  "pointSize": 5,
                  "showPoints": "auto",
                  "stacking": { "mode": "none" }
                },
                "color": { "mode": "palette-classic" },
                "unit": "s"
              },
              "overrides": []
            },
            "gridPos": { "h": 8, "w": 12, "x": 12, "y": 23 },
            "id": 21,
            "options": {
              "tooltip": { "mode": "multi", "sort": "desc" },
              "legend": { "displayMode": "list", "placement": "bottom" }
            },
            "title": "Queue Wait Time Percentiles",
            "type": "timeseries",
            "targets": [
              {
                "expr": "histogram_quantile(0.50, sum(rate(crow_queue_wait_seconds_bucket[$__rate_interval])) by (le))",
                "legendFormat": "p50",
                "refId": "A"
              },
              {
                "expr": "histogram_quantile(0.90, sum(rate(crow_queue_wait_seconds_bucket[$__rate_interval])) by (le))",
                "legendFormat": "p90",
                "refId": "B"
              },
              {
                "expr": "histogram_quantile(0.99, sum(rate(crow_queue_wait_seconds_bucket[$__rate_interval])) by (le))",
                "legendFormat": "p99",
                "refId": "C"
              }
            ]
          },
          {
            "datasource": { "type": "prometheus", "uid": "${DS_PROMETHEUS}" },
            "fieldConfig": {
              "defaults": {
                "custom": {
                  "drawStyle": "line",
                  "lineInterpolation": "smooth",
                  "fillOpacity": 20,
                  "pointSize": 5,
                  "showPoints": "auto",
                  "stacking": { "mode": "none" }
                },
                "color": { "mode": "palette-classic" },
                "unit": "short"
              },
              "overrides": []
            },
            "gridPos": { "h": 8, "w": 12, "x": 0, "y": 31 },
            "id": 30,
            "options": {
              "tooltip": { "mode": "multi", "sort": "desc" },
              "legend": { "displayMode": "list", "placement": "bottom" }
            },
            "title": "Connected Agents & Workers",
            "type": "timeseries",
            "targets": [
              {
                "expr": "sum(crow_connected_agents)",
                "legendFormat": "agents",
                "refId": "A"
              },
              {
                "expr": "sum(crow_worker_count)",
                "legendFormat": "workers",
                "refId": "B"
              }
            ]
          },
          {
            "datasource": { "type": "prometheus", "uid": "${DS_PROMETHEUS}" },
            "fieldConfig": {
              "defaults": {
                "custom": {
                  "drawStyle": "line",
                  "lineInterpolation": "smooth",
                  "fillOpacity": 20,
                  "pointSize": 5,
                  "showPoints": "auto",
                  "stacking": { "mode": "none" }
                },
                "color": { "mode": "palette-classic" },
                "unit": "short"
              },
              "overrides": [
                {
                  "matcher": { "id": "byName", "options": "registrations" },
                  "properties": [{ "id": "color", "value": { "fixedColor": "green", "mode": "fixed" } }]
                },
                {
                  "matcher": { "id": "byName", "options": "unregistrations" },
                  "properties": [{ "id": "color", "value": { "fixedColor": "red", "mode": "fixed" } }]
                }
              ]
            },
            "gridPos": { "h": 8, "w": 12, "x": 12, "y": 31 },
            "id": 31,
            "options": {
              "tooltip": { "mode": "multi", "sort": "desc" },
              "legend": { "displayMode": "list", "placement": "bottom" }
            },
            "title": "Agent Registration Rate",
            "type": "timeseries",
            "targets": [
              {
                "expr": "sum(rate(crow_agent_registrations_total[$__rate_interval]))",
                "legendFormat": "registrations",
                "refId": "A"
              },
              {
                "expr": "sum(rate(crow_agent_unregistrations_total[$__rate_interval]))",
                "legendFormat": "unregistrations",
                "refId": "B"
              }
            ]
          },
          {
            "collapsed": false,
            "gridPos": { "h": 1, "w": 24, "x": 0, "y": 39 },
            "id": 104,
            "title": "Server Resources",
            "type": "row"
          },
          {
            "datasource": { "type": "prometheus", "uid": "${DS_PROMETHEUS}" },
            "fieldConfig": {
              "defaults": {
                "custom": {
                  "drawStyle": "line",
                  "lineInterpolation": "smooth",
                  "fillOpacity": 20,
                  "pointSize": 5,
                  "showPoints": "auto",
                  "stacking": { "mode": "none" }
                },
                "color": { "mode": "palette-classic" },
                "unit": "bytes"
              },
              "overrides": []
            },
            "gridPos": { "h": 8, "w": 8, "x": 0, "y": 40 },
            "id": 40,
            "options": {
              "tooltip": { "mode": "multi", "sort": "desc" },
              "legend": { "displayMode": "list", "placement": "bottom" }
            },
            "title": "Memory Usage",
            "type": "timeseries",
            "targets": [
              {
                "expr": "sum(go_memstats_alloc_bytes{job=~\"$job\"})",
                "legendFormat": "alloc",
                "refId": "A"
              },
              {
                "expr": "sum(go_memstats_sys_bytes{job=~\"$job\"})",
                "legendFormat": "sys",
                "refId": "B"
              },
              {
                "expr": "sum(process_resident_memory_bytes{job=~\"$job\"})",
                "legendFormat": "resident",
                "refId": "C"
              }
            ]
          },
          {
            "datasource": { "type": "prometheus", "uid": "${DS_PROMETHEUS}" },
            "fieldConfig": {
              "defaults": {
                "custom": {
                  "drawStyle": "line",
                  "lineInterpolation": "smooth",
                  "fillOpacity": 20,
                  "pointSize": 5,
                  "showPoints": "auto",
                  "stacking": { "mode": "none" }
                },
                "color": { "mode": "palette-classic" },
                "unit": "short"
              },
              "overrides": []
            },
            "gridPos": { "h": 8, "w": 8, "x": 8, "y": 40 },
            "id": 41,
            "options": {
              "tooltip": { "mode": "multi", "sort": "desc" },
              "legend": { "displayMode": "list", "placement": "bottom" }
            },
            "title": "Goroutines",
            "type": "timeseries",
            "targets": [
              {
                "expr": "sum(go_goroutines{job=~\"$job\"})",
                "legendFormat": "goroutines",
                "refId": "A"
              }
            ]
          },
          {
            "datasource": { "type": "prometheus", "uid": "${DS_PROMETHEUS}" },
            "fieldConfig": {
              "defaults": {
                "custom": {
                  "drawStyle": "line",
                  "lineInterpolation": "smooth",
                  "fillOpacity": 20,
                  "pointSize": 5,
                  "showPoints": "auto",
                  "stacking": { "mode": "none" }
                },
                "color": { "mode": "palette-classic" },
                "unit": "percentunit"
              },
              "overrides": []
            },
            "gridPos": { "h": 8, "w": 8, "x": 16, "y": 40 },
            "id": 42,
            "options": {
              "tooltip": { "mode": "multi", "sort": "desc" },
              "legend": { "displayMode": "list", "placement": "bottom" }
            },
            "title": "CPU Usage",
            "type": "timeseries",
            "targets": [
              {
                "expr": "sum(rate(process_cpu_seconds_total{job=~\"$job\"}[$__rate_interval]))",
                "legendFormat": "cpu",
                "refId": "A"
              }
            ]
          }
        ],
        "schemaVersion": 39,
        "tags": ["crow", "ci", "cd"],
        "templating": {
          "list": [
            {
              "current": {
                "selected": false,
                "text": "Prometheus",
                "value": "Prometheus"
              },
              "hide": 0,
              "includeAll": false,
              "name": "DS_PROMETHEUS",
              "options": [],
              "query": "prometheus",
              "refresh": 1,
              "regex": "",
              "type": "datasource"
            },
            {
              "allValue": ".*",
              "current": {
                "selected": true,
                "text": "All",
                "value": "$__all"
              },
              "datasource": { "type": "prometheus", "uid": "${DS_PROMETHEUS}" },
              "definition": "label_values(crow_pipeline_count, repo)",
              "hide": 0,
              "includeAll": true,
              "multi": true,
              "name": "repo",
              "options": [],
              "query": "label_values(crow_pipeline_count, repo)",
              "refresh": 2,
              "sort": 1,
              "type": "query"
            },
            {
              "allValue": ".*",
              "current": {
                "selected": true,
                "text": "All",
                "value": "$__all"
              },
              "datasource": { "type": "prometheus", "uid": "${DS_PROMETHEUS}" },
              "definition": "label_values(crow_pipeline_count{repo=~\"$repo\"}, branch)",
              "hide": 0,
              "includeAll": true,
              "multi": true,
              "name": "branch",
              "options": [],
              "query": "label_values(crow_pipeline_count{repo=~\"$repo\"}, branch)",
              "refresh": 2,
              "sort": 1,
              "type": "query"
            },
            {
              "allValue": ".*",
              "current": {
                "selected": true,
                "text": "All",
                "value": "$__all"
              },
              "datasource": { "type": "prometheus", "uid": "${DS_PROMETHEUS}" },
              "definition": "label_values(crow_pipeline_total_count, job)",
              "hide": 0,
              "includeAll": true,
              "multi": false,
              "name": "job",
              "options": [],
              "query": "label_values(crow_pipeline_total_count, job)",
              "refresh": 2,
              "sort": 1,
              "type": "query"
            }
          ]
        },
        "time": {
          "from": "now-6h",
          "to": "now"
        },
        "timepicker": {},
        "timezone": "",
        "title": "Crow CI",
        "uid": "crow-ci-overview",
        "version": 1
      }
      
  


(root level)
+ one document added:
  apiVersion: rbac.authorization.k8s.io/v1
  kind: Role
  metadata:
    name: crowci-agent
    namespace: apps-crowci
    labels:
      app.kubernetes.io/instance: crowci
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: crow-server
      helm.toolkit.fluxcd.io/name: crowci
      helm.toolkit.fluxcd.io/namespace: flux-system
  rules:
  - resources:
    - persistentvolumeclaims
    - services
    - secrets
    apiGroups:
    -
    verbs:
    - create
    - delete
  - resources:
    - pods
    apiGroups:
    -
    verbs:
    - watch
    - create
    - delete
    - get
    - list
  - resources:
    - pods/log
    apiGroups:
    -
    verbs:
    - get

(root level)
+ one document added:
  apiVersion: rbac.authorization.k8s.io/v1
  kind: Role
  metadata:
    name: crowci-server
    namespace: apps-crowci
    labels:
      app.kubernetes.io/instance: crowci
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: crow-server
      helm.toolkit.fluxcd.io/name: crowci
      helm.toolkit.fluxcd.io/namespace: flux-system
  rules:
  - resources:
    - services
    - persistentvolumeclaims
    - secrets
    apiGroups:
    -
    verbs:
    - list
    - delete

(root level)
+ one document added:
  apiVersion: rbac.authorization.k8s.io/v1
  kind: RoleBinding
  metadata:
    name: crowci-agent
    namespace: apps-crowci
    labels:
      app.kubernetes.io/instance: crowci
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: crow-server
      helm.toolkit.fluxcd.io/name: crowci
      helm.toolkit.fluxcd.io/namespace: flux-system
  roleRef:
    name: crowci-agent
    apiGroup: rbac.authorization.k8s.io
    kind: Role
  subjects:
  - name: crowci-agent
    kind: ServiceAccount
    namespace: apps-crowci

(root level)
+ one document added:
  apiVersion: rbac.authorization.k8s.io/v1
  kind: RoleBinding
  metadata:
    name: crowci-server
    namespace: apps-crowci
    labels:
      app.kubernetes.io/instance: crowci
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: crow-server
      helm.toolkit.fluxcd.io/name: crowci
      helm.toolkit.fluxcd.io/namespace: flux-system
  roleRef:
    name: crowci-server
    apiGroup: rbac.authorization.k8s.io
    kind: Role
  subjects:
  - name: crowci-server
    kind: ServiceAccount
    namespace: apps-crowci

(root level)
+ one document added:
  apiVersion: v1
  kind: Service
  metadata:
    name: crowci-headless
    namespace: apps-crowci
    labels:
      app.kubernetes.io/instance: crowci
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: crow-server
      helm.toolkit.fluxcd.io/name: crowci
      helm.toolkit.fluxcd.io/namespace: flux-system
  spec:
    clusterIP: None
    ports:
    - name: http
      port: 80
      protocol: TCP
      targetPort: http
    - name: grpc
      port: 9000
      protocol: TCP
      targetPort: grpc
    - name: metrics
      port: 9001
      protocol: TCP
      targetPort: metrics
    selector:
      app.kubernetes.io/instance: crowci
      app.kubernetes.io/name: crow-server

(root level)
+ one document added:
  apiVersion: v1
  kind: Service
  metadata:
    name: crowci-agent
    namespace: apps-crowci
    labels:
      app.kubernetes.io/instance: crowci
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: crow-agent
      helm.toolkit.fluxcd.io/name: crowci
      helm.toolkit.fluxcd.io/namespace: flux-system
  spec:
    clusterIP: None
    ports:
    - name: http
      port: 3000
      protocol: TCP
      targetPort: http
    selector:
      app.kubernetes.io/instance: crowci
      app.kubernetes.io/name: crow-agent

(root level)
+ one document added:
  apiVersion: v1
  kind: Service
  metadata:
    name: crowci
    namespace: apps-crowci
    labels:
      app.kubernetes.io/instance: crowci
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: crow-server
      helm.toolkit.fluxcd.io/name: crowci
      helm.toolkit.fluxcd.io/namespace: flux-system
  spec:
    type: ClusterIP
    selector:
      app.kubernetes.io/instance: crowci
      app.kubernetes.io/name: crow-server
    ports:
    - name: http
      port: 80
      protocol: TCP
      targetPort: http
    - name: grpc
      port: 9000
      protocol: TCP
      targetPort: grpc
    - name: metrics
      port: 9001
      protocol: TCP
      targetPort: metrics

(root level)
+ one document added:
  apiVersion: apps/v1
  kind: StatefulSet
  metadata:
    name: crowci-agent
    namespace: apps-crowci
    labels:
      app.kubernetes.io/instance: crowci
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: crow-agent
      helm.toolkit.fluxcd.io/name: crowci
      helm.toolkit.fluxcd.io/namespace: flux-system
  spec:
    replicas: 2
    selector:
      matchLabels:
        app.kubernetes.io/instance: crowci
        app.kubernetes.io/name: crow-agent
    serviceName: crowci-agent
    template:
      metadata:
        labels:
          app.kubernetes.io/instance: crowci
          app.kubernetes.io/name: crow-agent
      spec:
        containers:
        - name: crow
          image: "codefloe.com/crowci/crow-agent:v6.1.0"
          imagePullPolicy: IfNotPresent
          resources: {}
          securityContext:
            runAsGroup: 1000
            runAsNonRoot: true
            runAsUser: 1000
          env:
          - name: CROW_SERVER
            value: "crowci:9000"
          - name: CROW_BACKEND_K8S_NAMESPACE
            value: apps-crowci
          - name: CROW_BACKEND
            value: kubernetes
          - name: CROW_BACKEND_K8S_POD_ANNOTATIONS
            value:
          - name: CROW_BACKEND_K8S_POD_ANNOTATIONS_ALLOW_FROM_STEP
            value: "true"
          - name: CROW_BACKEND_K8S_POD_LABELS
            value:
          - name: CROW_BACKEND_K8S_SERVICE_ACCOUNT_NAME_ALLOW_FROM_STEP
            value: "true"
          - name: CROW_BACKEND_K8S_STORAGE_CLASS
            value: longhorn
          - name: CROW_BACKEND_K8S_STORAGE_RWX
            value: "true"
          - name: CROW_BACKEND_K8S_VOLUME_SIZE
            value: 2Gi
          - name: CROW_CONNECT_RETRY_COUNT
            value: "1"
          - name: CROW_MAX_WORKFLOWS
            value: "4"
          ports:
          - name: http
            containerPort: 3000
            protocol: TCP
          volumeMounts:
          - name: agent-config
            mountPath: /etc/crow
          envFrom:
          - secretRef:
              name: crow-default-agent-secret
        initContainers:
        - name: wait-for-server
          image: "curlimages/curl:latest"
          args:
          - |
            echo "Waiting for server pod to be healthy..."
            while ! curl -s http://crowci:80/api/healthcheck > /dev/null; do
              echo "Server not ready yet, waiting 5 seconds..."
              sleep 5
            done
            echo "Server is healthy, starting agent..."

          command:
          - sh
          - "-c"
          securityContext:
            runAsGroup: 1000
            runAsNonRoot: true
            runAsUser: 1000
        securityContext:
          fsGroup: 1000
        serviceAccountName: crowci-agent
    volumeClaimTemplates:
    - metadata:
        name: agent-config
        annotations: null
      spec:
        resources:
          requests:
            storage: 1Gi
        accessModes:
        - ReadWriteOnce

(root level)
+ one document added:
  apiVersion: apps/v1
  kind: StatefulSet
  metadata:
    name: crowci-server
    namespace: apps-crowci
    annotations:
      reloader.stakater.com/auto: "true"
    labels:
      app.kubernetes.io/instance: crowci
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: crow-server
      helm.toolkit.fluxcd.io/name: crowci
      helm.toolkit.fluxcd.io/namespace: flux-system
  spec:
    replicas: 1
    revisionHistoryLimit: 5
    selector:
      matchLabels:
        app.kubernetes.io/instance: crowci
        app.kubernetes.io/name: crow-server
    serviceName: crowci-headless
    template:
      metadata:
        labels:
          app.kubernetes.io/instance: crowci
          app.kubernetes.io/name: crow-server
      spec:
        containers:
        - name: crow
          image: "codefloe.com/crowci/crow-server:v6.1.0"
          imagePullPolicy: IfNotPresent
          resources: {}
          securityContext: {}
          env:
          - name: CROW_ADMIN
            value: "appboss,crow-admin"
          - name: CROW_DATABASE_DRIVER
            value: postgres
          - name: CROW_FORGES
            value: aether
          - name: CROW_FORGE_AETHER_TYPE
            value: forgejo
          - name: CROW_FORGE_AETHER_URL
            value: "https://code.aether.earth"
          - name: CROW_HOST
            value: "https://ci.aether.earth/"
          - name: CROW_OPEN
            value: "true"
          - name: CROW_PLUGINS_PRIVILEGED
            value: "codefloe.com/crow-plugins/docker-buildx:2"
          - name: CROW_PLUGINS_PRIVILEGED_MATCH_TYPE
            value: semver
          - name: CROW_SMTP_FROM
            value: crowci@aether.earth
          - name: CROW_SMTP_HOST
            value: mail-relay.email.svc.cluster.local
          - name: CROW_SMTP_PORT
            value: "587"
          - name: SSL_CERT_FILE
            value: /etc/ssl/custom-certs/trust-bundle.pem
          - name: CROW_METRICS_SERVER_ADDR
            value: ":9001"
          livenessProbe:
            httpGet:
              path: /healthz
              port: 8000
          ports:
          - name: http
            containerPort: 8000
            protocol: TCP
          - name: grpc
            containerPort: 9000
            protocol: TCP
          - name: metrics
            containerPort: 9001
            protocol: TCP
          readinessProbe:
            httpGet:
              path: /healthz
              port: 8000
          startupProbe:
            failureThreshold: 30
            httpGet:
              path: /healthz
              port: 8000
            periodSeconds: 10
          volumeMounts:
          - name: data
            mountPath: /var/lib/crow
          - name: aethernet-certs
            mountPath: /etc/ssl/custom-certs
            readOnly: true
          envFrom:
          - secretRef:
              name: crow-default-agent-secret
          - secretRef:
              name: crow-stuff
        initContainers: null
        securityContext:
          fsGroup: 1000
        serviceAccountName: crowci-server
        volumes:
        - name: aethernet-certs
          configMap:
            name: aethernet.crt
    updateStrategy:
      type: RollingUpdate
    volumeClaimTemplates:
    - metadata:
        name: data
      spec:
        resources:
          requests:
            storage: 1Gi
        storageClassName: longhorn
        accessModes:
        - ReadWriteOnce

(root level)
+ one document added:
  apiVersion: v1
  kind: ServiceAccount
  metadata:
    name: echo
    namespace: apps-echo
    labels:
      app.kubernetes.io/instance: echo
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: echo
      helm.toolkit.fluxcd.io/name: echo
      helm.toolkit.fluxcd.io/namespace: flux-system
  automountServiceAccountToken: false

(root level)
+ one document added:
  apiVersion: v1
  kind: Service
  metadata:
    name: echo
    namespace: apps-echo
    labels:
      app.kubernetes.io/instance: echo
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: echo
      helm.toolkit.fluxcd.io/name: echo
      helm.toolkit.fluxcd.io/namespace: flux-system
  spec:
    type: ClusterIP
    selector:
      app.kubernetes.io/instance: echo
      app.kubernetes.io/name: echo
    ports:
    - name: http
      port: 80
      protocol: TCP
      targetPort: http

(root level)
+ one document added:
  apiVersion: apps/v1
  kind: Deployment
  metadata:
    name: echo
    namespace: apps-echo
    labels:
      app.kubernetes.io/instance: echo
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: echo
      helm.toolkit.fluxcd.io/name: echo
      helm.toolkit.fluxcd.io/namespace: flux-system
  spec:
    replicas: 1
    selector:
      matchLabels:
        app.kubernetes.io/instance: echo
        app.kubernetes.io/name: echo
    template:
      metadata:
        labels:
          app.kubernetes.io/instance: echo
          app.kubernetes.io/managed-by: Helm
          app.kubernetes.io/name: echo
      spec:
        automountServiceAccountToken: false
        containers:
        - name: echo
          image: "ghcr.io/home-operations/echo@sha256:89e18bc031f50b5fc706a4fc85007f4d44635762146d4f16f49d993fcfde2e39"
          imagePullPolicy: IfNotPresent
          env:
          - name: ECHO_HTTP_PORT
            value: "8080"
          - name: ECHO_METRICS_ENABLED
            value: "false"
          - name: ECHO_METRICS_PORT
            value: "8081"
          - name: ECHO_LOG_LEVEL
            value: info
          - name: ECHO_LOG_FORMAT
            value: json
          - name: ECHO_DISABLE_REQUEST_LOGS
            value: "false"
          - name: ECHO_BACK_TO_CLIENT
            value: "true"
          - name: ECHO_MAX_BODY_BYTES
            value: "1048576"
          - name: ECHO_COMMANDS_ENABLED
            value: "true"
          - name: ECHO_MAX_DELAY
            value: 10s
          - name: ECHO_PRETTY_PRINT
            value: "false"
          - name: ECHO_WS_ENABLED
            value: "true"
          livenessProbe:
            httpGet:
              path: /healthz
              port: http
            initialDelaySeconds: 5
            periodSeconds: 20
          ports:
          - name: http
            containerPort: 8080
            protocol: TCP
          readinessProbe:
            httpGet:
              path: /readyz
              port: http
            initialDelaySeconds: 2
            periodSeconds: 10
          resources:
            limits:
              cpu: 100m
              memory: 64Mi
            requests:
              cpu: 10m
              memory: 32Mi
          startupProbe:
            failureThreshold: 30
            httpGet:
              path: /healthz
              port: http
            periodSeconds: 5
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
              - ALL
            readOnlyRootFilesystem: true
        securityContext:
          fsGroup: 65532
          runAsGroup: 65532
          runAsNonRoot: true
          runAsUser: 65532
          seccompProfile:
            type: RuntimeDefault
        serviceAccountName: echo
        terminationGracePeriodSeconds: 30
  


(root level)
+ one document added:
  apiVersion: v1
  kind: ServiceAccount
  metadata:
    name: envoy-gateway
    namespace: envoy-gateway
    labels:
      app.kubernetes.io/instance: envoy-gateway
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: gateway-helm
      helm.toolkit.fluxcd.io/name: envoy-gateway
      helm.toolkit.fluxcd.io/namespace: flux-system

(root level)
+ one document added:
  apiVersion: v1
  kind: ConfigMap
  metadata:
    name: envoy-gateway-config
    namespace: envoy-gateway
    labels:
      app.kubernetes.io/instance: envoy-gateway
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: gateway-helm
      helm.toolkit.fluxcd.io/name: envoy-gateway
      helm.toolkit.fluxcd.io/namespace: flux-system
  data:
    envoy-gateway.yaml: |
      apiVersion: gateway.envoyproxy.io/v1alpha1
      kind: EnvoyGateway
      extensionApis: {}
      gateway:
        controllerName: gateway.envoyproxy.io/gatewayclass-controller
      logging:
        level:
          default: info
      provider:
        kubernetes:
          rateLimitDeployment:
            container:
              image: mirror.gcr.io/envoyproxy/ratelimit:1e50889b
            patch:
              type: StrategicMerge
              value:
                spec:
                  template:
                    spec:
                      containers:
                      - imagePullPolicy: IfNotPresent
                        name: envoy-ratelimit
          shutdownManager:
            image: mirror.gcr.io/envoyproxy/gateway:v1.8.2
        type: Kubernetes


(root level)
+ one document added:
  apiVersion: rbac.authorization.k8s.io/v1
  kind: ClusterRole
  metadata:
    name: envoy-gateway-gateway-helm-envoy-gateway-role
    creationTimestamp: null
    labels:
      app.kubernetes.io/instance: envoy-gateway
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: gateway-helm
      helm.toolkit.fluxcd.io/name: envoy-gateway
      helm.toolkit.fluxcd.io/namespace: flux-system
  rules:
  - resources:
    - nodes
    - namespaces
    apiGroups:
    -
    verbs:
    - get
    - list
    - watch
  - resources:
    - gatewayclasses
    apiGroups:
    - gateway.networking.k8s.io
    verbs:
    - get
    - list
    - patch
    - update
    - watch
  - resources:
    - gatewayclasses/status
    apiGroups:
    - gateway.networking.k8s.io
    verbs:
    - update
  - resources:
    - serviceimports
    apiGroups:
    - multicluster.x-k8s.io
    verbs:
    - get
    - list
    - watch
  - resources:
    - configmaps
    - secrets
    - services
    apiGroups:
    -
    verbs:
    - get
    - list
    - watch
  - resources:
    - deployments
    - daemonsets
    apiGroups:
    - apps
    verbs:
    - get
    - list
    - watch
  - resources:
    - endpointslices
    apiGroups:
    - discovery.k8s.io
    verbs:
    - get
    - list
    - watch
  - resources:
    - envoyproxies
    - envoypatchpolicies
    - clienttrafficpolicies
    - backendtrafficpolicies
    - securitypolicies
    - envoyextensionpolicies
    - backends
    - httproutefilters
    apiGroups:
    - gateway.envoyproxy.io
    verbs:
    - get
    - list
    - watch
  - resources:
    - envoypatchpolicies/status
    - clienttrafficpolicies/status
    - backendtrafficpolicies/status
    - securitypolicies/status
    - envoyextensionpolicies/status
    - backends/status
    apiGroups:
    - gateway.envoyproxy.io
    verbs:
    - update
  - resources:
    - gateways
    - listenersets
    - grpcroutes
    - httproutes
    - referencegrants
    - tcproutes
    - tlsroutes
    - udproutes
    - backendtlspolicies
    apiGroups:
    - gateway.networking.k8s.io
    verbs:
    - get
    - list
    - watch
  - resources:
    - gateways/status
    - listenersets/status
    - grpcroutes/status
    - httproutes/status
    - tcproutes/status
    - tlsroutes/status
    - udproutes/status
    - backendtlspolicies/status
    apiGroups:
    - gateway.networking.k8s.io
    verbs:
    - update
  - resources:
    - pods
    - pods/binding
    apiGroups:
    -
    verbs:
    - get
    - list
    - patch
    - update
    - watch

(root level)
+ one document added:
  apiVersion: rbac.authorization.k8s.io/v1
  kind: ClusterRoleBinding
  metadata:
    name: envoy-gateway-gateway-helm-envoy-gateway-rolebinding
    labels:
      app.kubernetes.io/instance: envoy-gateway
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: gateway-helm
      helm.toolkit.fluxcd.io/name: envoy-gateway
      helm.toolkit.fluxcd.io/namespace: flux-system
  roleRef:
    name: envoy-gateway-gateway-helm-envoy-gateway-role
    apiGroup: rbac.authorization.k8s.io
    kind: ClusterRole
  subjects:
  - name: envoy-gateway
    kind: ServiceAccount
    namespace: envoy-gateway

(root level)
+ one document added:
  apiVersion: rbac.authorization.k8s.io/v1
  kind: Role
  metadata:
    name: envoy-gateway-gateway-helm-infra-manager
    namespace: envoy-gateway
    labels:
      app.kubernetes.io/instance: envoy-gateway
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: gateway-helm
      helm.toolkit.fluxcd.io/name: envoy-gateway
      helm.toolkit.fluxcd.io/namespace: flux-system
  rules:
  - resources:
    - serviceaccounts
    - services
    - configmaps
    apiGroups:
    -
    verbs:
    - create
    - get
    - list
    - delete
    - deletecollection
    - patch
    - watch
  - resources:
    - deployments
    - daemonsets
    apiGroups:
    - apps
    verbs:
    - create
    - get
    - list
    - delete
    - deletecollection
    - patch
    - watch
  - resources:
    - horizontalpodautoscalers
    - poddisruptionbudgets
    apiGroups:
    - autoscaling
    - policy
    verbs:
    - create
    - get
    - list
    - delete
    - deletecollection
    - patch
    - watch
  - resources:
    - clustertrustbundles
    apiGroups:
    - certificates.k8s.io
    verbs:
    - list
    - get
    - watch

(root level)
+ one document added:
  apiVersion: rbac.authorization.k8s.io/v1
  kind: Role
  metadata:
    name: envoy-gateway-gateway-helm-leader-election-role
    namespace: envoy-gateway
    labels:
      app.kubernetes.io/instance: envoy-gateway
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: gateway-helm
      helm.toolkit.fluxcd.io/name: envoy-gateway
      helm.toolkit.fluxcd.io/namespace: flux-system
  rules:
  - resources:
    - configmaps
    apiGroups:
    -
    verbs:
    - get
    - list
    - watch
    - create
    - update
    - patch
    - delete
  - resources:
    - leases
    apiGroups:
    - coordination.k8s.io
    verbs:
    - get
    - list
    - watch
    - create
    - update
    - patch
    - delete
  - resources:
    - events
    apiGroups:
    -
    verbs:
    - create
    - patch

(root level)
+ one document added:
  apiVersion: rbac.authorization.k8s.io/v1
  kind: RoleBinding
  metadata:
    name: envoy-gateway-gateway-helm-infra-manager
    namespace: envoy-gateway
    labels:
      app.kubernetes.io/instance: envoy-gateway
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: gateway-helm
      helm.toolkit.fluxcd.io/name: envoy-gateway
      helm.toolkit.fluxcd.io/namespace: flux-system
  roleRef:
    name: envoy-gateway-gateway-helm-infra-manager
    apiGroup: rbac.authorization.k8s.io
    kind: Role
  subjects:
  - name: envoy-gateway
    kind: ServiceAccount
    namespace: envoy-gateway

(root level)
+ one document added:
  apiVersion: rbac.authorization.k8s.io/v1
  kind: RoleBinding
  metadata:
    name: envoy-gateway-gateway-helm-leader-election-rolebinding
    namespace: envoy-gateway
    labels:
      app.kubernetes.io/instance: envoy-gateway
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: gateway-helm
      helm.toolkit.fluxcd.io/name: envoy-gateway
      helm.toolkit.fluxcd.io/namespace: flux-system
  roleRef:
    name: envoy-gateway-gateway-helm-leader-election-role
    apiGroup: rbac.authorization.k8s.io
    kind: Role
  subjects:
  - name: envoy-gateway
    kind: ServiceAccount
    namespace: envoy-gateway

(root level)
+ one document added:
  apiVersion: v1
  kind: Service
  metadata:
    name: envoy-gateway
    namespace: envoy-gateway
    labels:
      app.kubernetes.io/instance: envoy-gateway
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: gateway-helm
      control-plane: envoy-gateway
      helm.toolkit.fluxcd.io/name: envoy-gateway
      helm.toolkit.fluxcd.io/namespace: flux-system
  spec:
    type: ClusterIP
    selector:
      app.kubernetes.io/instance: envoy-gateway
      app.kubernetes.io/name: gateway-helm
      control-plane: envoy-gateway
    ports:
    - name: grpc
      port: 18000
      targetPort: 18000
    - name: ratelimit
      port: 18001
      targetPort: 18001
    - name: wasm
      port: 18002
      targetPort: 18002
    - name: metrics
      port: 19001
      targetPort: 19001
    - name: webhook
      port: 9443
      targetPort: 9443

(root level)
+ one document added:
  apiVersion: apps/v1
  kind: Deployment
  metadata:
    name: envoy-gateway
    namespace: envoy-gateway
    labels:
      app.kubernetes.io/instance: envoy-gateway
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: gateway-helm
      control-plane: envoy-gateway
      helm.toolkit.fluxcd.io/name: envoy-gateway
      helm.toolkit.fluxcd.io/namespace: flux-system
  spec:
    replicas: 1
    selector:
      matchLabels:
        app.kubernetes.io/instance: envoy-gateway
        app.kubernetes.io/name: gateway-helm
        control-plane: envoy-gateway
    template:
      metadata:
        annotations:
          prometheus.io/port: "19001"
          prometheus.io/scrape: "true"
        labels:
          app.kubernetes.io/instance: envoy-gateway
          app.kubernetes.io/name: gateway-helm
          control-plane: envoy-gateway
      spec:
        containers:
        - name: envoy-gateway
          image: "mirror.gcr.io/envoyproxy/gateway:v1.8.2"
          imagePullPolicy: IfNotPresent
          args:
          - server
          - "--config-path=/config/envoy-gateway.yaml"
          livenessProbe:
            httpGet:
              path: /healthz
              port: 8081
            initialDelaySeconds: 15
            periodSeconds: 20
          ports:
          - name: grpc
            containerPort: 18000
          - name: ratelimit
            containerPort: 18001
          - name: wasm
            containerPort: 18002
          - name: metrics
            containerPort: 19001
          - name: webhook
            containerPort: 9443
          readinessProbe:
            httpGet:
              path: /readyz
              port: 8081
            initialDelaySeconds: 5
            periodSeconds: 10
          resources:
            limits:
              memory: 1024Mi
            requests:
              cpu: 100m
              memory: 256Mi
          volumeMounts:
          - name: envoy-gateway-config
            mountPath: /config
            readOnly: true
          - name: certs
            mountPath: /certs
            readOnly: true
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
              - ALL
            privileged: false
            runAsGroup: 65532
            runAsNonRoot: true
            runAsUser: 65532
            seccompProfile:
              type: RuntimeDefault
          env:
          - name: ENVOY_GATEWAY_NAMESPACE
            valueFrom:
              fieldRef:
                apiVersion: v1
                fieldPath: metadata.namespace
          - name: KUBERNETES_CLUSTER_DOMAIN
            value: cluster.local
        imagePullSecrets: []
        serviceAccountName: envoy-gateway
        terminationGracePeriodSeconds: 10
        volumes:
        - name: envoy-gateway-config
          configMap:
            name: envoy-gateway-config
            defaultMode: 420
        - name: certs
          secret:
            secretName: envoy-gateway

(root level)
+ one document added:
  apiVersion: admissionregistration.k8s.io/v1
  kind: ValidatingAdmissionPolicy
  metadata:
    name: safe-upgrades.gateway.networking.k8s.io
    namespace: envoy-gateway
    annotations:
      gateway.networking.k8s.io/bundle-version: v1.5.0-dev
      gateway.networking.k8s.io/channel: standard
    labels:
      helm.toolkit.fluxcd.io/name: envoy-gateway
      helm.toolkit.fluxcd.io/namespace: flux-system
  spec:
    failurePolicy: Fail
    matchConstraints:
      resourceRules:
      - resources:
        - "*"
        apiGroups:
        - apiextensions.k8s.io
        apiVersions:
        - v1
        operations:
        - CREATE
        - UPDATE
    validations:
    - expression: "object.spec.group != 'gateway.networking.k8s.io' || oldObject == null || ( has(object.metadata.annotations) && object.metadata.annotations.exists(k, k == 'gateway.networking.k8s.io/channel') && object.metadata.annotations['gateway.networking.k8s.io/channel'] == 'standard' ) || ( oldObject != null && has(oldObject.metadata.annotations) && oldObject.metadata.annotations.exists(k, k == 'gateway.networking.k8s.io/channel') && oldObject.metadata.annotations['gateway.networking.k8s.io/channel'] == 'experimental' )"
      message: "Installing experimental CRDs on top of standard channel CRDs is prohibited by default. Uninstall ValidatingAdmissionPolicy safe-upgrades.gateway.networking.k8s.io to install experimental CRDs on top of standard channel CRDs."
      reason: Invalid
    - expression: "object.spec.group != 'gateway.networking.k8s.io' || (has(object.metadata.annotations) && object.metadata.annotations.exists(k, k == 'gateway.networking.k8s.io/bundle-version') && !matches(object.metadata.annotations['gateway.networking.k8s.io/bundle-version'], 'v1.[0-4].\\\\d+') && !matches(object.metadata.annotations['gateway.networking.k8s.io/bundle-version'], 'v0'))"
      message: "Installing CRDs with version before v1.5.0 is prohibited by default. Uninstall ValidatingAdmissionPolicy safe-upgrades.gateway.networking.k8s.io to install older versions."
      reason: Invalid
  


(root level)
+ one document added:
  apiVersion: admissionregistration.k8s.io/v1
  kind: ValidatingAdmissionPolicyBinding
  metadata:
    name: safe-upgrades.gateway.networking.k8s.io
    namespace: envoy-gateway
    annotations:
      gateway.networking.k8s.io/bundle-version: v1.5.0-dev
      gateway.networking.k8s.io/channel: standard
    labels:
      helm.toolkit.fluxcd.io/name: envoy-gateway
      helm.toolkit.fluxcd.io/namespace: flux-system
  spec:
    matchResources:
      resourceRules:
      - resources:
        - customresourcedefinitions
        apiGroups:
        - apiextensions.k8s.io
        apiVersions:
        - v1
        operations:
        - CREATE
        - UPDATE
    policyName: safe-upgrades.gateway.networking.k8s.io
    validationActions:
    - Deny

(root level)
+ one document added:
  apiVersion: v1
  kind: ServiceAccount
  metadata:
    name: envoy-gateway-gateway-helm-certgen
    namespace: envoy-gateway
    annotations:
      helm.sh/hook: "pre-install, pre-upgrade"
      helm.sh/hook-weight: "-1"
    labels:
      app.kubernetes.io/instance: envoy-gateway
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: gateway-helm

(root level)
+ one document added:
  apiVersion: rbac.authorization.k8s.io/v1
  kind: ClusterRole
  metadata:
    name: "envoy-gateway-gateway-helm-certgen:envoy-gateway"
    annotations:
      helm.sh/hook: "pre-install, pre-upgrade"
      helm.sh/hook-weight: "-1"
    labels:
      app.kubernetes.io/instance: envoy-gateway
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: gateway-helm
  rules:
  - resources:
    - mutatingwebhookconfigurations
    apiGroups:
    - admissionregistration.k8s.io
    verbs:
    - get
    - list
    - watch
  - resources:
    - mutatingwebhookconfigurations
    apiGroups:
    - admissionregistration.k8s.io
    resourceNames:
    - envoy-gateway-topology-injector.envoy-gateway
    verbs:
    - update
    - patch

(root level)
+ one document added:
  apiVersion: rbac.authorization.k8s.io/v1
  kind: ClusterRoleBinding
  metadata:
    name: "envoy-gateway-gateway-helm-certgen:envoy-gateway"
    annotations:
      helm.sh/hook: "pre-install, pre-upgrade"
      helm.sh/hook-weight: "-1"
    labels:
      app.kubernetes.io/instance: envoy-gateway
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: gateway-helm
  roleRef:
    name: "envoy-gateway-gateway-helm-certgen:envoy-gateway"
    apiGroup: rbac.authorization.k8s.io
    kind: ClusterRole
  subjects:
  - name: envoy-gateway-gateway-helm-certgen
    kind: ServiceAccount
    namespace: envoy-gateway

(root level)
+ one document added:
  apiVersion: rbac.authorization.k8s.io/v1
  kind: Role
  metadata:
    name: envoy-gateway-gateway-helm-certgen
    namespace: envoy-gateway
    annotations:
      helm.sh/hook: "pre-install, pre-upgrade"
      helm.sh/hook-weight: "-1"
    labels:
      app.kubernetes.io/instance: envoy-gateway
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: gateway-helm
  rules:
  - resources:
    - secrets
    apiGroups:
    -
    verbs:
    - get
    - create
    - update

(root level)
+ one document added:
  apiVersion: rbac.authorization.k8s.io/v1
  kind: RoleBinding
  metadata:
    name: envoy-gateway-gateway-helm-certgen
    namespace: envoy-gateway
    annotations:
      helm.sh/hook: "pre-install, pre-upgrade"
      helm.sh/hook-weight: "-1"
    labels:
      app.kubernetes.io/instance: envoy-gateway
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: gateway-helm
  roleRef:
    name: envoy-gateway-gateway-helm-certgen
    apiGroup: rbac.authorization.k8s.io
    kind: Role
  subjects:
  - name: envoy-gateway-gateway-helm-certgen
    kind: ServiceAccount
    namespace: envoy-gateway

(root level)
+ one document added:
  apiVersion: batch/v1
  kind: Job
  metadata:
    name: envoy-gateway-gateway-helm-certgen
    namespace: envoy-gateway
    annotations:
      helm.sh/hook: "pre-install, pre-upgrade"
    labels:
      app.kubernetes.io/instance: envoy-gateway
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: gateway-helm
  spec:
    backoffLimit: 1
    completions: 1
    parallelism: 1
    template:
      metadata:
        labels:
          app: certgen
      spec:
        containers:
        - name: envoy-gateway-certgen
          image: "mirror.gcr.io/envoyproxy/gateway:v1.8.2"
          imagePullPolicy: IfNotPresent
          command:
          - envoy-gateway
          - certgen
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
              - ALL
            privileged: false
            readOnlyRootFilesystem: true
            runAsGroup: 65532
            runAsNonRoot: true
            runAsUser: 65532
            seccompProfile:
              type: RuntimeDefault
          env:
          - name: ENVOY_GATEWAY_NAMESPACE
            valueFrom:
              fieldRef:
                apiVersion: v1
                fieldPath: metadata.namespace
          - name: KUBERNETES_CLUSTER_DOMAIN
            value: cluster.local
        imagePullSecrets: []
        restartPolicy: Never
        serviceAccountName: envoy-gateway-gateway-helm-certgen
    ttlSecondsAfterFinished: 30

(root level)
+ one document added:
  apiVersion: admissionregistration.k8s.io/v1
  kind: MutatingWebhookConfiguration
  metadata:
    name: envoy-gateway-topology-injector.envoy-gateway
    annotations:
      helm.sh/hook: "pre-install, pre-upgrade"
      helm.sh/hook-weight: "-1"
    labels:
      app.kubernetes.io/component: topology-injector
      app.kubernetes.io/instance: envoy-gateway
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: gateway-helm
  webhooks:
  - name: topology.webhook.gateway.envoyproxy.io
    failurePolicy: Ignore
    sideEffects: None
    admissionReviewVersions:
    - v1
    clientConfig:
      service:
        name: envoy-gateway
        namespace: envoy-gateway
        path: /inject-pod-topology
        port: 9443
    rules:
    - resources:
      - pods/binding
      apiGroups:
      -
      apiVersions:
      - v1
      operations:
      - CREATE
    namespaceSelector:
      matchExpressions:
      - key: kubernetes.io/metadata.name
        operator: In
        values:
        - envoy-gateway

(root level)
+ one document added:
  apiVersion: v1
  kind: PersistentVolumeClaim
  metadata:
    name: gitea-shared-storage
    namespace: apps-forgejo
    annotations:
      helm.sh/resource-policy: keep
    labels:
      helm.toolkit.fluxcd.io/name: forgejo
      helm.toolkit.fluxcd.io/namespace: flux-system
  spec:
    resources:
      requests:
        storage: 100Gi
    storageClassName: longhorn
    volumeMode: Filesystem
    accessModes:
    - ReadWriteOnce

(root level)
+ one document added:
  apiVersion: v1
  kind: Service
  metadata:
    name: forgejo-http
    namespace: apps-forgejo
    labels:
      version: "15.0.5"
      app: forgejo
      app.kubernetes.io/instance: forgejo
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: forgejo
      helm.toolkit.fluxcd.io/name: forgejo
      helm.toolkit.fluxcd.io/namespace: flux-system
  spec:
    type: ClusterIP
    selector:
      app.kubernetes.io/instance: forgejo
      app.kubernetes.io/name: forgejo
    ports:
    - name: http
      port: 3000
      targetPort: http

(root level)
+ one document added:
  apiVersion: v1
  kind: Service
  metadata:
    name: forgejo-ssh
    namespace: apps-forgejo
    annotations:
      tailscale.com/hostname: forgejo-ssh
    labels:
      version: "15.0.5"
      app: forgejo
      app.kubernetes.io/instance: forgejo
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: forgejo
      helm.toolkit.fluxcd.io/name: forgejo
      helm.toolkit.fluxcd.io/namespace: flux-system
  spec:
    type: LoadBalancer
    ipFamilyPolicy: RequireDualStack
    loadBalancerClass: tailscale
    selector:
      app.kubernetes.io/instance: forgejo
      app.kubernetes.io/name: forgejo
    ports:
    - name: ssh
      port: 22
      protocol: TCP
      targetPort: ssh

(root level)
+ one document added:
  apiVersion: apps/v1
  kind: Deployment
  metadata:
    name: forgejo
    annotations: null
    namespace: apps-forgejo
    labels:
      version: "15.0.5"
      app: forgejo
      app.kubernetes.io/instance: forgejo
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: forgejo
      helm.toolkit.fluxcd.io/name: forgejo
      helm.toolkit.fluxcd.io/namespace: flux-system
  spec:
    replicas: 1
    selector:
      matchLabels:
        app.kubernetes.io/instance: forgejo
        app.kubernetes.io/name: forgejo
    strategy:
      type: Recreate
    template:
      metadata:
        labels:
          version: "15.0.5"
          app: forgejo
          app.kubernetes.io/instance: forgejo
          app.kubernetes.io/managed-by: Helm
          app.kubernetes.io/name: forgejo
      spec:
        containers:
        - name: forgejo
          image: "code.forgejo.org/forgejo/forgejo:15.0.5-rootless"
          imagePullPolicy: IfNotPresent
          resources: {}
          securityContext: {}
          env:
          - name: SSH_LISTEN_PORT
            value: "2222"
          - name: SSH_PORT
            value: "2222"
          - name: GITEA_APP_INI
            value: /data/gitea/conf/app.ini
          - name: GITEA_CUSTOM
            value: /data/gitea
          - name: GITEA_WORK_DIR
            value: /data
          - name: GITEA_TEMP
            value: /tmp/gitea
          - name: TMPDIR
            value: /tmp/gitea
          - name: HOME
            value: /data/gitea/git
          livenessProbe:
            failureThreshold: 10
            initialDelaySeconds: 200
            periodSeconds: 10
            successThreshold: 1
            tcpSocket:
              port: http
            timeoutSeconds: 1
          ports:
          - name: ssh
            containerPort: 2222
          - name: http
            containerPort: 3000
          readinessProbe:
            failureThreshold: 3
            httpGet:
              path: /api/healthz
              port: http
            initialDelaySeconds: 5
            periodSeconds: 10
            successThreshold: 1
            timeoutSeconds: 1
          volumeMounts:
          - name: temp
            mountPath: /tmp
          - name: data
            mountPath: /data
        initContainers:
        - name: init-directories
          image: "code.forgejo.org/forgejo/forgejo:15.0.5-rootless"
          imagePullPolicy: IfNotPresent
          securityContext: {}
          command:
          - /usr/sbin/init_directory_structure.sh
          env:
          - name: GITEA_APP_INI
            value: /data/gitea/conf/app.ini
          - name: GITEA_CUSTOM
            value: /data/gitea
          - name: GITEA_WORK_DIR
            value: /data
          - name: GITEA_TEMP
            value: /tmp/gitea
          resources:
            limits: {}
            requests:
              cpu: 100m
              memory: 128Mi
          volumeMounts:
          - name: init
            mountPath: /usr/sbin
          - name: temp
            mountPath: /tmp
          - name: data
            mountPath: /data
        - name: init-app-ini
          image: "code.forgejo.org/forgejo/forgejo:15.0.5-rootless"
          imagePullPolicy: IfNotPresent
          securityContext: {}
          command:
          - /usr/sbin/config_environment.sh
          resources:
            limits: {}
            requests:
              cpu: 100m
              memory: 128Mi
          volumeMounts:
          - name: config
            mountPath: /usr/sbin
          - name: temp
            mountPath: /tmp
          - name: data
            mountPath: /data
          - name: inline-config-sources
            mountPath: /env-to-ini-mounts/inlines/
          env:
          - name: GITEA_APP_INI
            value: /data/gitea/conf/app.ini
          - name: GITEA_CUSTOM
            value: /data/gitea
          - name: GITEA_WORK_DIR
            value: /data
          - name: GITEA_TEMP
            value: /tmp/gitea
          - name: FORGEJO__DATABASE__PASSWD
            valueFrom:
              secretKeyRef:
                name: db-forgejo-app
                key: password
          - name: FORGEJO__STORAGE__MINIO_ACCESS_KEY_ID
            valueFrom:
              secretKeyRef:
                name: forgejo-s3-creds
                key: AWS_ACCESS_KEY_ID
          - name: FORGEJO__STORAGE__MINIO_SECRET_ACCESS_KEY
            valueFrom:
              secretKeyRef:
                name: forgejo-s3-creds
                key: AWS_SECRET_ACCESS_KEY
        - name: configure-gitea
          image: "code.forgejo.org/forgejo/forgejo:15.0.5-rootless"
          imagePullPolicy: IfNotPresent
          command:
          - /usr/sbin/configure_gitea.sh
          securityContext:
            runAsUser: 1000
          resources:
            limits: {}
            requests:
              cpu: 100m
              memory: 128Mi
          volumeMounts:
          - name: init
            mountPath: /usr/sbin
          - name: temp
            mountPath: /tmp
          - name: data
            mountPath: /data
          env:
          - name: GITEA_APP_INI
            value: /data/gitea/conf/app.ini
          - name: GITEA_CUSTOM
            value: /data/gitea
          - name: GITEA_WORK_DIR
            value: /data
          - name: GITEA_TEMP
            value: /tmp/gitea
          - name: HOME
            value: /data/gitea/git
          - name: GITEA_OAUTH_KEY_0
            valueFrom:
              secretKeyRef:
                name: forgejo-oauth-secret
                key: key
          - name: GITEA_OAUTH_SECRET_0
            valueFrom:
              secretKeyRef:
                name: forgejo-oauth-secret
                key: secret
          - name: GITEA_ADMIN_USERNAME
            valueFrom:
              secretKeyRef:
                name: forgejo-admin
                key: username
          - name: GITEA_ADMIN_PASSWORD
            valueFrom:
              secretKeyRef:
                name: forgejo-admin
                key: password
          - name: GITEA_ADMIN_PASSWORD_MODE
            value: keepUpdated
        securityContext:
          fsGroup: 1000
        terminationGracePeriodSeconds: 60
        volumes:
        - name: init
          secret:
            defaultMode: 110
            secretName: forgejo-init
        - name: config
          secret:
            defaultMode: 110
            secretName: forgejo
        - name: inline-config-sources
          secret:
            secretName: forgejo-inline-config
        - name: temp
          emptyDir: {}
        - name: data
          persistentVolumeClaim:
            claimName: gitea-shared-storage

(root level)
+ one document added:
  apiVersion: gateway.networking.k8s.io/v1
  kind: HTTPRoute
  metadata:
    name: forgejo
    namespace: apps-forgejo
    annotations:
      gatus.home-operations.com/enabled: "true"
      gatus.home-operations.com/endpoint: "name: \"Forgejo\""
      gethomepage.dev/description: "Forgejo code forge"
      gethomepage.dev/enabled: "true"
      gethomepage.dev/icon: sh-forgejo
      gethomepage.dev/name: Forgejo
    labels:
      version: "15.0.5"
      app: forgejo
      app.kubernetes.io/instance: forgejo
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: forgejo
      helm.toolkit.fluxcd.io/name: forgejo
      helm.toolkit.fluxcd.io/namespace: flux-system
  spec:
    hostnames:
    - code.aether.earth
    parentRefs:
    - name: envoy-for-outside
      namespace: envoy-gateway
      sectionName: https
    rules:
    - backendRefs:
      - name: forgejo-http
        kind: Service
        port: 3000
      matches:
      - path:
          type: PathPrefix
          value: /

(root level)
+ one document added:
  apiVersion: monitoring.coreos.com/v1
  kind: ServiceMonitor
  metadata:
    name: forgejo
    namespace: apps-forgejo
    labels:
      version: "15.0.5"
      app: forgejo
      app.kubernetes.io/instance: forgejo
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: forgejo
      helm.toolkit.fluxcd.io/name: forgejo
      helm.toolkit.fluxcd.io/namespace: flux-system
  spec:
    endpoints:
    - port: http
    selector:
      matchLabels:
        app.kubernetes.io/instance: forgejo
        app.kubernetes.io/name: forgejo

(root level)
+ one document added:
  apiVersion: networking.k8s.io/v1
  kind: NetworkPolicy
  metadata:
    name: forgejo-valkey
    namespace: apps-forgejo
    labels:
      app.kubernetes.io/instance: forgejo-valkey
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: valkey
      app.kubernetes.io/part-of: valkey
      helm.toolkit.fluxcd.io/name: forgejo-valkey
      helm.toolkit.fluxcd.io/namespace: flux-system
  spec:
    egress:
    -   ingress:
    - ports:
      - port: 6379
    podSelector:
      matchLabels:
        app.kubernetes.io/instance: forgejo-valkey
        app.kubernetes.io/name: valkey
    policyTypes:
    - Ingress
    - Egress

(root level)
+ one document added:
  apiVersion: policy/v1
  kind: PodDisruptionBudget
  metadata:
    name: forgejo-valkey-primary
    namespace: apps-forgejo
    labels:
      app.kubernetes.io/component: primary
      app.kubernetes.io/instance: forgejo-valkey
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: valkey
      helm.toolkit.fluxcd.io/name: forgejo-valkey
      helm.toolkit.fluxcd.io/namespace: flux-system
  spec:
    maxUnavailable: 1
    selector:
      matchLabels:
        app.kubernetes.io/component: primary
        app.kubernetes.io/instance: forgejo-valkey
        app.kubernetes.io/name: valkey

(root level)
+ one document added:
  apiVersion: v1
  kind: ServiceAccount
  metadata:
    name: forgejo-valkey-primary
    namespace: apps-forgejo
    labels:
      app.kubernetes.io/instance: forgejo-valkey
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: valkey
      app.kubernetes.io/part-of: valkey
      helm.toolkit.fluxcd.io/name: forgejo-valkey
      helm.toolkit.fluxcd.io/namespace: flux-system
  automountServiceAccountToken: false

(root level)
+ one document added:
  apiVersion: v1
  kind: ConfigMap
  metadata:
    name: forgejo-valkey-configuration
    namespace: apps-forgejo
    labels:
      app.kubernetes.io/instance: forgejo-valkey
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: valkey
      app.kubernetes.io/part-of: valkey
      helm.toolkit.fluxcd.io/name: forgejo-valkey
      helm.toolkit.fluxcd.io/namespace: flux-system
  data:
    primary.conf: |
      dir /data
      # User-supplied primary configuration:
      rename-command FLUSHDB ""
      rename-command FLUSHALL ""
      # End of primary configuration
    replica.conf: |
      dir /data
      # User-supplied replica configuration:
      rename-command FLUSHDB ""
      rename-command FLUSHALL ""
      # End of replica configuration
    valkey.conf: |
      # User-supplied common configuration:
      # Enable AOF https://valkey.io/docs/topics/persistence.html
      appendonly yes
      # Disable RDB persistence, AOF persistence already enabled.
      save ""
      # End of common configuration

(root level)
+ one document added:
  apiVersion: v1
  kind: ConfigMap
  metadata:
    name: forgejo-valkey-health
    namespace: apps-forgejo
    labels:
      app.kubernetes.io/instance: forgejo-valkey
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: valkey
      helm.toolkit.fluxcd.io/name: forgejo-valkey
      helm.toolkit.fluxcd.io/namespace: flux-system
  data:
    ping_liveness_local.sh: |
      #!/bin/bash
      
      [[ -f $VALKEY_PASSWORD_FILE ]] && export VALKEY_PASSWORD="$(< "${VALKEY_PASSWORD_FILE}")"
      [[ -n "$VALKEY_PASSWORD" ]] && export REDISCLI_AUTH="$VALKEY_PASSWORD"
      response=$(
        timeout -s 15 $1 \
        valkey-cli \
          -h localhost \
          -p $VALKEY_PORT \
          ping
      )
      if [ "$?" -eq "124" ]; then
        echo "Timed out"
        exit 1
      fi
      responseFirstWord=$(echo $response | head -n1 | awk '{print $1;}')
      if [ "$response" != "PONG" ] && [ "$responseFirstWord" != "LOADING" ] && [ "$responseFirstWord" != "MASTERDOWN" ]; then
        echo "$response"
        exit 1
      fi
    ping_liveness_local_and_primary.sh: |
      script_dir="$(dirname "$0")"
      exit_status=0
      "$script_dir/ping_liveness_local.sh" $1 || exit_status=$?
      "$script_dir/ping_liveness_primary.sh" $1 || exit_status=$?
      exit $exit_status
    ping_liveness_primary.sh: |
      #!/bin/bash
      
      [[ -f $VALKEY_PRIMARY_PASSWORD_FILE ]] && export VALKEY_PRIMARY_PASSWORD="$(< "${VALKEY_PRIMARY_PASSWORD_FILE}")"
      [[ -n "$VALKEY_PRIMARY_PASSWORD" ]] && export REDISCLI_AUTH="$VALKEY_PRIMARY_PASSWORD"
      response=$(
        timeout -s 15 $1 \
        valkey-cli \
          -h $VALKEY_PRIMARY_HOST \
          -p $VALKEY_PRIMARY_PORT_NUMBER \
          ping
      )
      if [ "$?" -eq "124" ]; then
        echo "Timed out"
        exit 1
      fi
      responseFirstWord=$(echo $response | head -n1 | awk '{print $1;}')
      if [ "$response" != "PONG" ] && [ "$responseFirstWord" != "LOADING" ]; then
        echo "$response"
        exit 1
      fi
    ping_readiness_local.sh: |
      #!/bin/bash
      
      [[ -f $VALKEY_PASSWORD_FILE ]] && export VALKEY_PASSWORD="$(< "${VALKEY_PASSWORD_FILE}")"
      [[ -n "$VALKEY_PASSWORD" ]] && export REDISCLI_AUTH="$VALKEY_PASSWORD"
      response=$(
        timeout -s 15 $1 \
        valkey-cli \
          -h localhost \
          -p $VALKEY_PORT \
          ping
      )
      if [ "$?" -eq "124" ]; then
        echo "Timed out"
        exit 1
      fi
      if [ "$response" != "PONG" ]; then
        echo "$response"
        exit 1
      fi
    ping_readiness_local_and_primary.sh: |
      script_dir="$(dirname "$0")"
      exit_status=0
      "$script_dir/ping_readiness_local.sh" $1 || exit_status=$?
      "$script_dir/ping_readiness_primary.sh" $1 || exit_status=$?
      exit $exit_status
    ping_readiness_primary.sh: |
      #!/bin/bash
      
      [[ -f $VALKEY_PRIMARY_PASSWORD_FILE ]] && export VALKEY_PRIMARY_PASSWORD="$(< "${VALKEY_PRIMARY_PASSWORD_FILE}")"
      [[ -n "$VALKEY_PRIMARY_PASSWORD" ]] && export REDISCLI_AUTH="$VALKEY_PRIMARY_PASSWORD"
      response=$(
        timeout -s 15 $1 \
        valkey-cli \
          -h $VALKEY_PRIMARY_HOST \
          -p $VALKEY_PRIMARY_PORT_NUMBER \
          ping
      )
      if [ "$?" -eq "124" ]; then
        echo "Timed out"
        exit 1
      fi
      if [ "$response" != "PONG" ]; then
        echo "$response"
        exit 1
      fi
  


(root level)
+ one document added:
  apiVersion: v1
  kind: ConfigMap
  metadata:
    name: forgejo-valkey-scripts
    namespace: apps-forgejo
    labels:
      app.kubernetes.io/instance: forgejo-valkey
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: valkey
      app.kubernetes.io/part-of: valkey
      helm.toolkit.fluxcd.io/name: forgejo-valkey
      helm.toolkit.fluxcd.io/namespace: flux-system
  data:
    start-primary.sh: |
      #!/bin/bash
      
      [[ -f $VALKEY_PASSWORD_FILE ]] && export VALKEY_PASSWORD="$(< "${VALKEY_PASSWORD_FILE}")"
      if [[ -f /opt/bitnami/valkey/mounted-etc/primary.conf ]];then
          cp /opt/bitnami/valkey/mounted-etc/primary.conf /opt/bitnami/valkey/etc/primary.conf
      fi
      if [[ -f /opt/bitnami/valkey/mounted-etc/valkey.conf ]];then
          cp /opt/bitnami/valkey/mounted-etc/valkey.conf /opt/bitnami/valkey/etc/valkey.conf
      fi
      ARGS=("--port" "${VALKEY_PORT}")
      ARGS+=("--protected-mode" "no")
      ARGS+=("--include" "/opt/bitnami/valkey/etc/valkey.conf")
      ARGS+=("--include" "/opt/bitnami/valkey/etc/primary.conf")
      exec valkey-server "${ARGS[@]}"
      
  


(root level)
+ one document added:
  apiVersion: v1
  kind: Service
  metadata:
    name: forgejo-valkey-headless
    namespace: apps-forgejo
    labels:
      app.kubernetes.io/instance: forgejo-valkey
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: valkey
      app.kubernetes.io/part-of: valkey
      helm.toolkit.fluxcd.io/name: forgejo-valkey
      helm.toolkit.fluxcd.io/namespace: flux-system
  spec:
    type: ClusterIP
    clusterIP: None
    selector:
      app.kubernetes.io/instance: forgejo-valkey
      app.kubernetes.io/name: valkey
    ports:
    - name: tcp-redis
      port: 6379
      targetPort: redis

(root level)
+ one document added:
  apiVersion: v1
  kind: Service
  metadata:
    name: forgejo-valkey-primary
    namespace: apps-forgejo
    labels:
      app.kubernetes.io/component: primary
      app.kubernetes.io/instance: forgejo-valkey
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: valkey
      app.kubernetes.io/part-of: valkey
      helm.toolkit.fluxcd.io/name: forgejo-valkey
      helm.toolkit.fluxcd.io/namespace: flux-system
  spec:
    type: ClusterIP
    internalTrafficPolicy: Cluster
    selector:
      app.kubernetes.io/component: primary
      app.kubernetes.io/instance: forgejo-valkey
      app.kubernetes.io/name: valkey
    ports:
    - name: tcp-redis
      nodePort: null
      port: 6379
      targetPort: redis

(root level)
+ one document added:
  apiVersion: apps/v1
  kind: StatefulSet
  metadata:
    name: forgejo-valkey-primary
    namespace: apps-forgejo
    labels:
      app.kubernetes.io/component: primary
      app.kubernetes.io/instance: forgejo-valkey
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: valkey
      app.kubernetes.io/part-of: valkey
      helm.toolkit.fluxcd.io/name: forgejo-valkey
      helm.toolkit.fluxcd.io/namespace: flux-system
  spec:
    replicas: 1
    selector:
      matchLabels:
        app.kubernetes.io/component: primary
        app.kubernetes.io/instance: forgejo-valkey
        app.kubernetes.io/name: valkey
    serviceName: forgejo-valkey-headless
    template:
      metadata:
        labels:
          app.kubernetes.io/component: primary
          app.kubernetes.io/instance: forgejo-valkey
          app.kubernetes.io/managed-by: Helm
          app.kubernetes.io/name: valkey
      spec:
        affinity:
          nodeAffinity: null
          podAffinity: null
          podAntiAffinity:
            preferredDuringSchedulingIgnoredDuringExecution:
            - podAffinityTerm:
                labelSelector:
                  matchLabels:
                    app.kubernetes.io/component: primary
                    app.kubernetes.io/instance: forgejo-valkey
                    app.kubernetes.io/name: valkey
                topologyKey: kubernetes.io/hostname
              weight: 1
        automountServiceAccountToken: false
        containers:
        - name: valkey
          image: "registry-1.docker.io/bitnami/valkey:latest"
          imagePullPolicy: IfNotPresent
          args:
          - "-c"
          - /opt/bitnami/scripts/start-scripts/start-primary.sh
          command:
          - /bin/bash
          env:
          - name: BITNAMI_DEBUG
            value: "false"
          - name: VALKEY_REPLICATION_MODE
            value: primary
          - name: ALLOW_EMPTY_PASSWORD
            value: yes
          - name: OPENSSL_FIPS
            value: yes
          - name: VALKEY_TLS_ENABLED
            value: no
          - name: VALKEY_PORT
            value: "6379"
          ports:
          - name: redis
            containerPort: 6379
          resources:
            limits:
              cpu: 150m
              ephemeral-storage: 2Gi
              memory: 192Mi
            requests:
              cpu: 100m
              ephemeral-storage: 50Mi
              memory: 128Mi
          volumeMounts:
          - name: start-scripts
            mountPath: /opt/bitnami/scripts/start-scripts
          - name: health
            mountPath: /health
          - name: valkey-data
            mountPath: /data
          - name: config
            mountPath: /opt/bitnami/valkey/mounted-etc
          - name: empty-dir
            mountPath: /opt/bitnami/valkey/etc/
            subPath: app-conf-dir
          - name: empty-dir
            mountPath: /tmp
            subPath: tmp-dir
          livenessProbe:
            exec:
              command:
              - sh
              - "-c"
              - "/health/ping_liveness_local.sh 5"
            failureThreshold: 5
            initialDelaySeconds: 20
            periodSeconds: 5
            successThreshold: 1
            timeoutSeconds: 6
          readinessProbe:
            exec:
              command:
              - sh
              - "-c"
              - "/health/ping_readiness_local.sh 1"
            failureThreshold: 5
            initialDelaySeconds: 20
            periodSeconds: 5
            successThreshold: 1
            timeoutSeconds: 2
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
              - ALL
            readOnlyRootFilesystem: true
            runAsGroup: 1001
            runAsNonRoot: true
            runAsUser: 1001
            seLinuxOptions: {}
            seccompProfile:
              type: RuntimeDefault
        enableServiceLinks: true
        securityContext:
          fsGroup: 1001
          fsGroupChangePolicy: Always
          supplementalGroups: []
          sysctls: []
        serviceAccountName: forgejo-valkey-primary
        terminationGracePeriodSeconds: 30
        volumes:
        - name: start-scripts
          configMap:
            name: forgejo-valkey-scripts
            defaultMode: 493
        - name: health
          configMap:
            name: forgejo-valkey-health
            defaultMode: 493
        - name: config
          configMap:
            name: forgejo-valkey-configuration
        - name: empty-dir
          emptyDir: {}
    updateStrategy:
      type: RollingUpdate
    volumeClaimTemplates:
    - apiVersion: v1
      kind: PersistentVolumeClaim
      metadata:
        name: valkey-data
        labels:
          app.kubernetes.io/component: primary
          app.kubernetes.io/instance: forgejo-valkey
          app.kubernetes.io/name: valkey
      spec:
        resources:
          requests:
            storage: 8Gi
        storageClassName: longhorn
        accessModes:
        - ReadWriteOnce

(root level)
+ one document added:
  apiVersion: networking.k8s.io/v1
  kind: NetworkPolicy
  metadata:
    name: gitlab-redis
    namespace: gitlab
    labels:
      app.kubernetes.io/instance: gitlab
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: redis
      helm.toolkit.fluxcd.io/name: gitlab
      helm.toolkit.fluxcd.io/namespace: flux-system
  spec:
    egress:
    -   ingress:
    - ports:
      - port: 6379
    - ports:
      - port: 9121
    podSelector:
      matchLabels:
        app.kubernetes.io/instance: gitlab
        app.kubernetes.io/name: redis
    policyTypes:
    - Ingress
    - Egress

(root level)
+ one document added:
  apiVersion: policy/v1beta1
  kind: PodDisruptionBudget
  metadata:
    name: gitlab-gitaly
    namespace: gitlab
    labels:
      app: gitaly
      helm.toolkit.fluxcd.io/name: gitlab
      helm.toolkit.fluxcd.io/namespace: flux-system
      heritage: Helm
      release: gitlab
  spec:
    maxUnavailable: 1
    selector:
      matchLabels:
        app: gitaly
        release: gitlab

(root level)
+ one document added:
  apiVersion: policy/v1beta1
  kind: PodDisruptionBudget
  metadata:
    name: gitlab-gitlab-shell
    namespace: gitlab
    labels:
      app: gitlab-shell
      helm.toolkit.fluxcd.io/name: gitlab
      helm.toolkit.fluxcd.io/namespace: flux-system
      heritage: Helm
      release: gitlab
  spec:
    maxUnavailable: 1
    selector:
      matchLabels:
        app: gitlab-shell
        release: gitlab

(root level)
+ one document added:
  apiVersion: policy/v1beta1
  kind: PodDisruptionBudget
  metadata:
    name: gitlab-kas
    namespace: gitlab
    labels:
      app: kas
      helm.toolkit.fluxcd.io/name: gitlab
      helm.toolkit.fluxcd.io/namespace: flux-system
      heritage: Helm
      release: gitlab
  spec:
    maxUnavailable: 1
    selector:
      matchLabels:
        app: kas
        release: gitlab

(root level)
+ one document added:
  apiVersion: policy/v1beta1
  kind: PodDisruptionBudget
  metadata:
    name: gitlab-sidekiq-all-in-1-v1
    namespace: gitlab
    labels:
      app: sidekiq
      helm.toolkit.fluxcd.io/name: gitlab
      helm.toolkit.fluxcd.io/namespace: flux-system
      heritage: Helm
      release: gitlab
  spec:
    maxUnavailable: 1
    selector:
      matchLabels:
        app: sidekiq
        queue-pod-name: all-in-1
        release: gitlab

(root level)
+ one document added:
  apiVersion: policy/v1beta1
  kind: PodDisruptionBudget
  metadata:
    name: gitlab-webservice-default
    namespace: gitlab
    labels:
      app: webservice
      gitlab.com/webservice-name: default
      helm.toolkit.fluxcd.io/name: gitlab
      helm.toolkit.fluxcd.io/namespace: flux-system
      heritage: Helm
      release: gitlab
  spec:
    maxUnavailable: 1
    selector:
      matchLabels:
        app: webservice
        gitlab.com/webservice-name: default
        release: gitlab

(root level)
+ one document added:
  apiVersion: policy/v1beta1
  kind: PodDisruptionBudget
  metadata:
    name: gitlab-registry-v1
    namespace: gitlab
    labels:
      app: registry
      helm.toolkit.fluxcd.io/name: gitlab
      helm.toolkit.fluxcd.io/namespace: flux-system
      heritage: Helm
      release: gitlab
  spec:
    maxUnavailable: 1
    selector:
      matchLabels:
        app: registry
        release: gitlab

(root level)
+ one document added:
  apiVersion: v1
  kind: ServiceAccount
  metadata:
    name: gitlab-runner-access
    namespace: gitlab
    labels:
      app: gitlab-gitlab-runner
      helm.toolkit.fluxcd.io/name: gitlab
      helm.toolkit.fluxcd.io/namespace: flux-system
      heritage: Helm
      release: gitlab

(root level)
+ one document added:
  apiVersion: v1
  kind: ServiceAccount
  metadata:
    name: gitlab-redis-master
    namespace: gitlab
    labels:
      app.kubernetes.io/instance: gitlab
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: redis
      helm.toolkit.fluxcd.io/name: gitlab
      helm.toolkit.fluxcd.io/namespace: flux-system
  automountServiceAccountToken: false

(root level)
+ one document added:
  apiVersion: v1
  kind: ConfigMap
  metadata:
    name: gitlab-gitlab-runner
    namespace: gitlab
    labels:
      app: gitlab-gitlab-runner
      helm.toolkit.fluxcd.io/name: gitlab
      helm.toolkit.fluxcd.io/namespace: flux-system
      heritage: Helm
      release: gitlab
  data:
    check-live: |
      #!/bin/bash
      set -eou pipefail
      
      # default timeout is 3 seconds, can be overriden
      VERIFY_TIMEOUT=${1:-${VERIFY_TIMEOUT:-3}}
      
      if ! /usr/bin/pgrep -f ".*register-the-runner"  > /dev/null && ! /usr/bin/pgrep -f "gitlab.*runner"  > /dev/null ; then
        exit 1
      fi
      
      status=0
      # empty --url= helps `gitlab-runner verify` select all configured runners (otherwise filters for $CI_SERVER_URL)
      verify_output=$(timeout "${VERIFY_TIMEOUT}" gitlab-runner verify --url= 2>&1) || status=$?
      
      # timeout exit code is 143 with busybox, and 124 with coreutils
      if (( status == 143 )) || (( status == 124 )) ; then
        echo "'gitlab-runner verify' terminated by timeout, not a conclusive failure" >&2
        exit 0
      elif (( status > 0 )) ; then
        exit ${status}
      fi
      
      grep -qE "is (alive|valid)" <<<"${verify_output}"
      
    config.template.toml: |
      [[runners]]
        [runners.kubernetes]
        image = "archlinux/archlinux:latest"
        namespace_per_job = true
        node_selector_overwrite_allowed = "kubernetes.io/arch=.*"
        pull_policy = ["always", "always"]
      
        [runners.kubernetes.node_selector]
        "kubernetes.io/arch" = "amd64"
      
        [runners.cache]
          Type = "s3"
          Path = "gitlab-runner"
          Shared = true
          [runners.cache.s3]
            ServerAddress = "brickyard.home.arpa:3900"
            BucketName = "gitlab-runner-cache"
            BucketLocation = "apartment"
            Insecure = true
            AuthenticationType = "access-key"
            PathStyle = true
      
    config.toml: |
      shutdown_timeout = 0
      concurrent = 10
      check_interval = 3
      log_level = "info"
      
    entrypoint: |
      #!/bin/bash
      set -e
      
      export CONFIG_PATH_FOR_INIT="/home/gitlab-runner/.gitlab-runner/"
      mkdir -p ${CONFIG_PATH_FOR_INIT}
      cp /configmaps/config.toml ${CONFIG_PATH_FOR_INIT}
      
      # Set up environment variables for cache
      if [[ -f /secrets/accesskey && -f /secrets/secretkey ]]; then
        export CACHE_S3_ACCESS_KEY=$(cat /secrets/accesskey)
        export CACHE_S3_SECRET_KEY=$(cat /secrets/secretkey)
      fi
      
      if [[ -f /secrets/gcs-applicaton-credentials-file ]]; then
        export GOOGLE_APPLICATION_CREDENTIALS="/secrets/gcs-applicaton-credentials-file"
      elif [[ -f /secrets/gcs-application-credentials-file ]]; then
        export GOOGLE_APPLICATION_CREDENTIALS="/secrets/gcs-application-credentials-file"
      else
        if [[ -f /secrets/gcs-access-id && -f /secrets/gcs-private-key ]]; then
          export CACHE_GCS_ACCESS_ID=$(cat /secrets/gcs-access-id)
          # echo -e used to make private key multiline (in google json auth key private key is oneline with \n)
          export CACHE_GCS_PRIVATE_KEY=$(echo -e $(cat /secrets/gcs-private-key))
        fi
      fi
      
      if [[ -f /secrets/azure-account-name && -f /secrets/azure-account-key ]]; then
        export CACHE_AZURE_ACCOUNT_NAME=$(cat /secrets/azure-account-name)
        export CACHE_AZURE_ACCOUNT_KEY=$(cat /secrets/azure-account-key)
      fi
      
      if [[ -f /secrets/runner-registration-token ]]; then
        export REGISTRATION_TOKEN=$(cat /secrets/runner-registration-token)
      fi
      
      if [[ -f /secrets/runner-token ]]; then
        export CI_SERVER_TOKEN=$(cat /secrets/runner-token)
      fi
      
      # Register the runner
      if ! sh /configmaps/register-the-runner; then
        exit 1
      fi
      
      # Run pre-entrypoint-script
      if ! bash /configmaps/pre-entrypoint-script; then
        exit 1
      fi
      
      # Start the runner
      exec /entrypoint run \
        --working-directory=/home/gitlab-runner
      
    pre-entrypoint-script: 
    register-the-runner: |
      #!/bin/sh
      signal_handler() {
        if [ ! -d "/proc/$register_pid" ]; then
          wait $register_pid
        fi
        exit
      }
      trap 'signal_handler' QUIT INT
      
      MAX_REGISTER_ATTEMPTS=30
      
      # Reset/unset the not needed flags when an authentication token
      RUN_UNTAGGED=""
      ACCESS_LEVEL=""
      
      if [ -n "$CI_SERVER_TOKEN" ] && [ "${CI_SERVER_TOKEN#glrt-}" != "$CI_SERVER_TOKEN" ]; then
        RUN_UNTAGGED=""
        ACCESS_LEVEL=""
        unset REGISTER_LOCKED
        unset RUNNER_TAG_LIST
      fi
      
      for i in $(seq 1 "${MAX_REGISTER_ATTEMPTS}"); do
        echo "Registration attempt ${i} of ${MAX_REGISTER_ATTEMPTS}"
        /entrypoint register \
          ${RUN_UNTAGGED} \
          ${ACCESS_LEVEL} \
          --template-config /configmaps/config.template.toml \
          --non-interactive &
      
        register_pid=$!
        wait $register_pid
        retval=$?
      
        if [ ${retval} = 0 ]; then
          break
        elif [ ${i} = ${MAX_REGISTER_ATTEMPTS} ]; then
          exit 1
        fi
      
        sleep 5
      done
      
  


(root level)
+ one document added:
  apiVersion: v1
  kind: ConfigMap
  metadata:
    name: gitlab-gitaly
    namespace: gitlab
    labels:
      app: gitaly
      helm.toolkit.fluxcd.io/name: gitlab
      helm.toolkit.fluxcd.io/namespace: flux-system
      heritage: Helm
      release: gitlab
  data:
    config.toml.tpl: |
      # The directory where Gitaly's executables are stored
      bin_dir = "/usr/local/bin"
      
      # listen on a TCP socket. This is insecure (no authentication)
      listen_addr = ":8075"
      
      # Directory where internal sockets reside
      # note: no value will result in a `/tmp/gitlab-internal-*` path
      # internal_socket_dir = "/home/git"
      
      # If metrics collection is enabled, inform gitaly about that
      prometheus_listen_addr = ":9236"
      
      # Graceful shutdown timeout, how long to wait for in-flight requests to complete
      graceful_restart_timeout = "25s"
      
      # Storage configuration
      {% $storages := coll.Slice  "default" %}
      {% $hostid := index (.Env.HOSTNAME | strings.Split "-" | coll.Reverse) 0 %}
      {% $index := 0 %}
      {% if regexp.Match "^[0-9]+$" $hostid %}
        {% $index = conv.ToInt64 $hostid %}
      {% end %}
      {% if len $storages | lt $index %}
      [[storage]]
      name = "{% index $storages $index %}"
      path = "/home/git/repositories"
      {% else %}
      {% printf "Storage for node %d is not present in the storageNames array. Did you use kubectl to scale up? You need to solely use helm for this purpose." $index | fail %}
      {% end %}
      
      [logging]
      format = "json"
      dir = "/var/log/gitaly"
      
      [auth]
      token = {% file.Read "/etc/gitlab-secrets/gitaly/gitaly_token" | strings.TrimSpace | data.ToJSON %}
      
      [git]
      use_bundled_binaries = true
      ignore_gitconfig = true
      
      [gitlab-shell]
      # The directory where gitlab-shell is installed
      dir = "/srv/gitlab-shell"
      
      [gitlab]
      # location of shared secret for GitLab Shell / API interaction
      secret_file = "/etc/gitlab-secrets/shell/.gitlab_shell_secret"
      # URL of API
      url = "http://gitlab-webservice-default.gitlab.svc:8181/"
      
      [gitlab.http-settings]
      # read_timeout = 300
      # user = someone
      # password = somepass
      # ca_file = /etc/ssl/cert.pem
      # ca_path = /etc/pki/tls/certs
      
      [hooks]
      # directory containing custom hooks
      custom_hooks_dir = "/home/git/custom_hooks"
      
    configure: |
      set -e
      mkdir -p /init-secrets/gitaly /init-secrets/shell
      cp -v -r -L /init-config/.gitlab_shell_secret  /init-secrets/shell/.gitlab_shell_secret
      cp -v -r -L /init-config/gitaly_token  /init-secrets/gitaly/gitaly_token
      
  


(root level)
+ one document added:
  apiVersion: v1
  kind: ConfigMap
  metadata:
    name: gitlab-gitlab-exporter
    namespace: gitlab
    labels:
      app: gitlab-exporter
      helm.toolkit.fluxcd.io/name: gitlab
      helm.toolkit.fluxcd.io/namespace: flux-system
      heritage: Helm
      release: gitlab
  data:
    configure: |
      # BEGIN gitlab.scripts.configure.secrets
      set -e
      config_dir="/init-config"
      secret_dir="/init-secrets"
      # optional
      for secret in redis redis-sentinel postgres gitlab-exporter ; do
        if [ -e "${config_dir}/${secret}" ]; then
          mkdir -p "${secret_dir}/${secret}"
          cp -f -v -r -L "${config_dir}/${secret}/." "${secret_dir}/${secret}/"
        fi
      done
      # END gitlab.scripts.configure.secrets
      
    gitlab-exporter.yml.erb: |
      server:
        name: webrick
        listen_address: "*"
        listen_port: 9168
        
      
      probes:
        db_common: &db_common
          methods:
            - probe_db
          opts:
            connection_string: dbname=gitlab-prod user=gitlab host=db-gitlab-rw.gitlab.svc port=5432 password='<%= File.read('/etc/gitlab/postgres/psql-password-main').strip.gsub(/[\'\\]/) { |esc| '\\' + esc } %>'
        database:
          multiple: true
          ci_builds:
            class_name: Database::CiBuildsProber
            <<: *db_common
          tuple_stats:
            class_name: Database::TuplesProber
            <<: *db_common
          rows_count:
            class_name: Database::RowCountProber
            <<: *db_common
        database_bloat:
          class_name: Database::BloatProber
          <<: *db_common
      
        sidekiq: &sidekiq
          methods:
            - probe_queues
            - probe_workers
            - probe_retries
            - probe_stats
          opts:
            redis_url: redis://:<%= ERB::Util::url_encode(File.read("/etc/gitlab/redis/redis-password").strip) %>@gitlab-redis-master.gitlab.svc:6379/0
            redis_enable_client: false
            probe_non_namespaced: true
      
        ruby: &ruby
          methods:
            - probe_gc
          opts:
            quantiles: false
      
        metrics:
          multiple: true
          ruby:
            <<: *ruby
          sidekiq:
            <<: *sidekiq
          ci_builds:
            class_name: Database::CiBuildsProber
            <<: *db_common
          tuple_stats:
            class_name: Database::TuplesProber
            <<: *db_common
          rows_count:
            class_name: Database::RowCountProber
            <<: *db_common
          pg_sequences:
            class_name: Database::PgSequencesProber
            <<: *db_common
      
  


(root level)
+ one document added:
  apiVersion: v1
  kind: ConfigMap
  metadata:
    name: gitlab-gitlab-shell-sshd
    namespace: gitlab
    labels:
      app: gitlab-shell
      helm.toolkit.fluxcd.io/name: gitlab
      helm.toolkit.fluxcd.io/namespace: flux-system
      heritage: Helm
      release: gitlab
  data:
    sshd_config: |
      #	$OpenBSD: sshd_config,v 1.101 2017/03/14 07:19:07 djm Exp $
      
      # This is the sshd server system-wide configuration file.  See
      # sshd_config(5) for more information.
      
      # This sshd was compiled with PATH=/bin:/usr/bin:/sbin:/usr/sbin
      
      # The strategy used for options in the default sshd_config shipped with
      # OpenSSH is to specify options with their default value where
      # possible, but leave them commented.  Uncommented options override the
      # default value.
      
      Port 2222
      #AddressFamily any
      #ListenAddress 0.0.0.0
      #ListenAddress ::
      
      #HostKey /etc/ssh/ssh_host_rsa_key
      #HostKey /etc/ssh/ssh_host_dsa_key
      #HostKey /etc/ssh/ssh_host_ecdsa_key
      #HostKey /etc/ssh/ssh_host_ed25519_key
      
      # Ciphers and keying
      #RekeyLimit default none
      
      # Logging
      #SyslogFacility AUTH
      LogLevel ERROR
      
      # Authentication:
      
      PermitRootLogin no
      #StrictModes yes
      #MaxAuthTries 6
      #MaxSessions 10
      
      #PubkeyAuthentication yes
      
      #AuthorizedPrincipalsFile none
      
      # For this to work you will also need host keys in /etc/ssh/ssh_known_hosts
      #HostbasedAuthentication no
      # Change to yes if you don't trust ~/.ssh/known_hosts for
      # HostbasedAuthentication
      #IgnoreUserKnownHosts no
      # Don't read the user's ~/.rhosts and ~/.shosts files
      #IgnoreRhosts yes
      
      #PermitEmptyPasswords no
      
      # Change to no to disable s/key passwords
      #ChallengeResponseAuthentication yes
      
      # Kerberos options
      #KerberosAuthentication no
      #KerberosOrLocalPasswd yes
      #KerberosTicketCleanup yes
      #KerberosGetAFSToken no
      
      # GSSAPI options
      #GSSAPIAuthentication no
      #GSSAPICleanupCredentials yes
      
      # Set this to 'yes' to enable PAM authentication, account processing,
      # and session processing. If this is enabled, PAM authentication will
      # be allowed through the ChallengeResponseAuthentication and
      # PasswordAuthentication.  Depending on your PAM configuration,
      # PAM authentication via ChallengeResponseAuthentication may bypass
      # the setting of "PermitRootLogin without-password".
      # If you just want the PAM account and session checks to run without
      # PAM authentication, then enable this but set PasswordAuthentication
      # and ChallengeResponseAuthentication to 'no'.
      #UsePAM no
      
      #AllowAgentForwarding yes
      #AllowTcpForwarding yes
      #GatewayPorts no
      #X11Forwarding no
      #X11DisplayOffset 10
      #X11UseLocalhost yes
      #PermitTTY yes
      #PrintMotd yes
      #PrintLastLog yes
      #TCPKeepAlive yes
      #UseLogin no
      #PermitUserEnvironment no
      #Compression delayed
      ClientAliveInterval 0
      #ClientAliveCountMax 3
      #UseDNS no
      PidFile /srv/sshd/sshd.pid
      #PermitTunnel no
      #ChrootDirectory none
      #VersionAddendum none
      
      # no default banner path
      #Banner none
      
      # override default of no subsystems
      # Subsystem	sftp	/usr/lib/ssh/sftp-server
      
      # the following are HPN related configuration options
      # tcp receive buffer polling. disable in non autotuning kernels
      #TcpRcvBufPoll yes
      
      # disable hpn performance boosts
      #HPNDisabled no
      
      # buffer size for hpn to non-hpn connections
      #HPNBufferSize 2048
      
      
      # Example of overriding settings on a per-user basis
      #Match User anoncvs
      #	X11Forwarding no
      #	AllowTcpForwarding no
      #	PermitTTY no
      #	ForceCommand cvs server
      
      # The default is to check both .ssh/authorized_keys and .ssh/authorized_keys2
      # but this is overridden so installations will only check .ssh/authorized_keys
      AuthorizedKeysFile	.ssh/authorized_keys
      
      AuthorizedKeysCommand /authorized_keys %u %k
      AuthorizedKeysCommandUser git
      
      PasswordAuthentication no
      
      AllowUsers git
      
      # Enable the use of Git protcol v2
      AcceptEnv GIT_PROTOCOL
      
      # Hard disable all forwarding
      DisableForwarding yes
      
      # Specifies the maximum number of concurrent unauthenticated connections to the SSH daemon.
      # See `man sshd_config(5)`
      
      MaxStartups 10:30:100
      
      
      # Specifies amount of time athat the server will disconnect after if the user has not successfully logged in
      LoginGraceTime 60
      
      # Includes
      Include /etc/ssh/sshd_config.d/*.conf
      
  


(root level)
+ one document added:
  apiVersion: v1
  kind: ConfigMap
  metadata:
    name: gitlab-gitlab-shell
    namespace: gitlab
    labels:
      app: gitlab-shell
      helm.toolkit.fluxcd.io/name: gitlab
      helm.toolkit.fluxcd.io/namespace: flux-system
      heritage: Helm
      release: gitlab
  data:
    config.yml.tpl: |
      # GitLab user. git by default
      user: git
      
      # Url to gitlab instance. Used for api calls. Should end with a slash.
      gitlab_url: "http://gitlab-webservice-default.gitlab.svc:8181/"
      
      secret_file: /etc/gitlab-secrets/shell/.gitlab_shell_secret
      
      # File used as authorized_keys for gitlab user
      auth_file: "/home/git/.ssh/authorized_keys"
      
      # Log file.
      # Default is gitlab-shell.log in the root directory.
      log_file: "/var/log/gitlab-shell/gitlab-shell.log"
      
      log_format: json
      
      # Audit usernames.
      # Set to true to see real usernames in the logs instead of key ids, which is easier to follow, but
      # incurs an extra API call on every gitlab-shell command.
      audit_usernames: false
      
      
      lfs:
        pure_ssh_protocol: false
      pat:
        enabled: true
        allowed_scopes:
          []
      
    configure: |
      # BEGIN gitlab.scripts.configure.secrets
      set -e
      config_dir="/init-config"
      secret_dir="/init-secrets"
      # required
      for secret in shell ; do
        mkdir -p "${secret_dir}/${secret}"
        cp -f -v -r -L "${config_dir}/${secret}/." "${secret_dir}/${secret}/"
      done
      # END gitlab.scripts.configure.secrets
      mkdir -p /${secret_dir}/ssh
      cp -v -r -L /${config_dir}/ssh_host_* /${secret_dir}/ssh/
      chmod 0400 /${secret_dir}/ssh/ssh_host_*
      
    krb5.conf: 
  


(root level)
+ one document added:
  apiVersion: v1
  kind: ConfigMap
  metadata:
    name: gitlab-nginx-ingress-tcp
    namespace: gitlab
    labels:
      app: gitlab-shell
      helm.toolkit.fluxcd.io/name: gitlab
      helm.toolkit.fluxcd.io/namespace: flux-system
      heritage: Helm
      release: gitlab
  data:
    22222: "gitlab/gitlab-gitlab-shell:22222:PROXY:"

(root level)
+ one document added:
  apiVersion: v1
  kind: ConfigMap
  metadata:
    name: gitlab-kas
    namespace: gitlab
    labels:
      app: kas
      helm.toolkit.fluxcd.io/name: gitlab
      helm.toolkit.fluxcd.io/namespace: flux-system
      heritage: Helm
      release: gitlab
  data:
    config.yaml: |
      agent:
        kubernetes_api:
          listen:
            address: :8154
          url_path_prefix: /k8s-proxy
          websocket_token_secret_file: /etc/kas/.gitlab_kas_websocket_token_secret
        listen:
          address: :8150
          websocket: true
      api:
        listen:
          address: :8153
          authentication_secret_file: /etc/kas/.gitlab_kas_secret
      gitlab:
        address: http://gitlab-webservice-default.gitlab.svc:8181
        authentication_secret_file: /etc/kas/.gitlab_kas_secret
        external_url: https://code.nogweii.net
      observability:
        listen:
          address: :8151
        liveness_probe:
          url_path: /liveness
        readiness_probe:
          url_path: /readiness
      private_api:
        listen:
          address: :8155
          authentication_secret_file: /etc/kas/.gitlab_kas_private_api_secret
      redis:
        database_index: 0
        password_file: /etc/kas/redis/redis-password
        server:
          address: gitlab-redis-master.gitlab.svc:6379
      
  


(root level)
+ one document added:
  apiVersion: v1
  kind: ConfigMap
  metadata:
    name: gitlab-migrations
    namespace: gitlab
    labels:
      app: migrations
      helm.toolkit.fluxcd.io/name: gitlab
      helm.toolkit.fluxcd.io/namespace: flux-system
      heritage: Helm
      release: gitlab
  data:
    cable.yml.erb: |
      production:
        url: redis://:<%= ERB::Util::url_encode(File.read("/etc/gitlab/redis/redis-password").strip) %>@gitlab-redis-master.gitlab.svc:6379/0
        
        id:
        adapter: redis
      
    configure: |
      # BEGIN gitlab.scripts.configure.secrets
      set -e
      config_dir="/init-config"
      secret_dir="/init-secrets"
      # required
      for secret in rails-secrets migrations gitaly ; do
        mkdir -p "${secret_dir}/${secret}"
        cp -f -v -r -L "${config_dir}/${secret}/." "${secret_dir}/${secret}/"
      done
      # optional
      for secret in redis redis-sentinel minio objectstorage postgres ldap duo omniauth smtp kas pages oauth-secrets mailroom gitlab-exporter microsoft_graph_mailer zoekt clickhouse openbao ; do
        if [ -e "${config_dir}/${secret}" ]; then
          mkdir -p "${secret_dir}/${secret}"
          cp -f -v -r -L "${config_dir}/${secret}/." "${secret_dir}/${secret}/"
        fi
      done
      # END gitlab.scripts.configure.secrets
      
    database.yml.erb: |
      
      production:
        main:
          adapter: postgresql
          encoding: unicode
          database: gitlab-prod
          username: gitlab
          password: <%= File.read('/etc/gitlab/postgres/psql-password-main').strip.to_json %>
          host: "db-gitlab-rw.gitlab.svc"
          port: 5432
          connect_timeout: 
          keepalives: 
          keepalives_idle: 
          keepalives_interval: 
          keepalives_count: 
          tcp_user_timeout: 
          application_name: 
          prepared_statements: false
          database_tasks: true
          
          
        ci:
          adapter: postgresql
          encoding: unicode
          database: gitlab-prod
          username: gitlab
          password: <%= File.read('/etc/gitlab/postgres/psql-password-ci').strip.to_json %>
          host: "db-gitlab-rw.gitlab.svc"
          port: 5432
          connect_timeout: 
          keepalives: 
          keepalives_idle: 
          keepalives_interval: 
          keepalives_count: 
          tcp_user_timeout: 
          application_name: 
          prepared_statements: false
          database_tasks: false
          
          
      
    gitlab.yml.erb: |
      production: &base
        gitlab:
          host: code.nogweii.net
          https: true
          signup_enabled: false
        # Consolidated object storage configuration
        ## property local configuration will override object_store
        object_store:
          enabled: true
          proxy_download: true
          connection: <%= YAML.load_file("/etc/gitlab/objectstorage/object_store").to_json() %>
          objects:
            artifacts:
              bucket: gitlab-artifacts
              proxy_download: true
            lfs:
              bucket: gitlab-lfs
              proxy_download: true
            uploads:
              bucket: gitlab-uploads
              proxy_download: true
            packages:
              bucket: gitlab-packages
              proxy_download: true
            external_diffs:
              bucket: gitlab-external-diffs
              proxy_download: true
            terraform_state:
              bucket: gitlab-terraform-state
            dependency_proxy:
              bucket: gitlab-dependency-proxy
              proxy_download: true
            ci_secure_files:
              bucket: gitlab-ci-secure-files
            pages:
              bucket: gitlab-pages
        artifacts:
          enabled: true
        lfs:
          enabled: true
        uploads:
          enabled: true
        packages:
          enabled: true
        external_diffs:
          enabled: true
          when: 
        terraform_state:
          enabled: true
        ci_secure_files:
          enabled: true
        gitaly:
          client_path: /home/git/gitaly/bin
          token: <%= File.read('/etc/gitlab/gitaly/gitaly_token').strip.to_json %>
        repositories:
          storages: # You must have at least a `default` storage path.
            default:
              path: /var/opt/gitlab/repo
              gitaly_address: tcp://gitlab-gitaly-0.gitlab-gitaly.gitlab.svc:8075
            
        
        sidekiq:
          log_format: json
        oidc_provider:
          openid_id_token_expire_in_seconds: 120
        
        
      
    installation_type: |
      gitlab-helm-chart
      
    pages_redirect_uri: "https://projects.aether.page/auth"
    redis.action_cable.yml.erb: |
      production:
        url: redis://:<%= ERB::Util::url_encode(File.read("/etc/gitlab/redis/redis-password").strip) %>@gitlab-redis-master.gitlab.svc:6379/0
        
        id:
      
    resque.yml.erb: |
      production:
        url: redis://:<%= ERB::Util::url_encode(File.read("/etc/gitlab/redis/redis-password").strip) %>@gitlab-redis-master.gitlab.svc:6379/0
        
        id:
      
  


(root level)
+ one document added:
  apiVersion: v1
  kind: ConfigMap
  metadata:
    name: gitlab-sidekiq
    namespace: gitlab
    labels:
      app: sidekiq
      helm.toolkit.fluxcd.io/name: gitlab
      helm.toolkit.fluxcd.io/namespace: flux-system
      heritage: Helm
      release: gitlab
  data:
    cable.yml.erb: |
      production:
        url: redis://:<%= ERB::Util::url_encode(File.read("/etc/gitlab/redis/redis-password").strip) %>@gitlab-redis-master.gitlab.svc:6379/0
        
        id:
        adapter: redis
      
    configure: |
      # BEGIN gitlab.scripts.configure.secrets
      set -e
      config_dir="/init-config"
      secret_dir="/init-secrets"
      # required
      for secret in gitaly registry rails-secrets ; do
        mkdir -p "${secret_dir}/${secret}"
        cp -f -v -r -L "${config_dir}/${secret}/." "${secret_dir}/${secret}/"
      done
      # optional
      for secret in redis redis-sentinel minio objectstorage postgres ldap duo omniauth smtp kas pages oauth-secrets mailroom gitlab-exporter microsoft_graph_mailer zoekt clickhouse openbao ; do
        if [ -e "${config_dir}/${secret}" ]; then
          mkdir -p "${secret_dir}/${secret}"
          cp -f -v -r -L "${config_dir}/${secret}/." "${secret_dir}/${secret}/"
        fi
      done
      # END gitlab.scripts.configure.secrets
      
    database.yml.erb: |
      
      production:
        main:
          adapter: postgresql
          encoding: unicode
          database: gitlab-prod
          username: gitlab
          password: <%= File.read('/etc/gitlab/postgres/psql-password-main').strip.to_json %>
          host: "db-gitlab-rw.gitlab.svc"
          port: 5432
          connect_timeout: 
          keepalives: 
          keepalives_idle: 
          keepalives_interval: 
          keepalives_count: 
          tcp_user_timeout: 
          application_name: 
          prepared_statements: false
          database_tasks: true
          
          
        ci:
          adapter: postgresql
          encoding: unicode
          database: gitlab-prod
          username: gitlab
          password: <%= File.read('/etc/gitlab/postgres/psql-password-ci').strip.to_json %>
          host: "db-gitlab-rw.gitlab.svc"
          port: 5432
          connect_timeout: 
          keepalives: 
          keepalives_idle: 
          keepalives_interval: 
          keepalives_count: 
          tcp_user_timeout: 
          application_name: 
          prepared_statements: false
          database_tasks: false
          
          
      
    gitlab.yml.erb: |
      production: &base
        gitlab:
          host: code.nogweii.net
          https: true
          ssh_host: "code.nogweii.net"
          action_cable_allowed_origins: []
          max_request_duration_seconds: 57
          impersonation_enabled: 
          application_settings_cache_seconds: 60
          usage_ping_enabled: true
          seat_link_enabled: true
          username_changing_enabled: true
          issue_closing_pattern: 
          default_theme: 
          default_projects_features:
            issues: true
            merge_requests: true
            wiki: true
            snippets: true
            builds: true
            container_registry: true
          signup_enabled: false
          graphql_timeout: 
          webhook_timeout: 
          trusted_proxies:
          time_zone: "UTC"        
          email_from: "gitlab@aether.earth"
          email_display_name: "GitLab"
          email_reply_to: "gitlab+noreply@aether.earth"
          email_subject_suffix: ""
        
        gravatar:
          plain_url: 
          ssl_url: 
        extra:
          
          
          
          
          
          
        # Consolidated object storage configuration
        ## property local configuration will override object_store
        object_store:
          enabled: true
          proxy_download: true
          connection: <%= YAML.load_file("/etc/gitlab/objectstorage/object_store").to_json() %>
          objects:
            artifacts:
              bucket: gitlab-artifacts
              proxy_download: true
            lfs:
              bucket: gitlab-lfs
              proxy_download: true
            uploads:
              bucket: gitlab-uploads
              proxy_download: true
            packages:
              bucket: gitlab-packages
              proxy_download: true
            external_diffs:
              bucket: gitlab-external-diffs
              proxy_download: true
            terraform_state:
              bucket: gitlab-terraform-state
            dependency_proxy:
              bucket: gitlab-dependency-proxy
              proxy_download: true
            ci_secure_files:
              bucket: gitlab-ci-secure-files
            pages:
              bucket: gitlab-pages
        artifacts:
          enabled: true
        lfs:
          enabled: true
        uploads:
          enabled: true
        packages:
          enabled: true
        external_diffs:
          enabled: true
          when: 
        terraform_state:
          enabled: true
        ci_secure_files:
          enabled: true
        dependency_proxy:
          enabled: true
        
        sentry:
          enabled: false
          dsn: 
          clientside_dsn: 
          environment: 
        
        sidekiq:
          log_format: json
        oidc_provider:
          openid_id_token_expire_in_seconds: 120
        
        pages:
          enabled: false
          access_control: false
          artifacts_server: true
          path: /srv/gitlab/shared/pages
          host: aether.page
          port: 443
          https: true
          secret_file: /etc/gitlab/pages/secret
          external_http: false
          external_https: false
          local_store:
            enabled: false
            path: 
          namespace_in_path: false
        
        mattermost:
          enabled: false
        ## Registry Integration
        registry:
          enabled: true
          host: c.code.nogweii.net
          api_url: http://gitlab-registry.gitlab.svc:5000
          key: /etc/gitlab/registry/gitlab-registry.key
          issuer: gitlab-issuer
          notification_secret: <%= YAML.load_file("/etc/gitlab/registry/notificationSecret").flatten.first %>
        gitlab_ci:
        ldap:
          enabled: false
        
        omniauth:
          enabled: true
          sync_profile_from_provider: ["openid_connect"]
          sync_profile_attributes: ["email","name"]
          allow_single_sign_on: ["openid_connect"]
          block_auto_created_users: false
          auto_link_ldap_user: false
          auto_link_saml_user: false
          auto_link_user: ["openid_connect"]
          external_providers: []
          providers:
            - <%= YAML.load_file("/etc/gitlab/omniauth/authentik-oidc/config.yaml").to_json() %>
        kerberos:
          enabled: false
          keytab: /etc/krb5.keytab
          use_dedicated_port: false
          port: 8443
          https: true
          simple_ldap_linking_allowed_realms: []
        
        duo_auth:
          enabled: false
          hostname: 
          integration_key: 
          secret_key: 
        
        duo_auth:
          enabled: false
          hostname: 
          integration_key: 
          secret_key: 
        shared:
        gitaly:
          client_path: /home/git/gitaly/bin
          token: <%= File.read('/etc/gitlab/gitaly/gitaly_token').strip.to_json %>
        repositories:
          storages: # You must have at least a `default` storage path.
            default:
              path: /var/opt/gitlab/repo
              gitaly_address: tcp://gitlab-gitaly-0.gitlab-gitaly.gitlab.svc:8075
            
        backup:
          path: "tmp/backups"   # Relative paths are relative to Rails.root (default: tmp/backups/)
        gitlab_kas:
          enabled: true
          secret_file: /etc/gitlab/kas/.gitlab_kas_secret
          external_url: "wss://k.code.nogweii.net"
          internal_url: "grpc://gitlab-kas.gitlab.svc:8153"
          
        
        
        
        # Zoekt secrets are present, load them.
        zoekt:
          username_file: /etc/gitlab/zoekt/.gitlab_zoekt_username
          password_file: /etc/gitlab/zoekt/.gitlab_zoekt_password
        gitlab_shell:
          path: /home/git/gitlab-shell/
          hooks_path: /home/git/gitlab-shell/hooks/
          upload_pack: true
          receive_pack: true
          ssh_port: 22222
        workhorse:
        git:
          bin_path: /usr/bin/git
        webpack:
        monitoring:
          ip_whitelist:
            - "127.0.0.0/8"
            - "::1/128"
          sidekiq_exporter:
            enabled: true
            address: "*"
            port: 3807
            log_enabled: false
          sidekiq_health_checks:
            enabled: true
            address: "*"
            port: 3808
        
      
    installation_type: |
      gitlab-helm-chart
      
    krb5.conf: 
    redis.action_cable.yml.erb: |
      production:
        url: redis://:<%= ERB::Util::url_encode(File.read("/etc/gitlab/redis/redis-password").strip) %>@gitlab-redis-master.gitlab.svc:6379/0
        
        id:
      
    resque.yml.erb: |
      production:
        url: redis://:<%= ERB::Util::url_encode(File.read("/etc/gitlab/redis/redis-password").strip) %>@gitlab-redis-master.gitlab.svc:6379/0
        
        id:
      
    session_store.yml.erb: |
      production:
          session_cookie_token_prefix: ""
      
    smtp_settings.rb: |
      smtp_settings = {
        address: "mail-relay.email.svc.cluster.local",
        port: 587,
        ca_file: "/etc/ssl/certs/ca-certificates.crt",
        
        enable_starttls_auto: false,
        tls: false,
        openssl_verify_mode: "peer",
        open_timeout: 30,
        read_timeout: 60
      }
      
      Rails.application.config.action_mailer.delivery_method = :smtp
      ActionMailer::Base.delivery_method = :smtp
      
      ActionMailer::Base.smtp_settings = smtp_settings
      
  


(root level)
+ one document added:
  apiVersion: v1
  kind: ConfigMap
  metadata:
    name: gitlab-toolbox
    namespace: gitlab
    labels:
      app: toolbox
      helm.toolkit.fluxcd.io/name: gitlab
      helm.toolkit.fluxcd.io/namespace: flux-system
      heritage: Helm
      release: gitlab
  data:
    cable.yml.erb: |
      production:
        url: redis://:<%= ERB::Util::url_encode(File.read("/etc/gitlab/redis/redis-password").strip) %>@gitlab-redis-master.gitlab.svc:6379/0
        
        id:
        adapter: redis
      
    configure: |
      # BEGIN gitlab.scripts.configure.secrets
      set -e
      config_dir="/init-config"
      secret_dir="/init-secrets"
      # required
      for secret in shell gitaly registry rails-secrets ; do
        mkdir -p "${secret_dir}/${secret}"
        cp -f -v -r -L "${config_dir}/${secret}/." "${secret_dir}/${secret}/"
      done
      # optional
      for secret in redis redis-sentinel minio objectstorage postgres ldap duo omniauth smtp kas pages oauth-secrets mailroom gitlab-exporter microsoft_graph_mailer zoekt clickhouse openbao ; do
        if [ -e "${config_dir}/${secret}" ]; then
          mkdir -p "${secret_dir}/${secret}"
          cp -f -v -r -L "${config_dir}/${secret}/." "${secret_dir}/${secret}/"
        fi
      done
      # END gitlab.scripts.configure.secrets
      
      
      if [ ! -f "/${secret_dir}/objectstorage/.s3cfg" ]; then
      cat <<EOF > "/${secret_dir}/.s3cfg"
      [default]
      access_key = $(cat /init-secrets/minio/accesskey)
      secret_key = $(cat /init-secrets/minio/secretkey)
      bucket_location = us-east-1
      host_base = minio.code.nogweii.net
      host_bucket = minio.code.nogweii.net/%(bucket)
      default_mime_type = binary/octet-stream
      enable_multipart = True
      multipart_max_chunks = 10000
      multipart_chunk_size_mb = 128
      recursive = True
      recv_chunk = 65536
      send_chunk = 65536
      server_side_encryption = False
      signature_v2 = True
      socket_timeout = 300
      use_mime_magic = False
      verbosity = WARNING
      website_endpoint = https://minio.code.nogweii.net
      EOF
      else
        mv "/${secret_dir}/objectstorage/.s3cfg" "/${secret_dir}/.s3cfg"
      fi
      
    configure-gsutil: |
      if [ -e "$GOOGLE_APPLICATION_CREDENTIALS" ]; then
        # The following script is used to configure gsutil when creating backups
        # It provides inputs to the `gsutil config -e` prompt as follows:
        # 1) Path to service account JSON key file
        # 2) Do not set permissions for key file
        # 3) GCP Project ID
        # 4) Decline anonymous usage statistics
        printf "$GOOGLE_APPLICATION_CREDENTIALS\nN\n\nN\n" | gsutil config -e
      else
        # If the backup config is not configured, assume that
        # Application Default Credentials are used with a service account.
        # This enables GKE Workload Identity Federation to work.
        echo '[GoogleCompute]\nservice_account = default' > ~/.boto
      fi
      
    database.yml.erb: |
      
      production:
        main:
          adapter: postgresql
          encoding: unicode
          database: gitlab-prod
          username: gitlab
          password: <%= File.read('/etc/gitlab/postgres/psql-password-main').strip.to_json %>
          host: "db-gitlab-rw.gitlab.svc"
          port: 5432
          connect_timeout: 
          keepalives: 
          keepalives_idle: 
          keepalives_interval: 
          keepalives_count: 
          tcp_user_timeout: 
          application_name: 
          prepared_statements: false
          database_tasks: true
          
          
        ci:
          adapter: postgresql
          encoding: unicode
          database: gitlab-prod
          username: gitlab
          password: <%= File.read('/etc/gitlab/postgres/psql-password-ci').strip.to_json %>
          host: "db-gitlab-rw.gitlab.svc"
          port: 5432
          connect_timeout: 
          keepalives: 
          keepalives_idle: 
          keepalives_interval: 
          keepalives_count: 
          tcp_user_timeout: 
          application_name: 
          prepared_statements: false
          database_tasks: false
          
          
      
    gitlab.yml.erb: |
      production: &base
        gitlab:
          host: code.nogweii.net
          https: true
          ssh_host: "code.nogweii.net"
          max_request_duration_seconds: 57
          impersonation_enabled: 
          application_settings_cache_seconds: 60
          usage_ping_enabled: true
          seat_link_enabled: true
          username_changing_enabled: true
          issue_closing_pattern: 
          default_theme: 
          default_projects_features:
            issues: true
            merge_requests: true
            wiki: true
            snippets: true
            builds: true
            container_registry: true
          signup_enabled: false
          graphql_timeout: 
          webhook_timeout: 
          trusted_proxies:
          time_zone: "UTC"        
          email_from: "gitlab@aether.earth"
          email_display_name: "GitLab"
          email_reply_to: "gitlab+noreply@aether.earth"
          email_subject_suffix: ""
        
        # Consolidated object storage configuration
        ## property local configuration will override object_store
        object_store:
          enabled: true
          proxy_download: true
          connection: <%= YAML.load_file("/etc/gitlab/objectstorage/object_store").to_json() %>
          objects:
            artifacts:
              bucket: gitlab-artifacts
              proxy_download: true
            lfs:
              bucket: gitlab-lfs
              proxy_download: true
            uploads:
              bucket: gitlab-uploads
              proxy_download: true
            packages:
              bucket: gitlab-packages
              proxy_download: true
            external_diffs:
              bucket: gitlab-external-diffs
              proxy_download: true
            terraform_state:
              bucket: gitlab-terraform-state
            dependency_proxy:
              bucket: gitlab-dependency-proxy
              proxy_download: true
            ci_secure_files:
              bucket: gitlab-ci-secure-files
            pages:
              bucket: gitlab-pages
        artifacts:
          enabled: true
        lfs:
          enabled: true
        uploads:
          enabled: true
        packages:
          enabled: true
        external_diffs:
          enabled: true
          when: 
        terraform_state:
          enabled: true
        ci_secure_files:
          enabled: true
        dependency_proxy:
          enabled: true
        
        sidekiq:
          log_format: json
        oidc_provider:
          openid_id_token_expire_in_seconds: 120
        
        
        pages:
          enabled: false
          access_control: false
          artifacts_server: true
          path: /srv/gitlab/shared/pages
          host: aether.page
          port: 443
          https: true
          secret_file: /etc/gitlab/pages/secret
          external_http: false
          external_https: false
          local_store:
            enabled: false
            path: 
          namespace_in_path: false
        
        mattermost:
          enabled: false
        ## Registry Integration
        registry:
          enabled: true
          host: c.code.nogweii.net
          api_url: http://gitlab-registry.gitlab.svc:5000
          key: /etc/gitlab/registry/gitlab-registry.key
          issuer: gitlab-issuer
          notification_secret: <%= YAML.load_file("/etc/gitlab/registry/notificationSecret").flatten.first %>
        gitlab_ci:
        ldap:
          enabled: false
        
        omniauth:
          enabled: true
          sync_profile_from_provider: ["openid_connect"]
          sync_profile_attributes: ["email","name"]
          allow_single_sign_on: ["openid_connect"]
          block_auto_created_users: false
          auto_link_ldap_user: false
          auto_link_saml_user: false
          auto_link_user: ["openid_connect"]
          external_providers: []
          providers:
            - <%= YAML.load_file("/etc/gitlab/omniauth/authentik-oidc/config.yaml").to_json() %>
        kerberos:
          enabled: false
          keytab: /etc/krb5.keytab
          use_dedicated_port: false
          port: 8443
          https: true
          simple_ldap_linking_allowed_realms: []
        
        duo_auth:
          enabled: false
          hostname: 
          integration_key: 
          secret_key: 
        shared:
        gitaly:
          client_path: /home/git/gitaly/bin
          token: <%= File.read('/etc/gitlab/gitaly/gitaly_token').strip.to_json %>
        repositories:
          storages: # You must have at least a `default` storage path.
            default:
              path: /var/opt/gitlab/repo
              gitaly_address: tcp://gitlab-gitaly-0.gitlab-gitaly.gitlab.svc:8075
            
        backup:
          path: "tmp/backups"   # Relative paths are relative to Rails.root (default: tmp/backups/)
        gitlab_kas:
          enabled: true
          secret_file: /etc/gitlab/kas/.gitlab_kas_secret
          external_url: "wss://k.code.nogweii.net"
          internal_url: "grpc://gitlab-kas.gitlab.svc:8153"
          
        
        
        
        # Zoekt secrets are present, load them.
        zoekt:
          username_file: /etc/gitlab/zoekt/.gitlab_zoekt_username
          password_file: /etc/gitlab/zoekt/.gitlab_zoekt_password
        gitlab_shell:
          path: /home/git/gitlab-shell/
          hooks_path: /home/git/gitlab-shell/hooks/
          upload_pack: true
          receive_pack: true
          ssh_port: 22222
          secret_file: /etc/gitlab/shell/.gitlab_shell_secret
        workhorse:
        git:
          bin_path: /usr/bin/git
        webpack:
        monitoring:
          ip_whitelist:
            - 127.0.0.0/8
          sidekiq_exporter:
        extra:
        
      
    krb5.conf: 
    redis.action_cable.yml.erb: |
      production:
        url: redis://:<%= ERB::Util::url_encode(File.read("/etc/gitlab/redis/redis-password").strip) %>@gitlab-redis-master.gitlab.svc:6379/0
        
        id:
      
    resque.yml.erb: |
      production:
        url: redis://:<%= ERB::Util::url_encode(File.read("/etc/gitlab/redis/redis-password").strip) %>@gitlab-redis-master.gitlab.svc:6379/0
        
        id:
      
    session_store.yml.erb: |
      production:
          session_cookie_token_prefix: ""
      
    smtp_settings.rb: |
      smtp_settings = {
        address: "mail-relay.email.svc.cluster.local",
        port: 587,
        ca_file: "/etc/ssl/certs/ca-certificates.crt",
        
        enable_starttls_auto: false,
        tls: false,
        openssl_verify_mode: "peer",
        open_timeout: 30,
        read_timeout: 60
      }
      
      Rails.application.config.action_mailer.delivery_method = :smtp
      ActionMailer::Base.delivery_method = :smtp
      
      ActionMailer::Base.smtp_settings = smtp_settings
      
  


(root level)
+ one document added:
  apiVersion: v1
  kind: ConfigMap
  metadata:
    name: gitlab-webservice
    namespace: gitlab
    labels:
      app: webservice
      helm.toolkit.fluxcd.io/name: gitlab
      helm.toolkit.fluxcd.io/namespace: flux-system
      heritage: Helm
      release: gitlab
  data:
    cable.yml.erb: |
      production:
        url: redis://:<%= ERB::Util::url_encode(File.read("/etc/gitlab/redis/redis-password").strip) %>@gitlab-redis-master.gitlab.svc:6379/0
        
        id:
        adapter: redis
      
    configure: |
      # BEGIN gitlab.scripts.configure.secrets
      set -e
      config_dir="/init-config"
      secret_dir="/init-secrets"
      # required
      for secret in shell gitaly registry rails-secrets gitlab-workhorse ; do
        mkdir -p "${secret_dir}/${secret}"
        cp -f -v -r -L "${config_dir}/${secret}/." "${secret_dir}/${secret}/"
      done
      # optional
      for secret in redis redis-sentinel minio objectstorage postgres ldap duo omniauth smtp kas pages oauth-secrets mailroom gitlab-exporter microsoft_graph_mailer zoekt clickhouse openbao ; do
        if [ -e "${config_dir}/${secret}" ]; then
          mkdir -p "${secret_dir}/${secret}"
          cp -f -v -r -L "${config_dir}/${secret}/." "${secret_dir}/${secret}/"
        fi
      done
      # END gitlab.scripts.configure.secrets
    database.yml.erb: |
      
      production:
        main:
          adapter: postgresql
          encoding: unicode
          database: gitlab-prod
          username: gitlab
          password: <%= File.read('/etc/gitlab/postgres/psql-password-main').strip.to_json %>
          host: "db-gitlab-rw.gitlab.svc"
          port: 5432
          connect_timeout: 
          keepalives: 
          keepalives_idle: 
          keepalives_interval: 
          keepalives_count: 
          tcp_user_timeout: 
          application_name: 
          prepared_statements: false
          database_tasks: true
          
          
        ci:
          adapter: postgresql
          encoding: unicode
          database: gitlab-prod
          username: gitlab
          password: <%= File.read('/etc/gitlab/postgres/psql-password-ci').strip.to_json %>
          host: "db-gitlab-rw.gitlab.svc"
          port: 5432
          connect_timeout: 
          keepalives: 
          keepalives_idle: 
          keepalives_interval: 
          keepalives_count: 
          tcp_user_timeout: 
          application_name: 
          prepared_statements: false
          database_tasks: false
          
          
      
    gitlab.yml.erb: |
      production: &base
        gitlab:
          host: code.nogweii.net
          https: true
          ssh_host: "code.nogweii.net"
          action_cable_allowed_origins: []
          max_request_duration_seconds: 57
          impersonation_enabled: 
          application_settings_cache_seconds: 60
          usage_ping_enabled: true
          seat_link_enabled: true
          username_changing_enabled: true
          issue_closing_pattern: 
          default_theme: 
          default_color_mode: 
          default_syntax_highlighting_theme: 
          default_projects_features:
            issues: true
            merge_requests: true
            wiki: true
            snippets: true
            builds: true
            container_registry: true
          signup_enabled: false
          graphql_timeout: 
          webhook_timeout: 
          trusted_proxies:
          time_zone: "UTC"        
          email_from: "gitlab@aether.earth"
          email_display_name: "GitLab"
          email_reply_to: "gitlab+noreply@aether.earth"
          email_subject_suffix: ""
        
        gravatar:
          plain_url: 
          ssl_url: 
        extra:
          
          
          
          
          
          
        # Consolidated object storage configuration
        ## property local configuration will override object_store
        object_store:
          enabled: true
          proxy_download: true
          connection: <%= YAML.load_file("/etc/gitlab/objectstorage/object_store").to_json() %>
          objects:
            artifacts:
              bucket: gitlab-artifacts
              proxy_download: true
            lfs:
              bucket: gitlab-lfs
              proxy_download: true
            uploads:
              bucket: gitlab-uploads
              proxy_download: true
            packages:
              bucket: gitlab-packages
              proxy_download: true
            external_diffs:
              bucket: gitlab-external-diffs
              proxy_download: true
            terraform_state:
              bucket: gitlab-terraform-state
            dependency_proxy:
              bucket: gitlab-dependency-proxy
              proxy_download: true
            ci_secure_files:
              bucket: gitlab-ci-secure-files
            pages:
              bucket: gitlab-pages
        artifacts:
          enabled: true
        lfs:
          enabled: true
        uploads:
          enabled: true
        packages:
          enabled: true
        external_diffs:
          enabled: true
          when: 
        terraform_state:
          enabled: true
        ci_secure_files:
          enabled: true
        dependency_proxy:
          enabled: true
        
        sentry:
          enabled: false
          dsn: 
          clientside_dsn: 
          environment: 
        gitlab_docs:
          enabled: false
          host: ""
        
        sidekiq:
          log_format: json
        oidc_provider:
          openid_id_token_expire_in_seconds: 120
        
        pages:
          enabled: false
          access_control: false
          artifacts_server: true
          path: /srv/gitlab/shared/pages
          host: aether.page
          port: 443
          https: true
          secret_file: /etc/gitlab/pages/secret
          external_http: false
          external_https: false
          local_store:
            enabled: false
            path: 
          namespace_in_path: false
        
        mattermost:
          enabled: false
        gitlab_ci:
        ldap:
          enabled: false
        
        omniauth:
          enabled: true
          sync_profile_from_provider: ["openid_connect"]
          sync_profile_attributes: ["email","name"]
          allow_single_sign_on: ["openid_connect"]
          block_auto_created_users: false
          auto_link_ldap_user: false
          auto_link_saml_user: false
          auto_link_user: ["openid_connect"]
          external_providers: []
          providers:
            - <%= YAML.load_file("/etc/gitlab/omniauth/authentik-oidc/config.yaml").to_json() %>
        kerberos:
          enabled: false
          keytab: /etc/krb5.keytab
          use_dedicated_port: false
          port: 8443
          https: true
          simple_ldap_linking_allowed_realms: []
        
        duo_auth:
          enabled: false
          hostname: 
          integration_key: 
          secret_key: 
        shared:
        gitaly:
          client_path: /home/git/gitaly/bin
          token: <%= File.read('/etc/gitlab/gitaly/gitaly_token').strip.to_json %>
        repositories:
          storages: # You must have at least a `default` storage path.
            default:
              path: /var/opt/gitlab/repo
              gitaly_address: tcp://gitlab-gitaly-0.gitlab-gitaly.gitlab.svc:8075
            
        backup:
          path: "tmp/backups"   # Relative paths are relative to Rails.root (default: tmp/backups/)
        gitlab_kas:
          enabled: true
          secret_file: /etc/gitlab/kas/.gitlab_kas_secret
          external_url: "wss://k.code.nogweii.net"
          internal_url: "grpc://gitlab-kas.gitlab.svc:8153"
          
        
        
        
        # Zoekt secrets are present, load them.
        zoekt:
          username_file: /etc/gitlab/zoekt/.gitlab_zoekt_username
          password_file: /etc/gitlab/zoekt/.gitlab_zoekt_password
        gitlab_shell:
          path: /home/git/gitlab-shell/
          hooks_path: /home/git/gitlab-shell/hooks/
          upload_pack: true
          receive_pack: true
          ssh_port: 22222
          secret_file: /etc/gitlab/shell/.gitlab_shell_secret
        workhorse:
          secret_file: /etc/gitlab/gitlab-workhorse/secret
        git:
          bin_path: /usr/bin/git
        webpack:
        monitoring:
          ip_whitelist:
            - "0.0.0.0/0"
            - "::/0"
          web_exporter:
            enabled: true
            address: "0.0.0.0"
            port: 8083
          sidekiq_exporter:
        shutdown:
          blackout_seconds: <%= ENV["SHUTDOWN_BLACKOUT_SECONDS"] %>
        rack_attack:
          git_basic_auth:
        ## Registry Integration
        registry:
          enabled: true
          host: c.code.nogweii.net
          api_url: http://gitlab-registry.gitlab.svc:5000
          key: /etc/gitlab/registry/gitlab-registry.key
          issuer: gitlab-issuer
          notification_secret: <%= YAML.load_file("/etc/gitlab/registry/notificationSecret").flatten.first %>
        smartcard:
          enabled: false
          ca_file: '/etc/gitlab/rails-secrets/smartcard-ca.crt'
          client_certificate_required_host: smartcard.code.nogweii.net
          client_certificate_required_port: 443
          san_extensions: false
          required_for_git_access: false
        
      
    installation_type: |
      gitlab-helm-chart
      
    krb5.conf: 
    redis.action_cable.yml.erb: |
      production:
        url: redis://:<%= ERB::Util::url_encode(File.read("/etc/gitlab/redis/redis-password").strip) %>@gitlab-redis-master.gitlab.svc:6379/0
        
        id:
      
    resque.yml.erb: |
      production:
        url: redis://:<%= ERB::Util::url_encode(File.read("/etc/gitlab/redis/redis-password").strip) %>@gitlab-redis-master.gitlab.svc:6379/0
        
        id:
      
    session_store.yml.erb: |
      production:
          session_cookie_token_prefix: ""
      
    smtp_settings.rb: |
      smtp_settings = {
        address: "mail-relay.email.svc.cluster.local",
        port: 587,
        ca_file: "/etc/ssl/certs/ca-certificates.crt",
        
        enable_starttls_auto: false,
        tls: false,
        openssl_verify_mode: "peer",
        open_timeout: 30,
        read_timeout: 60
      }
      
      Rails.application.config.action_mailer.delivery_method = :smtp
      ActionMailer::Base.delivery_method = :smtp
      
      ActionMailer::Base.smtp_settings = smtp_settings
      
  


(root level)
+ one document added:
  apiVersion: v1
  kind: ConfigMap
  metadata:
    name: gitlab-workhorse-default
    namespace: gitlab
    labels:
      app: webservice
      helm.toolkit.fluxcd.io/name: gitlab
      helm.toolkit.fluxcd.io/namespace: flux-system
      heritage: Helm
      release: gitlab
  data:
    configure: |
      set -e
      mkdir -p /init-secrets-workhorse/gitlab-workhorse
      cp -v -r -L /init-config/gitlab-workhorse/secret /init-secrets-workhorse/gitlab-workhorse/secret
      mkdir -p /init-secrets-workhorse/redis
      cp -v -r -L /init-config/redis/redis-password /init-secrets-workhorse/redis/
      if [ -f /init-config/objectstorage/object_store ]; then
        mkdir -p /init-secrets-workhorse/objectstorage
        cp -v -r -L /init-config/objectstorage/object_store /init-secrets-workhorse/objectstorage/
      fi
      
    installation_type: |
      gitlab-helm-chart
      
    workhorse-config.toml.tpl: |
      shutdown_timeout = "61s"
      [redis]
      DB = 0
      URL = "redis://gitlab-redis-master.gitlab.svc:6379"
      Password = {% file.Read "/etc/gitlab/redis/redis-password" | strings.TrimSpace | data.ToJSON %}
      {%- $supported_providers := slice "AWS" "AzureRM" "Google" -%}
      {%- $connection := coll.Dict "provider" "" -%}
      {%- if file.Exists "/etc/gitlab/minio/accesskey" %}
        {%- $aws_access_key_id := file.Read "/etc/gitlab/minio/accesskey" | strings.TrimSpace -%}
        {%- $aws_secret_access_key := file.Read "/etc/gitlab/minio/secretkey" | strings.TrimSpace -%}
        {%- $connection = coll.Dict "provider" "AWS" "aws_access_key_id" $aws_access_key_id "aws_secret_access_key" $aws_secret_access_key -%}
      {%- end %}
      {%- if file.Exists "/etc/gitlab/objectstorage/object_store" %}
        {%- $connection = file.Read "/etc/gitlab/objectstorage/object_store" | strings.TrimSpace | data.YAML -%}
      {%- end %}
      {%- if has $supported_providers $connection.provider %}
      [object_storage]
      provider = "{% $connection.provider %}"
      {%-   if eq $connection.provider "AWS" %}
      {%-     $connection = coll.Merge $connection (coll.Dict "aws_access_key_id" "" "aws_secret_access_key" "" ) %}
      # AWS / S3 object storage configuration.
      [object_storage.s3]
      # access/secret can be blank!
      aws_access_key_id = {% $connection.aws_access_key_id | strings.TrimSpace | data.ToJSON %}
      aws_secret_access_key = {% $connection.aws_secret_access_key | strings.TrimSpace | data.ToJSON %}
      {%-   else if eq $connection.provider "AzureRM" %}
      {%-     $connection = coll.Merge $connection (coll.Dict "azure_storage_account_name" "" "azure_storage_access_key" "") %}
      # Azure Blob storage configuration.
      [object_storage.azurerm]
      azure_storage_account_name = {% $connection.azure_storage_account_name | strings.TrimSpace | data.ToJSON %}
      azure_storage_access_key = {% $connection.azure_storage_access_key | strings.TrimSpace | data.ToJSON %}
      {%-   else if eq $connection.provider "Google" %}
      # Google storage configuration.
      [object_storage.google]
      {% $connection | coll.Omit "provider" | data.ToTOML %}
      {%-   end %}
      {%- end %}
      [image_resizer]
      max_scaler_procs = 2
      max_filesize = 250000
      [[listeners]]
      network = "tcp"
      addr = ":8181"
      
  


(root level)
+ one document added:
  apiVersion: v1
  kind: ConfigMap
  metadata:
    name: gitlab-webservice-tests
    namespace: gitlab
    labels:
      app: webservice
      helm.toolkit.fluxcd.io/name: gitlab
      helm.toolkit.fluxcd.io/namespace: flux-system
      heritage: Helm
      release: gitlab
  data:
    test_login: |
      set -e
      echo 'Start Test'
      endpoint="https://code.nogweii.net"
      cookie_read="-c /tmp/test_login.cookie"
      cookie_readwrite="$cookie_read -b /tmp/test_login.cookie"
      
      signin_url="$endpoint/users/sign_in"
      echo "Login to create a session: $signin_url"
      csrf=$(curl -L $signin_url --fail -s $cookie_read | grep -Po '<meta.*name="csrf-token".*content="\K[a-zA-Z0-9\+=\-\/]*')
      curl -X POST $signin_url -s $cookie_readwrite -F "authenticity_token=$csrf" -F 'user[login]=root' -F "user[password]=$(cat /initial_root_password)"
      
      profile_url="$endpoint/-/profile"
      echo "Confirm session valid: $profile_url"
      profile_status=$(curl -L -s -o /tmp/profile_output -w "%{http_code}" $cookie_readwrite $profile_url)
      
      if [ "$profile_status" != "200" ]; then
        echo "Error: Session Invalid"
        cat /tmp/profile_output
        exit 1
      fi
      
      echo 'Test Passed'
      exit 0
      
  


(root level)
+ one document added:
  apiVersion: v1
  kind: ConfigMap
  metadata:
    name: gitlab-redis-configuration
    namespace: gitlab
    labels:
      app.kubernetes.io/instance: gitlab
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: redis
      helm.toolkit.fluxcd.io/name: gitlab
      helm.toolkit.fluxcd.io/namespace: flux-system
  data:
    master.conf: |
      dir /data
      # User-supplied master configuration:
      rename-command FLUSHDB ""
      rename-command FLUSHALL ""
      # End of master configuration
    redis.conf: |
      # User-supplied common configuration:
      # Enable AOF https://redis.io/topics/persistence#append-only-file
      appendonly yes
      # Disable RDB persistence, AOF persistence already enabled.
      save ""
      # End of common configuration
    replica.conf: |
      dir /data
      # User-supplied replica configuration:
      rename-command FLUSHDB ""
      rename-command FLUSHALL ""
      # End of replica configuration

(root level)
+ one document added:
  apiVersion: v1
  kind: ConfigMap
  metadata:
    name: gitlab-redis-health
    namespace: gitlab
    labels:
      app.kubernetes.io/instance: gitlab
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: redis
      helm.toolkit.fluxcd.io/name: gitlab
      helm.toolkit.fluxcd.io/namespace: flux-system
  data:
    ping_liveness_local.sh: |
      #!/bin/bash
      
      [[ -f $REDIS_PASSWORD_FILE ]] && export REDIS_PASSWORD="$(< "${REDIS_PASSWORD_FILE}")"
      [[ -n "$REDIS_PASSWORD" ]] && export REDISCLI_AUTH="$REDIS_PASSWORD"
      response=$(
        timeout -s 15 $1 \
        redis-cli \
          -h localhost \
          -p $REDIS_PORT \
          ping
      )
      if [ "$?" -eq "124" ]; then
        echo "Timed out"
        exit 1
      fi
      responseFirstWord=$(echo $response | head -n1 | awk '{print $1;}')
      if [ "$response" != "PONG" ] && [ "$responseFirstWord" != "LOADING" ] && [ "$responseFirstWord" != "MASTERDOWN" ]; then
        echo "$response"
        exit 1
      fi
    ping_liveness_local_and_master.sh: |
      script_dir="$(dirname "$0")"
      exit_status=0
      "$script_dir/ping_liveness_local.sh" $1 || exit_status=$?
      "$script_dir/ping_liveness_master.sh" $1 || exit_status=$?
      exit $exit_status
    ping_liveness_master.sh: |
      #!/bin/bash
      
      [[ -f $REDIS_MASTER_PASSWORD_FILE ]] && export REDIS_MASTER_PASSWORD="$(< "${REDIS_MASTER_PASSWORD_FILE}")"
      [[ -n "$REDIS_MASTER_PASSWORD" ]] && export REDISCLI_AUTH="$REDIS_MASTER_PASSWORD"
      response=$(
        timeout -s 15 $1 \
        redis-cli \
          -h $REDIS_MASTER_HOST \
          -p $REDIS_MASTER_PORT_NUMBER \
          ping
      )
      if [ "$?" -eq "124" ]; then
        echo "Timed out"
        exit 1
      fi
      responseFirstWord=$(echo $response | head -n1 | awk '{print $1;}')
      if [ "$response" != "PONG" ] && [ "$responseFirstWord" != "LOADING" ]; then
        echo "$response"
        exit 1
      fi
    ping_readiness_local.sh: |
      #!/bin/bash
      
      [[ -f $REDIS_PASSWORD_FILE ]] && export REDIS_PASSWORD="$(< "${REDIS_PASSWORD_FILE}")"
      [[ -n "$REDIS_PASSWORD" ]] && export REDISCLI_AUTH="$REDIS_PASSWORD"
      response=$(
        timeout -s 15 $1 \
        redis-cli \
          -h localhost \
          -p $REDIS_PORT \
          ping
      )
      if [ "$?" -eq "124" ]; then
        echo "Timed out"
        exit 1
      fi
      if [ "$response" != "PONG" ]; then
        echo "$response"
        exit 1
      fi
    ping_readiness_local_and_master.sh: |
      script_dir="$(dirname "$0")"
      exit_status=0
      "$script_dir/ping_readiness_local.sh" $1 || exit_status=$?
      "$script_dir/ping_readiness_master.sh" $1 || exit_status=$?
      exit $exit_status
    ping_readiness_master.sh: |
      #!/bin/bash
      
      [[ -f $REDIS_MASTER_PASSWORD_FILE ]] && export REDIS_MASTER_PASSWORD="$(< "${REDIS_MASTER_PASSWORD_FILE}")"
      [[ -n "$REDIS_MASTER_PASSWORD" ]] && export REDISCLI_AUTH="$REDIS_MASTER_PASSWORD"
      response=$(
        timeout -s 15 $1 \
        redis-cli \
          -h $REDIS_MASTER_HOST \
          -p $REDIS_MASTER_PORT_NUMBER \
          ping
      )
      if [ "$?" -eq "124" ]; then
        echo "Timed out"
        exit 1
      fi
      if [ "$response" != "PONG" ]; then
        echo "$response"
        exit 1
      fi
  


(root level)
+ one document added:
  apiVersion: v1
  kind: ConfigMap
  metadata:
    name: gitlab-redis-scripts
    namespace: gitlab
    labels:
      app.kubernetes.io/instance: gitlab
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: redis
      helm.toolkit.fluxcd.io/name: gitlab
      helm.toolkit.fluxcd.io/namespace: flux-system
  data:
    start-master.sh: |
      #!/bin/bash
      
      [[ -f $REDIS_PASSWORD_FILE ]] && export REDIS_PASSWORD="$(< "${REDIS_PASSWORD_FILE}")"
      if [[ -f /opt/bitnami/redis/mounted-etc/master.conf ]];then
          cp /opt/bitnami/redis/mounted-etc/master.conf /opt/bitnami/redis/etc/master.conf
      fi
      if [[ -f /opt/bitnami/redis/mounted-etc/redis.conf ]];then
          cp /opt/bitnami/redis/mounted-etc/redis.conf /opt/bitnami/redis/etc/redis.conf
      fi
      ARGS=("--port" "${REDIS_PORT}")
      ARGS+=("--requirepass" "${REDIS_PASSWORD}")
      ARGS+=("--masterauth" "${REDIS_PASSWORD}")
      ARGS+=("--include" "/opt/bitnami/redis/etc/redis.conf")
      ARGS+=("--include" "/opt/bitnami/redis/etc/master.conf")
      exec redis-server "${ARGS[@]}"
  


(root level)
+ one document added:
  apiVersion: v1
  kind: ConfigMap
  metadata:
    name: gitlab-registry
    namespace: gitlab
    labels:
      app: registry
      helm.toolkit.fluxcd.io/name: gitlab
      helm.toolkit.fluxcd.io/namespace: flux-system
      heritage: Helm
      release: gitlab
  data:
    config.yml.tpl: |
      version: 0.1
      log:
        fields:
          service: registry
        level: info
      http:
        addr: :5000
        # `host` is not configurable
        # `prefix` is not configurable
        debug:
          addr: :5001
          prometheus:
            enabled: false
            path: /metrics
        draintimeout: 0
        headers:
          X-Content-Type-Options: [nosniff]
        secret: "HTTP_SECRET"
        relativeurls: false
      health:
        storagedriver:
          enabled: false
          interval: 10s
          threshold: 3
      auth:
        token:
          realm: https://code.nogweii.net/jwt/auth
          service: container_registry
          issuer: gitlab-issuer
          # This is provided from the initContainer execution, at a known path.
          rootcertbundle: /etc/docker/registry/certificate.crt
          autoredirect: false
      validation:
        disabled: true
        manifests:
          referencelimit: 0
          payloadsizelimit: 0
          urls:
            allow:
            deny:
      
      notifications:
      reporting:
      profiling:
      storage:
        maintenance:
          readonly:
            enabled: false
          uploadpurging:
            enabled: true
            age: 168h
            interval: 24h
            dryrun: false
        redirect:
          disable: true
          exceptions:
      middleware:
      
      database:
        enabled: true
        host: "db-gitlab-rw.gitlab.svc"
        port: 5432
        user: registry
        password: "DB_PASSWORD_FILE"
        dbname: gl-registry
        sslmode: disable
      gc:
        disabled: false
      redis:
      rate_limiter:
        enabled: false
      
    configure: |
      if [ -e /config/accesskey ] ; then
        sed -i -e 's@ACCESS_KEY@'"$(cat /config/accesskey)"'@' -e 's@SECRET_KEY@'"$(cat /config/secretkey)"'@' /registry/config.yml
      fi
      # Place the `http.secret` value from the kubernetes secret
      sed -i -e 's@HTTP_SECRET@'"$(cat /config/httpSecret)"'@' /registry/config.yml
      # Populate sensitive registry notification secrets in the config file
      if [ -d /config/notifications ]; then
        for i in /config/notifications/*; do
          filename=$(basename $i);
          sed -i -e 's@'"${filename}"'@'"$(cat $i)"'@' /registry/config.yml;
        done
      fi
      # Insert any provided `storage` block from kubernetes secret
      if [ -d /config/storage ]; then
        # Copy contents of storage secret(s)
        mkdir -p /registry/storage
        cp -v -r -L /config/storage/* /registry/storage/
        # Ensure there is a new line in the end
        echo '' >> /registry/storage/config
        # Default `delete.enabled: true` if not present.
        ## Note: busybox grep doesn't support multiline, so we chain `egrep`.
        if ! $(egrep -A1 '^delete:\s*$' /registry/storage/config | egrep -q '\s{2,4}enabled:') ; then
          echo 'delete:' >> /registry/storage/config
          echo '  enabled: true' >> /registry/storage/config
        fi
        # Indent /registry/storage/config 2 spaces before inserting into config.yml
        sed -i 's/^/  /' /registry/storage/config
        # Insert into /registry/config.yml after `storage:`
        sed -i '/^storage:/ r /registry/storage/config' /registry/config.yml
        # Remove the now extraneous `config` file
        rm /registry/storage/config
      fi
      # Copy any middleware.storage if present
      if [ -d /config/middleware.storage ]; then
        cp -v -r -L /config/middleware.storage  /registry/middleware.storage
      fi
      # Set to known path, to used ConfigMap
      cat /config/certificate.crt > /registry/certificate.crt
      # Copy the optional profiling keyfile to the expected location
      if [ -f /config/profiling-key.json ]; then
        cp /config/profiling-key.json /registry/profiling-key.json
      fi
      # Insert Database password, if enabled
      if [ -f /config/database_password ] ; then
        sed -i -e 's@DB_PASSWORD_FILE@'"$(cat /config/database_password)"'@' /registry/config.yml
      fi
      # Insert Redis(cache) password, if enabled
      if [ -f /config/registry/redis-password ] ; then
        sed -i -e 's@REDIS_CACHE_PASSWORD@'"$(cat /config/registry/redis-password)"'@' /registry/config.yml
      fi
      # Insert Redis(rate-limiter) password, if enabled
      if [ -f /config/registry/redis-rateLimiting-password ] ; then
        sed -i -e 's@REDIS_RATE_LIMITING_PASSWORD@'"$(cat /config/registry/redis-rateLimiting-password)"'@' /registry/config.yml
      fi
      # Insert Redis(load balancing) password, if enabled
      if [ -f /config/registry/redis-loadBalancing-password ] ; then
        sed -i -e 's@REDIS_LOAD_BALANCING_PASSWORD@'"$(cat /config/registry/redis-loadBalancing-password)"'@' /registry/config.yml
      fi
      # Copy the database TLS connection files to the expected location and set permissions
      if [ -d /config/ssl ]; then
        cp -r /config/ssl/ /registry/ssl
        chmod 700 /registry/ssl
        chmod 600 /registry/ssl/*.pem
      fi
      # Copy TLS certificates if present
      if [ -d /config/tls ]; then
        cp -r /config/tls/ /registry/tls
        chmod 700 /registry/tls
        chmod 600 /registry/tls/*
      fi
    migrations-config.yml.tpl: |
      version: 0.1
      log:
        fields:
          service: registry
        level: info
      
      database:
        enabled: true
        host: "db-gitlab-rw.gitlab.svc"
        port: 5432
        user: registry
        password: "DB_PASSWORD_FILE"
        dbname: gl-registry
        sslmode: disable
  


(root level)
+ one document added:
  apiVersion: v1
  kind: ConfigMap
  metadata:
    name: gitlab-gitlab-chart-info
    namespace: gitlab
    labels:
      app: gitlab
      helm.toolkit.fluxcd.io/name: gitlab
      helm.toolkit.fluxcd.io/namespace: flux-system
      heritage: Helm
      release: gitlab
  data:
    gitlabChartVersion: "9.8.2"
    gitlabVersion: "18.8.2"

(root level)
+ one document added:
  apiVersion: rbac.authorization.k8s.io/v1
  kind: ClusterRole
  metadata:
    name: gitlab-gitlab-runner
    labels:
      app: gitlab-gitlab-runner
      helm.toolkit.fluxcd.io/name: gitlab
      helm.toolkit.fluxcd.io/namespace: flux-system
      heritage: Helm
      release: gitlab
  rules:
  - resources:
    - events
    apiGroups:
    -
    verbs:
    - list
    - watch
  - resources:
    - namespaces
    apiGroups:
    -
    verbs:
    - create
    - delete
  - resources:
    - pods
    apiGroups:
    -
    verbs:
    - create
    - delete
    - get
    - list
    - watch
  - resources:
    - pods/attach
    - pods/exec
    apiGroups:
    -
    verbs:
    - get
    - create
    - patch
    - delete
  - resources:
    - pods/log
    apiGroups:
    -
    verbs:
    - get
    - list
  - resources:
    - secrets
    apiGroups:
    -
    verbs:
    - create
    - delete
    - get
    - update
  - resources:
    - serviceaccounts
    apiGroups:
    -
    verbs:
    - get
  - resources:
    - services
    apiGroups:
    -
    verbs:
    - create
    - get

(root level)
+ one document added:
  apiVersion: rbac.authorization.k8s.io/v1
  kind: ClusterRoleBinding
  metadata:
    name: gitlab-gitlab-runner
    labels:
      app: gitlab-gitlab-runner
      helm.toolkit.fluxcd.io/name: gitlab
      helm.toolkit.fluxcd.io/namespace: flux-system
      heritage: Helm
      release: gitlab
  roleRef:
    name: gitlab-gitlab-runner
    apiGroup: rbac.authorization.k8s.io
    kind: ClusterRole
  subjects:
  - name: gitlab-runner-access
    kind: ServiceAccount
    namespace: gitlab

(root level)
+ one document added:
  apiVersion: v1
  kind: Service
  metadata:
    name: gitlab-gitaly
    namespace: gitlab
    labels:
      app: gitaly
      helm.toolkit.fluxcd.io/name: gitlab
      helm.toolkit.fluxcd.io/namespace: flux-system
      heritage: Helm
      release: gitlab
  spec:
    type: ClusterIP
    clusterIP: None
    selector:
      app: gitaly
      release: gitlab
    ports:
    - name: tcp-gitaly
      port: 8075
      targetPort: grpc-gitaly
    - name: http-metrics
      port: 9236
      targetPort: http-metrics

(root level)
+ one document added:
  apiVersion: v1
  kind: Service
  metadata:
    name: gitlab-gitlab-exporter
    namespace: gitlab
    labels:
      app: gitlab-exporter
      helm.toolkit.fluxcd.io/name: gitlab
      helm.toolkit.fluxcd.io/namespace: flux-system
      heritage: Helm
      release: gitlab
  spec:
    type: ClusterIP
    selector:
      app: gitlab-exporter
      release: gitlab
    ports:
    - name: http-metrics
      port: 9168
      protocol: TCP
      targetPort: http-metrics

(root level)
+ one document added:
  apiVersion: v1
  kind: Service
  metadata:
    name: gitlab-gitlab-shell
    namespace: gitlab
    annotations:
      tailscale.com/expose: "true"
      tailscale.com/hostname: gitlab-shell
    labels:
      app: gitlab-shell
      helm.toolkit.fluxcd.io/name: gitlab
      helm.toolkit.fluxcd.io/namespace: flux-system
      heritage: Helm
      release: gitlab
  spec:
    type: ClusterIP
    selector:
      app: gitlab-shell
      release: gitlab
    ports:
    - name: ssh
      port: 22222
      protocol: TCP
      targetPort: 2222

(root level)
+ one document added:
  apiVersion: v1
  kind: Service
  metadata:
    name: gitlab-kas
    namespace: gitlab
    labels:
      app: kas
      helm.toolkit.fluxcd.io/name: gitlab
      helm.toolkit.fluxcd.io/namespace: flux-system
      heritage: Helm
      release: gitlab
  spec:
    type: ClusterIP
    selector:
      app: kas
      release: gitlab
    ports:
    - name: tcp-kas-external-api
      port: 8150
      protocol: TCP
      targetPort: 8150
    - name: tcp-kas-internal-api
      port: 8153
      protocol: TCP
      targetPort: 8153
    - name: tcp-kas-k8s-api
      port: 8154
      protocol: TCP
      targetPort: 8154
    - name: http-metrics
      port: 8151
      protocol: TCP
      targetPort: http-metrics

(root level)
+ one document added:
  apiVersion: v1
  kind: Service
  metadata:
    name: gitlab-webservice-default
    namespace: gitlab
    labels:
      app: webservice
      gitlab.com/webservice-name: default
      helm.toolkit.fluxcd.io/name: gitlab
      helm.toolkit.fluxcd.io/namespace: flux-system
      heritage: Helm
      release: gitlab
  spec:
    type: ClusterIP
    selector:
      app: webservice
      gitlab.com/webservice-name: default
      release: gitlab
    ports:
    - name: http-webservice
      port: 8080
      protocol: TCP
      targetPort: http-webservice
    - name: http-workhorse
      port: 8181
      protocol: TCP
      targetPort: http-workhorse
    - name: http-metrics-ws
      port: 8083
      protocol: TCP
      targetPort: http-metrics-ws

(root level)
+ one document added:
  apiVersion: v1
  kind: Service
  metadata:
    name: gitlab-redis-headless
    namespace: gitlab
    labels:
      app.kubernetes.io/instance: gitlab
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: redis
      helm.toolkit.fluxcd.io/name: gitlab
      helm.toolkit.fluxcd.io/namespace: flux-system
  spec:
    type: ClusterIP
    clusterIP: None
    selector:
      app.kubernetes.io/instance: gitlab
      app.kubernetes.io/name: redis
    ports:
    - name: tcp-redis
      port: 6379
      targetPort: redis

(root level)
+ one document added:
  apiVersion: v1
  kind: Service
  metadata:
    name: gitlab-redis-master
    namespace: gitlab
    labels:
      app.kubernetes.io/component: master
      app.kubernetes.io/instance: gitlab
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: redis
      helm.toolkit.fluxcd.io/name: gitlab
      helm.toolkit.fluxcd.io/namespace: flux-system
  spec:
    type: ClusterIP
    internalTrafficPolicy: Cluster
    sessionAffinity: None
    selector:
      app.kubernetes.io/component: master
      app.kubernetes.io/instance: gitlab
      app.kubernetes.io/name: redis
    ports:
    - name: tcp-redis
      nodePort: null
      port: 6379
      targetPort: redis

(root level)
+ one document added:
  apiVersion: v1
  kind: Service
  metadata:
    name: gitlab-redis-metrics
    namespace: gitlab
    labels:
      app.kubernetes.io/component: metrics
      app.kubernetes.io/instance: gitlab
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: redis
      helm.toolkit.fluxcd.io/name: gitlab
      helm.toolkit.fluxcd.io/namespace: flux-system
  spec:
    type: ClusterIP
    selector:
      app.kubernetes.io/instance: gitlab
      app.kubernetes.io/name: redis
    ports:
    - name: http-metrics
      port: 9121
      protocol: TCP
      targetPort: metrics

(root level)
+ one document added:
  apiVersion: v1
  kind: Service
  metadata:
    name: gitlab-registry
    namespace: gitlab
    labels:
      app: registry
      helm.toolkit.fluxcd.io/name: gitlab
      helm.toolkit.fluxcd.io/namespace: flux-system
      heritage: Helm
      release: gitlab
  spec:
    type: ClusterIP
    selector:
      app: registry
      release: gitlab
    ports:
    - name: http-registry
      port: 5000
      protocol: TCP
      targetPort: http

(root level)
+ one document added:
  apiVersion: apps/v1
  kind: Deployment
  metadata:
    name: gitlab-gitlab-runner
    namespace: gitlab
    labels:
      app: gitlab-gitlab-runner
      helm.toolkit.fluxcd.io/name: gitlab
      helm.toolkit.fluxcd.io/namespace: flux-system
      heritage: Helm
      release: gitlab
  spec:
    revisionHistoryLimit: 10
    selector:
      matchLabels:
        app: gitlab-gitlab-runner
    template:
      metadata:
        annotations:
          gitlab.com/prometheus_port: "9252"
          gitlab.com/prometheus_scrape: "true"
        labels:
          app: gitlab-gitlab-runner
          heritage: Helm
          release: gitlab
      spec:
        containers:
        - name: gitlab-gitlab-runner
          image: "registry.gitlab.com/gitlab-org/gitlab-runner:alpine-v18.7.2"
          imagePullPolicy: IfNotPresent
          resources: {}
          command:
          - /usr/bin/dumb-init
          - "--"
          - /bin/bash
          - /configmaps/entrypoint
          ports:
          - name: metrics
            containerPort: 9252
          volumeMounts:
          - name: projected-secrets
            mountPath: /secrets
          - name: etc-gitlab-runner
            mountPath: /home/gitlab-runner/.gitlab-runner
          - name: configmaps
            mountPath: /configmaps
          livenessProbe:
            exec:
              command:
              - /bin/bash
              - /configmaps/check-live
              - "3"
            failureThreshold: 3
            initialDelaySeconds: 60
            periodSeconds: 60
            successThreshold: 1
            timeoutSeconds: 4
          readinessProbe:
            exec:
              command:
              - /usr/bin/pgrep
              - "gitlab.*runner"
            failureThreshold: 3
            initialDelaySeconds: 60
            periodSeconds: 60
            successThreshold: 1
            timeoutSeconds: 4
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
              - ALL
            privileged: false
            readOnlyRootFilesystem: false
            runAsNonRoot: true
          env:
          - name: CI_SERVER_URL
            value: "https://code.nogweii.net"
          - name: RUNNER_EXECUTOR
            value: kubernetes
          - name: REGISTER_LOCKED
            value: "false"
          - name: RUNNER_TAG_LIST
            value:
          - name: KUBERNETES_NAMESPACE
            value: gitlab
          - name: CACHE_S3_ACCESS_KEY
            valueFrom:
              secretKeyRef:
                name: gitlab-object-store-configs
                key: runner_access_key_id
          - name: CACHE_S3_SECRET_KEY
            valueFrom:
              secretKeyRef:
                name: gitlab-object-store-configs
                key: runner_secret_access_key
          - name: SESSION_SERVER_ADDRESS
            value: null
          lifecycle:
            preStop:
              exec:
                command:
                - /entrypoint
                - unregister
                - "--all-runners"
        securityContext:
          fsGroup: 65533
          runAsUser: 100
          seccompProfile:
            type: RuntimeDefault
        serviceAccountName: gitlab-runner-access
        terminationGracePeriodSeconds: 3600
        volumes:
        - name: runner-secrets
          emptyDir:
            medium: Memory
        - name: etc-gitlab-runner
          emptyDir:
            medium: Memory
        - name: projected-secrets
          projected:
            sources:
            - secret:
                name: gitlab-gitlab-runner-secret
                items:
                - key: runner-registration-token
                  path: runner-registration-token
                - key: runner-token
                  path: runner-token
        - name: configmaps
          configMap:
            name: gitlab-gitlab-runner

(root level)
+ one document added:
  apiVersion: apps/v1
  kind: Deployment
  metadata:
    name: gitlab-gitlab-exporter
    namespace: gitlab
    labels:
      app: gitlab-exporter
      app.kubernetes.io/name: gitlab
      helm.toolkit.fluxcd.io/name: gitlab
      helm.toolkit.fluxcd.io/namespace: flux-system
      heritage: Helm
      release: gitlab
  spec:
    replicas: 1
    selector:
      matchLabels:
        app: gitlab-exporter
        release: gitlab
    template:
      metadata:
        annotations:
          gitlab.com/prometheus_path: /metrics
          gitlab.com/prometheus_port: "9168"
          gitlab.com/prometheus_scrape: "true"
          prometheus.io/path: /metrics
          prometheus.io/port: "9168"
          prometheus.io/scrape: "true"
        labels:
          app: gitlab-exporter
          app.kubernetes.io/name: gitlab
          heritage: Helm
          release: gitlab
      spec:
        affinity:
          podAntiAffinity:
            preferredDuringSchedulingIgnoredDuringExecution:
            - podAffinityTerm:
                labelSelector:
                  matchLabels:
                    app: gitlab-exporter
                    release: gitlab
                topologyKey: kubernetes.io/hostname
              weight: 1
        automountServiceAccountToken: false
        containers:
        - name: gitlab-exporter
          image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-exporter:16.2.0"
          env:
          - name: TZ
            value: UTC
          - name: CONFIG_TEMPLATE_DIRECTORY
            value: /var/opt/gitlab-exporter/templates
          - name: CONFIG_DIRECTORY
            value: /etc/gitlab-exporter
          - name: MALLOC_CONF
            value: "dirty_decay_ms:0,muzzy_decay_ms:0"
          - name: RUBY_GC_HEAP_FREE_SLOTS_MAX_RATIO
            value: "0.111"
          - name: RUBY_GC_HEAP_FREE_SLOTS_MIN_RATIO
            value: "0.055"
          - name: RUBY_GC_HEAP_INIT_SLOTS
            value: "80000"
          ports:
          - name: http-metrics
            containerPort: 9168
          resources:
            requests:
              cpu: 75m
              memory: 100M
          volumeMounts:
          - name: gitlab-exporter-config
            mountPath: /var/opt/gitlab-exporter/templates/gitlab-exporter.yml.erb
            subPath: gitlab-exporter.yml.erb
          - name: gitlab-exporter-secrets
            mountPath: /etc/gitlab
            readOnly: true
          - name: etc-ssl-certs
            mountPath: /etc/ssl/certs/
            readOnly: true
          - name: etc-pki-ca-trust-extracted-pem
            mountPath: /etc/pki/ca-trust/extracted/pem
            readOnly: true
          livenessProbe:
            exec:
              command:
              - pgrep
              - "-f"
              - gitlab-exporter
          readinessProbe:
            exec:
              command:
              - pgrep
              - "-f"
              - gitlab-exporter
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
              - ALL
            runAsNonRoot: true
            runAsUser: 1000
          lifecycle:
            preStop:
              exec:
                command:
                - /bin/bash
                - "-c"
                - "pkill -f 'gitlab-exporter'"
        initContainers:
        - name: certificates
          image: "registry.gitlab.com/gitlab-org/build/cng/certificates:v18.8.2"
          env:
          - name: TZ
            value: UTC
          - name: MALLOC_CONF
            value: "dirty_decay_ms:0,muzzy_decay_ms:0"
          - name: RUBY_GC_HEAP_FREE_SLOTS_MAX_RATIO
            value: "0.111"
          - name: RUBY_GC_HEAP_FREE_SLOTS_MIN_RATIO
            value: "0.055"
          - name: RUBY_GC_HEAP_INIT_SLOTS
            value: "80000"
          resources:
            requests:
              cpu: 50m
          volumeMounts:
          - name: etc-ssl-certs
            mountPath: /etc/ssl/certs
            readOnly: false
          - name: etc-pki-ca-trust-extracted-pem
            mountPath: /etc/pki/ca-trust/extracted/pem
            readOnly: false
          - name: custom-ca-certificates
            mountPath: /usr/local/share/ca-certificates
            readOnly: true
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
              - ALL
            runAsNonRoot: true
        - name: configure
          image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-base:v18.8.2"
          command:
          - sh
          - /config/configure
          env:
          - name: TZ
            value: UTC
          - name: MALLOC_CONF
            value: "dirty_decay_ms:0,muzzy_decay_ms:0"
          - name: RUBY_GC_HEAP_FREE_SLOTS_MAX_RATIO
            value: "0.111"
          - name: RUBY_GC_HEAP_FREE_SLOTS_MIN_RATIO
            value: "0.055"
          - name: RUBY_GC_HEAP_INIT_SLOTS
            value: "80000"
          resources:
            requests:
              cpu: 50m
          volumeMounts:
          - name: gitlab-exporter-config
            mountPath: /config
            readOnly: true
          - name: init-gitlab-exporter-secrets
            mountPath: /init-config
            readOnly: true
          - name: gitlab-exporter-secrets
            mountPath: /init-secrets
            readOnly: false
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
              - ALL
            runAsNonRoot: true
        securityContext:
          fsGroup: 1000
          runAsUser: 1000
          seccompProfile:
            type: RuntimeDefault
        volumes:
        - name: gitlab-exporter-config
          configMap:
            name: gitlab-gitlab-exporter
        - name: init-gitlab-exporter-secrets
          projected:
            defaultMode: 256
            sources:
            - secret:
                name: db-gitlab-app
                items:
                - key: password
                  path: postgres/psql-password-ci
            - secret:
                name: db-gitlab-app
                items:
                - key: password
                  path: postgres/psql-password-main
            - secret:
                name: gitlab-redis-secret
                items:
                - key: secret
                  path: redis/redis-password
        - name: gitlab-exporter-secrets
          emptyDir:
            medium: Memory
        - name: etc-ssl-certs
          emptyDir:
            medium: Memory
        - name: etc-pki-ca-trust-extracted-pem
          emptyDir:
            medium: Memory
        - name: custom-ca-certificates
          projected:
            defaultMode: 288
            sources:
            - secret:
                name: aethernet.crt
            - secret:
                name: gitlab-wildcard-tls-ca
  


(root level)
+ one document added:
  apiVersion: apps/v1
  kind: Deployment
  metadata:
    name: gitlab-gitlab-shell
    namespace: gitlab
    labels:
      app: gitlab-shell
      app.kubernetes.io/name: gitlab
      helm.toolkit.fluxcd.io/name: gitlab
      helm.toolkit.fluxcd.io/namespace: flux-system
      heritage: Helm
      release: gitlab
  spec:
    selector:
      matchLabels:
        app: gitlab-shell
        release: gitlab
    template:
      metadata:
        annotations:
          cluster-autoscaler.kubernetes.io/safe-to-evict: "true"
        labels:
          app: gitlab-shell
          app.kubernetes.io/name: gitlab
          heritage: Helm
          release: gitlab
      spec:
        affinity:
          podAntiAffinity:
            preferredDuringSchedulingIgnoredDuringExecution:
            - podAffinityTerm:
                labelSelector:
                  matchLabels:
                    app: gitlab-shell
                    release: gitlab
                topologyKey: kubernetes.io/hostname
              weight: 1
        automountServiceAccountToken: false
        containers:
        - name: gitlab-shell
          image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-shell:v14.45.5"
          env:
          - name: CONFIG_TEMPLATE_DIRECTORY
            value: /etc/gitlab-shell
          - name: CONFIG_DIRECTORY
            value: /srv/gitlab-shell
          - name: KEYS_DIRECTORY
            value: /etc/gitlab-secrets/ssh
          - name: SSH_DAEMON
            value: openssh
          - name: GODEBUG
            value: "tlsmlkem=0,tlskyber=0"
          - name: TZ
            value: UTC
          ports:
          - name: ssh
            containerPort: 2222
          readinessProbe:
            failureThreshold: 2
            initialDelaySeconds: 10
            periodSeconds: 5
            successThreshold: 1
            tcpSocket:
              port: 2222
            timeoutSeconds: 3
          resources:
            requests:
              cpu: 0
              memory: 6M
          volumeMounts:
          - name: shell-config
            mountPath: /etc/gitlab-shell
          - name: shell-secrets
            mountPath: /etc/gitlab-secrets
            readOnly: true
          - name: shell-config
            mountPath: /etc/krb5.conf
            readOnly: true
            subPath: krb5.conf
          - name: sshd-config
            mountPath: /etc/ssh/sshd_config
            readOnly: true
            subPath: sshd_config
          - name: etc-ssl-certs
            mountPath: /etc/ssl/certs/
            readOnly: true
          - name: etc-pki-ca-trust-extracted-pem
            mountPath: /etc/pki/ca-trust/extracted/pem
            readOnly: true
          livenessProbe:
            exec:
              command:
              - /scripts/healthcheck
            failureThreshold: 3
            initialDelaySeconds: 10
            periodSeconds: 10
            successThreshold: 1
            timeoutSeconds: 3
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
              - ALL
            runAsNonRoot: true
            runAsUser: 1000
        initContainers:
        - name: certificates
          image: "registry.gitlab.com/gitlab-org/build/cng/certificates:v18.8.2"
          env:
          - name: TZ
            value: UTC
          resources:
            requests:
              cpu: 50m
          volumeMounts:
          - name: etc-ssl-certs
            mountPath: /etc/ssl/certs
            readOnly: false
          - name: etc-pki-ca-trust-extracted-pem
            mountPath: /etc/pki/ca-trust/extracted/pem
            readOnly: false
          - name: custom-ca-certificates
            mountPath: /usr/local/share/ca-certificates
            readOnly: true
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
              - ALL
            runAsNonRoot: true
        - name: configure
          image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-base:v18.8.2"
          command:
          - sh
          - /config/configure
          env:
          - name: TZ
            value: UTC
          resources:
            requests:
              cpu: 50m
          volumeMounts:
          - name: shell-config
            mountPath: /config
            readOnly: true
          - name: shell-init-secrets
            mountPath: /init-config
            readOnly: true
          - name: shell-secrets
            mountPath: /init-secrets
            readOnly: false
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
              - ALL
            runAsNonRoot: true
        securityContext:
          fsGroup: 1000
          runAsUser: 1000
          seccompProfile:
            type: RuntimeDefault
        terminationGracePeriodSeconds: 30
        volumes:
        - name: shell-config
          configMap:
            name: gitlab-gitlab-shell
        - name: sshd-config
          configMap:
            name: gitlab-gitlab-shell-sshd
        - name: shell-init-secrets
          projected:
            defaultMode: 288
            sources:
            - secret:
                name: gitlab-gitlab-shell-host-keys
            - secret:
                name: gitlab-gitlab-shell-secret
                items:
                - key: secret
                  path: shell/.gitlab_shell_secret
        - name: shell-secrets
          emptyDir:
            medium: Memory
        - name: etc-ssl-certs
          emptyDir:
            medium: Memory
        - name: etc-pki-ca-trust-extracted-pem
          emptyDir:
            medium: Memory
        - name: custom-ca-certificates
          projected:
            defaultMode: 288
            sources:
            - secret:
                name: aethernet.crt
            - secret:
                name: gitlab-wildcard-tls-ca
  


(root level)
+ one document added:
  apiVersion: apps/v1
  kind: Deployment
  metadata:
    name: gitlab-kas
    namespace: gitlab
    labels:
      app: kas
      app.kubernetes.io/name: gitlab
      helm.toolkit.fluxcd.io/name: gitlab
      helm.toolkit.fluxcd.io/namespace: flux-system
      heritage: Helm
      release: gitlab
  spec:
    selector:
      matchLabels:
        app: kas
        release: gitlab
    template:
      metadata:
        annotations:
          cluster-autoscaler.kubernetes.io/safe-to-evict: "true"
          gitlab.com/prometheus_path: /metrics
          gitlab.com/prometheus_port: "8151"
          gitlab.com/prometheus_scrape: "true"
          prometheus.io/path: /metrics
          prometheus.io/port: "8151"
          prometheus.io/scrape: "true"
        labels:
          app: kas
          app.kubernetes.io/name: gitlab
          heritage: Helm
          release: gitlab
      spec:
        affinity:
          podAntiAffinity:
            preferredDuringSchedulingIgnoredDuringExecution:
            - podAffinityTerm:
                labelSelector:
                  matchLabels:
                    app: kas
                    release: gitlab
                topologyKey: kubernetes.io/hostname
              weight: 1
        automountServiceAccountToken: false
        containers:
        - name: kas
          image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-kas:v18.8.2"
          args:
          - "--configuration-file=/etc/kas/config.yaml"
          env:
          - name: OWN_PRIVATE_API_HOST
            value: gitlab-kas.gitlab.svc
          - name: GODEBUG
            value: "tlsmlkem=0,tlskyber=0"
          - name: TZ
            value: UTC
          livenessProbe:
            httpGet:
              path: /liveness
              port: 8151
            initialDelaySeconds: 15
            periodSeconds: 20
          ports:
          - name: kas
            containerPort: 8150
          - name: kas-k8s-api
            containerPort: 8154
          - name: kas-private-api
            containerPort: 8155
          - name: http-metrics
            containerPort: 8151
          readinessProbe:
            httpGet:
              path: /readiness
              port: 8151
            initialDelaySeconds: 5
            periodSeconds: 10
          resources:
            requests:
              cpu: 100m
              memory: 256Mi
          volumeMounts:
          - name: init-etc-kas
            mountPath: /etc/kas
            readOnly: true
          - name: etc-ssl-certs
            mountPath: /etc/ssl/certs/
            readOnly: true
          - name: etc-pki-ca-trust-extracted-pem
            mountPath: /etc/pki/ca-trust/extracted/pem
            readOnly: true
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
              - ALL
            runAsNonRoot: true
            runAsUser: 65532
        initContainers:
        - name: certificates
          image: "registry.gitlab.com/gitlab-org/build/cng/certificates:v18.8.2"
          env:
          - name: TZ
            value: UTC
          resources:
            requests:
              cpu: 50m
          volumeMounts:
          - name: etc-ssl-certs
            mountPath: /etc/ssl/certs
            readOnly: false
          - name: etc-pki-ca-trust-extracted-pem
            mountPath: /etc/pki/ca-trust/extracted/pem
            readOnly: false
          - name: custom-ca-certificates
            mountPath: /usr/local/share/ca-certificates
            readOnly: true
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
              - ALL
            runAsNonRoot: true
        securityContext:
          fsGroup: 65532
          runAsGroup: 65532
          runAsUser: 65532
          seccompProfile:
            type: RuntimeDefault
        terminationGracePeriodSeconds: 300
        volumes:
        - name: etc-ssl-certs
          emptyDir:
            medium: Memory
        - name: etc-pki-ca-trust-extracted-pem
          emptyDir:
            medium: Memory
        - name: custom-ca-certificates
          projected:
            defaultMode: 288
            sources:
            - secret:
                name: aethernet.crt
            - secret:
                name: gitlab-wildcard-tls-ca
        - name: init-etc-kas
          projected:
            defaultMode: 288
            sources:
            - configMap:
                name: gitlab-kas
            - secret:
                name: gitlab-gitlab-kas-secret
                items:
                - key: kas_shared_secret
                  path: .gitlab_kas_secret
            - secret:
                name: gitlab-kas-private-api
                items:
                - key: kas_private_api_secret
                  path: .gitlab_kas_private_api_secret
            - secret:
                name: gitlab-kas-websocket-token
                items:
                - key: kas_websocket_token_secret
                  path: .gitlab_kas_websocket_token_secret
            - secret:
                name: gitlab-redis-secret
                items:
                - key: secret
                  path: redis/redis-password

(root level)
+ one document added:
  apiVersion: apps/v1
  kind: Deployment
  metadata:
    name: gitlab-sidekiq-all-in-1-v2
    namespace: gitlab
    labels:
      app: sidekiq
      app.kubernetes.io/name: gitlab
      helm.toolkit.fluxcd.io/name: gitlab
      helm.toolkit.fluxcd.io/namespace: flux-system
      heritage: Helm
      queue-pod-name: all-in-1
      release: gitlab
  spec:
    selector:
      matchLabels:
        app: sidekiq
        queue-pod-name: all-in-1
        release: gitlab
    template:
      metadata:
        annotations:
          cluster-autoscaler.kubernetes.io/safe-to-evict: "true"
          gitlab.com/prometheus_path: /metrics
          gitlab.com/prometheus_port: "3807"
          gitlab.com/prometheus_scrape: "true"
          prometheus.io/path: /metrics
          prometheus.io/port: "3807"
          prometheus.io/scrape: "true"
        labels:
          app: sidekiq
          app.kubernetes.io/name: gitlab
          heritage: Helm
          queue-pod-name: all-in-1
          release: gitlab
      spec:
        affinity:
          podAntiAffinity:
            preferredDuringSchedulingIgnoredDuringExecution:
            - podAffinityTerm:
                labelSelector:
                  matchLabels:
                    app: sidekiq
                    release: gitlab
                topologyKey: kubernetes.io/hostname
              weight: 1
        automountServiceAccountToken: false
        containers:
        - name: sidekiq
          image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-sidekiq-ce:v18.8.2"
          env:
          - name: prometheus_multiproc_dir
            value: /metrics
          - name: CONFIG_TEMPLATE_DIRECTORY
            value: /var/opt/gitlab/templates
          - name: CONFIG_DIRECTORY
            value: /srv/gitlab/config
          - name: SIDEKIQ_CONCURRENCY
            value: "20"
          - name: SIDEKIQ_TIMEOUT
            value: "25"
          - name: SIDEKIQ_QUEUES
            value: null
          - name: SIDEKIQ_DAEMON_MEMORY_KILLER
            value: "1"
          - name: SIDEKIQ_MEMORY_KILLER_CHECK_INTERVAL
            value: "3"
          - name: SIDEKIQ_MEMORY_KILLER_MAX_RSS
            value: "2000000"
          - name: SIDEKIQ_MEMORY_KILLER_GRACE_TIME
            value: "900"
          - name: SIDEKIQ_MEMORY_KILLER_SHUTDOWN_WAIT
            value: "30"
          - name: ENABLE_BOOTSNAP
            value: "1"
          - name: TZ
            value: UTC
          livenessProbe:
            failureThreshold: 3
            httpGet:
              path: /liveness
              port: 3808
            initialDelaySeconds: 20
            periodSeconds: 60
            successThreshold: 1
            timeoutSeconds: 30
          ports:
          - name: http-metrics
            containerPort: 3807
          readinessProbe:
            failureThreshold: 3
            httpGet:
              path: /readiness
              port: 3808
            initialDelaySeconds: 0
            periodSeconds: 10
            successThreshold: 1
            timeoutSeconds: 2
          resources:
            requests:
              cpu: 900m
              memory: 2G
          volumeMounts:
          - name: sidekiq-metrics
            mountPath: /metrics
          - name: sidekiq-config
            mountPath: /var/opt/gitlab/templates
            readOnly: true
          - name: sidekiq-secrets
            mountPath: /etc/gitlab
            readOnly: true
          - name: sidekiq-secrets
            mountPath: /srv/gitlab/config/secrets.yml
            subPath: rails-secrets/secrets.yml
          - name: sidekiq-config
            mountPath: /etc/krb5.conf
            subPath: krb5.conf
          - name: sidekiq-config
            mountPath: /srv/gitlab/config/initializers/smtp_settings.rb
            subPath: smtp_settings.rb
          - name: sidekiq-config
            mountPath: /srv/gitlab/INSTALLATION_TYPE
            subPath: installation_type
          - name: etc-ssl-certs
            mountPath: /etc/ssl/certs/
            readOnly: true
          - name: etc-pki-ca-trust-extracted-pem
            mountPath: /etc/pki/ca-trust/extracted/pem
            readOnly: true
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
              - ALL
            runAsNonRoot: true
            runAsUser: 1000
          lifecycle:
            preStop:
              exec:
                command:
                - /bin/bash
                - "-c"
                - "pkill -f 'sidekiq'"
        initContainers:
        - name: certificates
          image: "registry.gitlab.com/gitlab-org/build/cng/certificates:v18.8.2"
          env:
          - name: TZ
            value: UTC
          resources:
            requests:
              cpu: 50m
          volumeMounts:
          - name: etc-ssl-certs
            mountPath: /etc/ssl/certs
            readOnly: false
          - name: etc-pki-ca-trust-extracted-pem
            mountPath: /etc/pki/ca-trust/extracted/pem
            readOnly: false
          - name: custom-ca-certificates
            mountPath: /usr/local/share/ca-certificates
            readOnly: true
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
              - ALL
            runAsNonRoot: true
            runAsUser: 1000
        - name: configure
          image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-base:v18.8.2"
          command:
          - sh
          - /config/configure
          env:
          - name: TZ
            value: UTC
          resources:
            requests:
              cpu: 50m
          volumeMounts:
          - name: sidekiq-config
            mountPath: /config
            readOnly: true
          - name: init-sidekiq-secrets
            mountPath: /init-config
            readOnly: true
          - name: sidekiq-secrets
            mountPath: /init-secrets
            readOnly: false
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
              - ALL
            runAsNonRoot: true
            runAsUser: 1000
        - name: dependencies
          image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-sidekiq-ce:v18.8.2"
          args:
          - /scripts/wait-for-deps
          env:
          - name: CONFIG_TEMPLATE_DIRECTORY
            value: /var/opt/gitlab/templates
          - name: CONFIG_DIRECTORY
            value: /srv/gitlab/config
          - name: SIDEKIQ_CONCURRENCY
            value: "20"
          - name: SIDEKIQ_TIMEOUT
            value: "25"
          - name: ENABLE_BOOTSNAP
            value: "1"
          - name: TZ
            value: UTC
          resources:
            requests:
              cpu: 50m
          volumeMounts:
          - name: etc-ssl-certs
            mountPath: /etc/ssl/certs/
            readOnly: true
          - name: etc-pki-ca-trust-extracted-pem
            mountPath: /etc/pki/ca-trust/extracted/pem
            readOnly: true
          - name: sidekiq-config
            mountPath: /var/opt/gitlab/templates
            readOnly: true
          - name: sidekiq-secrets
            mountPath: /etc/gitlab
            readOnly: true
          - name: sidekiq-secrets
            mountPath: /srv/gitlab/config/secrets.yml
            readOnly: true
            subPath: rails-secrets/secrets.yml
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
              - ALL
            runAsNonRoot: true
            runAsUser: 1000
        securityContext:
          fsGroup: 1000
          runAsUser: 1000
          seccompProfile:
            type: RuntimeDefault
        terminationGracePeriodSeconds: 30
        volumes:
        - name: sidekiq-metrics
          emptyDir:
            medium: Memory
        - name: sidekiq-config
          projected:
            sources:
            - configMap:
                name: gitlab-sidekiq
        - name: init-sidekiq-secrets
          projected:
            defaultMode: 256
            sources:
            - secret:
                name: gitlab-rails-secret
                items:
                - key: secrets.yml
                  path: rails-secrets/secrets.yml
            - secret:
                name: gitlab-gitaly-secret
                items:
                - key: token
                  path: gitaly/gitaly_token
            - secret:
                name: gitlab-redis-secret
                items:
                - key: secret
                  path: redis/redis-password
            - secret:
                name: db-gitlab-app
                items:
                - key: password
                  path: postgres/psql-password-ci
            - secret:
                name: db-gitlab-app
                items:
                - key: password
                  path: postgres/psql-password-main
            - secret:
                name: gitlab-registry-secret
                items:
                - key: registry-auth.key
                  path: registry/gitlab-registry.key
            - secret:
                name: gitlab-registry-notification
                items:
                - key: secret
                  path: registry/notificationSecret
            - secret:
                name: gitlab-gitlab-kas-secret
                items:
                - key: kas_shared_secret
                  path: kas/.gitlab_kas_secret
            - secret:
                name: gitlab-zoekt-basicauth
                optional: true
                items:
                - key: gitlab_username
                  path: zoekt/.gitlab_zoekt_username
                - key: gitlab_password
                  path: zoekt/.gitlab_zoekt_password
            - secret:
                name: gitlab-object-store-configs
                items:
                - key: connection.yaml
                  path: objectstorage/object_store
            - secret:
                name: authentik-oidc
                items:
                - key: config.yaml
                  path: omniauth/authentik-oidc/config.yaml
        - name: sidekiq-secrets
          emptyDir:
            medium: Memory
        - name: etc-ssl-certs
          emptyDir:
            medium: Memory
        - name: etc-pki-ca-trust-extracted-pem
          emptyDir:
            medium: Memory
        - name: custom-ca-certificates
          projected:
            defaultMode: 288
            sources:
            - secret:
                name: aethernet.crt
            - secret:
                name: gitlab-wildcard-tls-ca
  


(root level)
+ one document added:
  apiVersion: apps/v1
  kind: Deployment
  metadata:
    name: gitlab-toolbox
    namespace: gitlab
    labels:
      app: toolbox
      app.kubernetes.io/name: gitlab
      helm.toolkit.fluxcd.io/name: gitlab
      helm.toolkit.fluxcd.io/namespace: flux-system
      heritage: Helm
      release: gitlab
  spec:
    replicas: 1
    selector:
      matchLabels:
        app: toolbox
        release: gitlab
    strategy:
      type: Recreate
      rollingUpdate: null
    template:
      metadata:
        annotations:
          cluster-autoscaler.kubernetes.io/safe-to-evict: "true"
        labels:
          app: toolbox
          app.kubernetes.io/name: gitlab
          heritage: Helm
          release: gitlab
      spec:
        affinity:
          podAntiAffinity:
            preferredDuringSchedulingIgnoredDuringExecution:
            - podAffinityTerm:
                labelSelector:
                  matchLabels:
                    app: gitaly
                    release: gitlab
                topologyKey: kubernetes.io/hostname
              weight: 1
        automountServiceAccountToken: false
        containers:
        - name: toolbox
          image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-toolbox-ce:v18.8.2"
          args:
          - /bin/bash
          - "-c"
          - "cp -v -r -L /etc/gitlab/.s3cfg $HOME/.s3cfg && while sleep 3600; do :; done"
          env:
          - name: ARTIFACTS_BUCKET_NAME
            value: gitlab-artifacts
          - name: REGISTRY_BUCKET_NAME
            value: gitlab-container-registry
          - name: LFS_BUCKET_NAME
            value: gitlab-lfs
          - name: UPLOADS_BUCKET_NAME
            value: gitlab-uploads
          - name: PACKAGES_BUCKET_NAME
            value: gitlab-packages
          - name: EXTERNAL_DIFFS_BUCKET_NAME
            value: gitlab-external-diffs
          - name: TERRAFORM_STATE_BUCKET_NAME
            value: gitlab-terraform-state
          - name: CI_SECURE_FILES_BUCKET_NAME
            value: gitlab-ci-secure-files
          - name: BACKUP_BUCKET_NAME
            value: gitlab-backup
          - name: BACKUP_BACKEND
            value: s3
          - name: TMP_BUCKET_NAME
            value: gitlab-tmp-storage
          - name: PAGES_BUCKET_NAME
            value: gitlab-pages
          - name: ENABLE_BOOTSNAP
            value: "1"
          - name: CONFIG_TEMPLATE_DIRECTORY
            value: /var/opt/gitlab/templates
          - name: CONFIG_DIRECTORY
            value: /srv/gitlab/config
          - name: TZ
            value: UTC
          resources:
            requests:
              cpu: 50m
              memory: 350M
          volumeMounts:
          - name: toolbox-config
            mountPath: /var/opt/gitlab/templates
          - name: toolbox-config
            mountPath: /etc/krb5.conf
            subPath: krb5.conf
          - name: toolbox-config
            mountPath: /srv/gitlab/config/initializers/smtp_settings.rb
            subPath: smtp_settings.rb
          - name: toolbox-secrets
            mountPath: /etc/gitlab
            readOnly: true
          - name: toolbox-secrets
            mountPath: /srv/gitlab/config/secrets.yml
            subPath: rails-secrets/secrets.yml
          - name: toolbox-tmp
            mountPath: /srv/gitlab/tmp
            readOnly: false
          - name: etc-ssl-certs
            mountPath: /etc/ssl/certs/
            readOnly: true
          - name: etc-pki-ca-trust-extracted-pem
            mountPath: /etc/pki/ca-trust/extracted/pem
            readOnly: true
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
              - ALL
            runAsNonRoot: true
            runAsUser: 1000
        initContainers:
        - name: certificates
          image: "registry.gitlab.com/gitlab-org/build/cng/certificates:v18.8.2"
          env:
          - name: TZ
            value: UTC
          resources:
            requests:
              cpu: 50m
          volumeMounts:
          - name: etc-ssl-certs
            mountPath: /etc/ssl/certs
            readOnly: false
          - name: etc-pki-ca-trust-extracted-pem
            mountPath: /etc/pki/ca-trust/extracted/pem
            readOnly: false
          - name: custom-ca-certificates
            mountPath: /usr/local/share/ca-certificates
            readOnly: true
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
              - ALL
            runAsNonRoot: true
            runAsUser: 1000
        - name: configure
          image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-base:v18.8.2"
          command:
          - sh
          - /config/configure
          env:
          - name: TZ
            value: UTC
          resources:
            requests:
              cpu: 50m
          volumeMounts:
          - name: toolbox-config
            mountPath: /config
            readOnly: true
          - name: init-toolbox-secrets
            mountPath: /init-config
            readOnly: true
          - name: toolbox-secrets
            mountPath: /init-secrets
            readOnly: false
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
              - ALL
            runAsNonRoot: true
            runAsUser: 1000
        securityContext:
          fsGroup: 1000
          runAsGroup: 1000
          runAsUser: 1000
          seccompProfile:
            type: RuntimeDefault
        volumes:
        - name: toolbox-config
          projected:
            sources:
            - configMap:
                name: gitlab-toolbox
        - name: toolbox-tmp
          emptyDir: {}
        - name: init-toolbox-secrets
          projected:
            defaultMode: 256
            sources:
            - secret:
                name: gitlab-rails-secret
                items:
                - key: secrets.yml
                  path: rails-secrets/secrets.yml
            - secret:
                name: gitlab-gitlab-shell-secret
                items:
                - key: secret
                  path: shell/.gitlab_shell_secret
            - secret:
                name: gitlab-gitaly-secret
                items:
                - key: token
                  path: gitaly/gitaly_token
            - secret:
                name: gitlab-redis-secret
                items:
                - key: secret
                  path: redis/redis-password
            - secret:
                name: db-gitlab-app
                items:
                - key: password
                  path: postgres/psql-password-ci
            - secret:
                name: db-gitlab-app
                items:
                - key: password
                  path: postgres/psql-password-main
            - secret:
                name: gitlab-registry-secret
                items:
                - key: registry-auth.key
                  path: registry/gitlab-registry.key
            - secret:
                name: gitlab-registry-notification
                items:
                - key: secret
                  path: registry/notificationSecret
            - secret:
                name: gitlab-object-store-configs
                items:
                - key: s3cmd.cfg
                  path: objectstorage/.s3cfg
            - secret:
                name: gitlab-gitlab-kas-secret
                items:
                - key: kas_shared_secret
                  path: kas/.gitlab_kas_secret
            - secret:
                name: gitlab-zoekt-basicauth
                optional: true
                items:
                - key: gitlab_username
                  path: zoekt/.gitlab_zoekt_username
                - key: gitlab_password
                  path: zoekt/.gitlab_zoekt_password
            - secret:
                name: gitlab-object-store-configs
                items:
                - key: connection.yaml
                  path: objectstorage/object_store
            - secret:
                name: authentik-oidc
                items:
                - key: config.yaml
                  path: omniauth/authentik-oidc/config.yaml
        - name: toolbox-secrets
          emptyDir:
            medium: Memory
        - name: etc-ssl-certs
          emptyDir:
            medium: Memory
        - name: etc-pki-ca-trust-extracted-pem
          emptyDir:
            medium: Memory
        - name: custom-ca-certificates
          projected:
            defaultMode: 288
            sources:
            - secret:
                name: aethernet.crt
            - secret:
                name: gitlab-wildcard-tls-ca
  


(root level)
+ one document added:
  apiVersion: apps/v1
  kind: Deployment
  metadata:
    name: gitlab-webservice-default
    namespace: gitlab
    labels:
      app: webservice
      app.kubernetes.io/name: gitlab
      gitlab.com/webservice-name: default
      helm.toolkit.fluxcd.io/name: gitlab
      helm.toolkit.fluxcd.io/namespace: flux-system
      heritage: Helm
      release: gitlab
  spec:
    selector:
      matchLabels:
        app: webservice
        gitlab.com/webservice-name: default
        release: gitlab
    template:
      metadata:
        annotations:
          cluster-autoscaler.kubernetes.io/safe-to-evict: "true"
          gitlab.com/prometheus_path: /metrics
          gitlab.com/prometheus_port: "8083"
          gitlab.com/prometheus_scrape: "true"
          prometheus.io/path: /metrics
          prometheus.io/port: "8083"
          prometheus.io/scrape: "true"
        labels:
          app: webservice
          app.kubernetes.io/name: gitlab
          gitlab.com/webservice-name: default
          heritage: Helm
          release: gitlab
      spec:
        affinity:
          podAntiAffinity:
            preferredDuringSchedulingIgnoredDuringExecution:
            - podAffinityTerm:
                labelSelector:
                  matchLabels:
                    app: webservice
                    gitlab.com/webservice-name: default
                    release: gitlab
                topologyKey: kubernetes.io/hostname
              weight: 1
        automountServiceAccountToken: false
        containers:
        - name: webservice
          image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-webservice-ce:v18.8.2"
          env:
          - name: TZ
            value: UTC
          - name: GITLAB_WEBSERVER
            value: puma
          - name: TMPDIR
            value: /tmp/gitlab
          - name: CONFIG_TEMPLATE_DIRECTORY
            value: /var/opt/gitlab/templates
          - name: CONFIG_DIRECTORY
            value: /srv/gitlab/config
          - name: prometheus_multiproc_dir
            value: /metrics
          - name: ENABLE_BOOTSNAP
            value: "1"
          - name: WORKER_PROCESSES
            value: "2"
          - name: WORKER_TIMEOUT
            value: "60"
          - name: INTERNAL_PORT
            value: "8080"
          - name: PUMA_THREADS_MIN
            value: "4"
          - name: PUMA_THREADS_MAX
            value: "4"
          - name: PUMA_WORKER_MAX_MEMORY
            value: 
          - name: DISABLE_PUMA_WORKER_KILLER
            value: "true"
          - name: BIND_IP6
            value: "false"
          - name: PUMA_CONTROL_PORT
            value: "9293"
          - name: SHUTDOWN_BLACKOUT_SECONDS
            value: "10"
          - name: WORKHORSE_ARCHIVE_CACHE_DISABLED
            value: "true"
          livenessProbe:
            failureThreshold: 3
            httpGet:
              path: /-/liveness
              port: 8080
            initialDelaySeconds: 20
            periodSeconds: 60
            successThreshold: 1
            timeoutSeconds: 30
          ports:
          - name: http-webservice
            containerPort: 8080
          - name: http-metrics-ws
            containerPort: 8083
          readinessProbe:
            failureThreshold: 2
            httpGet:
              path: /-/readiness
              port: 8080
            initialDelaySeconds: 0
            periodSeconds: 5
            successThreshold: 1
            timeoutSeconds: 2
          resources:
            requests:
              cpu: 300m
              memory: 2.5G
          volumeMounts:
          - name: webservice-metrics
            mountPath: /metrics
          - name: webservice-config
            mountPath: /var/opt/gitlab/templates
          - name: webservice-secrets
            mountPath: /etc/gitlab
            readOnly: true
          - name: webservice-secrets
            mountPath: /srv/gitlab/config/secrets.yml
            subPath: rails-secrets/secrets.yml
          - name: webservice-config
            mountPath: /etc/krb5.conf
            subPath: krb5.conf
          - name: webservice-config
            mountPath: /srv/gitlab/config/initializers/smtp_settings.rb
            subPath: smtp_settings.rb
          - name: webservice-config
            mountPath: /srv/gitlab/INSTALLATION_TYPE
            subPath: installation_type
          - name: shared-upload-directory
            mountPath: /srv/gitlab/public/uploads/tmp
            readOnly: false
          - name: shared-tmp
            mountPath: /tmp
            readOnly: false
          - name: etc-ssl-certs
            mountPath: /etc/ssl/certs/
            readOnly: true
          - name: etc-pki-ca-trust-extracted-pem
            mountPath: /etc/pki/ca-trust/extracted/pem
            readOnly: true
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
              - ALL
            runAsNonRoot: true
            runAsUser: 1000
          lifecycle:
            preStop:
              exec:
                command:
                - /bin/bash
                - "-c"
                - "pkill -SIGINT -o ruby"
        - name: gitlab-workhorse
          image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-workhorse-ce:v18.8.2"
          env:
          - name: TZ
            value: UTC
          - name: GODEBUG
            value: "tlsmlkem=0,tlskyber=0"
          - name: TMPDIR
            value: /tmp/gitlab
          - name: GITLAB_WORKHORSE_AUTH_BACKEND
            value: "http://localhost:8080"
          - name: GITLAB_WORKHORSE_EXTRA_ARGS
            value: 
          - name: GITLAB_WORKHORSE_LISTEN_PORT
            value: "8181"
          - name: GITLAB_WORKHORSE_LOG_FORMAT
            value: json
          - name: CONFIG_TEMPLATE_DIRECTORY
            value: /var/opt/gitlab/templates
          - name: CONFIG_DIRECTORY
            value: /srv/gitlab/config
          - name: SHUTDOWN_BLACKOUT_SECONDS
            value: "10"
          - name: PUMA_CONTROL_PORT
            value: "9293"
          ports:
          - name: http-workhorse
            containerPort: 8181
          resources:
            requests:
              cpu: 100m
              memory: 100M
          volumeMounts:
          - name: workhorse-config
            mountPath: /var/opt/gitlab/templates
          - name: workhorse-secrets
            mountPath: /etc/gitlab
            readOnly: true
          - name: shared-upload-directory
            mountPath: /srv/gitlab/public/uploads/tmp
            readOnly: false
          - name: shared-tmp
            mountPath: /tmp
            readOnly: false
          - name: etc-ssl-certs
            mountPath: /etc/ssl/certs/
            readOnly: true
          - name: etc-pki-ca-trust-extracted-pem
            mountPath: /etc/pki/ca-trust/extracted/pem
            readOnly: true
          livenessProbe:
            exec:
              command:
              - /scripts/healthcheck
            failureThreshold: 3
            initialDelaySeconds: 20
            periodSeconds: 60
            successThreshold: 1
            timeoutSeconds: 30
          readinessProbe:
            exec:
              command:
              - /scripts/healthcheck
            failureThreshold: 3
            initialDelaySeconds: 0
            periodSeconds: 10
            successThreshold: 1
            timeoutSeconds: 2
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
              - ALL
            runAsNonRoot: true
            runAsUser: 1000
          lifecycle:
            preStop:
              exec:
                command:
                - /bin/bash
                - "-c"
                - "sleep $SHUTDOWN_BLACKOUT_SECONDS"
        initContainers:
        - name: certificates
          image: "registry.gitlab.com/gitlab-org/build/cng/certificates:v18.8.2"
          env:
          - name: TZ
            value: UTC
          resources:
            requests:
              cpu: 50m
          volumeMounts:
          - name: etc-ssl-certs
            mountPath: /etc/ssl/certs
            readOnly: false
          - name: etc-pki-ca-trust-extracted-pem
            mountPath: /etc/pki/ca-trust/extracted/pem
            readOnly: false
          - name: custom-ca-certificates
            mountPath: /usr/local/share/ca-certificates
            readOnly: true
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
              - ALL
            runAsNonRoot: true
            runAsUser: 1000
        - name: configure
          image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-base:v18.8.2"
          args:
          - "-c"
          - "sh -x /config-webservice/configure ; sh -x /config-workhorse/configure ; mkdir -p -m 3770 /tmp/gitlab"
          command:
          - sh
          env:
          - name: TZ
            value: UTC
          resources:
            requests:
              cpu: 50m
          volumeMounts:
          - name: webservice-config
            mountPath: /config-webservice
            readOnly: true
          - name: workhorse-config
            mountPath: /config-workhorse
            readOnly: true
          - name: init-webservice-secrets
            mountPath: /init-config
            readOnly: true
          - name: webservice-secrets
            mountPath: /init-secrets
            readOnly: false
          - name: workhorse-secrets
            mountPath: /init-secrets-workhorse
            readOnly: false
          - name: shared-tmp
            mountPath: /tmp
            readOnly: false
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
              - ALL
            runAsNonRoot: true
            runAsUser: 1000
        - name: dependencies
          image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-webservice-ce:v18.8.2"
          args:
          - /scripts/wait-for-deps
          env:
          - name: TZ
            value: UTC
          - name: CONFIG_TEMPLATE_DIRECTORY
            value: /var/opt/gitlab/templates
          - name: CONFIG_DIRECTORY
            value: /srv/gitlab/config
          - name: WORKHORSE_ARCHIVE_CACHE_DISABLED
            value: "1"
          - name: ENABLE_BOOTSNAP
            value: "1"
          resources:
            requests:
              cpu: 50m
          volumeMounts:
          - name: etc-ssl-certs
            mountPath: /etc/ssl/certs/
            readOnly: true
          - name: etc-pki-ca-trust-extracted-pem
            mountPath: /etc/pki/ca-trust/extracted/pem
            readOnly: true
          - name: webservice-config
            mountPath: /var/opt/gitlab/templates
          - name: webservice-secrets
            mountPath: /etc/gitlab
            readOnly: true
          - name: webservice-secrets
            mountPath: /srv/gitlab/config/secrets.yml
            readOnly: true
            subPath: rails-secrets/secrets.yml
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
              - ALL
            runAsNonRoot: true
            runAsUser: 1000
        securityContext:
          fsGroup: 1000
          runAsUser: 1000
          seccompProfile:
            type: RuntimeDefault
        volumes:
        - name: shared-tmp
          emptyDir: {}
        - name: webservice-metrics
          emptyDir:
            medium: Memory
        - name: webservice-config
          configMap:
            name: gitlab-webservice
        - name: workhorse-config
          configMap:
            name: gitlab-workhorse-default
        - name: init-webservice-secrets
          projected:
            defaultMode: 256
            sources:
            - secret:
                name: gitlab-rails-secret
                items:
                - key: secrets.yml
                  path: rails-secrets/secrets.yml
            - secret:
                name: gitlab-gitlab-shell-secret
                items:
                - key: secret
                  path: shell/.gitlab_shell_secret
            - secret:
                name: gitlab-gitaly-secret
                items:
                - key: token
                  path: gitaly/gitaly_token
            - secret:
                name: gitlab-redis-secret
                items:
                - key: secret
                  path: redis/redis-password
            - secret:
                name: db-gitlab-app
                items:
                - key: password
                  path: postgres/psql-password-ci
            - secret:
                name: db-gitlab-app
                items:
                - key: password
                  path: postgres/psql-password-main
            - secret:
                name: gitlab-registry-secret
                items:
                - key: registry-auth.key
                  path: registry/gitlab-registry.key
            - secret:
                name: gitlab-registry-notification
                items:
                - key: secret
                  path: registry/notificationSecret
            - secret:
                name: gitlab-gitlab-workhorse-secret
                items:
                - key: shared_secret
                  path: gitlab-workhorse/secret
            - secret:
                name: gitlab-gitlab-kas-secret
                items:
                - key: kas_shared_secret
                  path: kas/.gitlab_kas_secret
            - secret:
                name: gitlab-zoekt-basicauth
                optional: true
                items:
                - key: gitlab_username
                  path: zoekt/.gitlab_zoekt_username
                - key: gitlab_password
                  path: zoekt/.gitlab_zoekt_password
            - secret:
                name: gitlab-object-store-configs
                items:
                - key: connection.yaml
                  path: objectstorage/object_store
            - secret:
                name: authentik-oidc
                items:
                - key: config.yaml
                  path: omniauth/authentik-oidc/config.yaml
        - name: webservice-secrets
          emptyDir:
            medium: Memory
        - name: workhorse-secrets
          emptyDir:
            medium: Memory
        - name: shared-upload-directory
          emptyDir: {}
        - name: etc-ssl-certs
          emptyDir:
            medium: Memory
        - name: etc-pki-ca-trust-extracted-pem
          emptyDir:
            medium: Memory
        - name: custom-ca-certificates
          projected:
            defaultMode: 288
            sources:
            - secret:
                name: aethernet.crt
            - secret:
                name: gitlab-wildcard-tls-ca
  


(root level)
+ one document added:
  apiVersion: apps/v1
  kind: Deployment
  metadata:
    name: gitlab-registry
    namespace: gitlab
    labels:
      app: registry
      app.kubernetes.io/name: gitlab
      helm.toolkit.fluxcd.io/name: gitlab
      helm.toolkit.fluxcd.io/namespace: flux-system
      heritage: Helm
      release: gitlab
  spec:
    selector:
      matchLabels:
        app: registry
        release: gitlab
    template:
      metadata:
        annotations:
          cluster-autoscaler.kubernetes.io/safe-to-evict: "true"
        labels:
          app: registry
          app.kubernetes.io/name: gitlab
          heritage: Helm
          release: gitlab
      spec:
        affinity:
          podAntiAffinity:
            preferredDuringSchedulingIgnoredDuringExecution:
            - podAffinityTerm:
                labelSelector:
                  matchLabels:
                    app: registry
                    release: gitlab
                topologyKey: kubernetes.io/hostname
              weight: 1
        automountServiceAccountToken: false
        containers:
        - name: registry
          image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-container-registry:v4.33.0-gitlab"
          env:
          - name: GODEBUG
            value: "tlsmlkem=0,tlskyber=0"
          - name: TZ
            value: UTC
          livenessProbe:
            failureThreshold: 3
            httpGet:
              path: /debug/health
              port: debug
              scheme: HTTP
            initialDelaySeconds: 5
            periodSeconds: 10
            successThreshold: 1
            timeoutSeconds: 1
          ports:
          - name: http
            containerPort: 5000
          - name: debug
            containerPort: 5001
          readinessProbe:
            failureThreshold: 3
            httpGet:
              path: /debug/health
              port: debug
              scheme: HTTP
            initialDelaySeconds: 5
            periodSeconds: 5
            successThreshold: 1
            timeoutSeconds: 1
          resources:
            requests:
              cpu: 50m
              memory: 32Mi
          volumeMounts:
          - name: registry-server-config
            mountPath: /etc/docker/registry/
            readOnly: true
          - name: etc-ssl-certs
            mountPath: /etc/ssl/certs/
            readOnly: true
          - name: etc-pki-ca-trust-extracted-pem
            mountPath: /etc/pki/ca-trust/extracted/pem
            readOnly: true
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
              - ALL
            runAsNonRoot: true
            runAsUser: 1000
          lifecycle:
            preStop:
              exec:
                command:
                - /bin/bash
                - "-c"
                - "sleep 5"
        initContainers:
        - name: certificates
          image: "registry.gitlab.com/gitlab-org/build/cng/certificates:v18.8.2"
          env:
          - name: TZ
            value: UTC
          resources:
            requests:
              cpu: 50m
          volumeMounts:
          - name: etc-ssl-certs
            mountPath: /etc/ssl/certs
            readOnly: false
          - name: etc-pki-ca-trust-extracted-pem
            mountPath: /etc/pki/ca-trust/extracted/pem
            readOnly: false
          - name: custom-ca-certificates
            mountPath: /usr/local/share/ca-certificates
            readOnly: true
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
              - ALL
            runAsNonRoot: true
            runAsUser: 1000
        - name: configure
          image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-base:v18.8.2"
          args:
          - sh
          - /config/configure
          env:
          - name: CONFIG_TEMPLATE_DIRECTORY
            value: /templates
          - name: CONFIG_DIRECTORY
            value: /registry
          - name: TZ
            value: UTC
          resources:
            requests:
              cpu: 50m
          volumeMounts:
          - name: registry-secrets
            mountPath: /config
          - name: registry-server-config-templates
            mountPath: /templates
            readOnly: true
          - name: registry-server-config
            mountPath: /registry
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
              - ALL
            runAsNonRoot: true
            runAsUser: 1000
        - name: dependencies
          image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-container-registry:v4.33.0-gitlab"
          command:
          - /scripts/wait-for-deps
          env:
          - name: TZ
            value: UTC
          resources:
            requests:
              cpu: 50m
          volumeMounts:
          - name: registry-server-config
            mountPath: /etc/docker/registry/
            readOnly: true
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
              - ALL
            runAsNonRoot: true
            runAsUser: 1000
        securityContext:
          fsGroup: 1000
          runAsUser: 1000
          seccompProfile:
            type: RuntimeDefault
        terminationGracePeriodSeconds: 30
        volumes:
        - name: registry-server-config-templates
          configMap:
            name: gitlab-registry
            items:
            - key: config.yml.tpl
              path: config.yml.tpl
        - name: registry-server-config
          emptyDir:
            medium: Memory
        - name: registry-secrets
          projected:
            sources:
            - configMap:
                name: gitlab-registry
            - secret:
                name: gitlab-registry-secret
                items:
                - key: registry-auth.crt
                  path: certificate.crt
            - secret:
                name: gitlab-registry-httpsecret
                items:
                - key: secret
                  path: httpSecret
            - secret:
                name: gitlab-object-store-configs
                items:
                - key: registry.yaml
                  path: storage/config
            - secret:
                name: gitlab-registry-db-pass
                items:
                - key: password
                  path: database_password
        - name: etc-ssl-certs
          emptyDir:
            medium: Memory
        - name: etc-pki-ca-trust-extracted-pem
          emptyDir:
            medium: Memory
        - name: custom-ca-certificates
          projected:
            defaultMode: 288
            sources:
            - secret:
                name: aethernet.crt
            - secret:
                name: gitlab-wildcard-tls-ca
  


(root level)
+ one document added:
  apiVersion: autoscaling/v2beta1
  kind: HorizontalPodAutoscaler
  metadata:
    name: gitlab-gitlab-shell
    namespace: gitlab
    labels:
      app: gitlab-shell
      helm.toolkit.fluxcd.io/name: gitlab
      helm.toolkit.fluxcd.io/namespace: flux-system
      heritage: Helm
      release: gitlab
  spec:
    maxReplicas: 10
    metrics:
    - type: Resource
      resource:
        name: cpu
        targetAverageValue: 100m
    minReplicas: 2
    scaleTargetRef:
      apiVersion: apps/v1
      kind: Deployment
      name: gitlab-gitlab-shell

(root level)
+ one document added:
  apiVersion: autoscaling/v2beta1
  kind: HorizontalPodAutoscaler
  metadata:
    name: gitlab-kas
    namespace: gitlab
    labels:
      app: kas
      helm.toolkit.fluxcd.io/name: gitlab
      helm.toolkit.fluxcd.io/namespace: flux-system
      heritage: Helm
      release: gitlab
  spec:
    maxReplicas: 10
    metrics:
    - type: Resource
      resource:
        name: cpu
        targetAverageValue: 100m
    minReplicas: 2
    scaleTargetRef:
      apiVersion: apps/v1
      kind: Deployment
      name: gitlab-kas

(root level)
+ one document added:
  apiVersion: autoscaling/v2beta1
  kind: HorizontalPodAutoscaler
  metadata:
    name: gitlab-sidekiq-all-in-1-v2
    namespace: gitlab
    labels:
      app: sidekiq
      helm.toolkit.fluxcd.io/name: gitlab
      helm.toolkit.fluxcd.io/namespace: flux-system
      heritage: Helm
      release: gitlab
  spec:
    maxReplicas: 10
    metrics:
    - type: Resource
      resource:
        name: cpu
        targetAverageValue: 350m
    minReplicas: 1
    scaleTargetRef:
      apiVersion: apps/v1
      kind: Deployment
      name: gitlab-sidekiq-all-in-1-v2

(root level)
+ one document added:
  apiVersion: autoscaling/v2beta1
  kind: HorizontalPodAutoscaler
  metadata:
    name: gitlab-webservice-default
    namespace: gitlab
    labels:
      app: webservice
      gitlab.com/webservice-name: default
      helm.toolkit.fluxcd.io/name: gitlab
      helm.toolkit.fluxcd.io/namespace: flux-system
      heritage: Helm
      release: gitlab
  spec:
    maxReplicas: 10
    metrics:
    - type: Resource
      resource:
        name: cpu
        targetAverageValue: 1
    minReplicas: 2
    scaleTargetRef:
      apiVersion: apps/v1
      kind: Deployment
      name: gitlab-webservice-default

(root level)
+ one document added:
  apiVersion: autoscaling/v2beta1
  kind: HorizontalPodAutoscaler
  metadata:
    name: gitlab-registry
    namespace: gitlab
    labels:
      app: registry
      helm.toolkit.fluxcd.io/name: gitlab
      helm.toolkit.fluxcd.io/namespace: flux-system
      heritage: Helm
      release: gitlab
  spec:
    maxReplicas: 10
    metrics:
    - type: Resource
      resource:
        name: cpu
        targetAverageUtilization: 75
    minReplicas: 2
    scaleTargetRef:
      apiVersion: apps/v1
      kind: Deployment
      name: gitlab-registry

(root level)
+ one document added:
  apiVersion: apps/v1
  kind: StatefulSet
  metadata:
    name: gitlab-gitaly
    namespace: gitlab
    labels:
      app: gitaly
      app.kubernetes.io/name: gitlab
      helm.toolkit.fluxcd.io/name: gitlab
      helm.toolkit.fluxcd.io/namespace: flux-system
      heritage: Helm
      release: gitlab
  spec:
    podManagementPolicy: Parallel
    replicas: 1
    selector:
      matchLabels:
        app: gitaly
        release: gitlab
    serviceName: gitlab-gitaly
    template:
      metadata:
        annotations:
          gitlab.com/prometheus_path: /metrics
          gitlab.com/prometheus_port: "9236"
          gitlab.com/prometheus_scrape: "true"
          prometheus.io/path: /metrics
          prometheus.io/port: "9236"
          prometheus.io/scrape: "true"
        labels:
          app: gitaly
          app.kubernetes.io/name: gitlab
          heritage: Helm
          release: gitlab
      spec:
        affinity:
          podAntiAffinity:
            preferredDuringSchedulingIgnoredDuringExecution:
            - podAffinityTerm:
                labelSelector:
                  matchLabels:
                    app: gitaly
                    release: gitlab
                topologyKey: kubernetes.io/hostname
              weight: 1
        automountServiceAccountToken: false
        containers:
        - name: gitaly
          image: "registry.gitlab.com/gitlab-org/build/cng/gitaly:v18.8.2"
          env:
          - name: CONFIG_TEMPLATE_DIRECTORY
            value: /etc/gitaly/templates
          - name: CONFIG_DIRECTORY
            value: /etc/gitaly
          - name: GITALY_CONFIG_FILE
            value: /etc/gitaly/config.toml
          - name: SSL_CERT_DIR
            value: /etc/ssl/certs
          - name: GODEBUG
            value: "tlsmlkem=0,tlskyber=0"
          - name: TZ
            value: UTC
          livenessProbe:
            failureThreshold: 3
            grpc:
              port: 8075
            initialDelaySeconds: 0
            periodSeconds: 10
            successThreshold: 1
            timeoutSeconds: 3
          ports:
          - name: grpc-gitaly
            containerPort: 8075
          - name: http-metrics
            containerPort: 9236
          readinessProbe:
            failureThreshold: 3
            grpc:
              port: 8075
            initialDelaySeconds: 0
            periodSeconds: 5
            successThreshold: 1
            timeoutSeconds: 3
          resources:
            requests:
              cpu: 100m
              memory: 200Mi
          startupProbe:
            failureThreshold: 60
            grpc:
              port: 8075
            initialDelaySeconds: 1
            periodSeconds: 1
            successThreshold: 1
            timeoutSeconds: 1
          volumeMounts:
          - name: etc-ssl-certs
            mountPath: /etc/ssl/certs/
            readOnly: true
          - name: etc-pki-ca-trust-extracted-pem
            mountPath: /etc/pki/ca-trust/extracted/pem
            readOnly: true
          - name: gitaly-config
            mountPath: /etc/gitaly/templates
          - name: gitaly-secrets
            mountPath: /etc/gitlab-secrets
            readOnly: true
          - name: repo-data
            mountPath: /home/git/repositories
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
              - ALL
            runAsNonRoot: true
            runAsUser: 1000
        initContainers:
        - name: certificates
          image: "registry.gitlab.com/gitlab-org/build/cng/certificates:v18.8.2"
          env:
          - name: TZ
            value: UTC
          resources:
            requests:
              cpu: 50m
          volumeMounts:
          - name: etc-ssl-certs
            mountPath: /etc/ssl/certs
            readOnly: false
          - name: etc-pki-ca-trust-extracted-pem
            mountPath: /etc/pki/ca-trust/extracted/pem
            readOnly: false
          - name: custom-ca-certificates
            mountPath: /usr/local/share/ca-certificates
            readOnly: true
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
              - ALL
            runAsNonRoot: true
        - name: configure
          image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-base:v18.8.2"
          command:
          - sh
          - /config/configure
          env:
          - name: TZ
            value: UTC
          resources:
            requests:
              cpu: 50m
          volumeMounts:
          - name: gitaly-config
            mountPath: /config
            readOnly: true
          - name: init-gitaly-secrets
            mountPath: /init-config
            readOnly: true
          - name: gitaly-secrets
            mountPath: /init-secrets
            readOnly: false
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
              - ALL
            runAsNonRoot: true
        securityContext:
          fsGroup: 1000
          runAsUser: 1000
        terminationGracePeriodSeconds: 30
        volumes:
        - name: gitaly-config
          configMap:
            name: gitlab-gitaly
        - name: gitaly-secrets
          emptyDir:
            medium: Memory
        - name: init-gitaly-secrets
          projected:
            defaultMode: 288
            sources:
            - secret:
                name: gitlab-gitaly-secret
                items:
                - key: token
                  path: gitaly_token
            - secret:
                name: gitlab-gitlab-shell-secret
                items:
                - key: secret
                  path: .gitlab_shell_secret
        - name: etc-ssl-certs
          emptyDir:
            medium: Memory
        - name: etc-pki-ca-trust-extracted-pem
          emptyDir:
            medium: Memory
        - name: custom-ca-certificates
          projected:
            defaultMode: 288
            sources:
            - secret:
                name: aethernet.crt
            - secret:
                name: gitlab-wildcard-tls-ca
    volumeClaimTemplates:
    - metadata:
        name: repo-data
        annotations: null
        labels:
          app: gitaly
          release: gitlab
      spec:
        resources:
          requests:
            storage: 50Gi
        selector: null
        storageClassName: nfs-subdir
        accessModes:
        - ReadWriteOnce

(root level)
+ one document added:
  apiVersion: apps/v1
  kind: StatefulSet
  metadata:
    name: gitlab-redis-master
    namespace: gitlab
    labels:
      app.kubernetes.io/component: master
      app.kubernetes.io/instance: gitlab
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: redis
      helm.toolkit.fluxcd.io/name: gitlab
      helm.toolkit.fluxcd.io/namespace: flux-system
  spec:
    replicas: 1
    selector:
      matchLabels:
        app.kubernetes.io/component: master
        app.kubernetes.io/instance: gitlab
        app.kubernetes.io/name: redis
    serviceName: gitlab-redis-headless
    template:
      metadata:
        annotations:
          prometheus.io/port: "9121"
          prometheus.io/scrape: "true"
        labels:
          app.kubernetes.io/component: master
          app.kubernetes.io/instance: gitlab
          app.kubernetes.io/managed-by: Helm
          app.kubernetes.io/name: redis
      spec:
        affinity:
          nodeAffinity: null
          podAffinity: null
          podAntiAffinity:
            preferredDuringSchedulingIgnoredDuringExecution:
            - podAffinityTerm:
                labelSelector:
                  matchLabels:
                    app.kubernetes.io/component: master
                    app.kubernetes.io/instance: gitlab
                    app.kubernetes.io/name: redis
                topologyKey: kubernetes.io/hostname
              weight: 1
        automountServiceAccountToken: false
        containers:
        - name: redis
          image: "docker.io/bitnamilegacy/redis:7.2.4-debian-12-r9"
          imagePullPolicy: IfNotPresent
          args:
          - "-c"
          - /opt/bitnami/scripts/start-scripts/start-master.sh
          command:
          - /bin/bash
          env:
          - name: BITNAMI_DEBUG
            value: "false"
          - name: REDIS_REPLICATION_MODE
            value: master
          - name: ALLOW_EMPTY_PASSWORD
            value: no
          - name: REDIS_PASSWORD_FILE
            value: /opt/bitnami/redis/secrets/redis-password
          - name: REDIS_TLS_ENABLED
            value: no
          - name: REDIS_PORT
            value: "6379"
          ports:
          - name: redis
            containerPort: 6379
          volumeMounts:
          - name: start-scripts
            mountPath: /opt/bitnami/scripts/start-scripts
          - name: health
            mountPath: /health
          - name: redis-password
            mountPath: /opt/bitnami/redis/secrets/
          - name: redis-data
            mountPath: /data
          - name: config
            mountPath: /opt/bitnami/redis/mounted-etc
          - name: empty-dir
            mountPath: /opt/bitnami/redis/etc/
            subPath: app-conf-dir
          - name: empty-dir
            mountPath: /tmp
            subPath: tmp-dir
          livenessProbe:
            exec:
              command:
              - sh
              - "-c"
              - "/health/ping_liveness_local.sh 5"
            failureThreshold: 5
            initialDelaySeconds: 20
            periodSeconds: 5
            successThreshold: 1
            timeoutSeconds: 6
          readinessProbe:
            exec:
              command:
              - sh
              - "-c"
              - "/health/ping_readiness_local.sh 1"
            failureThreshold: 5
            initialDelaySeconds: 20
            periodSeconds: 5
            successThreshold: 1
            timeoutSeconds: 2
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
              - ALL
            readOnlyRootFilesystem: false
            runAsGroup: 0
            runAsNonRoot: true
            runAsUser: 1001
            seLinuxOptions: null
            seccompProfile:
              type: RuntimeDefault
        - name: metrics
          image: "docker.io/bitnamilegacy/redis-exporter:1.58.0-debian-12-r4"
          imagePullPolicy: IfNotPresent
          command:
          - /bin/bash
          - "-c"
          - |
            if [[ -f '/secrets/redis-password' ]]; then
            export REDIS_PASSWORD=$(cat /secrets/redis-password)
            fi
            redis_exporter

          env:
          - name: REDIS_ALIAS
            value: gitlab-redis
          - name: REDIS_EXPORTER_WEB_LISTEN_ADDRESS
            value: ":9121"
          - name: REDIS_USER
            value: default
          livenessProbe:
            failureThreshold: 5
            initialDelaySeconds: 10
            periodSeconds: 10
            successThreshold: 1
            tcpSocket:
              port: metrics
            timeoutSeconds: 5
          ports:
          - name: metrics
            containerPort: 9121
          readinessProbe:
            failureThreshold: 3
            httpGet:
              path: /
              port: metrics
            initialDelaySeconds: 5
            periodSeconds: 10
            successThreshold: 1
            timeoutSeconds: 1
          volumeMounts:
          - name: empty-dir
            mountPath: /tmp
            subPath: app-tmp-dir
          - name: redis-password
            mountPath: /secrets/
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
              - ALL
            readOnlyRootFilesystem: false
            runAsGroup: 0
            runAsNonRoot: true
            runAsUser: 1001
            seLinuxOptions: null
            seccompProfile:
              type: RuntimeDefault
        enableServiceLinks: true
        securityContext:
          fsGroup: 1001
          fsGroupChangePolicy: Always
          supplementalGroups: []
          sysctls: []
        serviceAccountName: gitlab-redis-master
        terminationGracePeriodSeconds: 30
        volumes:
        - name: start-scripts
          configMap:
            name: gitlab-redis-scripts
            defaultMode: 493
        - name: health
          configMap:
            name: gitlab-redis-health
            defaultMode: 493
        - name: redis-password
          secret:
            items:
            - key: secret
              path: redis-password
            secretName: gitlab-redis-secret
        - name: config
          configMap:
            name: gitlab-redis-configuration
        - name: empty-dir
          emptyDir: {}
    updateStrategy:
      type: RollingUpdate
    volumeClaimTemplates:
    - apiVersion: v1
      kind: PersistentVolumeClaim
      metadata:
        name: redis-data
        labels:
          app.kubernetes.io/component: master
          app.kubernetes.io/instance: gitlab
          app.kubernetes.io/name: redis
      spec:
        resources:
          requests:
            storage: 8Gi
        storageClassName: longhorn
        accessModes:
        - ReadWriteOnce

(root level)
+ one document added:
  apiVersion: batch/v1
  kind: Job
  metadata:
    name: gitlab-migrations-c0164a8
    namespace: gitlab
    labels:
      app: migrations
      helm.toolkit.fluxcd.io/name: gitlab
      helm.toolkit.fluxcd.io/namespace: flux-system
      heritage: Helm
      release: gitlab
  spec:
    activeDeadlineSeconds: 3600
    backoffLimit: 6
    template:
      metadata:
        labels:
          app: migrations
          heritage: Helm
          release: gitlab
      spec:
        automountServiceAccountToken: false
        containers:
        - name: migrations
          image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-toolbox-ce:v18.8.2"
          args:
          - /bin/bash
          - "-c"
          - |
            set -e;
            /scripts/wait-for-deps;
            /scripts/db-migrate;
                                
            
          env:
          - name: CONFIG_TEMPLATE_DIRECTORY
            value: /var/opt/gitlab/templates
          - name: CONFIG_DIRECTORY
            value: /srv/gitlab/config
          - name: BYPASS_SCHEMA_VERSION
            value: "true"
          - name: ENABLE_BOOTSNAP
            value: "1"
          - name: TZ
            value: UTC
          resources:
            requests:
              cpu: 250m
              memory: 200Mi
          volumeMounts:
          - name: migrations-config
            mountPath: /var/opt/gitlab/templates
          - name: migrations-secrets
            mountPath: /etc/gitlab
            readOnly: true
          - name: migrations-secrets
            mountPath: /srv/gitlab/config/secrets.yml
            subPath: rails-secrets/secrets.yml
          - name: migrations-secrets
            mountPath: /srv/gitlab/config/initial_root_password
            subPath: migrations/initial_root_password
          - name: migrations-secrets
            mountPath: /srv/gitlab/config/gitlab_shared_runners_registration_token
            subPath: migrations/gitlab_shared_runners_registration_token
          - name: etc-ssl-certs
            mountPath: /etc/ssl/certs/
            readOnly: true
          - name: etc-pki-ca-trust-extracted-pem
            mountPath: /etc/pki/ca-trust/extracted/pem
            readOnly: true
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
              - ALL
            runAsNonRoot: true
            runAsUser: 1000
        initContainers:
        - name: certificates
          image: "registry.gitlab.com/gitlab-org/build/cng/certificates:v18.8.2"
          env:
          - name: TZ
            value: UTC
          resources:
            requests:
              cpu: 50m
          volumeMounts:
          - name: etc-ssl-certs
            mountPath: /etc/ssl/certs
            readOnly: false
          - name: etc-pki-ca-trust-extracted-pem
            mountPath: /etc/pki/ca-trust/extracted/pem
            readOnly: false
          - name: custom-ca-certificates
            mountPath: /usr/local/share/ca-certificates
            readOnly: true
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
              - ALL
            runAsNonRoot: true
        - name: configure
          image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-base:v18.8.2"
          command:
          - sh
          - /config/configure
          env:
          - name: TZ
            value: UTC
          resources:
            requests:
              cpu: 50m
          volumeMounts:
          - name: migrations-config
            mountPath: /config
            readOnly: true
          - name: init-migrations-secrets
            mountPath: /init-config
            readOnly: true
          - name: migrations-secrets
            mountPath: /init-secrets
            readOnly: false
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
              - ALL
            runAsNonRoot: true
        restartPolicy: OnFailure
        securityContext:
          fsGroup: 1000
          runAsUser: 1000
          seccompProfile:
            type: RuntimeDefault
        volumes:
        - name: migrations-config
          configMap:
            name: gitlab-migrations
        - name: init-migrations-secrets
          projected:
            defaultMode: 256
            sources:
            - secret:
                name: gitlab-rails-secret
                items:
                - key: secrets.yml
                  path: rails-secrets/secrets.yml
            - secret:
                name: gitlab-gitaly-secret
                items:
                - key: token
                  path: gitaly/gitaly_token
            - secret:
                name: gitlab-redis-secret
                items:
                - key: secret
                  path: redis/redis-password
            - secret:
                name: db-gitlab-app
                items:
                - key: password
                  path: postgres/psql-password-ci
            - secret:
                name: db-gitlab-app
                items:
                - key: password
                  path: postgres/psql-password-main
            - secret:
                name: gitlab-object-store-configs
                items:
                - key: connection.yaml
                  path: objectstorage/object_store
            - secret:
                name: gitlab-gitlab-initial-root-password
                items:
                - key: password
                  path: migrations/initial_root_password
            - secret:
                name: gitlab-gitlab-runner-secret
                optional: true
                items:
                - key: runner-registration-token
                  path: migrations/gitlab_shared_runners_registration_token
        - name: migrations-secrets
          emptyDir:
            medium: Memory
        - name: etc-ssl-certs
          emptyDir:
            medium: Memory
        - name: etc-pki-ca-trust-extracted-pem
          emptyDir:
            medium: Memory
        - name: custom-ca-certificates
          projected:
            defaultMode: 288
            sources:
            - secret:
                name: aethernet.crt
            - secret:
                name: gitlab-wildcard-tls-ca
  


(root level)
+ one document added:
  apiVersion: batch/v1
  kind: Job
  metadata:
    name: gitlab-registry-migrations-8e2a9a9
    namespace: gitlab
    labels:
      app: registry-migrations
      helm.toolkit.fluxcd.io/name: gitlab
      helm.toolkit.fluxcd.io/namespace: flux-system
      heritage: Helm
      release: gitlab
  spec:
    activeDeadlineSeconds: 3600
    backoffLimit: 6
    template:
      metadata:
        labels:
          app: registry-migrations
          heritage: Helm
          release: gitlab
      spec:
        containers:
        - name: migrations
          image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-container-registry:v4.33.0-gitlab"
          args:
          - /scripts/wait-for-deps
          - /scripts/db-migrate
          env:
          - name: BYPASS_SCHEMA_VERSION
            value: "true"
          resources:
            requests:
              cpu: 50m
              memory: 32Mi
          volumeMounts:
          - name: registry-server-config
            mountPath: /etc/docker/registry/
            readOnly: true
          - name: etc-ssl-certs
            mountPath: /etc/ssl/certs/
            readOnly: true
          - name: etc-pki-ca-trust-extracted-pem
            mountPath: /etc/pki/ca-trust/extracted/pem
            readOnly: true
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
              - ALL
            runAsNonRoot: true
            runAsUser: 1000
        initContainers:
        - name: certificates
          image: "registry.gitlab.com/gitlab-org/build/cng/certificates:v18.8.2"
          env:
          - name: TZ
            value: UTC
          resources:
            requests:
              cpu: 50m
          volumeMounts:
          - name: etc-ssl-certs
            mountPath: /etc/ssl/certs
            readOnly: false
          - name: etc-pki-ca-trust-extracted-pem
            mountPath: /etc/pki/ca-trust/extracted/pem
            readOnly: false
          - name: custom-ca-certificates
            mountPath: /usr/local/share/ca-certificates
            readOnly: true
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
              - ALL
            runAsNonRoot: true
            runAsUser: 1000
        - name: configure
          image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-base:v18.8.2"
          args:
          - sh
          - /config/configure
          env:
          - name: CONFIG_TEMPLATE_DIRECTORY
            value: /templates
          - name: CONFIG_DIRECTORY
            value: /registry
          resources:
            requests:
              cpu: 50m
          volumeMounts:
          - name: registry-secrets
            mountPath: /config
          - name: registry-server-config-templates
            mountPath: /templates
            readOnly: true
          - name: registry-server-config
            mountPath: /registry
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
              - ALL
            runAsNonRoot: true
            runAsUser: 1000
        restartPolicy: OnFailure
        securityContext:
          fsGroup: 1000
          runAsUser: 1000
          seccompProfile:
            type: RuntimeDefault
        volumes:
        - name: registry-server-config-templates
          configMap:
            name: gitlab-registry
            items:
            - key: migrations-config.yml.tpl
              path: config.yml.tpl
        - name: registry-server-config
          emptyDir:
            medium: Memory
        - name: registry-secrets
          projected:
            sources:
            - configMap:
                name: gitlab-registry
                items:
                - key: configure
                  path: configure
            - secret:
                name: gitlab-registry-db-pass
                items:
                - key: password
                  path: database_password
        - name: etc-ssl-certs
          emptyDir:
            medium: Memory
        - name: etc-pki-ca-trust-extracted-pem
          emptyDir:
            medium: Memory
        - name: custom-ca-certificates
          projected:
            defaultMode: 288
            sources:
            - secret:
                name: aethernet.crt
            - secret:
                name: gitlab-wildcard-tls-ca
  


(root level)
+ one document added:
  apiVersion: batch/v1beta1
  kind: CronJob
  metadata:
    name: gitlab-toolbox-backup
    namespace: gitlab
    labels:
      app: toolbox
      helm.toolkit.fluxcd.io/name: gitlab
      helm.toolkit.fluxcd.io/namespace: flux-system
      heritage: Helm
      release: gitlab
  spec:
    concurrencyPolicy: Replace
    failedJobsHistoryLimit: 1
    jobTemplate:
      spec:
        backoffLimit: 6
        template:
          metadata:
            annotations:
              cluster-autoscaler.kubernetes.io/safe-to-evict: "false"
            labels:
              app: toolbox
              heritage: Helm
              release: gitlab
          spec:
            containers:
            - name: toolbox-backup
              image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-toolbox-ce:v18.8.2"
              args:
              - /bin/bash
              - "-c"
              - "cp /etc/gitlab/.s3cfg $HOME/.s3cfg && backup-utility --skip registry --skip packages --skip pages --skip artifacts"
              env:
              - name: ARTIFACTS_BUCKET_NAME
                value: gitlab-artifacts
              - name: REGISTRY_BUCKET_NAME
                value: gitlab-container-registry
              - name: LFS_BUCKET_NAME
                value: gitlab-lfs
              - name: UPLOADS_BUCKET_NAME
                value: gitlab-uploads
              - name: PACKAGES_BUCKET_NAME
                value: gitlab-packages
              - name: EXTERNAL_DIFFS_BUCKET_NAME
                value: gitlab-external-diffs
              - name: TERRAFORM_STATE_BUCKET_NAME
                value: gitlab-terraform-state
              - name: CI_SECURE_FILES_BUCKET_NAME
                value: gitlab-ci-secure-files
              - name: BACKUP_BUCKET_NAME
                value: gitlab-backup
              - name: BACKUP_BACKEND
                value: s3
              - name: TMP_BUCKET_NAME
                value: gitlab-tmp-storage
              - name: PAGES_BUCKET_NAME
                value: gitlab-pages
              - name: CONFIG_TEMPLATE_DIRECTORY
                value: /var/opt/gitlab/templates
              - name: CONFIG_DIRECTORY
                value: /srv/gitlab/config
              - name: TZ
                value: UTC
              resources:
                requests:
                  cpu: 50m
                  memory: 350M
              volumeMounts:
              - name: toolbox-config
                mountPath: /var/opt/gitlab/templates
              - name: toolbox-secrets
                mountPath: /etc/gitlab
                readOnly: true
              - name: toolbox-secrets
                mountPath: /srv/gitlab/config/secrets.yml
                subPath: rails-secrets/secrets.yml
              - name: toolbox-tmp
                mountPath: /srv/gitlab/tmp
                readOnly: false
              - name: etc-ssl-certs
                mountPath: /etc/ssl/certs/
                readOnly: true
              - name: etc-pki-ca-trust-extracted-pem
                mountPath: /etc/pki/ca-trust/extracted/pem
                readOnly: true
              securityContext:
                allowPrivilegeEscalation: false
                capabilities:
                  drop:
                  - ALL
                runAsNonRoot: true
                runAsUser: 1000
            initContainers:
            - name: certificates
              image: "registry.gitlab.com/gitlab-org/build/cng/certificates:v18.8.2"
              env:
              - name: TZ
                value: UTC
              resources:
                requests:
                  cpu: 50m
              volumeMounts:
              - name: etc-ssl-certs
                mountPath: /etc/ssl/certs
                readOnly: false
              - name: etc-pki-ca-trust-extracted-pem
                mountPath: /etc/pki/ca-trust/extracted/pem
                readOnly: false
              - name: custom-ca-certificates
                mountPath: /usr/local/share/ca-certificates
                readOnly: true
              securityContext:
                allowPrivilegeEscalation: false
                capabilities:
                  drop:
                  - ALL
                runAsNonRoot: true
                runAsUser: 1000
            - name: configure
              image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-base:v18.8.2"
              command:
              - sh
              - /config/configure
              env:
              - name: TZ
                value: UTC
              resources:
                requests:
                  cpu: 50m
              volumeMounts:
              - name: toolbox-config
                mountPath: /config
                readOnly: true
              - name: init-toolbox-secrets
                mountPath: /init-config
                readOnly: true
              - name: toolbox-secrets
                mountPath: /init-secrets
                readOnly: false
              securityContext:
                allowPrivilegeEscalation: false
                capabilities:
                  drop:
                  - ALL
                runAsNonRoot: true
                runAsUser: 1000
            restartPolicy: OnFailure
            securityContext:
              fsGroup: 1000
              runAsGroup: 1000
              runAsUser: 1000
              seccompProfile:
                type: RuntimeDefault
            volumes:
            - name: toolbox-config
              projected:
                sources:
                - configMap:
                    name: gitlab-toolbox
            - name: toolbox-tmp
              emptyDir: {}
            - name: init-toolbox-secrets
              projected:
                defaultMode: 256
                sources:
                - secret:
                    name: gitlab-rails-secret
                    items:
                    - key: secrets.yml
                      path: rails-secrets/secrets.yml
                - secret:
                    name: gitlab-gitlab-shell-secret
                    items:
                    - key: secret
                      path: shell/.gitlab_shell_secret
                - secret:
                    name: gitlab-gitaly-secret
                    items:
                    - key: token
                      path: gitaly/gitaly_token
                - secret:
                    name: gitlab-redis-secret
                    items:
                    - key: secret
                      path: redis/redis-password
                - secret:
                    name: db-gitlab-app
                    items:
                    - key: password
                      path: postgres/psql-password-ci
                - secret:
                    name: db-gitlab-app
                    items:
                    - key: password
                      path: postgres/psql-password-main
                - secret:
                    name: gitlab-registry-secret
                    items:
                    - key: registry-auth.key
                      path: registry/gitlab-registry.key
                - secret:
                    name: gitlab-registry-notification
                    items:
                    - key: secret
                      path: registry/notificationSecret
                - secret:
                    name: gitlab-object-store-configs
                    items:
                    - key: s3cmd.cfg
                      path: objectstorage/.s3cfg
                - secret:
                    name: gitlab-gitlab-kas-secret
                    items:
                    - key: kas_shared_secret
                      path: kas/.gitlab_kas_secret
                - secret:
                    name: gitlab-object-store-configs
                    items:
                    - key: connection.yaml
                      path: objectstorage/object_store
                - secret:
                    name: authentik-oidc
                    items:
                    - key: config.yaml
                      path: omniauth/authentik-oidc/config.yaml
            - name: toolbox-secrets
              emptyDir:
                medium: Memory
            - name: etc-ssl-certs
              emptyDir:
                medium: Memory
            - name: etc-pki-ca-trust-extracted-pem
              emptyDir:
                medium: Memory
            - name: custom-ca-certificates
              projected:
                defaultMode: 288
                sources:
                - secret:
                    name: aethernet.crt
                - secret:
                    name: gitlab-wildcard-tls-ca
    schedule: @daily
    startingDeadlineSeconds: null
    successfulJobsHistoryLimit: 3
    suspend: false
  


(root level)
+ one document added:
  apiVersion: v1
  kind: ServiceAccount
  metadata:
    name: gitlab-shared-secrets
    namespace: gitlab
    annotations:
      helm.sh/hook: "pre-install,pre-upgrade"
      helm.sh/hook-delete-policy: "hook-succeeded,before-hook-creation"
      helm.sh/hook-weight: "-5"
    labels:
      app: gitlab
      heritage: Helm
      release: gitlab

(root level)
+ one document added:
  apiVersion: v1
  kind: ConfigMap
  metadata:
    name: gitlab-shared-secrets
    namespace: gitlab
    annotations:
      helm.sh/hook: "pre-install,pre-upgrade"
      helm.sh/hook-delete-policy: "hook-succeeded,before-hook-creation"
      helm.sh/hook-weight: "-3"
    labels:
      app: gitlab
      heritage: Helm
      release: gitlab
  data:
    generate-secrets: |
      # vim: set filetype=sh:
      
      namespace=gitlab
      release=gitlab
      env=production
      
      pushd $(mktemp -d)
      
      # Args pattern, length
      function gen_random(){
        head -c 4096 /dev/urandom | LC_CTYPE=C tr -cd $1 | head -c $2
      }
      
      # Args: length
      function gen_random_base64(){
        local len="$1"
        gen_random_bytes "$len" | base64 -w0
      }
      
      # Args: length
      function gen_random_bytes(){
        local len="$1"
        head -c "$len" /dev/urandom
      }
      
      # Args: yaml file, search path
      function fetch_rails_value(){
        local value=$(yq --prettyPrint --no-colors ".${2}" $1)
      
        # Don't return null values
        if [ "${value}" != "null" ]; then echo "${value}"; fi
      }
      
      # Args: secretname
      function label_secret(){
        local secret_name=$1
      # Remove application labels if they exist
        kubectl --namespace=$namespace label \
          secret $secret_name $(echo 'app.kubernetes.io/name=gitlab' | sed -E 's/=[^ ]*/-/g')
      
        kubectl --namespace=$namespace label \
          --overwrite \
          secret $secret_name app=gitlab chart=gitlab-9.8.2 release=gitlab heritage=Helm 
      }
      
      # Args: secretname, args
      function generate_secret_if_needed(){
        local secret_args=( "${@:2}")
        local secret_name=$1
      
        if ! $(kubectl --namespace=$namespace get secret $secret_name > /dev/null 2>&1); then
          kubectl --namespace=$namespace create secret generic $secret_name ${secret_args[@]}
        else
          echo "secret \"$secret_name\" already exists."
      
          for arg in "${secret_args[@]}"; do
            local from=$(echo -n ${arg} | cut -d '=' -f1)
      
            if [ -z "${from##*literal*}" ]; then
              local key=$(echo -n ${arg} | cut -d '=' -f2)
              local desiredValue=$(echo -n ${arg} | cut -d '=' -f3-)
              local flags="--namespace=$namespace --allow-missing-template-keys=false"
      
              if ! $(kubectl $flags get secret $secret_name -ojsonpath="{.data.${key}}" > /dev/null 2>&1); then
                echo "key \"${key}\" does not exist. patching it in."
      
                if [ "${desiredValue}" != "" ]; then
                  desiredValue=$(echo -n "${desiredValue}" | base64 -w 0)
                fi
      
                kubectl --namespace=$namespace patch secret ${secret_name} -p "{\"data\":{\"$key\":\"${desiredValue}\"}}"
              fi
            fi
          done
        fi
      
        label_secret $secret_name
      }
      
      # Initial root password
      generate_secret_if_needed "gitlab-gitlab-initial-root-password" --from-literal="password"=$(gen_random 'a-zA-Z0-9' 64)
      
      
      # Redis password
      generate_secret_if_needed "gitlab-redis-secret" --from-literal="secret"=$(gen_random 'a-zA-Z0-9' 64)
      
      
      
      
      # Gitlab shell
      generate_secret_if_needed "gitlab-gitlab-shell-secret" --from-literal="secret"=$(gen_random 'a-zA-Z0-9' 64)
      
      # Gitaly secret
      generate_secret_if_needed "gitlab-gitaly-secret" --from-literal="token"=$(gen_random 'a-zA-Z0-9' 64)
      
      
      
      # Gitlab runner secret
      generate_secret_if_needed "gitlab-gitlab-runner-secret" --from-literal=runner-registration-token=$(gen_random 'a-zA-Z0-9' 64) --from-literal=runner-token=""
      
      # GitLab Pages API secret
      
      
      # GitLab Pages auth secret for hashing cookie store when using access control
      
      
      # GitLab Pages OAuth secret
      
      
      # Gitlab-kas secret
      generate_secret_if_needed "gitlab-gitlab-kas-secret" --from-literal="kas_shared_secret"=$(gen_random 'a-zA-Z0-9' 32 | base64)
      
      # Gitlab-kas private API secret
      generate_secret_if_needed "gitlab-kas-private-api" --from-literal="kas_private_api_secret"=$(gen_random 'a-zA-Z0-9' 32 | base64)
      
      # Gitlab-kas WebSocket Token secret
      generate_secret_if_needed "gitlab-kas-websocket-token" --from-literal="kas_websocket_token_secret"=$(gen_random_base64 72)
      
      
      
      
      
      
      
      
      # Registry certificates
      mkdir -p certs
      openssl req -new -newkey rsa:4096 -subj "/CN=gitlab-issuer" -nodes -x509 -keyout certs/registry-example-com.key -out certs/registry-example-com.crt -days 3650
      generate_secret_if_needed "gitlab-registry-secret" --from-file=registry-auth.key=certs/registry-example-com.key --from-file=registry-auth.crt=certs/registry-example-com.crt
      
      # config/secrets.yaml
      if [ -n "$env" ]; then
        rails_secret="gitlab-rails-secret"
      
        # Fetch the values from the existing secret if it exists
        if $(kubectl --namespace=$namespace get secret $rails_secret > /dev/null 2>&1); then
          kubectl --namespace=$namespace get secret $rails_secret -o jsonpath="{.data.secrets\.yml}" | base64 --decode > secrets.yml
          secret_key_base=$(fetch_rails_value secrets.yml "${env}.secret_key_base")
          otp_key_base=$(fetch_rails_value secrets.yml "${env}.otp_key_base")
          db_key_base=$(fetch_rails_value secrets.yml "${env}.db_key_base")
          openid_connect_signing_key=$(fetch_rails_value secrets.yml "${env}.openid_connect_signing_key")
          encrypted_settings_key_base=$(fetch_rails_value secrets.yml "${env}.encrypted_settings_key_base")
      
          active_record_encryption_primary_keys=$(fetch_rails_value secrets.yml "${env}.active_record_encryption_primary_key")
          active_record_encryption_deterministic_keys=$(fetch_rails_value secrets.yml "${env}.active_record_encryption_deterministic_key")
          active_record_encryption_key_derivation_salt=$(fetch_rails_value secrets.yml "${env}.active_record_encryption_key_derivation_salt")
        fi;
      
        # Generate defaults for any unset secrets
        secret_key_base="${secret_key_base:-$(gen_random 'a-f0-9' 128)}" # equivalent to secureRandom.hex(64)
        otp_key_base="${otp_key_base:-$(gen_random 'a-f0-9' 128)}" # equivalent to secureRandom.hex(64)
        db_key_base="${db_key_base:-$(gen_random 'a-f0-9' 128)}" # equivalent to secureRandom.hex(64)
        openid_connect_signing_key="${openid_connect_signing_key:-$(openssl genrsa 2048)}"
        encrypted_settings_key_base="${encrypted_settings_key_base:-$(gen_random 'a-f0-9' 128)}" # equivalent to secureRandom.hex(64)
      
        # 1. We set the following two keys as an array to support keys rotation.
        #    The last key in the array is always used to encrypt data:
        #    https://github.com/rails/rails/blob/v7.0.8.4/activerecord/lib/active_record/encryption/key_provider.rb#L21
        #    while all the keys are used (in the order they're defined) to decrypt data:
        #    https://github.com/rails/rails/blob/v7.0.8.4/activerecord/lib/active_record/encryption/cipher.rb#L26.
        #    This allows to rotate keys by adding a new key as the last key, and start a re-encryption process that
        #    runs in the background: https://gitlab.com/gitlab-org/gitlab/-/issues/494976
        # 2. We use the same method and length as Rails' defaults:
        #    https://github.com/rails/rails/blob/v7.0.8.4/activerecord/lib/active_record/railties/databases.rake#L537-L540
        active_record_encryption_primary_keys=${active_record_encryption_primary_keys:-"- $(gen_random 'a-zA-Z0-9' 32)"}
        active_record_encryption_deterministic_keys=${active_record_encryption_deterministic_keys:-"- $(gen_random 'a-zA-Z0-9' 32)"}
        active_record_encryption_key_derivation_salt=${active_record_encryption_key_derivation_salt:-$(gen_random 'a-zA-Z0-9' 32)}
      
        # Update the existing secret
        cat << EOF > rails-secrets.yml
      apiVersion: v1
      kind: Secret
      metadata:
        name: $rails_secret
      type: Opaque
      stringData:
        secrets.yml: |-
          $env:
            secret_key_base: $secret_key_base
            otp_key_base: $otp_key_base
            db_key_base: $db_key_base
            encrypted_settings_key_base: $encrypted_settings_key_base
            openid_connect_signing_key: |
      $(echo "${openid_connect_signing_key}" | awk '{print "        " $0}')
            active_record_encryption_primary_key:
              $active_record_encryption_primary_keys
            active_record_encryption_deterministic_key:
              $active_record_encryption_deterministic_keys
            active_record_encryption_key_derivation_salt: $active_record_encryption_key_derivation_salt
      EOF
        kubectl --validate=false --namespace=$namespace apply -f rails-secrets.yml
        label_secret $rails_secret
      fi
      
      # Shell ssh host keys
      ssh-keygen -A
      mkdir -p host_keys
      cp /etc/ssh/ssh_host_* host_keys/
      generate_secret_if_needed "gitlab-gitlab-shell-host-keys" --from-file host_keys
      
      # Gitlab-workhorse secret
      generate_secret_if_needed "gitlab-gitlab-workhorse-secret" --from-literal="shared_secret"=$(gen_random 'a-zA-Z0-9' 32 | base64)
      
      # Registry http.secret secret
      generate_secret_if_needed "gitlab-registry-httpsecret" --from-literal="secret"=$(gen_random 'a-z0-9' 128 | base64 -w 0)
      
      # Container Registry notification_secret
      generate_secret_if_needed "gitlab-registry-notification" --from-literal="secret"=[\"$(gen_random 'a-zA-Z0-9' 32)\"]
      
  


(root level)
+ one document added:
  apiVersion: v1
  kind: ConfigMap
  metadata:
    name: gitlab-gitlab-upgrade-check
    namespace: gitlab
    annotations:
      helm.sh/hook: pre-upgrade
      helm.sh/hook-delete-policy: before-hook-creation
      helm.sh/hook-weight: "-11"
    labels:
      app: gitlab
      heritage: Helm
      release: gitlab
  data:
    runcheck: |
      #!/bin/sh
      
      set -e
      
      notify() {
        echo "$1"
        echo -n "$1 " >> /dev/termination-log
      }
      
      greater_version()
      {
        test "$(printf '%s\n' "$@" | sort -V | tail -n 1)" = "$1";
      }
      
      is_semver()
      {
        printf '%s' "$1" | grep -Eq "^[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}"
        return "$?"
      }
      
      # For the PostgreSQL upgrade, you either need both secrets, or no secrets.
      # If there are no secrets, we will create them for you.
      # If the secrets aren't in either of these states, we assume you are upgrading from an older version
      # This is running ahead of version checks to ensure this always runs. This is to account for
      # installations outside of the official helm repo.
      secrets_dir="/etc/secrets/postgresql"
      if [ -d "${secrets_dir}" ]; then
        if [ ! "$(ls -A ${secrets_dir}/..data/)" = "" ]; then
          if [ ! -f "${secrets_dir}/postgresql-postgres-password" ] || [ ! -f "${secrets_dir}/password" ]; then
            notify "You seem to be upgrading from a previous version of GitLab using the bundled PostgreSQL chart"
            notify "There are some manual steps which need to be performed in order to upgrade the database"
            notify "Please see the upgrade documentation for instructions on how to proceed:"
            notify "https://docs.gitlab.com/charts/installation/upgrade.html"
            exit 1
          fi
        fi
      fi
      MIN_VERSION=18.5
      CHART_MIN_VERSION=9.5
      
      # Remove 'v' prefix from GitLab version if present (set in Chart.yaml appVersions)
      GITLAB_VERSION=${GITLAB_VERSION#v}
      
      # Only run check for semver releases
      if ! is_semver "$GITLAB_VERSION"; then
        exit 0
      fi
      
      NEW_MAJOR_VERSION=$(echo $GITLAB_VERSION | awk -F "." '{print $1}')
      NEW_MINOR_VERSION=$(echo $GITLAB_VERSION | awk -F "." '{print $1"."$2}')
      
      NEW_CHART_MAJOR_VERSION=$(echo $CHART_VERSION | awk -F "." '{print $1}')
      NEW_CHART_MINOR_VERSION=$(echo $CHART_VERSION | awk -F "." '{print $1"."$2}')
      
      if [ ! -f /chart-info/gitlabVersion ]; then
        notify "It seems you are attempting an unsupported upgrade path."
        notify "Please follow the upgrade documentation at https://docs.gitlab.com/update/#upgrade-paths"
        exit 1
      fi
      
      OLD_VERSION_STRING=$(cat /chart-info/gitlabVersion)
      OLD_VERSION_STRING=${OLD_VERSION_STRING#v}
      OLD_CHART_VERSION_STRING=$(cat /chart-info/gitlabChartVersion)
      
      # Skip check if old version wasn't semver
      if ! is_semver "$OLD_VERSION_STRING"; then
        exit 0
      fi
      
      OLD_MAJOR_VERSION=$(echo $OLD_VERSION_STRING | awk -F "." '{print $1}')
      OLD_MINOR_VERSION=$(echo $OLD_VERSION_STRING | awk -F "." '{print $1"."$2}')
      OLD_CHART_MAJOR_VERSION=$(echo $OLD_CHART_VERSION_STRING | awk -F "." '{print $1}')
      OLD_CHART_MINOR_VERSION=$(echo $OLD_CHART_VERSION_STRING | awk -F "." '{print $1"."$2}')
      
      # Checking Version
      if ( ! greater_version "$OLD_MINOR_VERSION" "$MIN_VERSION" ) || ( ! greater_version "$OLD_CHART_MINOR_VERSION" "$CHART_MIN_VERSION" ); then
        notify "It seems you are upgrading the GitLab Helm Chart from ${OLD_CHART_VERSION_STRING} (GitLab ${OLD_VERSION_STRING}) to ${CHART_VERSION} (GitLab ${GITLAB_VERSION})."
        notify "It is required to upgrade to the latest ${CHART_MIN_VERSION}.x version first before proceeding."
        # Link to upgrade docs if it is a major version jump
        if [ "${OLD_MAJOR_VERSION}" -lt "${NEW_MAJOR_VERSION}" ] || [ "${OLD_CHART_MAJOR_VERSION}" -lt "${NEW_CHART_MAJOR_VERSION}" ]; then
          notify "Please follow the upgrade documentation at https://docs.gitlab.com/charts/releases/8_0.html"
          notify "and upgrade to GitLab Helm Chart version ${CHART_MIN_VERSION}.x before upgrading to ${CHART_VERSION}."
        fi
        exit 1
      fi
  


(root level)
+ one document added:
  apiVersion: rbac.authorization.k8s.io/v1
  kind: Role
  metadata:
    name: gitlab-shared-secrets
    namespace: gitlab
    annotations:
      helm.sh/hook: "pre-install,pre-upgrade"
      helm.sh/hook-delete-policy: "hook-succeeded,before-hook-creation"
      helm.sh/hook-weight: "-5"
    labels:
      app: shared-secrets
      heritage: Helm
      release: gitlab
  rules:
  - resources:
    - secrets
    apiGroups:
    -
    verbs:
    - get
    - list
    - create
    - patch

(root level)
+ one document added:
  apiVersion: rbac.authorization.k8s.io/v1
  kind: RoleBinding
  metadata:
    name: gitlab-shared-secrets
    namespace: gitlab
    annotations:
      helm.sh/hook: "pre-install,pre-upgrade"
      helm.sh/hook-delete-policy: "hook-succeeded,before-hook-creation"
      helm.sh/hook-weight: "-5"
    labels:
      app: shared-secrets
      heritage: Helm
      release: gitlab
  roleRef:
    name: gitlab-shared-secrets
    apiGroup: rbac.authorization.k8s.io
    kind: Role
  subjects:
  - name: gitlab-shared-secrets
    kind: ServiceAccount
    namespace: gitlab

(root level)
+ one document added:
  apiVersion: batch/v1
  kind: Job
  metadata:
    name: gitlab-shared-secrets-6fff130
    namespace: gitlab
    annotations:
      helm.sh/hook: "pre-install,pre-upgrade"
      helm.sh/hook-delete-policy: "hook-succeeded,before-hook-creation"
    labels:
      app: gitlab
      heritage: Helm
      release: gitlab
  spec:
    template:
      metadata:
        annotations: null
        labels:
          app: gitlab
          heritage: Helm
          release: gitlab
      spec:
        containers:
        - name: gitlab
          image: "registry.gitlab.com/gitlab-org/build/cng/kubectl:v18.8.2"
          command:
          - /bin/bash
          - /scripts/generate-secrets
          resources:
            requests:
              cpu: 50m
          volumeMounts:
          - name: scripts
            mountPath: /scripts
          - name: ssh
            mountPath: /etc/ssh
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
              - ALL
            runAsNonRoot: true
        restartPolicy: Never
        securityContext:
          fsGroup: 65534
          runAsUser: 65534
          seccompProfile:
            type: RuntimeDefault
        serviceAccountName: gitlab-shared-secrets
        volumes:
        - name: scripts
          configMap:
            name: gitlab-shared-secrets
        - name: ssh
          emptyDir: {}

(root level)
+ one document added:
  apiVersion: batch/v1
  kind: Job
  metadata:
    name: gitlab-shared-secrets-6fff130-selfsign
    namespace: gitlab
    annotations:
      helm.sh/hook: "pre-install,pre-upgrade"
      helm.sh/hook-delete-policy: "hook-succeeded,before-hook-creation"
    labels:
      app: gitlab
      heritage: Helm
      release: gitlab
  spec:
    template:
      metadata:
        annotations: null
        labels:
          app: gitlab
          heritage: Helm
          release: gitlab
      spec:
        containers:
        - name: kubectl
          image: "registry.gitlab.com/gitlab-org/build/cng/kubectl:v18.8.2"
          command:
          - /bin/bash
          - "-exc"
          - |
            certname=gitlab-wildcard-tls
            # create wildcard certificate secret
            kubectl create secret tls $certname \
              --cert=/output/wildcard.pem --key=/output/wildcard-key.pem || true
            kubectl --namespace=$namespace label \
              secret $certname  $(echo 'app.kubernetes.io/name=gitlab' | sed -E 's/=[^ ]*/-/g')
            kubectl --namespace=$namespace label --overwrite \
              secret $certname app=gitlab chart=gitlab-9.8.2 release=gitlab heritage=Helm 
            # create CA certificate secret
            kubectl create secret generic ${certname}-ca \
              --from-file=cfssl_ca=/output/ca.pem || true
            kubectl --namespace=$namespace label \
              secret ${certname}-ca  $(echo 'app.kubernetes.io/name=gitlab' | sed -E 's/=[^ ]*/-/g')
            kubectl --namespace=$namespace label --overwrite \
              secret ${certname}-ca app=gitlab chart=gitlab-9.8.2 release=gitlab heritage=Helm 
            # create certificate chain for GitLab Runner
            cat /output/ca.pem /output/wildcard.pem > /tmp/code.nogweii.net.crt
            kubectl create secret generic ${certname}-chain \
              --from-file=/tmp/code.nogweii.net.crt || true
            kubectl --namespace=$namespace label \
              secret ${certname}-chain  $(echo 'app.kubernetes.io/name=gitlab' | sed -E 's/=[^ ]*/-/g')
            kubectl --namespace=$namespace label --overwrite \
              secret ${certname}-chain app=gitlab chart=gitlab-9.8.2 release=gitlab heritage=Helm 
            
          resources:
            requests:
              cpu: 50m
          volumeMounts:
          - name: certs-path
            mountPath: /output
        initContainers:
        - name: cfssl-self-sign
          image: "registry.gitlab.com/gitlab-org/build/cng/cfssl-self-sign:v18.8.2"
          env:
          - name: CA_SUBJECT
            value: "GitLab Helm Chart"
          - name: CA_ORG
            value: gitlab
          - name: CA_ORG_UNIT
            value: gitlab
          - name: CERT_SUBJECT
            value: code.nogweii.net
          - name: CERT_DOMAIN
            value: code.nogweii.net
          - name: EXPIRY
            value: 3650d
          - name: ALGORITHM
            value: rsa
          - name: KEY_SIZE
            value: "4096"
          resources:
            requests:
              cpu: 50m
          volumeMounts:
          - name: certs-path
            mountPath: /output
        restartPolicy: Never
        securityContext:
          fsGroup: 65534
          runAsUser: 65534
        serviceAccountName: gitlab-shared-secrets
        volumes:
        - name: certs-path
          emptyDir: {}
  


(root level)
+ one document added:
  apiVersion: batch/v1
  kind: Job
  metadata:
    name: gitlab-gitlab-upgrade-check
    namespace: gitlab
    annotations:
      helm.sh/hook: pre-upgrade
      helm.sh/hook-delete-policy: "hook-succeeded,before-hook-creation"
      helm.sh/hook-weight: "-10"
    labels:
      app: gitlab
      heritage: Helm
      release: gitlab
  spec:
    backoffLimit: 2
    template:
      metadata:
        labels:
          app: gitlab
          heritage: Helm
          release: gitlab
      spec:
        containers:
        - name: run-check
          image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-base:v18.8.2"
          command:
          - /bin/sh
          - /scripts/runcheck
          env:
          - name: GITLAB_VERSION
            value: "18.8.2"
          - name: CHART_VERSION
            value: "9.8.2"
          resources:
            requests:
              cpu: 50m
          volumeMounts:
          - name: chart-info
            mountPath: /chart-info
          - name: scripts
            mountPath: /scripts
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
              - ALL
            runAsNonRoot: true
            runAsUser: 65534
        restartPolicy: Never
        securityContext:
          fsGroup: 65534
          runAsUser: 65534
          seccompProfile:
            type: RuntimeDefault
        volumes:
        - name: chart-info
          configMap:
            name: gitlab-gitlab-chart-info
            optional: true
        - name: scripts
          configMap:
            name: gitlab-gitlab-upgrade-check

(root level)
+ one document added:
  apiVersion: v1
  kind: ServiceAccount
  metadata:
    name: gitlab-agent-ocs-scanning-pod-sa
    namespace: gitlab
    labels:
      app.kubernetes.io/instance: gitlab-agent
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: gitlab-agent
      helm.toolkit.fluxcd.io/name: gitlab-agent
      helm.toolkit.fluxcd.io/namespace: flux-system

(root level)
+ one document added:
  apiVersion: v1
  kind: ServiceAccount
  metadata:
    name: gitlab-agent
    namespace: gitlab
    labels:
      app.kubernetes.io/instance: gitlab-agent
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: gitlab-agent
      helm.toolkit.fluxcd.io/name: gitlab-agent
      helm.toolkit.fluxcd.io/namespace: flux-system

(root level)
+ one document added:
  apiVersion: rbac.authorization.k8s.io/v1
  kind: ClusterRole
  metadata:
    name: "gitlab:gitlab-agent:ocs"
    labels:
      app.kubernetes.io/instance: gitlab-agent
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: gitlab-agent
      helm.toolkit.fluxcd.io/name: gitlab-agent
      helm.toolkit.fluxcd.io/namespace: flux-system
  rules:
  - resources:
    - cronjobs
    - jobs
    apiGroups:
    - batch
    verbs:
    - list
    - get
  - resources:
    - pods
    - replicationcontrollers
    - serviceaccounts
    - namespaces
    - services
    - configmaps
    - resourcequotas
    - limitranges
    - nodes
    - secrets
    apiGroups:
    -
    verbs:
    - list
    - get
  - resources:
    - replicasets
    - daemonsets
    - statefulsets
    - deployments
    apiGroups:
    - apps
    verbs:
    - list
    - get
  - resources:
    - roles
    - rolebindings
    - clusterroles
    - clusterrolebindings
    apiGroups:
    - rbac.authorization.k8s.io
    verbs:
    - list
    - get
  - resources:
    - networkpolicies
    - ingresses
    apiGroups:
    - networking.k8s.io
    verbs:
    - list
    - get

(root level)
+ one document added:
  apiVersion: rbac.authorization.k8s.io/v1
  kind: ClusterRoleBinding
  metadata:
    name: "gitlab:gitlab-agent-cluster-admin"
    labels:
      app.kubernetes.io/instance: gitlab-agent
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: gitlab-agent
      helm.toolkit.fluxcd.io/name: gitlab-agent
      helm.toolkit.fluxcd.io/namespace: flux-system
  roleRef:
    name: cluster-admin
    apiGroup: rbac.authorization.k8s.io
    kind: ClusterRole
  subjects:
  - name: gitlab-agent
    kind: ServiceAccount
    namespace: gitlab

(root level)
+ one document added:
  apiVersion: rbac.authorization.k8s.io/v1
  kind: ClusterRoleBinding
  metadata:
    name: "gitlab:gitlab-agent:ocs"
    labels:
      app.kubernetes.io/instance: gitlab-agent
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: gitlab-agent
      helm.toolkit.fluxcd.io/name: gitlab-agent
      helm.toolkit.fluxcd.io/namespace: flux-system
  roleRef:
    name: "gitlab:gitlab-agent:ocs"
    apiGroup: rbac.authorization.k8s.io
    kind: ClusterRole
  subjects:
  - name: gitlab-agent-ocs-scanning-pod-sa
    kind: ServiceAccount
    namespace: gitlab

(root level)
+ one document added:
  apiVersion: rbac.authorization.k8s.io/v1
  kind: Role
  metadata:
    name: "gitlab-agent:ocs"
    namespace: gitlab
    labels:
      app.kubernetes.io/instance: gitlab-agent
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: gitlab-agent
      helm.toolkit.fluxcd.io/name: gitlab-agent
      helm.toolkit.fluxcd.io/namespace: flux-system
  rules:
  - resources:
    - configmaps
    apiGroups:
    -
    verbs:
    - create

(root level)
+ one document added:
  apiVersion: rbac.authorization.k8s.io/v1
  kind: RoleBinding
  metadata:
    name: "gitlab-agent:ocs"
    namespace: gitlab
    labels:
      app.kubernetes.io/instance: gitlab-agent
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: gitlab-agent
      helm.toolkit.fluxcd.io/name: gitlab-agent
      helm.toolkit.fluxcd.io/namespace: flux-system
  roleRef:
    name: "gitlab-agent:ocs"
    apiGroup: rbac.authorization.k8s.io
    kind: Role
  subjects:
  - name: gitlab-agent-ocs-scanning-pod-sa
    kind: ServiceAccount
    namespace: gitlab

(root level)
+ one document added:
  apiVersion: v1
  kind: Service
  metadata:
    name: gitlab-agent-service
    namespace: gitlab
    labels:
      app.kubernetes.io/instance: gitlab-agent
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: gitlab-agent
      helm.toolkit.fluxcd.io/name: gitlab-agent
      helm.toolkit.fluxcd.io/namespace: flux-system
  spec:
    type: ClusterIP
    selector:
      app.kubernetes.io/instance: gitlab-agent
      app.kubernetes.io/name: gitlab-agent
    ports:
    - name: tcp-gitlab-agent-observability
      port: 8080
      protocol: TCP
      targetPort: observability

(root level)
+ one document added:
  apiVersion: apps/v1
  kind: Deployment
  metadata:
    name: gitlab-agent-v2
    namespace: gitlab
    labels:
      app.kubernetes.io/instance: gitlab-agent
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: gitlab-agent
      helm.toolkit.fluxcd.io/name: gitlab-agent
      helm.toolkit.fluxcd.io/namespace: flux-system
  spec:
    replicas: 2
    selector:
      matchLabels:
        app.kubernetes.io/instance: gitlab-agent
        app.kubernetes.io/name: gitlab-agent
    strategy:
      type: RollingUpdate
      rollingUpdate:
        maxSurge: 1
        maxUnavailable: 0
    template:
      metadata:
        annotations:
          prometheus.io/path: /metrics
          prometheus.io/port: "8080"
          prometheus.io/scrape: "true"
        labels:
          app.kubernetes.io/instance: gitlab-agent
          app.kubernetes.io/managed-by: Helm
          app.kubernetes.io/name: gitlab-agent
      spec:
        automountServiceAccountToken: false
        containers:
        - name: gitlab-agent
          image: "registry.gitlab.com/gitlab-org/cluster-integration/gitlab-agent/agentk:v18.8.0"
          imagePullPolicy: IfNotPresent
          resources: {}
          securityContext: {}
          terminationMessagePolicy: FallbackToLogsOnError
          args:
          - "--token-file=/etc/agentk/secrets/token"
          - "--kas-address=wss://k.code.nogweii.net"
          livenessProbe:
            httpGet:
              path: /liveness
              port: 8080
            initialDelaySeconds: 15
            periodSeconds: 20
          ports:
          - name: observability
            containerPort: 8080
            protocol: TCP
          - name: api
            containerPort: 8082
          readinessProbe:
            httpGet:
              path: /readiness
              port: 8080
            initialDelaySeconds: 5
            periodSeconds: 10
          volumeMounts:
          - name: service-account-token-volume
            mountPath: /var/run/secrets/kubernetes.io/serviceaccount
            readOnly: true
          - name: secret-volume
            mountPath: /etc/agentk/secrets
            readOnly: true
          env:
          - name: POD_NAMESPACE
            valueFrom:
              fieldRef:
                fieldPath: metadata.namespace
          - name: POD_NAME
            valueFrom:
              fieldRef:
                fieldPath: metadata.name
          - name: POD_IP
            valueFrom:
              fieldRef:
                fieldPath: status.podIP
          - name: GITLAB_AGENT_TELEMETRY_installation_method
            value: helm-chart
          - name: GITLAB_AGENT_TELEMETRY_helm_chart_version
            value: "2.23.0"
          - name: SERVICE_ACCOUNT_NAME
            valueFrom:
              fieldRef:
                fieldPath: spec.serviceAccountName
          - name: OCS_ENABLED
            value: "true"
          - name: OCS_SERVICE_ACCOUNT_NAME
            value: gitlab-agent-ocs-scanning-pod-sa
        securityContext: {}
        serviceAccountName: gitlab-agent
        volumes:
        - name: service-account-token-volume
          projected:
            defaultMode: 292
            sources:
            - configMap:
                name: kube-root-ca.crt
            - downwardAPI:
                items:
                - fieldRef:
                    apiVersion: v1
                    fieldPath: metadata.namespace
                  path: namespace
            - serviceAccountToken:
                expirationSeconds: 3600
                path: token
        - name: secret-volume
          secret:
            defaultMode: 292
            secretName: agentk-token
  


(root level)
+ one document added:
  apiVersion: v1
  kind: ServiceAccount
  metadata:
    name: k8s-event-logger
    namespace: kube-utilities
    labels:
      app.kubernetes.io/instance: k8s-event-logger
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: k8s-event-logger
      helm.toolkit.fluxcd.io/name: k8s-event-logger
      helm.toolkit.fluxcd.io/namespace: flux-system

(root level)
+ one document added:
  apiVersion: rbac.authorization.k8s.io/v1
  kind: ClusterRole
  metadata:
    name: k8s-event-logger
    labels:
      app.kubernetes.io/instance: k8s-event-logger
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: k8s-event-logger
      helm.toolkit.fluxcd.io/name: k8s-event-logger
      helm.toolkit.fluxcd.io/namespace: flux-system
  rules:
  - resources:
    - events
    apiGroups:
    -
    - events.k8s.io
    verbs:
    - get
    - list
    - watch

(root level)
+ one document added:
  apiVersion: rbac.authorization.k8s.io/v1
  kind: ClusterRoleBinding
  metadata:
    name: k8s-event-logger
    labels:
      app.kubernetes.io/instance: k8s-event-logger
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: k8s-event-logger
      helm.toolkit.fluxcd.io/name: k8s-event-logger
      helm.toolkit.fluxcd.io/namespace: flux-system
  roleRef:
    name: k8s-event-logger
    apiGroup: rbac.authorization.k8s.io
    kind: ClusterRole
  subjects:
  - name: k8s-event-logger
    kind: ServiceAccount
    namespace: kube-utilities

(root level)
+ one document added:
  apiVersion: apps/v1
  kind: Deployment
  metadata:
    name: k8s-event-logger
    namespace: kube-utilities
    labels:
      app.kubernetes.io/instance: k8s-event-logger
      app.kubernetes.io/managed-by: Helm
      helm.toolkit.fluxcd.io/name: k8s-event-logger
      helm.toolkit.fluxcd.io/namespace: flux-system
  spec:
    replicas: 1
    selector:
      matchLabels:
        app.kubernetes.io/instance: k8s-event-logger
        app.kubernetes.io/name: k8s-event-logger
    template:
      metadata:
        labels:
          app.kubernetes.io/instance: k8s-event-logger
          app.kubernetes.io/managed-by: Helm
          app.kubernetes.io/name: k8s-event-logger
      spec:
        containers:
        - name: k8s-event-logger
          env: null
          image: "maxrocketinternet/k8s-event-logger:2.7"
          imagePullPolicy: IfNotPresent
          resources:
            limits:
              cpu: 100m
              memory: 128Mi
            requests:
              cpu: 10m
              memory: 128Mi
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
              - ALL
            readOnlyRootFilesystem: true
            runAsGroup: 10001
            runAsNonRoot: true
            runAsUser: 10001
            seccompProfile:
              type: RuntimeDefault
        securityContext: {}
        serviceAccountName: k8s-event-logger

(root level)
+ one document added:
  apiVersion: v1
  kind: ServiceAccount
  metadata:
    name: kube-state-metrics
    namespace: monitoring
    labels:
      app.kubernetes.io/component: metrics
      app.kubernetes.io/instance: kube-prometheus-stack
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: kube-state-metrics
      app.kubernetes.io/part-of: kube-state-metrics
      helm.toolkit.fluxcd.io/name: kube-prometheus-stack
      helm.toolkit.fluxcd.io/namespace: flux-system
      release: kube-prometheus-stack
  automountServiceAccountToken: true

(root level)
+ one document added:
  apiVersion: v1
  kind: ServiceAccount
  metadata:
    name: node-exporter
    namespace: kube-privileged
    labels:
      app.kubernetes.io/component: metrics
      app.kubernetes.io/instance: kube-prometheus-stack
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: prometheus-node-exporter
      app.kubernetes.io/part-of: prometheus-node-exporter
      helm.toolkit.fluxcd.io/name: kube-prometheus-stack
      helm.toolkit.fluxcd.io/namespace: flux-system
      release: kube-prometheus-stack
  automountServiceAccountToken: false

(root level)
+ one document added:
  apiVersion: v1
  kind: ServiceAccount
  metadata:
    name: kube-prometheus-stack-alertmanager
    namespace: monitoring
    labels:
      app: kube-prometheus-stack-alertmanager
      app.kubernetes.io/component: alertmanager
      app.kubernetes.io/instance: kube-prometheus-stack
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: kube-prometheus-stack-alertmanager
      app.kubernetes.io/part-of: kube-prometheus-stack
      helm.toolkit.fluxcd.io/name: kube-prometheus-stack
      helm.toolkit.fluxcd.io/namespace: flux-system
      heritage: Helm
      release: kube-prometheus-stack
  automountServiceAccountToken: true

(root level)
+ one document added:
  apiVersion: v1
  kind: ServiceAccount
  metadata:
    name: kube-prometheus-stack-operator
    namespace: monitoring
    labels:
      app: kube-prometheus-stack-operator
      app.kubernetes.io/component: prometheus-operator
      app.kubernetes.io/instance: kube-prometheus-stack
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: kube-prometheus-stack-prometheus-operator
      app.kubernetes.io/part-of: kube-prometheus-stack
      helm.toolkit.fluxcd.io/name: kube-prometheus-stack
      helm.toolkit.fluxcd.io/namespace: flux-system
      heritage: Helm
      release: kube-prometheus-stack
  automountServiceAccountToken: true

(root level)
+ one document added:
  apiVersion: v1
  kind: ServiceAccount
  metadata:
    name: kube-prometheus-stack-prometheus
    namespace: monitoring
    labels:
      app: kube-prometheus-stack-prometheus
      app.kubernetes.io/component: prometheus
      app.kubernetes.io/instance: kube-prometheus-stack
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: kube-prometheus-stack-prometheus
      app.kubernetes.io/part-of: kube-prometheus-stack
      helm.toolkit.fluxcd.io/name: kube-prometheus-stack
      helm.toolkit.fluxcd.io/namespace: flux-system
      heritage: Helm
      release: kube-prometheus-stack
  automountServiceAccountToken: true

(root level)
+ one document added:
  apiVersion: v1
  kind: ConfigMap
  metadata:
    name: kube-state-metrics-customresourcestate-config
    namespace: monitoring
    labels:
      app.kubernetes.io/component: metrics
      app.kubernetes.io/instance: kube-prometheus-stack
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: kube-state-metrics
      app.kubernetes.io/part-of: kube-state-metrics
      helm.toolkit.fluxcd.io/name: kube-prometheus-stack
      helm.toolkit.fluxcd.io/namespace: flux-system
      release: kube-prometheus-stack
  data:
    config.yaml: |
      spec:
        resources:
        - groupVersionKind:
            group: kustomize.toolkit.fluxcd.io
            kind: Kustomization
            version: v1
          metricNamePrefix: gotk
          metrics:
          - each:
              info:
                labelsFromPath:
                  name:
                  - metadata
                  - name
              type: Info
            help: The current state of a GitOps Toolkit resource.
            labelsFromPath:
              exported_namespace:
              - metadata
              - namespace
              ready:
              - status
              - conditions
              - '[type=Ready]'
              - status
              revision:
              - status
              - lastAppliedRevision
              source_name:
              - spec
              - sourceRef
              - name
              suspended:
              - spec
              - suspend
            name: resource_info
        - groupVersionKind:
            group: helm.toolkit.fluxcd.io
            kind: HelmRelease
            version: v2
          metricNamePrefix: gotk
          metrics:
          - each:
              info:
                labelsFromPath:
                  name:
                  - metadata
                  - name
              type: Info
            help: The current state of a GitOps Toolkit resource.
            labelsFromPath:
              chart_app_version:
              - status
              - history
              - "0"
              - appVersion
              chart_name:
              - status
              - history
              - "0"
              - chartName
              chart_ref_name:
              - spec
              - chartRef
              - name
              chart_source_name:
              - spec
              - chart
              - spec
              - sourceRef
              - name
              exported_namespace:
              - metadata
              - namespace
              ready:
              - status
              - conditions
              - '[type=Ready]'
              - status
              revision:
              - status
              - history
              - "0"
              - chartVersion
              suspended:
              - spec
              - suspend
            name: resource_info
        - groupVersionKind:
            group: source.toolkit.fluxcd.io
            kind: GitRepository
            version: v1
          metricNamePrefix: gotk
          metrics:
          - each:
              info:
                labelsFromPath:
                  name:
                  - metadata
                  - name
              type: Info
            help: The current state of a GitOps Toolkit resource.
            labelsFromPath:
              exported_namespace:
              - metadata
              - namespace
              ready:
              - status
              - conditions
              - '[type=Ready]'
              - status
              revision:
              - status
              - artifact
              - revision
              suspended:
              - spec
              - suspend
              url:
              - spec
              - url
            name: resource_info
        - groupVersionKind:
            group: source.toolkit.fluxcd.io
            kind: Bucket
            version: v1
          metricNamePrefix: gotk
          metrics:
          - each:
              info:
                labelsFromPath:
                  name:
                  - metadata
                  - name
              type: Info
            help: The current state of a GitOps Toolkit resource.
            labelsFromPath:
              bucket_name:
              - spec
              - bucketName
              endpoint:
              - spec
              - endpoint
              exported_namespace:
              - metadata
              - namespace
              ready:
              - status
              - conditions
              - '[type=Ready]'
              - status
              revision:
              - status
              - artifact
              - revision
              suspended:
              - spec
              - suspend
            name: resource_info
        - groupVersionKind:
            group: source.toolkit.fluxcd.io
            kind: HelmRepository
            version: v1
          metricNamePrefix: gotk
          metrics:
          - each:
              info:
                labelsFromPath:
                  name:
                  - metadata
                  - name
              type: Info
            help: The current state of a GitOps Toolkit resource.
            labelsFromPath:
              exported_namespace:
              - metadata
              - namespace
              ready:
              - status
              - conditions
              - '[type=Ready]'
              - status
              revision:
              - status
              - artifact
              - revision
              suspended:
              - spec
              - suspend
              url:
              - spec
              - url
            name: resource_info
        - groupVersionKind:
            group: source.toolkit.fluxcd.io
            kind: HelmChart
            version: v1
          metricNamePrefix: gotk
          metrics:
          - each:
              info:
                labelsFromPath:
                  name:
                  - metadata
                  - name
              type: Info
            help: The current state of a GitOps Toolkit resource.
            labelsFromPath:
              chart_name:
              - spec
              - chart
              chart_version:
              - spec
              - version
              exported_namespace:
              - metadata
              - namespace
              ready:
              - status
              - conditions
              - '[type=Ready]'
              - status
              revision:
              - status
              - artifact
              - revision
              suspended:
              - spec
              - suspend
            name: resource_info
        - groupVersionKind:
            group: source.toolkit.fluxcd.io
            kind: OCIRepository
            version: v1
          metricNamePrefix: gotk
          metrics:
          - each:
              info:
                labelsFromPath:
                  name:
                  - metadata
                  - name
              type: Info
            help: The current state of a GitOps Toolkit resource.
            labelsFromPath:
              exported_namespace:
              - metadata
              - namespace
              ready:
              - status
              - conditions
              - '[type=Ready]'
              - status
              revision:
              - status
              - artifact
              - revision
              suspended:
              - spec
              - suspend
              url:
              - spec
              - url
            name: resource_info
        - groupVersionKind:
            group: notification.toolkit.fluxcd.io
            kind: Alert
            version: v1beta3
          metricNamePrefix: gotk
          metrics:
          - each:
              info:
                labelsFromPath:
                  name:
                  - metadata
                  - name
              type: Info
            help: The current state of a GitOps Toolkit resource.
            labelsFromPath:
              exported_namespace:
              - metadata
              - namespace
              suspended:
              - spec
              - suspend
            name: resource_info
        - groupVersionKind:
            group: notification.toolkit.fluxcd.io
            kind: Provider
            version: v1beta3
          metricNamePrefix: gotk
          metrics:
          - each:
              info:
                labelsFromPath:
                  name:
                  - metadata
                  - name
              type: Info
            help: The current state of a GitOps Toolkit resource.
            labelsFromPath:
              exported_namespace:
              - metadata
              - namespace
              suspended:
              - spec
              - suspend
            name: resource_info
        - groupVersionKind:
            group: notification.toolkit.fluxcd.io
            kind: Receiver
            version: v1
          metricNamePrefix: gotk
          metrics:
          - each:
              info:
                labelsFromPath:
                  name:
                  - metadata
                  - name
              type: Info
            help: The current state of a GitOps Toolkit resource.
            labelsFromPath:
              exported_namespace:
              - metadata
              - namespace
              ready:
              - status
              - conditions
              - '[type=Ready]'
              - status
              suspended:
              - spec
              - suspend
              webhook_path:
              - status
              - webhookPath
            name: resource_info


(root level)
+ one document added:
  apiVersion: rbac.authorization.k8s.io/v1
  kind: ClusterRole
  metadata:
    name: kube-state-metrics
    labels:
      app.kubernetes.io/component: metrics
      app.kubernetes.io/instance: kube-prometheus-stack
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: kube-state-metrics
      app.kubernetes.io/part-of: kube-state-metrics
      helm.toolkit.fluxcd.io/name: kube-prometheus-stack
      helm.toolkit.fluxcd.io/namespace: flux-system
      release: kube-prometheus-stack
  rules:
  - resources:
    - certificatesigningrequests
    apiGroups:
    - certificates.k8s.io
    verbs:
    - list
    - watch
  - resources:
    - configmaps
    apiGroups:
    -
    verbs:
    - list
    - watch
  - resources:
    - cronjobs
    apiGroups:
    - batch
    verbs:
    - list
    - watch
  - resources:
    - daemonsets
    apiGroups:
    - apps
    verbs:
    - list
    - watch
  - resources:
    - deployments
    apiGroups:
    - apps
    verbs:
    - list
    - watch
  - resources:
    - endpointslices
    apiGroups:
    - discovery.k8s.io
    verbs:
    - list
    - watch
  - resources:
    - horizontalpodautoscalers
    apiGroups:
    - autoscaling
    verbs:
    - list
    - watch
  - resources:
    - ingresses
    apiGroups:
    - networking.k8s.io
    verbs:
    - list
    - watch
  - resources:
    - jobs
    apiGroups:
    - batch
    verbs:
    - list
    - watch
  - resources:
    - leases
    apiGroups:
    - coordination.k8s.io
    verbs:
    - list
    - watch
  - resources:
    - limitranges
    apiGroups:
    -
    verbs:
    - list
    - watch
  - resources:
    - mutatingwebhookconfigurations
    apiGroups:
    - admissionregistration.k8s.io
    verbs:
    - list
    - watch
  - resources:
    - namespaces
    apiGroups:
    -
    verbs:
    - list
    - watch
  - resources:
    - networkpolicies
    apiGroups:
    - networking.k8s.io
    verbs:
    - list
    - watch
  - resources:
    - nodes
    apiGroups:
    -
    verbs:
    - list
    - watch
  - resources:
    - persistentvolumeclaims
    apiGroups:
    -
    verbs:
    - list
    - watch
  - resources:
    - persistentvolumes
    apiGroups:
    -
    verbs:
    - list
    - watch
  - resources:
    - poddisruptionbudgets
    apiGroups:
    - policy
    verbs:
    - list
    - watch
  - resources:
    - pods
    apiGroups:
    -
    verbs:
    - list
    - watch
  - resources:
    - replicasets
    apiGroups:
    - apps
    verbs:
    - list
    - watch
  - resources:
    - replicationcontrollers
    apiGroups:
    -
    verbs:
    - list
    - watch
  - resources:
    - resourcequotas
    apiGroups:
    -
    verbs:
    - list
    - watch
  - resources:
    - secrets
    apiGroups:
    -
    verbs:
    - list
    - watch
  - resources:
    - services
    apiGroups:
    -
    verbs:
    - list
    - watch
  - resources:
    - statefulsets
    apiGroups:
    - apps
    verbs:
    - list
    - watch
  - resources:
    - storageclasses
    apiGroups:
    - storage.k8s.io
    verbs:
    - list
    - watch
  - resources:
    - validatingwebhookconfigurations
    apiGroups:
    - admissionregistration.k8s.io
    verbs:
    - list
    - watch
  - resources:
    - volumeattachments
    apiGroups:
    - storage.k8s.io
    verbs:
    - list
    - watch
  - resources:
    - customresourcedefinitions
    apiGroups:
    - apiextensions.k8s.io
    verbs:
    - list
    - watch
  - resources:
    - alerts
    - buckets
    - gitrepositories
    - helmcharts
    - helmreleases
    - helmrepositories
    - kustomizations
    - ocirepositories
    - providers
    - receivers
    apiGroups:
    - helm.toolkit.fluxcd.io
    - kustomize.toolkit.fluxcd.io
    - notification.toolkit.fluxcd.io
    - source.toolkit.fluxcd.io
    verbs:
    - list
    - watch

(root level)
+ one document added:
  apiVersion: rbac.authorization.k8s.io/v1
  kind: ClusterRole
  metadata:
    name: kube-prometheus-stack-operator
    labels:
      app: kube-prometheus-stack-operator
      app.kubernetes.io/component: prometheus-operator
      app.kubernetes.io/instance: kube-prometheus-stack
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: kube-prometheus-stack-prometheus-operator
      app.kubernetes.io/part-of: kube-prometheus-stack
      helm.toolkit.fluxcd.io/name: kube-prometheus-stack
      helm.toolkit.fluxcd.io/namespace: flux-system
      heritage: Helm
      release: kube-prometheus-stack
  rules:
  - resources:
    - alertmanagers
    - alertmanagers/finalizers
    - alertmanagers/status
    - alertmanagerconfigs
    - prometheuses
    - prometheuses/finalizers
    - prometheuses/status
    - prometheusagents
    - prometheusagents/finalizers
    - prometheusagents/status
    - thanosrulers
    - thanosrulers/finalizers
    - thanosrulers/status
    - scrapeconfigs
    - scrapeconfigs/status
    - servicemonitors
    - servicemonitors/status
    - podmonitors
    - podmonitors/status
    - probes
    - probes/status
    - prometheusrules
    - prometheusrules/status
    apiGroups:
    - monitoring.coreos.com
    verbs:
    - "*"
  - resources:
    - statefulsets
    apiGroups:
    - apps
    verbs:
    - "*"
  - resources:
    - configmaps
    - secrets
    apiGroups:
    -
    verbs:
    - "*"
  - resources:
    - pods
    apiGroups:
    -
    verbs:
    - list
    - delete
  - resources:
    - services
    - services/finalizers
    - endpoints
    apiGroups:
    -
    verbs:
    - get
    - create
    - update
    - delete
  - resources:
    - nodes
    apiGroups:
    -
    verbs:
    - list
    - watch
  - resources:
    - namespaces
    apiGroups:
    -
    verbs:
    - get
    - list
    - watch
  - resources:
    - events
    apiGroups:
    -
    - events.k8s.io
    verbs:
    - patch
    - create
  - resources:
    - ingresses
    apiGroups:
    - networking.k8s.io
    verbs:
    - get
    - list
    - watch
  - resources:
    - storageclasses
    apiGroups:
    - storage.k8s.io
    verbs:
    - get
  - resources:
    - endpointslices
    apiGroups:
    - discovery.k8s.io
    verbs:
    - get
    - create
    - list
    - watch
    - update
    - delete

(root level)
+ one document added:
  apiVersion: rbac.authorization.k8s.io/v1
  kind: ClusterRole
  metadata:
    name: kube-prometheus-stack-prometheus
    labels:
      app: kube-prometheus-stack-prometheus
      app.kubernetes.io/instance: kube-prometheus-stack
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/part-of: kube-prometheus-stack
      helm.toolkit.fluxcd.io/name: kube-prometheus-stack
      helm.toolkit.fluxcd.io/namespace: flux-system
      heritage: Helm
      release: kube-prometheus-stack
  rules:
  - resources:
    - nodes
    - nodes/metrics
    - services
    - endpoints
    - pods
    apiGroups:
    -
    verbs:
    - get
    - list
    - watch
  - resources:
    - endpointslices
    apiGroups:
    - discovery.k8s.io
    verbs:
    - get
    - list
    - watch
  - resources:
    - ingresses
    apiGroups:
    - networking.k8s.io
    verbs:
    - get
    - list
    - watch
  - nonResourceURLs:
    - /metrics
    - /metrics/cadvisor
    verbs:
    - get

(root level)
+ one document added:
  apiVersion: rbac.authorization.k8s.io/v1
  kind: ClusterRoleBinding
  metadata:
    name: kube-state-metrics
    labels:
      app.kubernetes.io/component: metrics
      app.kubernetes.io/instance: kube-prometheus-stack
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: kube-state-metrics
      app.kubernetes.io/part-of: kube-state-metrics
      helm.toolkit.fluxcd.io/name: kube-prometheus-stack
      helm.toolkit.fluxcd.io/namespace: flux-system
      release: kube-prometheus-stack
  roleRef:
    name: kube-state-metrics
    apiGroup: rbac.authorization.k8s.io
    kind: ClusterRole
  subjects:
  - name: kube-state-metrics
    kind: ServiceAccount
    namespace: monitoring

(root level)
+ one document added:
  apiVersion: rbac.authorization.k8s.io/v1
  kind: ClusterRoleBinding
  metadata:
    name: kube-prometheus-stack-operator
    labels:
      app: kube-prometheus-stack-operator
      app.kubernetes.io/component: prometheus-operator
      app.kubernetes.io/instance: kube-prometheus-stack
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: kube-prometheus-stack-prometheus-operator
      app.kubernetes.io/part-of: kube-prometheus-stack
      helm.toolkit.fluxcd.io/name: kube-prometheus-stack
      helm.toolkit.fluxcd.io/namespace: flux-system
      heritage: Helm
      release: kube-prometheus-stack
  roleRef:
    name: kube-prometheus-stack-operator
    apiGroup: rbac.authorization.k8s.io
    kind: ClusterRole
  subjects:
  - name: kube-prometheus-stack-operator
    kind: ServiceAccount
    namespace: monitoring

(root level)
+ one document added:
  apiVersion: rbac.authorization.k8s.io/v1
  kind: ClusterRoleBinding
  metadata:
    name: kube-prometheus-stack-prometheus
    labels:
      app: kube-prometheus-stack-prometheus
      app.kubernetes.io/instance: kube-prometheus-stack
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/part-of: kube-prometheus-stack
      helm.toolkit.fluxcd.io/name: kube-prometheus-stack
      helm.toolkit.fluxcd.io/namespace: flux-system
      heritage: Helm
      release: kube-prometheus-stack
  roleRef:
    name: kube-prometheus-stack-prometheus
    apiGroup: rbac.authorization.k8s.io
    kind: ClusterRole
  subjects:
  - name: kube-prometheus-stack-prometheus
    kind: ServiceAccount
    namespace: monitoring

(root level)
+ one document added:
  apiVersion: v1
  kind: Service
  metadata:
    name: kube-state-metrics
    annotations: null
    namespace: monitoring
    labels:
      app.kubernetes.io/component: metrics
      app.kubernetes.io/instance: kube-prometheus-stack
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: kube-state-metrics
      app.kubernetes.io/part-of: kube-state-metrics
      helm.toolkit.fluxcd.io/name: kube-prometheus-stack
      helm.toolkit.fluxcd.io/namespace: flux-system
      release: kube-prometheus-stack
  spec:
    type: ClusterIP
    selector:
      app.kubernetes.io/instance: kube-prometheus-stack
      app.kubernetes.io/name: kube-state-metrics
    ports:
    - name: http
      port: 8080
      protocol: TCP
      targetPort: http

(root level)
+ one document added:
  apiVersion: v1
  kind: Service
  metadata:
    name: node-exporter
    namespace: kube-privileged
    annotations:
      prometheus.io/scrape: "true"
    labels:
      app.kubernetes.io/component: metrics
      app.kubernetes.io/instance: kube-prometheus-stack
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: prometheus-node-exporter
      app.kubernetes.io/part-of: prometheus-node-exporter
      helm.toolkit.fluxcd.io/name: kube-prometheus-stack
      helm.toolkit.fluxcd.io/namespace: flux-system
      jobLabel: node-exporter
      release: kube-prometheus-stack
  spec:
    type: ClusterIP
    selector:
      app.kubernetes.io/instance: kube-prometheus-stack
      app.kubernetes.io/name: prometheus-node-exporter
    ports:
    - name: http-metrics
      port: 9100
      protocol: TCP
      targetPort: 9100

(root level)
+ one document added:
  apiVersion: v1
  kind: Service
  metadata:
    name: kube-prometheus-stack-alertmanager
    namespace: monitoring
    labels:
      app: kube-prometheus-stack-alertmanager
      app.kubernetes.io/instance: kube-prometheus-stack
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/part-of: kube-prometheus-stack
      helm.toolkit.fluxcd.io/name: kube-prometheus-stack
      helm.toolkit.fluxcd.io/namespace: flux-system
      heritage: Helm
      release: kube-prometheus-stack
      self-monitor: "true"
  spec:
    type: ClusterIP
    sessionAffinity: None
    selector:
      alertmanager: kube-prometheus-stack
      app.kubernetes.io/name: alertmanager
    ports:
    - name: http-web
      port: 9093
      protocol: TCP
      targetPort: 9093
    - name: reloader-web
      appProtocol: http
      port: 8080
      targetPort: reloader-web

(root level)
+ one document added:
  apiVersion: v1
  kind: Service
  metadata:
    name: kube-prometheus-stack-coredns
    namespace: kube-system
    labels:
      app: kube-prometheus-stack-coredns
      app.kubernetes.io/instance: kube-prometheus-stack
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/part-of: kube-prometheus-stack
      helm.toolkit.fluxcd.io/name: kube-prometheus-stack
      helm.toolkit.fluxcd.io/namespace: flux-system
      heritage: Helm
      jobLabel: coredns
      release: kube-prometheus-stack
  spec:
    clusterIP: None
    ports:
    - name: http-metrics
      port: 9153
      protocol: TCP
      targetPort: 9153
    selector:
      k8s-app: kube-dns

(root level)
+ one document added:
  apiVersion: v1
  kind: Service
  metadata:
    name: kube-prometheus-stack-kube-controller-manager
    namespace: kube-system
    labels:
      app: kube-prometheus-stack-kube-controller-manager
      app.kubernetes.io/instance: kube-prometheus-stack
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/part-of: kube-prometheus-stack
      helm.toolkit.fluxcd.io/name: kube-prometheus-stack
      helm.toolkit.fluxcd.io/namespace: flux-system
      heritage: Helm
      jobLabel: kube-controller-manager
      release: kube-prometheus-stack
  spec:
    type: ClusterIP
    clusterIP: None
    selector:
      k8s-app: kube-controller-manager
    ports:
    - name: http-metrics
      port: 10257
      protocol: TCP
      targetPort: 10257

(root level)
+ one document added:
  apiVersion: v1
  kind: Service
  metadata:
    name: kube-prometheus-stack-kube-etcd
    namespace: kube-system
    labels:
      app: kube-prometheus-stack-kube-etcd
      app.kubernetes.io/instance: kube-prometheus-stack
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/part-of: kube-prometheus-stack
      helm.toolkit.fluxcd.io/name: kube-prometheus-stack
      helm.toolkit.fluxcd.io/namespace: flux-system
      heritage: Helm
      jobLabel: kube-etcd
      release: kube-prometheus-stack
  spec:
    type: ClusterIP
    clusterIP: None
    selector:
      k8s-app: kube-controller-manager
    ports:
    - name: http-metrics
      port: 2381
      protocol: TCP
      targetPort: 2381

(root level)
+ one document added:
  apiVersion: v1
  kind: Service
  metadata:
    name: kube-prometheus-stack-kube-scheduler
    namespace: kube-system
    labels:
      app: kube-prometheus-stack-kube-scheduler
      app.kubernetes.io/instance: kube-prometheus-stack
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/part-of: kube-prometheus-stack
      helm.toolkit.fluxcd.io/name: kube-prometheus-stack
      helm.toolkit.fluxcd.io/namespace: flux-system
      heritage: Helm
      jobLabel: kube-scheduler
      release: kube-prometheus-stack
  spec:
    type: ClusterIP
    clusterIP: None
    selector:
      k8s-app: kube-scheduler
    ports:
    - name: http-metrics
      port: 10259
      protocol: TCP
      targetPort: 10259

(root level)
+ one document added:
  apiVersion: v1
  kind: Service
  metadata:
    name: kube-prometheus-stack-operator
    namespace: monitoring
    labels:
      app: kube-prometheus-stack-operator
      app.kubernetes.io/component: prometheus-operator
      app.kubernetes.io/instance: kube-prometheus-stack
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: kube-prometheus-stack-prometheus-operator
      app.kubernetes.io/part-of: kube-prometheus-stack
      helm.toolkit.fluxcd.io/name: kube-prometheus-stack
      helm.toolkit.fluxcd.io/namespace: flux-system
      heritage: Helm
      release: kube-prometheus-stack
  spec:
    type: ClusterIP
    selector:
      app: kube-prometheus-stack-operator
      release: kube-prometheus-stack
    ports:
    - name: https
      port: 443
      targetPort: https

(root level)
+ one document added:
  apiVersion: v1
  kind: Service
  metadata:
    name: kube-prometheus-stack-prometheus
    namespace: monitoring
    labels:
      app: kube-prometheus-stack-prometheus
      app.kubernetes.io/instance: kube-prometheus-stack
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/part-of: kube-prometheus-stack
      helm.toolkit.fluxcd.io/name: kube-prometheus-stack
      helm.toolkit.fluxcd.io/namespace: flux-system
      heritage: Helm
      release: kube-prometheus-stack
      self-monitor: "true"
  spec:
    type: ClusterIP
    publishNotReadyAddresses: false
    sessionAffinity: None
    selector:
      app.kubernetes.io/name: prometheus
      operator.prometheus.io/name: kube-prometheus-stack
    ports:
    - name: http-web
      port: 9090
      targetPort: 9090
    - name: reloader-web
      appProtocol: http
      port: 8080
      targetPort: reloader-web

(root level)
+ one document added:
  apiVersion: apps/v1
  kind: DaemonSet
  metadata:
    name: node-exporter
    namespace: kube-privileged
    labels:
      app.kubernetes.io/component: metrics
      app.kubernetes.io/instance: kube-prometheus-stack
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: prometheus-node-exporter
      app.kubernetes.io/part-of: prometheus-node-exporter
      helm.toolkit.fluxcd.io/name: kube-prometheus-stack
      helm.toolkit.fluxcd.io/namespace: flux-system
      release: kube-prometheus-stack
  spec:
    revisionHistoryLimit: 10
    selector:
      matchLabels:
        app.kubernetes.io/instance: kube-prometheus-stack
        app.kubernetes.io/name: prometheus-node-exporter
    template:
      metadata:
        annotations:
          cluster-autoscaler.kubernetes.io/safe-to-evict: "true"
        labels:
          app.kubernetes.io/component: metrics
          app.kubernetes.io/instance: kube-prometheus-stack
          app.kubernetes.io/managed-by: Helm
          app.kubernetes.io/name: prometheus-node-exporter
          app.kubernetes.io/part-of: prometheus-node-exporter
          jobLabel: node-exporter
          release: kube-prometheus-stack
      spec:
        affinity:
          nodeAffinity:
            requiredDuringSchedulingIgnoredDuringExecution:
              nodeSelectorTerms:
              - matchExpressions:
                - key: eks.amazonaws.com/compute-type
                  operator: NotIn
                  values:
                  - fargate
                - key: type
                  operator: NotIn
                  values:
                  - virtual-kubelet
        automountServiceAccountToken: false
        containers:
        - name: node-exporter
          image: "quay.io/prometheus/node-exporter:v1.12.1-distroless"
          imagePullPolicy: IfNotPresent
          args:
          - "--path.procfs=/host/proc"
          - "--path.sysfs=/host/sys"
          - "--path.rootfs=/host/root"
          - "--path.udev.data=/host/root/run/udev/data"
          - "--web.listen-address=[$(HOST_IP)]:9100"
          - "--collector.filesystem.mount-points-exclude=^/(dev|proc|sys|run/containerd/.+|var/lib/docker/.+|var/lib/kubelet/.+)($|/)"
          - "--collector.filesystem.fs-types-exclude=^(autofs|binfmt_misc|bpf|cgroup2?|configfs|debugfs|devpts|devtmpfs|fusectl|hugetlbfs|iso9660|mqueue|nsfs|overlay|proc|procfs|pstore|rpc_pipefs|securityfs|selinuxfs|squashfs|sysfs|tracefs|erofs)$"
          securityContext:
            readOnlyRootFilesystem: true
          env:
          - name: HOST_IP
            value: "0.0.0.0"
          livenessProbe:
            failureThreshold: 3
            httpGet:
              httpHeaders: null
              path: /
              port: http-metrics
              scheme: HTTP
            initialDelaySeconds: 0
            periodSeconds: 10
            successThreshold: 1
            timeoutSeconds: 1
          ports:
          - name: http-metrics
            containerPort: 9100
            protocol: TCP
          readinessProbe:
            failureThreshold: 3
            httpGet:
              httpHeaders: null
              path: /
              port: http-metrics
              scheme: HTTP
            initialDelaySeconds: 0
            periodSeconds: 10
            successThreshold: 1
            timeoutSeconds: 1
          volumeMounts:
          - name: proc
            mountPath: /host/proc
            readOnly: true
          - name: sys
            mountPath: /host/sys
            readOnly: true
          - name: root
            mountPath: /host/root
            mountPropagation: HostToContainer
            readOnly: true
        hostIPC: false
        hostNetwork: true
        hostPID: true
        nodeSelector:
          kubernetes.io/os: linux
        securityContext:
          fsGroup: 65534
          runAsGroup: 65534
          runAsNonRoot: true
          runAsUser: 65534
        serviceAccountName: node-exporter
        tolerations:
        - effect: NoSchedule
          operator: Exists
        volumes:
        - name: proc
          hostPath:
            path: /proc
        - name: sys
          hostPath:
            path: /sys
        - name: root
          hostPath:
            path: /
    updateStrategy:
      type: RollingUpdate
      rollingUpdate:
        maxUnavailable: 1
  


(root level)
+ one document added:
  apiVersion: apps/v1
  kind: Deployment
  metadata:
    name: kube-state-metrics
    namespace: monitoring
    labels:
      app.kubernetes.io/component: metrics
      app.kubernetes.io/instance: kube-prometheus-stack
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: kube-state-metrics
      app.kubernetes.io/part-of: kube-state-metrics
      helm.toolkit.fluxcd.io/name: kube-prometheus-stack
      helm.toolkit.fluxcd.io/namespace: flux-system
      release: kube-prometheus-stack
  spec:
    replicas: 1
    revisionHistoryLimit: 10
    selector:
      matchLabels:
        app.kubernetes.io/instance: kube-prometheus-stack
        app.kubernetes.io/name: kube-state-metrics
    strategy:
      type: RollingUpdate
    template:
      metadata:
        labels:
          app.kubernetes.io/component: metrics
          app.kubernetes.io/instance: kube-prometheus-stack
          app.kubernetes.io/managed-by: Helm
          app.kubernetes.io/name: kube-state-metrics
          app.kubernetes.io/part-of: kube-state-metrics
          release: kube-prometheus-stack
      spec:
        automountServiceAccountToken: true
        containers:
        - name: kube-state-metrics
          image: "registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.19.1"
          imagePullPolicy: IfNotPresent
          resources: {}
          args:
          - "--port=8080"
          - "--resources=certificatesigningrequests,configmaps,cronjobs,daemonsets,deployments,endpointslices,horizontalpodautoscalers,ingresses,jobs,leases,limitranges,mutatingwebhookconfigurations,namespaces,networkpolicies,nodes,persistentvolumeclaims,persistentvolumes,poddisruptionbudgets,pods,replicasets,replicationcontrollers,resourcequotas,secrets,services,statefulsets,storageclasses,validatingwebhookconfigurations,volumeattachments"
          - "--metric-labels-allowlist=pods=[*],deployments=[*],persistentvolumeclaims=[*]"
          - "--custom-resource-state-config-file=/etc/customresourcestate/config.yaml"
          livenessProbe:
            failureThreshold: 3
            httpGet:
              path: /livez
              port: http
              scheme: HTTP
            initialDelaySeconds: 5
            periodSeconds: 10
            successThreshold: 1
            timeoutSeconds: 5
          ports:
          - name: http
            containerPort: 8080
          - name: metrics
            containerPort: 8081
          readinessProbe:
            failureThreshold: 3
            httpGet:
              path: /readyz
              port: metrics
              scheme: HTTP
            initialDelaySeconds: 5
            periodSeconds: 10
            successThreshold: 1
            timeoutSeconds: 5
          volumeMounts:
          - name: customresourcestate-config
            mountPath: /etc/customresourcestate
            readOnly: true
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
              - ALL
            readOnlyRootFilesystem: true
        dnsPolicy: ClusterFirst
        hostNetwork: false
        securityContext:
          fsGroup: 65534
          runAsGroup: 65534
          runAsNonRoot: true
          runAsUser: 65534
          seccompProfile:
            type: RuntimeDefault
        serviceAccountName: kube-state-metrics
        volumes:
        - name: customresourcestate-config
          configMap:
            name: kube-state-metrics-customresourcestate-config
  


(root level)
+ one document added:
  apiVersion: apps/v1
  kind: Deployment
  metadata:
    name: kube-prometheus-stack-operator
    namespace: monitoring
    labels:
      app: kube-prometheus-stack-operator
      app.kubernetes.io/component: prometheus-operator
      app.kubernetes.io/instance: kube-prometheus-stack
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: kube-prometheus-stack-prometheus-operator
      app.kubernetes.io/part-of: kube-prometheus-stack
      helm.toolkit.fluxcd.io/name: kube-prometheus-stack
      helm.toolkit.fluxcd.io/namespace: flux-system
      heritage: Helm
      release: kube-prometheus-stack
  spec:
    replicas: 1
    revisionHistoryLimit: 10
    selector:
      matchLabels:
        app: kube-prometheus-stack-operator
        release: kube-prometheus-stack
    template:
      metadata:
        labels:
          app: kube-prometheus-stack-operator
          app.kubernetes.io/component: prometheus-operator
          app.kubernetes.io/instance: kube-prometheus-stack
          app.kubernetes.io/managed-by: Helm
          app.kubernetes.io/name: kube-prometheus-stack-prometheus-operator
          app.kubernetes.io/part-of: kube-prometheus-stack
          heritage: Helm
          release: kube-prometheus-stack
      spec:
        automountServiceAccountToken: true
        containers:
        - name: kube-prometheus-stack
          image: "quay.io/prometheus-operator/prometheus-operator:v0.92.1"
          imagePullPolicy: IfNotPresent
          resources: {}
          args:
          - "--kubelet-service=kube-system/kube-prometheus-stack-kubelet"
          - "--kubelet-endpoints=true"
          - "--kubelet-endpointslice=false"
          - "--localhost=127.0.0.1"
          - "--prometheus-config-reloader=quay.io/prometheus-operator/prometheus-config-reloader:v0.92.1"
          - "--config-reloader-cpu-request=0"
          - "--config-reloader-cpu-limit=0"
          - "--config-reloader-memory-request=0"
          - "--config-reloader-memory-limit=0"
          - "--thanos-default-base-image=quay.io/thanos/thanos:v0.42.2"
          - "--secret-field-selector=type!=kubernetes.io/dockercfg,type!=kubernetes.io/service-account-token,type!=helm.sh/release.v1"
          - "--web.enable-tls=true"
          - "--web.cert-file=/cert/cert"
          - "--web.key-file=/cert/key"
          - "--web.listen-address=:10250"
          - "--web.tls-min-version=VersionTLS13"
          env:
          - name: GOGC
            value: "30"
          livenessProbe:
            failureThreshold: 3
            httpGet:
              path: /healthz
              port: https
              scheme: HTTPS
            initialDelaySeconds: 0
            periodSeconds: 10
            successThreshold: 1
            timeoutSeconds: 1
          ports:
          - name: https
            containerPort: 10250
          readinessProbe:
            failureThreshold: 3
            httpGet:
              path: /healthz
              port: https
              scheme: HTTPS
            initialDelaySeconds: 0
            periodSeconds: 10
            successThreshold: 1
            timeoutSeconds: 1
          volumeMounts:
          - name: tls-secret
            mountPath: /cert
            readOnly: true
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
              - ALL
            readOnlyRootFilesystem: true
        securityContext:
          fsGroup: 65534
          runAsGroup: 65534
          runAsNonRoot: true
          runAsUser: 65534
          seccompProfile:
            type: RuntimeDefault
        serviceAccountName: kube-prometheus-stack-operator
        terminationGracePeriodSeconds: 30
        volumes:
        - name: tls-secret
          secret:
            defaultMode: 420
            secretName: kube-prometheus-stack-admission
  


(root level)
+ one document added:
  apiVersion: admissionregistration.k8s.io/v1
  kind: MutatingWebhookConfiguration
  metadata:
    name: kube-prometheus-stack-admission
    annotations: null
    labels:
      app: kube-prometheus-stack-admission
      app.kubernetes.io/component: prometheus-operator-webhook
      app.kubernetes.io/instance: kube-prometheus-stack
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: kube-prometheus-stack-prometheus-operator
      app.kubernetes.io/part-of: kube-prometheus-stack
      helm.toolkit.fluxcd.io/name: kube-prometheus-stack
      helm.toolkit.fluxcd.io/namespace: flux-system
      heritage: Helm
      release: kube-prometheus-stack
  webhooks:
  - name: prometheusrulemutate.monitoring.coreos.com
    failurePolicy: Ignore
    sideEffects: None
    timeoutSeconds: 10
    admissionReviewVersions:
    - v1
    - v1beta1
    clientConfig:
      service:
        name: kube-prometheus-stack-operator
        namespace: monitoring
        path: /admission-prometheusrules/mutate
    rules:
    - resources:
      - prometheusrules
      apiGroups:
      - monitoring.coreos.com
      apiVersions:
      - "*"
      operations:
      - CREATE
      - UPDATE

(root level)
+ one document added:
  apiVersion: admissionregistration.k8s.io/v1
  kind: ValidatingWebhookConfiguration
  metadata:
    name: kube-prometheus-stack-admission
    annotations: null
    labels:
      app: kube-prometheus-stack-admission
      app.kubernetes.io/component: prometheus-operator-webhook
      app.kubernetes.io/instance: kube-prometheus-stack
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: kube-prometheus-stack-prometheus-operator
      app.kubernetes.io/part-of: kube-prometheus-stack
      helm.toolkit.fluxcd.io/name: kube-prometheus-stack
      helm.toolkit.fluxcd.io/namespace: flux-system
      heritage: Helm
      release: kube-prometheus-stack
  webhooks:
  - name: prometheusrulevalidate.monitoring.coreos.com
    failurePolicy: Ignore
    sideEffects: None
    timeoutSeconds: 10
    admissionReviewVersions:
    - v1
    - v1beta1
    clientConfig:
      service:
        name: kube-prometheus-stack-operator
        namespace: monitoring
        path: /admission-prometheusrules/validate
    rules:
    - resources:
      - prometheusrules
      apiGroups:
      - monitoring.coreos.com
      apiVersions:
      - "*"
      operations:
      - CREATE
      - UPDATE
  - name: alertmanagerconfigsvalidate.monitoring.coreos.com
    failurePolicy: Ignore
    sideEffects: None
    timeoutSeconds: 10
    admissionReviewVersions:
    - v1
    - v1beta1
    clientConfig:
      service:
        name: kube-prometheus-stack-operator
        namespace: monitoring
        path: /admission-alertmanagerconfigs/validate
    rules:
    - resources:
      - alertmanagerconfigs
      apiGroups:
      - monitoring.coreos.com
      apiVersions:
      - v1alpha1
      operations:
      - CREATE
      - UPDATE

(root level)
+ one document added:
  apiVersion: monitoring.coreos.com/v1
  kind: Alertmanager
  metadata:
    name: kube-prometheus-stack
    namespace: monitoring
    labels:
      app: kube-prometheus-stack-alertmanager
      app.kubernetes.io/instance: kube-prometheus-stack
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/part-of: kube-prometheus-stack
      helm.toolkit.fluxcd.io/name: kube-prometheus-stack
      helm.toolkit.fluxcd.io/namespace: flux-system
      heritage: Helm
      release: kube-prometheus-stack
  spec:
    version: v0.33.1
    logFormat: logfmt
    portName: http-web
    alertmanagerConfigNamespaceSelector: {}
    alertmanagerConfigSelector: {}
    automountServiceAccountToken: true
    externalUrl: "https://alertmanager.k8s.aether.earth"
    hostNetwork: false
    image: "quay.io/prometheus/alertmanager:v0.33.1"
    listenLocal: false
    serviceAccountName: kube-prometheus-stack-alertmanager
    paused: false
    logLevel: info
    routePrefix: /
    imagePullPolicy: IfNotPresent
    replicas: 1
    retention: 120h
    alertmanagerConfigMatcherStrategy:
      type: None
    securityContext:
      fsGroup: 2000
      runAsGroup: 2000
      runAsNonRoot: true
      runAsUser: 1000
      seccompProfile:
        type: RuntimeDefault
    storage:
      volumeClaimTemplate:
        spec:
          resources:
            requests:
              storage: 1Gi
          storageClassName: longhorn
    affinity:
      podAntiAffinity:
        preferredDuringSchedulingIgnoredDuringExecution:
        - podAffinityTerm:
            labelSelector:
              matchExpressions:
              - key: app.kubernetes.io/name
                operator: In
                values:
                - alertmanager
              - key: alertmanager
                operator: In
                values:
                - kube-prometheus-stack
            topologyKey: kubernetes.io/hostname
          weight: 100

(root level)
+ one document added:
  apiVersion: gateway.networking.k8s.io/v1
  kind: HTTPRoute
  metadata:
    name: kube-prometheus-stack-alertmanager
    namespace: monitoring
    annotations:
      gethomepage.dev/enabled: "true"
      gethomepage.dev/group: Observability
      gethomepage.dev/icon: "https://raw.githubusercontent.com/jhaezebr/svg_logos/master/alertmanager.svg"
      gethomepage.dev/name: Alertmanager
      gethomepage.dev/pod-selector: app.kubernetes.io/name=alertmanager
    labels:
      app: kube-prometheus-stack-alertmanager
      app.kubernetes.io/instance: kube-prometheus-stack
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/part-of: kube-prometheus-stack
      helm.toolkit.fluxcd.io/name: kube-prometheus-stack
      helm.toolkit.fluxcd.io/namespace: flux-system
      heritage: Helm
      release: kube-prometheus-stack
  spec:
    hostnames:
    - alertmanager.k8s.aether.earth
    parentRefs:
    - name: envoy-over-vpn
      namespace: envoy-gateway
    rules:
    - backendRefs:
      - name: kube-prometheus-stack-alertmanager
        group: 
        kind: Service
        port: 9093
        weight: 1
      matches:
      - path:
          type: PathPrefix
          value: /
  


(root level)
+ one document added:
  apiVersion: gateway.networking.k8s.io/v1
  kind: HTTPRoute
  metadata:
    name: kube-prometheus-stack-prometheus
    namespace: monitoring
    annotations:
      gethomepage.dev/enabled: "true"
      gethomepage.dev/group: Observability
      gethomepage.dev/icon: prometheus
      gethomepage.dev/name: Prometheus
      gethomepage.dev/pod-selector: app.kubernetes.io/name=prometheus
      gethomepage.dev/widget.type: prometheus
      gethomepage.dev/widget.url: "http://kube-prometheus-stack-prometheus.monitoring:9090"
    labels:
      app: kube-prometheus-stack-prometheus
      app.kubernetes.io/instance: kube-prometheus-stack
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/part-of: kube-prometheus-stack
      helm.toolkit.fluxcd.io/name: kube-prometheus-stack
      helm.toolkit.fluxcd.io/namespace: flux-system
      heritage: Helm
      release: kube-prometheus-stack
  spec:
    hostnames:
    - prometheus.k8s.aether.earth
    parentRefs:
    - name: envoy-over-vpn
      namespace: envoy-gateway
    rules:
    - backendRefs:
      - name: kube-prometheus-stack-prometheus
        group: 
        kind: Service
        port: 9090
        weight: 1
      matches:
      - path:
          type: PathPrefix
          value: /
  


(root level)
+ one document added:
  apiVersion: monitoring.coreos.com/v1
  kind: Prometheus
  metadata:
    name: kube-prometheus-stack
    namespace: monitoring
    labels:
      app: kube-prometheus-stack-prometheus
      app.kubernetes.io/instance: kube-prometheus-stack
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/part-of: kube-prometheus-stack
      helm.toolkit.fluxcd.io/name: kube-prometheus-stack
      helm.toolkit.fluxcd.io/namespace: flux-system
      heritage: Helm
      release: kube-prometheus-stack
  spec:
    version: v3.13.1-distroless
    probeNamespaceSelector: {}
    probeSelector: {}
    automountServiceAccountToken: true
    enableAdminAPI: true
    walCompression: true
    enableOTLPReceiver: false
    enableRemoteWriteReceiver: true
    externalUrl: "https://prometheus.k8s.aether.earth"
    hostNetwork: false
    replicas: 1
    imagePullPolicy: IfNotPresent
    listenLocal: false
    logFormat: logfmt
    logLevel: info
    paused: false
    podMonitorNamespaceSelector: {}
    podMonitorSelector: {}
    portName: http-web
    shards: 1
    serviceMonitorSelector: {}
    image: "quay.io/prometheus/prometheus:v3.13.1-distroless"
    serviceMonitorNamespaceSelector: {}
    retention: 14d
    retentionSize: 85GB
    routePrefix: /
    ruleNamespaceSelector: {}
    ruleSelector: {}
    scrapeConfigNamespaceSelector: {}
    scrapeConfigSelector: {}
    scrapeInterval: 1m
    serviceAccountName: kube-prometheus-stack-prometheus
    tsdb:
      outOfOrderTimeWindow: 0s
    enableFeatures:
    - memory-snapshot-on-shutdown
    securityContext:
      fsGroup: 2000
      runAsGroup: 2000
      runAsNonRoot: true
      runAsUser: 1000
      seccompProfile:
        type: RuntimeDefault
    resources:
      limits:
        memory: 4000Mi
      requests:
        cpu: 100m
        memory: 200Mi
    alerting:
      alertmanagers:
      - name: kube-prometheus-stack-alertmanager
        apiVersion: v2
        namespace: monitoring
        pathPrefix: /
        port: http-web
    storage:
      volumeClaimTemplate:
        spec:
          resources:
            requests:
              storage: 100Gi
          storageClassName: longhorn
    affinity:
      podAntiAffinity:
        preferredDuringSchedulingIgnoredDuringExecution:
        - podAffinityTerm:
            labelSelector:
              matchExpressions:
              - key: app.kubernetes.io/name
                operator: In
                values:
                - prometheus
              - key: app.kubernetes.io/instance
                operator: In
                values:
                - kube-prometheus-stack
            topologyKey: kubernetes.io/hostname
          weight: 100

(root level)
+ one document added:
  apiVersion: monitoring.coreos.com/v1
  kind: PrometheusRule
  metadata:
    name: kube-prometheus-stack-etcd-fragmentation
    namespace: monitoring
    labels:
      app: kube-prometheus-stack
      app.kubernetes.io/instance: kube-prometheus-stack
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/part-of: kube-prometheus-stack
      helm.toolkit.fluxcd.io/name: kube-prometheus-stack
      helm.toolkit.fluxcd.io/namespace: flux-system
      heritage: Helm
      release: kube-prometheus-stack
  spec:
    groups:
    - name: etcd-fragmentation
      rules:
      - alert: etcdDatabaseHighFragmentationRatio
        annotations:
          description: "etcd cluster \"{{ $labels.job }}\": database size in use on instance {{ $labels.instance }} is {{ $value | humanizePercentage }} of the actual allocated disk space, please run defragmentation (e.g. etcdctl defrag) to retrieve the unused fragmented disk space."
          runbook_url: "https://etcd.io/docs/v3.5/op-guide/maintenance/#defragmentation"
          summary: "etcd database size in use is less than 15% of the actual allocated storage"
        expr: "(last_over_time(etcd_mvcc_db_total_size_in_use_in_bytes{job=~\".*etcd.*\"}[5m]) / last_over_time(etcd_mvcc_db_total_size_in_bytes{job=~\".*etcd.*\"}[5m])) < 0.15 and etcd_mvcc_db_total_size_in_use_in_bytes{job=~\".*etcd.*\"} > 104857600"
        for: 15m
        labels:
          severity: warning
  


(root level)
+ one document added:
  apiVersion: monitoring.coreos.com/v1
  kind: PrometheusRule
  metadata:
    name: kube-prometheus-stack-alertmanager.rules
    namespace: monitoring
    labels:
      app: kube-prometheus-stack
      app.kubernetes.io/instance: kube-prometheus-stack
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/part-of: kube-prometheus-stack
      helm.toolkit.fluxcd.io/name: kube-prometheus-stack
      helm.toolkit.fluxcd.io/namespace: flux-system
      heritage: Helm
      release: kube-prometheus-stack
  spec:
    groups:
    - name: alertmanager.rules
      rules:
      - alert: AlertmanagerFailedReload
        annotations:
          description: "Configuration has failed to load for {{ $labels.namespace }}/{{ $labels.pod}}."
          runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/alertmanager/alertmanagerfailedreload"
          summary: "Reloading an Alertmanager configuration has failed."
        expr: |
          # Without max_over_time, failed scrapes could create false negatives, see
          # https://www.robustperception.io/alerting-on-gauges-in-prometheus-2-0 for details.
          max_over_time(alertmanager_config_last_reload_successful{job="kube-prometheus-stack-alertmanager",container="alertmanager",namespace="monitoring"}[5m]) == 0
        for: 10m
        labels:
          severity: critical
      - alert: AlertmanagerMembersInconsistent
        annotations:
          description: "Alertmanager {{ $labels.namespace }}/{{ $labels.pod}} has only found {{ $value }} members of the {{$labels.job}} cluster."
          runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/alertmanager/alertmanagermembersinconsistent"
          summary: "A member of an Alertmanager cluster has not found all other cluster members."
        expr: |
          # Without max_over_time, failed scrapes could create false negatives, see
          # https://www.robustperception.io/alerting-on-gauges-in-prometheus-2-0 for details.
            max_over_time(alertmanager_cluster_members{job="kube-prometheus-stack-alertmanager",container="alertmanager",namespace="monitoring"}[5m])
          < on (namespace,service,cluster) group_left
            count by (namespace,service,cluster) (max_over_time(alertmanager_cluster_members{job="kube-prometheus-stack-alertmanager",container="alertmanager",namespace="monitoring"}[5m]))
        for: 15m
        labels:
          severity: critical
      - alert: AlertmanagerFailedToSendAlerts
        annotations:
          description: "Alertmanager {{ $labels.namespace }}/{{ $labels.pod}} failed to send {{ $value | humanizePercentage }} of notifications to {{ $labels.integration }}."
          runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/alertmanager/alertmanagerfailedtosendalerts"
          summary: "An Alertmanager instance failed to send notifications."
        expr: |
          (
            rate(alertmanager_notifications_failed_total{job="kube-prometheus-stack-alertmanager",container="alertmanager",namespace="monitoring"}[15m])
          /
            ignoring (reason) group_left rate(alertmanager_notifications_total{job="kube-prometheus-stack-alertmanager",container="alertmanager",namespace="monitoring"}[15m])
          )
          > 0.01
        for: 5m
        labels:
          severity: warning
      - alert: AlertmanagerClusterFailedToSendAlerts
        annotations:
          description: "The minimum notification failure rate to {{ $labels.integration }} sent from any instance in the {{$labels.job}} cluster is {{ $value | humanizePercentage }}."
          runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/alertmanager/alertmanagerclusterfailedtosendalerts"
          summary: "All Alertmanager instances in a cluster failed to send notifications to a critical integration."
        expr: |
          min by (namespace,service, integration) (
            rate(alertmanager_notifications_failed_total{job="kube-prometheus-stack-alertmanager",container="alertmanager",namespace="monitoring", integration=~`.*`}[15m])
          /
            ignoring (reason) group_left rate(alertmanager_notifications_total{job="kube-prometheus-stack-alertmanager",container="alertmanager",namespace="monitoring", integration=~`.*`}[15m]) > 0
          )
          > 0.01
        for: 5m
        labels:
          severity: critical
      - alert: AlertmanagerClusterFailedToSendAlerts
        annotations:
          description: "The minimum notification failure rate to {{ $labels.integration }} sent from any instance in the {{$labels.job}} cluster is {{ $value | humanizePercentage }}."
          runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/alertmanager/alertmanagerclusterfailedtosendalerts"
          summary: "All Alertmanager instances in a cluster failed to send notifications to a non-critical integration."
        expr: |
          min by (namespace,service, integration) (
            rate(alertmanager_notifications_failed_total{job="kube-prometheus-stack-alertmanager",container="alertmanager",namespace="monitoring", integration!~`.*`}[15m])
          /
            ignoring (reason) group_left rate(alertmanager_notifications_total{job="kube-prometheus-stack-alertmanager",container="alertmanager",namespace="monitoring", integration!~`.*`}[15m]) > 0
          )
          > 0.01
        for: 5m
        labels:
          severity: warning
      - alert: AlertmanagerConfigInconsistent
        annotations:
          description: "Alertmanager instances within the {{$labels.job}} cluster have different configurations."
          runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/alertmanager/alertmanagerconfiginconsistent"
          summary: "Alertmanager instances within the same cluster have different configurations."
        expr: |
          count by (namespace,service,cluster) (
            count_values by (namespace,service,cluster) ("config_hash", alertmanager_config_hash{job="kube-prometheus-stack-alertmanager",container="alertmanager",namespace="monitoring"})
          )
          != 1
        for: 20m
        labels:
          severity: critical
      - alert: AlertmanagerClusterDown
        annotations:
          description: "{{ $value | humanizePercentage }} of Alertmanager instances within the {{$labels.job}} cluster have been up for less than half of the last 5m."
          runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/alertmanager/alertmanagerclusterdown"
          summary: "Half or more of the Alertmanager instances within the same cluster are down."
        expr: |
          (
            count by (namespace,service,cluster) (
              avg_over_time(up{job="kube-prometheus-stack-alertmanager",container="alertmanager",namespace="monitoring"}[5m]) < 0.5
            )
          /
            count by (namespace,service,cluster) (
              up{job="kube-prometheus-stack-alertmanager",container="alertmanager",namespace="monitoring"}
            )
          )
          >= 0.5
        for: 5m
        labels:
          severity: critical
      - alert: AlertmanagerClusterCrashlooping
        annotations:
          description: "{{ $value | humanizePercentage }} of Alertmanager instances within the {{$labels.job}} cluster have restarted at least 5 times in the last 10m."
          runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/alertmanager/alertmanagerclustercrashlooping"
          summary: "Half or more of the Alertmanager instances within the same cluster are crashlooping."
        expr: |
          (
            count by (namespace,service,cluster) (
              changes(process_start_time_seconds{job="kube-prometheus-stack-alertmanager",container="alertmanager",namespace="monitoring"}[10m]) > 4
            )
          /
            count by (namespace,service,cluster) (
              up{job="kube-prometheus-stack-alertmanager",container="alertmanager",namespace="monitoring"}
            )
          )
          >= 0.5
        for: 5m
        labels:
          severity: critical
      - alert: AlertmanagerClusterFailedPeers
        annotations:
          description: "Alertmanager {{ $labels.namespace }}/{{ $labels.pod}} has {{ $value }} failed peers in the {{$labels.job}} cluster."
          runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/alertmanager/alertmanagerclusterfailedpeers"
          summary: "An Alertmanager instance has failed peers in the cluster."
        expr: |
          # Without max_over_time, failed scrapes could create false negatives, see
          # https://www.robustperception.io/alerting-on-gauges-in-prometheus-2-0 for details.
          max_over_time(alertmanager_cluster_failed_peers{job="kube-prometheus-stack-alertmanager",container="alertmanager",namespace="monitoring"}[5m]) > 0
        for: 15m
        labels:
          severity: warning
  


(root level)
+ one document added:
  apiVersion: monitoring.coreos.com/v1
  kind: PrometheusRule
  metadata:
    name: kube-prometheus-stack-config-reloaders
    namespace: monitoring
    labels:
      app: kube-prometheus-stack
      app.kubernetes.io/instance: kube-prometheus-stack
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/part-of: kube-prometheus-stack
      helm.toolkit.fluxcd.io/name: kube-prometheus-stack
      helm.toolkit.fluxcd.io/namespace: flux-system
      heritage: Helm
      release: kube-prometheus-stack
  spec:
    groups:
    - name: config-reloaders
      rules:
      - alert: ConfigReloaderSidecarErrors
        annotations:
          description: |
            Errors encountered while the {{$labels.pod}} config-reloader sidecar attempts to sync config in {{$labels.namespace}} namespace.
            As a result, configuration for service running in {{$labels.pod}} may be stale and cannot be updated anymore.
          runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/prometheus-operator/configreloadersidecarerrors"
          summary: "config-reloader sidecar has not had a successful reload for 10m"
        expr: "max_over_time(reloader_last_reload_successful{namespace=~\".+\"}[5m]) == 0"
        for: 10m
        labels:
          severity: warning
  


(root level)
+ one document added:
  apiVersion: monitoring.coreos.com/v1
  kind: PrometheusRule
  metadata:
    name: kube-prometheus-stack-etcd
    namespace: monitoring
    labels:
      app: kube-prometheus-stack
      app.kubernetes.io/instance: kube-prometheus-stack
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/part-of: kube-prometheus-stack
      helm.toolkit.fluxcd.io/name: kube-prometheus-stack
      helm.toolkit.fluxcd.io/namespace: flux-system
      heritage: Helm
      release: kube-prometheus-stack
  spec:
    groups:
    - name: etcd
      rules:
      - alert: etcdMembersDown
        annotations:
          description: "etcd cluster \"{{ $labels.job }}\": members are down ({{ $value }})."
          runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/etcd/etcdmembersdown"
          summary: "etcd cluster members are down."
        expr: |
          max without (endpoint) (
            sum without (instance, pod) (up{job=~".*etcd.*"} == bool 0)
          or
            count without (To) (
              sum without (instance, pod) (rate(etcd_network_peer_sent_failures_total{job=~".*etcd.*"}[120s])) > 0.01
            )
          )
          > 0
        for: 20m
        labels:
          severity: warning
      - alert: etcdInsufficientMembers
        annotations:
          description: "etcd cluster \"{{ $labels.job }}\": insufficient members ({{ $value }})."
          runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/etcd/etcdinsufficientmembers"
          summary: "etcd cluster has insufficient number of members."
        expr: "sum(up{job=~\".*etcd.*\"} == bool 1) without (instance, pod) < ((count(up{job=~\".*etcd.*\"}) without (instance, pod) + 1) / 2)"
        for: 3m
        labels:
          severity: critical
      - alert: etcdNoLeader
        annotations:
          description: "etcd cluster \"{{ $labels.job }}\": member {{ $labels.instance }} has no leader."
          runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/etcd/etcdnoleader"
          summary: "etcd cluster has no leader."
        expr: "etcd_server_has_leader{job=~\".*etcd.*\"} == 0"
        for: 1m
        labels:
          severity: critical
      - alert: etcdHighNumberOfLeaderChanges
        annotations:
          description: "etcd cluster \"{{ $labels.job }}\": {{ $value }} leader changes within the last 15 minutes. Frequent elections may be a sign of insufficient resources, high network latency, or disruptions by other components and should be investigated."
          runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/etcd/etcdhighnumberofleaderchanges"
          summary: "etcd cluster has high number of leader changes."
        expr: "increase((max without (instance, pod) (etcd_server_leader_changes_seen_total{job=~\".*etcd.*\"}) or 0*absent(etcd_server_leader_changes_seen_total{job=~\".*etcd.*\"}))[15m:1m]) >= 4"
        for: 5m
        labels:
          severity: warning
      - alert: etcdHighNumberOfFailedGRPCRequests
        annotations:
          description: "etcd cluster \"{{ $labels.job }}\": {{ $value }}% of requests for {{ $labels.grpc_method }} failed on etcd instance {{ $labels.instance }}."
          runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/etcd/etcdhighnumberoffailedgrpcrequests"
          summary: "etcd cluster has high number of failed grpc requests."
        expr: |
          100 * sum(rate(grpc_server_handled_total{job=~".*etcd.*", grpc_code=~"Unknown|FailedPrecondition|ResourceExhausted|Internal|Unavailable|DataLoss|DeadlineExceeded"}[5m])) without (grpc_type, grpc_code)
            /
          sum(rate(grpc_server_handled_total{job=~".*etcd.*"}[5m])) without (grpc_type, grpc_code)
            > 1
        for: 10m
        labels:
          severity: warning
      - alert: etcdHighNumberOfFailedGRPCRequests
        annotations:
          description: "etcd cluster \"{{ $labels.job }}\": {{ $value }}% of requests for {{ $labels.grpc_method }} failed on etcd instance {{ $labels.instance }}."
          runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/etcd/etcdhighnumberoffailedgrpcrequests"
          summary: "etcd cluster has high number of failed grpc requests."
        expr: |
          100 * sum(rate(grpc_server_handled_total{job=~".*etcd.*", grpc_code=~"Unknown|FailedPrecondition|ResourceExhausted|Internal|Unavailable|DataLoss|DeadlineExceeded"}[5m])) without (grpc_type, grpc_code)
            /
          sum(rate(grpc_server_handled_total{job=~".*etcd.*"}[5m])) without (grpc_type, grpc_code)
            > 5
        for: 5m
        labels:
          severity: critical
      - alert: etcdGRPCRequestsSlow
        annotations:
          description: "etcd cluster \"{{ $labels.job }}\": 99th percentile of gRPC requests is {{ $value }}s on etcd instance {{ $labels.instance }} for {{ $labels.grpc_method }} method."
          runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/etcd/etcdgrpcrequestsslow"
          summary: "etcd grpc requests are slow"
        expr: |
          histogram_quantile(0.99, sum(rate(grpc_server_handling_seconds_bucket{job=~".*etcd.*", grpc_method!="Defragment", grpc_type="unary"}[5m])) without(grpc_type))
          > 0.15
        for: 10m
        labels:
          severity: critical
      - alert: etcdMemberCommunicationSlow
        annotations:
          description: "etcd cluster \"{{ $labels.job }}\": member communication with {{ $labels.To }} is taking {{ $value }}s on etcd instance {{ $labels.instance }}."
          runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/etcd/etcdmembercommunicationslow"
          summary: "etcd cluster member communication is slow."
        expr: |
          histogram_quantile(0.99, rate(etcd_network_peer_round_trip_time_seconds_bucket{job=~".*etcd.*"}[5m]))
          > 0.15
        for: 10m
        labels:
          severity: warning
      - alert: etcdHighNumberOfFailedProposals
        annotations:
          description: "etcd cluster \"{{ $labels.job }}\": {{ $value }} proposal failures within the last 30 minutes on etcd instance {{ $labels.instance }}."
          runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/etcd/etcdhighnumberoffailedproposals"
          summary: "etcd cluster has high number of proposal failures."
        expr: "rate(etcd_server_proposals_failed_total{job=~\".*etcd.*\"}[15m]) > 5"
        for: 15m
        labels:
          severity: warning
      - alert: etcdHighFsyncDurations
        annotations:
          description: "etcd cluster \"{{ $labels.job }}\": 99th percentile fsync durations are {{ $value }}s on etcd instance {{ $labels.instance }}."
          runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/etcd/etcdhighfsyncdurations"
          summary: "etcd cluster 99th percentile fsync durations are too high."
        expr: |
          histogram_quantile(0.99, rate(etcd_disk_wal_fsync_duration_seconds_bucket{job=~".*etcd.*"}[5m]))
          > 0.5
        for: 10m
        labels:
          severity: warning
      - alert: etcdHighFsyncDurations
        annotations:
          description: "etcd cluster \"{{ $labels.job }}\": 99th percentile fsync durations are {{ $value }}s on etcd instance {{ $labels.instance }}."
          runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/etcd/etcdhighfsyncdurations"
          summary: "etcd cluster 99th percentile fsync durations are too high."
        expr: |
          histogram_quantile(0.99, rate(etcd_disk_wal_fsync_duration_seconds_bucket{job=~".*etcd.*"}[5m]))
          > 1
        for: 10m
        labels:
          severity: critical
      - alert: etcdHighCommitDurations
        annotations:
          description: "etcd cluster \"{{ $labels.job }}\": 99th percentile commit durations {{ $value }}s on etcd instance {{ $labels.instance }}."
          runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/etcd/etcdhighcommitdurations"
          summary: "etcd cluster 99th percentile commit durations are too high."
        expr: |
          histogram_quantile(0.99, rate(etcd_disk_backend_commit_duration_seconds_bucket{job=~".*etcd.*"}[5m]))
          > 0.25
        for: 10m
        labels:
          severity: warning
      - alert: etcdDatabaseQuotaLowSpace
        annotations:
          description: "etcd cluster \"{{ $labels.job }}\": database size exceeds the defined quota on etcd instance {{ $labels.instance }}, please defrag or increase the quota as the writes to etcd will be disabled when it is full."
          runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/etcd/etcddatabasequotalowspace"
          summary: "etcd cluster database is running full."
        expr: "(last_over_time(etcd_mvcc_db_total_size_in_bytes{job=~\".*etcd.*\"}[5m]) / last_over_time(etcd_server_quota_backend_bytes{job=~\".*etcd.*\"}[5m]))*100 > 95"
        for: 10m
        labels:
          severity: critical
      - alert: etcdExcessiveDatabaseGrowth
        annotations:
          description: "etcd cluster \"{{ $labels.job }}\": Predicting running out of disk space in the next four hours, based on write observations within the past four hours on etcd instance {{ $labels.instance }}, please check as it might be disruptive."
          runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/etcd/etcdexcessivedatabasegrowth"
          summary: "etcd cluster database growing very fast."
        expr: "predict_linear(etcd_mvcc_db_total_size_in_bytes{job=~\".*etcd.*\"}[4h], 4*60*60) > etcd_server_quota_backend_bytes{job=~\".*etcd.*\"}"
        for: 10m
        labels:
          severity: warning
  


(root level)
+ one document added:
  apiVersion: monitoring.coreos.com/v1
  kind: PrometheusRule
  metadata:
    name: kube-prometheus-stack-general.rules
    namespace: monitoring
    labels:
      app: kube-prometheus-stack
      app.kubernetes.io/instance: kube-prometheus-stack
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/part-of: kube-prometheus-stack
      helm.toolkit.fluxcd.io/name: kube-prometheus-stack
      helm.toolkit.fluxcd.io/namespace: flux-system
      heritage: Helm
      release: kube-prometheus-stack
  spec:
    groups:
    - name: general.rules
      rules:
      - alert: TargetDown
        annotations:
          description: "{{ printf \"%.4g\" $value }}% of the {{ $labels.job }}/{{ $labels.service }} targets in {{ $labels.namespace }} namespace are down."
          runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/general/targetdown"
          summary: "One or more targets are unreachable."
        expr: "100 * (count(up == 0) BY (cluster, job, namespace, service) / count(up) BY (cluster, job, namespace, service)) > 10"
        for: 10m
        labels:
          severity: warning
      - alert: Watchdog
        annotations:
          description: |
            This is an alert meant to ensure that the entire alerting pipeline is functional.
            This alert is always firing, therefore it should always be firing in Alertmanager
            and always fire against a receiver. There are integrations with various notification
            mechanisms that send a notification when this alert is not firing. For example the
            "DeadMansSnitch" integration in PagerDuty.
            
          runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/general/watchdog"
          summary: "An alert that should always be firing to certify that Alertmanager is working properly."
        expr: vector(1)
        labels:
          severity: none
      - alert: InfoInhibitor
        annotations:
          description: |
            This is an alert that is used to inhibit info alerts.
            By themselves, the info-level alerts are sometimes very noisy, but they are relevant when combined with
            other alerts.
            This alert fires whenever there's a severity="info" alert, and stops firing when another alert with a
            severity of 'warning' or 'critical' starts firing on the same namespace.
            This alert should be routed to a null receiver and configured to inhibit alerts with severity="info".
            
          runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/general/infoinhibitor"
          summary: "Info-level alert inhibition."
        expr: "group by (namespace) (ALERTS{severity = \"info\"} == 1) unless on (namespace) group by (namespace) (ALERTS{alertname != \"InfoInhibitor\", alertstate = \"firing\", severity =~ \"warning|critical\"} == 1)"
        labels:
          severity: none
  


(root level)
+ one document added:
  apiVersion: monitoring.coreos.com/v1
  kind: PrometheusRule
  metadata:
    name: kube-prometheus-stack-k8s.rules.container-cpu-usage-seconds-tot
    namespace: monitoring
    labels:
      app: kube-prometheus-stack
      app.kubernetes.io/instance: kube-prometheus-stack
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/part-of: kube-prometheus-stack
      helm.toolkit.fluxcd.io/name: kube-prometheus-stack
      helm.toolkit.fluxcd.io/namespace: flux-system
      heritage: Helm
      release: kube-prometheus-stack
  spec:
    groups:
    - name: k8s.rules.container_cpu_usage_seconds_total
      rules:
      - expr: |
          sum by (cluster, namespace, pod, container) (
            rate(container_cpu_usage_seconds_total{job="kubelet", metrics_path="/metrics/cadvisor", image!=""}[5m])
          ) * on (cluster, namespace, pod) group_left(node) topk by (cluster, namespace, pod) (
            1, max by (cluster, namespace, pod, node) (kube_pod_info{node!=""})
          )
        record: "node_namespace_pod_container:container_cpu_usage_seconds_total:sum_rate5m"
      - expr: |
          sum by (cluster, namespace, pod, container) (
            irate(container_cpu_usage_seconds_total{job="kubelet", metrics_path="/metrics/cadvisor", image!=""}[5m])
          ) * on (cluster, namespace, pod) group_left(node) topk by (cluster, namespace, pod) (
            1, max by (cluster, namespace, pod, node) (kube_pod_info{node!=""})
          )
        record: "node_namespace_pod_container:container_cpu_usage_seconds_total:sum_irate"
  


(root level)
+ one document added:
  apiVersion: monitoring.coreos.com/v1
  kind: PrometheusRule
  metadata:
    name: kube-prometheus-stack-k8s.rules.container-memory-cache
    namespace: monitoring
    labels:
      app: kube-prometheus-stack
      app.kubernetes.io/instance: kube-prometheus-stack
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/part-of: kube-prometheus-stack
      helm.toolkit.fluxcd.io/name: kube-prometheus-stack
      helm.toolkit.fluxcd.io/namespace: flux-system
      heritage: Helm
      release: kube-prometheus-stack
  spec:
    groups:
    - name: k8s.rules.container_memory_cache
      rules:
      - expr: |
          container_memory_cache{job="kubelet", metrics_path="/metrics/cadvisor", image!=""}
          * on (cluster, namespace, pod) group_left(node) topk by (cluster, namespace, pod) (1,
            max by (cluster, namespace, pod, node) (kube_pod_info{node!=""})
          )
        record: "node_namespace_pod_container:container_memory_cache"
  


(root level)
+ one document added:
  apiVersion: monitoring.coreos.com/v1
  kind: PrometheusRule
  metadata:
    name: kube-prometheus-stack-k8s.rules.container-memory-rss
    namespace: monitoring
    labels:
      app: kube-prometheus-stack
      app.kubernetes.io/instance: kube-prometheus-stack
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/part-of: kube-prometheus-stack
      helm.toolkit.fluxcd.io/name: kube-prometheus-stack
      helm.toolkit.fluxcd.io/namespace: flux-system
      heritage: Helm
      release: kube-prometheus-stack
  spec:
    groups:
    - name: k8s.rules.container_memory_rss
      rules:
      - expr: |
          container_memory_rss{job="kubelet", metrics_path="/metrics/cadvisor", image!=""}
          * on (cluster, namespace, pod) group_left(node) topk by (cluster, namespace, pod) (1,
            max by (cluster, namespace, pod, node) (kube_pod_info{node!=""})
          )
        record: "node_namespace_pod_container:container_memory_rss"
  


(root level)
+ one document added:
  apiVersion: monitoring.coreos.com/v1
  kind: PrometheusRule
  metadata:
    name: kube-prometheus-stack-k8s.rules.container-memory-swap
    namespace: monitoring
    labels:
      app: kube-prometheus-stack
      app.kubernetes.io/instance: kube-prometheus-stack
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/part-of: kube-prometheus-stack
      helm.toolkit.fluxcd.io/name: kube-prometheus-stack
      helm.toolkit.fluxcd.io/namespace: flux-system
      heritage: Helm
      release: kube-prometheus-stack
  spec:
    groups:
    - name: k8s.rules.container_memory_swap
      rules:
      - expr: |
          container_memory_swap{job="kubelet", metrics_path="/metrics/cadvisor", image!=""}
          * on (cluster, namespace, pod) group_left(node) topk by (cluster, namespace, pod) (1,
            max by (cluster, namespace, pod, node) (kube_pod_info{node!=""})
          )
        record: "node_namespace_pod_container:container_memory_swap"
  


(root level)
+ one document added:
  apiVersion: monitoring.coreos.com/v1
  kind: PrometheusRule
  metadata:
    name: kube-prometheus-stack-k8s.rules.container-memory-working-set-by
    namespace: monitoring
    labels:
      app: kube-prometheus-stack
      app.kubernetes.io/instance: kube-prometheus-stack
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/part-of: kube-prometheus-stack
      helm.toolkit.fluxcd.io/name: kube-prometheus-stack
      helm.toolkit.fluxcd.io/namespace: flux-system
      heritage: Helm
      release: kube-prometheus-stack
  spec:
    groups:
    - name: k8s.rules.container_memory_working_set_bytes
      rules:
      - expr: |
          container_memory_working_set_bytes{job="kubelet", metrics_path="/metrics/cadvisor", image!=""}
          * on (cluster, namespace, pod) group_left(node) topk by (cluster, namespace, pod) (1,
            max by (cluster, namespace, pod, node) (kube_pod_info{node!=""})
          )
        record: "node_namespace_pod_container:container_memory_working_set_bytes"
  


(root level)
+ one document added:
  apiVersion: monitoring.coreos.com/v1
  kind: PrometheusRule
  metadata:
    name: kube-prometheus-stack-k8s.rules.container-resource
    namespace: monitoring
    labels:
      app: kube-prometheus-stack
      app.kubernetes.io/instance: kube-prometheus-stack
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/part-of: kube-prometheus-stack
      helm.toolkit.fluxcd.io/name: kube-prometheus-stack
      helm.toolkit.fluxcd.io/namespace: flux-system
      heritage: Helm
      release: kube-prometheus-stack
  spec:
    groups:
    - name: k8s.rules.container_resource
      rules:
      - expr: |
          kube_pod_container_resource_requests{resource="memory",job="kube-state-metrics"}  * on (namespace, pod, cluster)
          group_left() max by (namespace, pod, cluster) (
            (kube_pod_status_phase{phase=~"Pending|Running"} == 1)
          )
        record: "cluster:namespace:pod_memory:active:kube_pod_container_resource_requests"
      - expr: |
          sum by (namespace, cluster) (
              sum by (namespace, pod, cluster) (
                  max by (namespace, pod, container, cluster) (
                    kube_pod_container_resource_requests{resource="memory",job="kube-state-metrics"}
                  ) * on (namespace, pod, cluster) group_left() max by (namespace, pod, cluster) (
                    kube_pod_status_phase{phase=~"Pending|Running"} == 1
                  )
              )
          )
        record: "namespace_memory:kube_pod_container_resource_requests:sum"
      - expr: |
          kube_pod_container_resource_requests{resource="cpu",job="kube-state-metrics"}  * on (namespace, pod, cluster)
          group_left() max by (namespace, pod, cluster) (
            (kube_pod_status_phase{phase=~"Pending|Running"} == 1)
          )
        record: "cluster:namespace:pod_cpu:active:kube_pod_container_resource_requests"
      - expr: |
          sum by (namespace, cluster) (
              sum by (namespace, pod, cluster) (
                  max by (namespace, pod, container, cluster) (
                    kube_pod_container_resource_requests{resource="cpu",job="kube-state-metrics"}
                  ) * on (namespace, pod, cluster) group_left() max by (namespace, pod, cluster) (
                    kube_pod_status_phase{phase=~"Pending|Running"} == 1
                  )
              )
          )
        record: "namespace_cpu:kube_pod_container_resource_requests:sum"
      - expr: |
          kube_pod_container_resource_limits{resource="memory",job="kube-state-metrics"}  * on (namespace, pod, cluster)
          group_left() max by (namespace, pod, cluster) (
            (kube_pod_status_phase{phase=~"Pending|Running"} == 1)
          )
        record: "cluster:namespace:pod_memory:active:kube_pod_container_resource_limits"
      - expr: |
          sum by (namespace, cluster) (
              sum by (namespace, pod, cluster) (
                  max by (namespace, pod, container, cluster) (
                    kube_pod_container_resource_limits{resource="memory",job="kube-state-metrics"}
                  ) * on (namespace, pod, cluster) group_left() max by (namespace, pod, cluster) (
                    kube_pod_status_phase{phase=~"Pending|Running"} == 1
                  )
              )
          )
        record: "namespace_memory:kube_pod_container_resource_limits:sum"
      - expr: |
          kube_pod_container_resource_limits{resource="cpu",job="kube-state-metrics"}  * on (namespace, pod, cluster)
          group_left() max by (namespace, pod, cluster) (
           (kube_pod_status_phase{phase=~"Pending|Running"} == 1)
           )
        record: "cluster:namespace:pod_cpu:active:kube_pod_container_resource_limits"
      - expr: |
          sum by (namespace, cluster) (
              sum by (namespace, pod, cluster) (
                  max by (namespace, pod, container, cluster) (
                    kube_pod_container_resource_limits{resource="cpu",job="kube-state-metrics"}
                  ) * on (namespace, pod, cluster) group_left() max by (namespace, pod, cluster) (
                    kube_pod_status_phase{phase=~"Pending|Running"} == 1
                  )
              )
          )
        record: "namespace_cpu:kube_pod_container_resource_limits:sum"
  


(root level)
+ one document added:
  apiVersion: monitoring.coreos.com/v1
  kind: PrometheusRule
  metadata:
    name: kube-prometheus-stack-k8s.rules.pod-owner
    namespace: monitoring
    labels:
      app: kube-prometheus-stack
      app.kubernetes.io/instance: kube-prometheus-stack
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/part-of: kube-prometheus-stack
      helm.toolkit.fluxcd.io/name: kube-prometheus-stack
      helm.toolkit.fluxcd.io/namespace: flux-system
      heritage: Helm
      release: kube-prometheus-stack
  spec:
    groups:
    - name: k8s.rules.pod_owner
      rules:
      - expr: |
          max by (cluster, namespace, workload, pod) (
            label_replace(
              label_replace(
                kube_pod_owner{job="kube-state-metrics", owner_kind="ReplicaSet"},
                "replicaset", "$1", "owner_name", "(.*)"
              ) * on (cluster, replicaset, namespace) group_left(owner_name) topk by (cluster, replicaset, namespace) (
                1, max by (cluster, replicaset, namespace, owner_name) (
                  kube_replicaset_owner{job="kube-state-metrics", owner_kind=""}
                )
              ),
              "workload", "$1", "replicaset", "(.*)"
            )
          )
        labels:
          workload_type: replicaset
        record: "namespace_workload_pod:kube_pod_owner:relabel"
      - expr: |
          max by (cluster, namespace, workload, pod) (
            label_replace(
              label_replace(
                kube_pod_owner{job="kube-state-metrics", owner_kind="ReplicaSet"},
                "replicaset", "$1", "owner_name", "(.*)"
              ) * on (replicaset, namespace, cluster) group_left(owner_name) topk by (cluster, replicaset, namespace) (
                1, max by (cluster, replicaset, namespace, owner_name) (
                  kube_replicaset_owner{job="kube-state-metrics", owner_kind="Deployment"}
                )
              ),
              "workload", "$1", "owner_name", "(.*)"
            )
          )
        labels:
          workload_type: deployment
        record: "namespace_workload_pod:kube_pod_owner:relabel"
      - expr: |
          max by (cluster, namespace, workload, pod) (
            label_replace(
              kube_pod_owner{job="kube-state-metrics", owner_kind="DaemonSet"},
              "workload", "$1", "owner_name", "(.*)"
            )
          )
        labels:
          workload_type: daemonset
        record: "namespace_workload_pod:kube_pod_owner:relabel"
      - expr: |
          max by (cluster, namespace, workload, pod) (
            label_replace(
              kube_pod_owner{job="kube-state-metrics", owner_kind="StatefulSet"},
            "workload", "$1", "owner_name", "(.*)")
          )
        labels:
          workload_type: statefulset
        record: "namespace_workload_pod:kube_pod_owner:relabel"
      - expr: |
          group by (cluster, namespace, workload, pod) (
            label_join(
              group by (cluster, namespace, job_name, pod, owner_name) (
                label_join(
                  kube_pod_owner{job="kube-state-metrics", owner_kind="Job"}
                , "job_name", "", "owner_name")
              )
              * on (cluster, namespace, job_name) group_left()
              group by (cluster, namespace, job_name) (
                kube_job_owner{job="kube-state-metrics", owner_kind=~"Pod|"}
              )
            , "workload", "", "owner_name")
          )
        labels:
          workload_type: job
        record: "namespace_workload_pod:kube_pod_owner:relabel"
      - expr: |
          max by (cluster, namespace, workload, pod) (
            label_replace(
              kube_pod_owner{job="kube-state-metrics", owner_kind="", owner_name=""},
            "workload", "$1", "pod", "(.+)")
          )
        labels:
          workload_type: barepod
        record: "namespace_workload_pod:kube_pod_owner:relabel"
      - expr: |
          max by (cluster, namespace, workload, pod) (
            label_replace(
              kube_pod_owner{job="kube-state-metrics", owner_kind="Node"},
            "workload", "$1", "pod", "(.+)")
          )
        labels:
          workload_type: staticpod
        record: "namespace_workload_pod:kube_pod_owner:relabel"
      - expr: |
          group by (cluster, namespace, workload, workload_type, pod) (
            label_join(
              label_join(
                group by (cluster, namespace, job_name, pod) (
                  label_join(
                    kube_pod_owner{job="kube-state-metrics", owner_kind="Job"}
                  , "job_name", "", "owner_name")
                )
                * on (cluster, namespace, job_name) group_left(owner_kind, owner_name)
                group by (cluster, namespace, job_name, owner_kind, owner_name) (
                  kube_job_owner{job="kube-state-metrics", owner_kind!="Pod", owner_kind!=""}
                )
              , "workload", "", "owner_name")
            , "workload_type", "", "owner_kind")
          
            OR
          
            label_replace(
              label_replace(
                label_replace(
                  kube_pod_owner{job="kube-state-metrics", owner_kind="ReplicaSet"}
                  , "replicaset", "$1", "owner_name", "(.+)"
                )
                * on (cluster, namespace, replicaset) group_left(owner_kind, owner_name)
                group by (cluster, namespace, replicaset, owner_kind, owner_name) (
                  kube_replicaset_owner{job="kube-state-metrics", owner_kind!="Deployment", owner_kind!=""}
                )
              , "workload", "$1", "owner_name", "(.+)")
              OR
              label_replace(
                group by (cluster, namespace, pod, owner_name, owner_kind) (
                  kube_pod_owner{job="kube-state-metrics", owner_kind!="ReplicaSet", owner_kind!="DaemonSet", owner_kind!="StatefulSet", owner_kind!="Job", owner_kind!="Node", owner_kind!=""}
                )
                , "workload", "$1", "owner_name", "(.+)"
              )
            , "workload_type", "$1", "owner_kind", "(.+)")
          )
        record: "namespace_workload_pod:kube_pod_owner:relabel"
  


(root level)
+ one document added:
  apiVersion: monitoring.coreos.com/v1
  kind: PrometheusRule
  metadata:
    name: kube-prometheus-stack-kube-apiserver-availability.rules
    namespace: monitoring
    labels:
      app: kube-prometheus-stack
      app.kubernetes.io/instance: kube-prometheus-stack
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/part-of: kube-prometheus-stack
      helm.toolkit.fluxcd.io/name: kube-prometheus-stack
      helm.toolkit.fluxcd.io/namespace: flux-system
      heritage: Helm
      release: kube-prometheus-stack
  spec:
    groups:
    - name: kube-apiserver-availability.rules
      interval: 3m
      rules:
      - expr: "avg_over_time(code_verb:apiserver_request_total:increase1h[30d]) * 24 * 30"
        record: "code_verb:apiserver_request_total:increase30d"
      - expr: "sum by (cluster, code) (code_verb:apiserver_request_total:increase30d{verb=~\"LIST|GET\"})"
        labels:
          verb: read
        record: "code:apiserver_request_total:increase30d"
      - expr: "sum by (cluster, code) (code_verb:apiserver_request_total:increase30d{verb=~\"POST|PUT|PATCH|DELETE\"})"
        labels:
          verb: write
        record: "code:apiserver_request_total:increase30d"
      - expr: "sum by (cluster, verb, scope, le) (increase(apiserver_request_sli_duration_seconds_bucket[1h]))"
        record: "cluster_verb_scope_le:apiserver_request_sli_duration_seconds_bucket:increase1h"
      - expr: "sum by (cluster, verb, scope, le) (avg_over_time(cluster_verb_scope_le:apiserver_request_sli_duration_seconds_bucket:increase1h[30d]) * 24 * 30)"
        record: "cluster_verb_scope_le:apiserver_request_sli_duration_seconds_bucket:increase30d"
      - expr: "sum by (cluster, verb, scope) (cluster_verb_scope_le:apiserver_request_sli_duration_seconds_bucket:increase1h{le=\"+Inf\"})"
        record: "cluster_verb_scope:apiserver_request_sli_duration_seconds_count:increase1h"
      - expr: "sum by (cluster, verb, scope) (cluster_verb_scope_le:apiserver_request_sli_duration_seconds_bucket:increase30d{le=\"+Inf\"})"
        record: "cluster_verb_scope:apiserver_request_sli_duration_seconds_count:increase30d"
      - expr: |
          1 - (
            (
              # write too slow
              sum by (cluster) (cluster_verb_scope:apiserver_request_sli_duration_seconds_count:increase30d{verb=~"POST|PUT|PATCH|DELETE"})
              -
              sum by (cluster) (cluster_verb_scope_le:apiserver_request_sli_duration_seconds_bucket:increase30d{verb=~"POST|PUT|PATCH|DELETE",le=~"1(\\.0)?"} or vector(0))
            ) +
            (
              # read too slow
              sum by (cluster) (cluster_verb_scope:apiserver_request_sli_duration_seconds_count:increase30d{verb=~"LIST|GET"})
              -
              (
                sum by (cluster) (cluster_verb_scope_le:apiserver_request_sli_duration_seconds_bucket:increase30d{verb=~"LIST|GET",scope=~"resource|",le=~"1(\\.0)?"} or vector(0))
                +
                sum by (cluster) (cluster_verb_scope_le:apiserver_request_sli_duration_seconds_bucket:increase30d{verb=~"LIST|GET",scope="namespace",le=~"5(\\.0)?"} or vector(0))
                +
                sum by (cluster) (cluster_verb_scope_le:apiserver_request_sli_duration_seconds_bucket:increase30d{verb=~"LIST|GET",scope="cluster",le=~"30(\\.0)?"} or vector(0))
              )
            ) +
            # errors
            sum by (cluster) (code:apiserver_request_total:increase30d{code=~"5.."} or vector(0))
          )
          /
          sum by (cluster) (code:apiserver_request_total:increase30d)
        labels:
          verb: all
        record: "apiserver_request:availability30d"
      - expr: |
          1 - (
            sum by (cluster) (cluster_verb_scope:apiserver_request_sli_duration_seconds_count:increase30d{verb=~"LIST|GET"})
            -
            (
              # too slow
              sum by (cluster) (cluster_verb_scope_le:apiserver_request_sli_duration_seconds_bucket:increase30d{verb=~"LIST|GET",scope=~"resource|",le=~"1(\\.0)?"} or vector(0))
              +
              sum by (cluster) (cluster_verb_scope_le:apiserver_request_sli_duration_seconds_bucket:increase30d{verb=~"LIST|GET",scope="namespace",le=~"5(\\.0)?"} or vector(0))
              +
              sum by (cluster) (cluster_verb_scope_le:apiserver_request_sli_duration_seconds_bucket:increase30d{verb=~"LIST|GET",scope="cluster",le=~"30(\\.0)?"} or vector(0))
            )
            +
            # errors
            sum by (cluster) (code:apiserver_request_total:increase30d{verb="read",code=~"5.."} or vector(0))
          )
          /
          sum by (cluster) (code:apiserver_request_total:increase30d{verb="read"})
        labels:
          verb: read
        record: "apiserver_request:availability30d"
      - expr: |
          1 - (
            (
              # too slow
              sum by (cluster) (cluster_verb_scope:apiserver_request_sli_duration_seconds_count:increase30d{verb=~"POST|PUT|PATCH|DELETE"})
              -
              sum by (cluster) (cluster_verb_scope_le:apiserver_request_sli_duration_seconds_bucket:increase30d{verb=~"POST|PUT|PATCH|DELETE",le=~"1(\\.0)?"} or vector(0))
            )
            +
            # errors
            sum by (cluster) (code:apiserver_request_total:increase30d{verb="write",code=~"5.."} or vector(0))
          )
          /
          sum by (cluster) (code:apiserver_request_total:increase30d{verb="write"})
        labels:
          verb: write
        record: "apiserver_request:availability30d"
      - expr: "sum by (cluster,code,resource) (rate(apiserver_request_total{job=\"apiserver\",verb=~\"LIST|GET\"}[5m]))"
        labels:
          verb: read
        record: "code_resource:apiserver_request_total:rate5m"
      - expr: "sum by (cluster,code,resource) (rate(apiserver_request_total{job=\"apiserver\",verb=~\"POST|PUT|PATCH|DELETE\"}[5m]))"
        labels:
          verb: write
        record: "code_resource:apiserver_request_total:rate5m"
      - expr: "sum by (cluster, code, verb) (increase(apiserver_request_total{job=\"apiserver\",verb=~\"LIST|GET|POST|PUT|PATCH|DELETE\",code=~\"2..\"}[1h]))"
        record: "code_verb:apiserver_request_total:increase1h"
      - expr: "sum by (cluster, code, verb) (increase(apiserver_request_total{job=\"apiserver\",verb=~\"LIST|GET|POST|PUT|PATCH|DELETE\",code=~\"3..\"}[1h]))"
        record: "code_verb:apiserver_request_total:increase1h"
      - expr: "sum by (cluster, code, verb) (increase(apiserver_request_total{job=\"apiserver\",verb=~\"LIST|GET|POST|PUT|PATCH|DELETE\",code=~\"4..\"}[1h]))"
        record: "code_verb:apiserver_request_total:increase1h"
      - expr: "sum by (cluster, code, verb) (increase(apiserver_request_total{job=\"apiserver\",verb=~\"LIST|GET|POST|PUT|PATCH|DELETE\",code=~\"5..\"}[1h]))"
        record: "code_verb:apiserver_request_total:increase1h"
  


(root level)
+ one document added:
  apiVersion: monitoring.coreos.com/v1
  kind: PrometheusRule
  metadata:
    name: kube-prometheus-stack-kube-apiserver-burnrate.rules
    namespace: monitoring
    labels:
      app: kube-prometheus-stack
      app.kubernetes.io/instance: kube-prometheus-stack
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/part-of: kube-prometheus-stack
      helm.toolkit.fluxcd.io/name: kube-prometheus-stack
      helm.toolkit.fluxcd.io/namespace: flux-system
      heritage: Helm
      release: kube-prometheus-stack
  spec:
    groups:
    - name: kube-apiserver-burnrate.rules
      rules:
      - expr: |
          (
            (
              # too slow
              sum by (cluster) (rate(apiserver_request_sli_duration_seconds_count{job="apiserver",verb=~"LIST|GET",subresource!~"proxy|attach|log|exec|portforward"}[1d]))
              -
              (
                (
                  sum by (cluster) (rate(apiserver_request_sli_duration_seconds_bucket{job="apiserver",verb=~"LIST|GET",subresource!~"proxy|attach|log|exec|portforward",scope=~"resource|",le=~"1(\\.0)?"}[1d]))
                  or
                  vector(0)
                )
                +
                sum by (cluster) (rate(apiserver_request_sli_duration_seconds_bucket{job="apiserver",verb=~"LIST|GET",subresource!~"proxy|attach|log|exec|portforward",scope="namespace",le=~"5(\\.0)?"}[1d]))
                +
                sum by (cluster) (rate(apiserver_request_sli_duration_seconds_bucket{job="apiserver",verb=~"LIST|GET",subresource!~"proxy|attach|log|exec|portforward",scope="cluster",le=~"30(\\.0)?"}[1d]))
              )
            )
            +
            # errors
            sum by (cluster) (rate(apiserver_request_total{job="apiserver",verb=~"LIST|GET",code=~"5.."}[1d]))
          )
          /
          sum by (cluster) (rate(apiserver_request_total{job="apiserver",verb=~"LIST|GET"}[1d]))
        labels:
          verb: read
        record: "apiserver_request:burnrate1d"
      - expr: |
          (
            (
              # too slow
              sum by (cluster) (rate(apiserver_request_sli_duration_seconds_count{job="apiserver",verb=~"LIST|GET",subresource!~"proxy|attach|log|exec|portforward"}[1h]))
              -
              (
                (
                  sum by (cluster) (rate(apiserver_request_sli_duration_seconds_bucket{job="apiserver",verb=~"LIST|GET",subresource!~"proxy|attach|log|exec|portforward",scope=~"resource|",le=~"1(\\.0)?"}[1h]))
                  or
                  vector(0)
                )
                +
                sum by (cluster) (rate(apiserver_request_sli_duration_seconds_bucket{job="apiserver",verb=~"LIST|GET",subresource!~"proxy|attach|log|exec|portforward",scope="namespace",le=~"5(\\.0)?"}[1h]))
                +
                sum by (cluster) (rate(apiserver_request_sli_duration_seconds_bucket{job="apiserver",verb=~"LIST|GET",subresource!~"proxy|attach|log|exec|portforward",scope="cluster",le=~"30(\\.0)?"}[1h]))
              )
            )
            +
            # errors
            sum by (cluster) (rate(apiserver_request_total{job="apiserver",verb=~"LIST|GET",code=~"5.."}[1h]))
          )
          /
          sum by (cluster) (rate(apiserver_request_total{job="apiserver",verb=~"LIST|GET"}[1h]))
        labels:
          verb: read
        record: "apiserver_request:burnrate1h"
      - expr: |
          (
            (
              # too slow
              sum by (cluster) (rate(apiserver_request_sli_duration_seconds_count{job="apiserver",verb=~"LIST|GET",subresource!~"proxy|attach|log|exec|portforward"}[2h]))
              -
              (
                (
                  sum by (cluster) (rate(apiserver_request_sli_duration_seconds_bucket{job="apiserver",verb=~"LIST|GET",subresource!~"proxy|attach|log|exec|portforward",scope=~"resource|",le=~"1(\\.0)?"}[2h]))
                  or
                  vector(0)
                )
                +
                sum by (cluster) (rate(apiserver_request_sli_duration_seconds_bucket{job="apiserver",verb=~"LIST|GET",subresource!~"proxy|attach|log|exec|portforward",scope="namespace",le=~"5(\\.0)?"}[2h]))
                +
                sum by (cluster) (rate(apiserver_request_sli_duration_seconds_bucket{job="apiserver",verb=~"LIST|GET",subresource!~"proxy|attach|log|exec|portforward",scope="cluster",le=~"30(\\.0)?"}[2h]))
              )
            )
            +
            # errors
            sum by (cluster) (rate(apiserver_request_total{job="apiserver",verb=~"LIST|GET",code=~"5.."}[2h]))
          )
          /
          sum by (cluster) (rate(apiserver_request_total{job="apiserver",verb=~"LIST|GET"}[2h]))
        labels:
          verb: read
        record: "apiserver_request:burnrate2h"
      - expr: |
          (
            (
              # too slow
              sum by (cluster) (rate(apiserver_request_sli_duration_seconds_count{job="apiserver",verb=~"LIST|GET",subresource!~"proxy|attach|log|exec|portforward"}[30m]))
              -
              (
                (
                  sum by (cluster) (rate(apiserver_request_sli_duration_seconds_bucket{job="apiserver",verb=~"LIST|GET",subresource!~"proxy|attach|log|exec|portforward",scope=~"resource|",le=~"1(\\.0)?"}[30m]))
                  or
                  vector(0)
                )
                +
                sum by (cluster) (rate(apiserver_request_sli_duration_seconds_bucket{job="apiserver",verb=~"LIST|GET",subresource!~"proxy|attach|log|exec|portforward",scope="namespace",le=~"5(\\.0)?"}[30m]))
                +
                sum by (cluster) (rate(apiserver_request_sli_duration_seconds_bucket{job="apiserver",verb=~"LIST|GET",subresource!~"proxy|attach|log|exec|portforward",scope="cluster",le=~"30(\\.0)?"}[30m]))
              )
            )
            +
            # errors
            sum by (cluster) (rate(apiserver_request_total{job="apiserver",verb=~"LIST|GET",code=~"5.."}[30m]))
          )
          /
          sum by (cluster) (rate(apiserver_request_total{job="apiserver",verb=~"LIST|GET"}[30m]))
        labels:
          verb: read
        record: "apiserver_request:burnrate30m"
      - expr: |
          (
            (
              # too slow
              sum by (cluster) (rate(apiserver_request_sli_duration_seconds_count{job="apiserver",verb=~"LIST|GET",subresource!~"proxy|attach|log|exec|portforward"}[3d]))
              -
              (
                (
                  sum by (cluster) (rate(apiserver_request_sli_duration_seconds_bucket{job="apiserver",verb=~"LIST|GET",subresource!~"proxy|attach|log|exec|portforward",scope=~"resource|",le=~"1(\\.0)?"}[3d]))
                  or
                  vector(0)
                )
                +
                sum by (cluster) (rate(apiserver_request_sli_duration_seconds_bucket{job="apiserver",verb=~"LIST|GET",subresource!~"proxy|attach|log|exec|portforward",scope="namespace",le=~"5(\\.0)?"}[3d]))
                +
                sum by (cluster) (rate(apiserver_request_sli_duration_seconds_bucket{job="apiserver",verb=~"LIST|GET",subresource!~"proxy|attach|log|exec|portforward",scope="cluster",le=~"30(\\.0)?"}[3d]))
              )
            )
            +
            # errors
            sum by (cluster) (rate(apiserver_request_total{job="apiserver",verb=~"LIST|GET",code=~"5.."}[3d]))
          )
          /
          sum by (cluster) (rate(apiserver_request_total{job="apiserver",verb=~"LIST|GET"}[3d]))
        labels:
          verb: read
        record: "apiserver_request:burnrate3d"
      - expr: |
          (
            (
              # too slow
              sum by (cluster) (rate(apiserver_request_sli_duration_seconds_count{job="apiserver",verb=~"LIST|GET",subresource!~"proxy|attach|log|exec|portforward"}[5m]))
              -
              (
                (
                  sum by (cluster) (rate(apiserver_request_sli_duration_seconds_bucket{job="apiserver",verb=~"LIST|GET",subresource!~"proxy|attach|log|exec|portforward",scope=~"resource|",le=~"1(\\.0)?"}[5m]))
                  or
                  vector(0)
                )
                +
                sum by (cluster) (rate(apiserver_request_sli_duration_seconds_bucket{job="apiserver",verb=~"LIST|GET",subresource!~"proxy|attach|log|exec|portforward",scope="namespace",le=~"5(\\.0)?"}[5m]))
                +
                sum by (cluster) (rate(apiserver_request_sli_duration_seconds_bucket{job="apiserver",verb=~"LIST|GET",subresource!~"proxy|attach|log|exec|portforward",scope="cluster",le=~"30(\\.0)?"}[5m]))
              )
            )
            +
            # errors
            sum by (cluster) (rate(apiserver_request_total{job="apiserver",verb=~"LIST|GET",code=~"5.."}[5m]))
          )
          /
          sum by (cluster) (rate(apiserver_request_total{job="apiserver",verb=~"LIST|GET"}[5m]))
        labels:
          verb: read
        record: "apiserver_request:burnrate5m"
      - expr: |
          (
            (
              # too slow
              sum by (cluster) (rate(apiserver_request_sli_duration_seconds_count{job="apiserver",verb=~"LIST|GET",subresource!~"proxy|attach|log|exec|portforward"}[6h]))
              -
              (
                (
                  sum by (cluster) (rate(apiserver_request_sli_duration_seconds_bucket{job="apiserver",verb=~"LIST|GET",subresource!~"proxy|attach|log|exec|portforward",scope=~"resource|",le=~"1(\\.0)?"}[6h]))
                  or
                  vector(0)
                )
                +
                sum by (cluster) (rate(apiserver_request_sli_duration_seconds_bucket{job="apiserver",verb=~"LIST|GET",subresource!~"proxy|attach|log|exec|portforward",scope="namespace",le=~"5(\\.0)?"}[6h]))
                +
                sum by (cluster) (rate(apiserver_request_sli_duration_seconds_bucket{job="apiserver",verb=~"LIST|GET",subresource!~"proxy|attach|log|exec|portforward",scope="cluster",le=~"30(\\.0)?"}[6h]))
              )
            )
            +
            # errors
            sum by (cluster) (rate(apiserver_request_total{job="apiserver",verb=~"LIST|GET",code=~"5.."}[6h]))
          )
          /
          sum by (cluster) (rate(apiserver_request_total{job="apiserver",verb=~"LIST|GET"}[6h]))
        labels:
          verb: read
        record: "apiserver_request:burnrate6h"
      - expr: |
          (
            (
              # too slow
              sum by (cluster) (rate(apiserver_request_sli_duration_seconds_count{job="apiserver",verb=~"POST|PUT|PATCH|DELETE",subresource!~"proxy|attach|log|exec|portforward"}[1d]))
              -
              sum by (cluster) (rate(apiserver_request_sli_duration_seconds_bucket{job="apiserver",verb=~"POST|PUT|PATCH|DELETE",subresource!~"proxy|attach|log|exec|portforward",le=~"1(\\.0)?"}[1d]))
            )
            +
            sum by (cluster) (rate(apiserver_request_total{job="apiserver",verb=~"POST|PUT|PATCH|DELETE",code=~"5.."}[1d]))
          )
          /
          sum by (cluster) (rate(apiserver_request_total{job="apiserver",verb=~"POST|PUT|PATCH|DELETE"}[1d]))
        labels:
          verb: write
        record: "apiserver_request:burnrate1d"
      - expr: |
          (
            (
              # too slow
              sum by (cluster) (rate(apiserver_request_sli_duration_seconds_count{job="apiserver",verb=~"POST|PUT|PATCH|DELETE",subresource!~"proxy|attach|log|exec|portforward"}[1h]))
              -
              sum by (cluster) (rate(apiserver_request_sli_duration_seconds_bucket{job="apiserver",verb=~"POST|PUT|PATCH|DELETE",subresource!~"proxy|attach|log|exec|portforward",le=~"1(\\.0)?"}[1h]))
            )
            +
            sum by (cluster) (rate(apiserver_request_total{job="apiserver",verb=~"POST|PUT|PATCH|DELETE",code=~"5.."}[1h]))
          )
          /
          sum by (cluster) (rate(apiserver_request_total{job="apiserver",verb=~"POST|PUT|PATCH|DELETE"}[1h]))
        labels:
          verb: write
        record: "apiserver_request:burnrate1h"
      - expr: |
          (
            (
              # too slow
              sum by (cluster) (rate(apiserver_request_sli_duration_seconds_count{job="apiserver",verb=~"POST|PUT|PATCH|DELETE",subresource!~"proxy|attach|log|exec|portforward"}[2h]))
              -
              sum by (cluster) (rate(apiserver_request_sli_duration_seconds_bucket{job="apiserver",verb=~"POST|PUT|PATCH|DELETE",subresource!~"proxy|attach|log|exec|portforward",le=~"1(\\.0)?"}[2h]))
            )
            +
            sum by (cluster) (rate(apiserver_request_total{job="apiserver",verb=~"POST|PUT|PATCH|DELETE",code=~"5.."}[2h]))
          )
          /
          sum by (cluster) (rate(apiserver_request_total{job="apiserver",verb=~"POST|PUT|PATCH|DELETE"}[2h]))
        labels:
          verb: write
        record: "apiserver_request:burnrate2h"
      - expr: |
          (
            (
              # too slow
              sum by (cluster) (rate(apiserver_request_sli_duration_seconds_count{job="apiserver",verb=~"POST|PUT|PATCH|DELETE",subresource!~"proxy|attach|log|exec|portforward"}[30m]))
              -
              sum by (cluster) (rate(apiserver_request_sli_duration_seconds_bucket{job="apiserver",verb=~"POST|PUT|PATCH|DELETE",subresource!~"proxy|attach|log|exec|portforward",le=~"1(\\.0)?"}[30m]))
            )
            +
            sum by (cluster) (rate(apiserver_request_total{job="apiserver",verb=~"POST|PUT|PATCH|DELETE",code=~"5.."}[30m]))
          )
          /
          sum by (cluster) (rate(apiserver_request_total{job="apiserver",verb=~"POST|PUT|PATCH|DELETE"}[30m]))
        labels:
          verb: write
        record: "apiserver_request:burnrate30m"
      - expr: |
          (
            (
              # too slow
              sum by (cluster) (rate(apiserver_request_sli_duration_seconds_count{job="apiserver",verb=~"POST|PUT|PATCH|DELETE",subresource!~"proxy|attach|log|exec|portforward"}[3d]))
              -
              sum by (cluster) (rate(apiserver_request_sli_duration_seconds_bucket{job="apiserver",verb=~"POST|PUT|PATCH|DELETE",subresource!~"proxy|attach|log|exec|portforward",le=~"1(\\.0)?"}[3d]))
            )
            +
            sum by (cluster) (rate(apiserver_request_total{job="apiserver",verb=~"POST|PUT|PATCH|DELETE",code=~"5.."}[3d]))
          )
          /
          sum by (cluster) (rate(apiserver_request_total{job="apiserver",verb=~"POST|PUT|PATCH|DELETE"}[3d]))
        labels:
          verb: write
        record: "apiserver_request:burnrate3d"
      - expr: |
          (
            (
              # too slow
              sum by (cluster) (rate(apiserver_request_sli_duration_seconds_count{job="apiserver",verb=~"POST|PUT|PATCH|DELETE",subresource!~"proxy|attach|log|exec|portforward"}[5m]))
              -
              sum by (cluster) (rate(apiserver_request_sli_duration_seconds_bucket{job="apiserver",verb=~"POST|PUT|PATCH|DELETE",subresource!~"proxy|attach|log|exec|portforward",le=~"1(\\.0)?"}[5m]))
            )
            +
            sum by (cluster) (rate(apiserver_request_total{job="apiserver",verb=~"POST|PUT|PATCH|DELETE",code=~"5.."}[5m]))
          )
          /
          sum by (cluster) (rate(apiserver_request_total{job="apiserver",verb=~"POST|PUT|PATCH|DELETE"}[5m]))
        labels:
          verb: write
        record: "apiserver_request:burnrate5m"
      - expr: |
          (
            (
              # too slow
              sum by (cluster) (rate(apiserver_request_sli_duration_seconds_count{job="apiserver",verb=~"POST|PUT|PATCH|DELETE",subresource!~"proxy|attach|log|exec|portforward"}[6h]))
              -
              sum by (cluster) (rate(apiserver_request_sli_duration_seconds_bucket{job="apiserver",verb=~"POST|PUT|PATCH|DELETE",subresource!~"proxy|attach|log|exec|portforward",le=~"1(\\.0)?"}[6h]))
            )
            +
            sum by (cluster) (rate(apiserver_request_total{job="apiserver",verb=~"POST|PUT|PATCH|DELETE",code=~"5.."}[6h]))
          )
          /
          sum by (cluster) (rate(apiserver_request_total{job="apiserver",verb=~"POST|PUT|PATCH|DELETE"}[6h]))
        labels:
          verb: write
        record: "apiserver_request:burnrate6h"
  


(root level)
+ one document added:
  apiVersion: monitoring.coreos.com/v1
  kind: PrometheusRule
  metadata:
    name: kube-prometheus-stack-kube-apiserver-histogram.rules
    namespace: monitoring
    labels:
      app: kube-prometheus-stack
      app.kubernetes.io/instance: kube-prometheus-stack
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/part-of: kube-prometheus-stack
      helm.toolkit.fluxcd.io/name: kube-prometheus-stack
      helm.toolkit.fluxcd.io/namespace: flux-system
      heritage: Helm
      release: kube-prometheus-stack
  spec:
    groups:
    - name: kube-apiserver-histogram.rules
      rules:
      - expr: "histogram_quantile(0.99, sum by (cluster, le, resource) (rate(apiserver_request_sli_duration_seconds_bucket{job=\"apiserver\",verb=~\"LIST|GET\",subresource!~\"proxy|attach|log|exec|portforward\"}[5m]))) > 0"
        labels:
          quantile: "0.99"
          verb: read
        record: "cluster_quantile:apiserver_request_sli_duration_seconds:histogram_quantile"
      - expr: "histogram_quantile(0.99, sum by (cluster, le, resource) (rate(apiserver_request_sli_duration_seconds_bucket{job=\"apiserver\",verb=~\"POST|PUT|PATCH|DELETE\",subresource!~\"proxy|attach|log|exec|portforward\"}[5m]))) > 0"
        labels:
          quantile: "0.99"
          verb: write
        record: "cluster_quantile:apiserver_request_sli_duration_seconds:histogram_quantile"
  


(root level)
+ one document added:
  apiVersion: monitoring.coreos.com/v1
  kind: PrometheusRule
  metadata:
    name: kube-prometheus-stack-kube-apiserver-slos
    namespace: monitoring
    labels:
      app: kube-prometheus-stack
      app.kubernetes.io/instance: kube-prometheus-stack
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/part-of: kube-prometheus-stack
      helm.toolkit.fluxcd.io/name: kube-prometheus-stack
      helm.toolkit.fluxcd.io/namespace: flux-system
      heritage: Helm
      release: kube-prometheus-stack
  spec:
    groups:
    - name: kube-apiserver-slos
      rules:
      - alert: KubeAPIErrorBudgetBurn
        annotations:
          description: "The Kube API server is burning too much error budget on cluster {{ $labels.cluster }}."
          runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/kubernetes/kubeapierrorbudgetburn"
          summary: "The Kube API server is burning too much error budget."
        expr: |
          sum by (cluster) (apiserver_request:burnrate1h) > (14.40 * 0.01000)
          and on (cluster)
          sum by (cluster) (apiserver_request:burnrate5m) > (14.40 * 0.01000)
        for: 2m
        labels:
          long: 1h
          severity: critical
          short: 5m
      - alert: KubeAPIErrorBudgetBurn
        annotations:
          description: "The Kube API server is burning too much error budget on cluster {{ $labels.cluster }}."
          runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/kubernetes/kubeapierrorbudgetburn"
          summary: "The Kube API server is burning too much error budget."
        expr: |
          sum by (cluster) (apiserver_request:burnrate6h) > (6.00 * 0.01000)
          and on (cluster)
          sum by (cluster) (apiserver_request:burnrate30m) > (6.00 * 0.01000)
        for: 15m
        labels:
          long: 6h
          severity: critical
          short: 30m
      - alert: KubeAPIErrorBudgetBurn
        annotations:
          description: "The Kube API server is burning too much error budget on cluster {{ $labels.cluster }}."
          runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/kubernetes/kubeapierrorbudgetburn"
          summary: "The Kube API server is burning too much error budget."
        expr: |
          sum by (cluster) (apiserver_request:burnrate1d) > (3.00 * 0.01000)
          and on (cluster)
          sum by (cluster) (apiserver_request:burnrate2h) > (3.00 * 0.01000)
        for: 1h
        labels:
          long: 1d
          severity: warning
          short: 2h
      - alert: KubeAPIErrorBudgetBurn
        annotations:
          description: "The Kube API server is burning too much error budget on cluster {{ $labels.cluster }}."
          runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/kubernetes/kubeapierrorbudgetburn"
          summary: "The Kube API server is burning too much error budget."
        expr: |
          sum by (cluster) (apiserver_request:burnrate3d) > (1.00 * 0.01000)
          and on (cluster)
          sum by (cluster) (apiserver_request:burnrate6h) > (1.00 * 0.01000)
        for: 3h
        labels:
          long: 3d
          severity: warning
          short: 6h
  


(root level)
+ one document added:
  apiVersion: monitoring.coreos.com/v1
  kind: PrometheusRule
  metadata:
    name: kube-prometheus-stack-kube-prometheus-general.rules
    namespace: monitoring
    labels:
      app: kube-prometheus-stack
      app.kubernetes.io/instance: kube-prometheus-stack
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/part-of: kube-prometheus-stack
      helm.toolkit.fluxcd.io/name: kube-prometheus-stack
      helm.toolkit.fluxcd.io/namespace: flux-system
      heritage: Helm
      release: kube-prometheus-stack
  spec:
    groups:
    - name: kube-prometheus-general.rules
      rules:
      - expr: "count without(instance, pod, node) (up == 1)"
        record: "count:up1"
      - expr: "count without(instance, pod, node) (up == 0)"
        record: "count:up0"

(root level)
+ one document added:
  apiVersion: monitoring.coreos.com/v1
  kind: PrometheusRule
  metadata:
    name: kube-prometheus-stack-kube-prometheus-node-recording.rules
    namespace: monitoring
    labels:
      app: kube-prometheus-stack
      app.kubernetes.io/instance: kube-prometheus-stack
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/part-of: kube-prometheus-stack
      helm.toolkit.fluxcd.io/name: kube-prometheus-stack
      helm.toolkit.fluxcd.io/namespace: flux-system
      heritage: Helm
      release: kube-prometheus-stack
  spec:
    groups:
    - name: kube-prometheus-node-recording.rules
      rules:
      - expr: "sum(rate(node_cpu_seconds_total{mode!=\"idle\",mode!=\"iowait\",mode!=\"steal\"}[3m])) BY (instance)"
        record: "instance:node_cpu:rate:sum"
      - expr: "sum(rate(node_network_receive_bytes_total[3m])) BY (instance)"
        record: "instance:node_network_receive_bytes:rate:sum"
      - expr: "sum(rate(node_network_transmit_bytes_total[3m])) BY (instance)"
        record: "instance:node_network_transmit_bytes:rate:sum"
      - expr: "sum(rate(node_cpu_seconds_total{mode!=\"idle\",mode!=\"iowait\",mode!=\"steal\"}[5m])) WITHOUT (cpu, mode) / ON (instance) GROUP_LEFT() count(sum(node_cpu_seconds_total) BY (instance, cpu)) BY (instance)"
        record: "instance:node_cpu:ratio"
      - expr: "sum(rate(node_cpu_seconds_total{mode!=\"idle\",mode!=\"iowait\",mode!=\"steal\"}[5m]))"
        record: "cluster:node_cpu:sum_rate5m"
      - expr: "cluster:node_cpu:sum_rate5m / count(sum(node_cpu_seconds_total) BY (instance, cpu))"
        record: "cluster:node_cpu:ratio"
  


(root level)
+ one document added:
  apiVersion: monitoring.coreos.com/v1
  kind: PrometheusRule
  metadata:
    name: kube-prometheus-stack-kube-scheduler.rules
    namespace: monitoring
    labels:
      app: kube-prometheus-stack
      app.kubernetes.io/instance: kube-prometheus-stack
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/part-of: kube-prometheus-stack
      helm.toolkit.fluxcd.io/name: kube-prometheus-stack
      helm.toolkit.fluxcd.io/namespace: flux-system
      heritage: Helm
      release: kube-prometheus-stack
  spec:
    groups:
    - name: kube-scheduler.rules
      rules:
      - expr: "histogram_quantile(0.99, sum(rate(scheduler_scheduling_attempt_duration_seconds_bucket{job=\"kube-scheduler\"}[5m])) without(instance, pod))"
        labels:
          quantile: "0.99"
        record: "cluster_quantile:scheduler_scheduling_attempt_duration_seconds:histogram_quantile"
      - expr: "histogram_quantile(0.99, sum(rate(scheduler_scheduling_algorithm_duration_seconds_bucket{job=\"kube-scheduler\"}[5m])) without(instance, pod))"
        labels:
          quantile: "0.99"
        record: "cluster_quantile:scheduler_scheduling_algorithm_duration_seconds:histogram_quantile"
      - expr: "histogram_quantile(0.99, sum(rate(scheduler_pod_scheduling_sli_duration_seconds_bucket{job=\"kube-scheduler\"}[5m])) without(instance, pod))"
        labels:
          quantile: "0.99"
        record: "cluster_quantile:scheduler_pod_scheduling_sli_duration_seconds:histogram_quantile"
      - expr: "histogram_quantile(0.9, sum(rate(scheduler_scheduling_attempt_duration_seconds_bucket{job=\"kube-scheduler\"}[5m])) without(instance, pod))"
        labels:
          quantile: "0.9"
        record: "cluster_quantile:scheduler_scheduling_attempt_duration_seconds:histogram_quantile"
      - expr: "histogram_quantile(0.9, sum(rate(scheduler_scheduling_algorithm_duration_seconds_bucket{job=\"kube-scheduler\"}[5m])) without(instance, pod))"
        labels:
          quantile: "0.9"
        record: "cluster_quantile:scheduler_scheduling_algorithm_duration_seconds:histogram_quantile"
      - expr: "histogram_quantile(0.9, sum(rate(scheduler_pod_scheduling_sli_duration_seconds_bucket{job=\"kube-scheduler\"}[5m])) without(instance, pod))"
        labels:
          quantile: "0.9"
        record: "cluster_quantile:scheduler_pod_scheduling_sli_duration_seconds:histogram_quantile"
      - expr: "histogram_quantile(0.5, sum(rate(scheduler_scheduling_attempt_duration_seconds_bucket{job=\"kube-scheduler\"}[5m])) without(instance, pod))"
        labels:
          quantile: "0.5"
        record: "cluster_quantile:scheduler_scheduling_attempt_duration_seconds:histogram_quantile"
      - expr: "histogram_quantile(0.5, sum(rate(scheduler_scheduling_algorithm_duration_seconds_bucket{job=\"kube-scheduler\"}[5m])) without(instance, pod))"
        labels:
          quantile: "0.5"
        record: "cluster_quantile:scheduler_scheduling_algorithm_duration_seconds:histogram_quantile"
      - expr: "histogram_quantile(0.5, sum(rate(scheduler_pod_scheduling_sli_duration_seconds_bucket{job=\"kube-scheduler\"}[5m])) without(instance, pod))"
        labels:
          quantile: "0.5"
        record: "cluster_quantile:scheduler_pod_scheduling_sli_duration_seconds:histogram_quantile"
  


(root level)
+ one document added:
  apiVersion: monitoring.coreos.com/v1
  kind: PrometheusRule
  metadata:
    name: kube-prometheus-stack-kube-state-metrics
    namespace: monitoring
    labels:
      app: kube-prometheus-stack
      app.kubernetes.io/instance: kube-prometheus-stack
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/part-of: kube-prometheus-stack
      helm.toolkit.fluxcd.io/name: kube-prometheus-stack
      helm.toolkit.fluxcd.io/namespace: flux-system
      heritage: Helm
      release: kube-prometheus-stack
  spec:
    groups:
    - name: kube-state-metrics
      rules:
      - alert: KubeStateMetricsListErrors
        annotations:
          description: "kube-state-metrics is experiencing errors at an elevated rate in list operations. This is likely causing it to not be able to expose metrics about Kubernetes objects correctly or at all."
          runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/kube-state-metrics/kubestatemetricslisterrors"
          summary: "kube-state-metrics is experiencing errors in list operations."
        expr: |
          (sum(rate(kube_state_metrics_list_total{job="kube-state-metrics",result="error"}[5m])) by (cluster)
            /
          sum(rate(kube_state_metrics_list_total{job="kube-state-metrics"}[5m])) by (cluster))
          > 0.01
        for: 15m
        labels:
          severity: critical
      - alert: KubeStateMetricsWatchErrors
        annotations:
          description: "kube-state-metrics is experiencing errors at an elevated rate in watch operations. This is likely causing it to not be able to expose metrics about Kubernetes objects correctly or at all."
          runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/kube-state-metrics/kubestatemetricswatcherrors"
          summary: "kube-state-metrics is experiencing errors in watch operations."
        expr: |
          (sum(rate(kube_state_metrics_watch_total{job="kube-state-metrics",result="error"}[5m])) by (cluster)
            /
          sum(rate(kube_state_metrics_watch_total{job="kube-state-metrics"}[5m])) by (cluster))
          > 0.01
        for: 15m
        labels:
          severity: critical
      - alert: KubeStateMetricsShardingMismatch
        annotations:
          description: "kube-state-metrics pods are running with different --total-shards configuration, some Kubernetes objects may be exposed multiple times or not exposed at all."
          runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/kube-state-metrics/kubestatemetricsshardingmismatch"
          summary: "kube-state-metrics sharding is misconfigured."
        expr: "stdvar (kube_state_metrics_total_shards{job=\"kube-state-metrics\"}) by (cluster) != 0"
        for: 15m
        labels:
          severity: critical
      - alert: KubeStateMetricsShardsMissing
        annotations:
          description: "kube-state-metrics shards are missing, some Kubernetes objects are not being exposed."
          runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/kube-state-metrics/kubestatemetricsshardsmissing"
          summary: "kube-state-metrics shards are missing."
        expr: |
          2^max(kube_state_metrics_total_shards{job="kube-state-metrics"}) by (cluster) - 1
            -
          sum( 2 ^ max by (cluster, shard_ordinal) (kube_state_metrics_shard_ordinal{job="kube-state-metrics"}) ) by (cluster)
          != 0
        for: 15m
        labels:
          severity: critical
  


(root level)
+ one document added:
  apiVersion: monitoring.coreos.com/v1
  kind: PrometheusRule
  metadata:
    name: kube-prometheus-stack-kubelet.rules
    namespace: monitoring
    labels:
      app: kube-prometheus-stack
      app.kubernetes.io/instance: kube-prometheus-stack
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/part-of: kube-prometheus-stack
      helm.toolkit.fluxcd.io/name: kube-prometheus-stack
      helm.toolkit.fluxcd.io/namespace: flux-system
      heritage: Helm
      release: kube-prometheus-stack
  spec:
    groups:
    - name: kubelet.rules
      rules:
      - expr: |
          histogram_quantile(
            0.99,
            sum(rate(kubelet_pleg_relist_duration_seconds_bucket{job="kubelet", metrics_path="/metrics"}[5m])) by (cluster, instance, le)
            * on (cluster, instance) group_left (node)
            max by (cluster, instance, node) (kubelet_node_name{job="kubelet", metrics_path="/metrics"})
          )
        labels:
          quantile: "0.99"
        record: "node_quantile:kubelet_pleg_relist_duration_seconds:histogram_quantile"
      - expr: |
          histogram_quantile(
            0.9,
            sum(rate(kubelet_pleg_relist_duration_seconds_bucket{job="kubelet", metrics_path="/metrics"}[5m])) by (cluster, instance, le)
            * on (cluster, instance) group_left (node)
            max by (cluster, instance, node) (kubelet_node_name{job="kubelet", metrics_path="/metrics"})
          )
        labels:
          quantile: "0.9"
        record: "node_quantile:kubelet_pleg_relist_duration_seconds:histogram_quantile"
      - expr: |
          histogram_quantile(
            0.5,
            sum(rate(kubelet_pleg_relist_duration_seconds_bucket{job="kubelet", metrics_path="/metrics"}[5m])) by (cluster, instance, le)
            * on (cluster, instance) group_left (node)
            max by (cluster, instance, node) (kubelet_node_name{job="kubelet", metrics_path="/metrics"})
          )
        labels:
          quantile: "0.5"
        record: "node_quantile:kubelet_pleg_relist_duration_seconds:histogram_quantile"
  


(root level)
+ one document added:
  apiVersion: monitoring.coreos.com/v1
  kind: PrometheusRule
  metadata:
    name: kube-prometheus-stack-kubernetes-apps
    namespace: monitoring
    labels:
      app: kube-prometheus-stack
      app.kubernetes.io/instance: kube-prometheus-stack
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/part-of: kube-prometheus-stack
      helm.toolkit.fluxcd.io/name: kube-prometheus-stack
      helm.toolkit.fluxcd.io/namespace: flux-system
      heritage: Helm
      release: kube-prometheus-stack
  spec:
    groups:
    - name: kubernetes-apps
      rules:
      - alert: KubePodCrashLooping
        annotations:
          description: "Pod {{ $labels.namespace }}/{{ $labels.pod }} ({{ $labels.container }}) is in waiting state (reason: \"CrashLoopBackOff\") on cluster {{ $labels.cluster }}."
          runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/kubernetes/kubepodcrashlooping"
          summary: "Pod is crash looping."
        expr: "max_over_time(kube_pod_container_status_waiting_reason{reason=\"CrashLoopBackOff\", job=\"kube-state-metrics\", namespace=~\".*\"}[5m]) >= 1"
        for: 15m
        labels:
          severity: warning
      - alert: KubePodNotReady
        annotations:
          description: "Pod {{ $labels.namespace }}/{{ $labels.pod }} has been in a non-ready state for longer than 15 minutes on cluster {{ $labels.cluster }}."
          runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/kubernetes/kubepodnotready"
          summary: "Pod has been in a non-ready state for more than 15 minutes."
        expr: |
          sum by (namespace, pod, job, cluster) (
            max by (namespace, pod, job, cluster) (
              kube_pod_status_phase{job="kube-state-metrics", namespace=~".*", phase=~"Pending|Unknown"}
              or
              (
                kube_pod_status_phase{job="kube-state-metrics", namespace=~".*", phase="Running"} == 1
                and on (namespace, pod, cluster)
                kube_pod_status_ready{job="kube-state-metrics", namespace=~".*", condition="true"} == 0
              )
            ) * on (namespace, pod, cluster) group_left() topk by (namespace, pod, cluster) (
              1, max by (namespace, pod, owner_kind, cluster) (kube_pod_owner{owner_kind!="Job"})
            )
          ) > 0
          unless on (namespace, pod, cluster)
          kube_pod_status_reason{job="kube-state-metrics", namespace=~".*", reason="SchedulingGated"} == 1
        for: 15m
        labels:
          severity: warning
      - alert: KubeDeploymentGenerationMismatch
        annotations:
          description: "Deployment generation for {{ $labels.namespace }}/{{ $labels.deployment }} does not match, this indicates that the Deployment has failed but has not been rolled back on cluster {{ $labels.cluster }}."
          runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/kubernetes/kubedeploymentgenerationmismatch"
          summary: "Deployment generation mismatch due to possible roll-back"
        expr: |
          kube_deployment_status_observed_generation{job="kube-state-metrics", namespace=~".*"}
            !=
          kube_deployment_metadata_generation{job="kube-state-metrics", namespace=~".*"}
        for: 15m
        labels:
          severity: warning
      - alert: KubeDeploymentReplicasMismatch
        annotations:
          description: "Deployment {{ $labels.namespace }}/{{ $labels.deployment }} has not matched the expected number of replicas for longer than 15 minutes on cluster {{ $labels.cluster }}."
          runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/kubernetes/kubedeploymentreplicasmismatch"
          summary: "Deployment has not matched the expected number of replicas."
        expr: |
          (
            kube_deployment_spec_replicas{job="kube-state-metrics", namespace=~".*"}
              >
            kube_deployment_status_replicas_available{job="kube-state-metrics", namespace=~".*"}
          ) and (
            changes(kube_deployment_status_replicas_updated{job="kube-state-metrics", namespace=~".*"}[10m])
              ==
            0
          )
        for: 15m
        labels:
          severity: warning
      - alert: KubeDeploymentRolloutStuck
        annotations:
          description: "Rollout of deployment {{ $labels.namespace }}/{{ $labels.deployment }} is not progressing for longer than 15 minutes on cluster {{ $labels.cluster }}."
          runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/kubernetes/kubedeploymentrolloutstuck"
          summary: "Deployment rollout is not progressing."
        expr: |
          kube_deployment_status_condition{condition="Progressing", status="false",job="kube-state-metrics", namespace=~".*"}
          != 0
        for: 15m
        labels:
          severity: warning
      - alert: KubeStatefulSetReplicasMismatch
        annotations:
          description: "StatefulSet {{ $labels.namespace }}/{{ $labels.statefulset }} has not matched the expected number of replicas for longer than 15 minutes on cluster {{ $labels.cluster }}."
          runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/kubernetes/kubestatefulsetreplicasmismatch"
          summary: "StatefulSet has not matched the expected number of replicas."
        expr: |
          (
            kube_statefulset_status_replicas_ready{job="kube-state-metrics", namespace=~".*"}
              !=
            kube_statefulset_replicas{job="kube-state-metrics", namespace=~".*"}
          ) and (
            changes(kube_statefulset_status_replicas_updated{job="kube-state-metrics", namespace=~".*"}[10m])
              ==
            0
          )
        for: 15m
        labels:
          severity: warning
      - alert: KubeStatefulSetGenerationMismatch
        annotations:
          description: "StatefulSet generation for {{ $labels.namespace }}/{{ $labels.statefulset }} does not match, this indicates that the StatefulSet has failed but has not been rolled back on cluster {{ $labels.cluster }}."
          runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/kubernetes/kubestatefulsetgenerationmismatch"
          summary: "StatefulSet generation mismatch due to possible roll-back"
        expr: |
          kube_statefulset_status_observed_generation{job="kube-state-metrics", namespace=~".*"}
            !=
          kube_statefulset_metadata_generation{job="kube-state-metrics", namespace=~".*"}
        for: 15m
        labels:
          severity: warning
      - alert: KubeStatefulSetUpdateNotRolledOut
        annotations:
          description: "StatefulSet {{ $labels.namespace }}/{{ $labels.statefulset }} update has not been rolled out on cluster {{ $labels.cluster }}."
          runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/kubernetes/kubestatefulsetupdatenotrolledout"
          summary: "StatefulSet update has not been rolled out."
        expr: |
          (
            max by (namespace, statefulset, job, cluster) (
              kube_statefulset_status_current_revision{job="kube-state-metrics", namespace=~".*"}
                unless
              kube_statefulset_status_update_revision{job="kube-state-metrics", namespace=~".*"}
            )
              * on (namespace, statefulset, job, cluster)
            (
              kube_statefulset_replicas{job="kube-state-metrics", namespace=~".*"}
                !=
              kube_statefulset_status_replicas_updated{job="kube-state-metrics", namespace=~".*"}
            )
          )  and on (namespace, statefulset, job, cluster) (
            changes(kube_statefulset_status_replicas_updated{job="kube-state-metrics", namespace=~".*"}[5m])
              ==
            0
          )
        for: 15m
        labels:
          severity: warning
      - alert: KubeDaemonSetRolloutStuck
        annotations:
          description: "DaemonSet {{ $labels.namespace }}/{{ $labels.daemonset }} has not finished or progressed for at least 15m on cluster {{ $labels.cluster }}."
          runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/kubernetes/kubedaemonsetrolloutstuck"
          summary: "DaemonSet rollout is stuck."
        expr: |
          (
            (
              kube_daemonset_status_current_number_scheduled{job="kube-state-metrics", namespace=~".*"}
                !=
              kube_daemonset_status_desired_number_scheduled{job="kube-state-metrics", namespace=~".*"}
            ) or (
              kube_daemonset_status_number_misscheduled{job="kube-state-metrics", namespace=~".*"}
                !=
              0
            ) or (
              kube_daemonset_status_updated_number_scheduled{job="kube-state-metrics", namespace=~".*"}
                !=
              kube_daemonset_status_desired_number_scheduled{job="kube-state-metrics", namespace=~".*"}
            ) or (
              kube_daemonset_status_number_available{job="kube-state-metrics", namespace=~".*"}
                !=
              kube_daemonset_status_desired_number_scheduled{job="kube-state-metrics", namespace=~".*"}
            )
          ) and (
            changes(kube_daemonset_status_updated_number_scheduled{job="kube-state-metrics", namespace=~".*"}[5m])
              ==
            0
          )
        for: 15m
        labels:
          severity: warning
      - alert: KubeContainerWaiting
        annotations:
          description: "pod/{{ $labels.pod }} in namespace {{ $labels.namespace }} on container {{ $labels.container}} has been in waiting state for longer than 1 hour. (reason: \"{{ $labels.reason }}\") on cluster {{ $labels.cluster }}."
          runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/kubernetes/kubecontainerwaiting"
          summary: "Pod container waiting longer than 1 hour"
        expr: "kube_pod_container_status_waiting_reason{reason!=\"CrashLoopBackOff\", job=\"kube-state-metrics\", namespace=~\".*\"} > 0"
        for: 1h
        labels:
          severity: warning
      - alert: KubeDaemonSetNotScheduled
        annotations:
          description: "{{ $value }} Pods of DaemonSet {{ $labels.namespace }}/{{ $labels.daemonset }} are not scheduled on cluster {{ $labels.cluster }}."
          runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/kubernetes/kubedaemonsetnotscheduled"
          summary: "DaemonSet pods are not scheduled."
        expr: |
          kube_daemonset_status_desired_number_scheduled{job="kube-state-metrics", namespace=~".*"}
            -
          kube_daemonset_status_current_number_scheduled{job="kube-state-metrics", namespace=~".*"} > 0
        for: 10m
        labels:
          severity: warning
      - alert: KubeDaemonSetMisScheduled
        annotations:
          description: "{{ $value }} Pods of DaemonSet {{ $labels.namespace }}/{{ $labels.daemonset }} are running where they are not supposed to run on cluster {{ $labels.cluster }}."
          runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/kubernetes/kubedaemonsetmisscheduled"
          summary: "DaemonSet pods are misscheduled."
        expr: "kube_daemonset_status_number_misscheduled{job=\"kube-state-metrics\", namespace=~\".*\"} > 0"
        for: 15m
        labels:
          severity: warning
      - alert: KubeJobNotCompleted
        annotations:
          description: "Job {{ $labels.namespace }}/{{ $labels.job_name }} is taking more than {{ \"43200\" | humanizeDuration }} to complete on cluster {{ $labels.cluster }}."
          runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/kubernetes/kubejobnotcompleted"
          summary: "Job did not complete in time"
        expr: |
          time() - max by (namespace, job_name, cluster) (kube_job_status_start_time{job="kube-state-metrics", namespace=~".*"}
            and
          kube_job_status_active{job="kube-state-metrics", namespace=~".*"} > 0) > 43200
        labels:
          severity: warning
      - alert: KubeJobFailed
        annotations:
          description: "Job {{ $labels.namespace }}/{{ $labels.job_name }} failed to complete. Removing failed job after investigation should clear this alert on cluster {{ $labels.cluster }}."
          runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/kubernetes/kubejobfailed"
          summary: "Job failed to complete."
        expr: "kube_job_failed{job=\"kube-state-metrics\", namespace=~\".*\"}  > 0"
        for: 15m
        labels:
          severity: warning
      - alert: KubeHpaReplicasMismatch
        annotations:
          description: "HPA {{ $labels.namespace }}/{{ $labels.horizontalpodautoscaler  }} has not matched the desired number of replicas for longer than 15 minutes on cluster {{ $labels.cluster }}."
          runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/kubernetes/kubehpareplicasmismatch"
          summary: "HPA has not matched desired number of replicas."
        expr: |
          (kube_horizontalpodautoscaler_status_desired_replicas{job="kube-state-metrics", namespace=~".*"}
            !=
          kube_horizontalpodautoscaler_status_current_replicas{job="kube-state-metrics", namespace=~".*"})
            and
          (kube_horizontalpodautoscaler_status_current_replicas{job="kube-state-metrics", namespace=~".*"}
            >
          kube_horizontalpodautoscaler_spec_min_replicas{job="kube-state-metrics", namespace=~".*"})
            and
          (kube_horizontalpodautoscaler_status_current_replicas{job="kube-state-metrics", namespace=~".*"}
            <
          kube_horizontalpodautoscaler_spec_max_replicas{job="kube-state-metrics", namespace=~".*"})
            and
          changes(kube_horizontalpodautoscaler_status_current_replicas{job="kube-state-metrics", namespace=~".*"}[15m]) == 0
        for: 15m
        labels:
          severity: warning
      - alert: KubeHpaMaxedOut
        annotations:
          description: "HPA {{ $labels.namespace }}/{{ $labels.horizontalpodautoscaler  }} has been running at max replicas for longer than 15 minutes on cluster {{ $labels.cluster }}."
          runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/kubernetes/kubehpamaxedout"
          summary: "HPA is running at max replicas"
        expr: |
          (
            kube_horizontalpodautoscaler_status_current_replicas{job="kube-state-metrics", namespace=~".*"}
              ==
            kube_horizontalpodautoscaler_spec_max_replicas{job="kube-state-metrics", namespace=~".*"}
          )
          and on (namespace, horizontalpodautoscaler, cluster) (
            kube_horizontalpodautoscaler_spec_max_replicas{job="kube-state-metrics", namespace=~".*"}
              !=
            kube_horizontalpodautoscaler_spec_min_replicas{job="kube-state-metrics", namespace=~".*"}
          )
        for: 15m
        labels:
          severity: warning
      - alert: KubePdbNotEnoughHealthyPods
        annotations:
          description: "PDB {{ $labels.cluster }}/{{ $labels.namespace }}/{{ $labels.poddisruptionbudget }} expects {{ $value }} more healthy pods. The desired number of healthy pods has not been met for at least 15m."
          runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/kubernetes/kubepdbnotenoughhealthypods"
          summary: "PDB does not have enough healthy pods."
        expr: |
          (
            kube_poddisruptionbudget_status_desired_healthy{job="kube-state-metrics", namespace=~".*"}
            -
            kube_poddisruptionbudget_status_current_healthy{job="kube-state-metrics", namespace=~".*"}
          )
          > 0
        for: 15m
        labels:
          severity: warning
  


(root level)
+ one document added:
  apiVersion: monitoring.coreos.com/v1
  kind: PrometheusRule
  metadata:
    name: kube-prometheus-stack-kubernetes-resources
    namespace: monitoring
    labels:
      app: kube-prometheus-stack
      app.kubernetes.io/instance: kube-prometheus-stack
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/part-of: kube-prometheus-stack
      helm.toolkit.fluxcd.io/name: kube-prometheus-stack
      helm.toolkit.fluxcd.io/namespace: flux-system
      heritage: Helm
      release: kube-prometheus-stack
  spec:
    groups:
    - name: kubernetes-resources
      rules:
      - alert: KubeCPUOvercommit
        annotations:
          description: "Cluster {{ $labels.cluster }} has overcommitted CPU resource requests for Pods by {{ printf \"%.2f\" $value }} CPU shares and cannot tolerate node failure."
          runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/kubernetes/kubecpuovercommit"
          summary: "Cluster has overcommitted CPU resource requests."
        expr: |
          # Non-HA clusters.
          (
            (
              sum by (cluster) (namespace_cpu:kube_pod_container_resource_requests:sum{})
              -
              sum by (cluster) (kube_node_status_allocatable{job="kube-state-metrics",resource="cpu"}) > 0
            )
            and
            count by (cluster) (max by (cluster, node) (kube_node_role{job="kube-state-metrics", role="control-plane"})) < 3
          )
          or
          # HA clusters.
          (
            sum by (cluster) (namespace_cpu:kube_pod_container_resource_requests:sum{})
            -
            (
              # Skip clusters with only one allocatable node.
              (
                sum by (cluster) (kube_node_status_allocatable{job="kube-state-metrics",resource="cpu"})
                -
                max by (cluster) (kube_node_status_allocatable{job="kube-state-metrics",resource="cpu"})
              ) > 0
            ) > 0
          )
        for: 10m
        labels:
          severity: warning
      - alert: KubeMemoryOvercommit
        annotations:
          description: "Cluster {{ $labels.cluster }} has overcommitted memory resource requests for Pods by {{ $value | humanize }} bytes and cannot tolerate node failure."
          runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/kubernetes/kubememoryovercommit"
          summary: "Cluster has overcommitted memory resource requests."
        expr: |
          # Non-HA clusters.
          (
            (
              sum by (cluster) (namespace_memory:kube_pod_container_resource_requests:sum{})
              -
              sum by (cluster) (kube_node_status_allocatable{job="kube-state-metrics",resource="memory"}) > 0
            )
            and
            count by (cluster) (max by (cluster, node) (kube_node_role{job="kube-state-metrics", role="control-plane"})) < 3
          )
          or
          # HA clusters.
          (
            sum by (cluster) (namespace_memory:kube_pod_container_resource_requests:sum{})
            -
            (
              # Skip clusters with only one allocatable node.
              (
                sum by (cluster) (kube_node_status_allocatable{job="kube-state-metrics",resource="memory"})
                -
                max by (cluster) (kube_node_status_allocatable{job="kube-state-metrics",resource="memory"})
              ) > 0
            ) > 0
          )
        for: 10m
        labels:
          severity: warning
      - alert: KubeCPUQuotaOvercommit
        annotations:
          description: "Cluster {{ $labels.cluster }} has overcommitted CPU resource requests for Namespaces."
          runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/kubernetes/kubecpuquotaovercommit"
          summary: "Cluster has overcommitted CPU resource requests."
        expr: |
          sum by (cluster) (
            min without(resource) (kube_resourcequota{job="kube-state-metrics", type="hard", resource=~"(cpu|requests.cpu)"})
          )
          /
          sum by (cluster) (
            kube_node_status_allocatable{resource="cpu", job="kube-state-metrics"}
          ) > 1.5
        for: 5m
        labels:
          severity: warning
      - alert: KubeMemoryQuotaOvercommit
        annotations:
          description: "Cluster {{ $labels.cluster }} has overcommitted memory resource requests for Namespaces."
          runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/kubernetes/kubememoryquotaovercommit"
          summary: "Cluster has overcommitted memory resource requests."
        expr: |
          sum by (cluster) (
            min without(resource) (kube_resourcequota{job="kube-state-metrics", type="hard", resource=~"(memory|requests.memory)"})
          )
          /
          sum by (cluster) (
            kube_node_status_allocatable{resource="memory", job="kube-state-metrics"}
          ) > 1.5
        for: 5m
        labels:
          severity: warning
      - alert: KubeQuotaAlmostFull
        annotations:
          description: "Namespace {{ $labels.namespace }} is using {{ $value | humanizePercentage }} of its {{ $labels.resource }} quota on cluster {{ $labels.cluster }}."
          runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/kubernetes/kubequotaalmostfull"
          summary: "Namespace quota is going to be full."
        expr: |
          topk by (cluster, namespace, resource, resourcequota) (1,
            max without (instance, job, type) (
              kube_resourcequota{job="kube-state-metrics", type="used"}
            )
          )
          / on (cluster, namespace, resource, resourcequota) group_left()
          topk by (cluster, namespace, resource, resourcequota) (1,
            max without (instance, job, type) (
              kube_resourcequota{job="kube-state-metrics", type="hard"}
            ) > 0
          )
          > 0.9 < 1
        for: 15m
        labels:
          severity: info
      - alert: KubeQuotaFullyUsed
        annotations:
          description: "Namespace {{ $labels.namespace }} is using {{ $value | humanizePercentage }} of its {{ $labels.resource }} quota on cluster {{ $labels.cluster }}."
          runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/kubernetes/kubequotafullyused"
          summary: "Namespace quota is fully used."
        expr: |
          topk by (cluster, namespace, resource, resourcequota) (1,
            max without (instance, job, type) (
              kube_resourcequota{job="kube-state-metrics", type="used"}
            )
          )
          / on (cluster, namespace, resource, resourcequota) group_left()
          topk by (cluster, namespace, resource, resourcequota) (1,
            max without (instance, job, type) (
              kube_resourcequota{job="kube-state-metrics", type="hard"}
            ) > 0
          )
          == 1
        for: 15m
        labels:
          severity: info
      - alert: KubeQuotaExceeded
        annotations:
          description: "Namespace {{ $labels.namespace }} is using {{ $value | humanizePercentage }} of its {{ $labels.resource }} quota on cluster {{ $labels.cluster }}."
          runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/kubernetes/kubequotaexceeded"
          summary: "Namespace quota has exceeded the limits."
        expr: |
          topk by (cluster, namespace, resource, resourcequota) (1,
            max without (instance, job, type) (
              kube_resourcequota{job="kube-state-metrics", type="used"}
            )
          )
          / on (cluster, namespace, resource, resourcequota) group_left()
          topk by (cluster, namespace, resource, resourcequota) (1,
            max without (instance, job, type) (
              kube_resourcequota{job="kube-state-metrics", type="hard"}
            ) > 0
          ) > 1
        for: 15m
        labels:
          severity: warning
      - alert: CPUThrottlingHigh
        annotations:
          description: "{{ $value | humanizePercentage }} throttling of CPU in namespace {{ $labels.namespace }} for container {{ $labels.container }} in pod {{ $labels.pod }} on cluster {{ $labels.cluster }}."
          runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/kubernetes/cputhrottlinghigh"
          summary: "Processes experience elevated CPU throttling."
        expr: |
          sum without (id, metrics_path, name, image, endpoint, job, node) (
            topk by (cluster, namespace, pod, container, instance) (1,
              increase(
                container_cpu_cfs_throttled_periods_total{container!="", job="kubelet", metrics_path="/metrics/cadvisor", }
              [5m])
            )
          )
          / on (cluster, namespace, pod, container, instance) group_left
          sum without (id, metrics_path, name, image, endpoint, job, node) (
            topk by (cluster, namespace, pod, container, instance) (1,
              increase(
                container_cpu_cfs_periods_total{job="kubelet", metrics_path="/metrics/cadvisor", }
              [5m])
            )
          )
          > ( 25 / 100 )
        for: 15m
        labels:
          severity: info
  


(root level)
+ one document added:
  apiVersion: monitoring.coreos.com/v1
  kind: PrometheusRule
  metadata:
    name: kube-prometheus-stack-kubernetes-storage
    namespace: monitoring
    labels:
      app: kube-prometheus-stack
      app.kubernetes.io/instance: kube-prometheus-stack
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/part-of: kube-prometheus-stack
      helm.toolkit.fluxcd.io/name: kube-prometheus-stack
      helm.toolkit.fluxcd.io/namespace: flux-system
      heritage: Helm
      release: kube-prometheus-stack
  spec:
    groups:
    - name: kubernetes-storage
      rules:
      - alert: KubePersistentVolumeFillingUp
        annotations:
          description: "The PersistentVolume claimed by {{ $labels.persistentvolumeclaim }} in Namespace {{ $labels.namespace }} {{ with $labels.cluster -}} on Cluster {{ . }} {{- end }} is only {{ $value | humanizePercentage }} free."
          runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/kubernetes/kubepersistentvolumefillingup"
          summary: "PersistentVolume is filling up."
        expr: |
          (
            kubelet_volume_stats_available_bytes{job="kubelet", namespace=~".*", metrics_path="/metrics"}
              /
            kubelet_volume_stats_capacity_bytes{job="kubelet", namespace=~".*", metrics_path="/metrics"}
          ) < 0.03
          and
          kubelet_volume_stats_used_bytes{job="kubelet", namespace=~".*", metrics_path="/metrics"} > 0
          unless on (cluster, namespace, persistentvolumeclaim)
          kube_persistentvolumeclaim_access_mode{ access_mode="ReadOnlyMany"} == 1
          unless on (cluster, namespace, persistentvolumeclaim)
          kube_persistentvolumeclaim_labels{label_excluded_from_alerts="true"} == 1
        for: 1m
        labels:
          severity: critical
      - alert: KubePersistentVolumeFillingUp
        annotations:
          description: "Based on recent sampling, the PersistentVolume claimed by {{ $labels.persistentvolumeclaim }} in Namespace {{ $labels.namespace }} {{ with $labels.cluster -}} on Cluster {{ . }} {{- end }} is expected to fill up within four days. Currently {{ $value | humanizePercentage }} is available."
          runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/kubernetes/kubepersistentvolumefillingup"
          summary: "PersistentVolume is filling up."
        expr: |
          (
            kubelet_volume_stats_available_bytes{job="kubelet", namespace=~".*", metrics_path="/metrics"}
              /
            kubelet_volume_stats_capacity_bytes{job="kubelet", namespace=~".*", metrics_path="/metrics"}
          ) < 0.15
          and
          kubelet_volume_stats_used_bytes{job="kubelet", namespace=~".*", metrics_path="/metrics"} > 0
          and
          predict_linear(kubelet_volume_stats_available_bytes{job="kubelet", namespace=~".*", metrics_path="/metrics"}[6h], 4 * 24 * 3600) < 0
          unless on (cluster, namespace, persistentvolumeclaim)
          kube_persistentvolumeclaim_access_mode{ access_mode="ReadOnlyMany"} == 1
          unless on (cluster, namespace, persistentvolumeclaim)
          kube_persistentvolumeclaim_labels{label_excluded_from_alerts="true"} == 1
        for: 1h
        labels:
          severity: warning
      - alert: KubePersistentVolumeInodesFillingUp
        annotations:
          description: "The PersistentVolume claimed by {{ $labels.persistentvolumeclaim }} in Namespace {{ $labels.namespace }} {{ with $labels.cluster -}} on Cluster {{ . }} {{- end }} only has {{ $value | humanizePercentage }} free inodes."
          runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/kubernetes/kubepersistentvolumeinodesfillingup"
          summary: "PersistentVolumeInodes are filling up."
        expr: |
          (
            kubelet_volume_stats_inodes_free{job="kubelet", namespace=~".*", metrics_path="/metrics"}
              /
            kubelet_volume_stats_inodes{job="kubelet", namespace=~".*", metrics_path="/metrics"}
          ) < 0.03
          and
          kubelet_volume_stats_inodes_used{job="kubelet", namespace=~".*", metrics_path="/metrics"} > 0
          unless on (cluster, namespace, persistentvolumeclaim)
          kube_persistentvolumeclaim_access_mode{ access_mode="ReadOnlyMany"} == 1
          unless on (cluster, namespace, persistentvolumeclaim)
          kube_persistentvolumeclaim_labels{label_excluded_from_alerts="true"} == 1
        for: 1m
        labels:
          severity: critical
      - alert: KubePersistentVolumeInodesFillingUp
        annotations:
          description: "Based on recent sampling, the PersistentVolume claimed by {{ $labels.persistentvolumeclaim }} in Namespace {{ $labels.namespace }} {{ with $labels.cluster -}} on Cluster {{ . }} {{- end }} is expected to run out of inodes within four days. Currently {{ $value | humanizePercentage }} of its inodes are free."
          runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/kubernetes/kubepersistentvolumeinodesfillingup"
          summary: "PersistentVolumeInodes are filling up."
        expr: |
          (
            kubelet_volume_stats_inodes_free{job="kubelet", namespace=~".*", metrics_path="/metrics"}
              /
            kubelet_volume_stats_inodes{job="kubelet", namespace=~".*", metrics_path="/metrics"}
          ) < 0.15
          and
          kubelet_volume_stats_inodes_used{job="kubelet", namespace=~".*", metrics_path="/metrics"} > 0
          and
          predict_linear(kubelet_volume_stats_inodes_free{job="kubelet", namespace=~".*", metrics_path="/metrics"}[6h], 4 * 24 * 3600) < 0
          unless on (cluster, namespace, persistentvolumeclaim)
          kube_persistentvolumeclaim_access_mode{ access_mode="ReadOnlyMany"} == 1
          unless on (cluster, namespace, persistentvolumeclaim)
          kube_persistentvolumeclaim_labels{label_excluded_from_alerts="true"} == 1
        for: 1h
        labels:
          severity: warning
      - alert: KubePersistentVolumeErrors
        annotations:
          description: "The persistent volume {{ $labels.persistentvolume }} {{ with $labels.cluster -}} on Cluster {{ . }} {{- end }} has status {{ $labels.phase }}."
          runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/kubernetes/kubepersistentvolumeerrors"
          summary: "PersistentVolume is having issues with provisioning."
        expr: "kube_persistentvolume_status_phase{phase=~\"Failed|Pending\",job=\"kube-state-metrics\"} > 0"
        for: 5m
        labels:
          severity: critical
  


(root level)
+ one document added:
  apiVersion: monitoring.coreos.com/v1
  kind: PrometheusRule
  metadata:
    name: kube-prometheus-stack-kubernetes-system-apiserver
    namespace: monitoring
    labels:
      app: kube-prometheus-stack
      app.kubernetes.io/instance: kube-prometheus-stack
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/part-of: kube-prometheus-stack
      helm.toolkit.fluxcd.io/name: kube-prometheus-stack
      helm.toolkit.fluxcd.io/namespace: flux-system
      heritage: Helm
      release: kube-prometheus-stack
  spec:
    groups:
    - name: kubernetes-system-apiserver
      rules:
      - alert: KubeClientCertificateExpiration
        annotations:
          description: "A client certificate used to authenticate to kubernetes apiserver is expiring in less than 7.0 days on cluster {{ $labels.cluster }}."
          runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/kubernetes/kubeclientcertificateexpiration"
          summary: "Client certificate is about to expire."
        expr: |
          histogram_quantile(0.01, sum without (namespace, service, endpoint) (rate(apiserver_client_certificate_expiration_seconds_bucket{job="apiserver"}[5m]))) < 604800
          and
          on (job, cluster, instance) apiserver_client_certificate_expiration_seconds_count{job="apiserver"} > 0
        for: 5m
        labels:
          severity: warning
      - alert: KubeClientCertificateExpiration
        annotations:
          description: "A client certificate used to authenticate to kubernetes apiserver is expiring in less than 24.0 hours on cluster {{ $labels.cluster }}."
          runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/kubernetes/kubeclientcertificateexpiration"
          summary: "Client certificate is about to expire."
        expr: |
          histogram_quantile(0.01, sum without (namespace, service, endpoint) (rate(apiserver_client_certificate_expiration_seconds_bucket{job="apiserver"}[5m]))) < 86400
          and
          on (job, cluster, instance) apiserver_client_certificate_expiration_seconds_count{job="apiserver"} > 0
        for: 5m
        labels:
          severity: critical
      - alert: KubeAggregatedAPIErrors
        annotations:
          description: "Kubernetes aggregated API {{ $labels.instance }}/{{ $labels.name }} has reported {{ $labels.reason }} errors on cluster {{ $labels.cluster }}."
          runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/kubernetes/kubeaggregatedapierrors"
          summary: "Kubernetes aggregated API has reported errors."
        expr: "sum by (cluster, instance, name, reason)(increase(aggregator_unavailable_apiservice_total{job=\"apiserver\"}[1m])) > 0"
        for: 10m
        labels:
          severity: warning
      - alert: KubeAggregatedAPIDown
        annotations:
          description: "Kubernetes aggregated API {{ $labels.name }}/{{ $labels.namespace }} has been only {{ $value | humanize }}% available over the last 10m on cluster {{ $labels.cluster }}."
          runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/kubernetes/kubeaggregatedapidown"
          summary: "Kubernetes aggregated API is down."
        expr: "(1 - max by (name, namespace, cluster)(avg_over_time(aggregator_unavailable_apiservice{job=\"apiserver\"}[10m]))) * 100 < 85"
        for: 5m
        labels:
          severity: warning
      - alert: KubeAPIDown
        annotations:
          description: "KubeAPI has disappeared from Prometheus target discovery."
          runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/kubernetes/kubeapidown"
          summary: "Target disappeared from Prometheus target discovery."
        expr: absent(up{job="apiserver"})
        for: 15m
        labels:
          severity: critical
      - alert: KubeAPIInstanceUnreachable
        annotations:
          description: "A KubeAPI instance has been unreachable for more than 15 minutes."
          runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/kubernetes/kubeapiinstanceunreachable"
          summary: "KubeAPI instance is unreachable."
        expr: "up{job=\"apiserver\"} == 0"
        for: 15m
        labels:
          severity: warning
      - alert: KubeAPITerminatedRequests
        annotations:
          description: "The kubernetes apiserver has terminated {{ $value | humanizePercentage }} of its incoming requests on cluster {{ $labels.cluster }}."
          runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/kubernetes/kubeapiterminatedrequests"
          summary: "The kubernetes apiserver has terminated {{ $value | humanizePercentage }} of its incoming requests."
        expr: "sum by (cluster) (rate(apiserver_request_terminations_total{job=\"apiserver\"}[10m])) / ( sum by (cluster) (rate(apiserver_request_total{job=\"apiserver\"}[10m])) + sum by (cluster) (rate(apiserver_request_terminations_total{job=\"apiserver\"}[10m])) ) > 0.20"
        for: 5m
        labels:
          severity: warning
  


(root level)
+ one document added:
  apiVersion: monitoring.coreos.com/v1
  kind: PrometheusRule
  metadata:
    name: kube-prometheus-stack-kubernetes-system-controller-manager
    namespace: monitoring
    labels:
      app: kube-prometheus-stack
      app.kubernetes.io/instance: kube-prometheus-stack
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/part-of: kube-prometheus-stack
      helm.toolkit.fluxcd.io/name: kube-prometheus-stack
      helm.toolkit.fluxcd.io/namespace: flux-system
      heritage: Helm
      release: kube-prometheus-stack
  spec:
    groups:
    - name: kubernetes-system-controller-manager
      rules:
      - alert: KubeControllerManagerDown
        annotations:
          description: "KubeControllerManager has disappeared from Prometheus target discovery."
          runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/kubernetes/kubecontrollermanagerdown"
          summary: "Target disappeared from Prometheus target discovery."
        expr: absent(up{job="kube-controller-manager"})
        for: 15m
        labels:
          severity: critical
      - alert: KubeControllerManagerInstanceUnreachable
        annotations:
          description: "A KubeControllerManager instance has been unreachable for more than 15 minutes."
          runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/kubernetes/kubecontrollermanagerinstanceunreachable"
          summary: "KubeControllerManager instance is unreachable."
        expr: "up{job=\"kube-controller-manager\"} == 0"
        for: 15m
        labels:
          severity: warning
  


(root level)
+ one document added:
  apiVersion: monitoring.coreos.com/v1
  kind: PrometheusRule
  metadata:
    name: kube-prometheus-stack-kubernetes-system-kubelet
    namespace: monitoring
    labels:
      app: kube-prometheus-stack
      app.kubernetes.io/instance: kube-prometheus-stack
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/part-of: kube-prometheus-stack
      helm.toolkit.fluxcd.io/name: kube-prometheus-stack
      helm.toolkit.fluxcd.io/namespace: flux-system
      heritage: Helm
      release: kube-prometheus-stack
  spec:
    groups:
    - name: kubernetes-system-kubelet
      rules:
      - alert: KubeNodeNotReady
        annotations:
          description: "{{ $labels.node }} has been unready for more than 15 minutes on cluster {{ $labels.cluster }}."
          runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/kubernetes/kubenodenotready"
          summary: "Node is not ready."
        expr: |
          kube_node_status_condition{job="kube-state-metrics",condition="Ready",status="true"} == 0
          and on (cluster, node)
          kube_node_spec_unschedulable{job="kube-state-metrics"} == 0
        for: 15m
        labels:
          severity: warning
      - alert: KubeNodePressure
        annotations:
          description: "{{ $labels.node }} on cluster {{ $labels.cluster }} has active Condition {{ $labels.condition }}. This is caused by resource usage exceeding eviction thresholds."
          runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/kubernetes/kubenodepressure"
          summary: "Node has as active Condition."
        expr: |
          kube_node_status_condition{job="kube-state-metrics",condition=~"(MemoryPressure|DiskPressure|PIDPressure)",status="true"} == 1
          and on (cluster, node)
          kube_node_spec_unschedulable{job="kube-state-metrics"} == 0
        for: 10m
        labels:
          severity: info
      - alert: KubeNodeUnreachable
        annotations:
          description: "{{ $labels.node }} is unreachable and some workloads may be rescheduled on cluster {{ $labels.cluster }}."
          runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/kubernetes/kubenodeunreachable"
          summary: "Node is unreachable."
        expr: "(kube_node_spec_taint{job=\"kube-state-metrics\",key=\"node.kubernetes.io/unreachable\",effect=\"NoSchedule\"} unless ignoring(key,value) kube_node_spec_taint{job=\"kube-state-metrics\",key=~\"ToBeDeletedByClusterAutoscaler|cloud.google.com/impending-node-termination|aws-node-termination-handler/spot-itn\"}) == 1"
        for: 15m
        labels:
          severity: warning
      - alert: KubeletTooManyPods
        annotations:
          description: "Kubelet '{{ $labels.node }}' is running at {{ $value | humanizePercentage }} of its Pod capacity on cluster {{ $labels.cluster }}."
          runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/kubernetes/kubelettoomanypods"
          summary: "Kubelet is running at capacity."
        expr: |
          (
            max by (cluster, instance) (
              kubelet_running_pods{job="kubelet", metrics_path="/metrics"} > 1
            )
            * on (cluster, instance) group_left(node)
            max by (cluster, instance, node) (
              kubelet_node_name{job="kubelet", metrics_path="/metrics"}
            )
          )
          / on (cluster, node) group_left()
          max by (cluster, node) (
            kube_node_status_capacity{job="kube-state-metrics", resource="pods"} != 1
          ) > 0.95
        for: 15m
        labels:
          severity: info
      - alert: KubeNodeReadinessFlapping
        annotations:
          description: "The readiness status of node {{ $labels.node }} has changed {{ $value }} times in the last 15 minutes on cluster {{ $labels.cluster }}."
          runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/kubernetes/kubenodereadinessflapping"
          summary: "Node readiness status is flapping."
        expr: |
          sum(changes(kube_node_status_condition{job="kube-state-metrics",status="true",condition="Ready"}[15m])) by (cluster, node) > 2
          and on (cluster, node)
          kube_node_spec_unschedulable{job="kube-state-metrics"} == 0
        for: 15m
        labels:
          severity: warning
      - alert: KubeNodeEviction
        annotations:
          description: "Node {{ $labels.node }} on {{ $labels.cluster }} is evicting Pods due to {{ $labels.eviction_signal }}.  Eviction occurs when eviction thresholds are crossed, typically caused by Pods exceeding RAM/ephemeral-storage limits."
          runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/kubernetes/kubenodeeviction"
          summary: "Node is evicting pods."
        expr: |
          sum(rate(kubelet_evictions{job="kubelet", metrics_path="/metrics"}[15m])) by (cluster, eviction_signal, instance)
          * on (cluster, instance) group_left(node)
          max by (cluster, instance, node) (
            kubelet_node_name{job="kubelet", metrics_path="/metrics"}
          )
          > 0
        for: 0s
        labels:
          severity: info
      - alert: KubeletPlegDurationHigh
        annotations:
          description: "The Kubelet Pod Lifecycle Event Generator has a 99th percentile duration of {{ $value }} seconds on node {{ $labels.node }} on cluster {{ $labels.cluster }}."
          runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/kubernetes/kubeletplegdurationhigh"
          summary: "Kubelet Pod Lifecycle Event Generator is taking too long to relist."
        expr: "node_quantile:kubelet_pleg_relist_duration_seconds:histogram_quantile{quantile=\"0.99\"} >= 10"
        for: 5m
        labels:
          severity: warning
      - alert: KubeletPodStartUpLatencyHigh
        annotations:
          description: "Kubelet Pod startup 99th percentile latency is {{ $value }} seconds on node {{ $labels.node }} on cluster {{ $labels.cluster }}."
          runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/kubernetes/kubeletpodstartuplatencyhigh"
          summary: "Kubelet Pod startup latency is too high."
        expr: |
          histogram_quantile(0.99,
            sum by (cluster, instance, le) (
              topk by (cluster, instance, le, operation_type) (1,
                rate(kubelet_pod_worker_duration_seconds_bucket{job="kubelet", metrics_path="/metrics"}[5m])
              )
            )
          )
          * on (cluster, instance) group_left(node)
          topk by (cluster, instance, node) (1,
            kubelet_node_name{job="kubelet", metrics_path="/metrics"}
          )
          > 60
        for: 15m
        labels:
          severity: warning
      - alert: KubeletClientCertificateExpiration
        annotations:
          description: "Client certificate for Kubelet on node {{ $labels.node }} expires in {{ $value | humanizeDuration }} on cluster {{ $labels.cluster }}."
          runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/kubernetes/kubeletclientcertificateexpiration"
          summary: "Kubelet client certificate is about to expire."
        expr: "kubelet_certificate_manager_client_ttl_seconds < 604800"
        labels:
          severity: warning
      - alert: KubeletClientCertificateExpiration
        annotations:
          description: "Client certificate for Kubelet on node {{ $labels.node }} expires in {{ $value | humanizeDuration }} on cluster {{ $labels.cluster }}."
          runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/kubernetes/kubeletclientcertificateexpiration"
          summary: "Kubelet client certificate is about to expire."
        expr: "kubelet_certificate_manager_client_ttl_seconds < 86400"
        labels:
          severity: critical
      - alert: KubeletServerCertificateExpiration
        annotations:
          description: "Server certificate for Kubelet on node {{ $labels.node }} expires in {{ $value | humanizeDuration }} on cluster {{ $labels.cluster }}."
          runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/kubernetes/kubeletservercertificateexpiration"
          summary: "Kubelet server certificate is about to expire."
        expr: "kubelet_certificate_manager_server_ttl_seconds < 604800"
        labels:
          severity: warning
      - alert: KubeletServerCertificateExpiration
        annotations:
          description: "Server certificate for Kubelet on node {{ $labels.node }} expires in {{ $value | humanizeDuration }} on cluster {{ $labels.cluster }}."
          runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/kubernetes/kubeletservercertificateexpiration"
          summary: "Kubelet server certificate is about to expire."
        expr: "kubelet_certificate_manager_server_ttl_seconds < 86400"
        labels:
          severity: critical
      - alert: KubeletClientCertificateRenewalErrors
        annotations:
          description: "Kubelet on node {{ $labels.node }} has failed to renew its client certificate ({{ $value | humanize }} errors in the last 5 minutes) on cluster {{ $labels.cluster }}."
          runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/kubernetes/kubeletclientcertificaterenewalerrors"
          summary: "Kubelet has failed to renew its client certificate."
        expr: "increase(kubelet_certificate_manager_client_expiration_renew_errors[5m]) > 0"
        for: 15m
        labels:
          severity: warning
      - alert: KubeletServerCertificateRenewalErrors
        annotations:
          description: "Kubelet on node {{ $labels.node }} has failed to renew its server certificate ({{ $value | humanize }} errors in the last 5 minutes) on cluster {{ $labels.cluster }}."
          runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/kubernetes/kubeletservercertificaterenewalerrors"
          summary: "Kubelet has failed to renew its server certificate."
        expr: "increase(kubelet_server_expiration_renew_errors[5m]) > 0"
        for: 15m
        labels:
          severity: warning
      - alert: KubeletInstanceUnreachable
        annotations:
          description: "A Kubelet instance has been unreachable for more than 15 minutes."
          runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/kubernetes/kubeletinstanceunreachable"
          summary: "Kubelet instance is unreachable."
        expr: "up{job=\"kubelet\", metrics_path=\"/metrics\"} == 0"
        for: 15m
        labels:
          severity: warning
      - alert: KubeletDown
        annotations:
          description: "Kubelet has disappeared from Prometheus target discovery on cluster {{ $labels.cluster }}."
          runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/kubernetes/kubeletdown"
          summary: "Target disappeared from Prometheus target discovery."
        expr: |
          count by (cluster) (kube_node_info{job="kube-state-metrics"})
          unless on (cluster)
          count by (cluster) (up{job="kubelet", metrics_path="/metrics"} == 1)
        for: 15m
        labels:
          severity: critical
  


(root level)
+ one document added:
  apiVersion: monitoring.coreos.com/v1
  kind: PrometheusRule
  metadata:
    name: kube-prometheus-stack-kubernetes-system-scheduler
    namespace: monitoring
    labels:
      app: kube-prometheus-stack
      app.kubernetes.io/instance: kube-prometheus-stack
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/part-of: kube-prometheus-stack
      helm.toolkit.fluxcd.io/name: kube-prometheus-stack
      helm.toolkit.fluxcd.io/namespace: flux-system
      heritage: Helm
      release: kube-prometheus-stack
  spec:
    groups:
    - name: kubernetes-system-scheduler
      rules:
      - alert: KubeSchedulerDown
        annotations:
          description: "KubeScheduler has disappeared from Prometheus target discovery."
          runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/kubernetes/kubeschedulerdown"
          summary: "Target disappeared from Prometheus target discovery."
        expr: absent(up{job="kube-scheduler"})
        for: 15m
        labels:
          severity: critical
      - alert: KubeSchedulerInstanceUnreachable
        annotations:
          description: "A KubeScheduler instance has been unreachable for more than 15 minutes."
          runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/kubernetes/kubeschedulerinstanceunreachable"
          summary: "KubeScheduler instance is unreachable."
        expr: "up{job=\"kube-scheduler\"} == 0"
        for: 15m
        labels:
          severity: warning
  


(root level)
+ one document added:
  apiVersion: monitoring.coreos.com/v1
  kind: PrometheusRule
  metadata:
    name: kube-prometheus-stack-kubernetes-system
    namespace: monitoring
    labels:
      app: kube-prometheus-stack
      app.kubernetes.io/instance: kube-prometheus-stack
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/part-of: kube-prometheus-stack
      helm.toolkit.fluxcd.io/name: kube-prometheus-stack
      helm.toolkit.fluxcd.io/namespace: flux-system
      heritage: Helm
      release: kube-prometheus-stack
  spec:
    groups:
    - name: kubernetes-system
      rules:
      - alert: KubeVersionMismatch
        annotations:
          description: "There are {{ $value }} different semantic versions of Kubernetes components running on cluster {{ $labels.cluster }}."
          runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/kubernetes/kubeversionmismatch"
          summary: "Different semantic versions of Kubernetes components running."
        expr: "count by (cluster) (count by (git_version, cluster) (label_replace(kubernetes_build_info{job!~\"kube-dns|coredns\"},\"git_version\",\"$1\",\"git_version\",\"(v[0-9]*.[0-9]*).*\"))) > 1"
        for: 15m
        labels:
          severity: warning
      - alert: KubeClientErrors
        annotations:
          description: "Kubernetes API server client '{{ $labels.job }}/{{ $labels.instance }}' is experiencing {{ $value | humanizePercentage }} errors on cluster {{ $labels.cluster }}."
          runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/kubernetes/kubeclienterrors"
          summary: "Kubernetes API server client is experiencing errors."
        expr: |
          (sum(rate(rest_client_requests_total{job="apiserver",code=~"5.."}[5m])) by (cluster, instance, job, namespace)
            /
          sum(rate(rest_client_requests_total{job="apiserver"}[5m])) by (cluster, instance, job, namespace))
          > 0.01
        for: 15m
        labels:
          severity: warning
  


(root level)
+ one document added:
  apiVersion: monitoring.coreos.com/v1
  kind: PrometheusRule
  metadata:
    name: kube-prometheus-stack-node-exporter.rules
    namespace: monitoring
    labels:
      app: kube-prometheus-stack
      app.kubernetes.io/instance: kube-prometheus-stack
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/part-of: kube-prometheus-stack
      helm.toolkit.fluxcd.io/name: kube-prometheus-stack
      helm.toolkit.fluxcd.io/namespace: flux-system
      heritage: Helm
      release: kube-prometheus-stack
  spec:
    groups:
    - name: node-exporter.rules
      rules:
      - expr: |
          count without (cpu, mode) (
            node_cpu_seconds_total{job="node-exporter",mode="idle"}
          )
        record: "instance:node_num_cpu:sum"
      - expr: |
          1 - avg without (cpu) (
            sum without (mode) (rate(node_cpu_seconds_total{job="node-exporter", mode=~"idle|iowait|steal"}[5m]))
          )
        record: "instance:node_cpu_utilisation:rate5m"
      - expr: |
          (
            node_load1{job="node-exporter"}
          /
            instance:node_num_cpu:sum{job="node-exporter"}
          )
        record: "instance:node_load1_per_cpu:ratio"
      - expr: |
          1 - (
            (
              node_memory_MemAvailable_bytes{job="node-exporter"}
              or
              (
                node_memory_Buffers_bytes{job="node-exporter"}
                +
                node_memory_Cached_bytes{job="node-exporter"}
                +
                node_memory_MemFree_bytes{job="node-exporter"}
                +
                node_memory_Slab_bytes{job="node-exporter"}
              )
            )
          /
            node_memory_MemTotal_bytes{job="node-exporter"}
          )
        record: "instance:node_memory_utilisation:ratio"
      - expr: rate(node_vmstat_pgmajfault{job="node-exporter"}[5m])
        record: "instance:node_vmstat_pgmajfault:rate5m"
      - expr: "rate(node_disk_io_time_seconds_total{job=\"node-exporter\", device=~\"(/dev/)?(mmcblk.p.+|nvme.+|rbd.+|sd.+|vd.+|xvd.+|dm-.+|md.+|dasd.+)\"}[5m])"
        record: "instance_device:node_disk_io_time_seconds:rate5m"
      - expr: "rate(node_disk_io_time_weighted_seconds_total{job=\"node-exporter\", device=~\"(/dev/)?(mmcblk.p.+|nvme.+|rbd.+|sd.+|vd.+|xvd.+|dm-.+|md.+|dasd.+)\"}[5m])"
        record: "instance_device:node_disk_io_time_weighted_seconds:rate5m"
      - expr: |
          sum without (device) (
            rate(node_network_receive_bytes_total{job="node-exporter", device!="lo"}[5m])
          )
        record: "instance:node_network_receive_bytes_excluding_lo:rate5m"
      - expr: |
          sum without (device) (
            rate(node_network_transmit_bytes_total{job="node-exporter", device!="lo"}[5m])
          )
        record: "instance:node_network_transmit_bytes_excluding_lo:rate5m"
      - expr: |
          sum without (device) (
            rate(node_network_receive_drop_total{job="node-exporter", device!="lo"}[5m])
          )
        record: "instance:node_network_receive_drop_excluding_lo:rate5m"
      - expr: |
          sum without (device) (
            rate(node_network_transmit_drop_total{job="node-exporter", device!="lo"}[5m])
          )
        record: "instance:node_network_transmit_drop_excluding_lo:rate5m"
      - expr: |
          sum without (device) (
            rate(node_network_receive_bytes_total{job="node-exporter", device!~"lo|veth.+"}[5m])
          )
        record: "instance:node_network_receive_bytes_physical:rate5m"
      - expr: |
          sum without (device) (
            rate(node_network_transmit_bytes_total{job="node-exporter", device!~"lo|veth.+"}[5m])
          )
        record: "instance:node_network_transmit_bytes_physical:rate5m"
      - expr: |
          sum without (device) (
            rate(node_network_receive_drop_total{job="node-exporter", device!~"lo|veth.+"}[5m])
          )
        record: "instance:node_network_receive_drop_physical:rate5m"
      - expr: |
          sum without (device) (
            rate(node_network_transmit_drop_total{job="node-exporter", device!~"lo|veth.+"}[5m])
          )
        record: "instance:node_network_transmit_drop_physical:rate5m"
  


(root level)
+ one document added:
  apiVersion: monitoring.coreos.com/v1
  kind: PrometheusRule
  metadata:
    name: kube-prometheus-stack-node-exporter
    namespace: monitoring
    labels:
      app: kube-prometheus-stack
      app.kubernetes.io/instance: kube-prometheus-stack
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/part-of: kube-prometheus-stack
      helm.toolkit.fluxcd.io/name: kube-prometheus-stack
      helm.toolkit.fluxcd.io/namespace: flux-system
      heritage: Helm
      release: kube-prometheus-stack
  spec:
    groups:
    - name: node-exporter
      rules:
      - alert: NodeFilesystemSpaceFillingUp
        annotations:
          description: "Filesystem on {{ $labels.device }}, mounted on {{ $labels.mountpoint }}, at {{ $labels.instance }} has only {{ printf \"%.2f\" $value }}% available space left and is filling up."
          runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/node/nodefilesystemspacefillingup"
          summary: "Filesystem is predicted to run out of space within the next 24 hours."
        expr: |
          (
            node_filesystem_avail_bytes{job="node-exporter",fstype!="",mountpoint!=""} / node_filesystem_size_bytes{job="node-exporter",fstype!="",mountpoint!=""} * 100 < 15
          and
            predict_linear(node_filesystem_avail_bytes{job="node-exporter",fstype!="",mountpoint!=""}[6h], 24*60*60) < 0
          and
            node_filesystem_readonly{job="node-exporter",fstype!="",mountpoint!=""} == 0
          )
        for: 1h
        labels:
          severity: warning
      - alert: NodeFilesystemSpaceFillingUp
        annotations:
          description: "Filesystem on {{ $labels.device }}, mounted on {{ $labels.mountpoint }}, at {{ $labels.instance }} has only {{ printf \"%.2f\" $value }}% available space left and is filling up fast."
          runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/node/nodefilesystemspacefillingup"
          summary: "Filesystem is predicted to run out of space within the next 4 hours."
        expr: |
          (
            node_filesystem_avail_bytes{job="node-exporter",fstype!="",mountpoint!=""} / node_filesystem_size_bytes{job="node-exporter",fstype!="",mountpoint!=""} * 100 < 10
          and
            predict_linear(node_filesystem_avail_bytes{job="node-exporter",fstype!="",mountpoint!=""}[6h], 4*60*60) < 0
          and
            node_filesystem_readonly{job="node-exporter",fstype!="",mountpoint!=""} == 0
          )
        for: 1h
        labels:
          severity: critical
      - alert: NodeFilesystemAlmostOutOfSpace
        annotations:
          description: "Filesystem on {{ $labels.device }}, mounted on {{ $labels.mountpoint }}, at {{ $labels.instance }} has only {{ printf \"%.2f\" $value }}% available space left."
          runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/node/nodefilesystemalmostoutofspace"
          summary: "Filesystem has less than 5% space left."
        expr: |
          (
            node_filesystem_avail_bytes{job="node-exporter",fstype!="",mountpoint!=""} / node_filesystem_size_bytes{job="node-exporter",fstype!="",mountpoint!=""} * 100 < 5
          and
            node_filesystem_readonly{job="node-exporter",fstype!="",mountpoint!=""} == 0
          )
        for: 30m
        labels:
          severity: warning
      - alert: NodeFilesystemAlmostOutOfSpace
        annotations:
          description: "Filesystem on {{ $labels.device }}, mounted on {{ $labels.mountpoint }}, at {{ $labels.instance }} has only {{ printf \"%.2f\" $value }}% available space left."
          runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/node/nodefilesystemalmostoutofspace"
          summary: "Filesystem has less than 3% space left."
        expr: |
          (
            node_filesystem_avail_bytes{job="node-exporter",fstype!="",mountpoint!=""} / node_filesystem_size_bytes{job="node-exporter",fstype!="",mountpoint!=""} * 100 < 3
          and
            node_filesystem_readonly{job="node-exporter",fstype!="",mountpoint!=""} == 0
          )
        for: 30m
        labels:
          severity: critical
      - alert: NodeFilesystemFilesFillingUp
        annotations:
          description: "Filesystem on {{ $labels.device }}, mounted on {{ $labels.mountpoint }}, at {{ $labels.instance }} has only {{ printf \"%.2f\" $value }}% available inodes left and is filling up."
          runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/node/nodefilesystemfilesfillingup"
          summary: "Filesystem is predicted to run out of inodes within the next 24 hours."
        expr: |
          (
            node_filesystem_files_free{job="node-exporter",fstype!="",mountpoint!=""} / node_filesystem_files{job="node-exporter",fstype!="",mountpoint!=""} * 100 < 40
          and
            predict_linear(node_filesystem_files_free{job="node-exporter",fstype!="",mountpoint!=""}[6h], 24*60*60) < 0
          and
            node_filesystem_readonly{job="node-exporter",fstype!="",mountpoint!=""} == 0
          )
        for: 1h
        labels:
          severity: warning
      - alert: NodeFilesystemFilesFillingUp
        annotations:
          description: "Filesystem on {{ $labels.device }}, mounted on {{ $labels.mountpoint }}, at {{ $labels.instance }} has only {{ printf \"%.2f\" $value }}% available inodes left and is filling up fast."
          runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/node/nodefilesystemfilesfillingup"
          summary: "Filesystem is predicted to run out of inodes within the next 4 hours."
        expr: |
          (
            node_filesystem_files_free{job="node-exporter",fstype!="",mountpoint!=""} / node_filesystem_files{job="node-exporter",fstype!="",mountpoint!=""} * 100 < 20
          and
            predict_linear(node_filesystem_files_free{job="node-exporter",fstype!="",mountpoint!=""}[6h], 4*60*60) < 0
          and
            node_filesystem_readonly{job="node-exporter",fstype!="",mountpoint!=""} == 0
          )
        for: 1h
        labels:
          severity: critical
      - alert: NodeFilesystemAlmostOutOfFiles
        annotations:
          description: "Filesystem on {{ $labels.device }}, mounted on {{ $labels.mountpoint }}, at {{ $labels.instance }} has only {{ printf \"%.2f\" $value }}% available inodes left."
          runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/node/nodefilesystemalmostoutoffiles"
          summary: "Filesystem has less than 5% inodes left."
        expr: |
          (
            node_filesystem_files_free{job="node-exporter",fstype!="",mountpoint!=""} / node_filesystem_files{job="node-exporter",fstype!="",mountpoint!=""} * 100 < 5
          and
            node_filesystem_readonly{job="node-exporter",fstype!="",mountpoint!=""} == 0
          )
        for: 1h
        labels:
          severity: warning
      - alert: NodeFilesystemAlmostOutOfFiles
        annotations:
          description: "Filesystem on {{ $labels.device }}, mounted on {{ $labels.mountpoint }}, at {{ $labels.instance }} has only {{ printf \"%.2f\" $value }}% available inodes left."
          runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/node/nodefilesystemalmostoutoffiles"
          summary: "Filesystem has less than 3% inodes left."
        expr: |
          (
            node_filesystem_files_free{job="node-exporter",fstype!="",mountpoint!=""} / node_filesystem_files{job="node-exporter",fstype!="",mountpoint!=""} * 100 < 3
          and
            node_filesystem_readonly{job="node-exporter",fstype!="",mountpoint!=""} == 0
          )
        for: 1h
        labels:
          severity: critical
      - alert: NodeNetworkReceiveErrs
        annotations:
          description: "{{ $labels.instance }} interface {{ $labels.device }} has encountered {{ printf \"%.0f\" $value }} receive errors in the last two minutes."
          runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/node/nodenetworkreceiveerrs"
          summary: "Network interface is reporting many receive errors."
        expr: "rate(node_network_receive_errs_total{job=\"node-exporter\"}[2m]) / rate(node_network_receive_packets_total{job=\"node-exporter\"}[2m]) > 0.01"
        for: 1h
        labels:
          severity: warning
      - alert: NodeNetworkTransmitErrs
        annotations:
          description: "{{ $labels.instance }} interface {{ $labels.device }} has encountered {{ printf \"%.0f\" $value }} transmit errors in the last two minutes."
          runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/node/nodenetworktransmiterrs"
          summary: "Network interface is reporting many transmit errors."
        expr: "rate(node_network_transmit_errs_total{job=\"node-exporter\"}[2m]) / rate(node_network_transmit_packets_total{job=\"node-exporter\"}[2m]) > 0.01"
        for: 1h
        labels:
          severity: warning
      - alert: NodeHighNumberConntrackEntriesUsed
        annotations:
          description: "{{ $labels.instance }} {{ $value | humanizePercentage }} of conntrack entries are used."
          runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/node/nodehighnumberconntrackentriesused"
          summary: "Number of conntrack are getting close to the limit."
        expr: "(node_nf_conntrack_entries{job=\"node-exporter\"} / node_nf_conntrack_entries_limit) > 0.75"
        labels:
          severity: warning
      - alert: NodeTextFileCollectorScrapeError
        annotations:
          description: "Node Exporter text file collector on {{ $labels.instance }} failed to scrape."
          runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/node/nodetextfilecollectorscrapeerror"
          summary: "Node Exporter text file collector failed to scrape."
        expr: "node_textfile_scrape_error{job=\"node-exporter\"} == 1"
        labels:
          severity: warning
      - alert: NodeClockSkewDetected
        annotations:
          description: "Clock at {{ $labels.instance }} is out of sync by more than 0.05s. Ensure NTP is configured correctly on this host."
          runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/node/nodeclockskewdetected"
          summary: "Clock skew detected."
        expr: |
          (
            node_timex_offset_seconds{job="node-exporter"} > 0.05
          and
            deriv(node_timex_offset_seconds{job="node-exporter"}[5m]) >= 0
          )
          or
          (
            node_timex_offset_seconds{job="node-exporter"} < -0.05
          and
            deriv(node_timex_offset_seconds{job="node-exporter"}[5m]) <= 0
          )
        for: 10m
        labels:
          severity: warning
      - alert: NodeClockNotSynchronising
        annotations:
          description: "Clock at {{ $labels.instance }} is not synchronising. Ensure NTP is configured on this host."
          runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/node/nodeclocknotsynchronising"
          summary: "Clock not synchronising."
        expr: |
          min_over_time(node_timex_sync_status{job="node-exporter"}[5m]) == 0
          and
          node_timex_maxerror_seconds{job="node-exporter"} >= 16
        for: 10m
        labels:
          severity: warning
      - alert: NodeRAIDDegraded
        annotations:
          description: "RAID array '{{ $labels.device }}' at {{ $labels.instance }} is in degraded state due to one or more disks failures. Number of spare drives is insufficient to fix issue automatically."
          runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/node/noderaiddegraded"
          summary: "RAID Array is degraded."
        expr: "node_md_disks_required{job=\"node-exporter\",device=~\"(/dev/)?(mmcblk.p.+|nvme.+|rbd.+|sd.+|vd.+|xvd.+|dm-.+|md.+|dasd.+)\"} - ignoring (state) (node_md_disks{state=\"active\",job=\"node-exporter\",device=~\"(/dev/)?(mmcblk.p.+|nvme.+|rbd.+|sd.+|vd.+|xvd.+|dm-.+|md.+|dasd.+)\"}) > 0"
        for: 15m
        labels:
          severity: critical
      - alert: NodeRAIDDiskFailure
        annotations:
          description: "At least one device in RAID array at {{ $labels.instance }} failed. Array '{{ $labels.device }}' needs attention and possibly a disk swap."
          runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/node/noderaiddiskfailure"
          summary: "Failed device in RAID array."
        expr: "node_md_disks{state=\"failed\",job=\"node-exporter\",device=~\"(/dev/)?(mmcblk.p.+|nvme.+|rbd.+|sd.+|vd.+|xvd.+|dm-.+|md.+|dasd.+)\"} > 0"
        labels:
          severity: warning
      - alert: NodeFileDescriptorLimit
        annotations:
          description: "File descriptors limit at {{ $labels.instance }} is currently at {{ printf \"%.2f\" $value }}%."
          runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/node/nodefiledescriptorlimit"
          summary: "Kernel is predicted to exhaust file descriptors limit soon."
        expr: |
          (
            node_filefd_allocated{job="node-exporter"} * 100 / node_filefd_maximum{job="node-exporter"} > 70
          )
        for: 15m
        labels:
          severity: warning
      - alert: NodeFileDescriptorLimit
        annotations:
          description: "File descriptors limit at {{ $labels.instance }} is currently at {{ printf \"%.2f\" $value }}%."
          runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/node/nodefiledescriptorlimit"
          summary: "Kernel is predicted to exhaust file descriptors limit soon."
        expr: |
          (
            node_filefd_allocated{job="node-exporter"} * 100 / node_filefd_maximum{job="node-exporter"} > 90
          )
        for: 15m
        labels:
          severity: critical
      - alert: NodeCPUHighUsage
        annotations:
          description: |
            CPU usage at {{ $labels.instance }} has been above 90% for the last 15 minutes, is currently at {{ printf "%.2f" $value }}%.
            
          runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/node/nodecpuhighusage"
          summary: "High CPU usage."
        expr: "sum without(mode) (avg without (cpu) (rate(node_cpu_seconds_total{job=\"node-exporter\", mode!~\"idle|iowait\"}[2m]))) * 100 > 90"
        for: 15m
        labels:
          severity: info
      - alert: NodeSystemSaturation
        annotations:
          description: |
            System load per core at {{ $labels.instance }} has been above 2 for the last 15 minutes, is currently at {{ printf "%.2f" $value }}.
            This might indicate this instance resources saturation and can cause it becoming unresponsive.
            
          runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/node/nodesystemsaturation"
          summary: "System saturated, load per core is very high."
        expr: |
          node_load1{job="node-exporter"}
          / count without (cpu, mode) (node_cpu_seconds_total{job="node-exporter", mode="idle"}) > 2
        for: 15m
        labels:
          severity: warning
      - alert: NodeMemoryMajorPagesFaults
        annotations:
          description: |
            Memory major pages are occurring at very high rate at {{ $labels.instance }}, 500 major page faults per second for the last 15 minutes, is currently at {{ printf "%.2f" $value }}.
            Please check that there is enough memory available at this instance.
            
          runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/node/nodememorymajorpagesfaults"
          summary: "Memory major page faults are occurring at very high rate."
        expr: "rate(node_vmstat_pgmajfault{job=\"node-exporter\"}[5m]) > 500"
        for: 15m
        labels:
          severity: warning
      - alert: NodeMemoryHighUtilization
        annotations:
          description: |
            Memory is filling up at {{ $labels.instance }}, has been above 90% for the last 15 minutes, is currently at {{ printf "%.2f" $value }}%.
            
          runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/node/nodememoryhighutilization"
          summary: "Host is running out of memory."
        expr: "100 - (node_memory_MemAvailable_bytes{job=\"node-exporter\"} / node_memory_MemTotal_bytes{job=\"node-exporter\"} * 100) > 90"
        for: 15m
        labels:
          severity: warning
      - alert: NodeDiskIOSaturation
        annotations:
          description: |
            Disk IO queue (aqu-sq) is high on {{ $labels.device }} at {{ $labels.instance }}, has been above 10 for the last 30 minutes, is currently at {{ printf "%.2f" $value }}.
            This symptom might indicate disk saturation.
            
          runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/node/nodediskiosaturation"
          summary: "Disk IO queue is high."
        expr: "rate(node_disk_io_time_weighted_seconds_total{job=\"node-exporter\", device=~\"(/dev/)?(mmcblk.p.+|nvme.+|rbd.+|sd.+|vd.+|xvd.+|dm-.+|md.+|dasd.+)\"}[5m]) > 10"
        for: 30m
        labels:
          severity: warning
      - alert: NodeSystemdServiceFailed
        annotations:
          description: "Systemd service {{ $labels.name }} has entered failed state at {{ $labels.instance }}"
          runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/node/nodesystemdservicefailed"
          summary: "Systemd service has entered failed state."
        expr: "node_systemd_unit_state{job=\"node-exporter\", state=\"failed\"} == 1"
        for: 5m
        labels:
          severity: warning
      - alert: NodeSystemdServiceCrashlooping
        annotations:
          description: "Systemd service {{ $labels.name }} has being restarted too many times at {{ $labels.instance }} for the last 15 minutes. Please check if service is crash looping."
          runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/node/nodesystemdservicecrashlooping"
          summary: "Systemd service keeps restaring, possibly crash looping."
        expr: "increase(node_systemd_service_restart_total{job=\"node-exporter\"}[5m]) > 2"
        for: 15m
        labels:
          severity: warning
      - alert: NodeBondingDegraded
        annotations:
          description: "Bonding interface {{ $labels.master }} on {{ $labels.instance }} is in degraded state due to one or more slave failures."
          runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/node/nodebondingdegraded"
          summary: "Bonding interface is degraded."
        expr: "(node_bonding_slaves{job=\"node-exporter\"} - node_bonding_active{job=\"node-exporter\"}) != 0"
        for: 5m
        labels:
          severity: warning
  


(root level)
+ one document added:
  apiVersion: monitoring.coreos.com/v1
  kind: PrometheusRule
  metadata:
    name: kube-prometheus-stack-node-network
    namespace: monitoring
    labels:
      app: kube-prometheus-stack
      app.kubernetes.io/instance: kube-prometheus-stack
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/part-of: kube-prometheus-stack
      helm.toolkit.fluxcd.io/name: kube-prometheus-stack
      helm.toolkit.fluxcd.io/namespace: flux-system
      heritage: Helm
      release: kube-prometheus-stack
  spec:
    groups:
    - name: node-network
      rules:
      - alert: NodeNetworkInterfaceFlapping
        annotations:
          description: "Network interface \"{{ $labels.device }}\" changing its up status often on node-exporter {{ $labels.namespace }}/{{ $labels.pod }}"
          runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/general/nodenetworkinterfaceflapping"
          summary: "Network interface is often changing its status"
        expr: "changes(node_network_up{job=\"node-exporter\",device!~\"veth.+\"}[2m]) > 2"
        for: 2m
        labels:
          severity: warning
  


(root level)
+ one document added:
  apiVersion: monitoring.coreos.com/v1
  kind: PrometheusRule
  metadata:
    name: kube-prometheus-stack-node.rules
    namespace: monitoring
    labels:
      app: kube-prometheus-stack
      app.kubernetes.io/instance: kube-prometheus-stack
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/part-of: kube-prometheus-stack
      helm.toolkit.fluxcd.io/name: kube-prometheus-stack
      helm.toolkit.fluxcd.io/namespace: flux-system
      heritage: Helm
      release: kube-prometheus-stack
  spec:
    groups:
    - name: node.rules
      rules:
      - expr: |
          topk by (cluster, namespace, pod) (1,
            max by (cluster, node, namespace, pod) (
              label_replace(kube_pod_info{job="kube-state-metrics",node!=""}, "pod", "$1", "pod", "(.*)")
          ))
        record: "node_namespace_pod:kube_pod_info:"
      - expr: |
          count by (cluster, node) (
            node_cpu_seconds_total{mode="idle",job="node-exporter"}
            * on (cluster, namespace, pod) group_left(node)
            topk by (cluster, namespace, pod) (1, node_namespace_pod:kube_pod_info:)
          )
        record: "node:node_num_cpu:sum"
      - expr: |
          sum(
            node_memory_MemAvailable_bytes{job="node-exporter"} or
            (
              node_memory_Buffers_bytes{job="node-exporter"} +
              node_memory_Cached_bytes{job="node-exporter"} +
              node_memory_MemFree_bytes{job="node-exporter"} +
              node_memory_Slab_bytes{job="node-exporter"}
            )
          ) by (cluster)
        record: ":node_memory_MemAvailable_bytes:sum"
      - expr: |
          avg by (cluster, node) (
            sum without (mode) (
              rate(node_cpu_seconds_total{mode!="idle",mode!="iowait",mode!="steal",job="node-exporter"}[5m])
            )
          )
        record: "node:node_cpu_utilization:ratio_rate5m"
      - expr: |
          avg by (cluster) (
            node:node_cpu_utilization:ratio_rate5m
          )
        record: "cluster:node_cpu:ratio_rate5m"
  


(root level)
+ one document added:
  apiVersion: monitoring.coreos.com/v1
  kind: PrometheusRule
  metadata:
    name: kube-prometheus-stack-prometheus-operator
    namespace: monitoring
    labels:
      app: kube-prometheus-stack
      app.kubernetes.io/instance: kube-prometheus-stack
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/part-of: kube-prometheus-stack
      helm.toolkit.fluxcd.io/name: kube-prometheus-stack
      helm.toolkit.fluxcd.io/namespace: flux-system
      heritage: Helm
      release: kube-prometheus-stack
  spec:
    groups:
    - name: prometheus-operator
      rules:
      - alert: PrometheusOperatorListErrors
        annotations:
          description: "Errors while performing List operations in controller {{$labels.controller}} in {{$labels.namespace}} namespace."
          runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/prometheus-operator/prometheusoperatorlisterrors"
          summary: "Errors while performing list operations in controller."
        expr: "(sum by (cluster,controller,namespace) (rate(prometheus_operator_list_operations_failed_total{job=\"kube-prometheus-stack-operator\",namespace=\"monitoring\"}[10m])) / sum by (cluster,controller,namespace) (rate(prometheus_operator_list_operations_total{job=\"kube-prometheus-stack-operator\",namespace=\"monitoring\"}[10m]))) > 0.4"
        for: 15m
        labels:
          severity: warning
      - alert: PrometheusOperatorWatchErrors
        annotations:
          description: "Errors while performing watch operations in controller {{$labels.controller}} in {{$labels.namespace}} namespace."
          runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/prometheus-operator/prometheusoperatorwatcherrors"
          summary: "Errors while performing watch operations in controller."
        expr: "(sum by (cluster,controller,namespace) (rate(prometheus_operator_watch_operations_failed_total{job=\"kube-prometheus-stack-operator\",namespace=\"monitoring\"}[5m])) / sum by (cluster,controller,namespace) (rate(prometheus_operator_watch_operations_total{job=\"kube-prometheus-stack-operator\",namespace=\"monitoring\"}[5m]))) > 0.4"
        for: 15m
        labels:
          severity: warning
      - alert: PrometheusOperatorSyncFailed
        annotations:
          description: "Controller {{ $labels.controller }} in {{ $labels.namespace }} namespace fails to reconcile {{ $value }} objects."
          runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/prometheus-operator/prometheusoperatorsyncfailed"
          summary: "Last controller reconciliation failed"
        expr: "min_over_time(prometheus_operator_syncs{status=\"failed\",job=\"kube-prometheus-stack-operator\",namespace=\"monitoring\"}[5m]) > 0"
        for: 10m
        labels:
          severity: warning
      - alert: PrometheusOperatorReconcileErrors
        annotations:
          description: "{{ $value | humanizePercentage }} of reconciling operations failed for {{ $labels.controller }} controller in {{ $labels.namespace }} namespace."
          runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/prometheus-operator/prometheusoperatorreconcileerrors"
          summary: "Errors while reconciling objects."
        expr: "(sum by (cluster,controller,namespace) (rate(prometheus_operator_reconcile_errors_total{job=\"kube-prometheus-stack-operator\",namespace=\"monitoring\"}[5m]))) / (sum by (cluster,controller,namespace) (rate(prometheus_operator_reconcile_operations_total{job=\"kube-prometheus-stack-operator\",namespace=\"monitoring\"}[5m]))) > 0.1"
        for: 10m
        labels:
          severity: warning
      - alert: PrometheusOperatorStatusUpdateErrors
        annotations:
          description: "{{ $value | humanizePercentage }} of status update operations failed for {{ $labels.controller }} controller in {{ $labels.namespace }} namespace."
          runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/prometheus-operator/prometheusoperatorstatusupdateerrors"
          summary: "Errors while updating objects status."
        expr: "(sum by (cluster,controller,namespace) (rate(prometheus_operator_status_update_errors_total{job=\"kube-prometheus-stack-operator\",namespace=\"monitoring\"}[5m]))) / (sum by (cluster,controller,namespace) (rate(prometheus_operator_status_update_operations_total{job=\"kube-prometheus-stack-operator\",namespace=\"monitoring\"}[5m]))) > 0.1"
        for: 10m
        labels:
          severity: warning
      - alert: PrometheusOperatorNodeLookupErrors
        annotations:
          description: "Errors while reconciling Prometheus in {{ $labels.namespace }} Namespace."
          runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/prometheus-operator/prometheusoperatornodelookuperrors"
          summary: "Errors while reconciling Prometheus."
        expr: "rate(prometheus_operator_node_address_lookup_errors_total{job=\"kube-prometheus-stack-operator\",namespace=\"monitoring\"}[5m]) > 0.1"
        for: 10m
        labels:
          severity: warning
      - alert: PrometheusOperatorNotReady
        annotations:
          description: "Prometheus operator in {{ $labels.namespace }} namespace isn't ready to reconcile {{ $labels.controller }} resources."
          runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/prometheus-operator/prometheusoperatornotready"
          summary: "Prometheus operator not ready"
        expr: "min by (cluster,controller,namespace) (max_over_time(prometheus_operator_ready{job=\"kube-prometheus-stack-operator\",namespace=\"monitoring\"}[5m]) == 0)"
        for: 5m
        labels:
          severity: warning
      - alert: PrometheusOperatorRejectedResources
        annotations:
          description: "Prometheus operator in {{ $labels.namespace }} namespace rejected {{ printf \"%0.0f\" $value }} {{ $labels.controller }}/{{ $labels.resource }} resources."
          runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/prometheus-operator/prometheusoperatorrejectedresources"
          summary: "Resources rejected by Prometheus operator"
        expr: "min_over_time(prometheus_operator_managed_resources{state=\"rejected\",job=\"kube-prometheus-stack-operator\",namespace=\"monitoring\"}[5m]) > 0"
        for: 5m
        labels:
          severity: warning
  


(root level)
+ one document added:
  apiVersion: monitoring.coreos.com/v1
  kind: PrometheusRule
  metadata:
    name: kube-prometheus-stack-prometheus
    namespace: monitoring
    labels:
      app: kube-prometheus-stack
      app.kubernetes.io/instance: kube-prometheus-stack
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/part-of: kube-prometheus-stack
      helm.toolkit.fluxcd.io/name: kube-prometheus-stack
      helm.toolkit.fluxcd.io/namespace: flux-system
      heritage: Helm
      release: kube-prometheus-stack
  spec:
    groups:
    - name: prometheus
      rules:
      - alert: PrometheusBadConfig
        annotations:
          description: "Prometheus {{$labels.namespace}}/{{$labels.pod}} has failed to reload its configuration."
          runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/prometheus/prometheusbadconfig"
          summary: "Failed Prometheus configuration reload."
        expr: |
          # Without max_over_time, failed scrapes could create false negatives, see
          # https://www.robustperception.io/alerting-on-gauges-in-prometheus-2-0 for details.
          max_over_time(prometheus_config_last_reload_successful{job="kube-prometheus-stack-prometheus",namespace="monitoring"}[5m]) == 0
        for: 10m
        labels:
          severity: critical
      - alert: PrometheusSDRefreshFailure
        annotations:
          description: "Prometheus {{$labels.namespace}}/{{$labels.pod}} has failed to refresh SD with mechanism {{$labels.mechanism}}."
          runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/prometheus/prometheussdrefreshfailure"
          summary: "Failed Prometheus SD refresh."
        expr: "increase(prometheus_sd_refresh_failures_total{job=\"kube-prometheus-stack-prometheus\",namespace=\"monitoring\"}[10m]) > 0"
        for: 20m
        labels:
          severity: warning
      - alert: PrometheusKubernetesListWatchFailures
        annotations:
          description: "Kubernetes service discovery of Prometheus {{$labels.namespace}}/{{$labels.pod}} is experiencing {{ printf \"%.0f\" $value }} failures with LIST/WATCH requests to the Kubernetes API in the last 5 minutes."
          runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/prometheus/prometheuskuberneteslistwatchfailures"
          summary: "Requests in Kubernetes SD are failing."
        expr: "increase(prometheus_sd_kubernetes_failures_total{job=\"kube-prometheus-stack-prometheus\",namespace=\"monitoring\"}[5m]) > 0"
        for: 15m
        labels:
          severity: warning
      - alert: PrometheusNotificationQueueRunningFull
        annotations:
          description: "Alert notification queue of Prometheus {{$labels.namespace}}/{{$labels.pod}} is running full."
          runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/prometheus/prometheusnotificationqueuerunningfull"
          summary: "Prometheus alert notification queue predicted to run full in less than 30m."
        expr: |
          # Without min_over_time, failed scrapes could create false negatives, see
          # https://www.robustperception.io/alerting-on-gauges-in-prometheus-2-0 for details.
          (
            predict_linear(prometheus_notifications_queue_length{job="kube-prometheus-stack-prometheus",namespace="monitoring"}[5m], 60 * 30)
          >
            min_over_time(prometheus_notifications_queue_capacity{job="kube-prometheus-stack-prometheus",namespace="monitoring"}[5m])
          )
        for: 15m
        labels:
          severity: warning
      - alert: PrometheusErrorSendingAlertsToSomeAlertmanagers
        annotations:
          description: "{{ printf \"%.1f\" $value }}% of alerts sent by Prometheus {{$labels.namespace}}/{{$labels.pod}} to Alertmanager {{$labels.alertmanager}} were affected by errors."
          runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/prometheus/prometheuserrorsendingalertstosomealertmanagers"
          summary: "More than 1% of alerts sent by Prometheus to a specific Alertmanager were affected by errors."
        expr: |
          (
            rate(prometheus_notifications_errors_total{job="kube-prometheus-stack-prometheus",namespace="monitoring"}[5m])
          /
            rate(prometheus_notifications_sent_total{job="kube-prometheus-stack-prometheus",namespace="monitoring"}[5m])
          )
          * 100
          > 1
        for: 15m
        labels:
          severity: warning
      - alert: PrometheusNotConnectedToAlertmanagers
        annotations:
          description: "Prometheus {{$labels.namespace}}/{{$labels.pod}} is not connected to any Alertmanagers."
          runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/prometheus/prometheusnotconnectedtoalertmanagers"
          summary: "Prometheus is not connected to any Alertmanagers."
        expr: |
          # Without max_over_time, failed scrapes could create false negatives, see
          # https://www.robustperception.io/alerting-on-gauges-in-prometheus-2-0 for details.
          max_over_time(prometheus_notifications_alertmanagers_discovered{job="kube-prometheus-stack-prometheus",namespace="monitoring"}[5m]) < 1
        for: 10m
        labels:
          severity: warning
      - alert: PrometheusTSDBReloadsFailing
        annotations:
          description: "Prometheus {{$labels.namespace}}/{{$labels.pod}} has detected {{$value | humanize}} reload failures over the last 3h."
          runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/prometheus/prometheustsdbreloadsfailing"
          summary: "Prometheus has issues reloading blocks from disk."
        expr: "increase(prometheus_tsdb_reloads_failures_total{job=\"kube-prometheus-stack-prometheus\",namespace=\"monitoring\"}[3h]) > 0"
        for: 4h
        labels:
          severity: warning
      - alert: PrometheusTSDBCompactionsFailing
        annotations:
          description: "Prometheus {{$labels.namespace}}/{{$labels.pod}} has detected {{$value | humanize}} compaction failures over the last 3h."
          runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/prometheus/prometheustsdbcompactionsfailing"
          summary: "Prometheus has issues compacting blocks."
        expr: "increase(prometheus_tsdb_compactions_failed_total{job=\"kube-prometheus-stack-prometheus\",namespace=\"monitoring\"}[3h]) > 0"
        for: 4h
        labels:
          severity: warning
      - alert: PrometheusNotIngestingSamples
        annotations:
          description: "Prometheus {{$labels.namespace}}/{{$labels.pod}} is not ingesting samples."
          runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/prometheus/prometheusnotingestingsamples"
          summary: "Prometheus is not ingesting samples."
        expr: |
          (
            sum without(type) (rate(prometheus_tsdb_head_samples_appended_total{job="kube-prometheus-stack-prometheus",namespace="monitoring"}[5m])) <= 0
          and
            (
              sum without(scrape_job) (prometheus_target_metadata_cache_entries{job="kube-prometheus-stack-prometheus",namespace="monitoring"}) > 0
            or
              sum without(rule_group) (prometheus_rule_group_rules{job="kube-prometheus-stack-prometheus",namespace="monitoring"}) > 0
            )
          )
        for: 10m
        labels:
          severity: warning
      - alert: PrometheusDuplicateTimestamps
        annotations:
          description: "Prometheus {{$labels.namespace}}/{{$labels.pod}} is dropping {{ printf \"%.4g\" $value  }} samples/s with different values but duplicated timestamp."
          runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/prometheus/prometheusduplicatetimestamps"
          summary: "Prometheus is dropping samples with duplicate timestamps."
        expr: "rate(prometheus_target_scrapes_sample_duplicate_timestamp_total{job=\"kube-prometheus-stack-prometheus\",namespace=\"monitoring\"}[5m]) > 0"
        for: 10m
        labels:
          severity: warning
      - alert: PrometheusOutOfOrderTimestamps
        annotations:
          description: "Prometheus {{$labels.namespace}}/{{$labels.pod}} is dropping {{ printf \"%.4g\" $value  }} samples/s with timestamps arriving out of order."
          runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/prometheus/prometheusoutofordertimestamps"
          summary: "Prometheus drops samples with out-of-order timestamps."
        expr: "rate(prometheus_target_scrapes_sample_out_of_order_total{job=\"kube-prometheus-stack-prometheus\",namespace=\"monitoring\"}[5m]) > 0"
        for: 10m
        labels:
          severity: warning
      - alert: PrometheusRemoteStorageFailures
        annotations:
          description: "Prometheus {{$labels.namespace}}/{{$labels.pod}} failed to send {{ printf \"%.1f\" $value }}% of the samples to {{ $labels.remote_name}}:{{ $labels.url }}"
          runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/prometheus/prometheusremotestoragefailures"
          summary: "Prometheus fails to send samples to remote storage."
        expr: |
          (
            (rate(prometheus_remote_storage_failed_samples_total{job="kube-prometheus-stack-prometheus",namespace="monitoring"}[5m]) or rate(prometheus_remote_storage_samples_failed_total{job="kube-prometheus-stack-prometheus",namespace="monitoring"}[5m]))
          /
            (
              (rate(prometheus_remote_storage_failed_samples_total{job="kube-prometheus-stack-prometheus",namespace="monitoring"}[5m]) or rate(prometheus_remote_storage_samples_failed_total{job="kube-prometheus-stack-prometheus",namespace="monitoring"}[5m]))
            +
              (rate(prometheus_remote_storage_succeeded_samples_total{job="kube-prometheus-stack-prometheus",namespace="monitoring"}[5m]) or rate(prometheus_remote_storage_samples_total{job="kube-prometheus-stack-prometheus",namespace="monitoring"}[5m]))
            )
          )
          * 100
          > 1
        for: 15m
        labels:
          severity: critical
      - alert: PrometheusRemoteWriteBehind
        annotations:
          description: "Prometheus {{$labels.namespace}}/{{$labels.pod}} remote write is {{ printf \"%.1f\" $value }}s behind for {{ $labels.remote_name}}:{{ $labels.url }}."
          runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/prometheus/prometheusremotewritebehind"
          summary: "Prometheus remote write is behind."
        expr: |
          # Without max_over_time, failed scrapes could create false negatives, see
          # https://www.robustperception.io/alerting-on-gauges-in-prometheus-2-0 for details.
          (
            max_over_time(prometheus_remote_storage_queue_highest_timestamp_seconds{job="kube-prometheus-stack-prometheus",namespace="monitoring"}[5m])
          -
            max_over_time(prometheus_remote_storage_queue_highest_sent_timestamp_seconds{job="kube-prometheus-stack-prometheus",namespace="monitoring"}[5m])
          )
          > 120
        for: 15m
        labels:
          severity: critical
      - alert: PrometheusRemoteWriteDesiredShards
        annotations:
          description: "Prometheus {{$labels.namespace}}/{{$labels.pod}} remote write desired shards calculation wants to run {{ $value }} shards for queue {{ $labels.remote_name}}:{{ $labels.url }}, which is more than the max of {{ printf `prometheus_remote_storage_shards_max{instance=\"%s\",job=\"kube-prometheus-stack-prometheus\",namespace=\"monitoring\"}` $labels.instance | query | first | value }}."
          runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/prometheus/prometheusremotewritedesiredshards"
          summary: "Prometheus remote write desired shards calculation wants to run more than configured max shards."
        expr: |
          # Without max_over_time, failed scrapes could create false negatives, see
          # https://www.robustperception.io/alerting-on-gauges-in-prometheus-2-0 for details.
          (
            max_over_time(prometheus_remote_storage_shards_desired{job="kube-prometheus-stack-prometheus",namespace="monitoring"}[5m])
          >
            max_over_time(prometheus_remote_storage_shards_max{job="kube-prometheus-stack-prometheus",namespace="monitoring"}[5m])
          )
        for: 15m
        labels:
          severity: warning
      - alert: PrometheusRuleFailures
        annotations:
          description: "Prometheus {{$labels.namespace}}/{{$labels.pod}} has failed to evaluate {{ printf \"%.0f\" $value }} rules in the last 5m."
          runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/prometheus/prometheusrulefailures"
          summary: "Prometheus is failing rule evaluations."
        expr: "increase(prometheus_rule_evaluation_failures_total{job=\"kube-prometheus-stack-prometheus\",namespace=\"monitoring\"}[5m]) > 0"
        for: 15m
        labels:
          severity: critical
      - alert: PrometheusMissingRuleEvaluations
        annotations:
          description: "Prometheus {{$labels.namespace}}/{{$labels.pod}} has missed {{ printf \"%.0f\" $value }} rule group evaluations in the last 5m."
          runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/prometheus/prometheusmissingruleevaluations"
          summary: "Prometheus is missing rule evaluations due to slow rule group evaluation."
        expr: "increase(prometheus_rule_group_iterations_missed_total{job=\"kube-prometheus-stack-prometheus\",namespace=\"monitoring\"}[5m]) > 0"
        for: 15m
        labels:
          severity: warning
      - alert: PrometheusTargetLimitHit
        annotations:
          description: "Prometheus {{$labels.namespace}}/{{$labels.pod}} has dropped {{ printf \"%.0f\" $value }} targets because the number of targets exceeded the configured target_limit."
          runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/prometheus/prometheustargetlimithit"
          summary: "Prometheus has dropped targets because some scrape configs have exceeded the targets limit."
        expr: "increase(prometheus_target_scrape_pool_exceeded_target_limit_total{job=\"kube-prometheus-stack-prometheus\",namespace=\"monitoring\"}[5m]) > 0"
        for: 15m
        labels:
          severity: warning
      - alert: PrometheusLabelLimitHit
        annotations:
          description: "Prometheus {{$labels.namespace}}/{{$labels.pod}} has dropped {{ printf \"%.0f\" $value }} targets because some samples exceeded the configured label_limit, label_name_length_limit or label_value_length_limit."
          runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/prometheus/prometheuslabellimithit"
          summary: "Prometheus has dropped targets because some scrape configs have exceeded the labels limit."
        expr: "increase(prometheus_target_scrape_pool_exceeded_label_limits_total{job=\"kube-prometheus-stack-prometheus\",namespace=\"monitoring\"}[5m]) > 0"
        for: 15m
        labels:
          severity: warning
      - alert: PrometheusScrapeBodySizeLimitHit
        annotations:
          description: "Prometheus {{$labels.namespace}}/{{$labels.pod}} has failed {{ printf \"%.0f\" $value }} scrapes in the last 5m because some targets exceeded the configured body_size_limit."
          runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/prometheus/prometheusscrapebodysizelimithit"
          summary: "Prometheus has dropped some targets that exceeded body size limit."
        expr: "increase(prometheus_target_scrapes_exceeded_body_size_limit_total{job=\"kube-prometheus-stack-prometheus\",namespace=\"monitoring\"}[5m]) > 0"
        for: 15m
        labels:
          severity: warning
      - alert: PrometheusScrapeSampleLimitHit
        annotations:
          description: "Prometheus {{$labels.namespace}}/{{$labels.pod}} has failed {{ printf \"%.0f\" $value }} scrapes in the last 5m because some targets exceeded the configured sample_limit."
          runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/prometheus/prometheusscrapesamplelimithit"
          summary: "Prometheus has failed scrapes that have exceeded the configured sample limit."
        expr: "increase(prometheus_target_scrapes_exceeded_sample_limit_total{job=\"kube-prometheus-stack-prometheus\",namespace=\"monitoring\"}[5m]) > 0"
        for: 15m
        labels:
          severity: warning
      - alert: PrometheusTargetSyncFailure
        annotations:
          description: "{{ printf \"%.0f\" $value }} targets in Prometheus {{$labels.namespace}}/{{$labels.pod}} have failed to sync because invalid configuration was supplied."
          runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/prometheus/prometheustargetsyncfailure"
          summary: "Prometheus has failed to sync targets."
        expr: "increase(prometheus_target_sync_failed_total{job=\"kube-prometheus-stack-prometheus\",namespace=\"monitoring\"}[30m]) > 0"
        for: 5m
        labels:
          severity: critical
      - alert: PrometheusHighQueryLoad
        annotations:
          description: "Prometheus {{$labels.namespace}}/{{$labels.pod}} query API has less than 20% available capacity in its query engine for the last 15 minutes."
          runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/prometheus/prometheushighqueryload"
          summary: "Prometheus is reaching its maximum capacity serving concurrent requests."
        expr: "avg_over_time(prometheus_engine_queries{job=\"kube-prometheus-stack-prometheus\",namespace=\"monitoring\"}[5m]) / max_over_time(prometheus_engine_queries_concurrent_max{job=\"kube-prometheus-stack-prometheus\",namespace=\"monitoring\"}[5m]) > 0.8"
        for: 15m
        labels:
          severity: warning
      - alert: PrometheusErrorSendingAlertsToAnyAlertmanager
        annotations:
          description: "{{ printf \"%.1f\" $value }}% minimum errors while sending alerts from Prometheus {{$labels.namespace}}/{{$labels.pod}} to any Alertmanager."
          runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/prometheus/prometheuserrorsendingalertstoanyalertmanager"
          summary: "Prometheus encounters more than 3% errors sending alerts to any Alertmanager."
        expr: |
          min without (alertmanager) (
            rate(prometheus_notifications_errors_total{job="kube-prometheus-stack-prometheus",namespace="monitoring",alertmanager!~``}[5m])
          /
            rate(prometheus_notifications_sent_total{job="kube-prometheus-stack-prometheus",namespace="monitoring",alertmanager!~``}[5m])
          )
          * 100
          > 3
        for: 15m
        labels:
          severity: critical
  


(root level)
+ one document added:
  apiVersion: monitoring.coreos.com/v1
  kind: ServiceMonitor
  metadata:
    name: kube-state-metrics
    namespace: monitoring
    labels:
      app.kubernetes.io/component: metrics
      app.kubernetes.io/instance: kube-prometheus-stack
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: kube-state-metrics
      app.kubernetes.io/part-of: kube-state-metrics
      helm.toolkit.fluxcd.io/name: kube-prometheus-stack
      helm.toolkit.fluxcd.io/namespace: flux-system
      release: kube-prometheus-stack
  spec:
    endpoints:
    - honorLabels: true
      port: http
      relabelings:
      - action: replace
        regex: "(.*)"
        replacement: $1
        sourceLabels:
        - __meta_kubernetes_pod_node_name
        targetLabel: kubernetes_node
    jobLabel: app.kubernetes.io/name
    selector:
      matchLabels:
        app.kubernetes.io/instance: kube-prometheus-stack
        app.kubernetes.io/name: kube-state-metrics

(root level)
+ one document added:
  apiVersion: monitoring.coreos.com/v1
  kind: ServiceMonitor
  metadata:
    name: node-exporter
    namespace: kube-privileged
    labels:
      app.kubernetes.io/component: metrics
      app.kubernetes.io/instance: kube-prometheus-stack
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: prometheus-node-exporter
      app.kubernetes.io/part-of: prometheus-node-exporter
      helm.toolkit.fluxcd.io/name: kube-prometheus-stack
      helm.toolkit.fluxcd.io/namespace: flux-system
      release: kube-prometheus-stack
  spec:
    attachMetadata:
      node: false
    endpoints:
    - port: http-metrics
      relabelings:
      - action: replace
        regex: "(.*)"
        replacement: $1
        sourceLabels:
        - __meta_kubernetes_pod_node_name
        targetLabel: kubernetes_node
      scheme: http
    jobLabel: jobLabel
    selector:
      matchLabels:
        app.kubernetes.io/instance: kube-prometheus-stack
        app.kubernetes.io/name: prometheus-node-exporter

(root level)
+ one document added:
  apiVersion: monitoring.coreos.com/v1
  kind: ServiceMonitor
  metadata:
    name: kube-prometheus-stack-alertmanager
    namespace: monitoring
    labels:
      app: kube-prometheus-stack-alertmanager
      app.kubernetes.io/instance: kube-prometheus-stack
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/part-of: kube-prometheus-stack
      helm.toolkit.fluxcd.io/name: kube-prometheus-stack
      helm.toolkit.fluxcd.io/namespace: flux-system
      heritage: Helm
      release: kube-prometheus-stack
  spec:
    endpoints:
    - enableHttp2: true
      path: /metrics
      port: http-web
    - path: /metrics
      port: reloader-web
    namespaceSelector:
      matchNames:
      - monitoring
    selector:
      matchLabels:
        app: kube-prometheus-stack-alertmanager
        release: kube-prometheus-stack
        self-monitor: "true"

(root level)
+ one document added:
  apiVersion: monitoring.coreos.com/v1
  kind: ServiceMonitor
  metadata:
    name: kube-prometheus-stack-coredns
    namespace: monitoring
    labels:
      app: kube-prometheus-stack-coredns
      app.kubernetes.io/instance: kube-prometheus-stack
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/part-of: kube-prometheus-stack
      helm.toolkit.fluxcd.io/name: kube-prometheus-stack
      helm.toolkit.fluxcd.io/namespace: flux-system
      heritage: Helm
      release: kube-prometheus-stack
  spec:
    endpoints:
    - bearerTokenFile: /var/run/secrets/kubernetes.io/serviceaccount/token
      port: http-metrics
    jobLabel: jobLabel
    namespaceSelector:
      matchNames:
      - kube-system
    selector:
      matchLabels:
        app: kube-prometheus-stack-coredns
        release: kube-prometheus-stack

(root level)
+ one document added:
  apiVersion: monitoring.coreos.com/v1
  kind: ServiceMonitor
  metadata:
    name: kube-prometheus-stack-apiserver
    namespace: monitoring
    labels:
      app: kube-prometheus-stack-apiserver
      app.kubernetes.io/instance: kube-prometheus-stack
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/part-of: kube-prometheus-stack
      helm.toolkit.fluxcd.io/name: kube-prometheus-stack
      helm.toolkit.fluxcd.io/namespace: flux-system
      heritage: Helm
      release: kube-prometheus-stack
  spec:
    endpoints:
    - bearerTokenFile: /var/run/secrets/kubernetes.io/serviceaccount/token
      metricRelabelings:
      - action: drop
        regex: (etcd_request|apiserver_request_slo|apiserver_request_sli|apiserver_request)_duration_seconds_bucket;(0\.15|0\.2|0\.3|0\.35|0\.4|0\.45|0\.6|0\.7|0\.8|0\.9|1\.25|1\.5|1\.75|2|3|3\.5|4|4\.5|6|7|8|9|15|20|40|45|50)(\.0)?
        sourceLabels:
        - __name__
        - le
      port: https
      scheme: https
      tlsConfig:
        caFile: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
        insecureSkipVerify: false
        serverName: kubernetes
    jobLabel: component
    namespaceSelector:
      matchNames:
      - default
    selector:
      matchLabels:
        component: apiserver
        provider: kubernetes
  


(root level)
+ one document added:
  apiVersion: monitoring.coreos.com/v1
  kind: ServiceMonitor
  metadata:
    name: kube-prometheus-stack-kube-controller-manager
    namespace: monitoring
    labels:
      app: kube-prometheus-stack-kube-controller-manager
      app.kubernetes.io/instance: kube-prometheus-stack
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/part-of: kube-prometheus-stack
      helm.toolkit.fluxcd.io/name: kube-prometheus-stack
      helm.toolkit.fluxcd.io/namespace: flux-system
      heritage: Helm
      release: kube-prometheus-stack
  spec:
    endpoints:
    - bearerTokenFile: /var/run/secrets/kubernetes.io/serviceaccount/token
      port: http-metrics
      scheme: https
      tlsConfig:
        caFile: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
        insecureSkipVerify: true
    jobLabel: jobLabel
    namespaceSelector:
      matchNames:
      - kube-system
    selector:
      matchLabels:
        app: kube-prometheus-stack-kube-controller-manager
        release: kube-prometheus-stack

(root level)
+ one document added:
  apiVersion: monitoring.coreos.com/v1
  kind: ServiceMonitor
  metadata:
    name: kube-prometheus-stack-kube-etcd
    namespace: monitoring
    labels:
      app: kube-prometheus-stack-kube-etcd
      app.kubernetes.io/instance: kube-prometheus-stack
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/part-of: kube-prometheus-stack
      helm.toolkit.fluxcd.io/name: kube-prometheus-stack
      helm.toolkit.fluxcd.io/namespace: flux-system
      heritage: Helm
      release: kube-prometheus-stack
  spec:
    endpoints:
    - bearerTokenFile: /var/run/secrets/kubernetes.io/serviceaccount/token
      port: http-metrics
    jobLabel: jobLabel
    namespaceSelector:
      matchNames:
      - kube-system
    selector:
      matchLabels:
        app: kube-prometheus-stack-kube-etcd
        release: kube-prometheus-stack

(root level)
+ one document added:
  apiVersion: monitoring.coreos.com/v1
  kind: ServiceMonitor
  metadata:
    name: kube-prometheus-stack-kube-scheduler
    namespace: monitoring
    labels:
      app: kube-prometheus-stack-kube-scheduler
      app.kubernetes.io/instance: kube-prometheus-stack
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/part-of: kube-prometheus-stack
      helm.toolkit.fluxcd.io/name: kube-prometheus-stack
      helm.toolkit.fluxcd.io/namespace: flux-system
      heritage: Helm
      release: kube-prometheus-stack
  spec:
    endpoints:
    - bearerTokenFile: /var/run/secrets/kubernetes.io/serviceaccount/token
      port: http-metrics
      scheme: https
      tlsConfig:
        caFile: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
        insecureSkipVerify: true
    jobLabel: jobLabel
    namespaceSelector:
      matchNames:
      - kube-system
    selector:
      matchLabels:
        app: kube-prometheus-stack-kube-scheduler
        release: kube-prometheus-stack

(root level)
+ one document added:
  apiVersion: monitoring.coreos.com/v1
  kind: ServiceMonitor
  metadata:
    name: kube-prometheus-stack-kubelet
    namespace: monitoring
    labels:
      app: kube-prometheus-stack-kubelet
      app.kubernetes.io/instance: kube-prometheus-stack
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/part-of: kube-prometheus-stack
      helm.toolkit.fluxcd.io/name: kube-prometheus-stack
      helm.toolkit.fluxcd.io/namespace: flux-system
      heritage: Helm
      release: kube-prometheus-stack
  spec:
    attachMetadata:
      node: false
    endpoints:
    - bearerTokenFile: /var/run/secrets/kubernetes.io/serviceaccount/token
      honorLabels: true
      honorTimestamps: true
      metricRelabelings:
      - action: drop
        regex: (csi_operations|storage_operation_duration)_seconds_bucket;(0.25|2.5|15|25|120|600)(\.0)?
        sourceLabels:
        - __name__
        - le
      port: https-metrics
      relabelings:
      - action: replace
        sourceLabels:
        - __metrics_path__
        targetLabel: metrics_path
      scheme: https
      tlsConfig:
        caFile: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
        insecureSkipVerify: true
    - bearerTokenFile: /var/run/secrets/kubernetes.io/serviceaccount/token
      honorLabels: true
      honorTimestamps: true
      interval: 10s
      metricRelabelings:
      - action: drop
        regex: container_cpu_(cfs_throttled_seconds_total|load_average_10s|system_seconds_total|user_seconds_total)
        sourceLabels:
        - __name__
      - action: drop
        regex: container_fs_(io_current|io_time_seconds_total|io_time_weighted_seconds_total|reads_merged_total|sector_reads_total|sector_writes_total|writes_merged_total)
        sourceLabels:
        - __name__
      - action: drop
        regex: container_memory_(mapped_file|swap)
        sourceLabels:
        - __name__
      - action: drop
        regex: container_(file_descriptors|tasks_state|threads_max)
        sourceLabels:
        - __name__
      - action: drop
        regex: container_memory_failures_total;hierarchy
        sourceLabels:
        - __name__
        - scope
      - action: drop
        regex: "container_network_.*;(cali|cilium|cni|lxc|nodelocaldns|tunl).*"
        sourceLabels:
        - __name__
        - interface
      - action: drop
        regex: "container_spec.*"
        sourceLabels:
        - __name__
      - action: drop
        regex: .+;
        sourceLabels:
        - id
        - pod
      path: /metrics/cadvisor
      port: https-metrics
      relabelings:
      - action: replace
        sourceLabels:
        - __metrics_path__
        targetLabel: metrics_path
      scheme: https
      tlsConfig:
        caFile: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
        insecureSkipVerify: true
      trackTimestampsStaleness: true
    - bearerTokenFile: /var/run/secrets/kubernetes.io/serviceaccount/token
      honorLabels: true
      honorTimestamps: true
      path: /metrics/probes
      port: https-metrics
      relabelings:
      - action: replace
        sourceLabels:
        - __metrics_path__
        targetLabel: metrics_path
      scheme: https
      tlsConfig:
        caFile: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
        insecureSkipVerify: true
    jobLabel: k8s-app
    namespaceSelector:
      matchNames:
      - kube-system
    selector:
      matchLabels:
        app.kubernetes.io/name: kubelet
        k8s-app: kubelet
  


(root level)
+ one document added:
  apiVersion: monitoring.coreos.com/v1
  kind: ServiceMonitor
  metadata:
    name: kube-prometheus-stack-operator
    namespace: monitoring
    labels:
      app: kube-prometheus-stack-operator
      app.kubernetes.io/component: prometheus-operator
      app.kubernetes.io/instance: kube-prometheus-stack
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: kube-prometheus-stack-prometheus-operator
      app.kubernetes.io/part-of: kube-prometheus-stack
      helm.toolkit.fluxcd.io/name: kube-prometheus-stack
      helm.toolkit.fluxcd.io/namespace: flux-system
      heritage: Helm
      release: kube-prometheus-stack
  spec:
    endpoints:
    - honorLabels: true
      port: https
      scheme: https
      tlsConfig:
        ca:
          secret:
            name: kube-prometheus-stack-admission
            key: ca
            optional: false
        serverName: kube-prometheus-stack-operator
    namespaceSelector:
      matchNames:
      - monitoring
    selector:
      matchLabels:
        app: kube-prometheus-stack-operator
        release: kube-prometheus-stack

(root level)
+ one document added:
  apiVersion: monitoring.coreos.com/v1
  kind: ServiceMonitor
  metadata:
    name: kube-prometheus-stack-prometheus
    namespace: monitoring
    labels:
      app: kube-prometheus-stack-prometheus
      app.kubernetes.io/instance: kube-prometheus-stack
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/part-of: kube-prometheus-stack
      helm.toolkit.fluxcd.io/name: kube-prometheus-stack
      helm.toolkit.fluxcd.io/namespace: flux-system
      heritage: Helm
      release: kube-prometheus-stack
  spec:
    endpoints:
    - path: /metrics
      port: http-web
    - path: /metrics
      port: reloader-web
    namespaceSelector:
      matchNames:
      - monitoring
    selector:
      matchLabels:
        app: kube-prometheus-stack-prometheus
        release: kube-prometheus-stack
        self-monitor: "true"

(root level)
+ one document added:
  apiVersion: v1
  kind: ServiceAccount
  metadata:
    name: kube-prometheus-stack-admission
    namespace: monitoring
    annotations:
      helm.sh/hook: "pre-install,pre-upgrade,post-install,post-upgrade"
      helm.sh/hook-delete-policy: "before-hook-creation,hook-succeeded"
    labels:
      app: kube-prometheus-stack-admission
      app.kubernetes.io/component: prometheus-operator-webhook
      app.kubernetes.io/instance: kube-prometheus-stack
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: kube-prometheus-stack-prometheus-operator
      app.kubernetes.io/part-of: kube-prometheus-stack
      heritage: Helm
      release: kube-prometheus-stack
  automountServiceAccountToken: true

(root level)
+ one document added:
  apiVersion: rbac.authorization.k8s.io/v1
  kind: ClusterRole
  metadata:
    name: kube-prometheus-stack-admission
    annotations:
      helm.sh/hook: "pre-install,pre-upgrade,post-install,post-upgrade"
      helm.sh/hook-delete-policy: "before-hook-creation,hook-succeeded"
    labels:
      app: kube-prometheus-stack-admission
      app.kubernetes.io/component: prometheus-operator-webhook
      app.kubernetes.io/instance: kube-prometheus-stack
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: kube-prometheus-stack-prometheus-operator
      app.kubernetes.io/part-of: kube-prometheus-stack
      heritage: Helm
      release: kube-prometheus-stack
  rules:
  - resources:
    - validatingwebhookconfigurations
    - mutatingwebhookconfigurations
    apiGroups:
    - admissionregistration.k8s.io
    verbs:
    - get
    - update
    - patch

(root level)
+ one document added:
  apiVersion: rbac.authorization.k8s.io/v1
  kind: ClusterRoleBinding
  metadata:
    name: kube-prometheus-stack-admission
    annotations:
      helm.sh/hook: "pre-install,pre-upgrade,post-install,post-upgrade"
      helm.sh/hook-delete-policy: "before-hook-creation,hook-succeeded"
    labels:
      app: kube-prometheus-stack-admission
      app.kubernetes.io/component: prometheus-operator-webhook
      app.kubernetes.io/instance: kube-prometheus-stack
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: kube-prometheus-stack-prometheus-operator
      app.kubernetes.io/part-of: kube-prometheus-stack
      heritage: Helm
      release: kube-prometheus-stack
  roleRef:
    name: kube-prometheus-stack-admission
    apiGroup: rbac.authorization.k8s.io
    kind: ClusterRole
  subjects:
  - name: kube-prometheus-stack-admission
    kind: ServiceAccount
    namespace: monitoring

(root level)
+ one document added:
  apiVersion: rbac.authorization.k8s.io/v1
  kind: Role
  metadata:
    name: kube-prometheus-stack-admission
    namespace: monitoring
    annotations:
      helm.sh/hook: "pre-install,pre-upgrade,post-install,post-upgrade"
      helm.sh/hook-delete-policy: "before-hook-creation,hook-succeeded"
    labels:
      app: kube-prometheus-stack-admission
      app.kubernetes.io/component: prometheus-operator-webhook
      app.kubernetes.io/instance: kube-prometheus-stack
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: kube-prometheus-stack-prometheus-operator
      app.kubernetes.io/part-of: kube-prometheus-stack
      heritage: Helm
      release: kube-prometheus-stack
  rules:
  - resources:
    - secrets
    apiGroups:
    -
    verbs:
    - get
    - create

(root level)
+ one document added:
  apiVersion: rbac.authorization.k8s.io/v1
  kind: RoleBinding
  metadata:
    name: kube-prometheus-stack-admission
    namespace: monitoring
    annotations:
      helm.sh/hook: "pre-install,pre-upgrade,post-install,post-upgrade"
      helm.sh/hook-delete-policy: "before-hook-creation,hook-succeeded"
    labels:
      app: kube-prometheus-stack-admission
      app.kubernetes.io/component: prometheus-operator-webhook
      app.kubernetes.io/instance: kube-prometheus-stack
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: kube-prometheus-stack-prometheus-operator
      app.kubernetes.io/part-of: kube-prometheus-stack
      heritage: Helm
      release: kube-prometheus-stack
  roleRef:
    name: kube-prometheus-stack-admission
    apiGroup: rbac.authorization.k8s.io
    kind: Role
  subjects:
  - name: kube-prometheus-stack-admission
    kind: ServiceAccount
    namespace: monitoring

(root level)
+ one document added:
  apiVersion: batch/v1
  kind: Job
  metadata:
    name: kube-prometheus-stack-admission-create
    namespace: monitoring
    annotations:
      helm.sh/hook: "pre-install,pre-upgrade"
      helm.sh/hook-delete-policy: "before-hook-creation,hook-succeeded"
    labels:
      app: kube-prometheus-stack-admission-create
      app.kubernetes.io/component: prometheus-operator-webhook
      app.kubernetes.io/instance: kube-prometheus-stack
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: kube-prometheus-stack-prometheus-operator
      app.kubernetes.io/part-of: kube-prometheus-stack
      heritage: Helm
      release: kube-prometheus-stack
  spec:
    template:
      metadata:
        name: kube-prometheus-stack-admission-create
        labels:
          app: kube-prometheus-stack-admission-create
          app.kubernetes.io/component: prometheus-operator-webhook
          app.kubernetes.io/instance: kube-prometheus-stack
          app.kubernetes.io/managed-by: Helm
          app.kubernetes.io/name: kube-prometheus-stack-prometheus-operator
          app.kubernetes.io/part-of: kube-prometheus-stack
          heritage: Helm
          release: kube-prometheus-stack
      spec:
        containers:
        - name: create
          image: "ghcr.io/jkroepke/kube-webhook-certgen:1.8.4"
          imagePullPolicy: IfNotPresent
          resources: {}
          args:
          - create
          - "--host=kube-prometheus-stack-operator,kube-prometheus-stack-operator.monitoring.svc"
          - "--namespace=monitoring"
          - "--secret-name=kube-prometheus-stack-admission"
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
              - ALL
            readOnlyRootFilesystem: true
        restartPolicy: OnFailure
        securityContext:
          runAsGroup: 2000
          runAsNonRoot: true
          runAsUser: 2000
          seccompProfile:
            type: RuntimeDefault
        serviceAccountName: kube-prometheus-stack-admission
    ttlSecondsAfterFinished: 60
  


(root level)
+ one document added:
  apiVersion: batch/v1
  kind: Job
  metadata:
    name: kube-prometheus-stack-admission-patch
    namespace: monitoring
    annotations:
      helm.sh/hook: "post-install,post-upgrade"
      helm.sh/hook-delete-policy: "before-hook-creation,hook-succeeded"
    labels:
      app: kube-prometheus-stack-admission-patch
      app.kubernetes.io/component: prometheus-operator-webhook
      app.kubernetes.io/instance: kube-prometheus-stack
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: kube-prometheus-stack-prometheus-operator
      app.kubernetes.io/part-of: kube-prometheus-stack
      heritage: Helm
      release: kube-prometheus-stack
  spec:
    template:
      metadata:
        name: kube-prometheus-stack-admission-patch
        labels:
          app: kube-prometheus-stack-admission-patch
          app.kubernetes.io/component: prometheus-operator-webhook
          app.kubernetes.io/instance: kube-prometheus-stack
          app.kubernetes.io/managed-by: Helm
          app.kubernetes.io/name: kube-prometheus-stack-prometheus-operator
          app.kubernetes.io/part-of: kube-prometheus-stack
          heritage: Helm
          release: kube-prometheus-stack
      spec:
        containers:
        - name: patch
          image: "ghcr.io/jkroepke/kube-webhook-certgen:1.8.4"
          imagePullPolicy: IfNotPresent
          resources: {}
          args:
          - patch
          - "--webhook-name=kube-prometheus-stack-admission"
          - "--namespace=monitoring"
          - "--secret-name=kube-prometheus-stack-admission"
          - "--patch-failure-policy="
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
              - ALL
            readOnlyRootFilesystem: true
        restartPolicy: OnFailure
        securityContext:
          runAsGroup: 2000
          runAsNonRoot: true
          runAsUser: 2000
          seccompProfile:
            type: RuntimeDefault
        serviceAccountName: kube-prometheus-stack-admission
    ttlSecondsAfterFinished: 60

(root level)
+ one document added:
  apiVersion: networking.k8s.io/v1
  kind: NetworkPolicy
  metadata:
    name: local-ai-valkey
    namespace: local-ai
    labels:
      app.kubernetes.io/instance: local-ai-valkey
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: valkey
      app.kubernetes.io/part-of: valkey
      helm.toolkit.fluxcd.io/name: local-ai-valkey
      helm.toolkit.fluxcd.io/namespace: flux-system
  spec:
    egress:
    -   ingress:
    - ports:
      - port: 6379
    podSelector:
      matchLabels:
        app.kubernetes.io/instance: local-ai-valkey
        app.kubernetes.io/name: valkey
    policyTypes:
    - Ingress
    - Egress

(root level)
+ one document added:
  apiVersion: policy/v1
  kind: PodDisruptionBudget
  metadata:
    name: local-ai-valkey-primary
    namespace: local-ai
    labels:
      app.kubernetes.io/component: primary
      app.kubernetes.io/instance: local-ai-valkey
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: valkey
      helm.toolkit.fluxcd.io/name: local-ai-valkey
      helm.toolkit.fluxcd.io/namespace: flux-system
  spec:
    maxUnavailable: 1
    selector:
      matchLabels:
        app.kubernetes.io/component: primary
        app.kubernetes.io/instance: local-ai-valkey
        app.kubernetes.io/name: valkey

(root level)
+ one document added:
  apiVersion: v1
  kind: ServiceAccount
  metadata:
    name: local-ai-valkey-primary
    namespace: local-ai
    labels:
      app.kubernetes.io/instance: local-ai-valkey
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: valkey
      app.kubernetes.io/part-of: valkey
      helm.toolkit.fluxcd.io/name: local-ai-valkey
      helm.toolkit.fluxcd.io/namespace: flux-system
  automountServiceAccountToken: false

(root level)
+ one document added:
  apiVersion: v1
  kind: ConfigMap
  metadata:
    name: local-ai-valkey-configuration
    namespace: local-ai
    labels:
      app.kubernetes.io/instance: local-ai-valkey
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: valkey
      app.kubernetes.io/part-of: valkey
      helm.toolkit.fluxcd.io/name: local-ai-valkey
      helm.toolkit.fluxcd.io/namespace: flux-system
  data:
    primary.conf: |
      dir /data
      # User-supplied primary configuration:
      rename-command FLUSHDB ""
      rename-command FLUSHALL ""
      # End of primary configuration
    replica.conf: |
      dir /data
      # User-supplied replica configuration:
      rename-command FLUSHDB ""
      rename-command FLUSHALL ""
      # End of replica configuration
    valkey.conf: |
      # User-supplied common configuration:
      # Enable AOF https://valkey.io/docs/topics/persistence.html
      appendonly yes
      # Disable RDB persistence, AOF persistence already enabled.
      save ""
      # End of common configuration

(root level)
+ one document added:
  apiVersion: v1
  kind: ConfigMap
  metadata:
    name: local-ai-valkey-health
    namespace: local-ai
    labels:
      app.kubernetes.io/instance: local-ai-valkey
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: valkey
      helm.toolkit.fluxcd.io/name: local-ai-valkey
      helm.toolkit.fluxcd.io/namespace: flux-system
  data:
    ping_liveness_local.sh: |
      #!/bin/bash
      
      [[ -f $VALKEY_PASSWORD_FILE ]] && export VALKEY_PASSWORD="$(< "${VALKEY_PASSWORD_FILE}")"
      [[ -n "$VALKEY_PASSWORD" ]] && export REDISCLI_AUTH="$VALKEY_PASSWORD"
      response=$(
        timeout -s 15 $1 \
        valkey-cli \
          -h localhost \
          -p $VALKEY_PORT \
          ping
      )
      if [ "$?" -eq "124" ]; then
        echo "Timed out"
        exit 1
      fi
      responseFirstWord=$(echo $response | head -n1 | awk '{print $1;}')
      if [ "$response" != "PONG" ] && [ "$responseFirstWord" != "LOADING" ] && [ "$responseFirstWord" != "MASTERDOWN" ]; then
        echo "$response"
        exit 1
      fi
    ping_liveness_local_and_primary.sh: |
      script_dir="$(dirname "$0")"
      exit_status=0
      "$script_dir/ping_liveness_local.sh" $1 || exit_status=$?
      "$script_dir/ping_liveness_primary.sh" $1 || exit_status=$?
      exit $exit_status
    ping_liveness_primary.sh: |
      #!/bin/bash
      
      [[ -f $VALKEY_PRIMARY_PASSWORD_FILE ]] && export VALKEY_PRIMARY_PASSWORD="$(< "${VALKEY_PRIMARY_PASSWORD_FILE}")"
      [[ -n "$VALKEY_PRIMARY_PASSWORD" ]] && export REDISCLI_AUTH="$VALKEY_PRIMARY_PASSWORD"
      response=$(
        timeout -s 15 $1 \
        valkey-cli \
          -h $VALKEY_PRIMARY_HOST \
          -p $VALKEY_PRIMARY_PORT_NUMBER \
          ping
      )
      if [ "$?" -eq "124" ]; then
        echo "Timed out"
        exit 1
      fi
      responseFirstWord=$(echo $response | head -n1 | awk '{print $1;}')
      if [ "$response" != "PONG" ] && [ "$responseFirstWord" != "LOADING" ]; then
        echo "$response"
        exit 1
      fi
    ping_readiness_local.sh: |
      #!/bin/bash
      
      [[ -f $VALKEY_PASSWORD_FILE ]] && export VALKEY_PASSWORD="$(< "${VALKEY_PASSWORD_FILE}")"
      [[ -n "$VALKEY_PASSWORD" ]] && export REDISCLI_AUTH="$VALKEY_PASSWORD"
      response=$(
        timeout -s 15 $1 \
        valkey-cli \
          -h localhost \
          -p $VALKEY_PORT \
          ping
      )
      if [ "$?" -eq "124" ]; then
        echo "Timed out"
        exit 1
      fi
      if [ "$response" != "PONG" ]; then
        echo "$response"
        exit 1
      fi
    ping_readiness_local_and_primary.sh: |
      script_dir="$(dirname "$0")"
      exit_status=0
      "$script_dir/ping_readiness_local.sh" $1 || exit_status=$?
      "$script_dir/ping_readiness_primary.sh" $1 || exit_status=$?
      exit $exit_status
    ping_readiness_primary.sh: |
      #!/bin/bash
      
      [[ -f $VALKEY_PRIMARY_PASSWORD_FILE ]] && export VALKEY_PRIMARY_PASSWORD="$(< "${VALKEY_PRIMARY_PASSWORD_FILE}")"
      [[ -n "$VALKEY_PRIMARY_PASSWORD" ]] && export REDISCLI_AUTH="$VALKEY_PRIMARY_PASSWORD"
      response=$(
        timeout -s 15 $1 \
        valkey-cli \
          -h $VALKEY_PRIMARY_HOST \
          -p $VALKEY_PRIMARY_PORT_NUMBER \
          ping
      )
      if [ "$?" -eq "124" ]; then
        echo "Timed out"
        exit 1
      fi
      if [ "$response" != "PONG" ]; then
        echo "$response"
        exit 1
      fi
  


(root level)
+ one document added:
  apiVersion: v1
  kind: ConfigMap
  metadata:
    name: local-ai-valkey-scripts
    namespace: local-ai
    labels:
      app.kubernetes.io/instance: local-ai-valkey
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: valkey
      app.kubernetes.io/part-of: valkey
      helm.toolkit.fluxcd.io/name: local-ai-valkey
      helm.toolkit.fluxcd.io/namespace: flux-system
  data:
    start-primary.sh: |
      #!/bin/bash
      
      [[ -f $VALKEY_PASSWORD_FILE ]] && export VALKEY_PASSWORD="$(< "${VALKEY_PASSWORD_FILE}")"
      if [[ -f /opt/bitnami/valkey/mounted-etc/primary.conf ]];then
          cp /opt/bitnami/valkey/mounted-etc/primary.conf /opt/bitnami/valkey/etc/primary.conf
      fi
      if [[ -f /opt/bitnami/valkey/mounted-etc/valkey.conf ]];then
          cp /opt/bitnami/valkey/mounted-etc/valkey.conf /opt/bitnami/valkey/etc/valkey.conf
      fi
      ARGS=("--port" "${VALKEY_PORT}")
      ARGS+=("--protected-mode" "no")
      ARGS+=("--include" "/opt/bitnami/valkey/etc/valkey.conf")
      ARGS+=("--include" "/opt/bitnami/valkey/etc/primary.conf")
      exec valkey-server "${ARGS[@]}"
      
  


(root level)
+ one document added:
  apiVersion: v1
  kind: Service
  metadata:
    name: local-ai-valkey-headless
    namespace: local-ai
    labels:
      app.kubernetes.io/instance: local-ai-valkey
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: valkey
      app.kubernetes.io/part-of: valkey
      helm.toolkit.fluxcd.io/name: local-ai-valkey
      helm.toolkit.fluxcd.io/namespace: flux-system
  spec:
    type: ClusterIP
    clusterIP: None
    selector:
      app.kubernetes.io/instance: local-ai-valkey
      app.kubernetes.io/name: valkey
    ports:
    - name: tcp-redis
      port: 6379
      targetPort: redis

(root level)
+ one document added:
  apiVersion: v1
  kind: Service
  metadata:
    name: local-ai-valkey-primary
    namespace: local-ai
    labels:
      app.kubernetes.io/component: primary
      app.kubernetes.io/instance: local-ai-valkey
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: valkey
      app.kubernetes.io/part-of: valkey
      helm.toolkit.fluxcd.io/name: local-ai-valkey
      helm.toolkit.fluxcd.io/namespace: flux-system
  spec:
    type: ClusterIP
    internalTrafficPolicy: Cluster
    selector:
      app.kubernetes.io/component: primary
      app.kubernetes.io/instance: local-ai-valkey
      app.kubernetes.io/name: valkey
    ports:
    - name: tcp-redis
      nodePort: null
      port: 6379
      targetPort: redis

(root level)
+ one document added:
  apiVersion: apps/v1
  kind: StatefulSet
  metadata:
    name: local-ai-valkey-primary
    namespace: local-ai
    labels:
      app.kubernetes.io/component: primary
      app.kubernetes.io/instance: local-ai-valkey
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: valkey
      app.kubernetes.io/part-of: valkey
      helm.toolkit.fluxcd.io/name: local-ai-valkey
      helm.toolkit.fluxcd.io/namespace: flux-system
  spec:
    replicas: 1
    selector:
      matchLabels:
        app.kubernetes.io/component: primary
        app.kubernetes.io/instance: local-ai-valkey
        app.kubernetes.io/name: valkey
    serviceName: local-ai-valkey-headless
    template:
      metadata:
        labels:
          app.kubernetes.io/component: primary
          app.kubernetes.io/instance: local-ai-valkey
          app.kubernetes.io/managed-by: Helm
          app.kubernetes.io/name: valkey
      spec:
        affinity:
          nodeAffinity: null
          podAffinity: null
          podAntiAffinity:
            preferredDuringSchedulingIgnoredDuringExecution:
            - podAffinityTerm:
                labelSelector:
                  matchLabels:
                    app.kubernetes.io/component: primary
                    app.kubernetes.io/instance: local-ai-valkey
                    app.kubernetes.io/name: valkey
                topologyKey: kubernetes.io/hostname
              weight: 1
        automountServiceAccountToken: false
        containers:
        - name: valkey
          image: "registry-1.docker.io/bitnami/valkey:latest"
          imagePullPolicy: IfNotPresent
          args:
          - "-c"
          - /opt/bitnami/scripts/start-scripts/start-primary.sh
          command:
          - /bin/bash
          env:
          - name: BITNAMI_DEBUG
            value: "false"
          - name: VALKEY_REPLICATION_MODE
            value: primary
          - name: ALLOW_EMPTY_PASSWORD
            value: yes
          - name: OPENSSL_FIPS
            value: yes
          - name: VALKEY_TLS_ENABLED
            value: no
          - name: VALKEY_PORT
            value: "6379"
          ports:
          - name: redis
            containerPort: 6379
          resources:
            limits:
              cpu: 150m
              ephemeral-storage: 2Gi
              memory: 192Mi
            requests:
              cpu: 100m
              ephemeral-storage: 50Mi
              memory: 128Mi
          volumeMounts:
          - name: start-scripts
            mountPath: /opt/bitnami/scripts/start-scripts
          - name: health
            mountPath: /health
          - name: valkey-data
            mountPath: /data
          - name: config
            mountPath: /opt/bitnami/valkey/mounted-etc
          - name: empty-dir
            mountPath: /opt/bitnami/valkey/etc/
            subPath: app-conf-dir
          - name: empty-dir
            mountPath: /tmp
            subPath: tmp-dir
          livenessProbe:
            exec:
              command:
              - sh
              - "-c"
              - "/health/ping_liveness_local.sh 5"
            failureThreshold: 5
            initialDelaySeconds: 20
            periodSeconds: 5
            successThreshold: 1
            timeoutSeconds: 6
          readinessProbe:
            exec:
              command:
              - sh
              - "-c"
              - "/health/ping_readiness_local.sh 1"
            failureThreshold: 5
            initialDelaySeconds: 20
            periodSeconds: 5
            successThreshold: 1
            timeoutSeconds: 2
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
              - ALL
            readOnlyRootFilesystem: true
            runAsGroup: 1001
            runAsNonRoot: true
            runAsUser: 1001
            seLinuxOptions: {}
            seccompProfile:
              type: RuntimeDefault
        enableServiceLinks: true
        securityContext:
          fsGroup: 1001
          fsGroupChangePolicy: Always
          supplementalGroups: []
          sysctls: []
        serviceAccountName: local-ai-valkey-primary
        terminationGracePeriodSeconds: 30
        volumes:
        - name: start-scripts
          configMap:
            name: local-ai-valkey-scripts
            defaultMode: 493
        - name: health
          configMap:
            name: local-ai-valkey-health
            defaultMode: 493
        - name: config
          configMap:
            name: local-ai-valkey-configuration
        - name: empty-dir
          emptyDir: {}
    updateStrategy:
      type: RollingUpdate
    volumeClaimTemplates:
    - apiVersion: v1
      kind: PersistentVolumeClaim
      metadata:
        name: valkey-data
        labels:
          app.kubernetes.io/component: primary
          app.kubernetes.io/instance: local-ai-valkey
          app.kubernetes.io/name: valkey
      spec:
        resources:
          requests:
            storage: 8Gi
        storageClassName: longhorn
        accessModes:
        - ReadWriteOnce

(root level)
+ one document added:
  apiVersion: scheduling.k8s.io/v1
  kind: PriorityClass
  metadata:
    name: longhorn-critical
    labels:
      app.kubernetes.io/instance: longhorn
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: longhorn
      helm.toolkit.fluxcd.io/name: longhorn
      helm.toolkit.fluxcd.io/namespace: flux-system
  description: "Ensure Longhorn pods have the highest priority to prevent any unexpected eviction by the Kubernetes scheduler under node pressure"
  globalDefault: false
  preemptionPolicy: PreemptLowerPriority
  value: 1000000000
  


(root level)
+ one document added:
  apiVersion: v1
  kind: ServiceAccount
  metadata:
    name: longhorn-service-account
    namespace: longhorn-system
    labels:
      app.kubernetes.io/instance: longhorn
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: longhorn
      helm.toolkit.fluxcd.io/name: longhorn
      helm.toolkit.fluxcd.io/namespace: flux-system

(root level)
+ one document added:
  apiVersion: v1
  kind: ServiceAccount
  metadata:
    name: longhorn-ui-service-account
    namespace: longhorn-system
    labels:
      app.kubernetes.io/instance: longhorn
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: longhorn
      helm.toolkit.fluxcd.io/name: longhorn
      helm.toolkit.fluxcd.io/namespace: flux-system

(root level)
+ one document added:
  apiVersion: v1
  kind: ServiceAccount
  metadata:
    name: longhorn-support-bundle
    namespace: longhorn-system
    labels:
      app.kubernetes.io/instance: longhorn
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: longhorn
      helm.toolkit.fluxcd.io/name: longhorn
      helm.toolkit.fluxcd.io/namespace: flux-system

(root level)
+ one document added:
  apiVersion: v1
  kind: ConfigMap
  metadata:
    name: longhorn-default-resource
    namespace: longhorn-system
    labels:
      app.kubernetes.io/instance: longhorn
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: longhorn
      helm.toolkit.fluxcd.io/name: longhorn
      helm.toolkit.fluxcd.io/namespace: flux-system
  data:
    default-resource.yaml: "backup-target: nfs://brickyard.home.arpa:/volume1/k8s/longhorn-backups"
  


(root level)
+ one document added:
  apiVersion: v1
  kind: ConfigMap
  metadata:
    name: longhorn-default-setting
    namespace: longhorn-system
    labels:
      app.kubernetes.io/instance: longhorn
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: longhorn
      helm.toolkit.fluxcd.io/name: longhorn
      helm.toolkit.fluxcd.io/namespace: flux-system
  data:
    default-setting.yaml: |
      priority-class: "longhorn-critical"
      disable-revision-counter: "{\"v1\":\"true\"}"

(root level)
+ one document added:
  apiVersion: v1
  kind: ConfigMap
  metadata:
    name: longhorn-storageclass
    namespace: longhorn-system
    labels:
      app.kubernetes.io/instance: longhorn
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: longhorn
      helm.toolkit.fluxcd.io/name: longhorn
      helm.toolkit.fluxcd.io/namespace: flux-system
  data:
    storageclass.yaml: |
      kind: StorageClass
      apiVersion: storage.k8s.io/v1
      metadata:
        name: longhorn
        annotations:
          storageclass.kubernetes.io/is-default-class: "true"
      provisioner: driver.longhorn.io
      allowVolumeExpansion: true
      reclaimPolicy: "Delete"
      volumeBindingMode: Immediate
      parameters:
        numberOfReplicas: "2"
        staleReplicaTimeout: "30"
        fromBackup: ""
        fsType: "ext4"
        migratable: "true"
        dataLocality: "best-effort"
        unmapMarkSnapChainRemoved: "ignored"
        disableRevisionCounter: "true"
        dataEngine: "v1"
        backupTargetName: "default"


(root level)
+ one document added:
  apiVersion: rbac.authorization.k8s.io/v1
  kind: ClusterRole
  metadata:
    name: longhorn-role
    labels:
      app.kubernetes.io/instance: longhorn
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: longhorn
      helm.toolkit.fluxcd.io/name: longhorn
      helm.toolkit.fluxcd.io/namespace: flux-system
  rules:
  - resources:
    - customresourcedefinitions
    apiGroups:
    - apiextensions.k8s.io
    verbs:
    - "*"
  - resources:
    - pods
    apiGroups:
    -
    verbs:
    - get
    - list
    - watch
    - delete
    - deletecollection
  - resources:
    - secrets
    - services
    - endpoints
    - configmaps
    - serviceaccounts
    - pods/log
    apiGroups:
    -
    verbs:
    - get
    - list
    - watch
  - resources:
    - events
    - persistentvolumes
    - persistentvolumeclaims
    - persistentvolumeclaims/status
    - nodes
    apiGroups:
    -
    verbs:
    - "*"
  - resources:
    - namespaces
    apiGroups:
    -
    verbs:
    - get
    - list
  - resources:
    - daemonsets
    - statefulsets
    - deployments
    - replicasets
    apiGroups:
    - apps
    verbs:
    - get
    - list
    - watch
  - resources:
    - jobs
    - cronjobs
    apiGroups:
    - batch
    verbs:
    - get
    - list
    - watch
  - resources:
    - poddisruptionbudgets
    apiGroups:
    - policy
    verbs:
    - get
    - list
    - watch
  - resources:
    - priorityclasses
    apiGroups:
    - scheduling.k8s.io
    verbs:
    - watch
    - list
  - resources:
    - storageclasses
    - volumeattachments
    - volumeattachments/status
    - volumeattributesclasses
    - csinodes
    - csidrivers
    - csistoragecapacities
    apiGroups:
    - storage.k8s.io
    verbs:
    - "*"
  - resources:
    - volumesnapshotclasses
    - volumesnapshots
    - volumesnapshotcontents
    - volumesnapshotcontents/status
    apiGroups:
    - snapshot.storage.k8s.io
    verbs:
    - "*"
  - resources:
    - volumes
    - volumes/status
    - enginefrontends
    - enginefrontends/status
    - engines
    - engines/status
    - replicas
    - replicas/status
    - settings
    - settings/status
    - engineimages
    - engineimages/status
    - nodes
    - nodes/status
    - instancemanagers
    - instancemanagers/status
    - sharemanagers
    - sharemanagers/status
    - backingimages
    - backingimages/status
    - backingimagemanagers
    - backingimagemanagers/status
    - backingimagedatasources
    - backingimagedatasources/status
    - backuptargets
    - backuptargets/status
    - backupvolumes
    - backupvolumes/status
    - backups
    - backups/status
    - recurringjobs
    - recurringjobs/status
    - orphans
    - orphans/status
    - snapshots
    - snapshots/status
    - supportbundles
    - supportbundles/status
    - systembackups
    - systembackups/status
    - systemrestores
    - systemrestores/status
    - volumeattachments
    - volumeattachments/status
    - backupbackingimages
    - backupbackingimages/status
    apiGroups:
    - longhorn.io
    verbs:
    - "*"
  - resources:
    - leases
    apiGroups:
    - coordination.k8s.io
    verbs:
    - get
    - list
    - watch
  - resources:
    - pods
    - nodes
    apiGroups:
    - metrics.k8s.io
    verbs:
    - get
    - list
  - resources:
    - apiservices
    apiGroups:
    - apiregistration.k8s.io
    verbs:
    - list
    - watch
  - resources:
    - mutatingwebhookconfigurations
    - validatingwebhookconfigurations
    apiGroups:
    - admissionregistration.k8s.io
    verbs:
    - get
    - list
    - create
    - patch
    - delete
  - resources:
    - roles
    - rolebindings
    apiGroups:
    - rbac.authorization.k8s.io
    verbs:
    - get
    - list
    - watch
  - resources:
    - endpointslices
    apiGroups:
    - discovery.k8s.io
    verbs:
    - get
    - list
    - watch
  - resources:
    - clusterrolebindings
    - clusterroles
    apiGroups:
    - rbac.authorization.k8s.io
    verbs:
    - "*"

(root level)
+ one document added:
  apiVersion: rbac.authorization.k8s.io/v1
  kind: ClusterRoleBinding
  metadata:
    name: longhorn-bind
    labels:
      app.kubernetes.io/instance: longhorn
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: longhorn
      helm.toolkit.fluxcd.io/name: longhorn
      helm.toolkit.fluxcd.io/namespace: flux-system
  roleRef:
    name: longhorn-role
    apiGroup: rbac.authorization.k8s.io
    kind: ClusterRole
  subjects:
  - name: longhorn-service-account
    kind: ServiceAccount
    namespace: longhorn-system

(root level)
+ one document added:
  apiVersion: rbac.authorization.k8s.io/v1
  kind: ClusterRoleBinding
  metadata:
    name: longhorn-support-bundle
    labels:
      app.kubernetes.io/instance: longhorn
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: longhorn
      helm.toolkit.fluxcd.io/name: longhorn
      helm.toolkit.fluxcd.io/namespace: flux-system
  roleRef:
    name: cluster-admin
    apiGroup: rbac.authorization.k8s.io
    kind: ClusterRole
  subjects:
  - name: longhorn-support-bundle
    kind: ServiceAccount
    namespace: longhorn-system

(root level)
+ one document added:
  apiVersion: rbac.authorization.k8s.io/v1
  kind: Role
  metadata:
    name: longhorn
    namespace: longhorn-system
    labels:
      app.kubernetes.io/instance: longhorn
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: longhorn
      helm.toolkit.fluxcd.io/name: longhorn
      helm.toolkit.fluxcd.io/namespace: flux-system
  rules:
  - resources:
    - pods
    - pods/log
    - events
    - secrets
    - services
    - endpoints
    - configmaps
    - serviceaccounts
    - persistentvolumeclaims
    - persistentvolumeclaims/status
    apiGroups:
    -
    verbs:
    - "*"
  - resources:
    - daemonsets
    - deployments
    - statefulsets
    - replicasets
    apiGroups:
    - apps
    verbs:
    - "*"
  - resources:
    - jobs
    - cronjobs
    apiGroups:
    - batch
    verbs:
    - "*"
  - resources:
    - poddisruptionbudgets
    apiGroups:
    - policy
    verbs:
    - "*"
  - resources:
    - leases
    apiGroups:
    - coordination.k8s.io
    verbs:
    - "*"
  - resources:
    - roles
    - rolebindings
    apiGroups:
    - rbac.authorization.k8s.io
    verbs:
    - "*"
  - resources:
    - endpointslices
    apiGroups:
    - discovery.k8s.io
    verbs:
    - "*"

(root level)
+ one document added:
  apiVersion: rbac.authorization.k8s.io/v1
  kind: RoleBinding
  metadata:
    name: longhorn
    namespace: longhorn-system
    labels:
      helm.toolkit.fluxcd.io/name: longhorn
      helm.toolkit.fluxcd.io/namespace: flux-system
  roleRef:
    name: longhorn
    apiGroup: rbac.authorization.k8s.io
    kind: Role
  subjects:
  - name: longhorn-service-account
    kind: ServiceAccount
    namespace: longhorn-system

(root level)
+ one document added:
  apiVersion: v1
  kind: Service
  metadata:
    name: longhorn-backend
    namespace: longhorn-system
    labels:
      app: longhorn-manager
      app.kubernetes.io/instance: longhorn
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: longhorn
      helm.toolkit.fluxcd.io/name: longhorn
      helm.toolkit.fluxcd.io/namespace: flux-system
  spec:
    type: ClusterIP
    selector:
      app: longhorn-manager
    ports:
    - name: manager
      port: 9500
      targetPort: manager

(root level)
+ one document added:
  apiVersion: v1
  kind: Service
  metadata:
    name: longhorn-frontend
    namespace: longhorn-system
    labels:
      app: longhorn-ui
      app.kubernetes.io/instance: longhorn
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: longhorn
      helm.toolkit.fluxcd.io/name: longhorn
      helm.toolkit.fluxcd.io/namespace: flux-system
  spec:
    type: ClusterIP
    selector:
      app: longhorn-ui
    ports:
    - name: http
      nodePort: null
      port: 80
      targetPort: http

(root level)
+ one document added:
  apiVersion: v1
  kind: Service
  metadata:
    name: longhorn-admission-webhook
    namespace: longhorn-system
    labels:
      app: longhorn-admission-webhook
      app.kubernetes.io/instance: longhorn
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: longhorn
      helm.toolkit.fluxcd.io/name: longhorn
      helm.toolkit.fluxcd.io/namespace: flux-system
  spec:
    type: ClusterIP
    selector:
      longhorn.io/admission-webhook: longhorn-admission-webhook
    ports:
    - name: admission-webhook
      port: 9502
      targetPort: admission-wh

(root level)
+ one document added:
  apiVersion: v1
  kind: Service
  metadata:
    name: longhorn-recovery-backend
    namespace: longhorn-system
    labels:
      app: longhorn-recovery-backend
      app.kubernetes.io/instance: longhorn
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: longhorn
      helm.toolkit.fluxcd.io/name: longhorn
      helm.toolkit.fluxcd.io/namespace: flux-system
  spec:
    type: ClusterIP
    selector:
      longhorn.io/recovery-backend: longhorn-recovery-backend
    ports:
    - name: recovery-backend
      port: 9503
      targetPort: recov-backend

(root level)
+ one document added:
  apiVersion: apps/v1
  kind: DaemonSet
  metadata:
    name: longhorn-manager
    namespace: longhorn-system
    labels:
      app: longhorn-manager
      app.kubernetes.io/instance: longhorn
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: longhorn
      helm.toolkit.fluxcd.io/name: longhorn
      helm.toolkit.fluxcd.io/namespace: flux-system
  spec:
    selector:
      matchLabels:
        app: longhorn-manager
    template:
      metadata:
        labels:
          app: longhorn-manager
          app.kubernetes.io/instance: longhorn
          app.kubernetes.io/managed-by: Helm
          app.kubernetes.io/name: longhorn
      spec:
        containers:
        - name: longhorn-manager
          image: "docker.io/longhornio/longhorn-manager:v1.12.0"
          imagePullPolicy: IfNotPresent
          command:
          - longhorn-manager
          - "-d"
          - daemon
          - "--engine-image"
          - "docker.io/longhornio/longhorn-engine:v1.12.0"
          - "--instance-manager-image"
          - "docker.io/longhornio/longhorn-instance-manager:v1.12.0"
          - "--share-manager-image"
          - "docker.io/longhornio/longhorn-share-manager:v1.12.0"
          - "--backing-image-manager-image"
          - "docker.io/longhornio/backing-image-manager:v1.12.0"
          - "--support-bundle-manager-image"
          - "docker.io/longhornio/support-bundle-kit:v0.0.86"
          - "--manager-image"
          - "docker.io/longhornio/longhorn-manager:v1.12.0"
          - "--service-account"
          - longhorn-service-account
          - "--upgrade-version-check"
          securityContext:
            privileged: true
          ports:
          - name: manager
            containerPort: 9500
          - name: admission-wh
            containerPort: 9502
          - name: recov-backend
            containerPort: 9503
          readinessProbe:
            httpGet:
              path: /v1/healthz
              port: 9502
              scheme: HTTPS
          volumeMounts:
          - name: boot
            mountPath: /host/boot/
            readOnly: true
          - name: dev
            mountPath: /host/dev/
          - name: proc
            mountPath: /host/proc/
            readOnly: true
          - name: etc
            mountPath: /host/etc/
            readOnly: true
          - name: longhorn
            mountPath: /var/lib/longhorn/
            mountPropagation: Bidirectional
          - name: longhorn-grpc-tls
            mountPath: /tls-files/
          env:
          - name: POD_NAME
            valueFrom:
              fieldRef:
                fieldPath: metadata.name
          - name: POD_NAMESPACE
            valueFrom:
              fieldRef:
                fieldPath: metadata.namespace
          - name: POD_IP
            valueFrom:
              fieldRef:
                fieldPath: status.podIP
          - name: NODE_NAME
            valueFrom:
              fieldRef:
                fieldPath: spec.nodeName
          - name: LONGHORN_DISTRO
            value: longhorn
        - name: pre-pull-share-manager-image
          image: "docker.io/longhornio/longhorn-share-manager:v1.12.0"
          imagePullPolicy: IfNotPresent
          command:
          - sh
          - "-c"
          - "echo share-manager image pulled && sleep infinity"
        priorityClassName: longhorn-critical
        serviceAccountName: longhorn-service-account
        volumes:
        - name: boot
          hostPath:
            path: /boot/
        - name: dev
          hostPath:
            path: /dev/
        - name: proc
          hostPath:
            path: /proc/
        - name: etc
          hostPath:
            path: /etc/
        - name: longhorn
          hostPath:
            path: /var/lib/longhorn/
        - name: longhorn-grpc-tls
          secret:
            optional: true
            secretName: longhorn-grpc-tls
    updateStrategy:
      rollingUpdate:
        maxUnavailable: 100%

(root level)
+ one document added:
  apiVersion: apps/v1
  kind: Deployment
  metadata:
    name: longhorn-driver-deployer
    namespace: longhorn-system
    labels:
      app.kubernetes.io/instance: longhorn
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: longhorn
      helm.toolkit.fluxcd.io/name: longhorn
      helm.toolkit.fluxcd.io/namespace: flux-system
  spec:
    replicas: 1
    selector:
      matchLabels:
        app: longhorn-driver-deployer
    template:
      metadata:
        labels:
          app: longhorn-driver-deployer
          app.kubernetes.io/instance: longhorn
          app.kubernetes.io/managed-by: Helm
          app.kubernetes.io/name: longhorn
      spec:
        containers:
        - name: longhorn-driver-deployer
          image: "docker.io/longhornio/longhorn-manager:v1.12.0"
          imagePullPolicy: IfNotPresent
          command:
          - longhorn-manager
          - "-d"
          - deploy-driver
          - "--manager-image"
          - "docker.io/longhornio/longhorn-manager:v1.12.0"
          - "--manager-url"
          - "http://longhorn-backend:9500/v1"
          env:
          - name: POD_NAMESPACE
            valueFrom:
              fieldRef:
                fieldPath: metadata.namespace
          - name: NODE_NAME
            valueFrom:
              fieldRef:
                fieldPath: spec.nodeName
          - name: SERVICE_ACCOUNT
            valueFrom:
              fieldRef:
                fieldPath: spec.serviceAccountName
          - name: CSI_ATTACHER_IMAGE
            value: "docker.io/longhornio/csi-attacher:v4.12.0"
          - name: CSI_PROVISIONER_IMAGE
            value: "docker.io/longhornio/csi-provisioner:v5.3.0-20260514"
          - name: CSI_NODE_DRIVER_REGISTRAR_IMAGE
            value: "docker.io/longhornio/csi-node-driver-registrar:v2.17.0"
          - name: CSI_RESIZER_IMAGE
            value: "docker.io/longhornio/csi-resizer:v2.1.0-20260514"
          - name: CSI_SNAPSHOTTER_IMAGE
            value: "docker.io/longhornio/csi-snapshotter:v8.5.0-20260514"
          - name: CSI_LIVENESS_PROBE_IMAGE
            value: "docker.io/longhornio/livenessprobe:v2.19.0"
        initContainers:
        - name: wait-longhorn-manager
          image: "docker.io/longhornio/longhorn-manager:v1.12.0"
          command:
          - sh
          - "-c"
          - "while [ $(curl -m 1 -s -o /dev/null -w \"%{http_code}\" http://longhorn-backend:9500/v1) != \"200\" ]; do echo waiting; sleep 2; done"
        priorityClassName: longhorn-critical
        securityContext:
          runAsUser: 0
        serviceAccountName: longhorn-service-account
  


(root level)
+ one document added:
  apiVersion: apps/v1
  kind: Deployment
  metadata:
    name: longhorn-ui
    namespace: longhorn-system
    labels:
      app: longhorn-ui
      app.kubernetes.io/instance: longhorn
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: longhorn
      helm.toolkit.fluxcd.io/name: longhorn
      helm.toolkit.fluxcd.io/namespace: flux-system
  spec:
    replicas: 2
    selector:
      matchLabels:
        app: longhorn-ui
    template:
      metadata:
        labels:
          app: longhorn-ui
          app.kubernetes.io/instance: longhorn
          app.kubernetes.io/managed-by: Helm
          app.kubernetes.io/name: longhorn
      spec:
        affinity:
          podAntiAffinity:
            preferredDuringSchedulingIgnoredDuringExecution:
            - podAffinityTerm:
                labelSelector:
                  matchExpressions:
                  - key: app
                    operator: In
                    values:
                    - longhorn-ui
                topologyKey: kubernetes.io/hostname
              weight: 1
        containers:
        - name: longhorn-ui
          image: "docker.io/longhornio/longhorn-ui:v1.12.0"
          imagePullPolicy: IfNotPresent
          env:
          - name: LONGHORN_MANAGER_IP
            value: "http://longhorn-backend:9500"
          - name: LONGHORN_UI_PORT
            value: "8000"
          ports:
          - name: http
            containerPort: 8000
          volumeMounts:
          - name: nginx-cache
            mountPath: /var/cache/nginx/
          - name: nginx-config
            mountPath: /var/config/nginx/
          - name: var-run
            mountPath: /var/run/
        priorityClassName: longhorn-critical
        serviceAccountName: longhorn-ui-service-account
        volumes:
        - name: nginx-cache
          emptyDir: {}
        - name: nginx-config
          emptyDir: {}
        - name: var-run
          emptyDir: {}

(root level)
+ one document added:
  apiVersion: monitoring.coreos.com/v1
  kind: ServiceMonitor
  metadata:
    name: longhorn-prometheus-servicemonitor
    namespace: longhorn-system
    labels:
      name: longhorn-prometheus-servicemonitor
      app.kubernetes.io/instance: longhorn
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: longhorn
      helm.toolkit.fluxcd.io/name: longhorn
      helm.toolkit.fluxcd.io/namespace: flux-system
  spec:
    endpoints:
    - port: manager
    namespaceSelector:
      matchNames:
      - longhorn-system
    selector:
      matchLabels:
        app: longhorn-manager

(root level)
+ one document added:
  apiVersion: batch/v1
  kind: Job
  metadata:
    name: longhorn-post-upgrade
    namespace: longhorn-system
    annotations:
      helm.sh/hook: post-upgrade
      helm.sh/hook-delete-policy: "hook-succeeded,before-hook-creation"
    labels:
      app.kubernetes.io/instance: longhorn
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: longhorn
  spec:
    activeDeadlineSeconds: 900
    backoffLimit: 1
    template:
      metadata:
        name: longhorn-post-upgrade
        labels:
          app.kubernetes.io/instance: longhorn
          app.kubernetes.io/managed-by: Helm
          app.kubernetes.io/name: longhorn
      spec:
        containers:
        - name: longhorn-post-upgrade
          image: "docker.io/longhornio/longhorn-manager:v1.12.0"
          imagePullPolicy: IfNotPresent
          command:
          - longhorn-manager
          - post-upgrade
          env:
          - name: POD_NAMESPACE
            valueFrom:
              fieldRef:
                fieldPath: metadata.namespace
        priorityClassName: longhorn-critical
        restartPolicy: OnFailure
        serviceAccountName: longhorn-service-account

(root level)
+ one document added:
  apiVersion: batch/v1
  kind: Job
  metadata:
    name: longhorn-pre-upgrade
    namespace: longhorn-system
    annotations:
      helm.sh/hook: pre-upgrade
      helm.sh/hook-delete-policy: "hook-succeeded,before-hook-creation,hook-failed"
    labels:
      app.kubernetes.io/instance: longhorn
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: longhorn
  spec:
    activeDeadlineSeconds: 900
    backoffLimit: 1
    template:
      metadata:
        name: longhorn-pre-upgrade
        labels:
          app.kubernetes.io/instance: longhorn
          app.kubernetes.io/managed-by: Helm
          app.kubernetes.io/name: longhorn
      spec:
        containers:
        - name: longhorn-pre-upgrade
          image: "docker.io/longhornio/longhorn-manager:v1.12.0"
          imagePullPolicy: IfNotPresent
          command:
          - longhorn-manager
          - pre-upgrade
          securityContext:
            privileged: true
          volumeMounts:
          - name: proc
            mountPath: /host/proc/
          env:
          - name: LONGHORN_DISTRO
            value: longhorn
          - name: POD_NAMESPACE
            valueFrom:
              fieldRef:
                fieldPath: metadata.namespace
        restartPolicy: OnFailure
        serviceAccountName: longhorn-service-account
        volumes:
        - name: proc
          hostPath:
            path: /proc/
  


(root level)
+ one document added:
  apiVersion: batch/v1
  kind: Job
  metadata:
    name: longhorn-uninstall
    namespace: longhorn-system
    annotations:
      helm.sh/hook: pre-delete
      helm.sh/hook-delete-policy: "before-hook-creation,hook-succeeded"
    labels:
      app.kubernetes.io/instance: longhorn
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: longhorn
  spec:
    activeDeadlineSeconds: 900
    backoffLimit: 1
    template:
      metadata:
        name: longhorn-uninstall
        labels:
          app.kubernetes.io/instance: longhorn
          app.kubernetes.io/managed-by: Helm
          app.kubernetes.io/name: longhorn
      spec:
        containers:
        - name: longhorn-uninstall
          image: "docker.io/longhornio/longhorn-manager:v1.12.0"
          imagePullPolicy: IfNotPresent
          command:
          - longhorn-manager
          - uninstall
          - "--force"
          env:
          - name: LONGHORN_NAMESPACE
            valueFrom:
              fieldRef:
                fieldPath: metadata.namespace
        priorityClassName: longhorn-critical
        restartPolicy: Never
        serviceAccountName: longhorn-service-account

(root level)
+ one document added:
  apiVersion: v1
  kind: ServiceAccount
  metadata:
    name: memini
    namespace: local-ai
    labels:
      app.kubernetes.io/instance: memini
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: memini
      helm.toolkit.fluxcd.io/name: memini
      helm.toolkit.fluxcd.io/namespace: flux-system

(root level)
+ one document added:
  apiVersion: v1
  kind: ConfigMap
  metadata:
    name: memini-memini
    namespace: local-ai
    annotations:
      grafana_dashboard_folder: memini
      meta.helm.sh/release-name: memini
      meta.helm.sh/release-namespace: local-ai
    labels:
      app.kubernetes.io/instance: memini
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: memini
      grafana_dashboard: "1"
      helm.toolkit.fluxcd.io/name: memini
      helm.toolkit.fluxcd.io/namespace: flux-system
  data:
    memini.json: |
      
      {
        "annotations": {
          "list": []
        },
        "description": "memini \u2014 what the service is actually doing for your agents. Live memory counts, write/recall traffic by tier, consolidation outcomes, store health, embedder & rerank latency & saturation, HTTP surface.",
        "editable": true,
        "graphTooltip": 1,
        "id": null,
        "links": [],
        "panels": [
          {
            "id": 1,
            "type": "row",
            "title": "Now",
            "gridPos": {
              "h": 1,
              "w": 24,
              "x": 0,
              "y": 0
            },
            "collapsed": false,
            "panels": []
          },
          {
            "id": 2,
            "type": "stat",
            "title": "Live memories",
            "description": "Live (non-superseded, non-expired) memories by tier.",
            "datasource": {
              "type": "prometheus",
              "uid": "${DS_PROMETHEUS}"
            },
            "gridPos": {
              "h": 6,
              "w": 6,
              "x": 0,
              "y": 1
            },
            "options": {
              "colorMode": "value",
              "graphMode": "area",
              "justifyMode": "auto",
              "orientation": "horizontal",
              "reduceOptions": {
                "calcs": ["lastNotNull"],
                "fields": "",
                "values": false
              },
              "textMode": "auto"
            },
            "targets": [
              {
                "datasource": {
                  "type": "prometheus",
                  "uid": "${DS_PROMETHEUS}"
                },
                "expr": "memini_memories_active",
                "legendFormat": "{{tier}}",
                "refId": "A"
              }
            ]
          },
          {
            "id": 3,
            "type": "stat",
            "title": "Writes (5m rate)",
            "description": "Successful Remember calls per second, by tier.",
            "datasource": {
              "type": "prometheus",
              "uid": "${DS_PROMETHEUS}"
            },
            "gridPos": {
              "h": 6,
              "w": 6,
              "x": 6,
              "y": 1
            },
            "options": {
              "colorMode": "value",
              "graphMode": "area",
              "justifyMode": "auto",
              "orientation": "horizontal",
              "reduceOptions": {
                "calcs": ["lastNotNull"],
                "fields": "",
                "values": false
              },
              "textMode": "auto"
            },
            "fieldConfig": {
              "defaults": {
                "unit": "ops"
              }
            },
            "targets": [
              {
                "datasource": {
                  "type": "prometheus",
                  "uid": "${DS_PROMETHEUS}"
                },
                "expr": "sum by (tier) (rate(memini_remember_results_total{result=\"ok\"}[5m]))",
                "legendFormat": "{{tier}}",
                "refId": "A"
              }
            ]
          },
          {
            "id": 4,
            "type": "stat",
            "title": "Recalls (5m rate)",
            "description": "Successful Recall calls per second.",
            "datasource": {
              "type": "prometheus",
              "uid": "${DS_PROMETHEUS}"
            },
            "gridPos": {
              "h": 6,
              "w": 6,
              "x": 12,
              "y": 1
            },
            "options": {
              "colorMode": "value",
              "graphMode": "area",
              "justifyMode": "auto",
              "orientation": "horizontal",
              "reduceOptions": {
                "calcs": ["lastNotNull"],
                "fields": "",
                "values": false
              },
              "textMode": "auto"
            },
            "fieldConfig": {
              "defaults": {
                "unit": "ops"
              }
            },
            "targets": [
              {
                "datasource": {
                  "type": "prometheus",
                  "uid": "${DS_PROMETHEUS}"
                },
                "expr": "sum(rate(memini_recall_results_total{result=\"ok\"}[5m]))",
                "legendFormat": "recalls/s",
                "refId": "A"
              }
            ]
          },
          {
            "id": 18,
            "type": "stat",
            "title": "Consolidation queue",
            "description": "Backlog of memories awaiting async consolidation. Sustained > 0 means the worker can't keep up with Remember writes.",
            "datasource": {
              "type": "prometheus",
              "uid": "${DS_PROMETHEUS}"
            },
            "gridPos": {
              "h": 6,
              "w": 6,
              "x": 18,
              "y": 1
            },
            "options": {
              "colorMode": "value",
              "graphMode": "area",
              "justifyMode": "auto",
              "orientation": "horizontal",
              "reduceOptions": {
                "calcs": ["lastNotNull"],
                "fields": "",
                "values": false
              },
              "textMode": "auto"
            },
            "fieldConfig": {
              "defaults": {
                "unit": "short",
                "thresholds": {
                  "mode": "absolute",
                  "steps": [
                    {
                      "color": "green",
                      "value": null
                    },
                    {
                      "color": "yellow",
                      "value": 50
                    },
                    {
                      "color": "red",
                      "value": 500
                    }
                  ]
                }
              }
            },
            "targets": [
              {
                "datasource": {
                  "type": "prometheus",
                  "uid": "${DS_PROMETHEUS}"
                },
                "expr": "memini_consolidate_queue_depth",
                "legendFormat": "queued",
                "refId": "A"
              }
            ]
          },
          {
            "id": 5,
            "type": "row",
            "title": "Writes & Recalls",
            "gridPos": {
              "h": 1,
              "w": 24,
              "x": 0,
              "y": 7
            },
            "collapsed": false,
            "panels": []
          },
          {
            "id": 6,
            "type": "timeseries",
            "title": "Remembers per second (by tier)",
            "datasource": {
              "type": "prometheus",
              "uid": "${DS_PROMETHEUS}"
            },
            "gridPos": {
              "h": 8,
              "w": 12,
              "x": 0,
              "y": 8
            },
            "fieldConfig": {
              "defaults": {
                "custom": {
                  "drawStyle": "line",
                  "lineInterpolation": "smooth",
                  "fillOpacity": 10,
                  "showPoints": "never"
                },
                "unit": "ops"
              }
            },
            "options": {
              "legend": {
                "displayMode": "table",
                "placement": "bottom",
                "showLegend": true,
                "calcs": ["mean", "max"]
              },
              "tooltip": {
                "mode": "multi",
                "sort": "desc"
              }
            },
            "targets": [
              {
                "datasource": {
                  "type": "prometheus",
                  "uid": "${DS_PROMETHEUS}"
                },
                "expr": "sum by (tier) (rate(memini_remember_results_total{result=\"ok\"}[5m]))",
                "legendFormat": "{{tier}}",
                "refId": "A"
              }
            ]
          },
          {
            "id": 7,
            "type": "timeseries",
            "title": "Recalls per second (by hit-count bucket)",
            "description": "How many memories a typical recall returns. '0' means no matches \u2014 investigate if persistent.",
            "datasource": {
              "type": "prometheus",
              "uid": "${DS_PROMETHEUS}"
            },
            "gridPos": {
              "h": 8,
              "w": 12,
              "x": 12,
              "y": 8
            },
            "fieldConfig": {
              "defaults": {
                "custom": {
                  "drawStyle": "line",
                  "lineInterpolation": "smooth",
                  "fillOpacity": 10,
                  "showPoints": "never"
                },
                "unit": "ops"
              }
            },
            "options": {
              "legend": {
                "displayMode": "table",
                "placement": "bottom",
                "showLegend": true,
                "calcs": ["mean", "max"]
              },
              "tooltip": {
                "mode": "multi",
                "sort": "desc"
              }
            },
            "targets": [
              {
                "datasource": {
                  "type": "prometheus",
                  "uid": "${DS_PROMETHEUS}"
                },
                "expr": "sum by (hits_bucket) (rate(memini_recall_results_total{result=\"ok\"}[5m]))",
                "legendFormat": "{{hits_bucket}}",
                "refId": "A"
              }
            ]
          },
          {
            "id": 19,
            "type": "row",
            "title": "Retrieval quality",
            "gridPos": {
              "h": 1,
              "w": 24,
              "x": 0,
              "y": 16
            },
            "collapsed": false,
            "panels": []
          },
          {
            "id": 20,
            "type": "timeseries",
            "title": "Rerank outcomes by backend",
            "description": "Per-recall reranker traffic: ok = reranker reordered the fused candidates; fallback = reranker timed out / errored and the fused order was kept.",
            "datasource": {
              "type": "prometheus",
              "uid": "${DS_PROMETHEUS}"
            },
            "gridPos": {
              "h": 8,
              "w": 12,
              "x": 0,
              "y": 17
            },
            "fieldConfig": {
              "defaults": {
                "custom": {
                  "drawStyle": "line",
                  "lineInterpolation": "smooth",
                  "fillOpacity": 15,
                  "showPoints": "never"
                },
                "unit": "ops"
              }
            },
            "options": {
              "legend": {
                "displayMode": "table",
                "placement": "bottom",
                "showLegend": true,
                "calcs": ["mean", "max"]
              },
              "tooltip": {
                "mode": "multi",
                "sort": "desc"
              }
            },
            "targets": [
              {
                "datasource": {
                  "type": "prometheus",
                  "uid": "${DS_PROMETHEUS}"
                },
                "expr": "sum by (backend, result) (rate(memini_rerank_results_total[5m]))",
                "legendFormat": "{{backend}}/{{result}}",
                "refId": "A"
              }
            ]
          },
          {
            "id": 21,
            "type": "timeseries",
            "title": "Recall degradation reasons",
            "description": "Recalls that fell back to keyword-only search because the embedder was slow or errored. embed_timeout = the recall embed budget elapsed; embed_error = the embed call failed.",
            "datasource": {
              "type": "prometheus",
              "uid": "${DS_PROMETHEUS}"
            },
            "gridPos": {
              "h": 8,
              "w": 12,
              "x": 12,
              "y": 17
            },
            "fieldConfig": {
              "defaults": {
                "custom": {
                  "drawStyle": "line",
                  "lineInterpolation": "smooth",
                  "fillOpacity": 15,
                  "showPoints": "never"
                },
                "unit": "ops"
              }
            },
            "options": {
              "legend": {
                "displayMode": "table",
                "placement": "bottom",
                "showLegend": true,
                "calcs": ["mean", "max"]
              },
              "tooltip": {
                "mode": "multi",
                "sort": "desc"
              }
            },
            "targets": [
              {
                "datasource": {
                  "type": "prometheus",
                  "uid": "${DS_PROMETHEUS}"
                },
                "expr": "sum by (reason) (rate(memini_recall_degraded_total[5m]))",
                "legendFormat": "{{reason}}",
                "refId": "A"
              }
            ]
          },
          {
            "id": 22,
            "type": "timeseries",
            "title": "Recall reinforcement (best-effort)",
            "description": "Background access-count bump on recalled memories. Errors are swallowed \u2014 a sustained nonzero error rate means the store write path is unhealthy but recall still served.",
            "datasource": {
              "type": "prometheus",
              "uid": "${DS_PROMETHEUS}"
            },
            "gridPos": {
              "h": 8,
              "w": 12,
              "x": 0,
              "y": 25
            },
            "fieldConfig": {
              "defaults": {
                "custom": {
                  "drawStyle": "line",
                  "lineInterpolation": "smooth",
                  "fillOpacity": 15,
                  "showPoints": "never"
                },
                "unit": "ops"
              }
            },
            "options": {
              "legend": {
                "displayMode": "table",
                "placement": "bottom",
                "showLegend": true,
                "calcs": ["mean", "max"]
              },
              "tooltip": {
                "mode": "multi",
                "sort": "desc"
              }
            },
            "targets": [
              {
                "datasource": {
                  "type": "prometheus",
                  "uid": "${DS_PROMETHEUS}"
                },
                "expr": "sum by (result) (rate(memini_reinforce_results_total[5m]))",
                "legendFormat": "{{result}}",
                "refId": "A"
              }
            ]
          },
          {
            "id": 23,
            "type": "stat",
            "title": "Recall success ratio",
            "description": "Fraction of recall calls that succeeded. A drop means the recall path is erroring (embed + keyword + rerank + RRF + everything).",
            "datasource": {
              "type": "prometheus",
              "uid": "${DS_PROMETHEUS}"
            },
            "gridPos": {
              "h": 8,
              "w": 12,
              "x": 12,
              "y": 25
            },
            "options": {
              "colorMode": "value",
              "graphMode": "area",
              "reduceOptions": {
                "calcs": ["lastNotNull"],
                "fields": "",
                "values": false
              },
              "textMode": "auto"
            },
            "fieldConfig": {
              "defaults": {
                "unit": "percentunit",
                "min": 0,
                "max": 1,
                "thresholds": {
                  "mode": "absolute",
                  "steps": [
                    {
                      "color": "red",
                      "value": null
                    },
                    {
                      "color": "yellow",
                      "value": 0.95
                    },
                    {
                      "color": "green",
                      "value": 0.99
                    }
                  ]
                }
              }
            },
            "targets": [
              {
                "datasource": {
                  "type": "prometheus",
                  "uid": "${DS_PROMETHEUS}"
                },
                "expr": "sum(rate(memini_recall_results_total{result=\"ok\"}[15m])) / clamp_min(sum(rate(memini_recall_results_total[15m])), 1e-9)",
                "legendFormat": "ok ratio",
                "refId": "A"
              }
            ]
          },
          {
            "id": 8,
            "type": "row",
            "title": "Consolidation (LLM dedup)",
            "gridPos": {
              "h": 1,
              "w": 24,
              "x": 0,
              "y": 33
            },
            "collapsed": false,
            "panels": []
          },
          {
            "id": 9,
            "type": "timeseries",
            "title": "Consolidation outcomes per minute",
            "description": "gated = similarity gate skipped the LLM; new = nothing to merge; update = merged into an existing memory; supersede = contradiction-tombstoned an old one; noop = nothing to do; error/dropped = failure modes.",
            "datasource": {
              "type": "prometheus",
              "uid": "${DS_PROMETHEUS}"
            },
            "gridPos": {
              "h": 8,
              "w": 16,
              "x": 0,
              "y": 34
            },
            "fieldConfig": {
              "defaults": {
                "custom": {
                  "drawStyle": "line",
                  "lineInterpolation": "smooth",
                  "fillOpacity": 20,
                  "showPoints": "never",
                  "stacking": {
                    "mode": "normal"
                  }
                },
                "unit": "ops"
              }
            },
            "options": {
              "legend": {
                "displayMode": "table",
                "placement": "right",
                "showLegend": true,
                "calcs": ["sum"]
              },
              "tooltip": {
                "mode": "multi",
                "sort": "desc"
              }
            },
            "targets": [
              {
                "datasource": {
                  "type": "prometheus",
                  "uid": "${DS_PROMETHEUS}"
                },
                "expr": "sum by (result) (rate(memini_consolidate_results_total[5m]))",
                "legendFormat": "{{result}}",
                "refId": "A"
              }
            ]
          },
          {
            "id": 10,
            "type": "stat",
            "title": "Dedup effectiveness",
            "description": "Fraction of consolidations that actually used the LLM (update+supersede+new+noop) vs the similarity gate skipping it. Higher = busier corpus or noisier dedup signal.",
            "datasource": {
              "type": "prometheus",
              "uid": "${DS_PROMETHEUS}"
            },
            "gridPos": {
              "h": 8,
              "w": 8,
              "x": 16,
              "y": 34
            },
            "options": {
              "colorMode": "value",
              "graphMode": "area",
              "reduceOptions": {
                "calcs": ["lastNotNull"],
                "fields": "",
                "values": false
              },
              "textMode": "auto"
            },
            "fieldConfig": {
              "defaults": {
                "unit": "percentunit",
                "min": 0,
                "max": 1
              }
            },
            "targets": [
              {
                "datasource": {
                  "type": "prometheus",
                  "uid": "${DS_PROMETHEUS}"
                },
                "expr": "sum(rate(memini_consolidate_results_total{result=~\"update|supersede|new|noop\"}[15m])) / clamp_min(sum(rate(memini_consolidate_results_total{result!~\"error|dropped\"}[15m])), 1e-9)",
                "legendFormat": "LLM use ratio",
                "refId": "A"
              }
            ]
          },
          {
            "id": 11,
            "type": "row",
            "title": "Storage & decay",
            "gridPos": {
              "h": 1,
              "w": 24,
              "x": 0,
              "y": 42
            },
            "collapsed": false,
            "panels": []
          },
          {
            "id": 12,
            "type": "timeseries",
            "title": "Live memories by tier",
            "datasource": {
              "type": "prometheus",
              "uid": "${DS_PROMETHEUS}"
            },
            "gridPos": {
              "h": 8,
              "w": 12,
              "x": 0,
              "y": 43
            },
            "fieldConfig": {
              "defaults": {
                "custom": {
                  "drawStyle": "line",
                  "lineInterpolation": "stepAfter",
                  "fillOpacity": 15,
                  "showPoints": "never",
                  "stacking": {
                    "mode": "normal"
                  }
                },
                "unit": "short"
              }
            },
            "options": {
              "legend": {
                "displayMode": "table",
                "placement": "right",
                "showLegend": true,
                "calcs": ["mean", "max"]
              },
              "tooltip": {
                "mode": "multi",
                "sort": "desc"
              }
            },
            "targets": [
              {
                "datasource": {
                  "type": "prometheus",
                  "uid": "${DS_PROMETHEUS}"
                },
                "expr": "memini_memories_active",
                "legendFormat": "{{tier}}",
                "refId": "A"
              }
            ]
          },
          {
            "id": 13,
            "type": "timeseries",
            "title": "Decay sweep + tombstones (per minute)",
            "description": "Swept = memories purged by TTL; soft deletes = contradictions tombstoned by consolidation; dedup tombstones = tombstoned by the periodic dedup pass.",
            "datasource": {
              "type": "prometheus",
              "uid": "${DS_PROMETHEUS}"
            },
            "gridPos": {
              "h": 8,
              "w": 12,
              "x": 12,
              "y": 43
            },
            "fieldConfig": {
              "defaults": {
                "custom": {
                  "drawStyle": "line",
                  "lineInterpolation": "stepAfter",
                  "fillOpacity": 15,
                  "showPoints": "never"
                },
                "unit": "ops"
              }
            },
            "options": {
              "legend": {
                "displayMode": "table",
                "placement": "bottom",
                "showLegend": true,
                "calcs": ["sum"]
              },
              "tooltip": {
                "mode": "multi",
                "sort": "desc"
              }
            },
            "targets": [
              {
                "datasource": {
                  "type": "prometheus",
                  "uid": "${DS_PROMETHEUS}"
                },
                "expr": "sum by (tier) (rate(memini_store_swept_total[5m]))",
                "legendFormat": "swept/{{tier}}",
                "refId": "A"
              },
              {
                "datasource": {
                  "type": "prometheus",
                  "uid": "${DS_PROMETHEUS}"
                },
                "expr": "rate(memini_store_soft_deletes_total[5m])",
                "legendFormat": "consolidate tombstones",
                "refId": "B"
              },
              {
                "datasource": {
                  "type": "prometheus",
                  "uid": "${DS_PROMETHEUS}"
                },
                "expr": "rate(memini_dedup_tombstoned_total[5m])",
                "legendFormat": "dedup tombstones",
                "refId": "C"
              }
            ]
          },
          {
            "id": 14,
            "type": "row",
            "title": "Embedder & rerank",
            "gridPos": {
              "h": 1,
              "w": 24,
              "x": 0,
              "y": 51
            },
            "collapsed": false,
            "panels": []
          },
          {
            "id": 15,
            "type": "timeseries",
            "title": "Embedder p95 latency (by backend)",
            "description": "openai = real network calls; cached/diskcache/batched = local cache or fan-out; disabled = no endpoint configured.",
            "datasource": {
              "type": "prometheus",
              "uid": "${DS_PROMETHEUS}"
            },
            "gridPos": {
              "h": 8,
              "w": 12,
              "x": 0,
              "y": 52
            },
            "fieldConfig": {
              "defaults": {
                "custom": {
                  "drawStyle": "line",
                  "lineInterpolation": "smooth",
                  "fillOpacity": 10,
                  "showPoints": "never"
                },
                "unit": "s"
              }
            },
            "options": {
              "legend": {
                "displayMode": "table",
                "placement": "bottom",
                "showLegend": true,
                "calcs": ["mean", "max"]
              },
              "tooltip": {
                "mode": "multi",
                "sort": "desc"
              }
            },
            "targets": [
              {
                "datasource": {
                  "type": "prometheus",
                  "uid": "${DS_PROMETHEUS}"
                },
                "expr": "histogram_quantile(0.95, sum by (backend, le) (rate(memini_embed_duration_seconds_bucket[5m])))",
                "legendFormat": "p95 {{backend}}",
                "refId": "A"
              }
            ]
          },
          {
            "id": 16,
            "type": "timeseries",
            "title": "Embedder tokens + error rate",
            "datasource": {
              "type": "prometheus",
              "uid": "${DS_PROMETHEUS}"
            },
            "gridPos": {
              "h": 8,
              "w": 12,
              "x": 12,
              "y": 52
            },
            "fieldConfig": {
              "defaults": {
                "custom": {
                  "drawStyle": "line",
                  "lineInterpolation": "smooth",
                  "fillOpacity": 10,
                  "showPoints": "never"
                }
              }
            },
            "options": {
              "legend": {
                "displayMode": "table",
                "placement": "bottom",
                "showLegend": true,
                "calcs": ["mean", "max"]
              },
              "tooltip": {
                "mode": "multi",
                "sort": "desc"
              }
            },
            "targets": [
              {
                "datasource": {
                  "type": "prometheus",
                  "uid": "${DS_PROMETHEUS}"
                },
                "expr": "sum by (backend) (rate(memini_embed_tokens_total[5m]))",
                "legendFormat": "tokens/s {{backend}}",
                "refId": "A"
              },
              {
                "datasource": {
                  "type": "prometheus",
                  "uid": "${DS_PROMETHEUS}"
                },
                "expr": "sum by (backend) (rate(memini_embed_errors_total[5m]))",
                "legendFormat": "err/s {{backend}}",
                "refId": "B"
              }
            ]
          },
          {
            "id": 24,
            "type": "stat",
            "title": "Embedder in-flight",
            "description": "Concurrent embed calls against the backend (post-cap, excludes cache hits). Spikes during ingest storms are normal; sustained values near the cap mean the embedder is the bottleneck.",
            "datasource": {
              "type": "prometheus",
              "uid": "${DS_PROMETHEUS}"
            },
            "gridPos": {
              "h": 4,
              "w": 8,
              "x": 0,
              "y": 60
            },
            "options": {
              "colorMode": "value",
              "graphMode": "area",
              "justifyMode": "auto",
              "orientation": "horizontal",
              "reduceOptions": {
                "calcs": ["lastNotNull"],
                "fields": "",
                "values": false
              },
              "textMode": "auto"
            },
            "fieldConfig": {
              "defaults": {
                "unit": "short"
              }
            },
            "targets": [
              {
                "datasource": {
                  "type": "prometheus",
                  "uid": "${DS_PROMETHEUS}"
                },
                "expr": "memini_embed_in_flight",
                "legendFormat": "embed in-flight",
                "refId": "A"
              }
            ]
          },
          {
            "id": 25,
            "type": "stat",
            "title": "Rerank in-flight",
            "description": "Concurrent rerank calls. A nonzero value indicates rerank is configured; if this stays pinned at the cap, the reranker is the bottleneck.",
            "datasource": {
              "type": "prometheus",
              "uid": "${DS_PROMETHEUS}"
            },
            "gridPos": {
              "h": 4,
              "w": 8,
              "x": 8,
              "y": 60
            },
            "options": {
              "colorMode": "value",
              "graphMode": "area",
              "justifyMode": "auto",
              "orientation": "horizontal",
              "reduceOptions": {
                "calcs": ["lastNotNull"],
                "fields": "",
                "values": false
              },
              "textMode": "auto"
            },
            "fieldConfig": {
              "defaults": {
                "unit": "short"
              }
            },
            "targets": [
              {
                "datasource": {
                  "type": "prometheus",
                  "uid": "${DS_PROMETHEUS}"
                },
                "expr": "memini_rerank_in_flight",
                "legendFormat": "rerank in-flight",
                "refId": "A"
              }
            ]
          },
          {
            "id": 26,
            "type": "timeseries",
            "title": "Embedder batch size (p50 vs p95)",
            "description": "Items per embed call, by backend. batched shows a single high-p95 bar; cached should be ~1.",
            "datasource": {
              "type": "prometheus",
              "uid": "${DS_PROMETHEUS}"
            },
            "gridPos": {
              "h": 4,
              "w": 8,
              "x": 16,
              "y": 60
            },
            "fieldConfig": {
              "defaults": {
                "custom": {
                  "drawStyle": "line",
                  "lineInterpolation": "smooth",
                  "fillOpacity": 5,
                  "showPoints": "never"
                }
              }
            },
            "options": {
              "legend": {
                "displayMode": "list",
                "placement": "bottom",
                "showLegend": true,
                "calcs": ["mean"]
              },
              "tooltip": {
                "mode": "multi",
                "sort": "desc"
              }
            },
            "targets": [
              {
                "datasource": {
                  "type": "prometheus",
                  "uid": "${DS_PROMETHEUS}"
                },
                "expr": "histogram_quantile(0.5, sum by (backend, le) (rate(memini_embed_items_bucket[5m])))",
                "legendFormat": "p50 {{backend}}",
                "refId": "A"
              },
              {
                "datasource": {
                  "type": "prometheus",
                  "uid": "${DS_PROMETHEUS}"
                },
                "expr": "histogram_quantile(0.95, sum by (backend, le) (rate(memini_embed_items_bucket[5m])))",
                "legendFormat": "p95 {{backend}}",
                "refId": "B"
              }
            ]
          },
          {
            "id": 27,
            "type": "row",
            "title": "HTTP surface",
            "gridPos": {
              "h": 1,
              "w": 24,
              "x": 0,
              "y": 64
            },
            "collapsed": false,
            "panels": []
          },
          {
            "id": 28,
            "type": "timeseries",
            "title": "HTTP requests by route (status class)",
            "description": "Per-route request rate broken down by 2xx / 4xx / 5xx. 5xx spikes point at a broken handler; 4xx spikes usually mean client misuse or a misconfigured agent.",
            "datasource": {
              "type": "prometheus",
              "uid": "${DS_PROMETHEUS}"
            },
            "gridPos": {
              "h": 8,
              "w": 16,
              "x": 0,
              "y": 65
            },
            "fieldConfig": {
              "defaults": {
                "custom": {
                  "drawStyle": "line",
                  "lineInterpolation": "smooth",
                  "fillOpacity": 15,
                  "showPoints": "never",
                  "stacking": {
                    "mode": "normal"
                  }
                },
                "unit": "ops"
              }
            },
            "options": {
              "legend": {
                "displayMode": "table",
                "placement": "right",
                "showLegend": true,
                "calcs": ["mean", "max"]
              },
              "tooltip": {
                "mode": "multi",
                "sort": "desc"
              }
            },
            "targets": [
              {
                "datasource": {
                  "type": "prometheus",
                  "uid": "${DS_PROMETHEUS}"
                },
                "expr": "sum by (route, status) (label_replace(rate(memini_http_requests_total[5m]), \"status_class\", \"$1\", \"status\", \"(...).\"))",
                "legendFormat": "{{route}} {{status_class}}xx",
                "refId": "A"
              }
            ]
          },
          {
            "id": 29,
            "type": "timeseries",
            "title": "HTTP p95 latency by route",
            "datasource": {
              "type": "prometheus",
              "uid": "${DS_PROMETHEUS}"
            },
            "gridPos": {
              "h": 8,
              "w": 8,
              "x": 16,
              "y": 65
            },
            "fieldConfig": {
              "defaults": {
                "custom": {
                  "drawStyle": "line",
                  "lineInterpolation": "smooth",
                  "fillOpacity": 10,
                  "showPoints": "never"
                },
                "unit": "s"
              }
            },
            "options": {
              "legend": {
                "displayMode": "table",
                "placement": "bottom",
                "showLegend": true,
                "calcs": ["mean", "max"]
              },
              "tooltip": {
                "mode": "multi",
                "sort": "desc"
              }
            },
            "targets": [
              {
                "datasource": {
                  "type": "prometheus",
                  "uid": "${DS_PROMETHEUS}"
                },
                "expr": "histogram_quantile(0.95, sum by (route, le) (rate(memini_http_request_duration_seconds_bucket[5m])))",
                "legendFormat": "p95 {{route}}",
                "refId": "A"
              }
            ]
          },
          {
            "id": 17,
            "type": "timeseries",
            "title": "End-to-end op latency p95 (by op)",
            "datasource": {
              "type": "prometheus",
              "uid": "${DS_PROMETHEUS}"
            },
            "gridPos": {
              "h": 8,
              "w": 16,
              "x": 0,
              "y": 73
            },
            "fieldConfig": {
              "defaults": {
                "custom": {
                  "drawStyle": "line",
                  "lineInterpolation": "smooth",
                  "fillOpacity": 5,
                  "showPoints": "never"
                },
                "unit": "s"
              }
            },
            "options": {
              "legend": {
                "displayMode": "table",
                "placement": "right",
                "showLegend": true,
                "calcs": ["mean", "max"]
              },
              "tooltip": {
                "mode": "multi",
                "sort": "desc"
              }
            },
            "targets": [
              {
                "datasource": {
                  "type": "prometheus",
                  "uid": "${DS_PROMETHEUS}"
                },
                "expr": "histogram_quantile(0.95, sum by (op, le) (rate(memini_op_duration_seconds_bucket[5m])))",
                "legendFormat": "{{op}}",
                "refId": "A"
              }
            ]
          },
          {
            "id": 34,
            "type": "timeseries",
            "title": "HTTP response size by route (p50/p90)",
            "description": "Body bytes shipped per response. The recall/briefing routes are what hooks inject from — watch these when tuning context-injection volume.",
            "datasource": {
              "type": "prometheus",
              "uid": "${DS_PROMETHEUS}"
            },
            "gridPos": {
              "h": 8,
              "w": 8,
              "x": 16,
              "y": 73
            },
            "fieldConfig": {
              "defaults": {
                "custom": {
                  "drawStyle": "line",
                  "lineInterpolation": "smooth",
                  "fillOpacity": 10,
                  "showPoints": "never"
                },
                "unit": "bytes"
              }
            },
            "options": {
              "legend": {
                "displayMode": "table",
                "placement": "bottom",
                "showLegend": true,
                "calcs": ["mean", "max"]
              },
              "tooltip": {
                "mode": "multi",
                "sort": "desc"
              }
            },
            "targets": [
              {
                "datasource": {
                  "type": "prometheus",
                  "uid": "${DS_PROMETHEUS}"
                },
                "expr": "histogram_quantile(0.90, sum by (route, le) (rate(memini_http_response_bytes_bucket{route=~\"/v1/search|/v1/namespaces/briefing\"}[5m])))",
                "legendFormat": "p90 {{route}}",
                "refId": "A"
              },
              {
                "datasource": {
                  "type": "prometheus",
                  "uid": "${DS_PROMETHEUS}"
                },
                "expr": "histogram_quantile(0.50, sum by (route, le) (rate(memini_http_response_bytes_bucket{route=~\"/v1/search|/v1/namespaces/briefing\"}[5m])))",
                "legendFormat": "p50 {{route}}",
                "refId": "B"
              }
            ]
          },
          {
            "id": 30,
            "type": "row",
            "title": "Write-path signals",
            "collapsed": false,
            "gridPos": {
              "h": 1,
              "w": 24,
              "x": 0,
              "y": 82
            },
            "panels": []
          },
          {
            "id": 31,
            "type": "timeseries",
            "title": "Corroboration routing",
            "description": "A fresh short-term write restating a durable fact: corroborated (confidence grown), cooldown (inside the 24h per-fact window), miss (no durable neighbour), error.",
            "datasource": {
              "type": "prometheus",
              "uid": "${DS_PROMETHEUS}"
            },
            "gridPos": {
              "h": 8,
              "w": 12,
              "x": 0,
              "y": 83
            },
            "fieldConfig": {
              "defaults": {
                "custom": {
                  "drawStyle": "line",
                  "lineInterpolation": "smooth",
                  "fillOpacity": 10,
                  "showPoints": "never"
                },
                "unit": "short"
              }
            },
            "options": {
              "legend": {
                "displayMode": "table",
                "placement": "bottom",
                "showLegend": true,
                "calcs": ["mean", "max"]
              },
              "tooltip": {
                "mode": "multi",
                "sort": "desc"
              }
            },
            "targets": [
              {
                "datasource": {
                  "type": "prometheus",
                  "uid": "${DS_PROMETHEUS}"
                },
                "expr": "sum by (result) (rate(memini_corroborate_results_total[5m]))",
                "legendFormat": "{{result}}",
                "refId": "A"
              }
            ]
          },
          {
            "id": 33,
            "type": "timeseries",
            "title": "Contradiction routing",
            "description": "A fresh durable write that changes a fact's value or flips its polarity: contradicted (stale fact invalidated via valid_to + confidence shrink), no_signal (durable neighbour found but not a real change), cooldown (inside the 24h per-fact window), miss (no durable neighbour), error. Default-on; a contradicted rate far above expectation is the misfire smoke alarm (set MEMINI_CONTRADICT_DOWNRANK=false to disable).",
            "datasource": {
              "type": "prometheus",
              "uid": "${DS_PROMETHEUS}"
            },
            "gridPos": {
              "h": 8,
              "w": 12,
              "x": 0,
              "y": 91
            },
            "fieldConfig": {
              "defaults": {
                "custom": {
                  "drawStyle": "line",
                  "lineInterpolation": "smooth",
                  "fillOpacity": 10,
                  "showPoints": "never"
                },
                "unit": "short"
              }
            },
            "options": {
              "legend": {
                "displayMode": "table",
                "placement": "bottom",
                "showLegend": true,
                "calcs": ["mean", "max"]
              },
              "tooltip": {
                "mode": "multi",
                "sort": "desc"
              }
            },
            "targets": [
              {
                "datasource": {
                  "type": "prometheus",
                  "uid": "${DS_PROMETHEUS}"
                },
                "expr": "sum by (result) (rate(memini_contradict_results_total[5m]))",
                "legendFormat": "{{result}}",
                "refId": "A"
              }
            ]
          },
          {
            "id": 32,
            "type": "timeseries",
            "title": "Tier classification & promotion",
            "description": "Omitted-tier writes the marker classifier routed to a durable tier, and facts produced by the promotion pass (LLM or marker extractor).",
            "datasource": {
              "type": "prometheus",
              "uid": "${DS_PROMETHEUS}"
            },
            "gridPos": {
              "h": 8,
              "w": 12,
              "x": 12,
              "y": 83
            },
            "fieldConfig": {
              "defaults": {
                "custom": {
                  "drawStyle": "line",
                  "lineInterpolation": "smooth",
                  "fillOpacity": 10,
                  "showPoints": "never"
                },
                "unit": "short"
              }
            },
            "options": {
              "legend": {
                "displayMode": "table",
                "placement": "bottom",
                "showLegend": true,
                "calcs": ["mean", "max"]
              },
              "tooltip": {
                "mode": "multi",
                "sort": "desc"
              }
            },
            "targets": [
              {
                "datasource": {
                  "type": "prometheus",
                  "uid": "${DS_PROMETHEUS}"
                },
                "expr": "sum by (tier) (rate(memini_tier_classified_total[5m]))",
                "legendFormat": "classified -> {{tier}}",
                "refId": "A"
              },
              {
                "datasource": {
                  "type": "prometheus",
                  "uid": "${DS_PROMETHEUS}"
                },
                "expr": "sum(rate(memini_promote_facts_total[5m]))",
                "legendFormat": "promoted facts",
                "refId": "B"
              }
            ]
          },
          {
            "id": 40,
            "type": "row",
            "title": "Injection efficiency (client telemetry)",
            "collapsed": false,
            "gridPos": {
              "h": 1,
              "w": 24,
              "x": 0,
              "y": 99
            },
            "panels": []
          },
          {
            "id": 41,
            "type": "timeseries",
            "title": "Injection outcomes (by result)",
            "description": "What hooks reported actually reaching model context vs held back by their local gates (seen/cooldown/budget/unchanged/score). Absent entirely means no integration is reporting.",
            "datasource": {
              "type": "prometheus",
              "uid": "${DS_PROMETHEUS}"
            },
            "gridPos": {
              "h": 8,
              "w": 8,
              "x": 0,
              "y": 100
            },
            "fieldConfig": {
              "defaults": {
                "custom": {
                  "drawStyle": "line",
                  "lineInterpolation": "smooth",
                  "fillOpacity": 10,
                  "showPoints": "never",
                  "stacking": {
                    "mode": "normal"
                  }
                }
              }
            },
            "options": {
              "legend": {
                "displayMode": "table",
                "placement": "bottom",
                "showLegend": true,
                "calcs": ["mean", "max"]
              },
              "tooltip": {
                "mode": "multi",
                "sort": "desc"
              }
            },
            "targets": [
              {
                "datasource": {
                  "type": "prometheus",
                  "uid": "${DS_PROMETHEUS}"
                },
                "expr": "sum by (result) (rate(memini_injected_memories_total[5m]))",
                "legendFormat": "{{result}}",
                "refId": "A"
              }
            ]
          },
          {
            "id": 42,
            "type": "timeseries",
            "title": "Injected memories (by surface)",
            "description": "Memories that reached context, split by which hook surface put them there.",
            "datasource": {
              "type": "prometheus",
              "uid": "${DS_PROMETHEUS}"
            },
            "gridPos": {
              "h": 8,
              "w": 8,
              "x": 8,
              "y": 100
            },
            "fieldConfig": {
              "defaults": {
                "custom": {
                  "drawStyle": "line",
                  "lineInterpolation": "smooth",
                  "fillOpacity": 10,
                  "showPoints": "never"
                }
              }
            },
            "options": {
              "legend": {
                "displayMode": "table",
                "placement": "bottom",
                "showLegend": true,
                "calcs": ["mean", "max"]
              },
              "tooltip": {
                "mode": "multi",
                "sort": "desc"
              }
            },
            "targets": [
              {
                "datasource": {
                  "type": "prometheus",
                  "uid": "${DS_PROMETHEUS}"
                },
                "expr": "sum by (surface) (rate(memini_injected_memories_total{result=\"injected\"}[5m]))",
                "legendFormat": "{{surface}}",
                "refId": "A"
              }
            ]
          },
          {
            "id": 43,
            "type": "timeseries",
            "title": "Injected tokens per hour (by surface)",
            "description": "Client-estimated tokens the hooks added to context. The number injection tuning should push down.",
            "datasource": {
              "type": "prometheus",
              "uid": "${DS_PROMETHEUS}"
            },
            "gridPos": {
              "h": 8,
              "w": 8,
              "x": 16,
              "y": 100
            },
            "fieldConfig": {
              "defaults": {
                "custom": {
                  "drawStyle": "line",
                  "lineInterpolation": "smooth",
                  "fillOpacity": 10,
                  "showPoints": "never"
                }
              }
            },
            "options": {
              "legend": {
                "displayMode": "table",
                "placement": "bottom",
                "showLegend": true,
                "calcs": ["mean", "max"]
              },
              "tooltip": {
                "mode": "multi",
                "sort": "desc"
              }
            },
            "targets": [
              {
                "datasource": {
                  "type": "prometheus",
                  "uid": "${DS_PROMETHEUS}"
                },
                "expr": "sum by (surface) (increase(memini_injected_tokens_total[1h]))",
                "legendFormat": "{{surface}}",
                "refId": "A"
              }
            ]
          }
        ],
        "refresh": "30s",
        "schemaVersion": 39,
        "tags": ["memini"],
        "templating": {
          "list": [
            {
              "current": {
                "selected": false,
                "text": "Prometheus",
                "value": "Prometheus"
              },
              "hide": 0,
              "includeAll": false,
              "label": "Datasource",
              "multi": false,
              "name": "DS_PROMETHEUS",
              "options": [],
              "query": "prometheus",
              "queryValue": "",
              "refresh": 1,
              "regex": "",
              "skipUrlSync": false,
              "type": "datasource"
            }
          ]
        },
        "time": {
          "from": "now-6h",
          "to": "now"
        },
        "timepicker": {},
        "timezone": "",
        "title": "memini",
        "uid": "memini",
        "version": 2,
        "weekStart": ""
      }
  


(root level)
+ one document added:
  apiVersion: v1
  kind: PersistentVolumeClaim
  metadata:
    name: memini
    namespace: local-ai
    labels:
      app.kubernetes.io/instance: memini
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: memini
      helm.toolkit.fluxcd.io/name: memini
      helm.toolkit.fluxcd.io/namespace: flux-system
  spec:
    resources:
      requests:
        storage: 10Gi
    storageClassName: longhorn
    accessModes:
    - ReadWriteOnce

(root level)
+ one document added:
  apiVersion: v1
  kind: Service
  metadata:
    name: memini
    namespace: local-ai
    labels:
      app.kubernetes.io/instance: memini
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: memini
      app.kubernetes.io/service: memini
      helm.toolkit.fluxcd.io/name: memini
      helm.toolkit.fluxcd.io/namespace: flux-system
  spec:
    type: ClusterIP
    selector:
      app.kubernetes.io/controller: main
      app.kubernetes.io/instance: memini
      app.kubernetes.io/name: memini
    ports:
    - name: http
      port: 8080
      protocol: TCP
      targetPort: 8080
    - name: metrics
      port: 9090
      protocol: TCP
      targetPort: 9090
    - name: ui
      port: 8081
      protocol: TCP
      targetPort: 8081

(root level)
+ one document added:
  apiVersion: apps/v1
  kind: StatefulSet
  metadata:
    name: memini
    namespace: local-ai
    labels:
      app.kubernetes.io/controller: main
      app.kubernetes.io/instance: memini
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: memini
      helm.toolkit.fluxcd.io/name: memini
      helm.toolkit.fluxcd.io/namespace: flux-system
  spec:
    podManagementPolicy: OrderedReady
    replicas: 1
    revisionHistoryLimit: 3
    selector:
      matchLabels:
        app.kubernetes.io/controller: main
        app.kubernetes.io/instance: memini
        app.kubernetes.io/name: memini
    serviceName: memini
    template:
      metadata:
        labels:
          app.kubernetes.io/controller: main
          app.kubernetes.io/instance: memini
          app.kubernetes.io/name: memini
      spec:
        automountServiceAccountToken: false
        containers:
        - name: main
          image: "registry.erwanleboucher.dev/eleboucher/memini@sha256:2d388222bca3d65673a4072e99e0970fe0d5cdab0030ce0effdfdd78307ae7e2"
          imagePullPolicy: IfNotPresent
          env:
          - name: MEMINI_BACKEND
            value: sqlite
          - name: MEMINI_DEFAULT_NAMESPACE
            value: default
          - name: MEMINI_EMBED_BASE_URL
            value: "http://energon.home.arpa:8080/v1"
          - name: MEMINI_EMBED_DIMS
            value: "1024"
          - name: MEMINI_EMBED_MODEL
            value: qwen3-embedding-0.6b
          - name: MEMINI_HTTP_ADDR
            value: ":8080"
          - name: MEMINI_LLM_BASE_URL
            value: "http://energon.home.arpa:8080/v1"
          - name: MEMINI_LLM_MODEL
            value: gemma4-12b
          - name: MEMINI_LOG_FORMAT
            value: json
          - name: MEMINI_LOG_LEVEL
            value: info
          - name: MEMINI_METRICS_ADDR
            value: ":9090"
          - name: MEMINI_RERANK
            value: "true"
          - name: MEMINI_RERANK_MODEL
            value: "http://energon.home.arpa:8080/v1"
          - name: MEMINI_SQLITE_PATH
            value: /data/memini.db
          - name: MEMINI_SWEEP_INTERVAL
            value: 1h
          - name: MEMINI_UI_ADDR
            value: ":8081"
          - name: MEMINI_UI_ENABLED
            value: "true"
          - name: NODE_EXTRA_CA_CERTS
            value: /etc/ssl/certs/aethernet-ca.pem
          - name: SSL_CERT_FILE
            value: /etc/ssl/certs/aethernet-ca.pem
          livenessProbe:
            httpGet:
              path: /healthz
              port: 8080
            initialDelaySeconds: 5
            periodSeconds: 15
          readinessProbe:
            httpGet:
              path: /readyz
              port: 8080
            initialDelaySeconds: 3
            periodSeconds: 10
          resources:
            limits:
              cpu: "1"
              memory: 512Mi
            requests:
              cpu: 25m
              memory: 128Mi
          volumeMounts:
          - name: data
            mountPath: /data
          envFrom:
          - secretRef:
              name: memini-api-key
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
              - ALL
            readOnlyRootFilesystem: true
        dnsPolicy: ClusterFirst
        enableServiceLinks: false
        hostIPC: false
        hostNetwork: false
        hostPID: false
        securityContext:
          fsGroup: 65532
          runAsNonRoot: true
          runAsUser: 65532
        serviceAccountName: memini
        volumes:
        - name: data
          persistentVolumeClaim:
            claimName: memini
    updateStrategy:
      type: RollingUpdate
  


(root level)
+ one document added:
  apiVersion: gateway.networking.k8s.io/v1alpha2
  kind: HTTPRoute
  metadata:
    name: memini-main
    namespace: local-ai
    labels:
      app.kubernetes.io/instance: memini
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: memini
      helm.toolkit.fluxcd.io/name: memini
      helm.toolkit.fluxcd.io/namespace: flux-system
  spec:
    hostnames:
    - memini.k8s.aether.earth
    parentRefs:
    - name: envoy-over-vpn
      group: gateway.networking.k8s.io
      kind: Gateway
      namespace: envoy-gateway
      sectionName: https
    rules:
    - backendRefs:
      - name: memini
        group:
        kind: Service
        namespace: local-ai
        port: 8080
        weight: 1

(root level)
+ one document added:
  apiVersion: gateway.networking.k8s.io/v1alpha2
  kind: HTTPRoute
  metadata:
    name: memini-ui
    namespace: local-ai
    labels:
      app.kubernetes.io/instance: memini
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: memini
      helm.toolkit.fluxcd.io/name: memini
      helm.toolkit.fluxcd.io/namespace: flux-system
  spec:
    hostnames:
    - memini-admin.k8s.aether.earth
    parentRefs:
    - name: envoy-over-vpn
      group: gateway.networking.k8s.io
      kind: Gateway
      namespace: envoy-gateway
      sectionName: https
    rules:
    - backendRefs:
      - name: memini
        group:
        kind: Service
        namespace: local-ai
        port: 8081
        weight: 1

(root level)
+ one document added:
  apiVersion: monitoring.coreos.com/v1
  kind: ServiceMonitor
  metadata:
    name: memini
    namespace: local-ai
    labels:
      app.kubernetes.io/instance: memini
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: memini
      helm.toolkit.fluxcd.io/name: memini
      helm.toolkit.fluxcd.io/namespace: flux-system
  spec:
    endpoints:
    - interval: 30s
      path: /metrics
      port: metrics
      scrapeTimeout: 10s
    jobLabel: app.kubernetes.io/name
    namespaceSelector:
      matchNames:
      - local-ai
    selector:
      matchLabels:
        app.kubernetes.io/instance: memini
        app.kubernetes.io/name: memini
        app.kubernetes.io/service: memini

(root level)
+ one document added:
  apiVersion: v1
  kind: ServiceAccount
  metadata:
    name: metrics-server
    namespace: monitoring
    labels:
      app.kubernetes.io/instance: metrics-server
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: metrics-server
      helm.toolkit.fluxcd.io/name: metrics-server
      helm.toolkit.fluxcd.io/namespace: flux-system

(root level)
+ one document added:
  apiVersion: rbac.authorization.k8s.io/v1
  kind: ClusterRole
  metadata:
    name: "system:metrics-server-aggregated-reader"
    labels:
      app.kubernetes.io/instance: metrics-server
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: metrics-server
      helm.toolkit.fluxcd.io/name: metrics-server
      helm.toolkit.fluxcd.io/namespace: flux-system
      rbac.authorization.k8s.io/aggregate-to-admin: "true"
      rbac.authorization.k8s.io/aggregate-to-edit: "true"
      rbac.authorization.k8s.io/aggregate-to-view: "true"
  rules:
  - resources:
    - pods
    - nodes
    apiGroups:
    - metrics.k8s.io
    verbs:
    - get
    - list
    - watch

(root level)
+ one document added:
  apiVersion: rbac.authorization.k8s.io/v1
  kind: ClusterRole
  metadata:
    name: "system:metrics-server"
    labels:
      app.kubernetes.io/instance: metrics-server
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: metrics-server
      helm.toolkit.fluxcd.io/name: metrics-server
      helm.toolkit.fluxcd.io/namespace: flux-system
  rules:
  - resources:
    - nodes/metrics
    apiGroups:
    -
    verbs:
    - get
  - resources:
    - pods
    - nodes
    - namespaces
    - configmaps
    apiGroups:
    -
    verbs:
    - get
    - list
    - watch

(root level)
+ one document added:
  apiVersion: rbac.authorization.k8s.io/v1
  kind: ClusterRoleBinding
  metadata:
    name: "metrics-server:system:auth-delegator"
    labels:
      app.kubernetes.io/instance: metrics-server
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: metrics-server
      helm.toolkit.fluxcd.io/name: metrics-server
      helm.toolkit.fluxcd.io/namespace: flux-system
  roleRef:
    name: "system:auth-delegator"
    apiGroup: rbac.authorization.k8s.io
    kind: ClusterRole
  subjects:
  - name: metrics-server
    kind: ServiceAccount
    namespace: monitoring

(root level)
+ one document added:
  apiVersion: rbac.authorization.k8s.io/v1
  kind: ClusterRoleBinding
  metadata:
    name: "system:metrics-server"
    labels:
      app.kubernetes.io/instance: metrics-server
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: metrics-server
      helm.toolkit.fluxcd.io/name: metrics-server
      helm.toolkit.fluxcd.io/namespace: flux-system
  roleRef:
    name: "system:metrics-server"
    apiGroup: rbac.authorization.k8s.io
    kind: ClusterRole
  subjects:
  - name: metrics-server
    kind: ServiceAccount
    namespace: monitoring

(root level)
+ one document added:
  apiVersion: rbac.authorization.k8s.io/v1
  kind: RoleBinding
  metadata:
    name: metrics-server-auth-reader
    namespace: kube-system
    labels:
      app.kubernetes.io/instance: metrics-server
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: metrics-server
      helm.toolkit.fluxcd.io/name: metrics-server
      helm.toolkit.fluxcd.io/namespace: flux-system
  roleRef:
    name: extension-apiserver-authentication-reader
    apiGroup: rbac.authorization.k8s.io
    kind: Role
  subjects:
  - name: metrics-server
    kind: ServiceAccount
    namespace: monitoring

(root level)
+ one document added:
  apiVersion: v1
  kind: Service
  metadata:
    name: metrics-server
    namespace: monitoring
    labels:
      app.kubernetes.io/instance: metrics-server
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: metrics-server
      helm.toolkit.fluxcd.io/name: metrics-server
      helm.toolkit.fluxcd.io/namespace: flux-system
  spec:
    type: ClusterIP
    selector:
      app.kubernetes.io/instance: metrics-server
      app.kubernetes.io/name: metrics-server
    ports:
    - name: https
      appProtocol: https
      port: 443
      protocol: TCP
      targetPort: https

(root level)
+ one document added:
  apiVersion: apps/v1
  kind: Deployment
  metadata:
    name: metrics-server
    namespace: monitoring
    labels:
      app.kubernetes.io/instance: metrics-server
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: metrics-server
      helm.toolkit.fluxcd.io/name: metrics-server
      helm.toolkit.fluxcd.io/namespace: flux-system
  spec:
    replicas: 1
    selector:
      matchLabels:
        app.kubernetes.io/instance: metrics-server
        app.kubernetes.io/name: metrics-server
    template:
      metadata:
        labels:
          app.kubernetes.io/instance: metrics-server
          app.kubernetes.io/name: metrics-server
      spec:
        containers:
        - name: metrics-server
          image: "registry.k8s.io/metrics-server/metrics-server:v0.8.0"
          imagePullPolicy: IfNotPresent
          args:
          - "--secure-port=10250"
          - "--cert-dir=/tmp"
          - "--kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname"
          - "--kubelet-use-node-status-port"
          - "--metric-resolution=15s"
          - "--authorization-always-allow-paths=/metrics"
          - "--kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname"
          - "--kubelet-use-node-status-port"
          - "--metric-resolution=15s"
          livenessProbe:
            failureThreshold: 3
            httpGet:
              path: /livez
              port: https
              scheme: HTTPS
            initialDelaySeconds: 0
            periodSeconds: 10
          ports:
          - name: https
            containerPort: 10250
            protocol: TCP
          readinessProbe:
            failureThreshold: 3
            httpGet:
              path: /readyz
              port: https
              scheme: HTTPS
            initialDelaySeconds: 20
            periodSeconds: 10
          resources:
            requests:
              cpu: 100m
              memory: 200Mi
          volumeMounts:
          - name: tmp
            mountPath: /tmp
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
              - ALL
            readOnlyRootFilesystem: true
            runAsNonRoot: true
            runAsUser: 1000
            seccompProfile:
              type: RuntimeDefault
        priorityClassName: system-cluster-critical
        serviceAccountName: metrics-server
        volumes:
        - name: tmp
          emptyDir: {}

(root level)
+ one document added:
  apiVersion: apiregistration.k8s.io/v1
  kind: APIService
  metadata:
    name: v1beta1.metrics.k8s.io
    annotations: null
    labels:
      app.kubernetes.io/instance: metrics-server
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: metrics-server
      helm.toolkit.fluxcd.io/name: metrics-server
      helm.toolkit.fluxcd.io/namespace: flux-system
  spec:
    version: v1beta1
    group: metrics.k8s.io
    groupPriorityMinimum: 100
    insecureSkipTLSVerify: true
    versionPriority: 100
    service:
      name: metrics-server
      namespace: monitoring
      port: 443

(root level)
+ one document added:
  apiVersion: monitoring.coreos.com/v1
  kind: ServiceMonitor
  metadata:
    name: metrics-server
    namespace: monitoring
    labels:
      app.kubernetes.io/instance: metrics-server
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: metrics-server
      helm.toolkit.fluxcd.io/name: metrics-server
      helm.toolkit.fluxcd.io/namespace: flux-system
  spec:
    endpoints:
    - interval: 1m
      path: /metrics
      port: https
      scheme: https
      scrapeTimeout: 10s
      tlsConfig:
        insecureSkipVerify: true
    jobLabel: app.kubernetes.io/instance
    namespaceSelector:
      matchNames:
      - monitoring
    selector:
      matchLabels:
        app.kubernetes.io/instance: metrics-server
        app.kubernetes.io/name: metrics-server

(root level)
+ one document added:
  apiVersion: v1
  kind: ServiceAccount
  metadata:
    name: netbox-valkey
    namespace: it-inventory
    labels:
      app.kubernetes.io/instance: netbox-valkey
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: valkey
      helm.toolkit.fluxcd.io/name: netbox-valkey
      helm.toolkit.fluxcd.io/namespace: flux-system
  automountServiceAccountToken: false

(root level)
+ one document added:
  apiVersion: v1
  kind: ConfigMap
  metadata:
    name: netbox-valkey-init-scripts
    namespace: it-inventory
    labels:
      app.kubernetes.io/instance: netbox-valkey
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: valkey
      helm.toolkit.fluxcd.io/name: netbox-valkey
      helm.toolkit.fluxcd.io/namespace: flux-system
  data:
    init.sh: |
      #!/bin/sh
      set -eu
      
      # Default config paths
      VALKEY_CONFIG=${VALKEY_CONFIG_PATH:-/data/conf/valkey.conf}
      
      LOGFILE="/data/init.log"
      DATA_DIR="/data/conf"
      
      # Logging function (outputs to stderr and file)
      log() {
        echo "$(date) $1" | tee -a "$LOGFILE" >&2
      }
      # Function to get password for a user
      # Usage: get_user_password <username> [password_key]
      # Returns: password via stdout, exits with error if not found
      get_user_password() {
        username="$1"
        password_key="${2:-$username}"
        password=""
        # Try to get password from existing secret first (priority)
        if [ -f "/valkey-users-secret/$password_key" ]; then
          password=$(cat "/valkey-users-secret/$password_key")
          log "Using password from existing secret for user $username"
        elif [ -f "/valkey-auth-secret/${username}-password" ]; then
          # Fallback to inline password
          password=$(cat "/valkey-auth-secret/${username}-password")
          log "Using inline password for user $username"
        else
          log "ERROR: No password found for user $username"
          return 1
        fi
      
        echo "$password"
      }
      
      # Clean old log if requested
      if [ "${KEEP_OLD_LOGS:-false}" != "true" ]; then
        rm -f "$LOGFILE"
      fi
      
      if [ -f "$LOGFILE" ]; then
        log "Detected restart of this instance ($HOSTNAME)"
      fi
      
      log "Creating configuration in $DATA_DIR..."
      mkdir -p "$DATA_DIR"
      rm -f "$VALKEY_CONFIG"
      
      
      # Base valkey.conf
      log "Generating base valkey.conf"
      {
        echo "tls-cert-file /tls/tls.crt"
        echo "tls-key-file /tls/tls.key"
        echo "tls-ca-cert-file /tls/ca.crt"
        echo "tls-auth-clients no"
        echo "port 0"
        echo "tls-port 6379"
        echo "protected-mode no"
        echo "bind * -::*"
        echo "dir /data"
      } >>"$VALKEY_CONFIG"
      # Create secure directory for ACL file
      log "Creating /etc/valkey directory for ACL file"
      mkdir -p /etc/valkey
      
      # Set aclfile path in valkey.conf
      echo "aclfile /etc/valkey/users.acl" >>"$VALKEY_CONFIG"
      
      # Remove or reset existing ACL file if present (it may be read-only from previous run)
      log "Preparing ACL file at /etc/valkey/users.acl"
      if [ -f /etc/valkey/users.acl ]; then
        log "Removing existing read-only users.acl file"
        chmod 0600 /etc/valkey/users.acl
        rm -f /etc/valkey/users.acl
      fi
      
      # Create ACL file with secure permissions
      touch /etc/valkey/users.acl
      chmod 0600 /etc/valkey/users.acl
      # Generate ACL entries for each user
      log "Generating ACL entries for users"
      
      # User: cacheuser
      PASSWORD=$(get_user_password "cacheuser" "cacheuser-password") || exit 1
      
      # Hash the password and write ACL entry
      PASSHASH=$(echo -n "$PASSWORD" | sha256sum | cut -f 1 -d " ")
      echo "user cacheuser on #$PASSHASH +@all ~* &*" >> /etc/valkey/users.acl
      
      # User: default
      PASSWORD=$(get_user_password "default" "default-password") || exit 1
      
      # Hash the password and write ACL entry
      PASSHASH=$(echo -n "$PASSWORD" | sha256sum | cut -f 1 -d " ")
      echo "user default on #$PASSHASH off" >> /etc/valkey/users.acl
      
      # Set final permissions
      chmod 0400 /etc/valkey/users.acl
      log "ACL file created with 0400 permissions"
      
      # Append extra configs if present
      if [ -f /usr/local/etc/valkey/valkey.conf ]; then
        log "Appending /usr/local/etc/valkey/valkey.conf"
        cat /usr/local/etc/valkey/valkey.conf >>"$VALKEY_CONFIG"
      fi
      if [ -d /extravalkeyconfigs ]; then
        log "Appending files in /extravalkeyconfigs/"
        cat /extravalkeyconfigs/* >>"$VALKEY_CONFIG"
      fi
  


(root level)
+ one document added:
  apiVersion: v1
  kind: PersistentVolumeClaim
  metadata:
    name: netbox-valkey
    namespace: it-inventory
    labels:
      app.kubernetes.io/instance: netbox-valkey
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: valkey
      helm.toolkit.fluxcd.io/name: netbox-valkey
      helm.toolkit.fluxcd.io/namespace: flux-system
  spec:
    resources:
      requests:
        storage: 8Gi
    storageClassName: longhorn
    volumeMode: Filesystem
    accessModes:
    - ReadWriteOnce

(root level)
+ one document added:
  apiVersion: v1
  kind: Service
  metadata:
    name: netbox-valkey
    namespace: it-inventory
    labels:
      app.kubernetes.io/component: primary
      app.kubernetes.io/instance: netbox-valkey
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: valkey
      helm.toolkit.fluxcd.io/name: netbox-valkey
      helm.toolkit.fluxcd.io/namespace: flux-system
  spec:
    type: ClusterIP
    selector:
      app.kubernetes.io/instance: netbox-valkey
      app.kubernetes.io/name: valkey
    ports:
    - name: tcp
      port: 6379
      protocol: TCP
      targetPort: tcp

(root level)
+ one document added:
  apiVersion: apps/v1
  kind: Deployment
  metadata:
    name: netbox-valkey
    namespace: it-inventory
    labels:
      app.kubernetes.io/instance: netbox-valkey
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: valkey
      helm.toolkit.fluxcd.io/name: netbox-valkey
      helm.toolkit.fluxcd.io/namespace: flux-system
  spec:
    replicas: 1
    selector:
      matchLabels:
        app.kubernetes.io/instance: netbox-valkey
        app.kubernetes.io/name: valkey
    strategy:
      type: RollingUpdate
    template:
      metadata:
        labels:
          app.kubernetes.io/instance: netbox-valkey
          app.kubernetes.io/name: valkey
      spec:
        automountServiceAccountToken: false
        containers:
        - name: netbox-valkey
          image: "docker.io/valkey/valkey:9.0.1"
          imagePullPolicy: IfNotPresent
          resources: {}
          args:
          - /data/conf/valkey.conf
          command:
          - valkey-server
          env:
          - name: VALKEY_LOGLEVEL
            value: notice
          ports:
          - name: tcp
            containerPort: 6379
            protocol: TCP
          volumeMounts:
          - name: valkey-data
            mountPath: /data
          - name: netbox-valkey-tls
            mountPath: /tls
          - name: valkey-acl
            mountPath: /etc/valkey
          livenessProbe:
            exec:
              command:
              - sh
              - "-c"
              - "valkey-cli --cacert /tls/ca.crt --tls ping"
          securityContext:
            capabilities:
              drop:
              - ALL
            readOnlyRootFilesystem: true
            runAsNonRoot: true
            runAsUser: 1000
          startupProbe:
            exec:
              command:
              - sh
              - "-c"
              - "valkey-cli --cacert /tls/ca.crt --tls ping"
        initContainers:
        - name: netbox-valkey-init
          image: "docker.io/valkey/valkey:9.0.1"
          imagePullPolicy: IfNotPresent
          command:
          - /scripts/init.sh
          volumeMounts:
          - name: valkey-data
            mountPath: /data
          - name: scripts
            mountPath: /scripts
          - name: valkey-acl
            mountPath: /etc/valkey
          - name: valkey-users-secret
            mountPath: /valkey-users-secret
            readOnly: true
          securityContext:
            capabilities:
              drop:
              - ALL
            readOnlyRootFilesystem: true
            runAsNonRoot: true
            runAsUser: 1000
        securityContext:
          fsGroup: 1000
          runAsGroup: 1000
          runAsUser: 1000
        serviceAccountName: netbox-valkey
        volumes:
        - name: scripts
          configMap:
            name: netbox-valkey-init-scripts
            defaultMode: 365
        - name: valkey-acl
          emptyDir:
            medium: Memory
        - name: netbox-valkey-tls
          secret:
            defaultMode: 256
            secretName: netbox-valkey-tls
        - name: valkey-users-secret
          secret:
            defaultMode: 256
            secretName: netbox-valkey-acl-passwords
        - name: valkey-data
          persistentVolumeClaim:
            claimName: netbox-valkey

(root level)
+ one document added:
  apiVersion: policy/v1
  kind: PodDisruptionBudget
  metadata:
    name: nginx-for-outside-ingress-nginx-controller
    namespace: cluster-ingress
    labels:
      app.kubernetes.io/component: controller
      app.kubernetes.io/instance: nginx-for-outside
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: ingress-nginx
      app.kubernetes.io/part-of: ingress-nginx
      helm.toolkit.fluxcd.io/name: nginx-for-outside
      helm.toolkit.fluxcd.io/namespace: flux-system
  spec:
    minAvailable: 1
    selector:
      matchLabels:
        app.kubernetes.io/component: controller
        app.kubernetes.io/instance: nginx-for-outside
        app.kubernetes.io/name: ingress-nginx

(root level)
+ one document added:
  apiVersion: v1
  kind: ServiceAccount
  metadata:
    name: nginx-for-outside-ingress-nginx
    namespace: cluster-ingress
    labels:
      app.kubernetes.io/component: controller
      app.kubernetes.io/instance: nginx-for-outside
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: ingress-nginx
      app.kubernetes.io/part-of: ingress-nginx
      helm.toolkit.fluxcd.io/name: nginx-for-outside
      helm.toolkit.fluxcd.io/namespace: flux-system
  automountServiceAccountToken: true

(root level)
+ one document added:
  apiVersion: v1
  kind: ServiceAccount
  metadata:
    name: nginx-for-outside-ingress-nginx-backend
    namespace: cluster-ingress
    labels:
      app.kubernetes.io/component: default-backend
      app.kubernetes.io/instance: nginx-for-outside
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: ingress-nginx
      app.kubernetes.io/part-of: ingress-nginx
      helm.toolkit.fluxcd.io/name: nginx-for-outside
      helm.toolkit.fluxcd.io/namespace: flux-system
  automountServiceAccountToken: true

(root level)
+ one document added:
  apiVersion: v1
  kind: ConfigMap
  metadata:
    name: nginx-for-outside-ingress-nginx-controller
    namespace: cluster-ingress
    labels:
      app.kubernetes.io/component: controller
      app.kubernetes.io/instance: nginx-for-outside
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: ingress-nginx
      app.kubernetes.io/part-of: ingress-nginx
      helm.toolkit.fluxcd.io/name: nginx-for-outside
      helm.toolkit.fluxcd.io/namespace: flux-system
  data:
    allow-snippet-annotations: "true"
    annotations-risk-level: Critical
    compute-full-forwarded-for: "true"
    custom-http-errors: "400,401,403,404,405,407,408,409,410,411,413,416,418,429,500,502,503,504,505"
    enable-brotli: "true"
    enable-ocsp: "false"
    enable-real-ip: "true"
    hide-headers: "Server,X-Powered-By"
    log-format-upstream: "nginx-http from=\"nginx-for-outside\" time=\"$time_iso8601\" remote.addr=\"$proxy_protocol_addr\" remote.user=\"$remote_user\" request.proto=\"$server_protocol\" request.verb=\"$request_method\" request.size=\"$request_length\" url.domain=\"$host\" url.path=\"$uri\" url.query=\"$args\" response.size=\"$bytes_sent\" response.status=\"$status\" response.duration=\"$upstream_response_time\" response.servers=\"$upstream_addr\" user.agent=\"$http_user_agent\" user.referrer=\"$http_referer\" k8s.ing.namespace=\"$namespace\" k8s.ing.name=\"$ingress_name\" k8s.svc.name=\"$service_name\" k8s.svc.port=\"$service_port\" request.id=\"$req_id\""
    proxy-real-ip-cidr: "100.64.0.0/10,fd7a:115c:a1e0::/48,172.27.0.0/16,fda3:a0a0:cafe::/48"
    use-geoip: "false"
    use-geoip2: "false"
    use-gzip: "true"
    use-proxy-protocol: "true"
  


(root level)
+ one document added:
  apiVersion: rbac.authorization.k8s.io/v1
  kind: ClusterRole
  metadata:
    name: nginx-for-outside-ingress-nginx
    labels:
      app.kubernetes.io/instance: nginx-for-outside
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: ingress-nginx
      app.kubernetes.io/part-of: ingress-nginx
      helm.toolkit.fluxcd.io/name: nginx-for-outside
      helm.toolkit.fluxcd.io/namespace: flux-system
  rules:
  - resources:
    - configmaps
    - endpoints
    - nodes
    - pods
    - secrets
    - namespaces
    apiGroups:
    -
    verbs:
    - list
    - watch
  - resources:
    - leases
    apiGroups:
    - coordination.k8s.io
    verbs:
    - list
    - watch
  - resources:
    - nodes
    apiGroups:
    -
    verbs:
    - get
  - resources:
    - services
    apiGroups:
    -
    verbs:
    - get
    - list
    - watch
  - resources:
    - ingresses
    apiGroups:
    - networking.k8s.io
    verbs:
    - get
    - list
    - watch
  - resources:
    - events
    apiGroups:
    -
    verbs:
    - create
    - patch
  - resources:
    - ingresses/status
    apiGroups:
    - networking.k8s.io
    verbs:
    - update
  - resources:
    - ingressclasses
    apiGroups:
    - networking.k8s.io
    verbs:
    - get
    - list
    - watch
  - resources:
    - endpointslices
    apiGroups:
    - discovery.k8s.io
    verbs:
    - list
    - watch
    - get

(root level)
+ one document added:
  apiVersion: rbac.authorization.k8s.io/v1
  kind: ClusterRoleBinding
  metadata:
    name: nginx-for-outside-ingress-nginx
    labels:
      app.kubernetes.io/instance: nginx-for-outside
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: ingress-nginx
      app.kubernetes.io/part-of: ingress-nginx
      helm.toolkit.fluxcd.io/name: nginx-for-outside
      helm.toolkit.fluxcd.io/namespace: flux-system
  roleRef:
    name: nginx-for-outside-ingress-nginx
    apiGroup: rbac.authorization.k8s.io
    kind: ClusterRole
  subjects:
  - name: nginx-for-outside-ingress-nginx
    kind: ServiceAccount
    namespace: cluster-ingress

(root level)
+ one document added:
  apiVersion: rbac.authorization.k8s.io/v1
  kind: Role
  metadata:
    name: nginx-for-outside-ingress-nginx
    namespace: cluster-ingress
    labels:
      app.kubernetes.io/component: controller
      app.kubernetes.io/instance: nginx-for-outside
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: ingress-nginx
      app.kubernetes.io/part-of: ingress-nginx
      helm.toolkit.fluxcd.io/name: nginx-for-outside
      helm.toolkit.fluxcd.io/namespace: flux-system
  rules:
  - resources:
    - namespaces
    apiGroups:
    -
    verbs:
    - get
  - resources:
    - configmaps
    - pods
    - secrets
    - endpoints
    apiGroups:
    -
    verbs:
    - get
    - list
    - watch
  - resources:
    - services
    apiGroups:
    -
    verbs:
    - get
    - list
    - watch
  - resources:
    - ingresses
    apiGroups:
    - networking.k8s.io
    verbs:
    - get
    - list
    - watch
  - resources:
    - ingresses/status
    apiGroups:
    - networking.k8s.io
    verbs:
    - update
  - resources:
    - ingressclasses
    apiGroups:
    - networking.k8s.io
    verbs:
    - get
    - list
    - watch
  - resources:
    - leases
    apiGroups:
    - coordination.k8s.io
    resourceNames:
    - nginx-for-outside-controller-leader
    verbs:
    - get
    - update
  - resources:
    - leases
    apiGroups:
    - coordination.k8s.io
    verbs:
    - create
  - resources:
    - events
    apiGroups:
    -
    verbs:
    - create
    - patch
  - resources:
    - endpointslices
    apiGroups:
    - discovery.k8s.io
    verbs:
    - list
    - watch
    - get

(root level)
+ one document added:
  apiVersion: rbac.authorization.k8s.io/v1
  kind: RoleBinding
  metadata:
    name: nginx-for-outside-ingress-nginx
    namespace: cluster-ingress
    labels:
      app.kubernetes.io/component: controller
      app.kubernetes.io/instance: nginx-for-outside
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: ingress-nginx
      app.kubernetes.io/part-of: ingress-nginx
      helm.toolkit.fluxcd.io/name: nginx-for-outside
      helm.toolkit.fluxcd.io/namespace: flux-system
  roleRef:
    name: nginx-for-outside-ingress-nginx
    apiGroup: rbac.authorization.k8s.io
    kind: Role
  subjects:
  - name: nginx-for-outside-ingress-nginx
    kind: ServiceAccount
    namespace: cluster-ingress

(root level)
+ one document added:
  apiVersion: v1
  kind: Service
  metadata:
    name: nginx-for-outside-ingress-nginx-controller-metrics
    namespace: cluster-ingress
    labels:
      app.kubernetes.io/component: controller
      app.kubernetes.io/instance: nginx-for-outside
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: ingress-nginx
      app.kubernetes.io/part-of: ingress-nginx
      helm.toolkit.fluxcd.io/name: nginx-for-outside
      helm.toolkit.fluxcd.io/namespace: flux-system
  spec:
    type: ClusterIP
    selector:
      app.kubernetes.io/component: controller
      app.kubernetes.io/instance: nginx-for-outside
      app.kubernetes.io/name: ingress-nginx
    ports:
    - name: metrics
      port: 10254
      protocol: TCP
      targetPort: metrics

(root level)
+ one document added:
  apiVersion: v1
  kind: Service
  metadata:
    name: nginx-for-outside-ingress-nginx-controller-admission
    namespace: cluster-ingress
    labels:
      app.kubernetes.io/component: controller
      app.kubernetes.io/instance: nginx-for-outside
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: ingress-nginx
      app.kubernetes.io/part-of: ingress-nginx
      helm.toolkit.fluxcd.io/name: nginx-for-outside
      helm.toolkit.fluxcd.io/namespace: flux-system
  spec:
    type: ClusterIP
    selector:
      app.kubernetes.io/component: controller
      app.kubernetes.io/instance: nginx-for-outside
      app.kubernetes.io/name: ingress-nginx
    ports:
    - name: https-webhook
      appProtocol: https
      port: 443
      targetPort: webhook

(root level)
+ one document added:
  apiVersion: v1
  kind: Service
  metadata:
    name: nginx-for-outside-ingress-nginx-controller
    namespace: cluster-ingress
    annotations:
      tailscale.com/hostname: ingress-nginx-for-outside
    labels:
      app.kubernetes.io/component: controller
      app.kubernetes.io/instance: nginx-for-outside
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: ingress-nginx
      app.kubernetes.io/part-of: ingress-nginx
      helm.toolkit.fluxcd.io/name: nginx-for-outside
      helm.toolkit.fluxcd.io/namespace: flux-system
  spec:
    type: LoadBalancer
    ipFamilyPolicy: PreferDualStack
    loadBalancerClass: tailscale
    ipFamilies:
    - IPv4
    - IPv6
    selector:
      app.kubernetes.io/component: controller
      app.kubernetes.io/instance: nginx-for-outside
      app.kubernetes.io/name: ingress-nginx
    ports:
    - name: http
      appProtocol: http
      port: 80
      protocol: TCP
      targetPort: http
    - name: https
      appProtocol: https
      port: 443
      protocol: TCP
      targetPort: https

(root level)
+ one document added:
  apiVersion: v1
  kind: Service
  metadata:
    name: nginx-for-outside-ingress-nginx-defaultbackend
    namespace: cluster-ingress
    labels:
      app.kubernetes.io/component: default-backend
      app.kubernetes.io/instance: nginx-for-outside
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: ingress-nginx
      app.kubernetes.io/part-of: ingress-nginx
      helm.toolkit.fluxcd.io/name: nginx-for-outside
      helm.toolkit.fluxcd.io/namespace: flux-system
  spec:
    type: ClusterIP
    selector:
      app.kubernetes.io/component: default-backend
      app.kubernetes.io/instance: nginx-for-outside
      app.kubernetes.io/name: ingress-nginx
    ports:
    - name: http
      appProtocol: http
      port: 80
      protocol: TCP
      targetPort: http

(root level)
+ one document added:
  apiVersion: apps/v1
  kind: Deployment
  metadata:
    name: nginx-for-outside-ingress-nginx-controller
    namespace: cluster-ingress
    labels:
      app.kubernetes.io/component: controller
      app.kubernetes.io/instance: nginx-for-outside
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: ingress-nginx
      app.kubernetes.io/part-of: ingress-nginx
      helm.toolkit.fluxcd.io/name: nginx-for-outside
      helm.toolkit.fluxcd.io/namespace: flux-system
  spec:
    minReadySeconds: 0
    replicas: 2
    revisionHistoryLimit: 10
    selector:
      matchLabels:
        app.kubernetes.io/component: controller
        app.kubernetes.io/instance: nginx-for-outside
        app.kubernetes.io/name: ingress-nginx
    template:
      metadata:
        labels:
          app.kubernetes.io/component: controller
          app.kubernetes.io/instance: nginx-for-outside
          app.kubernetes.io/managed-by: Helm
          app.kubernetes.io/name: ingress-nginx
          app.kubernetes.io/part-of: ingress-nginx
      spec:
        automountServiceAccountToken: true
        containers:
        - name: controller
          image: "registry.k8s.io/ingress-nginx/controller:v1.13.3@sha256:1b044f6dcac3afbb59e05d98463f1dec6f3d3fb99940bc12ca5d80270358e3bd"
          imagePullPolicy: IfNotPresent
          args:
          - /nginx-ingress-controller
          - "--default-backend-service=$(POD_NAMESPACE)/nginx-for-outside-ingress-nginx-defaultbackend"
          - "--publish-service=$(POD_NAMESPACE)/nginx-for-outside-ingress-nginx-controller"
          - "--election-id=nginx-for-outside-controller-leader"
          - "--controller-class=infra.aether.earth/nginx-for-outside"
          - "--ingress-class=nginx"
          - "--configmap=$(POD_NAMESPACE)/nginx-for-outside-ingress-nginx-controller"
          - "--validating-webhook=:8443"
          - "--validating-webhook-certificate=/usr/local/certificates/cert"
          - "--validating-webhook-key=/usr/local/certificates/key"
          - "--enable-metrics=true"
          livenessProbe:
            failureThreshold: 5
            httpGet:
              path: /healthz
              port: 10254
              scheme: HTTP
            initialDelaySeconds: 10
            periodSeconds: 10
            successThreshold: 1
            timeoutSeconds: 1
          ports:
          - name: http
            containerPort: 80
            protocol: TCP
          - name: https
            containerPort: 443
            protocol: TCP
          - name: metrics
            containerPort: 10254
            protocol: TCP
          - name: webhook
            containerPort: 8443
            protocol: TCP
          readinessProbe:
            failureThreshold: 3
            httpGet:
              path: /healthz
              port: 10254
              scheme: HTTP
            initialDelaySeconds: 10
            periodSeconds: 10
            successThreshold: 1
            timeoutSeconds: 1
          resources:
            requests:
              cpu: 100m
              memory: 90Mi
          volumeMounts:
          - name: webhook-cert
            mountPath: /usr/local/certificates/
            readOnly: true
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              add:
              - NET_BIND_SERVICE
              drop:
              - ALL
            readOnlyRootFilesystem: false
            runAsGroup: 82
            runAsNonRoot: true
            runAsUser: 101
            seccompProfile:
              type: RuntimeDefault
          env:
          - name: POD_NAME
            valueFrom:
              fieldRef:
                fieldPath: metadata.name
          - name: POD_NAMESPACE
            valueFrom:
              fieldRef:
                fieldPath: metadata.namespace
          - name: LD_PRELOAD
            value: /usr/local/lib/libmimalloc.so
          lifecycle:
            preStop:
              exec:
                command:
                - /wait-shutdown
        dnsPolicy: ClusterFirst
        nodeSelector:
          kubernetes.io/os: linux
        serviceAccountName: nginx-for-outside-ingress-nginx
        terminationGracePeriodSeconds: 300
        volumes:
        - name: webhook-cert
          secret:
            items:
            - key: tls.crt
              path: cert
            - key: tls.key
              path: key
            secretName: nginx-for-outside-ingress-nginx-admission
  


(root level)
+ one document added:
  apiVersion: apps/v1
  kind: Deployment
  metadata:
    name: nginx-for-outside-ingress-nginx-defaultbackend
    namespace: cluster-ingress
    labels:
      app.kubernetes.io/component: default-backend
      app.kubernetes.io/instance: nginx-for-outside
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: ingress-nginx
      app.kubernetes.io/part-of: ingress-nginx
      helm.toolkit.fluxcd.io/name: nginx-for-outside
      helm.toolkit.fluxcd.io/namespace: flux-system
  spec:
    minReadySeconds: 0
    replicas: 1
    revisionHistoryLimit: 10
    selector:
      matchLabels:
        app.kubernetes.io/component: default-backend
        app.kubernetes.io/instance: nginx-for-outside
        app.kubernetes.io/name: ingress-nginx
    template:
      metadata:
        labels:
          app.kubernetes.io/component: default-backend
          app.kubernetes.io/instance: nginx-for-outside
          app.kubernetes.io/managed-by: Helm
          app.kubernetes.io/name: ingress-nginx
          app.kubernetes.io/part-of: ingress-nginx
      spec:
        automountServiceAccountToken: true
        containers:
        - name: ingress-nginx-default-backend
          image: "ghcr.io/tarampampam/error-pages:3.3.2"
          imagePullPolicy: IfNotPresent
          env:
          - name: TEMPLATE_NAME
            value: connection
          - name: SHOW_DETAILS
            value: "true"
          - name: SEND_SAME_HTTP_CODE
            value: "true"
          - name: DISABLE_MINIFICATION
            value: "true"
          livenessProbe:
            failureThreshold: 3
            httpGet:
              path: /healthz
              port: 8080
              scheme: HTTP
            initialDelaySeconds: 30
            periodSeconds: 10
            successThreshold: 1
            timeoutSeconds: 5
          ports:
          - name: http
            containerPort: 8080
            protocol: TCP
          readinessProbe:
            failureThreshold: 6
            httpGet:
              path: /healthz
              port: 8080
              scheme: HTTP
            initialDelaySeconds: 0
            periodSeconds: 5
            successThreshold: 1
            timeoutSeconds: 5
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
              - ALL
            readOnlyRootFilesystem: true
            runAsGroup: 65534
            runAsNonRoot: true
            runAsUser: 65534
            seccompProfile:
              type: RuntimeDefault
        nodeSelector:
          kubernetes.io/os: linux
        serviceAccountName: nginx-for-outside-ingress-nginx-backend
        terminationGracePeriodSeconds: 60

(root level)
+ one document added:
  apiVersion: networking.k8s.io/v1
  kind: IngressClass
  metadata:
    name: nginx-for-outside
    labels:
      app.kubernetes.io/component: controller
      app.kubernetes.io/instance: nginx-for-outside
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: ingress-nginx
      app.kubernetes.io/part-of: ingress-nginx
      helm.toolkit.fluxcd.io/name: nginx-for-outside
      helm.toolkit.fluxcd.io/namespace: flux-system
  spec:
    controller: infra.aether.earth/nginx-for-outside

(root level)
+ one document added:
  apiVersion: admissionregistration.k8s.io/v1
  kind: ValidatingWebhookConfiguration
  metadata:
    name: nginx-for-outside-ingress-nginx-admission
    annotations:
      cert-manager.io/inject-ca-from: cluster-ingress/nginx-for-outside-ingress-nginx-admission
      certmanager.k8s.io/inject-ca-from: cluster-ingress/nginx-for-outside-ingress-nginx-admission
    labels:
      app.kubernetes.io/component: admission-webhook
      app.kubernetes.io/instance: nginx-for-outside
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: ingress-nginx
      app.kubernetes.io/part-of: ingress-nginx
      helm.toolkit.fluxcd.io/name: nginx-for-outside
      helm.toolkit.fluxcd.io/namespace: flux-system
  webhooks:
  - name: validate.nginx.ingress.kubernetes.io
    failurePolicy: Fail
    matchPolicy: Equivalent
    sideEffects: None
    admissionReviewVersions:
    - v1
    clientConfig:
      service:
        name: nginx-for-outside-ingress-nginx-controller-admission
        namespace: cluster-ingress
        path: /networking/v1/ingresses
        port: 443
    rules:
    - resources:
      - ingresses
      apiGroups:
      - networking.k8s.io
      apiVersions:
      - v1
      operations:
      - CREATE
      - UPDATE
  


(root level)
+ one document added:
  apiVersion: cert-manager.io/v1
  kind: Certificate
  metadata:
    name: nginx-for-outside-ingress-nginx-admission
    namespace: cluster-ingress
    labels:
      helm.toolkit.fluxcd.io/name: nginx-for-outside
      helm.toolkit.fluxcd.io/namespace: flux-system
  spec:
    dnsNames:
    - nginx-for-outside-ingress-nginx-controller-admission
    - nginx-for-outside-ingress-nginx-controller-admission.cluster-ingress
    - nginx-for-outside-ingress-nginx-controller-admission.cluster-ingress.svc
    duration: 8760h0m0s
    issuerRef:
      name: in-cluster-ca
      group: cert-manager.io
      kind: ClusterIssuer
    secretName: nginx-for-outside-ingress-nginx-admission
    subject:
      organizations:
      - ingress-nginx-admission

(root level)
+ one document added:
  apiVersion: monitoring.coreos.com/v1
  kind: ServiceMonitor
  metadata:
    name: nginx-for-outside-ingress-nginx-controller
    namespace: cluster-ingress
    labels:
      app.kubernetes.io/component: controller
      app.kubernetes.io/instance: nginx-for-outside
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: ingress-nginx
      app.kubernetes.io/part-of: ingress-nginx
      helm.toolkit.fluxcd.io/name: nginx-for-outside
      helm.toolkit.fluxcd.io/namespace: flux-system
  spec:
    endpoints:
    - interval: 30s
      port: metrics
    namespaceSelector:
      matchNames:
      - cluster-ingress
    selector:
      matchLabels:
        app.kubernetes.io/component: controller
        app.kubernetes.io/instance: nginx-for-outside
        app.kubernetes.io/name: ingress-nginx

(root level)
+ one document added:
  apiVersion: policy/v1
  kind: PodDisruptionBudget
  metadata:
    name: nginx-on-lan-ingress-nginx-controller
    namespace: cluster-ingress
    labels:
      app.kubernetes.io/component: controller
      app.kubernetes.io/instance: nginx-on-lan
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: ingress-nginx
      app.kubernetes.io/part-of: ingress-nginx
      helm.toolkit.fluxcd.io/name: nginx-on-lan
      helm.toolkit.fluxcd.io/namespace: flux-system
  spec:
    minAvailable: 1
    selector:
      matchLabels:
        app.kubernetes.io/component: controller
        app.kubernetes.io/instance: nginx-on-lan
        app.kubernetes.io/name: ingress-nginx

(root level)
+ one document added:
  apiVersion: v1
  kind: ServiceAccount
  metadata:
    name: nginx-on-lan-ingress-nginx
    namespace: cluster-ingress
    labels:
      app.kubernetes.io/component: controller
      app.kubernetes.io/instance: nginx-on-lan
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: ingress-nginx
      app.kubernetes.io/part-of: ingress-nginx
      helm.toolkit.fluxcd.io/name: nginx-on-lan
      helm.toolkit.fluxcd.io/namespace: flux-system
  automountServiceAccountToken: true

(root level)
+ one document added:
  apiVersion: v1
  kind: ServiceAccount
  metadata:
    name: nginx-on-lan-ingress-nginx-backend
    namespace: cluster-ingress
    labels:
      app.kubernetes.io/component: default-backend
      app.kubernetes.io/instance: nginx-on-lan
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: ingress-nginx
      app.kubernetes.io/part-of: ingress-nginx
      helm.toolkit.fluxcd.io/name: nginx-on-lan
      helm.toolkit.fluxcd.io/namespace: flux-system
  automountServiceAccountToken: true

(root level)
+ one document added:
  apiVersion: v1
  kind: ConfigMap
  metadata:
    name: nginx-on-lan-ingress-nginx-controller
    namespace: cluster-ingress
    labels:
      app.kubernetes.io/component: controller
      app.kubernetes.io/instance: nginx-on-lan
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: ingress-nginx
      app.kubernetes.io/part-of: ingress-nginx
      helm.toolkit.fluxcd.io/name: nginx-on-lan
      helm.toolkit.fluxcd.io/namespace: flux-system
  data:
    allow-snippet-annotations: "true"
    annotations-risk-level: Critical
    compute-full-forwarded-for: "true"
    custom-http-errors: "400,401,403,404,405,407,408,409,410,411,413,416,418,429,500,502,503,504,505"
    enable-brotli: "true"
    enable-ocsp: "false"
    enable-real-ip: "true"
    hide-headers: "Server,X-Powered-By"
    log-format-upstream: "nginx-http from=\"nginx-on-lan\" time=\"$time_iso8601\" remote.addr=\"$proxy_protocol_addr\" remote.user=\"$remote_user\" request.proto=\"$server_protocol\" request.verb=\"$request_method\" request.size=\"$request_length\" url.domain=\"$host\" url.path=\"$uri\" url.query=\"$args\" response.size=\"$bytes_sent\" response.status=\"$status\" response.duration=\"$upstream_response_time\" response.servers=\"$upstream_addr\" user.agent=\"$http_user_agent\" user.referrer=\"$http_referer\" k8s.ing.namespace=\"$namespace\" k8s.ing.name=\"$ingress_name\" k8s.svc.name=\"$service_name\" k8s.svc.port=\"$service_port\" request.id=\"$req_id\""
    proxy-real-ip-cidr: "100.64.0.0/10,fd7a:115c:a1e0::/48,172.27.0.0/16,fda3:a0a0:cafe::/48"
    use-geoip: "false"
    use-geoip2: "false"
    use-gzip: "true"
  


(root level)
+ one document added:
  apiVersion: rbac.authorization.k8s.io/v1
  kind: ClusterRole
  metadata:
    name: nginx-on-lan-ingress-nginx
    labels:
      app.kubernetes.io/instance: nginx-on-lan
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: ingress-nginx
      app.kubernetes.io/part-of: ingress-nginx
      helm.toolkit.fluxcd.io/name: nginx-on-lan
      helm.toolkit.fluxcd.io/namespace: flux-system
  rules:
  - resources:
    - configmaps
    - endpoints
    - nodes
    - pods
    - secrets
    - namespaces
    apiGroups:
    -
    verbs:
    - list
    - watch
  - resources:
    - leases
    apiGroups:
    - coordination.k8s.io
    verbs:
    - list
    - watch
  - resources:
    - nodes
    apiGroups:
    -
    verbs:
    - get
  - resources:
    - services
    apiGroups:
    -
    verbs:
    - get
    - list
    - watch
  - resources:
    - ingresses
    apiGroups:
    - networking.k8s.io
    verbs:
    - get
    - list
    - watch
  - resources:
    - events
    apiGroups:
    -
    verbs:
    - create
    - patch
  - resources:
    - ingresses/status
    apiGroups:
    - networking.k8s.io
    verbs:
    - update
  - resources:
    - ingressclasses
    apiGroups:
    - networking.k8s.io
    verbs:
    - get
    - list
    - watch
  - resources:
    - endpointslices
    apiGroups:
    - discovery.k8s.io
    verbs:
    - list
    - watch
    - get

(root level)
+ one document added:
  apiVersion: rbac.authorization.k8s.io/v1
  kind: ClusterRoleBinding
  metadata:
    name: nginx-on-lan-ingress-nginx
    labels:
      app.kubernetes.io/instance: nginx-on-lan
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: ingress-nginx
      app.kubernetes.io/part-of: ingress-nginx
      helm.toolkit.fluxcd.io/name: nginx-on-lan
      helm.toolkit.fluxcd.io/namespace: flux-system
  roleRef:
    name: nginx-on-lan-ingress-nginx
    apiGroup: rbac.authorization.k8s.io
    kind: ClusterRole
  subjects:
  - name: nginx-on-lan-ingress-nginx
    kind: ServiceAccount
    namespace: cluster-ingress

(root level)
+ one document added:
  apiVersion: rbac.authorization.k8s.io/v1
  kind: Role
  metadata:
    name: nginx-on-lan-ingress-nginx
    namespace: cluster-ingress
    labels:
      app.kubernetes.io/component: controller
      app.kubernetes.io/instance: nginx-on-lan
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: ingress-nginx
      app.kubernetes.io/part-of: ingress-nginx
      helm.toolkit.fluxcd.io/name: nginx-on-lan
      helm.toolkit.fluxcd.io/namespace: flux-system
  rules:
  - resources:
    - namespaces
    apiGroups:
    -
    verbs:
    - get
  - resources:
    - configmaps
    - pods
    - secrets
    - endpoints
    apiGroups:
    -
    verbs:
    - get
    - list
    - watch
  - resources:
    - services
    apiGroups:
    -
    verbs:
    - get
    - list
    - watch
  - resources:
    - ingresses
    apiGroups:
    - networking.k8s.io
    verbs:
    - get
    - list
    - watch
  - resources:
    - ingresses/status
    apiGroups:
    - networking.k8s.io
    verbs:
    - update
  - resources:
    - ingressclasses
    apiGroups:
    - networking.k8s.io
    verbs:
    - get
    - list
    - watch
  - resources:
    - leases
    apiGroups:
    - coordination.k8s.io
    resourceNames:
    - nginx-on-lan-controller-leader
    verbs:
    - get
    - update
  - resources:
    - leases
    apiGroups:
    - coordination.k8s.io
    verbs:
    - create
  - resources:
    - events
    apiGroups:
    -
    verbs:
    - create
    - patch
  - resources:
    - endpointslices
    apiGroups:
    - discovery.k8s.io
    verbs:
    - list
    - watch
    - get

(root level)
+ one document added:
  apiVersion: rbac.authorization.k8s.io/v1
  kind: RoleBinding
  metadata:
    name: nginx-on-lan-ingress-nginx
    namespace: cluster-ingress
    labels:
      app.kubernetes.io/component: controller
      app.kubernetes.io/instance: nginx-on-lan
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: ingress-nginx
      app.kubernetes.io/part-of: ingress-nginx
      helm.toolkit.fluxcd.io/name: nginx-on-lan
      helm.toolkit.fluxcd.io/namespace: flux-system
  roleRef:
    name: nginx-on-lan-ingress-nginx
    apiGroup: rbac.authorization.k8s.io
    kind: Role
  subjects:
  - name: nginx-on-lan-ingress-nginx
    kind: ServiceAccount
    namespace: cluster-ingress

(root level)
+ one document added:
  apiVersion: v1
  kind: Service
  metadata:
    name: nginx-on-lan-ingress-nginx-controller-metrics
    namespace: cluster-ingress
    labels:
      app.kubernetes.io/component: controller
      app.kubernetes.io/instance: nginx-on-lan
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: ingress-nginx
      app.kubernetes.io/part-of: ingress-nginx
      helm.toolkit.fluxcd.io/name: nginx-on-lan
      helm.toolkit.fluxcd.io/namespace: flux-system
  spec:
    type: ClusterIP
    selector:
      app.kubernetes.io/component: controller
      app.kubernetes.io/instance: nginx-on-lan
      app.kubernetes.io/name: ingress-nginx
    ports:
    - name: metrics
      port: 10254
      protocol: TCP
      targetPort: metrics

(root level)
+ one document added:
  apiVersion: v1
  kind: Service
  metadata:
    name: nginx-on-lan-ingress-nginx-controller-admission
    namespace: cluster-ingress
    labels:
      app.kubernetes.io/component: controller
      app.kubernetes.io/instance: nginx-on-lan
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: ingress-nginx
      app.kubernetes.io/part-of: ingress-nginx
      helm.toolkit.fluxcd.io/name: nginx-on-lan
      helm.toolkit.fluxcd.io/namespace: flux-system
  spec:
    type: ClusterIP
    selector:
      app.kubernetes.io/component: controller
      app.kubernetes.io/instance: nginx-on-lan
      app.kubernetes.io/name: ingress-nginx
    ports:
    - name: https-webhook
      appProtocol: https
      port: 443
      targetPort: webhook

(root level)
+ one document added:
  apiVersion: v1
  kind: Service
  metadata:
    name: nginx-on-lan-ingress-nginx-controller
    namespace: cluster-ingress
    annotations:
      external-dns.alpha.kubernetes.io/hostname: nginx-on-lan.home.arpa
    labels:
      app.kubernetes.io/component: controller
      app.kubernetes.io/instance: nginx-on-lan
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: ingress-nginx
      app.kubernetes.io/part-of: ingress-nginx
      helm.toolkit.fluxcd.io/name: nginx-on-lan
      helm.toolkit.fluxcd.io/namespace: flux-system
  spec:
    type: LoadBalancer
    ipFamilyPolicy: RequireDualStack
    loadBalancerClass: io.cilium/bgp-control-plane
    ipFamilies:
    - IPv6
    - IPv4
    selector:
      app.kubernetes.io/component: controller
      app.kubernetes.io/instance: nginx-on-lan
      app.kubernetes.io/name: ingress-nginx
    ports:
    - name: http
      appProtocol: http
      port: 80
      protocol: TCP
      targetPort: http
    - name: https
      appProtocol: https
      port: 443
      protocol: TCP
      targetPort: https

(root level)
+ one document added:
  apiVersion: v1
  kind: Service
  metadata:
    name: nginx-on-lan-ingress-nginx-defaultbackend
    namespace: cluster-ingress
    labels:
      app.kubernetes.io/component: default-backend
      app.kubernetes.io/instance: nginx-on-lan
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: ingress-nginx
      app.kubernetes.io/part-of: ingress-nginx
      helm.toolkit.fluxcd.io/name: nginx-on-lan
      helm.toolkit.fluxcd.io/namespace: flux-system
  spec:
    type: ClusterIP
    selector:
      app.kubernetes.io/component: default-backend
      app.kubernetes.io/instance: nginx-on-lan
      app.kubernetes.io/name: ingress-nginx
    ports:
    - name: http
      appProtocol: http
      port: 80
      protocol: TCP
      targetPort: http

(root level)
+ one document added:
  apiVersion: apps/v1
  kind: Deployment
  metadata:
    name: nginx-on-lan-ingress-nginx-controller
    namespace: cluster-ingress
    labels:
      app.kubernetes.io/component: controller
      app.kubernetes.io/instance: nginx-on-lan
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: ingress-nginx
      app.kubernetes.io/part-of: ingress-nginx
      helm.toolkit.fluxcd.io/name: nginx-on-lan
      helm.toolkit.fluxcd.io/namespace: flux-system
  spec:
    minReadySeconds: 0
    replicas: 2
    revisionHistoryLimit: 10
    selector:
      matchLabels:
        app.kubernetes.io/component: controller
        app.kubernetes.io/instance: nginx-on-lan
        app.kubernetes.io/name: ingress-nginx
    template:
      metadata:
        labels:
          app.kubernetes.io/component: controller
          app.kubernetes.io/instance: nginx-on-lan
          app.kubernetes.io/managed-by: Helm
          app.kubernetes.io/name: ingress-nginx
          app.kubernetes.io/part-of: ingress-nginx
      spec:
        automountServiceAccountToken: true
        containers:
        - name: controller
          image: "registry.k8s.io/ingress-nginx/controller:v1.13.3@sha256:1b044f6dcac3afbb59e05d98463f1dec6f3d3fb99940bc12ca5d80270358e3bd"
          imagePullPolicy: IfNotPresent
          args:
          - /nginx-ingress-controller
          - "--default-backend-service=$(POD_NAMESPACE)/nginx-on-lan-ingress-nginx-defaultbackend"
          - "--publish-service=$(POD_NAMESPACE)/nginx-on-lan-ingress-nginx-controller"
          - "--election-id=nginx-on-lan-controller-leader"
          - "--controller-class=infra.aether.earth/nginx-on-lan"
          - "--ingress-class=nginx"
          - "--configmap=$(POD_NAMESPACE)/nginx-on-lan-ingress-nginx-controller"
          - "--validating-webhook=:8443"
          - "--validating-webhook-certificate=/usr/local/certificates/cert"
          - "--validating-webhook-key=/usr/local/certificates/key"
          - "--enable-metrics=true"
          livenessProbe:
            failureThreshold: 5
            httpGet:
              path: /healthz
              port: 10254
              scheme: HTTP
            initialDelaySeconds: 10
            periodSeconds: 10
            successThreshold: 1
            timeoutSeconds: 1
          ports:
          - name: http
            containerPort: 80
            protocol: TCP
          - name: https
            containerPort: 443
            protocol: TCP
          - name: metrics
            containerPort: 10254
            protocol: TCP
          - name: webhook
            containerPort: 8443
            protocol: TCP
          readinessProbe:
            failureThreshold: 3
            httpGet:
              path: /healthz
              port: 10254
              scheme: HTTP
            initialDelaySeconds: 10
            periodSeconds: 10
            successThreshold: 1
            timeoutSeconds: 1
          resources:
            requests:
              cpu: 100m
              memory: 90Mi
          volumeMounts:
          - name: webhook-cert
            mountPath: /usr/local/certificates/
            readOnly: true
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              add:
              - NET_BIND_SERVICE
              drop:
              - ALL
            readOnlyRootFilesystem: false
            runAsGroup: 82
            runAsNonRoot: true
            runAsUser: 101
            seccompProfile:
              type: RuntimeDefault
          env:
          - name: POD_NAME
            valueFrom:
              fieldRef:
                fieldPath: metadata.name
          - name: POD_NAMESPACE
            valueFrom:
              fieldRef:
                fieldPath: metadata.namespace
          - name: LD_PRELOAD
            value: /usr/local/lib/libmimalloc.so
          lifecycle:
            preStop:
              exec:
                command:
                - /wait-shutdown
        dnsPolicy: ClusterFirst
        nodeSelector:
          kubernetes.io/os: linux
        serviceAccountName: nginx-on-lan-ingress-nginx
        terminationGracePeriodSeconds: 300
        volumes:
        - name: webhook-cert
          secret:
            items:
            - key: tls.crt
              path: cert
            - key: tls.key
              path: key
            secretName: nginx-on-lan-ingress-nginx-admission
  


(root level)
+ one document added:
  apiVersion: apps/v1
  kind: Deployment
  metadata:
    name: nginx-on-lan-ingress-nginx-defaultbackend
    namespace: cluster-ingress
    labels:
      app.kubernetes.io/component: default-backend
      app.kubernetes.io/instance: nginx-on-lan
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: ingress-nginx
      app.kubernetes.io/part-of: ingress-nginx
      helm.toolkit.fluxcd.io/name: nginx-on-lan
      helm.toolkit.fluxcd.io/namespace: flux-system
  spec:
    minReadySeconds: 0
    replicas: 1
    revisionHistoryLimit: 10
    selector:
      matchLabels:
        app.kubernetes.io/component: default-backend
        app.kubernetes.io/instance: nginx-on-lan
        app.kubernetes.io/name: ingress-nginx
    template:
      metadata:
        labels:
          app.kubernetes.io/component: default-backend
          app.kubernetes.io/instance: nginx-on-lan
          app.kubernetes.io/managed-by: Helm
          app.kubernetes.io/name: ingress-nginx
          app.kubernetes.io/part-of: ingress-nginx
      spec:
        automountServiceAccountToken: true
        containers:
        - name: ingress-nginx-default-backend
          image: "ghcr.io/tarampampam/error-pages:3.3.2"
          imagePullPolicy: IfNotPresent
          env:
          - name: TEMPLATE_NAME
            value: connection
          - name: SHOW_DETAILS
            value: "true"
          - name: SEND_SAME_HTTP_CODE
            value: "true"
          - name: DISABLE_MINIFICATION
            value: "true"
          livenessProbe:
            failureThreshold: 3
            httpGet:
              path: /healthz
              port: 8080
              scheme: HTTP
            initialDelaySeconds: 30
            periodSeconds: 10
            successThreshold: 1
            timeoutSeconds: 5
          ports:
          - name: http
            containerPort: 8080
            protocol: TCP
          readinessProbe:
            failureThreshold: 6
            httpGet:
              path: /healthz
              port: 8080
              scheme: HTTP
            initialDelaySeconds: 0
            periodSeconds: 5
            successThreshold: 1
            timeoutSeconds: 5
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
              - ALL
            readOnlyRootFilesystem: true
            runAsGroup: 65534
            runAsNonRoot: true
            runAsUser: 65534
            seccompProfile:
              type: RuntimeDefault
        nodeSelector:
          kubernetes.io/os: linux
        serviceAccountName: nginx-on-lan-ingress-nginx-backend
        terminationGracePeriodSeconds: 60

(root level)
+ one document added:
  apiVersion: networking.k8s.io/v1
  kind: IngressClass
  metadata:
    name: nginx-on-lan
    labels:
      app.kubernetes.io/component: controller
      app.kubernetes.io/instance: nginx-on-lan
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: ingress-nginx
      app.kubernetes.io/part-of: ingress-nginx
      helm.toolkit.fluxcd.io/name: nginx-on-lan
      helm.toolkit.fluxcd.io/namespace: flux-system
  spec:
    controller: infra.aether.earth/nginx-on-lan

(root level)
+ one document added:
  apiVersion: admissionregistration.k8s.io/v1
  kind: ValidatingWebhookConfiguration
  metadata:
    name: nginx-on-lan-ingress-nginx-admission
    annotations:
      cert-manager.io/inject-ca-from: cluster-ingress/nginx-on-lan-ingress-nginx-admission
      certmanager.k8s.io/inject-ca-from: cluster-ingress/nginx-on-lan-ingress-nginx-admission
    labels:
      app.kubernetes.io/component: admission-webhook
      app.kubernetes.io/instance: nginx-on-lan
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: ingress-nginx
      app.kubernetes.io/part-of: ingress-nginx
      helm.toolkit.fluxcd.io/name: nginx-on-lan
      helm.toolkit.fluxcd.io/namespace: flux-system
  webhooks:
  - name: validate.nginx.ingress.kubernetes.io
    failurePolicy: Fail
    matchPolicy: Equivalent
    sideEffects: None
    admissionReviewVersions:
    - v1
    clientConfig:
      service:
        name: nginx-on-lan-ingress-nginx-controller-admission
        namespace: cluster-ingress
        path: /networking/v1/ingresses
        port: 443
    rules:
    - resources:
      - ingresses
      apiGroups:
      - networking.k8s.io
      apiVersions:
      - v1
      operations:
      - CREATE
      - UPDATE
  


(root level)
+ one document added:
  apiVersion: cert-manager.io/v1
  kind: Certificate
  metadata:
    name: nginx-on-lan-ingress-nginx-admission
    namespace: cluster-ingress
    labels:
      helm.toolkit.fluxcd.io/name: nginx-on-lan
      helm.toolkit.fluxcd.io/namespace: flux-system
  spec:
    dnsNames:
    - nginx-on-lan-ingress-nginx-controller-admission
    - nginx-on-lan-ingress-nginx-controller-admission.cluster-ingress
    - nginx-on-lan-ingress-nginx-controller-admission.cluster-ingress.svc
    duration: 8760h0m0s
    issuerRef:
      name: in-cluster-ca
      group: cert-manager.io
      kind: ClusterIssuer
    secretName: nginx-on-lan-ingress-nginx-admission
    subject:
      organizations:
      - ingress-nginx-admission

(root level)
+ one document added:
  apiVersion: monitoring.coreos.com/v1
  kind: ServiceMonitor
  metadata:
    name: nginx-on-lan-ingress-nginx-controller
    namespace: cluster-ingress
    labels:
      app.kubernetes.io/component: controller
      app.kubernetes.io/instance: nginx-on-lan
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: ingress-nginx
      app.kubernetes.io/part-of: ingress-nginx
      helm.toolkit.fluxcd.io/name: nginx-on-lan
      helm.toolkit.fluxcd.io/namespace: flux-system
  spec:
    endpoints:
    - interval: 30s
      port: metrics
    namespaceSelector:
      matchNames:
      - cluster-ingress
    selector:
      matchLabels:
        app.kubernetes.io/component: controller
        app.kubernetes.io/instance: nginx-on-lan
        app.kubernetes.io/name: ingress-nginx

(root level)
+ one document added:
  apiVersion: policy/v1
  kind: PodDisruptionBudget
  metadata:
    name: nginx-over-vpn-ingress-nginx-controller
    namespace: cluster-ingress
    labels:
      app.kubernetes.io/component: controller
      app.kubernetes.io/instance: nginx-over-vpn
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: ingress-nginx
      app.kubernetes.io/part-of: ingress-nginx
      helm.toolkit.fluxcd.io/name: nginx-over-vpn
      helm.toolkit.fluxcd.io/namespace: flux-system
  spec:
    minAvailable: 1
    selector:
      matchLabels:
        app.kubernetes.io/component: controller
        app.kubernetes.io/instance: nginx-over-vpn
        app.kubernetes.io/name: ingress-nginx

(root level)
+ one document added:
  apiVersion: v1
  kind: ServiceAccount
  metadata:
    name: nginx-over-vpn-ingress-nginx
    namespace: cluster-ingress
    labels:
      app.kubernetes.io/component: controller
      app.kubernetes.io/instance: nginx-over-vpn
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: ingress-nginx
      app.kubernetes.io/part-of: ingress-nginx
      helm.toolkit.fluxcd.io/name: nginx-over-vpn
      helm.toolkit.fluxcd.io/namespace: flux-system
  automountServiceAccountToken: true

(root level)
+ one document added:
  apiVersion: v1
  kind: ServiceAccount
  metadata:
    name: nginx-over-vpn-ingress-nginx-backend
    namespace: cluster-ingress
    labels:
      app.kubernetes.io/component: default-backend
      app.kubernetes.io/instance: nginx-over-vpn
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: ingress-nginx
      app.kubernetes.io/part-of: ingress-nginx
      helm.toolkit.fluxcd.io/name: nginx-over-vpn
      helm.toolkit.fluxcd.io/namespace: flux-system
  automountServiceAccountToken: true

(root level)
+ one document added:
  apiVersion: v1
  kind: ConfigMap
  metadata:
    name: nginx-over-vpn-ingress-nginx-controller
    namespace: cluster-ingress
    labels:
      app.kubernetes.io/component: controller
      app.kubernetes.io/instance: nginx-over-vpn
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: ingress-nginx
      app.kubernetes.io/part-of: ingress-nginx
      helm.toolkit.fluxcd.io/name: nginx-over-vpn
      helm.toolkit.fluxcd.io/namespace: flux-system
  data:
    allow-snippet-annotations: "true"
    annotations-risk-level: Critical
    compute-full-forwarded-for: "true"
    custom-http-errors: "400,401,403,404,405,407,408,409,410,411,413,416,418,429,500,502,503,504,505"
    enable-brotli: "true"
    enable-ocsp: "false"
    enable-real-ip: "true"
    hide-headers: "Server,X-Powered-By"
    log-format-upstream: "nginx-http from=\"nginx-over-vpn\" time=\"$time_iso8601\" remote.addr=\"$proxy_protocol_addr\" remote.user=\"$remote_user\" request.proto=\"$server_protocol\" request.verb=\"$request_method\" request.size=\"$request_length\" url.domain=\"$host\" url.path=\"$uri\" url.query=\"$args\" response.size=\"$bytes_sent\" response.status=\"$status\" response.duration=\"$upstream_response_time\" response.servers=\"$upstream_addr\" user.agent=\"$http_user_agent\" user.referrer=\"$http_referer\" k8s.ing.namespace=\"$namespace\" k8s.ing.name=\"$ingress_name\" k8s.svc.name=\"$service_name\" k8s.svc.port=\"$service_port\" request.id=\"$req_id\""
    proxy-real-ip-cidr: "100.64.0.0/10,fd7a:115c:a1e0::/48,172.27.0.0/16,fda3:a0a0:cafe::/48"
    use-geoip: "false"
    use-geoip2: "false"
    use-gzip: "true"
  


(root level)
+ one document added:
  apiVersion: rbac.authorization.k8s.io/v1
  kind: ClusterRole
  metadata:
    name: nginx-over-vpn-ingress-nginx
    labels:
      app.kubernetes.io/instance: nginx-over-vpn
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: ingress-nginx
      app.kubernetes.io/part-of: ingress-nginx
      helm.toolkit.fluxcd.io/name: nginx-over-vpn
      helm.toolkit.fluxcd.io/namespace: flux-system
  rules:
  - resources:
    - configmaps
    - endpoints
    - nodes
    - pods
    - secrets
    - namespaces
    apiGroups:
    -
    verbs:
    - list
    - watch
  - resources:
    - leases
    apiGroups:
    - coordination.k8s.io
    verbs:
    - list
    - watch
  - resources:
    - nodes
    apiGroups:
    -
    verbs:
    - get
  - resources:
    - services
    apiGroups:
    -
    verbs:
    - get
    - list
    - watch
  - resources:
    - ingresses
    apiGroups:
    - networking.k8s.io
    verbs:
    - get
    - list
    - watch
  - resources:
    - events
    apiGroups:
    -
    verbs:
    - create
    - patch
  - resources:
    - ingresses/status
    apiGroups:
    - networking.k8s.io
    verbs:
    - update
  - resources:
    - ingressclasses
    apiGroups:
    - networking.k8s.io
    verbs:
    - get
    - list
    - watch
  - resources:
    - endpointslices
    apiGroups:
    - discovery.k8s.io
    verbs:
    - list
    - watch
    - get

(root level)
+ one document added:
  apiVersion: rbac.authorization.k8s.io/v1
  kind: ClusterRoleBinding
  metadata:
    name: nginx-over-vpn-ingress-nginx
    labels:
      app.kubernetes.io/instance: nginx-over-vpn
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: ingress-nginx
      app.kubernetes.io/part-of: ingress-nginx
      helm.toolkit.fluxcd.io/name: nginx-over-vpn
      helm.toolkit.fluxcd.io/namespace: flux-system
  roleRef:
    name: nginx-over-vpn-ingress-nginx
    apiGroup: rbac.authorization.k8s.io
    kind: ClusterRole
  subjects:
  - name: nginx-over-vpn-ingress-nginx
    kind: ServiceAccount
    namespace: cluster-ingress

(root level)
+ one document added:
  apiVersion: rbac.authorization.k8s.io/v1
  kind: Role
  metadata:
    name: nginx-over-vpn-ingress-nginx
    namespace: cluster-ingress
    labels:
      app.kubernetes.io/component: controller
      app.kubernetes.io/instance: nginx-over-vpn
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: ingress-nginx
      app.kubernetes.io/part-of: ingress-nginx
      helm.toolkit.fluxcd.io/name: nginx-over-vpn
      helm.toolkit.fluxcd.io/namespace: flux-system
  rules:
  - resources:
    - namespaces
    apiGroups:
    -
    verbs:
    - get
  - resources:
    - configmaps
    - pods
    - secrets
    - endpoints
    apiGroups:
    -
    verbs:
    - get
    - list
    - watch
  - resources:
    - services
    apiGroups:
    -
    verbs:
    - get
    - list
    - watch
  - resources:
    - ingresses
    apiGroups:
    - networking.k8s.io
    verbs:
    - get
    - list
    - watch
  - resources:
    - ingresses/status
    apiGroups:
    - networking.k8s.io
    verbs:
    - update
  - resources:
    - ingressclasses
    apiGroups:
    - networking.k8s.io
    verbs:
    - get
    - list
    - watch
  - resources:
    - leases
    apiGroups:
    - coordination.k8s.io
    resourceNames:
    - nginx-over-vpn-controller-leader
    verbs:
    - get
    - update
  - resources:
    - leases
    apiGroups:
    - coordination.k8s.io
    verbs:
    - create
  - resources:
    - events
    apiGroups:
    -
    verbs:
    - create
    - patch
  - resources:
    - endpointslices
    apiGroups:
    - discovery.k8s.io
    verbs:
    - list
    - watch
    - get

(root level)
+ one document added:
  apiVersion: rbac.authorization.k8s.io/v1
  kind: RoleBinding
  metadata:
    name: nginx-over-vpn-ingress-nginx
    namespace: cluster-ingress
    labels:
      app.kubernetes.io/component: controller
      app.kubernetes.io/instance: nginx-over-vpn
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: ingress-nginx
      app.kubernetes.io/part-of: ingress-nginx
      helm.toolkit.fluxcd.io/name: nginx-over-vpn
      helm.toolkit.fluxcd.io/namespace: flux-system
  roleRef:
    name: nginx-over-vpn-ingress-nginx
    apiGroup: rbac.authorization.k8s.io
    kind: Role
  subjects:
  - name: nginx-over-vpn-ingress-nginx
    kind: ServiceAccount
    namespace: cluster-ingress

(root level)
+ one document added:
  apiVersion: v1
  kind: Service
  metadata:
    name: nginx-over-vpn-ingress-nginx-controller-metrics
    namespace: cluster-ingress
    labels:
      app.kubernetes.io/component: controller
      app.kubernetes.io/instance: nginx-over-vpn
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: ingress-nginx
      app.kubernetes.io/part-of: ingress-nginx
      helm.toolkit.fluxcd.io/name: nginx-over-vpn
      helm.toolkit.fluxcd.io/namespace: flux-system
  spec:
    type: ClusterIP
    selector:
      app.kubernetes.io/component: controller
      app.kubernetes.io/instance: nginx-over-vpn
      app.kubernetes.io/name: ingress-nginx
    ports:
    - name: metrics
      port: 10254
      protocol: TCP
      targetPort: metrics

(root level)
+ one document added:
  apiVersion: v1
  kind: Service
  metadata:
    name: nginx-over-vpn-ingress-nginx-controller-admission
    namespace: cluster-ingress
    labels:
      app.kubernetes.io/component: controller
      app.kubernetes.io/instance: nginx-over-vpn
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: ingress-nginx
      app.kubernetes.io/part-of: ingress-nginx
      helm.toolkit.fluxcd.io/name: nginx-over-vpn
      helm.toolkit.fluxcd.io/namespace: flux-system
  spec:
    type: ClusterIP
    selector:
      app.kubernetes.io/component: controller
      app.kubernetes.io/instance: nginx-over-vpn
      app.kubernetes.io/name: ingress-nginx
    ports:
    - name: https-webhook
      appProtocol: https
      port: 443
      targetPort: webhook

(root level)
+ one document added:
  apiVersion: v1
  kind: Service
  metadata:
    name: nginx-over-vpn-ingress-nginx-controller
    namespace: cluster-ingress
    annotations:
      tailscale.com/hostname: ingress-nginx-over-vpn
    labels:
      app.kubernetes.io/component: controller
      app.kubernetes.io/instance: nginx-over-vpn
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: ingress-nginx
      app.kubernetes.io/part-of: ingress-nginx
      helm.toolkit.fluxcd.io/name: nginx-over-vpn
      helm.toolkit.fluxcd.io/namespace: flux-system
  spec:
    type: LoadBalancer
    ipFamilyPolicy: PreferDualStack
    loadBalancerClass: tailscale
    ipFamilies:
    - IPv4
    - IPv6
    selector:
      app.kubernetes.io/component: controller
      app.kubernetes.io/instance: nginx-over-vpn
      app.kubernetes.io/name: ingress-nginx
    ports:
    - name: http
      appProtocol: http
      port: 80
      protocol: TCP
      targetPort: http
    - name: https
      appProtocol: https
      port: 443
      protocol: TCP
      targetPort: https

(root level)
+ one document added:
  apiVersion: v1
  kind: Service
  metadata:
    name: nginx-over-vpn-ingress-nginx-defaultbackend
    namespace: cluster-ingress
    labels:
      app.kubernetes.io/component: default-backend
      app.kubernetes.io/instance: nginx-over-vpn
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: ingress-nginx
      app.kubernetes.io/part-of: ingress-nginx
      helm.toolkit.fluxcd.io/name: nginx-over-vpn
      helm.toolkit.fluxcd.io/namespace: flux-system
  spec:
    type: ClusterIP
    selector:
      app.kubernetes.io/component: default-backend
      app.kubernetes.io/instance: nginx-over-vpn
      app.kubernetes.io/name: ingress-nginx
    ports:
    - name: http
      appProtocol: http
      port: 80
      protocol: TCP
      targetPort: http

(root level)
+ one document added:
  apiVersion: apps/v1
  kind: Deployment
  metadata:
    name: nginx-over-vpn-ingress-nginx-controller
    namespace: cluster-ingress
    labels:
      app.kubernetes.io/component: controller
      app.kubernetes.io/instance: nginx-over-vpn
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: ingress-nginx
      app.kubernetes.io/part-of: ingress-nginx
      helm.toolkit.fluxcd.io/name: nginx-over-vpn
      helm.toolkit.fluxcd.io/namespace: flux-system
  spec:
    minReadySeconds: 0
    replicas: 2
    revisionHistoryLimit: 10
    selector:
      matchLabels:
        app.kubernetes.io/component: controller
        app.kubernetes.io/instance: nginx-over-vpn
        app.kubernetes.io/name: ingress-nginx
    template:
      metadata:
        labels:
          app.kubernetes.io/component: controller
          app.kubernetes.io/instance: nginx-over-vpn
          app.kubernetes.io/managed-by: Helm
          app.kubernetes.io/name: ingress-nginx
          app.kubernetes.io/part-of: ingress-nginx
      spec:
        automountServiceAccountToken: true
        containers:
        - name: controller
          image: "registry.k8s.io/ingress-nginx/controller:v1.13.3@sha256:1b044f6dcac3afbb59e05d98463f1dec6f3d3fb99940bc12ca5d80270358e3bd"
          imagePullPolicy: IfNotPresent
          args:
          - /nginx-ingress-controller
          - "--default-backend-service=$(POD_NAMESPACE)/nginx-over-vpn-ingress-nginx-defaultbackend"
          - "--publish-service=$(POD_NAMESPACE)/nginx-over-vpn-ingress-nginx-controller"
          - "--election-id=nginx-over-vpn-controller-leader"
          - "--controller-class=infra.aether.earth/nginx-over-vpn"
          - "--ingress-class=nginx"
          - "--configmap=$(POD_NAMESPACE)/nginx-over-vpn-ingress-nginx-controller"
          - "--validating-webhook=:8443"
          - "--validating-webhook-certificate=/usr/local/certificates/cert"
          - "--validating-webhook-key=/usr/local/certificates/key"
          - "--enable-metrics=true"
          livenessProbe:
            failureThreshold: 5
            httpGet:
              path: /healthz
              port: 10254
              scheme: HTTP
            initialDelaySeconds: 10
            periodSeconds: 10
            successThreshold: 1
            timeoutSeconds: 1
          ports:
          - name: http
            containerPort: 80
            protocol: TCP
          - name: https
            containerPort: 443
            protocol: TCP
          - name: metrics
            containerPort: 10254
            protocol: TCP
          - name: webhook
            containerPort: 8443
            protocol: TCP
          readinessProbe:
            failureThreshold: 3
            httpGet:
              path: /healthz
              port: 10254
              scheme: HTTP
            initialDelaySeconds: 10
            periodSeconds: 10
            successThreshold: 1
            timeoutSeconds: 1
          resources:
            requests:
              cpu: 100m
              memory: 90Mi
          volumeMounts:
          - name: webhook-cert
            mountPath: /usr/local/certificates/
            readOnly: true
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              add:
              - NET_BIND_SERVICE
              drop:
              - ALL
            readOnlyRootFilesystem: false
            runAsGroup: 82
            runAsNonRoot: true
            runAsUser: 101
            seccompProfile:
              type: RuntimeDefault
          env:
          - name: POD_NAME
            valueFrom:
              fieldRef:
                fieldPath: metadata.name
          - name: POD_NAMESPACE
            valueFrom:
              fieldRef:
                fieldPath: metadata.namespace
          - name: LD_PRELOAD
            value: /usr/local/lib/libmimalloc.so
          lifecycle:
            preStop:
              exec:
                command:
                - /wait-shutdown
        dnsPolicy: ClusterFirst
        nodeSelector:
          kubernetes.io/os: linux
        serviceAccountName: nginx-over-vpn-ingress-nginx
        terminationGracePeriodSeconds: 300
        volumes:
        - name: webhook-cert
          secret:
            items:
            - key: tls.crt
              path: cert
            - key: tls.key
              path: key
            secretName: nginx-over-vpn-ingress-nginx-admission
  


(root level)
+ one document added:
  apiVersion: apps/v1
  kind: Deployment
  metadata:
    name: nginx-over-vpn-ingress-nginx-defaultbackend
    namespace: cluster-ingress
    labels:
      app.kubernetes.io/component: default-backend
      app.kubernetes.io/instance: nginx-over-vpn
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: ingress-nginx
      app.kubernetes.io/part-of: ingress-nginx
      helm.toolkit.fluxcd.io/name: nginx-over-vpn
      helm.toolkit.fluxcd.io/namespace: flux-system
  spec:
    minReadySeconds: 0
    replicas: 1
    revisionHistoryLimit: 10
    selector:
      matchLabels:
        app.kubernetes.io/component: default-backend
        app.kubernetes.io/instance: nginx-over-vpn
        app.kubernetes.io/name: ingress-nginx
    template:
      metadata:
        labels:
          app.kubernetes.io/component: default-backend
          app.kubernetes.io/instance: nginx-over-vpn
          app.kubernetes.io/managed-by: Helm
          app.kubernetes.io/name: ingress-nginx
          app.kubernetes.io/part-of: ingress-nginx
      spec:
        automountServiceAccountToken: true
        containers:
        - name: ingress-nginx-default-backend
          image: "ghcr.io/tarampampam/error-pages:3.3.2"
          imagePullPolicy: IfNotPresent
          env:
          - name: TEMPLATE_NAME
            value: connection
          - name: SHOW_DETAILS
            value: "true"
          - name: SEND_SAME_HTTP_CODE
            value: "true"
          - name: DISABLE_MINIFICATION
            value: "true"
          livenessProbe:
            failureThreshold: 3
            httpGet:
              path: /healthz
              port: 8080
              scheme: HTTP
            initialDelaySeconds: 30
            periodSeconds: 10
            successThreshold: 1
            timeoutSeconds: 5
          ports:
          - name: http
            containerPort: 8080
            protocol: TCP
          readinessProbe:
            failureThreshold: 6
            httpGet:
              path: /healthz
              port: 8080
              scheme: HTTP
            initialDelaySeconds: 0
            periodSeconds: 5
            successThreshold: 1
            timeoutSeconds: 5
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
              - ALL
            readOnlyRootFilesystem: true
            runAsGroup: 65534
            runAsNonRoot: true
            runAsUser: 65534
            seccompProfile:
              type: RuntimeDefault
        nodeSelector:
          kubernetes.io/os: linux
        serviceAccountName: nginx-over-vpn-ingress-nginx-backend
        terminationGracePeriodSeconds: 60

(root level)
+ one document added:
  apiVersion: networking.k8s.io/v1
  kind: IngressClass
  metadata:
    name: nginx-over-vpn
    labels:
      app.kubernetes.io/component: controller
      app.kubernetes.io/instance: nginx-over-vpn
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: ingress-nginx
      app.kubernetes.io/part-of: ingress-nginx
      helm.toolkit.fluxcd.io/name: nginx-over-vpn
      helm.toolkit.fluxcd.io/namespace: flux-system
  spec:
    controller: infra.aether.earth/nginx-over-vpn

(root level)
+ one document added:
  apiVersion: admissionregistration.k8s.io/v1
  kind: ValidatingWebhookConfiguration
  metadata:
    name: nginx-over-vpn-ingress-nginx-admission
    annotations:
      cert-manager.io/inject-ca-from: cluster-ingress/nginx-over-vpn-ingress-nginx-admission
      certmanager.k8s.io/inject-ca-from: cluster-ingress/nginx-over-vpn-ingress-nginx-admission
    labels:
      app.kubernetes.io/component: admission-webhook
      app.kubernetes.io/instance: nginx-over-vpn
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: ingress-nginx
      app.kubernetes.io/part-of: ingress-nginx
      helm.toolkit.fluxcd.io/name: nginx-over-vpn
      helm.toolkit.fluxcd.io/namespace: flux-system
  webhooks:
  - name: validate.nginx.ingress.kubernetes.io
    failurePolicy: Fail
    matchPolicy: Equivalent
    sideEffects: None
    admissionReviewVersions:
    - v1
    clientConfig:
      service:
        name: nginx-over-vpn-ingress-nginx-controller-admission
        namespace: cluster-ingress
        path: /networking/v1/ingresses
        port: 443
    rules:
    - resources:
      - ingresses
      apiGroups:
      - networking.k8s.io
      apiVersions:
      - v1
      operations:
      - CREATE
      - UPDATE
  


(root level)
+ one document added:
  apiVersion: cert-manager.io/v1
  kind: Certificate
  metadata:
    name: nginx-over-vpn-ingress-nginx-admission
    namespace: cluster-ingress
    labels:
      helm.toolkit.fluxcd.io/name: nginx-over-vpn
      helm.toolkit.fluxcd.io/namespace: flux-system
  spec:
    dnsNames:
    - nginx-over-vpn-ingress-nginx-controller-admission
    - nginx-over-vpn-ingress-nginx-controller-admission.cluster-ingress
    - nginx-over-vpn-ingress-nginx-controller-admission.cluster-ingress.svc
    duration: 8760h0m0s
    issuerRef:
      name: in-cluster-ca
      group: cert-manager.io
      kind: ClusterIssuer
    secretName: nginx-over-vpn-ingress-nginx-admission
    subject:
      organizations:
      - ingress-nginx-admission

(root level)
+ one document added:
  apiVersion: monitoring.coreos.com/v1
  kind: ServiceMonitor
  metadata:
    name: nginx-over-vpn-ingress-nginx-controller
    namespace: cluster-ingress
    labels:
      app.kubernetes.io/component: controller
      app.kubernetes.io/instance: nginx-over-vpn
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: ingress-nginx
      app.kubernetes.io/part-of: ingress-nginx
      helm.toolkit.fluxcd.io/name: nginx-over-vpn
      helm.toolkit.fluxcd.io/namespace: flux-system
  spec:
    endpoints:
    - interval: 30s
      port: metrics
    namespaceSelector:
      matchNames:
      - cluster-ingress
    selector:
      matchLabels:
        app.kubernetes.io/component: controller
        app.kubernetes.io/instance: nginx-over-vpn
        app.kubernetes.io/name: ingress-nginx

(root level)
+ one document added:
  apiVersion: v1
  kind: ServiceAccount
  metadata:
    name: node-feature-discovery
    namespace: kube-privileged
    labels:
      app.kubernetes.io/instance: node-feature-discovery
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: node-feature-discovery
      helm.toolkit.fluxcd.io/name: node-feature-discovery
      helm.toolkit.fluxcd.io/namespace: flux-system

(root level)
+ one document added:
  apiVersion: v1
  kind: ServiceAccount
  metadata:
    name: node-feature-discovery-gc
    namespace: kube-privileged
    labels:
      app.kubernetes.io/instance: node-feature-discovery
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: node-feature-discovery
      helm.toolkit.fluxcd.io/name: node-feature-discovery
      helm.toolkit.fluxcd.io/namespace: flux-system

(root level)
+ one document added:
  apiVersion: v1
  kind: ServiceAccount
  metadata:
    name: node-feature-discovery-worker
    namespace: kube-privileged
    labels:
      app.kubernetes.io/instance: node-feature-discovery
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: node-feature-discovery
      helm.toolkit.fluxcd.io/name: node-feature-discovery
      helm.toolkit.fluxcd.io/namespace: flux-system

(root level)
+ one document added:
  apiVersion: v1
  kind: ConfigMap
  metadata:
    name: node-feature-discovery-master-conf
    namespace: kube-privileged
    labels:
      app.kubernetes.io/instance: node-feature-discovery
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: node-feature-discovery
      helm.toolkit.fluxcd.io/name: node-feature-discovery
      helm.toolkit.fluxcd.io/namespace: flux-system
  data:
    nfd-master.conf: "null"

(root level)
+ one document added:
  apiVersion: v1
  kind: ConfigMap
  metadata:
    name: node-feature-discovery-worker-conf
    namespace: kube-privileged
    labels:
      app.kubernetes.io/instance: node-feature-discovery
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: node-feature-discovery
      helm.toolkit.fluxcd.io/name: node-feature-discovery
      helm.toolkit.fluxcd.io/namespace: flux-system
  data:
    nfd-worker.conf: "null"

(root level)
+ one document added:
  apiVersion: rbac.authorization.k8s.io/v1
  kind: ClusterRole
  metadata:
    name: node-feature-discovery
    labels:
      app.kubernetes.io/instance: node-feature-discovery
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: node-feature-discovery
      helm.toolkit.fluxcd.io/name: node-feature-discovery
      helm.toolkit.fluxcd.io/namespace: flux-system
  rules:
  - resources:
    - namespaces
    apiGroups:
    -
    verbs:
    - watch
    - list
  - resources:
    - nodes
    - nodes/status
    apiGroups:
    -
    verbs:
    - get
    - patch
    - update
    - list
  - resources:
    - nodefeatures
    - nodefeaturerules
    - nodefeaturegroups
    apiGroups:
    - nfd.k8s-sigs.io
    verbs:
    - get
    - list
    - watch
  - resources:
    - nodefeaturegroups/status
    apiGroups:
    - nfd.k8s-sigs.io
    verbs:
    - patch
    - update
  - resources:
    - leases
    apiGroups:
    - coordination.k8s.io
    verbs:
    - create
  - resources:
    - leases
    apiGroups:
    - coordination.k8s.io
    resourceNames:
    - nfd-master.nfd.kubernetes.io
    verbs:
    - get
    - update

(root level)
+ one document added:
  apiVersion: rbac.authorization.k8s.io/v1
  kind: ClusterRole
  metadata:
    name: node-feature-discovery-gc
    labels:
      app.kubernetes.io/instance: node-feature-discovery
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: node-feature-discovery
      helm.toolkit.fluxcd.io/name: node-feature-discovery
      helm.toolkit.fluxcd.io/namespace: flux-system
  rules:
  - resources:
    - nodes
    apiGroups:
    -
    verbs:
    - list
    - watch
  - resources:
    - noderesourcetopologies
    apiGroups:
    - topology.node.k8s.io
    verbs:
    - delete
    - list
  - resources:
    - nodefeatures
    apiGroups:
    - nfd.k8s-sigs.io
    verbs:
    - delete
    - list

(root level)
+ one document added:
  apiVersion: rbac.authorization.k8s.io/v1
  kind: ClusterRoleBinding
  metadata:
    name: node-feature-discovery
    labels:
      app.kubernetes.io/instance: node-feature-discovery
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: node-feature-discovery
      helm.toolkit.fluxcd.io/name: node-feature-discovery
      helm.toolkit.fluxcd.io/namespace: flux-system
  roleRef:
    name: node-feature-discovery
    apiGroup: rbac.authorization.k8s.io
    kind: ClusterRole
  subjects:
  - name: node-feature-discovery
    kind: ServiceAccount
    namespace: kube-privileged

(root level)
+ one document added:
  apiVersion: rbac.authorization.k8s.io/v1
  kind: ClusterRoleBinding
  metadata:
    name: node-feature-discovery-gc
    labels:
      app.kubernetes.io/instance: node-feature-discovery
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: node-feature-discovery
      helm.toolkit.fluxcd.io/name: node-feature-discovery
      helm.toolkit.fluxcd.io/namespace: flux-system
  roleRef:
    name: node-feature-discovery-gc
    apiGroup: rbac.authorization.k8s.io
    kind: ClusterRole
  subjects:
  - name: node-feature-discovery-gc
    kind: ServiceAccount
    namespace: kube-privileged

(root level)
+ one document added:
  apiVersion: rbac.authorization.k8s.io/v1
  kind: Role
  metadata:
    name: node-feature-discovery-worker
    namespace: kube-privileged
    labels:
      app.kubernetes.io/instance: node-feature-discovery
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: node-feature-discovery
      helm.toolkit.fluxcd.io/name: node-feature-discovery
      helm.toolkit.fluxcd.io/namespace: flux-system
  rules:
  - resources:
    - nodefeatures
    apiGroups:
    - nfd.k8s-sigs.io
    verbs:
    - create
    - get
    - update
    - delete
  - resources:
    - pods
    apiGroups:
    -
    verbs:
    - get

(root level)
+ one document added:
  apiVersion: rbac.authorization.k8s.io/v1
  kind: RoleBinding
  metadata:
    name: node-feature-discovery-worker
    namespace: kube-privileged
    labels:
      app.kubernetes.io/instance: node-feature-discovery
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: node-feature-discovery
      helm.toolkit.fluxcd.io/name: node-feature-discovery
      helm.toolkit.fluxcd.io/namespace: flux-system
  roleRef:
    name: node-feature-discovery-worker
    apiGroup: rbac.authorization.k8s.io
    kind: Role
  subjects:
  - name: node-feature-discovery-worker
    kind: ServiceAccount
    namespace: kube-privileged

(root level)
+ one document added:
  apiVersion: apps/v1
  kind: DaemonSet
  metadata:
    name: node-feature-discovery-worker
    namespace: kube-privileged
    labels:
      app.kubernetes.io/instance: node-feature-discovery
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: node-feature-discovery
      helm.toolkit.fluxcd.io/name: node-feature-discovery
      helm.toolkit.fluxcd.io/namespace: flux-system
      role: worker
  spec:
    revisionHistoryLimit: null
    selector:
      matchLabels:
        app.kubernetes.io/instance: node-feature-discovery
        app.kubernetes.io/name: node-feature-discovery
        role: worker
    template:
      metadata:
        labels:
          app.kubernetes.io/instance: node-feature-discovery
          app.kubernetes.io/name: node-feature-discovery
          role: worker
      spec:
        containers:
        - name: worker
          image: "registry.k8s.io/nfd/node-feature-discovery:v0.19.0"
          imagePullPolicy: IfNotPresent
          args:
          - "-owner-refs=pod,ds"
          - "-port=8080"
          command:
          - nfd-worker
          livenessProbe:
            httpGet:
              path: /healthz
              port: http
            initialDelaySeconds: 10
          ports:
          - name: http
            containerPort: 8080
          readinessProbe:
            failureThreshold: 10
            httpGet:
              path: /healthz
              port: http
            initialDelaySeconds: 5
          resources:
            limits:
              memory: 512Mi
            requests:
              cpu: 5m
              memory: 64Mi
          volumeMounts:
          - name: host-boot
            mountPath: /host-boot
            readOnly: true
          - name: host-os-release
            mountPath: /host-etc/os-release
            readOnly: true
          - name: host-sys
            mountPath: /host-sys
            readOnly: true
          - name: host-usr-lib
            mountPath: /host-usr/lib
            readOnly: true
          - name: host-lib
            mountPath: /host-lib
            readOnly: true
          - name: host-proc-swaps
            mountPath: /host-proc/swaps
            readOnly: true
          - name: features-d
            mountPath: /etc/kubernetes/node-feature-discovery/features.d/
            readOnly: true
          - name: nfd-worker-conf
            mountPath: /etc/kubernetes/node-feature-discovery
            readOnly: true
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
              - ALL
            readOnlyRootFilesystem: true
            runAsNonRoot: true
          env:
          - name: NODE_NAME
            valueFrom:
              fieldRef:
                fieldPath: spec.nodeName
          - name: POD_NAME
            valueFrom:
              fieldRef:
                fieldPath: metadata.name
          - name: POD_UID
            valueFrom:
              fieldRef:
                fieldPath: metadata.uid
        dnsPolicy: ClusterFirstWithHostNet
        hostNetwork: false
        imagePullSecrets: null
        securityContext: {}
        serviceAccountName: node-feature-discovery-worker
        volumes:
        - name: host-boot
          hostPath:
            path: /boot
        - name: host-os-release
          hostPath:
            path: /etc/os-release
        - name: host-sys
          hostPath:
            path: /sys
        - name: host-usr-lib
          hostPath:
            path: /usr/lib
        - name: host-lib
          hostPath:
            path: /lib
        - name: host-proc-swaps
          hostPath:
            path: /proc/swaps
        - name: features-d
          hostPath:
            path: /etc/kubernetes/node-feature-discovery/features.d/
        - name: nfd-worker-conf
          configMap:
            name: node-feature-discovery-worker-conf
            items:
            - key: nfd-worker.conf
              path: nfd-worker.conf
    updateStrategy:
      rollingUpdate:
        maxUnavailable: 10%

(root level)
+ one document added:
  apiVersion: apps/v1
  kind: Deployment
  metadata:
    name: node-feature-discovery-master
    namespace: kube-privileged
    labels:
      app.kubernetes.io/instance: node-feature-discovery
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: node-feature-discovery
      helm.toolkit.fluxcd.io/name: node-feature-discovery
      helm.toolkit.fluxcd.io/namespace: flux-system
      role: master
  spec:
    replicas: 1
    revisionHistoryLimit: null
    selector:
      matchLabels:
        app.kubernetes.io/instance: node-feature-discovery
        app.kubernetes.io/name: node-feature-discovery
        role: master
    template:
      metadata:
        labels:
          app.kubernetes.io/instance: node-feature-discovery
          app.kubernetes.io/name: node-feature-discovery
          role: master
      spec:
        affinity:
          nodeAffinity:
            preferredDuringSchedulingIgnoredDuringExecution:
            - preference:
                matchExpressions:
                - key: node-role.kubernetes.io/control-plane
                  operator: In
                  values:
                  -
              weight: 1
        containers:
        - name: master
          image: "registry.k8s.io/nfd/node-feature-discovery:v0.19.0"
          imagePullPolicy: IfNotPresent
          args:
          - "-port=8080"
          command:
          - nfd-master
          livenessProbe:
            httpGet:
              path: /healthz
              port: http
          ports:
          - name: http
            containerPort: 8080
          readinessProbe:
            failureThreshold: 10
            httpGet:
              path: /healthz
              port: http
          resources:
            limits:
              memory: 4Gi
            requests:
              cpu: 100m
              memory: 128Mi
          startupProbe:
            failureThreshold: 30
            httpGet:
              path: /healthz
              port: http
          volumeMounts:
          - name: nfd-master-conf
            mountPath: /etc/kubernetes/node-feature-discovery
            readOnly: true
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
              - ALL
            readOnlyRootFilesystem: true
            runAsNonRoot: true
          env:
          - name: NODE_NAME
            valueFrom:
              fieldRef:
                fieldPath: spec.nodeName
        dnsPolicy: ClusterFirstWithHostNet
        enableServiceLinks: false
        hostNetwork: false
        imagePullSecrets: null
        securityContext: {}
        serviceAccountName: node-feature-discovery
        tolerations:
        - key: node-role.kubernetes.io/control-plane
          effect: NoSchedule
          operator: Equal
          value:
        volumes:
        - name: nfd-master-conf
          configMap:
            name: node-feature-discovery-master-conf
            items:
            - key: nfd-master.conf
              path: nfd-master.conf

(root level)
+ one document added:
  apiVersion: apps/v1
  kind: Deployment
  metadata:
    name: node-feature-discovery-gc
    namespace: kube-privileged
    labels:
      app.kubernetes.io/instance: node-feature-discovery
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: node-feature-discovery
      helm.toolkit.fluxcd.io/name: node-feature-discovery
      helm.toolkit.fluxcd.io/namespace: flux-system
      role: gc
  spec:
    replicas: 1
    revisionHistoryLimit: null
    selector:
      matchLabels:
        app.kubernetes.io/instance: node-feature-discovery
        app.kubernetes.io/name: node-feature-discovery
        role: gc
    template:
      metadata:
        labels:
          app.kubernetes.io/instance: node-feature-discovery
          app.kubernetes.io/name: node-feature-discovery
          role: gc
      spec:
        containers:
        - name: gc
          image: "registry.k8s.io/nfd/node-feature-discovery:v0.19.0"
          imagePullPolicy: IfNotPresent
          args:
          - "-gc-interval=1h"
          command:
          - nfd-gc
          livenessProbe:
            httpGet:
              path: /healthz
              port: http
            initialDelaySeconds: 10
          ports:
          - name: http
            containerPort: 8080
          readinessProbe:
            httpGet:
              path: /healthz
              port: http
            initialDelaySeconds: 5
          resources:
            limits:
              memory: 1Gi
            requests:
              cpu: 10m
              memory: 128Mi
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
              - ALL
            readOnlyRootFilesystem: true
            runAsNonRoot: true
          env:
          - name: NODE_NAME
            valueFrom:
              fieldRef:
                fieldPath: spec.nodeName
        dnsPolicy: ClusterFirstWithHostNet
        hostNetwork: false
        imagePullSecrets: null
        securityContext: {}
        serviceAccountName: node-feature-discovery-gc

(root level)
+ one document added:
  apiVersion: monitoring.coreos.com/v1
  kind: PodMonitor
  metadata:
    name: node-feature-discovery
    namespace: kube-privileged
    labels:
      app.kubernetes.io/instance: node-feature-discovery
      app.kubernetes.io/name: node-feature-discovery
      helm.toolkit.fluxcd.io/name: node-feature-discovery
      helm.toolkit.fluxcd.io/namespace: flux-system
  spec:
    namespaceSelector:
      matchNames:
      - kube-privileged
    podMetricsEndpoints:
    - honorLabels: true
      interval: 10s
      path: /metrics
      port: http
      scheme: http
    selector:
      matchExpressions:
      - key: app.kubernetes.io/instance
        operator: In
        values:
        - node-feature-discovery
      - key: app.kubernetes.io/name
        operator: In
        values:
        - node-feature-discovery

(root level)
+ one document added:
  apiVersion: v1
  kind: ServiceAccount
  metadata:
    name: node-feature-discovery-prune
    namespace: kube-privileged
    annotations:
      helm.sh/hook: post-delete
      helm.sh/hook-delete-policy: "before-hook-creation,hook-succeeded"
    labels:
      app.kubernetes.io/instance: node-feature-discovery
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: node-feature-discovery

(root level)
+ one document added:
  apiVersion: rbac.authorization.k8s.io/v1
  kind: ClusterRole
  metadata:
    name: node-feature-discovery-prune
    annotations:
      helm.sh/hook: post-delete
      helm.sh/hook-delete-policy: "before-hook-creation,hook-succeeded"
    labels:
      app.kubernetes.io/instance: node-feature-discovery
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: node-feature-discovery
  rules:
  - resources:
    - nodes
    - nodes/status
    apiGroups:
    -
    verbs:
    - get
    - patch
    - update
    - list

(root level)
+ one document added:
  apiVersion: rbac.authorization.k8s.io/v1
  kind: ClusterRoleBinding
  metadata:
    name: node-feature-discovery-prune
    annotations:
      helm.sh/hook: post-delete
      helm.sh/hook-delete-policy: "before-hook-creation,hook-succeeded"
    labels:
      app.kubernetes.io/instance: node-feature-discovery
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: node-feature-discovery
  roleRef:
    name: node-feature-discovery-prune
    apiGroup: rbac.authorization.k8s.io
    kind: ClusterRole
  subjects:
  - name: node-feature-discovery-prune
    kind: ServiceAccount
    namespace: kube-privileged

(root level)
+ one document added:
  apiVersion: batch/v1
  kind: Job
  metadata:
    name: node-feature-discovery-prune
    namespace: kube-privileged
    annotations:
      helm.sh/hook: post-delete
      helm.sh/hook-delete-policy: "before-hook-creation,hook-succeeded"
    labels:
      app.kubernetes.io/instance: node-feature-discovery
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: node-feature-discovery
  spec:
    template:
      metadata:
        labels:
          app.kubernetes.io/instance: node-feature-discovery
          app.kubernetes.io/managed-by: Helm
          app.kubernetes.io/name: node-feature-discovery
          role: prune
      spec:
        affinity:
          nodeAffinity:
            preferredDuringSchedulingIgnoredDuringExecution:
            - preference:
                matchExpressions:
                - key: node-role.kubernetes.io/control-plane
                  operator: In
                  values:
                  -
              weight: 1
        containers:
        - name: nfd-master
          image: "registry.k8s.io/nfd/node-feature-discovery:v0.19.0"
          imagePullPolicy: IfNotPresent
          args:
          - "-prune"
          command:
          - nfd-master
          resources:
            limits:
              memory: 4Gi
            requests:
              cpu: 100m
              memory: 128Mi
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
              - ALL
            readOnlyRootFilesystem: true
            runAsNonRoot: true
        imagePullSecrets: null
        restartPolicy: Never
        serviceAccountName: node-feature-discovery-prune
        tolerations:
        - key: node-role.kubernetes.io/control-plane
          effect: NoSchedule
          operator: Equal
          value:
    ttlSecondsAfterFinished: 3600

(root level)
+ one document added:
  apiVersion: v1
  kind: ServiceAccount
  metadata:
    name: node-problem-detector
    namespace: kube-privileged
    labels:
      app.kubernetes.io/instance: node-problem-detector
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: node-problem-detector
      helm.toolkit.fluxcd.io/name: node-problem-detector
      helm.toolkit.fluxcd.io/namespace: flux-system

(root level)
+ one document added:
  apiVersion: v1
  kind: ConfigMap
  metadata:
    name: node-problem-detector-custom-config
    namespace: kube-privileged
    labels:
      app.kubernetes.io/instance: node-problem-detector
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: node-problem-detector
      helm.toolkit.fluxcd.io/name: node-problem-detector
      helm.toolkit.fluxcd.io/namespace: flux-system
  data: {}

(root level)
+ one document added:
  apiVersion: rbac.authorization.k8s.io/v1
  kind: ClusterRole
  metadata:
    name: node-problem-detector
    labels:
      app.kubernetes.io/instance: node-problem-detector
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: node-problem-detector
      helm.toolkit.fluxcd.io/name: node-problem-detector
      helm.toolkit.fluxcd.io/namespace: flux-system
  rules:
  - resources:
    - nodes
    apiGroups:
    -
    verbs:
    - get
  - resources:
    - nodes/status
    apiGroups:
    -
    verbs:
    - patch
  - resources:
    - events
    apiGroups:
    -
    verbs:
    - create
    - patch
    - update

(root level)
+ one document added:
  apiVersion: rbac.authorization.k8s.io/v1
  kind: ClusterRoleBinding
  metadata:
    name: node-problem-detector
    labels:
      app.kubernetes.io/instance: node-problem-detector
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: node-problem-detector
      helm.toolkit.fluxcd.io/name: node-problem-detector
      helm.toolkit.fluxcd.io/namespace: flux-system
  roleRef:
    name: node-problem-detector
    apiGroup: rbac.authorization.k8s.io
    kind: ClusterRole
  subjects:
  - name: node-problem-detector
    kind: ServiceAccount
    namespace: kube-privileged

(root level)
+ one document added:
  apiVersion: v1
  kind: Service
  metadata:
    name: node-problem-detector
    namespace: kube-privileged
    annotations:
      prometheus.io/path: /metrics
      prometheus.io/port: "20257"
      prometheus.io/scheme: http
      prometheus.io/scrape: "true"
    labels:
      app: node-problem-detector
      app.kubernetes.io/instance: node-problem-detector
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: node-problem-detector
      helm.toolkit.fluxcd.io/name: node-problem-detector
      helm.toolkit.fluxcd.io/namespace: flux-system
  spec:
    type: ClusterIP
    clusterIP: None
    selector:
      app: node-problem-detector
    ports:
    - name: exporter
      port: 20257
      protocol: TCP

(root level)
+ one document added:
  apiVersion: apps/v1
  kind: DaemonSet
  metadata:
    name: node-problem-detector
    namespace: kube-privileged
    labels:
      app.kubernetes.io/instance: node-problem-detector
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: node-problem-detector
      helm.toolkit.fluxcd.io/name: node-problem-detector
      helm.toolkit.fluxcd.io/namespace: flux-system
  spec:
    selector:
      matchLabels:
        app: node-problem-detector
        app.kubernetes.io/instance: node-problem-detector
        app.kubernetes.io/name: node-problem-detector
    template:
      metadata:
        labels:
          app: node-problem-detector
          app.kubernetes.io/instance: node-problem-detector
          app.kubernetes.io/name: node-problem-detector
      spec:
        containers:
        - name: node-problem-detector
          image: "registry.k8s.io/node-problem-detector/node-problem-detector:v0.8.19"
          imagePullPolicy: IfNotPresent
          resources: {}
          command:
          - /bin/sh
          - "-c"
          - "exec /node-problem-detector --logtostderr --config.system-log-monitor=/config/kernel-monitor.json,/config/docker-monitor.json  --prometheus-address=0.0.0.0 --prometheus-port=20257 --k8s-exporter-heartbeat-period=5m0s  "
          securityContext:
            privileged: true
          ports:
          - name: exporter
            containerPort: 20257
          volumeMounts:
          - name: log
            mountPath: /var/log/
            readOnly: true
          - name: localtime
            mountPath: /etc/localtime
            readOnly: true
          - name: custom-config
            mountPath: /custom-config
            readOnly: true
          env:
          - name: NODE_NAME
            valueFrom:
              fieldRef:
                fieldPath: spec.nodeName
        hostNetwork: false
        hostPID: false
        priorityClassName: system-node-critical
        serviceAccountName: node-problem-detector
        terminationGracePeriodSeconds: 30
        tolerations:
        - effect: NoSchedule
          operator: Exists
        volumes:
        - name: log
          hostPath:
            path: /var/log/
        - name: localtime
          hostPath:
            type: FileOrCreate
            path: /etc/localtime
        - name: custom-config
          configMap:
            name: node-problem-detector-custom-config
            defaultMode: 493
    updateStrategy:
      type: RollingUpdate
      rollingUpdate:
        maxUnavailable: 1
  


(root level)
+ one document added:
  apiVersion: monitoring.coreos.com/v1
  kind: PrometheusRule
  metadata:
    name: node-problem-detector
    namespace: kube-privileged
    labels:
      app.kubernetes.io/instance: node-problem-detector
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: node-problem-detector
      helm.toolkit.fluxcd.io/name: node-problem-detector
      helm.toolkit.fluxcd.io/namespace: flux-system
  spec:
    groups:
    - name: node-problem-detector.rules
      rules:
      - alert: NodeProblemTaskHung
        annotations:
          description: "Task hung in node {{ $labels.node }}"
          summary: "Task hung"
        expr: "increase(problem_counter{reason=\"TaskHung\"}[2m]) > 0"
        for: 1s
        labels:
          severity: warning
      - alert: NodeProblemOOMKilling
        annotations:
          description: "Process Out-Of-Memory Killed in node {{ $labels.node }}"
          summary: "Process Out-Of-Memory Killed"
        expr: "increase(problem_counter{reason=\"OOMKilling\"}[2m]) > 0"
        for: 1s
        labels:
          severity: warning
      - alert: NodeProblemUnregisterNetDevice
        annotations:
          description: "Unable to unregister a network device in node {{ $labels.node }}"
          summary: "Unregister Network Device"
        expr: "increase(problem_counter{reason=\"UnregisterNetDevice\"}[2m]) > 0"
        for: 1s
        labels:
          severity: warning
      - alert: NodeProblemMemoryReadError
        annotations:
          description: "CE memory read error in node {{ $labels.node }}"
          summary: "Memory Read Error"
        expr: "increase(problem_counter{reason=\"MemoryReadError\"}[2m]) > 0"
        for: 1s
        labels:
          severity: warning
      - alert: NodeProblemKernelOops
        annotations:
          description: "Kernel oops detected in node {{ $labels.node }}"
          summary: "Kernel oops"
        expr: "increase(problem_counter{reason=\"KernelOops\"}[2m]) > 0"
        for: 1s
        labels:
          severity: warning
      - alert: NodeProblemIOError
        annotations:
          description: "Buffer I/O error in node {{ $labels.node }}"
          summary: "Buffer I/O error"
        expr: "increase(problem_counter{reason=\"IOError\"}[2m]) > 0"
        for: 1s
        labels:
          severity: warning
      - alert: NodeProblemFilesystemIsReadOnly
        annotations:
          description: "Filesystem is read only in node {{ $labels.node }}"
          summary: "Filesystem is read only"
        expr: "increase(problem_counter{reason=\"FilesystemIsReadOnly\"}[2m]) > 0"
        for: 1s
        labels:
          severity: warning
      - alert: NodeProblemExt4Warning
        annotations:
          description: "EXT4-fs warning in node {{ $labels.node }}"
          summary: "EXT4-fs warning"
        expr: "increase(problem_counter{reason=\"Ext4Warning\"}[2m]) > 0"
        for: 1s
        labels:
          severity: warning
      - alert: NodeProblemExt4Error
        annotations:
          description: "EXT4-fs error in node {{ $labels.node }}"
          summary: "EXT4-fs error"
        expr: "increase(problem_counter{reason=\"Ext4Error\"}[2m]) > 0"
        for: 1s
        labels:
          severity: warning
      - alert: NodeProblemDockerHung
        annotations:
          description: "Docker hung in node {{ $labels.node }}"
          summary: "Docker hung"
        expr: "increase(problem_counter{reason=\"DockerHung\"}[2m]) > 0"
        for: 1s
        labels:
          severity: warning
      - alert: NodeProblemDockerContainerStartupFailure
        annotations:
          description: "Docker container startup failure in node {{ $labels.node }}"
          summary: "Docker container startup failure"
        expr: "increase(problem_counter{reason=\"DockerContainerStartupFailure\"}[2m]) > 0"
        for: 1s
        labels:
          severity: warning
      - alert: NodeProblemCorruptDockerOverlay2
        annotations:
          description: "Corrupt docker overlay2 in node {{ $labels.node }}"
          summary: "Corrupt docker overlay2"
        expr: "increase(problem_counter{reason=\"CorruptDockerOverlay2\"}[2m]) > 0"
        for: 1s
        labels:
          severity: warning
      - alert: NodeProblemCorruptDockerImage
        annotations:
          description: "Corrupt docker image in node {{ $labels.node }}"
          summary: "Corrupt docker image"
        expr: "increase(problem_counter{reason=\"CorruptDockerImage\"}[2m]) > 0"
        for: 1s
        labels:
          severity: warning
      - alert: NodeProblemGaugeCorruptDockerOverlay2
        annotations:
          description: "Corrupt docker overlay2 is affecting node {{ $labels.node }}"
          summary: "Corrupt docker overlay2"
        expr: "increase(problem_gauge{reason=\"CorruptDockerOverlay2\",type=\"CorruptDockerOverlay2\"}[2m]) > 0"
        for: 1s
        labels:
          severity: critical
      - alert: NodeProblemGaugeDockerHung
        annotations:
          description: "Docker hung (Kernel deadlock) is affecting node {{ $labels.node }}"
          summary: "Docker hung"
        expr: "increase(problem_gauge{reason=\"DockerHung\",type=\"KernelDeadlock\"}[2m]) > 0"
        for: 1s
        labels:
          severity: critical
      - alert: NodeProblemGaugeFilesystemIsReadOnly
        annotations:
          description: "Read only filesystem is affecting node {{ $labels.node }}"
          summary: "Filesystem is read only"
        expr: "increase(problem_gauge{reason=\"FilesystemIsReadOnly\",type=\"ReadonlyFilesystem\"}[2m]) > 0"
        for: 1s
        labels:
          severity: critical
  


(root level)
+ one document added:
  apiVersion: monitoring.coreos.com/v1
  kind: ServiceMonitor
  metadata:
    name: node-problem-detector
    namespace: kube-privileged
    labels:
      app.kubernetes.io/instance: node-problem-detector
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: node-problem-detector
      helm.toolkit.fluxcd.io/name: node-problem-detector
      helm.toolkit.fluxcd.io/namespace: flux-system
  spec:
    endpoints:
    - interval: 60s
      path: /metrics
      port: exporter
      relabelings:
      - action: replace
        sourceLabels:
        - __meta_kubernetes_pod_node_name
        targetLabel: node
      - action: replace
        sourceLabels:
        - __meta_kubernetes_pod_host_ip
        targetLabel: host_ip
    namespaceSelector:
      matchNames:
      - kube-privileged
    selector:
      matchLabels:
        app: node-problem-detector

(root level)
+ one document added:
  apiVersion: v1
  kind: ServiceAccount
  metadata:
    name: node-feature-discovery
    namespace: nvidia
    labels:
      app.kubernetes.io/instance: nvidia-device-plugin
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: node-feature-discovery
      helm.toolkit.fluxcd.io/name: nvidia-device-plugin
      helm.toolkit.fluxcd.io/namespace: flux-system

(root level)
+ one document added:
  apiVersion: v1
  kind: ServiceAccount
  metadata:
    name: nvidia-device-plugin-node-feature-discovery-gc
    namespace: nvidia
    labels:
      app.kubernetes.io/instance: nvidia-device-plugin
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: node-feature-discovery
      helm.toolkit.fluxcd.io/name: nvidia-device-plugin
      helm.toolkit.fluxcd.io/namespace: flux-system

(root level)
+ one document added:
  apiVersion: v1
  kind: ServiceAccount
  metadata:
    name: nvidia-device-plugin-node-feature-discovery-worker
    namespace: nvidia
    labels:
      app.kubernetes.io/instance: nvidia-device-plugin
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: node-feature-discovery
      helm.toolkit.fluxcd.io/name: nvidia-device-plugin
      helm.toolkit.fluxcd.io/namespace: flux-system

(root level)
+ one document added:
  apiVersion: v1
  kind: ServiceAccount
  metadata:
    name: nvidia-device-plugin-service-account
    namespace: nvidia
    labels:
      app.kubernetes.io/instance: nvidia-device-plugin
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: nvidia-device-plugin
      helm.toolkit.fluxcd.io/name: nvidia-device-plugin
      helm.toolkit.fluxcd.io/namespace: flux-system

(root level)
+ one document added:
  apiVersion: v1
  kind: ConfigMap
  metadata:
    name: nvidia-device-plugin-node-feature-discovery-master-conf
    namespace: nvidia
    labels:
      app.kubernetes.io/instance: nvidia-device-plugin
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: node-feature-discovery
      helm.toolkit.fluxcd.io/name: nvidia-device-plugin
      helm.toolkit.fluxcd.io/namespace: flux-system
  data:
    nfd-master.conf: |
      extraLabelNs:
      - nvidia.com

(root level)
+ one document added:
  apiVersion: v1
  kind: ConfigMap
  metadata:
    name: nvidia-device-plugin-node-feature-discovery-worker-conf
    namespace: nvidia
    labels:
      app.kubernetes.io/instance: nvidia-device-plugin
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: node-feature-discovery
      helm.toolkit.fluxcd.io/name: nvidia-device-plugin
      helm.toolkit.fluxcd.io/namespace: flux-system
  data:
    nfd-worker.conf: |
      sources:
        pci:
          deviceClassWhitelist:
          - "02"
          - "03"
          deviceLabelFields:
          - vendor

(root level)
+ one document added:
  apiVersion: v1
  kind: ConfigMap
  metadata:
    name: nvidia-device-plugin-configs
    namespace: nvidia
    labels:
      app.kubernetes.io/instance: nvidia-device-plugin
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: nvidia-device-plugin
      helm.toolkit.fluxcd.io/name: nvidia-device-plugin
      helm.toolkit.fluxcd.io/namespace: flux-system
  data:
    default: |
      "flags":
        "migStrategy": "none"
      "sharing":
        "timeSlicing":
          "resources":
          - "name": "nvidia.com/gpu"
            "replicas": 64
      "version": "v1"

(root level)
+ one document added:
  apiVersion: rbac.authorization.k8s.io/v1
  kind: ClusterRole
  metadata:
    name: nvidia-device-plugin-node-feature-discovery
    labels:
      app.kubernetes.io/instance: nvidia-device-plugin
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: node-feature-discovery
      helm.toolkit.fluxcd.io/name: nvidia-device-plugin
      helm.toolkit.fluxcd.io/namespace: flux-system
  rules:
  - resources:
    - namespaces
    apiGroups:
    -
    verbs:
    - watch
    - list
  - resources:
    - nodes
    - nodes/status
    apiGroups:
    -
    verbs:
    - get
    - patch
    - update
    - list
  - resources:
    - nodefeatures
    - nodefeaturerules
    - nodefeaturegroups
    apiGroups:
    - nfd.k8s-sigs.io
    verbs:
    - get
    - list
    - watch
  - resources:
    - nodefeaturegroups/status
    apiGroups:
    - nfd.k8s-sigs.io
    verbs:
    - patch
    - update
  - resources:
    - leases
    apiGroups:
    - coordination.k8s.io
    verbs:
    - create
  - resources:
    - leases
    apiGroups:
    - coordination.k8s.io
    resourceNames:
    - nfd-master.nfd.kubernetes.io
    verbs:
    - get
    - update

(root level)
+ one document added:
  apiVersion: rbac.authorization.k8s.io/v1
  kind: ClusterRole
  metadata:
    name: nvidia-device-plugin-node-feature-discovery-gc
    labels:
      app.kubernetes.io/instance: nvidia-device-plugin
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: node-feature-discovery
      helm.toolkit.fluxcd.io/name: nvidia-device-plugin
      helm.toolkit.fluxcd.io/namespace: flux-system
  rules:
  - resources:
    - nodes
    apiGroups:
    -
    verbs:
    - list
    - watch
  - resources:
    - nodes/proxy
    apiGroups:
    -
    verbs:
    - get
  - resources:
    - noderesourcetopologies
    apiGroups:
    - topology.node.k8s.io
    verbs:
    - delete
    - list
  - resources:
    - nodefeatures
    apiGroups:
    - nfd.k8s-sigs.io
    verbs:
    - delete
    - list

(root level)
+ one document added:
  apiVersion: rbac.authorization.k8s.io/v1
  kind: ClusterRole
  metadata:
    name: nvidia-device-plugin-role
    labels:
      app.kubernetes.io/instance: nvidia-device-plugin
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: nvidia-device-plugin
      helm.toolkit.fluxcd.io/name: nvidia-device-plugin
      helm.toolkit.fluxcd.io/namespace: flux-system
  rules:
  - resources:
    - nodes
    apiGroups:
    -
    verbs:
    - get
    - list
    - watch
  - resources:
    - nodefeatures
    apiGroups:
    - nfd.k8s-sigs.io
    verbs:
    - get
    - list
    - watch
    - create
    - update
  - resources:
    - pods
    apiGroups:
    -
    verbs:
    - get

(root level)
+ one document added:
  apiVersion: rbac.authorization.k8s.io/v1
  kind: ClusterRoleBinding
  metadata:
    name: nvidia-device-plugin-node-feature-discovery
    labels:
      app.kubernetes.io/instance: nvidia-device-plugin
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: node-feature-discovery
      helm.toolkit.fluxcd.io/name: nvidia-device-plugin
      helm.toolkit.fluxcd.io/namespace: flux-system
  roleRef:
    name: nvidia-device-plugin-node-feature-discovery
    apiGroup: rbac.authorization.k8s.io
    kind: ClusterRole
  subjects:
  - name: node-feature-discovery
    kind: ServiceAccount
    namespace: nvidia

(root level)
+ one document added:
  apiVersion: rbac.authorization.k8s.io/v1
  kind: ClusterRoleBinding
  metadata:
    name: nvidia-device-plugin-node-feature-discovery-gc
    labels:
      app.kubernetes.io/instance: nvidia-device-plugin
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: node-feature-discovery
      helm.toolkit.fluxcd.io/name: nvidia-device-plugin
      helm.toolkit.fluxcd.io/namespace: flux-system
  roleRef:
    name: nvidia-device-plugin-node-feature-discovery-gc
    apiGroup: rbac.authorization.k8s.io
    kind: ClusterRole
  subjects:
  - name: nvidia-device-plugin-node-feature-discovery-gc
    kind: ServiceAccount
    namespace: nvidia

(root level)
+ one document added:
  apiVersion: rbac.authorization.k8s.io/v1
  kind: ClusterRoleBinding
  metadata:
    name: nvidia-device-plugin-role-binding
    labels:
      app.kubernetes.io/instance: nvidia-device-plugin
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: nvidia-device-plugin
      helm.toolkit.fluxcd.io/name: nvidia-device-plugin
      helm.toolkit.fluxcd.io/namespace: flux-system
  roleRef:
    name: nvidia-device-plugin-role
    apiGroup: rbac.authorization.k8s.io
    kind: ClusterRole
  subjects:
  - name: nvidia-device-plugin-service-account
    kind: ServiceAccount
    namespace: nvidia

(root level)
+ one document added:
  apiVersion: rbac.authorization.k8s.io/v1
  kind: Role
  metadata:
    name: nvidia-device-plugin-node-feature-discovery-worker
    namespace: nvidia
    labels:
      app.kubernetes.io/instance: nvidia-device-plugin
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: node-feature-discovery
      helm.toolkit.fluxcd.io/name: nvidia-device-plugin
      helm.toolkit.fluxcd.io/namespace: flux-system
  rules:
  - resources:
    - nodefeatures
    apiGroups:
    - nfd.k8s-sigs.io
    verbs:
    - create
    - get
    - update
    - delete
  - resources:
    - pods
    apiGroups:
    -
    verbs:
    - get

(root level)
+ one document added:
  apiVersion: rbac.authorization.k8s.io/v1
  kind: RoleBinding
  metadata:
    name: nvidia-device-plugin-node-feature-discovery-worker
    namespace: nvidia
    labels:
      app.kubernetes.io/instance: nvidia-device-plugin
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: node-feature-discovery
      helm.toolkit.fluxcd.io/name: nvidia-device-plugin
      helm.toolkit.fluxcd.io/namespace: flux-system
  roleRef:
    name: nvidia-device-plugin-node-feature-discovery-worker
    apiGroup: rbac.authorization.k8s.io
    kind: Role
  subjects:
  - name: nvidia-device-plugin-node-feature-discovery-worker
    kind: ServiceAccount
    namespace: nvidia

(root level)
+ one document added:
  apiVersion: apps/v1
  kind: DaemonSet
  metadata:
    name: nvidia-device-plugin-node-feature-discovery-worker
    namespace: nvidia
    labels:
      app.kubernetes.io/instance: nvidia-device-plugin
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: node-feature-discovery
      helm.toolkit.fluxcd.io/name: nvidia-device-plugin
      helm.toolkit.fluxcd.io/namespace: flux-system
      role: worker
  spec:
    revisionHistoryLimit: null
    selector:
      matchLabels:
        app.kubernetes.io/instance: nvidia-device-plugin
        app.kubernetes.io/name: node-feature-discovery
        role: worker
    template:
      metadata:
        labels:
          app.kubernetes.io/instance: nvidia-device-plugin
          app.kubernetes.io/name: node-feature-discovery
          role: worker
      spec:
        containers:
        - name: worker
          image: "registry.k8s.io/nfd/node-feature-discovery:v0.17.3"
          imagePullPolicy: IfNotPresent
          args:
          - "-feature-gates=NodeFeatureGroupAPI=false"
          - "-metrics=8081"
          - "-grpc-health=8082"
          command:
          - nfd-worker
          livenessProbe:
            grpc:
              port: 8082
            initialDelaySeconds: 10
          ports:
          - name: metrics
            containerPort: 8081
          - name: health
            containerPort: 8082
          readinessProbe:
            failureThreshold: 10
            grpc:
              port: 8082
            initialDelaySeconds: 5
          resources:
            limits:
              memory: 512Mi
            requests:
              cpu: 5m
              memory: 64Mi
          volumeMounts:
          - name: host-boot
            mountPath: /host-boot
            readOnly: true
          - name: host-os-release
            mountPath: /host-etc/os-release
            readOnly: true
          - name: host-sys
            mountPath: /host-sys
            readOnly: true
          - name: host-usr-lib
            mountPath: /host-usr/lib
            readOnly: true
          - name: host-lib
            mountPath: /host-lib
            readOnly: true
          - name: host-proc-swaps
            mountPath: /host-proc/swaps
            readOnly: true
          - name: features-d
            mountPath: /etc/kubernetes/node-feature-discovery/features.d/
            readOnly: true
          - name: nfd-worker-conf
            mountPath: /etc/kubernetes/node-feature-discovery
            readOnly: true
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
              - ALL
            readOnlyRootFilesystem: true
            runAsNonRoot: true
          env:
          - name: NODE_NAME
            valueFrom:
              fieldRef:
                fieldPath: spec.nodeName
          - name: POD_NAME
            valueFrom:
              fieldRef:
                fieldPath: metadata.name
          - name: POD_UID
            valueFrom:
              fieldRef:
                fieldPath: metadata.uid
        dnsPolicy: ClusterFirstWithHostNet
        hostNetwork: false
        securityContext: {}
        serviceAccountName: nvidia-device-plugin-node-feature-discovery-worker
        tolerations:
        - key: node-role.kubernetes.io/master
          effect: NoSchedule
          operator: Equal
          value:
        - key: nvidia.com/gpu
          effect: NoSchedule
          operator: Equal
          value: present
        volumes:
        - name: host-boot
          hostPath:
            path: /boot
        - name: host-os-release
          hostPath:
            path: /etc/os-release
        - name: host-sys
          hostPath:
            path: /sys
        - name: host-usr-lib
          hostPath:
            path: /usr/lib
        - name: host-lib
          hostPath:
            path: /lib
        - name: host-proc-swaps
          hostPath:
            path: /proc/swaps
        - name: features-d
          hostPath:
            path: /etc/kubernetes/node-feature-discovery/features.d/
        - name: nfd-worker-conf
          configMap:
            name: nvidia-device-plugin-node-feature-discovery-worker-conf
            items:
            - key: nfd-worker.conf
              path: nfd-worker.conf

(root level)
+ one document added:
  apiVersion: apps/v1
  kind: DaemonSet
  metadata:
    name: nvidia-device-plugin
    namespace: nvidia
    labels:
      app.kubernetes.io/instance: nvidia-device-plugin
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: nvidia-device-plugin
      helm.toolkit.fluxcd.io/name: nvidia-device-plugin
      helm.toolkit.fluxcd.io/namespace: flux-system
  spec:
    selector:
      matchLabels:
        app.kubernetes.io/instance: nvidia-device-plugin
        app.kubernetes.io/name: nvidia-device-plugin
    template:
      metadata:
        labels:
          app.kubernetes.io/instance: nvidia-device-plugin
          app.kubernetes.io/name: nvidia-device-plugin
      spec:
        affinity:
          nodeAffinity:
            requiredDuringSchedulingIgnoredDuringExecution:
              nodeSelectorTerms:
              - matchExpressions:
                - key: feature.node.kubernetes.io/pci-10de.present
                  operator: In
                  values:
                  - "true"
              - matchExpressions:
                - key: feature.node.kubernetes.io/cpu-model.vendor_id
                  operator: In
                  values:
                  - NVIDIA
              - matchExpressions:
                - key: nvidia.com/gpu.present
                  operator: In
                  values:
                  - "true"
        containers:
        - name: nvidia-device-plugin-sidecar
          image: "nvcr.io/nvidia/k8s-device-plugin:v0.19.3"
          command:
          - config-manager
          volumeMounts:
          - name: available-configs
            mountPath: /available-configs
          - name: config
            mountPath: /config
          securityContext:
            capabilities:
              add:
              - SYS_ADMIN
          env:
          - name: ONESHOT
            value: "false"
          - name: KUBECONFIG
            value:
          - name: NODE_NAME
            valueFrom:
              fieldRef:
                fieldPath: spec.nodeName
          - name: NODE_LABEL
            value: nvidia.com/device-plugin.config
          - name: CONFIG_FILE_SRCDIR
            value: /available-configs
          - name: CONFIG_FILE_DST
            value: /config/config.yaml
          - name: DEFAULT_CONFIG
            value: null
          - name: FALLBACK_STRATEGIES
            value: "named,single"
          - name: SEND_SIGNAL
            value: "true"
          - name: SIGNAL
            value: "1"
          - name: PROCESS_TO_SIGNAL
            value: nvidia-device-plugin
        - name: nvidia-device-plugin-ctr
          image: "nvcr.io/nvidia/k8s-device-plugin:v0.19.3"
          imagePullPolicy: IfNotPresent
          command:
          - nvidia-device-plugin
          env:
          - name: MPS_ROOT
            value: /run/nvidia/mps
          - name: CONFIG_FILE
            value: /config/config.yaml
          - name: NVIDIA_MIG_MONITOR_DEVICES
            value: all
          - name: NVIDIA_VISIBLE_DEVICES
            value: all
          - name: NVIDIA_DRIVER_CAPABILITIES
            value: "compute,utility"
          volumeMounts:
          - name: kubelet-device-plugins-dir
            mountPath: /var/lib/kubelet/device-plugins
          - name: mps-shm
            mountPath: /dev/shm
          - name: mps-root
            mountPath: /mps
          - name: cdi-root
            mountPath: /var/run/cdi
          - name: available-configs
            mountPath: /available-configs
          - name: config
            mountPath: /config
          securityContext:
            capabilities:
              add:
              - SYS_ADMIN
        initContainers:
        - name: nvidia-device-plugin-init
          image: "nvcr.io/nvidia/k8s-device-plugin:v0.19.3"
          command:
          - config-manager
          volumeMounts:
          - name: available-configs
            mountPath: /available-configs
          - name: config
            mountPath: /config
          env:
          - name: ONESHOT
            value: "true"
          - name: KUBECONFIG
            value:
          - name: NODE_NAME
            valueFrom:
              fieldRef:
                fieldPath: spec.nodeName
          - name: NODE_LABEL
            value: nvidia.com/device-plugin.config
          - name: CONFIG_FILE_SRCDIR
            value: /available-configs
          - name: CONFIG_FILE_DST
            value: /config/config.yaml
          - name: DEFAULT_CONFIG
            value: null
          - name: FALLBACK_STRATEGIES
            value: "named,single"
          - name: SEND_SIGNAL
            value: "false"
          - name: SIGNAL
            value:
          - name: PROCESS_TO_SIGNAL
            value:
        priorityClassName: system-node-critical
        runtimeClassName: nvidia
        securityContext: {}
        serviceAccountName: nvidia-device-plugin-service-account
        shareProcessNamespace: true
        tolerations:
        - key: CriticalAddonsOnly
          operator: Exists
        - key: nvidia.com/gpu
          effect: NoSchedule
          operator: Exists
        volumes:
        - name: kubelet-device-plugins-dir
          hostPath:
            type: Directory
            path: /var/lib/kubelet/device-plugins
        - name: mps-root
          hostPath:
            type: DirectoryOrCreate
            path: /run/nvidia/mps
        - name: mps-shm
          hostPath:
            path: /run/nvidia/mps/shm
        - name: cdi-root
          hostPath:
            type: DirectoryOrCreate
            path: /var/run/cdi
        - name: available-configs
          configMap:
            name: nvidia-device-plugin-configs
        - name: config
          emptyDir: {}
    updateStrategy:
      type: RollingUpdate

(root level)
+ one document added:
  apiVersion: apps/v1
  kind: DaemonSet
  metadata:
    name: nvidia-device-plugin-gpu-feature-discovery
    namespace: nvidia
    labels:
      app.kubernetes.io/instance: nvidia-device-plugin
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: nvidia-device-plugin
      helm.toolkit.fluxcd.io/name: nvidia-device-plugin
      helm.toolkit.fluxcd.io/namespace: flux-system
  spec:
    selector:
      matchLabels:
        app.kubernetes.io/instance: nvidia-device-plugin
        app.kubernetes.io/name: nvidia-device-plugin
    template:
      metadata:
        labels:
          app.kubernetes.io/instance: nvidia-device-plugin
          app.kubernetes.io/name: nvidia-device-plugin
      spec:
        affinity:
          nodeAffinity:
            requiredDuringSchedulingIgnoredDuringExecution:
              nodeSelectorTerms:
              - matchExpressions:
                - key: feature.node.kubernetes.io/pci-10de.present
                  operator: In
                  values:
                  - "true"
              - matchExpressions:
                - key: feature.node.kubernetes.io/cpu-model.vendor_id
                  operator: In
                  values:
                  - NVIDIA
              - matchExpressions:
                - key: nvidia.com/gpu.present
                  operator: In
                  values:
                  - "true"
        containers:
        - name: gpu-feature-discovery-sidecar
          image: "nvcr.io/nvidia/k8s-device-plugin:v0.19.3"
          command:
          - config-manager
          securityContext:
            privileged: true
          volumeMounts:
          - name: available-configs
            mountPath: /available-configs
          - name: config
            mountPath: /config
          env:
          - name: ONESHOT
            value: "false"
          - name: KUBECONFIG
            value:
          - name: NODE_NAME
            valueFrom:
              fieldRef:
                fieldPath: spec.nodeName
          - name: NODE_LABEL
            value: nvidia.com/device-plugin.config
          - name: CONFIG_FILE_SRCDIR
            value: /available-configs
          - name: CONFIG_FILE_DST
            value: /config/config.yaml
          - name: DEFAULT_CONFIG
            value: null
          - name: FALLBACK_STRATEGIES
            value: "named,single"
          - name: SEND_SIGNAL
            value: "true"
          - name: SIGNAL
            value: "1"
          - name: PROCESS_TO_SIGNAL
            value: gpu-feature-discovery
        - name: gpu-feature-discovery-ctr
          image: "nvcr.io/nvidia/k8s-device-plugin:v0.19.3"
          imagePullPolicy: IfNotPresent
          command:
          - gpu-feature-discovery
          securityContext:
            privileged: true
          volumeMounts:
          - name: output-dir
            mountPath: /etc/kubernetes/node-feature-discovery/features.d
          - name: host-sys
            mountPath: /sys
          - name: available-configs
            mountPath: /available-configs
          - name: config
            mountPath: /config
          env:
          - name: NODE_NAME
            valueFrom:
              fieldRef:
                fieldPath: spec.nodeName
          - name: NAMESPACE
            valueFrom:
              fieldRef:
                fieldPath: metadata.namespace
          - name: POD_NAME
            valueFrom:
              fieldRef:
                fieldPath: metadata.name
          - name: CONFIG_FILE
            value: /config/config.yaml
          - name: NVIDIA_MIG_MONITOR_DEVICES
            value: all
        initContainers:
        - name: gpu-feature-discovery-init
          image: "nvcr.io/nvidia/k8s-device-plugin:v0.19.3"
          command:
          - config-manager
          volumeMounts:
          - name: available-configs
            mountPath: /available-configs
          - name: config
            mountPath: /config
          env:
          - name: ONESHOT
            value: "true"
          - name: KUBECONFIG
            value:
          - name: NODE_NAME
            valueFrom:
              fieldRef:
                fieldPath: spec.nodeName
          - name: NODE_LABEL
            value: nvidia.com/device-plugin.config
          - name: CONFIG_FILE_SRCDIR
            value: /available-configs
          - name: CONFIG_FILE_DST
            value: /config/config.yaml
          - name: DEFAULT_CONFIG
            value: null
          - name: FALLBACK_STRATEGIES
            value: "named,single"
          - name: SEND_SIGNAL
            value: "false"
          - name: SIGNAL
            value:
          - name: PROCESS_TO_SIGNAL
            value:
        priorityClassName: system-node-critical
        runtimeClassName: nvidia
        securityContext: {}
        serviceAccountName: nvidia-device-plugin-service-account
        shareProcessNamespace: true
        tolerations:
        - key: CriticalAddonsOnly
          operator: Exists
        - key: nvidia.com/gpu
          effect: NoSchedule
          operator: Exists
        volumes:
        - name: output-dir
          hostPath:
            type: DirectoryOrCreate
            path: /etc/kubernetes/node-feature-discovery/features.d
        - name: host-sys
          hostPath:
            type: Directory
            path: /sys
        - name: driver-root
          hostPath:
            type: Directory
            path: /
        - name: available-configs
          configMap:
            name: nvidia-device-plugin-configs
        - name: config
          emptyDir: {}
    updateStrategy:
      type: RollingUpdate

(root level)
+ one document added:
  apiVersion: apps/v1
  kind: DaemonSet
  metadata:
    name: nvidia-device-plugin-mps-control-daemon
    namespace: nvidia
    labels:
      app.kubernetes.io/instance: nvidia-device-plugin
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: nvidia-device-plugin
      helm.toolkit.fluxcd.io/name: nvidia-device-plugin
      helm.toolkit.fluxcd.io/namespace: flux-system
  spec:
    selector:
      matchLabels:
        app.kubernetes.io/instance: nvidia-device-plugin
        app.kubernetes.io/name: nvidia-device-plugin
    template:
      metadata:
        labels:
          app.kubernetes.io/instance: nvidia-device-plugin
          app.kubernetes.io/name: nvidia-device-plugin
      spec:
        affinity:
          nodeAffinity:
            requiredDuringSchedulingIgnoredDuringExecution:
              nodeSelectorTerms:
              - matchExpressions:
                - key: feature.node.kubernetes.io/pci-10de.present
                  operator: In
                  values:
                  - "true"
              - matchExpressions:
                - key: feature.node.kubernetes.io/cpu-model.vendor_id
                  operator: In
                  values:
                  - NVIDIA
              - matchExpressions:
                - key: nvidia.com/gpu.present
                  operator: In
                  values:
                  - "true"
        containers:
        - name: mps-control-daemon-sidecar
          image: "nvcr.io/nvidia/k8s-device-plugin:v0.19.3"
          command:
          - config-manager
          volumeMounts:
          - name: available-configs
            mountPath: /available-configs
          - name: config
            mountPath: /config
          env:
          - name: ONESHOT
            value: "false"
          - name: KUBECONFIG
            value:
          - name: NODE_NAME
            valueFrom:
              fieldRef:
                fieldPath: spec.nodeName
          - name: NODE_LABEL
            value: nvidia.com/device-plugin.config
          - name: CONFIG_FILE_SRCDIR
            value: /available-configs
          - name: CONFIG_FILE_DST
            value: /config/config.yaml
          - name: DEFAULT_CONFIG
            value: null
          - name: FALLBACK_STRATEGIES
            value: "named,single"
          - name: SEND_SIGNAL
            value: "true"
          - name: SIGNAL
            value: "1"
          - name: PROCESS_TO_SIGNAL
            value: /usr/bin/mps-control-daemon
        - name: mps-control-daemon-ctr
          image: "nvcr.io/nvidia/k8s-device-plugin:v0.19.3"
          imagePullPolicy: IfNotPresent
          command:
          - mps-control-daemon
          securityContext:
            privileged: true
          volumeMounts:
          - name: mps-shm
            mountPath: /dev/shm
          - name: mps-root
            mountPath: /mps
          - name: available-configs
            mountPath: /available-configs
          - name: config
            mountPath: /config
          env:
          - name: NODE_NAME
            valueFrom:
              fieldRef:
                apiVersion: v1
                fieldPath: spec.nodeName
          - name: CONFIG_FILE
            value: /config/config.yaml
          - name: NVIDIA_MIG_MONITOR_DEVICES
            value: all
          - name: NVIDIA_VISIBLE_DEVICES
            value: all
          - name: NVIDIA_DRIVER_CAPABILITIES
            value: "compute,utility"
        hostPID: true
        initContainers:
        - name: mps-control-daemon-mounts
          image: "nvcr.io/nvidia/k8s-device-plugin:v0.19.3"
          command:
          - mps-control-daemon
          - mount-shm
          securityContext:
            privileged: true
          volumeMounts:
          - name: mps-root
            mountPath: /mps
            mountPropagation: Bidirectional
        - name: mps-control-daemon-init
          image: "nvcr.io/nvidia/k8s-device-plugin:v0.19.3"
          command:
          - config-manager
          volumeMounts:
          - name: available-configs
            mountPath: /available-configs
          - name: config
            mountPath: /config
          env:
          - name: ONESHOT
            value: "true"
          - name: KUBECONFIG
            value:
          - name: NODE_NAME
            valueFrom:
              fieldRef:
                fieldPath: spec.nodeName
          - name: NODE_LABEL
            value: nvidia.com/device-plugin.config
          - name: CONFIG_FILE_SRCDIR
            value: /available-configs
          - name: CONFIG_FILE_DST
            value: /config/config.yaml
          - name: DEFAULT_CONFIG
            value: null
          - name: FALLBACK_STRATEGIES
            value: "named,single"
          - name: SEND_SIGNAL
            value: "false"
          - name: SIGNAL
            value:
          - name: PROCESS_TO_SIGNAL
            value:
        nodeSelector:
          nvidia.com/mps.capable: "true"
        priorityClassName: system-node-critical
        runtimeClassName: nvidia
        securityContext: {}
        serviceAccountName: nvidia-device-plugin-service-account
        tolerations:
        - key: CriticalAddonsOnly
          operator: Exists
        - key: nvidia.com/gpu
          effect: NoSchedule
          operator: Exists
        volumes:
        - name: mps-root
          hostPath:
            type: DirectoryOrCreate
            path: /run/nvidia/mps
        - name: mps-shm
          hostPath:
            path: /run/nvidia/mps/shm
        - name: available-configs
          configMap:
            name: nvidia-device-plugin-configs
        - name: config
          emptyDir: {}
    updateStrategy:
      type: RollingUpdate

(root level)
+ one document added:
  apiVersion: apps/v1
  kind: Deployment
  metadata:
    name: nvidia-device-plugin-node-feature-discovery-master
    namespace: nvidia
    labels:
      app.kubernetes.io/instance: nvidia-device-plugin
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: node-feature-discovery
      helm.toolkit.fluxcd.io/name: nvidia-device-plugin
      helm.toolkit.fluxcd.io/namespace: flux-system
      role: master
  spec:
    replicas: 1
    revisionHistoryLimit: null
    selector:
      matchLabels:
        app.kubernetes.io/instance: nvidia-device-plugin
        app.kubernetes.io/name: node-feature-discovery
        role: master
    template:
      metadata:
        labels:
          app.kubernetes.io/instance: nvidia-device-plugin
          app.kubernetes.io/name: node-feature-discovery
          role: master
      spec:
        affinity:
          nodeAffinity:
            preferredDuringSchedulingIgnoredDuringExecution:
            - preference:
                matchExpressions:
                - key: node-role.kubernetes.io/master
                  operator: In
                  values:
                  -
              weight: 1
            - preference:
                matchExpressions:
                - key: node-role.kubernetes.io/control-plane
                  operator: In
                  values:
                  -
              weight: 1
        containers:
        - name: master
          image: "registry.k8s.io/nfd/node-feature-discovery:v0.17.3"
          imagePullPolicy: IfNotPresent
          args:
          - "-enable-leader-election"
          - "-feature-gates=NodeFeatureGroupAPI=false"
          - "-metrics=8081"
          - "-grpc-health=8082"
          command:
          - nfd-master
          livenessProbe:
            grpc:
              port: 8082
          ports:
          - name: metrics
            containerPort: 8081
          - name: health
            containerPort: 8082
          readinessProbe:
            failureThreshold: 10
            grpc:
              port: 8082
          resources:
            limits:
              memory: 4Gi
            requests:
              cpu: 100m
              memory: 128Mi
          startupProbe:
            failureThreshold: 30
            grpc:
              port: 8082
          volumeMounts:
          - name: nfd-master-conf
            mountPath: /etc/kubernetes/node-feature-discovery
            readOnly: true
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
              - ALL
            readOnlyRootFilesystem: true
            runAsNonRoot: true
          env:
          - name: NODE_NAME
            valueFrom:
              fieldRef:
                fieldPath: spec.nodeName
        enableServiceLinks: false
        hostNetwork: false
        securityContext: {}
        serviceAccountName: node-feature-discovery
        tolerations:
        - key: node-role.kubernetes.io/master
          effect: NoSchedule
          operator: Equal
          value:
        - key: node-role.kubernetes.io/control-plane
          effect: NoSchedule
          operator: Equal
          value:
        volumes:
        - name: nfd-master-conf
          configMap:
            name: nvidia-device-plugin-node-feature-discovery-master-conf
            items:
            - key: nfd-master.conf
              path: nfd-master.conf

(root level)
+ one document added:
  apiVersion: apps/v1
  kind: Deployment
  metadata:
    name: nvidia-device-plugin-node-feature-discovery-gc
    namespace: nvidia
    labels:
      app.kubernetes.io/instance: nvidia-device-plugin
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: node-feature-discovery
      helm.toolkit.fluxcd.io/name: nvidia-device-plugin
      helm.toolkit.fluxcd.io/namespace: flux-system
      role: gc
  spec:
    replicas: 1
    revisionHistoryLimit: null
    selector:
      matchLabels:
        app.kubernetes.io/instance: nvidia-device-plugin
        app.kubernetes.io/name: node-feature-discovery
        role: gc
    template:
      metadata:
        labels:
          app.kubernetes.io/instance: nvidia-device-plugin
          app.kubernetes.io/name: node-feature-discovery
          role: gc
      spec:
        containers:
        - name: gc
          image: "registry.k8s.io/nfd/node-feature-discovery:v0.17.3"
          imagePullPolicy: IfNotPresent
          args:
          - "-gc-interval=1h"
          command:
          - nfd-gc
          ports:
          - name: metrics
            containerPort: 8081
          resources:
            limits:
              memory: 1Gi
            requests:
              cpu: 10m
              memory: 128Mi
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
              - ALL
            readOnlyRootFilesystem: true
            runAsNonRoot: true
          env:
          - name: NODE_NAME
            valueFrom:
              fieldRef:
                fieldPath: spec.nodeName
        dnsPolicy: ClusterFirstWithHostNet
        hostNetwork: false
        securityContext: {}
        serviceAccountName: nvidia-device-plugin-node-feature-discovery-gc

(root level)
+ one document added:
  apiVersion: v1
  kind: ServiceAccount
  metadata:
    name: nvidia-device-plugin-node-feature-discovery-prune
    namespace: nvidia
    annotations:
      helm.sh/hook: post-delete
      helm.sh/hook-delete-policy: "before-hook-creation,hook-succeeded"
    labels:
      app.kubernetes.io/instance: nvidia-device-plugin
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: node-feature-discovery

(root level)
+ one document added:
  apiVersion: rbac.authorization.k8s.io/v1
  kind: ClusterRole
  metadata:
    name: nvidia-device-plugin-node-feature-discovery-prune
    annotations:
      helm.sh/hook: post-delete
      helm.sh/hook-delete-policy: "before-hook-creation,hook-succeeded"
    labels:
      app.kubernetes.io/instance: nvidia-device-plugin
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: node-feature-discovery
  rules:
  - resources:
    - nodes
    - nodes/status
    apiGroups:
    -
    verbs:
    - get
    - patch
    - update
    - list

(root level)
+ one document added:
  apiVersion: rbac.authorization.k8s.io/v1
  kind: ClusterRoleBinding
  metadata:
    name: nvidia-device-plugin-node-feature-discovery-prune
    annotations:
      helm.sh/hook: post-delete
      helm.sh/hook-delete-policy: "before-hook-creation,hook-succeeded"
    labels:
      app.kubernetes.io/instance: nvidia-device-plugin
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: node-feature-discovery
  roleRef:
    name: nvidia-device-plugin-node-feature-discovery-prune
    apiGroup: rbac.authorization.k8s.io
    kind: ClusterRole
  subjects:
  - name: nvidia-device-plugin-node-feature-discovery-prune
    kind: ServiceAccount
    namespace: nvidia

(root level)
+ one document added:
  apiVersion: batch/v1
  kind: Job
  metadata:
    name: nvidia-device-plugin-node-feature-discovery-prune
    namespace: nvidia
    annotations:
      helm.sh/hook: post-delete
      helm.sh/hook-delete-policy: "before-hook-creation,hook-succeeded"
    labels:
      app.kubernetes.io/instance: nvidia-device-plugin
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: node-feature-discovery
  spec:
    template:
      metadata:
        labels:
          app.kubernetes.io/instance: nvidia-device-plugin
          app.kubernetes.io/managed-by: Helm
          app.kubernetes.io/name: node-feature-discovery
          role: prune
      spec:
        affinity:
          nodeAffinity:
            preferredDuringSchedulingIgnoredDuringExecution:
            - preference:
                matchExpressions:
                - key: node-role.kubernetes.io/master
                  operator: In
                  values:
                  -
              weight: 1
            - preference:
                matchExpressions:
                - key: node-role.kubernetes.io/control-plane
                  operator: In
                  values:
                  -
              weight: 1
        containers:
        - name: nfd-master
          image: "registry.k8s.io/nfd/node-feature-discovery:v0.17.3"
          imagePullPolicy: IfNotPresent
          args:
          - "-prune"
          command:
          - nfd-master
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
              - ALL
            readOnlyRootFilesystem: true
            runAsNonRoot: true
        restartPolicy: Never
        serviceAccountName: nvidia-device-plugin-node-feature-discovery-prune
        tolerations:
        - key: node-role.kubernetes.io/master
          effect: NoSchedule
          operator: Equal
          value:
        - key: node-role.kubernetes.io/control-plane
          effect: NoSchedule
          operator: Equal
          value:

(root level)
+ one document added:
  apiVersion: v1
  kind: ServiceAccount
  metadata:
    name: nvidia-gpu-exporter
    namespace: nvidia
    labels:
      app.kubernetes.io/instance: nvidia-gpu-exporter
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: nvidia-gpu-exporter
      helm.toolkit.fluxcd.io/name: nvidia-gpu-exporter
      helm.toolkit.fluxcd.io/namespace: flux-system

(root level)
+ one document added:
  apiVersion: v1
  kind: Service
  metadata:
    name: nvidia-gpu-exporter
    namespace: nvidia
    labels:
      app.kubernetes.io/instance: nvidia-gpu-exporter
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: nvidia-gpu-exporter
      helm.toolkit.fluxcd.io/name: nvidia-gpu-exporter
      helm.toolkit.fluxcd.io/namespace: flux-system
  spec:
    type: ClusterIP
    selector:
      app.kubernetes.io/instance: nvidia-gpu-exporter
      app.kubernetes.io/name: nvidia-gpu-exporter
    ports:
    - name: http
      port: 9835
      protocol: TCP
      targetPort: http

(root level)
+ one document added:
  apiVersion: apps/v1
  kind: DaemonSet
  metadata:
    name: nvidia-gpu-exporter
    namespace: nvidia
    labels:
      app.kubernetes.io/instance: nvidia-gpu-exporter
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: nvidia-gpu-exporter
      helm.toolkit.fluxcd.io/name: nvidia-gpu-exporter
      helm.toolkit.fluxcd.io/namespace: flux-system
  spec:
    selector:
      matchLabels:
        app.kubernetes.io/instance: nvidia-gpu-exporter
        app.kubernetes.io/name: nvidia-gpu-exporter
    template:
      metadata:
        labels:
          app.kubernetes.io/instance: nvidia-gpu-exporter
          app.kubernetes.io/name: nvidia-gpu-exporter
      spec:
        affinity:
          nodeAffinity:
            requiredDuringSchedulingIgnoredDuringExecution:
              nodeSelectorTerms:
              - matchExpressions:
                - key: nvidia.com/gpu.count
                  operator: Exists
        automountServiceAccountToken: false
        containers:
        - name: nvidia-gpu-exporter
          image: "docker.io/utkuozdemir/nvidia_gpu_exporter:1.13.0"
          imagePullPolicy: IfNotPresent
          args:
          - "--web.listen-address"
          - ":9835"
          - "--web.telemetry-path"
          - /metrics
          - "--nvidia-smi-command"
          - nvidia-smi
          - "--query-field-names"
          - AUTO
          - "--log.level"
          - info
          - "--log.format"
          - logfmt
          env:
          - name: NVIDIA_VISIBLE_DEVICES
            value: all
          - name: NVIDIA_DRIVER_CAPABILITIES
            value: utility
          livenessProbe:
            httpGet:
              path: /-/healthy
              port: http
          ports:
          - name: http
            containerPort: 9835
            protocol: TCP
          readinessProbe:
            httpGet:
              path: /-/ready
              port: http
        hostNetwork: false
        hostPID: false
        nodeSelector:
          kubernetes.io/os: linux
        runtimeClassName: nvidia
        serviceAccountName: nvidia-gpu-exporter
    updateStrategy:
      type: RollingUpdate
      rollingUpdate:
        maxUnavailable: 1

(root level)
+ one document added:
  apiVersion: monitoring.coreos.com/v1
  kind: ServiceMonitor
  metadata:
    name: nvidia-gpu-exporter
    namespace: nvidia
    labels:
      app.kubernetes.io/instance: nvidia-gpu-exporter
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: nvidia-gpu-exporter
      helm.toolkit.fluxcd.io/name: nvidia-gpu-exporter
      helm.toolkit.fluxcd.io/namespace: flux-system
  spec:
    endpoints:
    - interval: 15s
      path: /metrics
      port: http
      scheme: http
    selector:
      matchLabels:
        app.kubernetes.io/instance: nvidia-gpu-exporter
        app.kubernetes.io/name: nvidia-gpu-exporter

(root level)
+ one document added:
  apiVersion: v1
  kind: ServiceAccount
  metadata:
    name: open-webui-tika
    namespace: local-ai
    labels:
      app.kubernetes.io/instance: open-webui
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: tika
      helm.toolkit.fluxcd.io/name: open-webui
      helm.toolkit.fluxcd.io/namespace: flux-system

(root level)
+ one document added:
  apiVersion: v1
  kind: ServiceAccount
  metadata:
    name: open-webui-sa
    namespace: local-ai
    labels:
      app.kubernetes.io/component: open-webui
      app.kubernetes.io/instance: open-webui
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: open-webui
      helm.toolkit.fluxcd.io/name: open-webui
      helm.toolkit.fluxcd.io/namespace: flux-system
  automountServiceAccountToken: false

(root level)
+ one document added:
  apiVersion: v1
  kind: Service
  metadata:
    name: open-webui-tika
    annotations: null
    namespace: local-ai
    labels:
      app.kubernetes.io/instance: open-webui
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: tika
      helm.toolkit.fluxcd.io/name: open-webui
      helm.toolkit.fluxcd.io/namespace: flux-system
  spec:
    type: ClusterIP
    selector:
      app.kubernetes.io/instance: open-webui
      app.kubernetes.io/name: tika
    ports:
    - name: http
      port: 9998
      protocol: TCP
      targetPort: http

(root level)
+ one document added:
  apiVersion: v1
  kind: Service
  metadata:
    name: open-webui
    namespace: local-ai
    labels:
      app.kubernetes.io/component: open-webui
      app.kubernetes.io/instance: open-webui
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: open-webui
      helm.toolkit.fluxcd.io/name: open-webui
      helm.toolkit.fluxcd.io/namespace: flux-system
  spec:
    type: ClusterIP
    selector:
      app.kubernetes.io/component: open-webui
      app.kubernetes.io/instance: open-webui
    ports:
    - name: http
      port: 80
      protocol: TCP
      targetPort: http

(root level)
+ one document added:
  apiVersion: apps/v1
  kind: Deployment
  metadata:
    name: open-webui-tika
    namespace: local-ai
    labels:
      app.kubernetes.io/instance: open-webui
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: tika
      helm.toolkit.fluxcd.io/name: open-webui
      helm.toolkit.fluxcd.io/namespace: flux-system
  spec:
    replicas: 1
    selector:
      matchLabels:
        app.kubernetes.io/instance: open-webui
        app.kubernetes.io/name: tika
    template:
      metadata:
        labels:
          app.kubernetes.io/instance: open-webui
          app.kubernetes.io/name: tika
      spec:
        containers:
        - name: tika
          image: "apache/tika:3.2.2.0-full"
          imagePullPolicy: IfNotPresent
          livenessProbe:
            failureThreshold: 20
            httpGet:
              path: /
              port: 9998
              scheme: HTTP
            initialDelaySeconds: 15
            periodSeconds: 5
            timeoutSeconds: 30
          ports:
          - name: http
            containerPort: 9998
            protocol: TCP
          readinessProbe:
            failureThreshold: 20
            httpGet:
              path: /
              port: 9998
              scheme: HTTP
            initialDelaySeconds: 15
            periodSeconds: 5
            timeoutSeconds: 30
          resources:
            limits:
              cpu: "2"
              memory: 2000Mi
            requests:
              cpu: "1"
              memory: 1500Mi
          volumeMounts:
          - name: sec-ctx-vol
            mountPath: /tmp
          securityContext:
            allowPrivilegeEscalation: true
            capabilities:
              drop:
              - ALL
            readOnlyRootFilesystem: true
            runAsGroup: 35002
            runAsNonRoot: true
            runAsUser: 35002
        securityContext: {}
        serviceAccountName: open-webui-tika
        volumes:
        - name: sec-ctx-vol
          emptyDir: {}

(root level)
+ one document added:
  apiVersion: apps/v1
  kind: Deployment
  metadata:
    name: open-webui
    namespace: local-ai
    labels:
      app.kubernetes.io/component: open-webui
      app.kubernetes.io/instance: open-webui
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: open-webui
      helm.toolkit.fluxcd.io/name: open-webui
      helm.toolkit.fluxcd.io/namespace: flux-system
  spec:
    replicas: 1
    revisionHistoryLimit: 10
    selector:
      matchLabels:
        app.kubernetes.io/component: open-webui
        app.kubernetes.io/instance: open-webui
    template:
      metadata:
        labels:
          app.kubernetes.io/component: open-webui
          app.kubernetes.io/instance: open-webui
          app.kubernetes.io/managed-by: Helm
          app.kubernetes.io/name: open-webui
      spec:
        automountServiceAccountToken: false
        containers:
        - name: open-webui
          image: "ghcr.io/open-webui/open-webui:0.10.2"
          imagePullPolicy: IfNotPresent
          tty: true
          ports:
          - name: http
            containerPort: 8080
          volumeMounts:
          - name: data
            mountPath: /app/backend/data
          - name: aethernet-ca
            mountPath: /etc/ssl/certs/aethernet-ca.pem
            readOnly: true
            subPath: trust-bundle.pem
          env:
          - name: ENABLE_OLLAMA_API
            value: False
          - name: OPENAI_API_BASE_URL
            value: "http://energon.home.arpa:8080/v1"
          - name: OPENAI_API_KEY
            valueFrom:
              secretKeyRef:
                name: litellm-master-key
                key: masterkey
          - name: CONTENT_EXTRACTION_ENGINE
            value: Tika
          - name: TIKA_SERVER_URL
            value: "http://open-webui-tika:9998"
          - name: STORAGE_PROVIDER
            value: s3
          - name: S3_ACCESS_KEY_ID
            valueFrom:
              secretKeyRef:
                name: open-webui-s3-creds
                key: access-key
          - name: S3_SECRET_ACCESS_KEY
            valueFrom:
              secretKeyRef:
                name: open-webui-s3-creds
                key: secret-key
          - name: S3_ENDPOINT_URL
            value: "http://brickyard.home.arpa:3900"
          - name: S3_BUCKET_NAME
            value: open-webui
          - name: S3_REGION_NAME
            value: apartment
          - name: S3_KEY_PREFIX
            value: null
          - name: ENABLE_WEBSOCKET_SUPPORT
            value: True
          - name: WEBSOCKET_MANAGER
            value: redis
          - name: REDIS_URL
            value: "redis://local-ai-valkey-primary.local-ai.svc.cluster.local:6379/1"
          - name: WEBSOCKET_REDIS_URL
            value: "redis://local-ai-valkey-primary.local-ai.svc.cluster.local:6379/1"
          - name: ENABLE_OAUTH_SIGNUP
            value: True
          - name: OAUTH_MERGE_ACCOUNTS_BY_EMAIL
            value: True
          - name: OAUTH_CLIENT_ID
            valueFrom:
              secretKeyRef:
                name: bitwarden-oidc-open-webui
                key: client-id
          - name: OAUTH_CLIENT_SECRET
            valueFrom:
              secretKeyRef:
                name: bitwarden-oidc-open-webui
                key: client-secret
          - name: OPENID_PROVIDER_URL
            value: "https://log.me.in.aether.earth/application/o/open-webui/.well-known/openid-configuration"
          - name: OAUTH_PROVIDER_NAME
            value: Authentik
          - name: OAUTH_SCOPES
            value: "openid email profile groups"
          - name: ENABLE_OAUTH_ROLE_MANAGEMENT
            value: True
          - name: OAUTH_ROLES_CLAIM
            value: groups
          - name: OAUTH_ALLOWED_ROLES
            value: "Open WebUI Users"
          - name: OAUTH_ADMIN_ROLES
            value: "Open WebUI Admins"
          - name: ENABLE_OAUTH_GROUP_MANAGEMENT
            value: True
          - name: OAUTH_GROUP_CLAIM
            value: groups
          - name: ENABLE_PERSISTENT_CONFIG
            value: "true"
          - name: ENABLE_LOGIN_FORM
            value: "false"
          - name: WEBUI_URL
            value: "https://ai.k8s.aether.earth"
          - name: CORS_ALLOW_ORIGIN
            value: "https://ai.k8s.aether.earth"
          - name: BYPASS_MODEL_ACCESS_CONTROL
            value: "true"
          - name: ENABLE_RAG_WEB_SEARCH
            value: "true"
          - name: RAG_WEB_SEARCH_ENGINE
            value: searxng
          - name: SEARXNG_QUERY_URL
            value: "http://searxng.apps-searxng.svc.cluster.local:8080/search?q=<query>"
          - name: AIOHTTP_CLIENT_SSL_CERT_FILE
            value: /etc/ssl/certs/aethernet-ca.pem
          - name: SSL_CERT_FILE
            value: /etc/ssl/certs/aethernet-ca.pem
          - name: REQUESTS_CA_BUNDLE
            value: /etc/ssl/certs/aethernet-ca.pem
          - name: WEBUI_SECRET_KEY
            valueFrom:
              secretKeyRef:
                name: open-webui-secret-key
                key: secret_key
          - name: DATABASE_URL
            valueFrom:
              secretKeyRef:
                name: local-ai-db-app
                key: uri
        enableServiceLinks: false
        initContainers:
        - name: copy-app-data
          image: "ghcr.io/open-webui/open-webui:0.10.2"
          imagePullPolicy: IfNotPresent
          command:
          - sh
          - "-c"
          - "cp -R -n /app/backend/data/* /tmp/app-data/"
          volumeMounts:
          - name: data
            mountPath: /tmp/app-data
        serviceAccountName: open-webui-sa
        volumes:
        - name: data
          emptyDir: {}
        - name: aethernet-ca
          configMap:
            name: aethernet.crt
  


(root level)
+ one document added:
  apiVersion: gateway.networking.k8s.io/v1
  kind: HTTPRoute
  metadata:
    name: open-webui
    namespace: local-ai
    annotations:
      gatus.home-operations.com/enabled: "true"
      gatus.home-operations.com/endpoint: |
        name: "Open WebUI"
        url: "https://ai.k8s.aether.earth/"
      gethomepage.dev/description: "Open WebUI"
      gethomepage.dev/enabled: "true"
      gethomepage.dev/group: AI
      gethomepage.dev/icon: sh-open-webui
      gethomepage.dev/name: "Open WebUI"
    labels:
      app.kubernetes.io/component: open-webui
      app.kubernetes.io/instance: open-webui
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: open-webui
      helm.toolkit.fluxcd.io/name: open-webui
      helm.toolkit.fluxcd.io/namespace: flux-system
  spec:
    hostnames:
    - ai.k8s.aether.earth
    parentRefs:
    - name: envoy-over-vpn
      namespace: envoy-gateway
      sectionName: https
    rules:
    - backendRefs:
      - name: open-webui
        group:
        kind: Service
        port: 80
        weight: 1
      matches:
      - path:
          type: PathPrefix
          value: /

(root level)
+ one document added:
  apiVersion: networking.k8s.io/v1
  kind: NetworkPolicy
  metadata:
    name: paperless-valkey
    namespace: apps-paperless
    labels:
      app.kubernetes.io/instance: paperless-valkey
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: valkey
      app.kubernetes.io/part-of: valkey
      helm.toolkit.fluxcd.io/name: paperless-valkey
      helm.toolkit.fluxcd.io/namespace: flux-system
  spec:
    egress:
    -   ingress:
    - ports:
      - port: 6379
    podSelector:
      matchLabels:
        app.kubernetes.io/instance: paperless-valkey
        app.kubernetes.io/name: valkey
    policyTypes:
    - Ingress
    - Egress

(root level)
+ one document added:
  apiVersion: policy/v1
  kind: PodDisruptionBudget
  metadata:
    name: paperless-valkey-primary
    namespace: apps-paperless
    labels:
      app.kubernetes.io/component: primary
      app.kubernetes.io/instance: paperless-valkey
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: valkey
      helm.toolkit.fluxcd.io/name: paperless-valkey
      helm.toolkit.fluxcd.io/namespace: flux-system
  spec:
    maxUnavailable: 1
    selector:
      matchLabels:
        app.kubernetes.io/component: primary
        app.kubernetes.io/instance: paperless-valkey
        app.kubernetes.io/name: valkey

(root level)
+ one document added:
  apiVersion: v1
  kind: ServiceAccount
  metadata:
    name: paperless-valkey-primary
    namespace: apps-paperless
    labels:
      app.kubernetes.io/instance: paperless-valkey
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: valkey
      app.kubernetes.io/part-of: valkey
      helm.toolkit.fluxcd.io/name: paperless-valkey
      helm.toolkit.fluxcd.io/namespace: flux-system
  automountServiceAccountToken: false

(root level)
+ one document added:
  apiVersion: v1
  kind: ConfigMap
  metadata:
    name: paperless-valkey-configuration
    namespace: apps-paperless
    labels:
      app.kubernetes.io/instance: paperless-valkey
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: valkey
      app.kubernetes.io/part-of: valkey
      helm.toolkit.fluxcd.io/name: paperless-valkey
      helm.toolkit.fluxcd.io/namespace: flux-system
  data:
    primary.conf: |
      dir /data
      # User-supplied primary configuration:
      rename-command FLUSHDB ""
      rename-command FLUSHALL ""
      # End of primary configuration
    replica.conf: |
      dir /data
      # User-supplied replica configuration:
      rename-command FLUSHDB ""
      rename-command FLUSHALL ""
      # End of replica configuration
    valkey.conf: |
      # User-supplied common configuration:
      # Enable AOF https://valkey.io/docs/topics/persistence.html
      appendonly yes
      # Disable RDB persistence, AOF persistence already enabled.
      save ""
      # End of common configuration

(root level)
+ one document added:
  apiVersion: v1
  kind: ConfigMap
  metadata:
    name: paperless-valkey-health
    namespace: apps-paperless
    labels:
      app.kubernetes.io/instance: paperless-valkey
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: valkey
      helm.toolkit.fluxcd.io/name: paperless-valkey
      helm.toolkit.fluxcd.io/namespace: flux-system
  data:
    ping_liveness_local.sh: |
      #!/bin/bash
      
      [[ -f $VALKEY_PASSWORD_FILE ]] && export VALKEY_PASSWORD="$(< "${VALKEY_PASSWORD_FILE}")"
      [[ -n "$VALKEY_PASSWORD" ]] && export REDISCLI_AUTH="$VALKEY_PASSWORD"
      response=$(
        timeout -s 15 $1 \
        valkey-cli \
          -h localhost \
          -p $VALKEY_PORT \
          ping
      )
      if [ "$?" -eq "124" ]; then
        echo "Timed out"
        exit 1
      fi
      responseFirstWord=$(echo $response | head -n1 | awk '{print $1;}')
      if [ "$response" != "PONG" ] && [ "$responseFirstWord" != "LOADING" ] && [ "$responseFirstWord" != "MASTERDOWN" ]; then
        echo "$response"
        exit 1
      fi
    ping_liveness_local_and_primary.sh: |
      script_dir="$(dirname "$0")"
      exit_status=0
      "$script_dir/ping_liveness_local.sh" $1 || exit_status=$?
      "$script_dir/ping_liveness_primary.sh" $1 || exit_status=$?
      exit $exit_status
    ping_liveness_primary.sh: |
      #!/bin/bash
      
      [[ -f $VALKEY_PRIMARY_PASSWORD_FILE ]] && export VALKEY_PRIMARY_PASSWORD="$(< "${VALKEY_PRIMARY_PASSWORD_FILE}")"
      [[ -n "$VALKEY_PRIMARY_PASSWORD" ]] && export REDISCLI_AUTH="$VALKEY_PRIMARY_PASSWORD"
      response=$(
        timeout -s 15 $1 \
        valkey-cli \
          -h $VALKEY_PRIMARY_HOST \
          -p $VALKEY_PRIMARY_PORT_NUMBER \
          ping
      )
      if [ "$?" -eq "124" ]; then
        echo "Timed out"
        exit 1
      fi
      responseFirstWord=$(echo $response | head -n1 | awk '{print $1;}')
      if [ "$response" != "PONG" ] && [ "$responseFirstWord" != "LOADING" ]; then
        echo "$response"
        exit 1
      fi
    ping_readiness_local.sh: |
      #!/bin/bash
      
      [[ -f $VALKEY_PASSWORD_FILE ]] && export VALKEY_PASSWORD="$(< "${VALKEY_PASSWORD_FILE}")"
      [[ -n "$VALKEY_PASSWORD" ]] && export REDISCLI_AUTH="$VALKEY_PASSWORD"
      response=$(
        timeout -s 15 $1 \
        valkey-cli \
          -h localhost \
          -p $VALKEY_PORT \
          ping
      )
      if [ "$?" -eq "124" ]; then
        echo "Timed out"
        exit 1
      fi
      if [ "$response" != "PONG" ]; then
        echo "$response"
        exit 1
      fi
    ping_readiness_local_and_primary.sh: |
      script_dir="$(dirname "$0")"
      exit_status=0
      "$script_dir/ping_readiness_local.sh" $1 || exit_status=$?
      "$script_dir/ping_readiness_primary.sh" $1 || exit_status=$?
      exit $exit_status
    ping_readiness_primary.sh: |
      #!/bin/bash
      
      [[ -f $VALKEY_PRIMARY_PASSWORD_FILE ]] && export VALKEY_PRIMARY_PASSWORD="$(< "${VALKEY_PRIMARY_PASSWORD_FILE}")"
      [[ -n "$VALKEY_PRIMARY_PASSWORD" ]] && export REDISCLI_AUTH="$VALKEY_PRIMARY_PASSWORD"
      response=$(
        timeout -s 15 $1 \
        valkey-cli \
          -h $VALKEY_PRIMARY_HOST \
          -p $VALKEY_PRIMARY_PORT_NUMBER \
          ping
      )
      if [ "$?" -eq "124" ]; then
        echo "Timed out"
        exit 1
      fi
      if [ "$response" != "PONG" ]; then
        echo "$response"
        exit 1
      fi
  


(root level)
+ one document added:
  apiVersion: v1
  kind: ConfigMap
  metadata:
    name: paperless-valkey-scripts
    namespace: apps-paperless
    labels:
      app.kubernetes.io/instance: paperless-valkey
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: valkey
      app.kubernetes.io/part-of: valkey
      helm.toolkit.fluxcd.io/name: paperless-valkey
      helm.toolkit.fluxcd.io/namespace: flux-system
  data:
    start-primary.sh: |
      #!/bin/bash
      
      [[ -f $VALKEY_PASSWORD_FILE ]] && export VALKEY_PASSWORD="$(< "${VALKEY_PASSWORD_FILE}")"
      if [[ -f /opt/bitnami/valkey/mounted-etc/primary.conf ]];then
          cp /opt/bitnami/valkey/mounted-etc/primary.conf /opt/bitnami/valkey/etc/primary.conf
      fi
      if [[ -f /opt/bitnami/valkey/mounted-etc/valkey.conf ]];then
          cp /opt/bitnami/valkey/mounted-etc/valkey.conf /opt/bitnami/valkey/etc/valkey.conf
      fi
      ARGS=("--port" "${VALKEY_PORT}")
      ARGS+=("--protected-mode" "no")
      ARGS+=("--include" "/opt/bitnami/valkey/etc/valkey.conf")
      ARGS+=("--include" "/opt/bitnami/valkey/etc/primary.conf")
      exec valkey-server "${ARGS[@]}"
      
  


(root level)
+ one document added:
  apiVersion: v1
  kind: Service
  metadata:
    name: paperless-valkey-headless
    namespace: apps-paperless
    labels:
      app.kubernetes.io/instance: paperless-valkey
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: valkey
      app.kubernetes.io/part-of: valkey
      helm.toolkit.fluxcd.io/name: paperless-valkey
      helm.toolkit.fluxcd.io/namespace: flux-system
  spec:
    type: ClusterIP
    clusterIP: None
    selector:
      app.kubernetes.io/instance: paperless-valkey
      app.kubernetes.io/name: valkey
    ports:
    - name: tcp-redis
      port: 6379
      targetPort: redis

(root level)
+ one document added:
  apiVersion: v1
  kind: Service
  metadata:
    name: paperless-valkey-primary
    namespace: apps-paperless
    labels:
      app.kubernetes.io/component: primary
      app.kubernetes.io/instance: paperless-valkey
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: valkey
      app.kubernetes.io/part-of: valkey
      helm.toolkit.fluxcd.io/name: paperless-valkey
      helm.toolkit.fluxcd.io/namespace: flux-system
  spec:
    type: ClusterIP
    internalTrafficPolicy: Cluster
    selector:
      app.kubernetes.io/component: primary
      app.kubernetes.io/instance: paperless-valkey
      app.kubernetes.io/name: valkey
    ports:
    - name: tcp-redis
      nodePort: null
      port: 6379
      targetPort: redis

(root level)
+ one document added:
  apiVersion: apps/v1
  kind: StatefulSet
  metadata:
    name: paperless-valkey-primary
    namespace: apps-paperless
    labels:
      app.kubernetes.io/component: primary
      app.kubernetes.io/instance: paperless-valkey
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: valkey
      app.kubernetes.io/part-of: valkey
      helm.toolkit.fluxcd.io/name: paperless-valkey
      helm.toolkit.fluxcd.io/namespace: flux-system
  spec:
    replicas: 1
    selector:
      matchLabels:
        app.kubernetes.io/component: primary
        app.kubernetes.io/instance: paperless-valkey
        app.kubernetes.io/name: valkey
    serviceName: paperless-valkey-headless
    template:
      metadata:
        labels:
          app.kubernetes.io/component: primary
          app.kubernetes.io/instance: paperless-valkey
          app.kubernetes.io/managed-by: Helm
          app.kubernetes.io/name: valkey
      spec:
        affinity:
          nodeAffinity: null
          podAffinity: null
          podAntiAffinity:
            preferredDuringSchedulingIgnoredDuringExecution:
            - podAffinityTerm:
                labelSelector:
                  matchLabels:
                    app.kubernetes.io/component: primary
                    app.kubernetes.io/instance: paperless-valkey
                    app.kubernetes.io/name: valkey
                topologyKey: kubernetes.io/hostname
              weight: 1
        automountServiceAccountToken: false
        containers:
        - name: valkey
          image: "registry-1.docker.io/bitnami/valkey:latest"
          imagePullPolicy: IfNotPresent
          args:
          - "-c"
          - /opt/bitnami/scripts/start-scripts/start-primary.sh
          command:
          - /bin/bash
          env:
          - name: BITNAMI_DEBUG
            value: "false"
          - name: VALKEY_REPLICATION_MODE
            value: primary
          - name: ALLOW_EMPTY_PASSWORD
            value: yes
          - name: OPENSSL_FIPS
            value: yes
          - name: VALKEY_TLS_ENABLED
            value: no
          - name: VALKEY_PORT
            value: "6379"
          ports:
          - name: redis
            containerPort: 6379
          resources:
            limits:
              cpu: 150m
              ephemeral-storage: 2Gi
              memory: 192Mi
            requests:
              cpu: 100m
              ephemeral-storage: 50Mi
              memory: 128Mi
          volumeMounts:
          - name: start-scripts
            mountPath: /opt/bitnami/scripts/start-scripts
          - name: health
            mountPath: /health
          - name: valkey-data
            mountPath: /data
          - name: config
            mountPath: /opt/bitnami/valkey/mounted-etc
          - name: empty-dir
            mountPath: /opt/bitnami/valkey/etc/
            subPath: app-conf-dir
          - name: empty-dir
            mountPath: /tmp
            subPath: tmp-dir
          livenessProbe:
            exec:
              command:
              - sh
              - "-c"
              - "/health/ping_liveness_local.sh 5"
            failureThreshold: 5
            initialDelaySeconds: 20
            periodSeconds: 5
            successThreshold: 1
            timeoutSeconds: 6
          readinessProbe:
            exec:
              command:
              - sh
              - "-c"
              - "/health/ping_readiness_local.sh 1"
            failureThreshold: 5
            initialDelaySeconds: 20
            periodSeconds: 5
            successThreshold: 1
            timeoutSeconds: 2
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
              - ALL
            readOnlyRootFilesystem: true
            runAsGroup: 1001
            runAsNonRoot: true
            runAsUser: 1001
            seLinuxOptions: {}
            seccompProfile:
              type: RuntimeDefault
        enableServiceLinks: true
        securityContext:
          fsGroup: 1001
          fsGroupChangePolicy: Always
          supplementalGroups: []
          sysctls: []
        serviceAccountName: paperless-valkey-primary
        terminationGracePeriodSeconds: 30
        volumes:
        - name: start-scripts
          configMap:
            name: paperless-valkey-scripts
            defaultMode: 493
        - name: health
          configMap:
            name: paperless-valkey-health
            defaultMode: 493
        - name: config
          configMap:
            name: paperless-valkey-configuration
        - name: empty-dir
          emptyDir: {}
    updateStrategy:
      type: RollingUpdate
    volumeClaimTemplates:
    - apiVersion: v1
      kind: PersistentVolumeClaim
      metadata:
        name: valkey-data
        labels:
          app.kubernetes.io/component: primary
          app.kubernetes.io/instance: paperless-valkey
          app.kubernetes.io/name: valkey
      spec:
        resources:
          requests:
            storage: 8Gi
        storageClassName: longhorn
        accessModes:
        - ReadWriteOnce

(root level)
+ one document added:
  apiVersion: v1
  kind: ServiceAccount
  metadata:
    name: renovate-operator-renovate-operator
    namespace: apps-renovate
    labels:
      helm.toolkit.fluxcd.io/name: renovate-operator
      helm.toolkit.fluxcd.io/namespace: flux-system

(root level)
+ one document added:
  apiVersion: v1
  kind: ConfigMap
  metadata:
    name: renovate-operator-dashboard
    namespace: apps-renovate
    labels:
      grafana_dashboard: "1"
      helm.toolkit.fluxcd.io/name: renovate-operator
      helm.toolkit.fluxcd.io/namespace: flux-system
  data:
    renovate-operator.json: |
      
      {
        "annotations": {
          "list": [
            {
              "builtIn": 1,
              "datasource": {
                "type": "grafana",
                "uid": "-- Grafana --"
              },
              "enable": true,
              "hide": true,
              "iconColor": "rgba(0, 211, 255, 1)",
              "name": "Annotations & Alerts",
              "type": "dashboard"
            }
          ]
        },
        "editable": true,
        "fiscalYearStartMonth": 0,
        "graphTooltip": 0,
        "id": 37,
        "links": [],
        "panels": [
          {
            "datasource": {
              "type": "prometheus",
              "uid": "$datasource"
            },
            "fieldConfig": {
              "defaults": {
                "color": {
                  "mode": "thresholds"
                },
                "mappings": [],
                "thresholds": {
                  "mode": "absolute",
                  "steps": [
                    {
                      "color": "green",
                      "value": 0
                    }
                  ]
                }
              },
              "overrides": []
            },
            "gridPos": {
              "h": 4,
              "w": 7,
              "x": 0,
              "y": 0
            },
            "id": 6,
            "options": {
              "colorMode": "value",
              "graphMode": "area",
              "justifyMode": "auto",
              "orientation": "auto",
              "percentChangeColorMode": "standard",
              "reduceOptions": {
                "calcs": [
                  "lastNotNull"
                ],
                "fields": "",
                "values": false
              },
              "showPercentChange": false,
              "textMode": "auto",
              "wideLayout": true
            },
            "pluginVersion": "12.3.1",
            "targets": [
              {
                "editorMode": "code",
                "exemplar": false,
                "expr": "count(group by(project) (renovate_operator_project_executions_total{\"renovate_namespace\"=~\"$RenovateNamespace\", \"renovate_job\"=~\"$RenovateJob\"}))",
                "instant": false,
                "legendFormat": "__auto",
                "range": true,
                "refId": "A"
              }
            ],
            "title": "Repository Count",
            "type": "stat"
          },
          {
            "datasource": {
              "type": "prometheus",
              "uid": "$datasource"
            },
            "fieldConfig": {
              "defaults": {
                "color": {
                  "mode": "thresholds"
                },
                "mappings": [],
                "thresholds": {
                  "mode": "absolute",
                  "steps": [
                    {
                      "color": "green",
                      "value": 0
                    }
                  ]
                }
              },
              "overrides": []
            },
            "gridPos": {
              "h": 4,
              "w": 5,
              "x": 7,
              "y": 0
            },
            "id": 2,
            "options": {
              "colorMode": "value",
              "graphMode": "area",
              "justifyMode": "auto",
              "orientation": "auto",
              "percentChangeColorMode": "standard",
              "reduceOptions": {
                "calcs": [
                  "lastNotNull"
                ],
                "fields": "",
                "values": false
              },
              "showPercentChange": false,
              "textMode": "auto",
              "wideLayout": true
            },
            "pluginVersion": "12.3.1",
            "targets": [
              {
                "editorMode": "builder",
                "exemplar": false,
                "expr": "sum(renovate_operator_project_executions_total{\"renovate_namespace\"=~\"$RenovateNamespace\", \"renovate_job\"=~\"$RenovateJob\", status=\"completed\"})",
                "instant": true,
                "legendFormat": "__auto",
                "range": false,
                "refId": "A"
              }
            ],
            "title": "Completed",
            "type": "stat"
          },
          {
            "datasource": {
              "type": "prometheus",
              "uid": "$datasource"
            },
            "fieldConfig": {
              "defaults": {
                "color": {
                  "mode": "thresholds"
                },
                "mappings": [],
                "thresholds": {
                  "mode": "absolute",
                  "steps": [
                    {
                      "color": "green",
                      "value": 0
                    },
                    {
                      "color": "yellow",
                      "value": 5
                    },
                    {
                      "color": "orange",
                      "value": 50
                    },
                    {
                      "color": "red",
                      "value": 100
                    }
                  ]
                }
              },
              "overrides": []
            },
            "gridPos": {
              "h": 4,
              "w": 5,
              "x": 12,
              "y": 0
            },
            "id": 3,
            "options": {
              "colorMode": "value",
              "graphMode": "area",
              "justifyMode": "auto",
              "orientation": "auto",
              "percentChangeColorMode": "standard",
              "reduceOptions": {
                "calcs": [
                  "lastNotNull"
                ],
                "fields": "",
                "values": false
              },
              "showPercentChange": false,
              "textMode": "auto",
              "wideLayout": true
            },
            "pluginVersion": "12.3.1",
            "targets": [
              {
                "editorMode": "builder",
                "exemplar": false,
                "expr": "sum(renovate_operator_project_executions_total{\"renovate_namespace\"=~\"$RenovateNamespace\", \"renovate_job\"=~\"$RenovateJob\", status=\"failed\"})",
                "instant": true,
                "legendFormat": "__auto",
                "range": false,
                "refId": "A"
              }
            ],
            "title": "Failed",
            "type": "stat"
          },
          {
            "datasource": {
              "type": "prometheus",
              "uid": "$datasource"
            },
            "fieldConfig": {
              "defaults": {
                "color": {
                  "mode": "thresholds"
                },
                "mappings": [],
                "thresholds": {
                  "mode": "absolute",
                  "steps": [
                    {
                      "color": "green",
                      "value": 0
                    },
                    {
                      "color": "#EAB839",
                      "value": 1
                    },
                    {
                      "color": "orange",
                      "value": 5
                    },
                    {
                      "color": "red",
                      "value": 10
                    }
                  ]
                }
              },
              "overrides": []
            },
            "gridPos": {
              "h": 4,
              "w": 7,
              "x": 17,
              "y": 0
            },
            "id": 5,
            "options": {
              "colorMode": "value",
              "graphMode": "area",
              "justifyMode": "auto",
              "orientation": "auto",
              "percentChangeColorMode": "standard",
              "reduceOptions": {
                "calcs": [
                  "lastNotNull"
                ],
                "fields": "",
                "values": false
              },
              "showPercentChange": false,
              "textMode": "auto",
              "wideLayout": true
            },
            "pluginVersion": "12.3.1",
            "targets": [
              {
                "editorMode": "code",
                "exemplar": false,
                "expr": "sum(renovate_operator_project_executions_total{\"renovate_namespace\"=~\"$RenovateNamespace\", \"renovate_job\"=~\"$RenovateJob\", status=\"failed\"}) / sum (renovate_operator_project_executions_total{\"renovate_namespace\"=~\"$RenovateNamespace\", \"renovate_job\"=~\"$RenovateJob\"}) * 100",
                "instant": false,
                "legendFormat": "__auto",
                "range": true,
                "refId": "A"
              }
            ],
            "title": "Failure Rate %",
            "type": "stat"
          },
          {
            "datasource": {
              "type": "prometheus",
              "uid": "$datasource"
            },
            "fieldConfig": {
              "defaults": {
                "color": {
                  "mode": "palette-classic"
                },
                "custom": {
                  "axisBorderShow": false,
                  "axisCenteredZero": false,
                  "axisColorMode": "text",
                  "axisLabel": "",
                  "axisPlacement": "auto",
                  "fillOpacity": 80,
                  "gradientMode": "none",
                  "hideFrom": {
                    "legend": false,
                    "tooltip": false,
                    "viz": false
                  },
                  "lineWidth": 1,
                  "scaleDistribution": {
                    "type": "linear"
                  },
                  "thresholdsStyle": {
                    "mode": "off"
                  }
                },
                "mappings": [],
                "thresholds": {
                  "mode": "absolute",
                  "steps": [
                    {
                      "color": "green",
                      "value": 0
                    },
                    {
                      "color": "red",
                      "value": 80
                    }
                  ]
                }
              },
              "overrides": []
            },
            "gridPos": {
              "h": 9,
              "w": 12,
              "x": 0,
              "y": 4
            },
            "id": 1,
            "options": {
              "barRadius": 0,
              "barWidth": 0.97,
              "fullHighlight": false,
              "groupWidth": 0.7,
              "legend": {
                "calcs": [],
                "displayMode": "list",
                "placement": "bottom",
                "showLegend": true
              },
              "orientation": "auto",
              "showValue": "auto",
              "stacking": "none",
              "tooltip": {
                "hideZeros": false,
                "mode": "single",
                "sort": "none"
              },
              "xTickLabelRotation": 0,
              "xTickLabelSpacing": 0
            },
            "pluginVersion": "12.3.1",
            "targets": [
              {
                "datasource": {
                  "type": "prometheus",
                  "uid": "$datasource"
                },
                "editorMode": "code",
                "exemplar": false,
                "expr": "sum by(project) (renovate_operator_project_executions_total{\"renovate_namespace\"=~\"$RenovateNamespace\", \"renovate_job\"=~\"$RenovateJob\", status=\"completed\"})",
                "instant": true,
                "legendFormat": "{{project}} - {{status}}",
                "range": false,
                "refId": "A"
              }
            ],
            "title": "Renovate Executions - Completed",
            "type": "barchart"
          },
          {
            "datasource": {
              "type": "prometheus",
              "uid": "$datasource"
            },
            "fieldConfig": {
              "defaults": {
                "color": {
                  "mode": "palette-classic"
                },
                "custom": {
                  "axisBorderShow": false,
                  "axisCenteredZero": false,
                  "axisColorMode": "text",
                  "axisLabel": "",
                  "axisPlacement": "auto",
                  "fillOpacity": 80,
                  "gradientMode": "none",
                  "hideFrom": {
                    "legend": false,
                    "tooltip": false,
                    "viz": false
                  },
                  "lineWidth": 1,
                  "scaleDistribution": {
                    "type": "linear"
                  },
                  "thresholdsStyle": {
                    "mode": "off"
                  }
                },
                "mappings": [],
                "thresholds": {
                  "mode": "absolute",
                  "steps": [
                    {
                      "color": "green",
                      "value": 0
                    },
                    {
                      "color": "red",
                      "value": 80
                    }
                  ]
                }
              },
              "overrides": []
            },
            "gridPos": {
              "h": 9,
              "w": 12,
              "x": 12,
              "y": 4
            },
            "id": 4,
            "options": {
              "barRadius": 0,
              "barWidth": 0.97,
              "fullHighlight": false,
              "groupWidth": 0.7,
              "legend": {
                "calcs": [],
                "displayMode": "list",
                "placement": "bottom",
                "showLegend": true
              },
              "orientation": "auto",
              "showValue": "auto",
              "stacking": "none",
              "tooltip": {
                "hideZeros": false,
                "mode": "single",
                "sort": "none"
              },
              "xTickLabelRotation": 0,
              "xTickLabelSpacing": 0
            },
            "pluginVersion": "12.3.1",
            "targets": [
              {
                "datasource": {
                  "type": "prometheus",
                  "uid": "$datasource"
                },
                "editorMode": "builder",
                "exemplar": false,
                "expr": "sum by(project) (renovate_operator_project_executions_total{\"renovate_namespace\"=~\"$RenovateNamespace\", \"renovate_job\"=~\"$RenovateJob\", status=\"failed\"})",
                "instant": true,
                "legendFormat": "{{project}} - {{status}}",
                "range": false,
                "refId": "A"
              }
            ],
            "title": "Renovate Executions - Failed",
            "type": "barchart"
          },
          {
            "datasource": {
              "type": "prometheus",
              "uid": "$datasource"
            },
            "fieldConfig": {
              "defaults": {
                "color": {
                  "mode": "thresholds"
                },
                "mappings": [],
                "thresholds": {
                  "mode": "absolute",
                  "steps": [
                    {
                      "color": "green",
                      "value": 0
                    },
                    {
                      "color": "red",
                      "value": 1
                    }
                  ]
                }
              },
              "overrides": []
            },
            "gridPos": {
              "h": 4,
              "w": 6,
              "x": 0,
              "y": 13
            },
            "id": 7,
            "options": {
              "colorMode": "value",
              "graphMode": "area",
              "justifyMode": "auto",
              "orientation": "auto",
              "percentChangeColorMode": "standard",
              "reduceOptions": {
                "calcs": [
                  "lastNotNull"
                ],
                "fields": "",
                "values": false
              },
              "showPercentChange": false,
              "textMode": "auto",
              "wideLayout": true
            },
            "pluginVersion": "12.3.1",
            "targets": [
              {
                "editorMode": "code",
                "exemplar": false,
                "expr": "count(renovate_operator_run_failed{\"renovate_namespace\"=~\"$RenovateNamespace\", \"renovate_job\"=~\"$RenovateJob\"} == 1) or vector(0)",
                "instant": true,
                "legendFormat": "__auto",
                "range": false,
                "refId": "A"
              }
            ],
            "title": "Currently Failed Runs",
            "type": "stat"
          },
          {
            "datasource": {
              "type": "prometheus",
              "uid": "$datasource"
            },
            "fieldConfig": {
              "defaults": {
                "color": {
                  "mode": "thresholds"
                },
                "mappings": [],
                "thresholds": {
                  "mode": "absolute",
                  "steps": [
                    {
                      "color": "green",
                      "value": 0
                    },
                    {
                      "color": "orange",
                      "value": 1
                    }
                  ]
                }
              },
              "overrides": []
            },
            "gridPos": {
              "h": 4,
              "w": 6,
              "x": 6,
              "y": 13
            },
            "id": 8,
            "options": {
              "colorMode": "value",
              "graphMode": "area",
              "justifyMode": "auto",
              "orientation": "auto",
              "percentChangeColorMode": "standard",
              "reduceOptions": {
                "calcs": [
                  "lastNotNull"
                ],
                "fields": "",
                "values": false
              },
              "showPercentChange": false,
              "textMode": "auto",
              "wideLayout": true
            },
            "pluginVersion": "12.3.1",
            "targets": [
              {
                "editorMode": "code",
                "exemplar": false,
                "expr": "count(renovate_operator_dependency_issues{\"renovate_namespace\"=~\"$RenovateNamespace\", \"renovate_job\"=~\"$RenovateJob\"} == 1) or vector(0)",
                "instant": true,
                "legendFormat": "__auto",
                "range": false,
                "refId": "A"
              }
            ],
            "title": "Projects with Dependency Issues",
            "type": "stat"
          },
          {
            "datasource": {
              "type": "prometheus",
              "uid": "$datasource"
            },
            "fieldConfig": {
              "defaults": {
                "color": {
                  "mode": "thresholds"
                },
                "custom": {
                  "align": "auto",
                  "cellOptions": {
                    "type": "auto"
                  },
                  "inspect": false
                },
                "mappings": [],
                "thresholds": {
                  "mode": "absolute",
                  "steps": [
                    {
                      "color": "green",
                      "value": null
                    }
                  ]
                }
              },
              "overrides": [
                {
                  "matcher": {
                    "id": "byName",
                    "options": "project"
                  },
                  "properties": [
                    {
                      "id": "custom.width",
                      "value": 300
                    }
                  ]
                }
              ]
            },
            "gridPos": {
              "h": 8,
              "w": 12,
              "x": 12,
              "y": 13
            },
            "id": 9,
            "options": {
              "cellHeight": "sm",
              "footer": {
                "countRows": false,
                "fields": "",
                "reducer": [
                  "sum"
                ],
                "show": false
              },
              "showHeader": true
            },
            "pluginVersion": "12.3.1",
            "targets": [
              {
                "datasource": {
                  "type": "prometheus",
                  "uid": "$datasource"
                },
                "editorMode": "code",
                "exemplar": false,
                "expr": "renovate_operator_run_failed{\"renovate_namespace\"=~\"$RenovateNamespace\", \"renovate_job\"=~\"$RenovateJob\"} == 1 or renovate_operator_dependency_issues{\"renovate_namespace\"=~\"$RenovateNamespace\", \"renovate_job\"=~\"$RenovateJob\"} == 1",
                "format": "table",
                "instant": true,
                "legendFormat": "__auto",
                "range": false,
                "refId": "A"
              }
            ],
            "title": "Projects with Issues",
            "transformations": [
              {
                "id": "organize",
                "options": {
                  "excludeByName": {
                    "Time": true,
                    "Value": true,
                    "__name__": true
                  },
                  "indexByName": {
                    "Time": 0,
                    "Value": 5,
                    "__name__": 1,
                    "project": 4,
                    "renovate_job": 3,
                    "renovate_namespace": 2
                  },
                  "renameByName": {
                    "project": "Project",
                    "renovate_job": "Renovate Job",
                    "renovate_namespace": "Namespace"
                  }
                }
              }
            ],
            "type": "table"
          }
        ],
        "preload": false,
        "schemaVersion": 42,
        "tags": [],
        "templating": {
          "list": [
            {
              "current": {
                "text": "default",
                "value": "default"
              },
              "label": "Data Source",
              "name": "datasource",
              "options": [],
              "query": "prometheus",
              "refresh": 1,
              "regex": "",
              "type": "datasource"
            },
            {
              "current": {
                "text": "All",
                "value": [
                  "$__all"
                ]
              },
              "definition": "label_values(renovate_operator_project_executions_total,renovate_namespace)",
              "includeAll": true,
              "multi": true,
              "name": "RenovateNamespace",
              "options": [],
              "query": {
                "qryType": 1,
                "query": "label_values(renovate_operator_project_executions_total,renovate_namespace)",
                "refId": "PrometheusVariableQueryEditor-VariableQuery"
              },
              "refresh": 1,
              "regex": "",
              "type": "query"
            },
            {
              "current": {
                "text": "All",
                "value": [
                  "$__all"
                ]
              },
              "definition": "label_values(renovate_operator_project_executions_total{\"renovate_namespace\"=~\"$RenovateNamespace\"},renovate_job)",
              "includeAll": true,
              "multi": true,
              "name": "RenovateJob",
              "options": [],
              "query": {
                "qryType": 1,
                "query": "label_values(renovate_operator_project_executions_total{\"renovate_namespace\"=~\"$RenovateNamespace\"},renovate_job)",
                "refId": "PrometheusVariableQueryEditor-VariableQuery"
              },
              "refresh": 1,
              "regex": "",
              "type": "query"
            }
          ]
        },
        "time": {
          "from": "now-12h",
          "to": "now"
        },
        "timepicker": {},
        "timezone": "browser",
        "title": "Renovate Operator",
        "uid": "lu79xfd",
        "version": 10
      }
      
  


(root level)
+ one document added:
  apiVersion: rbac.authorization.k8s.io/v1
  kind: Role
  metadata:
    name: renovate-operator-renovate-operator
    namespace: apps-renovate
    labels:
      helm.toolkit.fluxcd.io/name: renovate-operator
      helm.toolkit.fluxcd.io/namespace: flux-system
  rules:
  - resources:
    - renovatejobs
    - renovatejobs/status
    apiGroups:
    - renovate-operator.mogenius.com
    verbs:
    - get
    - list
    - watch
    - update
    - patch
  - resources:
    - pods
    apiGroups:
    -
    verbs:
    - create
    - get
    - list
    - watch
    - update
    - delete
  - resources:
    - jobs
    apiGroups:
    - batch
    verbs:
    - create
    - get
    - list
    - watch
    - update
    - delete
    - patch
  - resources:
    - pods/log
    apiGroups:
    -
    verbs:
    - get
    - list
  - resources:
    - secrets
    apiGroups:
    -
    verbs:
    - create
    - get
    - list
    - watch
    - update
    - delete

(root level)
+ one document added:
  apiVersion: rbac.authorization.k8s.io/v1
  kind: RoleBinding
  metadata:
    name: renovate-operator-renovate-operator
    namespace: apps-renovate
    labels:
      helm.toolkit.fluxcd.io/name: renovate-operator
      helm.toolkit.fluxcd.io/namespace: flux-system
  roleRef:
    name: renovate-operator-renovate-operator
    apiGroup: rbac.authorization.k8s.io
    kind: Role
  subjects:
  - name: renovate-operator-renovate-operator
    kind: ServiceAccount
    namespace: apps-renovate

(root level)
+ one document added:
  apiVersion: v1
  kind: Service
  metadata:
    name: renovate-operator-renovate-operator
    namespace: apps-renovate
    labels:
      app: renovate-operator-renovate-operator
      helm.toolkit.fluxcd.io/name: renovate-operator
      helm.toolkit.fluxcd.io/namespace: flux-system
  spec:
    ports:
    - name: http
      port: 8081
      protocol: TCP
      targetPort: http
    - name: webhook
      port: 8082
      protocol: TCP
      targetPort: webhook
    - name: metrics
      port: 8080
      protocol: TCP
      targetPort: metrics
    selector:
      app: renovate-operator-renovate-operator

(root level)
+ one document added:
  apiVersion: apps/v1
  kind: Deployment
  metadata:
    name: renovate-operator-renovate-operator
    namespace: apps-renovate
    labels:
      helm.toolkit.fluxcd.io/name: renovate-operator
      helm.toolkit.fluxcd.io/namespace: flux-system
  spec:
    replicas: 1
    revisionHistoryLimit: 10
    selector:
      matchLabels:
        app: renovate-operator-renovate-operator
    template:
      metadata:
        labels:
          app: renovate-operator-renovate-operator
      spec:
        containers:
        - name: renovate-operator
          image: "ghcr.io/mogenius/renovate-operator:5.2.0"
          imagePullPolicy: IfNotPresent
          args:
          - "--zap-log-level=info"
          - "--zap-encoder=json"
          ports:
          - name: http
            containerPort: 8081
            protocol: TCP
          - name: metrics
            containerPort: 8080
            protocol: TCP
          - name: webhook
            containerPort: 8082
            protocol: TCP
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
              - ALL
            privileged: false
            readOnlyRootFilesystem: true
            runAsGroup: 1000
            runAsNonRoot: true
            runAsUser: 1000
            seccompProfile:
              type: RuntimeDefault
          env:
          - name: POD_NAMESPACE
            valueFrom:
              fieldRef:
                fieldPath: metadata.namespace
          - name: JOB_TIMEOUT_SECONDS
            value: "1800"
          - name: JOB_BACKOFF_LIMIT
            value: "1"
          - name: DELETE_SUCCESSFUL_JOBS
            value: "true"
          - name: JOB_TTL_SECONDS_AFTER_FINISHED
            value: "86400"
          - name: IMAGE_PULL_SECRETS
            value: []
          - name: SERVER_PORT
            value: "8081"
          - name: WATCH_NAMESPACE
            valueFrom:
              fieldRef:
                fieldPath: metadata.namespace
          - name: WEBHOOK_SERVER_PORT
            value: "8082"
          - name: WEBHOOK_SERVER_ENABLED
            value: "true"
          - name: WEBHOOK_SERVER_UNIFIED_HOST
            value: "false"
          - name: WEBHOOK_BASE_URL
            value: "https://renovate-webhook.k8s.aether.earth"
          - name: OIDC_ISSUER_URL
            value: "https://log.me.in.aether.earth/application/o/renovate-operator/"
          - name: OIDC_CLIENT_ID
            value: Qa486D0v13qAPfsRWUMHY8QoIeRAxnB0vcGXp9x8
          - name: OIDC_CLIENT_SECRET
            valueFrom:
              secretKeyRef:
                name: bitwarden-oidc-renovate-operator
                key: client-secret
          - name: OIDC_REDIRECT_URL
            value: "https://renovate.k8s.aether.earth/auth/callback"
          - name: OIDC_PKCE_ENABLED
            value: "true"
          - name: VALKEY_URL
            valueFrom:
              secretKeyRef:
                name: renovate-operator-valkey-url
                key: valkey-url
          - name: VALKEY_FORWARD_CACHE_TO_JOBS
            value: "true"
          - name: GLOBAL_PARALLELISM_LIMIT
            value: "0"
          - name: LOG_STORE_MODE
            value: valkey
        securityContext:
          fsGroup: 1000
          runAsGroup: 1000
          runAsNonRoot: true
          runAsUser: 1000
          seccompProfile:
            type: RuntimeDefault
        serviceAccountName: renovate-operator-renovate-operator
  


(root level)
+ one document added:
  apiVersion: gateway.networking.k8s.io/v1
  kind: HTTPRoute
  metadata:
    name: renovate-operator-renovate-operator
    namespace: apps-renovate
    annotations:
      gatus.home-operations.com/enabled: "true"
      gatus.home-operations.com/endpoint: |
        name: "Renovate Operator"
        path: "/health"
      gethomepage.dev/description: "Cross-platform dependency automation dashboard"
      gethomepage.dev/enabled: "true"
      gethomepage.dev/icon: sh-mend-renovate
      gethomepage.dev/name: "Renovate Operator"
    labels:
      helm.toolkit.fluxcd.io/name: renovate-operator
      helm.toolkit.fluxcd.io/namespace: flux-system
  spec:
    hostnames:
    - renovate.k8s.aether.earth
    parentRefs:
    - name: envoy-over-vpn
      namespace: envoy-gateway
      sectionName: https
    rules:
    - backendRefs:
      - name: renovate-operator-renovate-operator
        group: 
        kind: Service
        port: 8081
        weight: 1
      matches:
      - path:
          type: PathPrefix
          value: /
  


(root level)
+ one document added:
  apiVersion: gateway.networking.k8s.io/v1
  kind: HTTPRoute
  metadata:
    name: renovate-operator-renovate-operator-webhook
    namespace: apps-renovate
    labels:
      helm.toolkit.fluxcd.io/name: renovate-operator
      helm.toolkit.fluxcd.io/namespace: flux-system
  spec:
    hostnames:
    - renovate-webhook.k8s.aether.earth
    parentRefs:
    - name: envoy-over-vpn
      namespace: envoy-gateway
      sectionName: https
    rules:
    - backendRefs:
      - name: renovate-operator-renovate-operator
        group:
        kind: Service
        port: 8082
        weight: 1
      matches:
      - path:
          type: PathPrefix
          value: /

(root level)
+ one document added:
  apiVersion: monitoring.coreos.com/v1
  kind: ServiceMonitor
  metadata:
    name: renovate-operator-renovate-operator
    namespace: apps-renovate
    labels:
      helm.toolkit.fluxcd.io/name: renovate-operator
      helm.toolkit.fluxcd.io/namespace: flux-system
  spec:
    endpoints:
    - path: /metrics
      port: metrics
    namespaceSelector:
      matchNames:
      - apps-renovate
    selector:
      matchLabels:
        app: renovate-operator-renovate-operator

(root level)
+ one document added:
  apiVersion: v1
  kind: ServiceAccount
  metadata:
    name: renovate-operator-renovate-operator-crd-hook
    namespace: apps-renovate
    annotations:
      helm.sh/hook: "pre-install,pre-upgrade"
      helm.sh/hook-delete-policy: "before-hook-creation,hook-succeeded"
      helm.sh/hook-weight: "-5"

(root level)
+ one document added:
  apiVersion: v1
  kind: ConfigMap
  metadata:
    name: renovate-operator-renovate-operator-crd
    namespace: apps-renovate
    annotations:
      argocd.argoproj.io/sync-options: ServerSideApply=true
      helm.sh/hook: "pre-install,pre-upgrade"
      helm.sh/hook-delete-policy: "before-hook-creation,hook-succeeded"
      helm.sh/hook-weight: "-5"
  data:
    renovatejob.yaml: |
      ---
      apiVersion: apiextensions.k8s.io/v1
      kind: CustomResourceDefinition
      metadata:
        annotations:
          controller-gen.kubebuilder.io/version: v0.21.0
        name: renovatejobs.renovate-operator.mogenius.com
      spec:
        group: renovate-operator.mogenius.com
        names:
          kind: RenovateJob
          listKind: RenovateJobList
          plural: renovatejobs
          singular: renovatejob
        scope: Namespaced
        versions:
        - name: v1alpha1
          schema:
            openAPIV3Schema:
              properties:
                apiVersion:
                  description: |-
                    APIVersion defines the versioned schema of this representation of an object.
                    Servers should convert recognized schemas to the latest internal value, and
                    may reject unrecognized values.
                    More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
                  type: string
                kind:
                  description: |-
                    Kind is a string value representing the REST resource this object represents.
                    Servers may infer this from the endpoint the client submits requests to.
                    Cannot be updated.
                    In CamelCase.
                    More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
                  type: string
                metadata:
                  type: object
                spec:
                  description: RenovateJobSpec defines the desired state of RenovateJob
                  properties:
                    affinity:
                      description: Affinity settings for scheduling the resulting pod
                      properties:
                        nodeAffinity:
                          description: Describes node affinity scheduling rules for the
                            pod.
                          properties:
                            preferredDuringSchedulingIgnoredDuringExecution:
                              description: |-
                                The scheduler will prefer to schedule pods to nodes that satisfy
                                the affinity expressions specified by this field, but it may choose
                                a node that violates one or more of the expressions. The node that is
                                most preferred is the one with the greatest sum of weights, i.e.
                                for each node that meets all of the scheduling requirements (resource
                                request, requiredDuringScheduling affinity expressions, etc.),
                                compute a sum by iterating through the elements of this field and adding
                                "weight" to the sum if the node matches the corresponding matchExpressions; the
                                node(s) with the highest sum are the most preferred.
                              items:
                                description: |-
                                  An empty preferred scheduling term matches all objects with implicit weight 0
                                  (i.e. it's a no-op). A null preferred scheduling term matches no objects (i.e. is also a no-op).
                                properties:
                                  preference:
                                    description: A node selector term, associated with the
                                      corresponding weight.
                                    properties:
                                      matchExpressions:
                                        description: A list of node selector requirements
                                          by node's labels.
                                        items:
                                          description: |-
                                            A node selector requirement is a selector that contains values, a key, and an operator
                                            that relates the key and values.
                                          properties:
                                            key:
                                              description: The label key that the selector
                                                applies to.
                                              type: string
                                            operator:
                                              description: |-
                                                Represents a key's relationship to a set of values.
                                                Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
                                              type: string
                                            values:
                                              description: |-
                                                An array of string values. If the operator is In or NotIn,
                                                the values array must be non-empty. If the operator is Exists or DoesNotExist,
                                                the values array must be empty. If the operator is Gt or Lt, the values
                                                array must have a single element, which will be interpreted as an integer.
                                                This array is replaced during a strategic merge patch.
                                              items:
                                                type: string
                                              type: array
                                              x-kubernetes-list-type: atomic
                                          required:
                                          - key
                                          - operator
                                          type: object
                                        type: array
                                        x-kubernetes-list-type: atomic
                                      matchFields:
                                        description: A list of node selector requirements
                                          by node's fields.
                                        items:
                                          description: |-
                                            A node selector requirement is a selector that contains values, a key, and an operator
                                            that relates the key and values.
                                          properties:
                                            key:
                                              description: The label key that the selector
                                                applies to.
                                              type: string
                                            operator:
                                              description: |-
                                                Represents a key's relationship to a set of values.
                                                Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
                                              type: string
                                            values:
                                              description: |-
                                                An array of string values. If the operator is In or NotIn,
                                                the values array must be non-empty. If the operator is Exists or DoesNotExist,
                                                the values array must be empty. If the operator is Gt or Lt, the values
                                                array must have a single element, which will be interpreted as an integer.
                                                This array is replaced during a strategic merge patch.
                                              items:
                                                type: string
                                              type: array
                                              x-kubernetes-list-type: atomic
                                          required:
                                          - key
                                          - operator
                                          type: object
                                        type: array
                                        x-kubernetes-list-type: atomic
                                    type: object
                                    x-kubernetes-map-type: atomic
                                  weight:
                                    description: Weight associated with matching the corresponding
                                      nodeSelectorTerm, in the range 1-100.
                                    format: int32
                                    type: integer
                                required:
                                - preference
                                - weight
                                type: object
                              type: array
                              x-kubernetes-list-type: atomic
                            requiredDuringSchedulingIgnoredDuringExecution:
                              description: |-
                                If the affinity requirements specified by this field are not met at
                                scheduling time, the pod will not be scheduled onto the node.
                                If the affinity requirements specified by this field cease to be met
                                at some point during pod execution (e.g. due to an update), the system
                                may or may not try to eventually evict the pod from its node.
                              properties:
                                nodeSelectorTerms:
                                  description: Required. A list of node selector terms.
                                    The terms are ORed.
                                  items:
                                    description: |-
                                      A null or empty node selector term matches no objects. The requirements of
                                      them are ANDed.
                                      The TopologySelectorTerm type implements a subset of the NodeSelectorTerm.
                                    properties:
                                      matchExpressions:
                                        description: A list of node selector requirements
                                          by node's labels.
                                        items:
                                          description: |-
                                            A node selector requirement is a selector that contains values, a key, and an operator
                                            that relates the key and values.
                                          properties:
                                            key:
                                              description: The label key that the selector
                                                applies to.
                                              type: string
                                            operator:
                                              description: |-
                                                Represents a key's relationship to a set of values.
                                                Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
                                              type: string
                                            values:
                                              description: |-
                                                An array of string values. If the operator is In or NotIn,
                                                the values array must be non-empty. If the operator is Exists or DoesNotExist,
                                                the values array must be empty. If the operator is Gt or Lt, the values
                                                array must have a single element, which will be interpreted as an integer.
                                                This array is replaced during a strategic merge patch.
                                              items:
                                                type: string
                                              type: array
                                              x-kubernetes-list-type: atomic
                                          required:
                                          - key
                                          - operator
                                          type: object
                                        type: array
                                        x-kubernetes-list-type: atomic
                                      matchFields:
                                        description: A list of node selector requirements
                                          by node's fields.
                                        items:
                                          description: |-
                                            A node selector requirement is a selector that contains values, a key, and an operator
                                            that relates the key and values.
                                          properties:
                                            key:
                                              description: The label key that the selector
                                                applies to.
                                              type: string
                                            operator:
                                              description: |-
                                                Represents a key's relationship to a set of values.
                                                Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
                                              type: string
                                            values:
                                              description: |-
                                                An array of string values. If the operator is In or NotIn,
                                                the values array must be non-empty. If the operator is Exists or DoesNotExist,
                                                the values array must be empty. If the operator is Gt or Lt, the values
                                                array must have a single element, which will be interpreted as an integer.
                                                This array is replaced during a strategic merge patch.
                                              items:
                                                type: string
                                              type: array
                                              x-kubernetes-list-type: atomic
                                          required:
                                          - key
                                          - operator
                                          type: object
                                        type: array
                                        x-kubernetes-list-type: atomic
                                    type: object
                                    x-kubernetes-map-type: atomic
                                  type: array
                                  x-kubernetes-list-type: atomic
                              required:
                              - nodeSelectorTerms
                              type: object
                              x-kubernetes-map-type: atomic
                          type: object
                        podAffinity:
                          description: Describes pod affinity scheduling rules (e.g. co-locate
                            this pod in the same node, zone, etc. as some other pod(s)).
                          properties:
                            preferredDuringSchedulingIgnoredDuringExecution:
                              description: |-
                                The scheduler will prefer to schedule pods to nodes that satisfy
                                the affinity expressions specified by this field, but it may choose
                                a node that violates one or more of the expressions. The node that is
                                most preferred is the one with the greatest sum of weights, i.e.
                                for each node that meets all of the scheduling requirements (resource
                                request, requiredDuringScheduling affinity expressions, etc.),
                                compute a sum by iterating through the elements of this field and adding
                                "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the
                                node(s) with the highest sum are the most preferred.
                              items:
                                description: The weights of all of the matched WeightedPodAffinityTerm
                                  fields are added per-node to find the most preferred node(s)
                                properties:
                                  podAffinityTerm:
                                    description: Required. A pod affinity term, associated
                                      with the corresponding weight.
                                    properties:
                                      labelSelector:
                                        description: |-
                                          A label query over a set of resources, in this case pods.
                                          If it's null, this PodAffinityTerm matches with no Pods.
                                        properties:
                                          matchExpressions:
                                            description: matchExpressions is a list of label
                                              selector requirements. The requirements are
                                              ANDed.
                                            items:
                                              description: |-
                                                A label selector requirement is a selector that contains values, a key, and an operator that
                                                relates the key and values.
                                              properties:
                                                key:
                                                  description: key is the label key that
                                                    the selector applies to.
                                                  type: string
                                                operator:
                                                  description: |-
                                                    operator represents a key's relationship to a set of values.
                                                    Valid operators are In, NotIn, Exists and DoesNotExist.
                                                  type: string
                                                values:
                                                  description: |-
                                                    values is an array of string values. If the operator is In or NotIn,
                                                    the values array must be non-empty. If the operator is Exists or DoesNotExist,
                                                    the values array must be empty. This array is replaced during a strategic
                                                    merge patch.
                                                  items:
                                                    type: string
                                                  type: array
                                                  x-kubernetes-list-type: atomic
                                              required:
                                              - key
                                              - operator
                                              type: object
                                            type: array
                                            x-kubernetes-list-type: atomic
                                          matchLabels:
                                            additionalProperties:
                                              type: string
                                            description: |-
                                              matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
                                              map is equivalent to an element of matchExpressions, whose key field is "key", the
                                              operator is "In", and the values array contains only "value". The requirements are ANDed.
                                            type: object
                                        type: object
                                        x-kubernetes-map-type: atomic
                                      matchLabelKeys:
                                        description: |-
                                          MatchLabelKeys is a set of pod label keys to select which pods will
                                          be taken into consideration. The keys are used to lookup values from the
                                          incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`
                                          to select the group of existing pods which pods will be taken into consideration
                                          for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
                                          pod labels will be ignored. The default value is empty.
                                          The same key is forbidden to exist in both matchLabelKeys and labelSelector.
                                          Also, matchLabelKeys cannot be set when labelSelector isn't set.
                                        items:
                                          type: string
                                        type: array
                                        x-kubernetes-list-type: atomic
                                      mismatchLabelKeys:
                                        description: |-
                                          MismatchLabelKeys is a set of pod label keys to select which pods will
                                          be taken into consideration. The keys are used to lookup values from the
                                          incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`
                                          to select the group of existing pods which pods will be taken into consideration
                                          for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
                                          pod labels will be ignored. The default value is empty.
                                          The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
                                          Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
                                        items:
                                          type: string
                                        type: array
                                        x-kubernetes-list-type: atomic
                                      namespaceSelector:
                                        description: |-
                                          A label query over the set of namespaces that the term applies to.
                                          The term is applied to the union of the namespaces selected by this field
                                          and the ones listed in the namespaces field.
                                          null selector and null or empty namespaces list means "this pod's namespace".
                                          An empty selector ({}) matches all namespaces.
                                        properties:
                                          matchExpressions:
                                            description: matchExpressions is a list of label
                                              selector requirements. The requirements are
                                              ANDed.
                                            items:
                                              description: |-
                                                A label selector requirement is a selector that contains values, a key, and an operator that
                                                relates the key and values.
                                              properties:
                                                key:
                                                  description: key is the label key that
                                                    the selector applies to.
                                                  type: string
                                                operator:
                                                  description: |-
                                                    operator represents a key's relationship to a set of values.
                                                    Valid operators are In, NotIn, Exists and DoesNotExist.
                                                  type: string
                                                values:
                                                  description: |-
                                                    values is an array of string values. If the operator is In or NotIn,
                                                    the values array must be non-empty. If the operator is Exists or DoesNotExist,
                                                    the values array must be empty. This array is replaced during a strategic
                                                    merge patch.
                                                  items:
                                                    type: string
                                                  type: array
                                                  x-kubernetes-list-type: atomic
                                              required:
                                              - key
                                              - operator
                                              type: object
                                            type: array
                                            x-kubernetes-list-type: atomic
                                          matchLabels:
                                            additionalProperties:
                                              type: string
                                            description: |-
                                              matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
                                              map is equivalent to an element of matchExpressions, whose key field is "key", the
                                              operator is "In", and the values array contains only "value". The requirements are ANDed.
                                            type: object
                                        type: object
                                        x-kubernetes-map-type: atomic
                                      namespaces:
                                        description: |-
                                          namespaces specifies a static list of namespace names that the term applies to.
                                          The term is applied to the union of the namespaces listed in this field
                                          and the ones selected by namespaceSelector.
                                          null or empty namespaces list and null namespaceSelector means "this pod's namespace".
                                        items:
                                          type: string
                                        type: array
                                        x-kubernetes-list-type: atomic
                                      topologyKey:
                                        description: |-
                                          This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching
                                          the labelSelector in the specified namespaces, where co-located is defined as running on a node
                                          whose value of the label with key topologyKey matches that of any node on which any of the
                                          selected pods is running.
                                          Empty topologyKey is not allowed.
                                        type: string
                                    required:
                                    - topologyKey
                                    type: object
                                  weight:
                                    description: |-
                                      weight associated with matching the corresponding podAffinityTerm,
                                      in the range 1-100.
                                    format: int32
                                    type: integer
                                required:
                                - podAffinityTerm
                                - weight
                                type: object
                              type: array
                              x-kubernetes-list-type: atomic
                            requiredDuringSchedulingIgnoredDuringExecution:
                              description: |-
                                If the affinity requirements specified by this field are not met at
                                scheduling time, the pod will not be scheduled onto the node.
                                If the affinity requirements specified by this field cease to be met
                                at some point during pod execution (e.g. due to a pod label update), the
                                system may or may not try to eventually evict the pod from its node.
                                When there are multiple elements, the lists of nodes corresponding to each
                                podAffinityTerm are intersected, i.e. all terms must be satisfied.
                              items:
                                description: |-
                                  Defines a set of pods (namely those matching the labelSelector
                                  relative to the given namespace(s)) that this pod should be
                                  co-located (affinity) or not co-located (anti-affinity) with,
                                  where co-located is defined as running on a node whose value of
                                  the label with key <topologyKey> matches that of any node on which
                                  a pod of the set of pods is running
                                properties:
                                  labelSelector:
                                    description: |-
                                      A label query over a set of resources, in this case pods.
                                      If it's null, this PodAffinityTerm matches with no Pods.
                                    properties:
                                      matchExpressions:
                                        description: matchExpressions is a list of label
                                          selector requirements. The requirements are ANDed.
                                        items:
                                          description: |-
                                            A label selector requirement is a selector that contains values, a key, and an operator that
                                            relates the key and values.
                                          properties:
                                            key:
                                              description: key is the label key that the
                                                selector applies to.
                                              type: string
                                            operator:
                                              description: |-
                                                operator represents a key's relationship to a set of values.
                                                Valid operators are In, NotIn, Exists and DoesNotExist.
                                              type: string
                                            values:
                                              description: |-
                                                values is an array of string values. If the operator is In or NotIn,
                                                the values array must be non-empty. If the operator is Exists or DoesNotExist,
                                                the values array must be empty. This array is replaced during a strategic
                                                merge patch.
                                              items:
                                                type: string
                                              type: array
                                              x-kubernetes-list-type: atomic
                                          required:
                                          - key
                                          - operator
                                          type: object
                                        type: array
                                        x-kubernetes-list-type: atomic
                                      matchLabels:
                                        additionalProperties:
                                          type: string
                                        description: |-
                                          matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
                                          map is equivalent to an element of matchExpressions, whose key field is "key", the
                                          operator is "In", and the values array contains only "value". The requirements are ANDed.
                                        type: object
                                    type: object
                                    x-kubernetes-map-type: atomic
                                  matchLabelKeys:
                                    description: |-
                                      MatchLabelKeys is a set of pod label keys to select which pods will
                                      be taken into consideration. The keys are used to lookup values from the
                                      incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`
                                      to select the group of existing pods which pods will be taken into consideration
                                      for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
                                      pod labels will be ignored. The default value is empty.
                                      The same key is forbidden to exist in both matchLabelKeys and labelSelector.
                                      Also, matchLabelKeys cannot be set when labelSelector isn't set.
                                    items:
                                      type: string
                                    type: array
                                    x-kubernetes-list-type: atomic
                                  mismatchLabelKeys:
                                    description: |-
                                      MismatchLabelKeys is a set of pod label keys to select which pods will
                                      be taken into consideration. The keys are used to lookup values from the
                                      incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`
                                      to select the group of existing pods which pods will be taken into consideration
                                      for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
                                      pod labels will be ignored. The default value is empty.
                                      The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
                                      Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
                                    items:
                                      type: string
                                    type: array
                                    x-kubernetes-list-type: atomic
                                  namespaceSelector:
                                    description: |-
                                      A label query over the set of namespaces that the term applies to.
                                      The term is applied to the union of the namespaces selected by this field
                                      and the ones listed in the namespaces field.
                                      null selector and null or empty namespaces list means "this pod's namespace".
                                      An empty selector ({}) matches all namespaces.
                                    properties:
                                      matchExpressions:
                                        description: matchExpressions is a list of label
                                          selector requirements. The requirements are ANDed.
                                        items:
                                          description: |-
                                            A label selector requirement is a selector that contains values, a key, and an operator that
                                            relates the key and values.
                                          properties:
                                            key:
                                              description: key is the label key that the
                                                selector applies to.
                                              type: string
                                            operator:
                                              description: |-
                                                operator represents a key's relationship to a set of values.
                                                Valid operators are In, NotIn, Exists and DoesNotExist.
                                              type: string
                                            values:
                                              description: |-
                                                values is an array of string values. If the operator is In or NotIn,
                                                the values array must be non-empty. If the operator is Exists or DoesNotExist,
                                                the values array must be empty. This array is replaced during a strategic
                                                merge patch.
                                              items:
                                                type: string
                                              type: array
                                              x-kubernetes-list-type: atomic
                                          required:
                                          - key
                                          - operator
                                          type: object
                                        type: array
                                        x-kubernetes-list-type: atomic
                                      matchLabels:
                                        additionalProperties:
                                          type: string
                                        description: |-
                                          matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
                                          map is equivalent to an element of matchExpressions, whose key field is "key", the
                                          operator is "In", and the values array contains only "value". The requirements are ANDed.
                                        type: object
                                    type: object
                                    x-kubernetes-map-type: atomic
                                  namespaces:
                                    description: |-
                                      namespaces specifies a static list of namespace names that the term applies to.
                                      The term is applied to the union of the namespaces listed in this field
                                      and the ones selected by namespaceSelector.
                                      null or empty namespaces list and null namespaceSelector means "this pod's namespace".
                                    items:
                                      type: string
                                    type: array
                                    x-kubernetes-list-type: atomic
                                  topologyKey:
                                    description: |-
                                      This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching
                                      the labelSelector in the specified namespaces, where co-located is defined as running on a node
                                      whose value of the label with key topologyKey matches that of any node on which any of the
                                      selected pods is running.
                                      Empty topologyKey is not allowed.
                                    type: string
                                required:
                                - topologyKey
                                type: object
                              type: array
                              x-kubernetes-list-type: atomic
                          type: object
                        podAntiAffinity:
                          description: Describes pod anti-affinity scheduling rules (e.g.
                            avoid putting this pod in the same node, zone, etc. as some
                            other pod(s)).
                          properties:
                            preferredDuringSchedulingIgnoredDuringExecution:
                              description: |-
                                The scheduler will prefer to schedule pods to nodes that satisfy
                                the anti-affinity expressions specified by this field, but it may choose
                                a node that violates one or more of the expressions. The node that is
                                most preferred is the one with the greatest sum of weights, i.e.
                                for each node that meets all of the scheduling requirements (resource
                                request, requiredDuringScheduling anti-affinity expressions, etc.),
                                compute a sum by iterating through the elements of this field and subtracting
                                "weight" from the sum if the node has pods which matches the corresponding podAffinityTerm; the
                                node(s) with the highest sum are the most preferred.
                              items:
                                description: The weights of all of the matched WeightedPodAffinityTerm
                                  fields are added per-node to find the most preferred node(s)
                                properties:
                                  podAffinityTerm:
                                    description: Required. A pod affinity term, associated
                                      with the corresponding weight.
                                    properties:
                                      labelSelector:
                                        description: |-
                                          A label query over a set of resources, in this case pods.
                                          If it's null, this PodAffinityTerm matches with no Pods.
                                        properties:
                                          matchExpressions:
                                            description: matchExpressions is a list of label
                                              selector requirements. The requirements are
                                              ANDed.
                                            items:
                                              description: |-
                                                A label selector requirement is a selector that contains values, a key, and an operator that
                                                relates the key and values.
                                              properties:
                                                key:
                                                  description: key is the label key that
                                                    the selector applies to.
                                                  type: string
                                                operator:
                                                  description: |-
                                                    operator represents a key's relationship to a set of values.
                                                    Valid operators are In, NotIn, Exists and DoesNotExist.
                                                  type: string
                                                values:
                                                  description: |-
                                                    values is an array of string values. If the operator is In or NotIn,
                                                    the values array must be non-empty. If the operator is Exists or DoesNotExist,
                                                    the values array must be empty. This array is replaced during a strategic
                                                    merge patch.
                                                  items:
                                                    type: string
                                                  type: array
                                                  x-kubernetes-list-type: atomic
                                              required:
                                              - key
                                              - operator
                                              type: object
                                            type: array
                                            x-kubernetes-list-type: atomic
                                          matchLabels:
                                            additionalProperties:
                                              type: string
                                            description: |-
                                              matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
                                              map is equivalent to an element of matchExpressions, whose key field is "key", the
                                              operator is "In", and the values array contains only "value". The requirements are ANDed.
                                            type: object
                                        type: object
                                        x-kubernetes-map-type: atomic
                                      matchLabelKeys:
                                        description: |-
                                          MatchLabelKeys is a set of pod label keys to select which pods will
                                          be taken into consideration. The keys are used to lookup values from the
                                          incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`
                                          to select the group of existing pods which pods will be taken into consideration
                                          for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
                                          pod labels will be ignored. The default value is empty.
                                          The same key is forbidden to exist in both matchLabelKeys and labelSelector.
                                          Also, matchLabelKeys cannot be set when labelSelector isn't set.
                                        items:
                                          type: string
                                        type: array
                                        x-kubernetes-list-type: atomic
                                      mismatchLabelKeys:
                                        description: |-
                                          MismatchLabelKeys is a set of pod label keys to select which pods will
                                          be taken into consideration. The keys are used to lookup values from the
                                          incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`
                                          to select the group of existing pods which pods will be taken into consideration
                                          for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
                                          pod labels will be ignored. The default value is empty.
                                          The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
                                          Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
                                        items:
                                          type: string
                                        type: array
                                        x-kubernetes-list-type: atomic
                                      namespaceSelector:
                                        description: |-
                                          A label query over the set of namespaces that the term applies to.
                                          The term is applied to the union of the namespaces selected by this field
                                          and the ones listed in the namespaces field.
                                          null selector and null or empty namespaces list means "this pod's namespace".
                                          An empty selector ({}) matches all namespaces.
                                        properties:
                                          matchExpressions:
                                            description: matchExpressions is a list of label
                                              selector requirements. The requirements are
                                              ANDed.
                                            items:
                                              description: |-
                                                A label selector requirement is a selector that contains values, a key, and an operator that
                                                relates the key and values.
                                              properties:
                                                key:
                                                  description: key is the label key that
                                                    the selector applies to.
                                                  type: string
                                                operator:
                                                  description: |-
                                                    operator represents a key's relationship to a set of values.
                                                    Valid operators are In, NotIn, Exists and DoesNotExist.
                                                  type: string
                                                values:
                                                  description: |-
                                                    values is an array of string values. If the operator is In or NotIn,
                                                    the values array must be non-empty. If the operator is Exists or DoesNotExist,
                                                    the values array must be empty. This array is replaced during a strategic
                                                    merge patch.
                                                  items:
                                                    type: string
                                                  type: array
                                                  x-kubernetes-list-type: atomic
                                              required:
                                              - key
                                              - operator
                                              type: object
                                            type: array
                                            x-kubernetes-list-type: atomic
                                          matchLabels:
                                            additionalProperties:
                                              type: string
                                            description: |-
                                              matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
                                              map is equivalent to an element of matchExpressions, whose key field is "key", the
                                              operator is "In", and the values array contains only "value". The requirements are ANDed.
                                            type: object
                                        type: object
                                        x-kubernetes-map-type: atomic
                                      namespaces:
                                        description: |-
                                          namespaces specifies a static list of namespace names that the term applies to.
                                          The term is applied to the union of the namespaces listed in this field
                                          and the ones selected by namespaceSelector.
                                          null or empty namespaces list and null namespaceSelector means "this pod's namespace".
                                        items:
                                          type: string
                                        type: array
                                        x-kubernetes-list-type: atomic
                                      topologyKey:
                                        description: |-
                                          This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching
                                          the labelSelector in the specified namespaces, where co-located is defined as running on a node
                                          whose value of the label with key topologyKey matches that of any node on which any of the
                                          selected pods is running.
                                          Empty topologyKey is not allowed.
                                        type: string
                                    required:
                                    - topologyKey
                                    type: object
                                  weight:
                                    description: |-
                                      weight associated with matching the corresponding podAffinityTerm,
                                      in the range 1-100.
                                    format: int32
                                    type: integer
                                required:
                                - podAffinityTerm
                                - weight
                                type: object
                              type: array
                              x-kubernetes-list-type: atomic
                            requiredDuringSchedulingIgnoredDuringExecution:
                              description: |-
                                If the anti-affinity requirements specified by this field are not met at
                                scheduling time, the pod will not be scheduled onto the node.
                                If the anti-affinity requirements specified by this field cease to be met
                                at some point during pod execution (e.g. due to a pod label update), the
                                system may or may not try to eventually evict the pod from its node.
                                When there are multiple elements, the lists of nodes corresponding to each
                                podAffinityTerm are intersected, i.e. all terms must be satisfied.
                              items:
                                description: |-
                                  Defines a set of pods (namely those matching the labelSelector
                                  relative to the given namespace(s)) that this pod should be
                                  co-located (affinity) or not co-located (anti-affinity) with,
                                  where co-located is defined as running on a node whose value of
                                  the label with key <topologyKey> matches that of any node on which
                                  a pod of the set of pods is running
                                properties:
                                  labelSelector:
                                    description: |-
                                      A label query over a set of resources, in this case pods.
                                      If it's null, this PodAffinityTerm matches with no Pods.
                                    properties:
                                      matchExpressions:
                                        description: matchExpressions is a list of label
                                          selector requirements. The requirements are ANDed.
                                        items:
                                          description: |-
                                            A label selector requirement is a selector that contains values, a key, and an operator that
                                            relates the key and values.
                                          properties:
                                            key:
                                              description: key is the label key that the
                                                selector applies to.
                                              type: string
                                            operator:
                                              description: |-
                                                operator represents a key's relationship to a set of values.
                                                Valid operators are In, NotIn, Exists and DoesNotExist.
                                              type: string
                                            values:
                                              description: |-
                                                values is an array of string values. If the operator is In or NotIn,
                                                the values array must be non-empty. If the operator is Exists or DoesNotExist,
                                                the values array must be empty. This array is replaced during a strategic
                                                merge patch.
                                              items:
                                                type: string
                                              type: array
                                              x-kubernetes-list-type: atomic
                                          required:
                                          - key
                                          - operator
                                          type: object
                                        type: array
                                        x-kubernetes-list-type: atomic
                                      matchLabels:
                                        additionalProperties:
                                          type: string
                                        description: |-
                                          matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
                                          map is equivalent to an element of matchExpressions, whose key field is "key", the
                                          operator is "In", and the values array contains only "value". The requirements are ANDed.
                                        type: object
                                    type: object
                                    x-kubernetes-map-type: atomic
                                  matchLabelKeys:
                                    description: |-
                                      MatchLabelKeys is a set of pod label keys to select which pods will
                                      be taken into consideration. The keys are used to lookup values from the
                                      incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`
                                      to select the group of existing pods which pods will be taken into consideration
                                      for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
                                      pod labels will be ignored. The default value is empty.
                                      The same key is forbidden to exist in both matchLabelKeys and labelSelector.
                                      Also, matchLabelKeys cannot be set when labelSelector isn't set.
                                    items:
                                      type: string
                                    type: array
                                    x-kubernetes-list-type: atomic
                                  mismatchLabelKeys:
                                    description: |-
                                      MismatchLabelKeys is a set of pod label keys to select which pods will
                                      be taken into consideration. The keys are used to lookup values from the
                                      incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`
                                      to select the group of existing pods which pods will be taken into consideration
                                      for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
                                      pod labels will be ignored. The default value is empty.
                                      The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
                                      Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
                                    items:
                                      type: string
                                    type: array
                                    x-kubernetes-list-type: atomic
                                  namespaceSelector:
                                    description: |-
                                      A label query over the set of namespaces that the term applies to.
                                      The term is applied to the union of the namespaces selected by this field
                                      and the ones listed in the namespaces field.
                                      null selector and null or empty namespaces list means "this pod's namespace".
                                      An empty selector ({}) matches all namespaces.
                                    properties:
                                      matchExpressions:
                                        description: matchExpressions is a list of label
                                          selector requirements. The requirements are ANDed.
                                        items:
                                          description: |-
                                            A label selector requirement is a selector that contains values, a key, and an operator that
                                            relates the key and values.
                                          properties:
                                            key:
                                              description: key is the label key that the
                                                selector applies to.
                                              type: string
                                            operator:
                                              description: |-
                                                operator represents a key's relationship to a set of values.
                                                Valid operators are In, NotIn, Exists and DoesNotExist.
                                              type: string
                                            values:
                                              description: |-
                                                values is an array of string values. If the operator is In or NotIn,
                                                the values array must be non-empty. If the operator is Exists or DoesNotExist,
                                                the values array must be empty. This array is replaced during a strategic
                                                merge patch.
                                              items:
                                                type: string
                                              type: array
                                              x-kubernetes-list-type: atomic
                                          required:
                                          - key
                                          - operator
                                          type: object
                                        type: array
                                        x-kubernetes-list-type: atomic
                                      matchLabels:
                                        additionalProperties:
                                          type: string
                                        description: |-
                                          matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
                                          map is equivalent to an element of matchExpressions, whose key field is "key", the
                                          operator is "In", and the values array contains only "value". The requirements are ANDed.
                                        type: object
                                    type: object
                                    x-kubernetes-map-type: atomic
                                  namespaces:
                                    description: |-
                                      namespaces specifies a static list of namespace names that the term applies to.
                                      The term is applied to the union of the namespaces listed in this field
                                      and the ones selected by namespaceSelector.
                                      null or empty namespaces list and null namespaceSelector means "this pod's namespace".
                                    items:
                                      type: string
                                    type: array
                                    x-kubernetes-list-type: atomic
                                  topologyKey:
                                    description: |-
                                      This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching
                                      the labelSelector in the specified namespaces, where co-located is defined as running on a node
                                      whose value of the label with key topologyKey matches that of any node on which any of the
                                      selected pods is running.
                                      Empty topologyKey is not allowed.
                                    type: string
                                required:
                                - topologyKey
                                type: object
                              type: array
                              x-kubernetes-list-type: atomic
                          type: object
                      type: object
                    allowedGroups:
                      description: |-
                        Groups allowed to view this RenovateJob when authentication is enabled.
                        If empty or not set, the job is hidden from all users.
                      items:
                        type: string
                      type: array
                    discoverTopics:
                      description: Topics to discover projects from, will be concatenated
                        using , separator
                      items:
                        type: string
                      type: array
                    discoveryFilters:
                      description: Filter to select which projects to process, will be concatenated
                        using , separator
                      items:
                        type: string
                      type: array
                    dnsPolicy:
                      description: DNS Policy for the renovate pods
                      type: string
                    extraEnv:
                      description: Additional environment variables to set in the renovate
                        container
                      items:
                        description: EnvVar represents an environment variable present in
                          a Container.
                        properties:
                          name:
                            description: |-
                              Name of the environment variable.
                              May consist of any printable ASCII characters except '='.
                            type: string
                          value:
                            description: |-
                              Variable references $(VAR_NAME) are expanded
                              using the previously defined environment variables in the container and
                              any service environment variables. If a variable cannot be resolved,
                              the reference in the input string will be unchanged. Double $$ are reduced
                              to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e.
                              "$$(VAR_NAME)" will produce the string literal "$(VAR_NAME)".
                              Escaped references will never be expanded, regardless of whether the variable
                              exists or not.
                              Defaults to "".
                            type: string
                          valueFrom:
                            description: Source for the environment variable's value. Cannot
                              be used if value is not empty.
                            properties:
                              configMapKeyRef:
                                description: Selects a key of a ConfigMap.
                                properties:
                                  key:
                                    description: The key to select.
                                    type: string
                                  name:
                                    default: ""
                                    description: |-
                                      Name of the referent.
                                      This field is effectively required, but due to backwards compatibility is
                                      allowed to be empty. Instances of this type with an empty value here are
                                      almost certainly wrong.
                                      More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                                    type: string
                                  optional:
                                    description: Specify whether the ConfigMap or its key
                                      must be defined
                                    type: boolean
                                required:
                                - key
                                type: object
                                x-kubernetes-map-type: atomic
                              fieldRef:
                                description: |-
                                  Selects a field of the pod: supports metadata.name, metadata.namespace, `metadata.labels['<KEY>']`, `metadata.annotations['<KEY>']`,
                                  spec.nodeName, spec.serviceAccountName, status.hostIP, status.podIP, status.podIPs.
                                properties:
                                  apiVersion:
                                    description: Version of the schema the FieldPath is
                                      written in terms of, defaults to "v1".
                                    type: string
                                  fieldPath:
                                    description: Path of the field to select in the specified
                                      API version.
                                    type: string
                                required:
                                - fieldPath
                                type: object
                                x-kubernetes-map-type: atomic
                              fileKeyRef:
                                description: |-
                                  FileKeyRef selects a key of the env file.
                                  Requires the EnvFiles feature gate to be enabled.
                                properties:
                                  key:
                                    description: |-
                                      The key within the env file. An invalid key will prevent the pod from starting.
                                      The keys defined within a source may consist of any printable ASCII characters except '='.
                                      During Alpha stage of the EnvFiles feature gate, the key size is limited to 128 characters.
                                    type: string
                                  optional:
                                    default: false
                                    description: |-
                                      Specify whether the file or its key must be defined. If the file or key
                                      does not exist, then the env var is not published.
                                      If optional is set to true and the specified key does not exist,
                                      the environment variable will not be set in the Pod's containers.
      
                                      If optional is set to false and the specified key does not exist,
                                      an error will be returned during Pod creation.
                                    type: boolean
                                  path:
                                    description: |-
                                      The path within the volume from which to select the file.
                                      Must be relative and may not contain the '..' path or start with '..'.
                                    type: string
                                  volumeName:
                                    description: The name of the volume mount containing
                                      the env file.
                                    type: string
                                required:
                                - key
                                - path
                                - volumeName
                                type: object
                                x-kubernetes-map-type: atomic
                              resourceFieldRef:
                                description: |-
                                  Selects a resource of the container: only resources limits and requests
                                  (limits.cpu, limits.memory, limits.ephemeral-storage, requests.cpu, requests.memory and requests.ephemeral-storage) are currently supported.
                                properties:
                                  containerName:
                                    description: 'Container name: required for volumes,
                                      optional for env vars'
                                    type: string
                                  divisor:
                                    anyOf:
                                    - type: integer
                                    - type: string
                                    description: Specifies the output format of the exposed
                                      resources, defaults to "1"
                                    pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
                                    x-kubernetes-int-or-string: true
                                  resource:
                                    description: 'Required: resource to select'
                                    type: string
                                required:
                                - resource
                                type: object
                                x-kubernetes-map-type: atomic
                              secretKeyRef:
                                description: Selects a key of a secret in the pod's namespace
                                properties:
                                  key:
                                    description: The key of the secret to select from.  Must
                                      be a valid secret key.
                                    type: string
                                  name:
                                    default: ""
                                    description: |-
                                      Name of the referent.
                                      This field is effectively required, but due to backwards compatibility is
                                      allowed to be empty. Instances of this type with an empty value here are
                                      almost certainly wrong.
                                      More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                                    type: string
                                  optional:
                                    description: Specify whether the Secret or its key must
                                      be defined
                                    type: boolean
                                required:
                                - key
                                type: object
                                x-kubernetes-map-type: atomic
                            type: object
                        required:
                        - name
                        type: object
                      type: array
                    extraEnvFrom:
                      description: Additional environment variable sources to set in the
                        renovate container
                      items:
                        description: EnvFromSource represents the source of a set of ConfigMaps
                          or Secrets
                        properties:
                          configMapRef:
                            description: The ConfigMap to select from
                            properties:
                              name:
                                default: ""
                                description: |-
                                  Name of the referent.
                                  This field is effectively required, but due to backwards compatibility is
                                  allowed to be empty. Instances of this type with an empty value here are
                                  almost certainly wrong.
                                  More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                                type: string
                              optional:
                                description: Specify whether the ConfigMap must be defined
                                type: boolean
                            type: object
                            x-kubernetes-map-type: atomic
                          prefix:
                            description: |-
                              Optional text to prepend to the name of each environment variable.
                              May consist of any printable ASCII characters except '='.
                            type: string
                          secretRef:
                            description: The Secret to select from
                            properties:
                              name:
                                default: ""
                                description: |-
                                  Name of the referent.
                                  This field is effectively required, but due to backwards compatibility is
                                  allowed to be empty. Instances of this type with an empty value here are
                                  almost certainly wrong.
                                  More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                                type: string
                              optional:
                                description: Specify whether the Secret must be defined
                                type: boolean
                            type: object
                            x-kubernetes-map-type: atomic
                        type: object
                      type: array
                    extraVolumeMounts:
                      description: Additional volume mounts for the renovate pods
                      items:
                        description: VolumeMount describes a mounting of a Volume within
                          a container.
                        properties:
                          mountPath:
                            description: |-
                              Path within the container at which the volume should be mounted.  Must
                              not contain ':'.
                            type: string
                          mountPropagation:
                            description: |-
                              mountPropagation determines how mounts are propagated from the host
                              to container and the other way around.
                              When not set, MountPropagationNone is used.
                              This field is beta in 1.10.
                              When RecursiveReadOnly is set to IfPossible or to Enabled, MountPropagation must be None or unspecified
                              (which defaults to None).
                            type: string
                          name:
                            description: This must match the Name of a Volume.
                            type: string
                          readOnly:
                            description: |-
                              Mounted read-only if true, read-write otherwise (false or unspecified).
                              Defaults to false.
                            type: boolean
                          recursiveReadOnly:
                            description: |-
                              RecursiveReadOnly specifies whether read-only mounts should be handled
                              recursively.
      
                              If ReadOnly is false, this field has no meaning and must be unspecified.
      
                              If ReadOnly is true, and this field is set to Disabled, the mount is not made
                              recursively read-only.  If this field is set to IfPossible, the mount is made
                              recursively read-only, if it is supported by the container runtime.  If this
                              field is set to Enabled, the mount is made recursively read-only if it is
                              supported by the container runtime, otherwise the pod will not be started and
                              an error will be generated to indicate the reason.
      
                              If this field is set to IfPossible or Enabled, MountPropagation must be set to
                              None (or be unspecified, which defaults to None).
      
                              If this field is not specified, it is treated as an equivalent of Disabled.
                            type: string
                          subPath:
                            description: |-
                              Path within the volume from which the container's volume should be mounted.
                              Defaults to "" (volume's root).
                            type: string
                          subPathExpr:
                            description: |-
                              Expanded path within the volume from which the container's volume should be mounted.
                              Behaves similarly to SubPath but environment variable references $(VAR_NAME) are expanded using the container's environment.
                              Defaults to "" (volume's root).
                              SubPathExpr and SubPath are mutually exclusive.
                            type: string
                        required:
                        - mountPath
                        - name
                        type: object
                      type: array
                    extraVolumes:
                      description: Additional volumes to mount in the renovate pods
                      items:
                        description: Volume represents a named volume in a pod that may
                          be accessed by any container in the pod.
                        properties:
                          awsElasticBlockStore:
                            description: |-
                              awsElasticBlockStore represents an AWS Disk resource that is attached to a
                              kubelet's host machine and then exposed to the pod.
                              Deprecated: AWSElasticBlockStore is deprecated. All operations for the in-tree
                              awsElasticBlockStore type are redirected to the ebs.csi.aws.com CSI driver.
                              More info: https://kubernetes.io/docs/concepts/storage/volumes#awselasticblockstore
                            properties:
                              fsType:
                                description: |-
                                  fsType is the filesystem type of the volume that you want to mount.
                                  Tip: Ensure that the filesystem type is supported by the host operating system.
                                  Examples: "ext4", "xfs", "ntfs". Implicitly inferred to be "ext4" if unspecified.
                                  More info: https://kubernetes.io/docs/concepts/storage/volumes#awselasticblockstore
                                type: string
                              partition:
                                description: |-
                                  partition is the partition in the volume that you want to mount.
                                  If omitted, the default is to mount by volume name.
                                  Examples: For volume /dev/sda1, you specify the partition as "1".
                                  Similarly, the volume partition for /dev/sda is "0" (or you can leave the property empty).
                                format: int32
                                type: integer
                              readOnly:
                                description: |-
                                  readOnly value true will force the readOnly setting in VolumeMounts.
                                  More info: https://kubernetes.io/docs/concepts/storage/volumes#awselasticblockstore
                                type: boolean
                              volumeID:
                                description: |-
                                  volumeID is unique ID of the persistent disk resource in AWS (Amazon EBS volume).
                                  More info: https://kubernetes.io/docs/concepts/storage/volumes#awselasticblockstore
                                type: string
                            required:
                            - volumeID
                            type: object
                          azureDisk:
                            description: |-
                              azureDisk represents an Azure Data Disk mount on the host and bind mount to the pod.
                              Deprecated: AzureDisk is deprecated. All operations for the in-tree azureDisk type
                              are redirected to the disk.csi.azure.com CSI driver.
                            properties:
                              cachingMode:
                                description: 'cachingMode is the Host Caching mode: None,
                                  Read Only, Read Write.'
                                type: string
                              diskName:
                                description: diskName is the Name of the data disk in the
                                  blob storage
                                type: string
                              diskURI:
                                description: diskURI is the URI of data disk in the blob
                                  storage
                                type: string
                              fsType:
                                default: ext4
                                description: |-
                                  fsType is Filesystem type to mount.
                                  Must be a filesystem type supported by the host operating system.
                                  Ex. "ext4", "xfs", "ntfs". Implicitly inferred to be "ext4" if unspecified.
                                type: string
                              kind:
                                description: 'kind expected values are Shared: multiple
                                  blob disks per storage account  Dedicated: single blob
                                  disk per storage account  Managed: azure managed data
                                  disk (only in managed availability set). defaults to shared'
                                type: string
                              readOnly:
                                default: false
                                description: |-
                                  readOnly Defaults to false (read/write). ReadOnly here will force
                                  the ReadOnly setting in VolumeMounts.
                                type: boolean
                            required:
                            - diskName
                            - diskURI
                            type: object
                          azureFile:
                            description: |-
                              azureFile represents an Azure File Service mount on the host and bind mount to the pod.
                              Deprecated: AzureFile is deprecated. All operations for the in-tree azureFile type
                              are redirected to the file.csi.azure.com CSI driver.
                            properties:
                              readOnly:
                                description: |-
                                  readOnly defaults to false (read/write). ReadOnly here will force
                                  the ReadOnly setting in VolumeMounts.
                                type: boolean
                              secretName:
                                description: secretName is the  name of secret that contains
                                  Azure Storage Account Name and Key
                                type: string
                              shareName:
                                description: shareName is the azure share Name
                                type: string
                            required:
                            - secretName
                            - shareName
                            type: object
                          cephfs:
                            description: |-
                              cephFS represents a Ceph FS mount on the host that shares a pod's lifetime.
                              Deprecated: CephFS is deprecated and the in-tree cephfs type is no longer supported.
                            properties:
                              monitors:
                                description: |-
                                  monitors is Required: Monitors is a collection of Ceph monitors
                                  More info: https://examples.k8s.io/volumes/cephfs/README.md#how-to-use-it
                                items:
                                  type: string
                                type: array
                                x-kubernetes-list-type: atomic
                              path:
                                description: 'path is Optional: Used as the mounted root,
                                  rather than the full Ceph tree, default is /'
                                type: string
                              readOnly:
                                description: |-
                                  readOnly is Optional: Defaults to false (read/write). ReadOnly here will force
                                  the ReadOnly setting in VolumeMounts.
                                  More info: https://examples.k8s.io/volumes/cephfs/README.md#how-to-use-it
                                type: boolean
                              secretFile:
                                description: |-
                                  secretFile is Optional: SecretFile is the path to key ring for User, default is /etc/ceph/user.secret
                                  More info: https://examples.k8s.io/volumes/cephfs/README.md#how-to-use-it
                                type: string
                              secretRef:
                                description: |-
                                  secretRef is Optional: SecretRef is reference to the authentication secret for User, default is empty.
                                  More info: https://examples.k8s.io/volumes/cephfs/README.md#how-to-use-it
                                properties:
                                  name:
                                    default: ""
                                    description: |-
                                      Name of the referent.
                                      This field is effectively required, but due to backwards compatibility is
                                      allowed to be empty. Instances of this type with an empty value here are
                                      almost certainly wrong.
                                      More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                                    type: string
                                type: object
                                x-kubernetes-map-type: atomic
                              user:
                                description: |-
                                  user is optional: User is the rados user name, default is admin
                                  More info: https://examples.k8s.io/volumes/cephfs/README.md#how-to-use-it
                                type: string
                            required:
                            - monitors
                            type: object
                          cinder:
                            description: |-
                              cinder represents a cinder volume attached and mounted on kubelets host machine.
                              Deprecated: Cinder is deprecated. All operations for the in-tree cinder type
                              are redirected to the cinder.csi.openstack.org CSI driver.
                              More info: https://examples.k8s.io/mysql-cinder-pd/README.md
                            properties:
                              fsType:
                                description: |-
                                  fsType is the filesystem type to mount.
                                  Must be a filesystem type supported by the host operating system.
                                  Examples: "ext4", "xfs", "ntfs". Implicitly inferred to be "ext4" if unspecified.
                                  More info: https://examples.k8s.io/mysql-cinder-pd/README.md
                                type: string
                              readOnly:
                                description: |-
                                  readOnly defaults to false (read/write). ReadOnly here will force
                                  the ReadOnly setting in VolumeMounts.
                                  More info: https://examples.k8s.io/mysql-cinder-pd/README.md
                                type: boolean
                              secretRef:
                                description: |-
                                  secretRef is optional: points to a secret object containing parameters used to connect
                                  to OpenStack.
                                properties:
                                  name:
                                    default: ""
                                    description: |-
                                      Name of the referent.
                                      This field is effectively required, but due to backwards compatibility is
                                      allowed to be empty. Instances of this type with an empty value here are
                                      almost certainly wrong.
                                      More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                                    type: string
                                type: object
                                x-kubernetes-map-type: atomic
                              volumeID:
                                description: |-
                                  volumeID used to identify the volume in cinder.
                                  More info: https://examples.k8s.io/mysql-cinder-pd/README.md
                                type: string
                            required:
                            - volumeID
                            type: object
                          configMap:
                            description: configMap represents a configMap that should populate
                              this volume
                            properties:
                              defaultMode:
                                description: |-
                                  defaultMode is optional: mode bits used to set permissions on created files by default.
                                  Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511.
                                  YAML accepts both octal and decimal values, JSON requires decimal values for mode bits.
                                  Defaults to 0644.
                                  Directories within the path are not affected by this setting.
                                  This might be in conflict with other options that affect the file
                                  mode, like fsGroup, and the result can be other mode bits set.
                                format: int32
                                type: integer
                              items:
                                description: |-
                                  items if unspecified, each key-value pair in the Data field of the referenced
                                  ConfigMap will be projected into the volume as a file whose name is the
                                  key and content is the value. If specified, the listed keys will be
                                  projected into the specified paths, and unlisted keys will not be
                                  present. If a key is specified which is not present in the ConfigMap,
                                  the volume setup will error unless it is marked optional. Paths must be
                                  relative and may not contain the '..' path or start with '..'.
                                items:
                                  description: Maps a string key to a path within a volume.
                                  properties:
                                    key:
                                      description: key is the key to project.
                                      type: string
                                    mode:
                                      description: |-
                                        mode is Optional: mode bits used to set permissions on this file.
                                        Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511.
                                        YAML accepts both octal and decimal values, JSON requires decimal values for mode bits.
                                        If not specified, the volume defaultMode will be used.
                                        This might be in conflict with other options that affect the file
                                        mode, like fsGroup, and the result can be other mode bits set.
                                      format: int32
                                      type: integer
                                    path:
                                      description: |-
                                        path is the relative path of the file to map the key to.
                                        May not be an absolute path.
                                        May not contain the path element '..'.
                                        May not start with the string '..'.
                                      type: string
                                  required:
                                  - key
                                  - path
                                  type: object
                                type: array
                                x-kubernetes-list-type: atomic
                              name:
                                default: ""
                                description: |-
                                  Name of the referent.
                                  This field is effectively required, but due to backwards compatibility is
                                  allowed to be empty. Instances of this type with an empty value here are
                                  almost certainly wrong.
                                  More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                                type: string
                              optional:
                                description: optional specify whether the ConfigMap or its
                                  keys must be defined
                                type: boolean
                            type: object
                            x-kubernetes-map-type: atomic
                          csi:
                            description: csi (Container Storage Interface) represents ephemeral
                              storage that is handled by certain external CSI drivers.
                            properties:
                              driver:
                                description: |-
                                  driver is the name of the CSI driver that handles this volume.
                                  Consult with your admin for the correct name as registered in the cluster.
                                type: string
                              fsType:
                                description: |-
                                  fsType to mount. Ex. "ext4", "xfs", "ntfs".
                                  If not provided, the empty value is passed to the associated CSI driver
                                  which will determine the default filesystem to apply.
                                type: string
                              nodePublishSecretRef:
                                description: |-
                                  nodePublishSecretRef is a reference to the secret object containing
                                  sensitive information to pass to the CSI driver to complete the CSI
                                  NodePublishVolume and NodeUnpublishVolume calls.
                                  This field is optional, and  may be empty if no secret is required. If the
                                  secret object contains more than one secret, all secret references are passed.
                                properties:
                                  name:
                                    default: ""
                                    description: |-
                                      Name of the referent.
                                      This field is effectively required, but due to backwards compatibility is
                                      allowed to be empty. Instances of this type with an empty value here are
                                      almost certainly wrong.
                                      More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                                    type: string
                                type: object
                                x-kubernetes-map-type: atomic
                              readOnly:
                                description: |-
                                  readOnly specifies a read-only configuration for the volume.
                                  Defaults to false (read/write).
                                type: boolean
                              volumeAttributes:
                                additionalProperties:
                                  type: string
                                description: |-
                                  volumeAttributes stores driver-specific properties that are passed to the CSI
                                  driver. Consult your driver's documentation for supported values.
                                type: object
                            required:
                            - driver
                            type: object
                          downwardAPI:
                            description: downwardAPI represents downward API about the pod
                              that should populate this volume
                            properties:
                              defaultMode:
                                description: |-
                                  Optional: mode bits to use on created files by default. Must be a
                                  Optional: mode bits used to set permissions on created files by default.
                                  Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511.
                                  YAML accepts both octal and decimal values, JSON requires decimal values for mode bits.
                                  Defaults to 0644.
                                  Directories within the path are not affected by this setting.
                                  This might be in conflict with other options that affect the file
                                  mode, like fsGroup, and the result can be other mode bits set.
                                format: int32
                                type: integer
                              items:
                                description: Items is a list of downward API volume file
                                items:
                                  description: DownwardAPIVolumeFile represents information
                                    to create the file containing the pod field
                                  properties:
                                    fieldRef:
                                      description: 'Required: Selects a field of the pod:
                                        only annotations, labels, name, namespace and uid
                                        are supported.'
                                      properties:
                                        apiVersion:
                                          description: Version of the schema the FieldPath
                                            is written in terms of, defaults to "v1".
                                          type: string
                                        fieldPath:
                                          description: Path of the field to select in the
                                            specified API version.
                                          type: string
                                      required:
                                      - fieldPath
                                      type: object
                                      x-kubernetes-map-type: atomic
                                    mode:
                                      description: |-
                                        Optional: mode bits used to set permissions on this file, must be an octal value
                                        between 0000 and 0777 or a decimal value between 0 and 511.
                                        YAML accepts both octal and decimal values, JSON requires decimal values for mode bits.
                                        If not specified, the volume defaultMode will be used.
                                        This might be in conflict with other options that affect the file
                                        mode, like fsGroup, and the result can be other mode bits set.
                                      format: int32
                                      type: integer
                                    path:
                                      description: 'Required: Path is  the relative path
                                        name of the file to be created. Must not be absolute
                                        or contain the ''..'' path. Must be utf-8 encoded.
                                        The first item of the relative path must not start
                                        with ''..'''
                                      type: string
                                    resourceFieldRef:
                                      description: |-
                                        Selects a resource of the container: only resources limits and requests
                                        (limits.cpu, limits.memory, requests.cpu and requests.memory) are currently supported.
                                      properties:
                                        containerName:
                                          description: 'Container name: required for volumes,
                                            optional for env vars'
                                          type: string
                                        divisor:
                                          anyOf:
                                          - type: integer
                                          - type: string
                                          description: Specifies the output format of the
                                            exposed resources, defaults to "1"
                                          pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
                                          x-kubernetes-int-or-string: true
                                        resource:
                                          description: 'Required: resource to select'
                                          type: string
                                      required:
                                      - resource
                                      type: object
                                      x-kubernetes-map-type: atomic
                                  required:
                                  - path
                                  type: object
                                type: array
                                x-kubernetes-list-type: atomic
                            type: object
                          emptyDir:
                            description: |-
                              emptyDir represents a temporary directory that shares a pod's lifetime.
                              More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir
                            properties:
                              medium:
                                description: |-
                                  medium represents what type of storage medium should back this directory.
                                  The default is "" which means to use the node's default medium.
                                  Must be an empty string (default) or Memory.
                                  More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir
                                type: string
                              sizeLimit:
                                anyOf:
                                - type: integer
                                - type: string
                                description: |-
                                  sizeLimit is the total amount of local storage required for this EmptyDir volume.
                                  The size limit is also applicable for memory medium.
                                  The maximum usage on memory medium EmptyDir would be the minimum value between
                                  the SizeLimit specified here and the sum of memory limits of all containers in a pod.
                                  The default is nil which means that the limit is undefined.
                                  More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir
                                pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
                                x-kubernetes-int-or-string: true
                            type: object
                          ephemeral:
                            description: |-
                              ephemeral represents a volume that is handled by a cluster storage driver.
                              The volume's lifecycle is tied to the pod that defines it - it will be created before the pod starts,
                              and deleted when the pod is removed.
      
                              Use this if:
                              a) the volume is only needed while the pod runs,
                              b) features of normal volumes like restoring from snapshot or capacity
                                 tracking are needed,
                              c) the storage driver is specified through a storage class, and
                              d) the storage driver supports dynamic volume provisioning through
                                 a PersistentVolumeClaim (see EphemeralVolumeSource for more
                                 information on the connection between this volume type
                                 and PersistentVolumeClaim).
      
                              Use PersistentVolumeClaim or one of the vendor-specific
                              APIs for volumes that persist for longer than the lifecycle
                              of an individual pod.
      
                              Use CSI for light-weight local ephemeral volumes if the CSI driver is meant to
                              be used that way - see the documentation of the driver for
                              more information.
      
                              A pod can use both types of ephemeral volumes and
                              persistent volumes at the same time.
                            properties:
                              volumeClaimTemplate:
                                description: |-
                                  Will be used to create a stand-alone PVC to provision the volume.
                                  The pod in which this EphemeralVolumeSource is embedded will be the
                                  owner of the PVC, i.e. the PVC will be deleted together with the
                                  pod.  The name of the PVC will be `<pod name>-<volume name>` where
                                  `<volume name>` is the name from the `PodSpec.Volumes` array
                                  entry. Pod validation will reject the pod if the concatenated name
                                  is not valid for a PVC (for example, too long).
      
                                  An existing PVC with that name that is not owned by the pod
                                  will *not* be used for the pod to avoid using an unrelated
                                  volume by mistake. Starting the pod is then blocked until
                                  the unrelated PVC is removed. If such a pre-created PVC is
                                  meant to be used by the pod, the PVC has to updated with an
                                  owner reference to the pod once the pod exists. Normally
                                  this should not be necessary, but it may be useful when
                                  manually reconstructing a broken cluster.
      
                                  This field is read-only and no changes will be made by Kubernetes
                                  to the PVC after it has been created.
      
                                  Required, must not be nil.
                                properties:
                                  metadata:
                                    description: |-
                                      May contain labels and annotations that will be copied into the PVC
                                      when creating it. No other fields are allowed and will be rejected during
                                      validation.
                                    type: object
                                  spec:
                                    description: |-
                                      The specification for the PersistentVolumeClaim. The entire content is
                                      copied unchanged into the PVC that gets created from this
                                      template. The same fields as in a PersistentVolumeClaim
                                      are also valid here.
                                    properties:
                                      accessModes:
                                        description: |-
                                          accessModes contains the desired access modes the volume should have.
                                          More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#access-modes-1
                                        items:
                                          type: string
                                        type: array
                                        x-kubernetes-list-type: atomic
                                      dataSource:
                                        description: |-
                                          dataSource field can be used to specify either:
                                          * An existing VolumeSnapshot object (snapshot.storage.k8s.io/VolumeSnapshot)
                                          * An existing PVC (PersistentVolumeClaim)
                                          If the provisioner or an external controller can support the specified data source,
                                          it will create a new volume based on the contents of the specified data source.
                                          When the AnyVolumeDataSource feature gate is enabled, dataSource contents will be copied to dataSourceRef,
                                          and dataSourceRef contents will be copied to dataSource when dataSourceRef.namespace is not specified.
                                          If the namespace is specified, then dataSourceRef will not be copied to dataSource.
                                        properties:
                                          apiGroup:
                                            description: |-
                                              APIGroup is the group for the resource being referenced.
                                              If APIGroup is not specified, the specified Kind must be in the core API group.
                                              For any other third-party types, APIGroup is required.
                                            type: string
                                          kind:
                                            description: Kind is the type of resource being
                                              referenced
                                            type: string
                                          name:
                                            description: Name is the name of resource being
                                              referenced
                                            type: string
                                        required:
                                        - kind
                                        - name
                                        type: object
                                        x-kubernetes-map-type: atomic
                                      dataSourceRef:
                                        description: |-
                                          dataSourceRef specifies the object from which to populate the volume with data, if a non-empty
                                          volume is desired. This may be any object from a non-empty API group (non
                                          core object) or a PersistentVolumeClaim object.
                                          When this field is specified, volume binding will only succeed if the type of
                                          the specified object matches some installed volume populator or dynamic
                                          provisioner.
                                          This field will replace the functionality of the dataSource field and as such
                                          if both fields are non-empty, they must have the same value. For backwards
                                          compatibility, when namespace isn't specified in dataSourceRef,
                                          both fields (dataSource and dataSourceRef) will be set to the same
                                          value automatically if one of them is empty and the other is non-empty.
                                          When namespace is specified in dataSourceRef,
                                          dataSource isn't set to the same value and must be empty.
                                          There are three important differences between dataSource and dataSourceRef:
                                          * While dataSource only allows two specific types of objects, dataSourceRef
                                            allows any non-core object, as well as PersistentVolumeClaim objects.
                                          * While dataSource ignores disallowed values (dropping them), dataSourceRef
                                            preserves all values, and generates an error if a disallowed value is
                                            specified.
                                          * While dataSource only allows local objects, dataSourceRef allows objects
                                            in any namespaces.
                                          (Beta) Using this field requires the AnyVolumeDataSource feature gate to be enabled.
                                          (Alpha) Using the namespace field of dataSourceRef requires the CrossNamespaceVolumeDataSource feature gate to be enabled.
                                        properties:
                                          apiGroup:
                                            description: |-
                                              APIGroup is the group for the resource being referenced.
                                              If APIGroup is not specified, the specified Kind must be in the core API group.
                                              For any other third-party types, APIGroup is required.
                                            type: string
                                          kind:
                                            description: Kind is the type of resource being
                                              referenced
                                            type: string
                                          name:
                                            description: Name is the name of resource being
                                              referenced
                                            type: string
                                          namespace:
                                            description: |-
                                              Namespace is the namespace of resource being referenced
                                              Note that when a namespace is specified, a gateway.networking.k8s.io/ReferenceGrant object is required in the referent namespace to allow that namespace's owner to accept the reference. See the ReferenceGrant documentation for details.
                                              (Alpha) This field requires the CrossNamespaceVolumeDataSource feature gate to be enabled.
                                            type: string
                                        required:
                                        - kind
                                        - name
                                        type: object
                                      resources:
                                        description: |-
                                          resources represents the minimum resources the volume should have.
                                          Users are allowed to specify resource requirements
                                          that are lower than previous value but must still be higher than capacity recorded in the
                                          status field of the claim.
                                          More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#resources
                                        properties:
                                          limits:
                                            additionalProperties:
                                              anyOf:
                                              - type: integer
                                              - type: string
                                              pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
                                              x-kubernetes-int-or-string: true
                                            description: |-
                                              Limits describes the maximum amount of compute resources allowed.
                                              More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
                                            type: object
                                          requests:
                                            additionalProperties:
                                              anyOf:
                                              - type: integer
                                              - type: string
                                              pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
                                              x-kubernetes-int-or-string: true
                                            description: |-
                                              Requests describes the minimum amount of compute resources required.
                                              If Requests is omitted for a container, it defaults to Limits if that is explicitly specified,
                                              otherwise to an implementation-defined value. Requests cannot exceed Limits.
                                              More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
                                            type: object
                                        type: object
                                      selector:
                                        description: selector is a label query over volumes
                                          to consider for binding.
                                        properties:
                                          matchExpressions:
                                            description: matchExpressions is a list of label
                                              selector requirements. The requirements are
                                              ANDed.
                                            items:
                                              description: |-
                                                A label selector requirement is a selector that contains values, a key, and an operator that
                                                relates the key and values.
                                              properties:
                                                key:
                                                  description: key is the label key that
                                                    the selector applies to.
                                                  type: string
                                                operator:
                                                  description: |-
                                                    operator represents a key's relationship to a set of values.
                                                    Valid operators are In, NotIn, Exists and DoesNotExist.
                                                  type: string
                                                values:
                                                  description: |-
                                                    values is an array of string values. If the operator is In or NotIn,
                                                    the values array must be non-empty. If the operator is Exists or DoesNotExist,
                                                    the values array must be empty. This array is replaced during a strategic
                                                    merge patch.
                                                  items:
                                                    type: string
                                                  type: array
                                                  x-kubernetes-list-type: atomic
                                              required:
                                              - key
                                              - operator
                                              type: object
                                            type: array
                                            x-kubernetes-list-type: atomic
                                          matchLabels:
                                            additionalProperties:
                                              type: string
                                            description: |-
                                              matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
                                              map is equivalent to an element of matchExpressions, whose key field is "key", the
                                              operator is "In", and the values array contains only "value". The requirements are ANDed.
                                            type: object
                                        type: object
                                        x-kubernetes-map-type: atomic
                                      storageClassName:
                                        description: |-
                                          storageClassName is the name of the StorageClass required by the claim.
                                          More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#class-1
                                        type: string
                                      volumeAttributesClassName:
                                        description: |-
                                          volumeAttributesClassName may be used to set the VolumeAttributesClass used by this claim.
                                          If specified, the CSI driver will create or update the volume with the attributes defined
                                          in the corresponding VolumeAttributesClass. This has a different purpose than storageClassName,
                                          it can be changed after the claim is created. An empty string or nil value indicates that no
                                          VolumeAttributesClass will be applied to the claim. If the claim enters an Infeasible error state,
                                          this field can be reset to its previous value (including nil) to cancel the modification.
                                          If the resource referred to by volumeAttributesClass does not exist, this PersistentVolumeClaim will be
                                          set to a Pending state, as reflected by the modifyVolumeStatus field, until such as a resource
                                          exists.
                                          More info: https://kubernetes.io/docs/concepts/storage/volume-attributes-classes/
                                        type: string
                                      volumeMode:
                                        description: |-
                                          volumeMode defines what type of volume is required by the claim.
                                          Value of Filesystem is implied when not included in claim spec.
                                        type: string
                                      volumeName:
                                        description: volumeName is the binding reference
                                          to the PersistentVolume backing this claim.
                                        type: string
                                    type: object
                                required:
                                - spec
                                type: object
                            type: object
                          fc:
                            description: fc represents a Fibre Channel resource that is
                              attached to a kubelet's host machine and then exposed to the
                              pod.
                            properties:
                              fsType:
                                description: |-
                                  fsType is the filesystem type to mount.
                                  Must be a filesystem type supported by the host operating system.
                                  Ex. "ext4", "xfs", "ntfs". Implicitly inferred to be "ext4" if unspecified.
                                type: string
                              lun:
                                description: 'lun is Optional: FC target lun number'
                                format: int32
                                type: integer
                              readOnly:
                                description: |-
                                  readOnly is Optional: Defaults to false (read/write). ReadOnly here will force
                                  the ReadOnly setting in VolumeMounts.
                                type: boolean
                              targetWWNs:
                                description: 'targetWWNs is Optional: FC target worldwide
                                  names (WWNs)'
                                items:
                                  type: string
                                type: array
                                x-kubernetes-list-type: atomic
                              wwids:
                                description: |-
                                  wwids Optional: FC volume world wide identifiers (wwids)
                                  Either wwids or combination of targetWWNs and lun must be set, but not both simultaneously.
                                items:
                                  type: string
                                type: array
                                x-kubernetes-list-type: atomic
                            type: object
                          flexVolume:
                            description: |-
                              flexVolume represents a generic volume resource that is
                              provisioned/attached using an exec based plugin.
                              Deprecated: FlexVolume is deprecated. Consider using a CSIDriver instead.
                            properties:
                              driver:
                                description: driver is the name of the driver to use for
                                  this volume.
                                type: string
                              fsType:
                                description: |-
                                  fsType is the filesystem type to mount.
                                  Must be a filesystem type supported by the host operating system.
                                  Ex. "ext4", "xfs", "ntfs". The default filesystem depends on FlexVolume script.
                                type: string
                              options:
                                additionalProperties:
                                  type: string
                                description: 'options is Optional: this field holds extra
                                  command options if any.'
                                type: object
                              readOnly:
                                description: |-
                                  readOnly is Optional: defaults to false (read/write). ReadOnly here will force
                                  the ReadOnly setting in VolumeMounts.
                                type: boolean
                              secretRef:
                                description: |-
                                  secretRef is Optional: secretRef is reference to the secret object containing
                                  sensitive information to pass to the plugin scripts. This may be
                                  empty if no secret object is specified. If the secret object
                                  contains more than one secret, all secrets are passed to the plugin
                                  scripts.
                                properties:
                                  name:
                                    default: ""
                                    description: |-
                                      Name of the referent.
                                      This field is effectively required, but due to backwards compatibility is
                                      allowed to be empty. Instances of this type with an empty value here are
                                      almost certainly wrong.
                                      More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                                    type: string
                                type: object
                                x-kubernetes-map-type: atomic
                            required:
                            - driver
                            type: object
                          flocker:
                            description: |-
                              flocker represents a Flocker volume attached to a kubelet's host machine. This depends on the Flocker control service being running.
                              Deprecated: Flocker is deprecated and the in-tree flocker type is no longer supported.
                            properties:
                              datasetName:
                                description: |-
                                  datasetName is Name of the dataset stored as metadata -> name on the dataset for Flocker
                                  should be considered as deprecated
                                type: string
                              datasetUUID:
                                description: datasetUUID is the UUID of the dataset. This
                                  is unique identifier of a Flocker dataset
                                type: string
                            type: object
                          gcePersistentDisk:
                            description: |-
                              gcePersistentDisk represents a GCE Disk resource that is attached to a
                              kubelet's host machine and then exposed to the pod.
                              Deprecated: GCEPersistentDisk is deprecated. All operations for the in-tree
                              gcePersistentDisk type are redirected to the pd.csi.storage.gke.io CSI driver.
                              More info: https://kubernetes.io/docs/concepts/storage/volumes#gcepersistentdisk
                            properties:
                              fsType:
                                description: |-
                                  fsType is filesystem type of the volume that you want to mount.
                                  Tip: Ensure that the filesystem type is supported by the host operating system.
                                  Examples: "ext4", "xfs", "ntfs". Implicitly inferred to be "ext4" if unspecified.
                                  More info: https://kubernetes.io/docs/concepts/storage/volumes#gcepersistentdisk
                                type: string
                              partition:
                                description: |-
                                  partition is the partition in the volume that you want to mount.
                                  If omitted, the default is to mount by volume name.
                                  Examples: For volume /dev/sda1, you specify the partition as "1".
                                  Similarly, the volume partition for /dev/sda is "0" (or you can leave the property empty).
                                  More info: https://kubernetes.io/docs/concepts/storage/volumes#gcepersistentdisk
                                format: int32
                                type: integer
                              pdName:
                                description: |-
                                  pdName is unique name of the PD resource in GCE. Used to identify the disk in GCE.
                                  More info: https://kubernetes.io/docs/concepts/storage/volumes#gcepersistentdisk
                                type: string
                              readOnly:
                                description: |-
                                  readOnly here will force the ReadOnly setting in VolumeMounts.
                                  Defaults to false.
                                  More info: https://kubernetes.io/docs/concepts/storage/volumes#gcepersistentdisk
                                type: boolean
                            required:
                            - pdName
                            type: object
                          gitRepo:
                            description: |-
                              gitRepo represents a git repository at a particular revision.
                              Deprecated: GitRepo is deprecated. To provision a container with a git repo, mount an
                              EmptyDir into an InitContainer that clones the repo using git, then mount the EmptyDir
                              into the Pod's container.
                            properties:
                              directory:
                                description: |-
                                  directory is the target directory name.
                                  Must not contain or start with '..'.  If '.' is supplied, the volume directory will be the
                                  git repository.  Otherwise, if specified, the volume will contain the git repository in
                                  the subdirectory with the given name.
                                type: string
                              repository:
                                description: repository is the URL
                                type: string
                              revision:
                                description: revision is the commit hash for the specified
                                  revision.
                                type: string
                            required:
                            - repository
                            type: object
                          glusterfs:
                            description: |-
                              glusterfs represents a Glusterfs mount on the host that shares a pod's lifetime.
                              Deprecated: Glusterfs is deprecated and the in-tree glusterfs type is no longer supported.
                            properties:
                              endpoints:
                                description: endpoints is the endpoint name that details
                                  Glusterfs topology.
                                type: string
                              path:
                                description: |-
                                  path is the Glusterfs volume path.
                                  More info: https://examples.k8s.io/volumes/glusterfs/README.md#create-a-pod
                                type: string
                              readOnly:
                                description: |-
                                  readOnly here will force the Glusterfs volume to be mounted with read-only permissions.
                                  Defaults to false.
                                  More info: https://examples.k8s.io/volumes/glusterfs/README.md#create-a-pod
                                type: boolean
                            required:
                            - endpoints
                            - path
                            type: object
                          hostPath:
                            description: |-
                              hostPath represents a pre-existing file or directory on the host
                              machine that is directly exposed to the container. This is generally
                              used for system agents or other privileged things that are allowed
                              to see the host machine. Most containers will NOT need this.
                              More info: https://kubernetes.io/docs/concepts/storage/volumes#hostpath
                            properties:
                              path:
                                description: |-
                                  path of the directory on the host.
                                  If the path is a symlink, it will follow the link to the real path.
                                  More info: https://kubernetes.io/docs/concepts/storage/volumes#hostpath
                                type: string
                              type:
                                description: |-
                                  type for HostPath Volume
                                  Defaults to ""
                                  More info: https://kubernetes.io/docs/concepts/storage/volumes#hostpath
                                type: string
                            required:
                            - path
                            type: object
                          image:
                            description: |-
                              image represents an OCI object (a container image or artifact) pulled and mounted on the kubelet's host machine.
                              The volume is resolved at pod startup depending on which PullPolicy value is provided:
      
                              - Always: the kubelet always attempts to pull the reference. Container creation will fail If the pull fails.
                              - Never: the kubelet never pulls the reference and only uses a local image or artifact. Container creation will fail if the reference isn't present.
                              - IfNotPresent: the kubelet pulls if the reference isn't already present on disk. Container creation will fail if the reference isn't present and the pull fails.
      
                              The volume gets re-resolved if the pod gets deleted and recreated, which means that new remote content will become available on pod recreation.
                              A failure to resolve or pull the image during pod startup will block containers from starting and may add significant latency. Failures will be retried using normal volume backoff and will be reported on the pod reason and message.
                              The types of objects that may be mounted by this volume are defined by the container runtime implementation on a host machine and at minimum must include all valid types supported by the container image field.
                              The OCI object gets mounted in a single directory (spec.containers[*].volumeMounts.mountPath) by merging the manifest layers in the same way as for container images.
                              The volume will be mounted read-only (ro).
                              Sub path mounts for containers are not supported (spec.containers[*].volumeMounts.subpath) before 1.33.
                              The field spec.securityContext.fsGroupChangePolicy has no effect on this volume type.
                            properties:
                              pullPolicy:
                                description: |-
                                  Policy for pulling OCI objects. Possible values are:
                                  Always: the kubelet always attempts to pull the reference. Container creation will fail If the pull fails.
                                  Never: the kubelet never pulls the reference and only uses a local image or artifact. Container creation will fail if the reference isn't present.
                                  IfNotPresent: the kubelet pulls if the reference isn't already present on disk. Container creation will fail if the reference isn't present and the pull fails.
                                  Defaults to Always if :latest tag is specified, or IfNotPresent otherwise.
                                type: string
                              reference:
                                description: |-
                                  Required: Image or artifact reference to be used.
                                  Behaves in the same way as pod.spec.containers[*].image.
                                  Pull secrets will be assembled in the same way as for the container image by looking up node credentials, SA image pull secrets, and pod spec image pull secrets.
                                  More info: https://kubernetes.io/docs/concepts/containers/images
                                  This field is optional to allow higher level config management to default or override
                                  container images in workload controllers like Deployments and StatefulSets.
                                type: string
                            type: object
                          iscsi:
                            description: |-
                              iscsi represents an ISCSI Disk resource that is attached to a
                              kubelet's host machine and then exposed to the pod.
                              More info: https://kubernetes.io/docs/concepts/storage/volumes/#iscsi
                            properties:
                              chapAuthDiscovery:
                                description: chapAuthDiscovery defines whether support iSCSI
                                  Discovery CHAP authentication
                                type: boolean
                              chapAuthSession:
                                description: chapAuthSession defines whether support iSCSI
                                  Session CHAP authentication
                                type: boolean
                              fsType:
                                description: |-
                                  fsType is the filesystem type of the volume that you want to mount.
                                  Tip: Ensure that the filesystem type is supported by the host operating system.
                                  Examples: "ext4", "xfs", "ntfs". Implicitly inferred to be "ext4" if unspecified.
                                  More info: https://kubernetes.io/docs/concepts/storage/volumes#iscsi
                                type: string
                              initiatorName:
                                description: |-
                                  initiatorName is the custom iSCSI Initiator Name.
                                  If initiatorName is specified with iscsiInterface simultaneously, new iSCSI interface
                                  <target portal>:<volume name> will be created for the connection.
                                type: string
                              iqn:
                                description: iqn is the target iSCSI Qualified Name.
                                type: string
                              iscsiInterface:
                                default: default
                                description: |-
                                  iscsiInterface is the interface Name that uses an iSCSI transport.
                                  Defaults to 'default' (tcp).
                                type: string
                              lun:
                                description: lun represents iSCSI Target Lun number.
                                format: int32
                                type: integer
                              portals:
                                description: |-
                                  portals is the iSCSI Target Portal List. The portal is either an IP or ip_addr:port if the port
                                  is other than default (typically TCP ports 860 and 3260).
                                items:
                                  type: string
                                type: array
                                x-kubernetes-list-type: atomic
                              readOnly:
                                description: |-
                                  readOnly here will force the ReadOnly setting in VolumeMounts.
                                  Defaults to false.
                                type: boolean
                              secretRef:
                                description: secretRef is the CHAP Secret for iSCSI target
                                  and initiator authentication
                                properties:
                                  name:
                                    default: ""
                                    description: |-
                                      Name of the referent.
                                      This field is effectively required, but due to backwards compatibility is
                                      allowed to be empty. Instances of this type with an empty value here are
                                      almost certainly wrong.
                                      More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                                    type: string
                                type: object
                                x-kubernetes-map-type: atomic
                              targetPortal:
                                description: |-
                                  targetPortal is iSCSI Target Portal. The Portal is either an IP or ip_addr:port if the port
                                  is other than default (typically TCP ports 860 and 3260).
                                type: string
                            required:
                            - iqn
                            - lun
                            - targetPortal
                            type: object
                          name:
                            description: |-
                              name of the volume.
                              Must be a DNS_LABEL and unique within the pod.
                              More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                            type: string
                          nfs:
                            description: |-
                              nfs represents an NFS mount on the host that shares a pod's lifetime
                              More info: https://kubernetes.io/docs/concepts/storage/volumes#nfs
                            properties:
                              path:
                                description: |-
                                  path that is exported by the NFS server.
                                  More info: https://kubernetes.io/docs/concepts/storage/volumes#nfs
                                type: string
                              readOnly:
                                description: |-
                                  readOnly here will force the NFS export to be mounted with read-only permissions.
                                  Defaults to false.
                                  More info: https://kubernetes.io/docs/concepts/storage/volumes#nfs
                                type: boolean
                              server:
                                description: |-
                                  server is the hostname or IP address of the NFS server.
                                  More info: https://kubernetes.io/docs/concepts/storage/volumes#nfs
                                type: string
                            required:
                            - path
                            - server
                            type: object
                          persistentVolumeClaim:
                            description: |-
                              persistentVolumeClaimVolumeSource represents a reference to a
                              PersistentVolumeClaim in the same namespace.
                              More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#persistentvolumeclaims
                            properties:
                              claimName:
                                description: |-
                                  claimName is the name of a PersistentVolumeClaim in the same namespace as the pod using this volume.
                                  More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#persistentvolumeclaims
                                type: string
                              readOnly:
                                description: |-
                                  readOnly Will force the ReadOnly setting in VolumeMounts.
                                  Default false.
                                type: boolean
                            required:
                            - claimName
                            type: object
                          photonPersistentDisk:
                            description: |-
                              photonPersistentDisk represents a PhotonController persistent disk attached and mounted on kubelets host machine.
                              Deprecated: PhotonPersistentDisk is deprecated and the in-tree photonPersistentDisk type is no longer supported.
                            properties:
                              fsType:
                                description: |-
                                  fsType is the filesystem type to mount.
                                  Must be a filesystem type supported by the host operating system.
                                  Ex. "ext4", "xfs", "ntfs". Implicitly inferred to be "ext4" if unspecified.
                                type: string
                              pdID:
                                description: pdID is the ID that identifies Photon Controller
                                  persistent disk
                                type: string
                            required:
                            - pdID
                            type: object
                          portworxVolume:
                            description: |-
                              portworxVolume represents a portworx volume attached and mounted on kubelets host machine.
                              Deprecated: PortworxVolume is deprecated. All operations for the in-tree portworxVolume type
                              are redirected to the pxd.portworx.com CSI driver.
                            properties:
                              fsType:
                                description: |-
                                  fSType represents the filesystem type to mount
                                  Must be a filesystem type supported by the host operating system.
                                  Ex. "ext4", "xfs". Implicitly inferred to be "ext4" if unspecified.
                                type: string
                              readOnly:
                                description: |-
                                  readOnly defaults to false (read/write). ReadOnly here will force
                                  the ReadOnly setting in VolumeMounts.
                                type: boolean
                              volumeID:
                                description: volumeID uniquely identifies a Portworx volume
                                type: string
                            required:
                            - volumeID
                            type: object
                          projected:
                            description: projected items for all in one resources secrets,
                              configmaps, and downward API
                            properties:
                              defaultMode:
                                description: |-
                                  defaultMode are the mode bits used to set permissions on created files by default.
                                  Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511.
                                  YAML accepts both octal and decimal values, JSON requires decimal values for mode bits.
                                  Directories within the path are not affected by this setting.
                                  This might be in conflict with other options that affect the file
                                  mode, like fsGroup, and the result can be other mode bits set.
                                format: int32
                                type: integer
                              sources:
                                description: |-
                                  sources is the list of volume projections. Each entry in this list
                                  handles one source.
                                items:
                                  description: |-
                                    Projection that may be projected along with other supported volume types.
                                    Exactly one of these fields must be set.
                                  properties:
                                    clusterTrustBundle:
                                      description: |-
                                        ClusterTrustBundle allows a pod to access the `.spec.trustBundle` field
                                        of ClusterTrustBundle objects in an auto-updating file.
      
                                        Alpha, gated by the ClusterTrustBundleProjection feature gate.
      
                                        ClusterTrustBundle objects can either be selected by name, or by the
                                        combination of signer name and a label selector.
      
                                        Kubelet performs aggressive normalization of the PEM contents written
                                        into the pod filesystem.  Esoteric PEM features such as inter-block
                                        comments and block headers are stripped.  Certificates are deduplicated.
                                        The ordering of certificates within the file is arbitrary, and Kubelet
                                        may change the order over time.
                                      properties:
                                        labelSelector:
                                          description: |-
                                            Select all ClusterTrustBundles that match this label selector.  Only has
                                            effect if signerName is set.  Mutually-exclusive with name.  If unset,
                                            interpreted as "match nothing".  If set but empty, interpreted as "match
                                            everything".
                                          properties:
                                            matchExpressions:
                                              description: matchExpressions is a list of
                                                label selector requirements. The requirements
                                                are ANDed.
                                              items:
                                                description: |-
                                                  A label selector requirement is a selector that contains values, a key, and an operator that
                                                  relates the key and values.
                                                properties:
                                                  key:
                                                    description: key is the label key that
                                                      the selector applies to.
                                                    type: string
                                                  operator:
                                                    description: |-
                                                      operator represents a key's relationship to a set of values.
                                                      Valid operators are In, NotIn, Exists and DoesNotExist.
                                                    type: string
                                                  values:
                                                    description: |-
                                                      values is an array of string values. If the operator is In or NotIn,
                                                      the values array must be non-empty. If the operator is Exists or DoesNotExist,
                                                      the values array must be empty. This array is replaced during a strategic
                                                      merge patch.
                                                    items:
                                                      type: string
                                                    type: array
                                                    x-kubernetes-list-type: atomic
                                                required:
                                                - key
                                                - operator
                                                type: object
                                              type: array
                                              x-kubernetes-list-type: atomic
                                            matchLabels:
                                              additionalProperties:
                                                type: string
                                              description: |-
                                                matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
                                                map is equivalent to an element of matchExpressions, whose key field is "key", the
                                                operator is "In", and the values array contains only "value". The requirements are ANDed.
                                              type: object
                                          type: object
                                          x-kubernetes-map-type: atomic
                                        name:
                                          description: |-
                                            Select a single ClusterTrustBundle by object name.  Mutually-exclusive
                                            with signerName and labelSelector.
                                          type: string
                                        optional:
                                          description: |-
                                            If true, don't block pod startup if the referenced ClusterTrustBundle(s)
                                            aren't available.  If using name, then the named ClusterTrustBundle is
                                            allowed not to exist.  If using signerName, then the combination of
                                            signerName and labelSelector is allowed to match zero
                                            ClusterTrustBundles.
                                          type: boolean
                                        path:
                                          description: Relative path from the volume root
                                            to write the bundle.
                                          type: string
                                        signerName:
                                          description: |-
                                            Select all ClusterTrustBundles that match this signer name.
                                            Mutually-exclusive with name.  The contents of all selected
                                            ClusterTrustBundles will be unified and deduplicated.
                                          type: string
                                      required:
                                      - path
                                      type: object
                                    configMap:
                                      description: configMap information about the configMap
                                        data to project
                                      properties:
                                        items:
                                          description: |-
                                            items if unspecified, each key-value pair in the Data field of the referenced
                                            ConfigMap will be projected into the volume as a file whose name is the
                                            key and content is the value. If specified, the listed keys will be
                                            projected into the specified paths, and unlisted keys will not be
                                            present. If a key is specified which is not present in the ConfigMap,
                                            the volume setup will error unless it is marked optional. Paths must be
                                            relative and may not contain the '..' path or start with '..'.
                                          items:
                                            description: Maps a string key to a path within
                                              a volume.
                                            properties:
                                              key:
                                                description: key is the key to project.
                                                type: string
                                              mode:
                                                description: |-
                                                  mode is Optional: mode bits used to set permissions on this file.
                                                  Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511.
                                                  YAML accepts both octal and decimal values, JSON requires decimal values for mode bits.
                                                  If not specified, the volume defaultMode will be used.
                                                  This might be in conflict with other options that affect the file
                                                  mode, like fsGroup, and the result can be other mode bits set.
                                                format: int32
                                                type: integer
                                              path:
                                                description: |-
                                                  path is the relative path of the file to map the key to.
                                                  May not be an absolute path.
                                                  May not contain the path element '..'.
                                                  May not start with the string '..'.
                                                type: string
                                            required:
                                            - key
                                            - path
                                            type: object
                                          type: array
                                          x-kubernetes-list-type: atomic
                                        name:
                                          default: ""
                                          description: |-
                                            Name of the referent.
                                            This field is effectively required, but due to backwards compatibility is
                                            allowed to be empty. Instances of this type with an empty value here are
                                            almost certainly wrong.
                                            More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                                          type: string
                                        optional:
                                          description: optional specify whether the ConfigMap
                                            or its keys must be defined
                                          type: boolean
                                      type: object
                                      x-kubernetes-map-type: atomic
                                    downwardAPI:
                                      description: downwardAPI information about the downwardAPI
                                        data to project
                                      properties:
                                        items:
                                          description: Items is a list of DownwardAPIVolume
                                            file
                                          items:
                                            description: DownwardAPIVolumeFile represents
                                              information to create the file containing
                                              the pod field
                                            properties:
                                              fieldRef:
                                                description: 'Required: Selects a field
                                                  of the pod: only annotations, labels,
                                                  name, namespace and uid are supported.'
                                                properties:
                                                  apiVersion:
                                                    description: Version of the schema the
                                                      FieldPath is written in terms of,
                                                      defaults to "v1".
                                                    type: string
                                                  fieldPath:
                                                    description: Path of the field to select
                                                      in the specified API version.
                                                    type: string
                                                required:
                                                - fieldPath
                                                type: object
                                                x-kubernetes-map-type: atomic
                                              mode:
                                                description: |-
                                                  Optional: mode bits used to set permissions on this file, must be an octal value
                                                  between 0000 and 0777 or a decimal value between 0 and 511.
                                                  YAML accepts both octal and decimal values, JSON requires decimal values for mode bits.
                                                  If not specified, the volume defaultMode will be used.
                                                  This might be in conflict with other options that affect the file
                                                  mode, like fsGroup, and the result can be other mode bits set.
                                                format: int32
                                                type: integer
                                              path:
                                                description: 'Required: Path is  the relative
                                                  path name of the file to be created. Must
                                                  not be absolute or contain the ''..''
                                                  path. Must be utf-8 encoded. The first
                                                  item of the relative path must not start
                                                  with ''..'''
                                                type: string
                                              resourceFieldRef:
                                                description: |-
                                                  Selects a resource of the container: only resources limits and requests
                                                  (limits.cpu, limits.memory, requests.cpu and requests.memory) are currently supported.
                                                properties:
                                                  containerName:
                                                    description: 'Container name: required
                                                      for volumes, optional for env vars'
                                                    type: string
                                                  divisor:
                                                    anyOf:
                                                    - type: integer
                                                    - type: string
                                                    description: Specifies the output format
                                                      of the exposed resources, defaults
                                                      to "1"
                                                    pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
                                                    x-kubernetes-int-or-string: true
                                                  resource:
                                                    description: 'Required: resource to
                                                      select'
                                                    type: string
                                                required:
                                                - resource
                                                type: object
                                                x-kubernetes-map-type: atomic
                                            required:
                                            - path
                                            type: object
                                          type: array
                                          x-kubernetes-list-type: atomic
                                      type: object
                                    podCertificate:
                                      description: |-
                                        Projects an auto-rotating credential bundle (private key and certificate
                                        chain) that the pod can use either as a TLS client or server.
      
                                        Kubelet generates a private key and uses it to send a
                                        PodCertificateRequest to the named signer.  Once the signer approves the
                                        request and issues a certificate chain, Kubelet writes the key and
                                        certificate chain to the pod filesystem.  The pod does not start until
                                        certificates have been issued for each podCertificate projected volume
                                        source in its spec.
      
                                        Kubelet will begin trying to rotate the certificate at the time indicated
                                        by the signer using the PodCertificateRequest.Status.BeginRefreshAt
                                        timestamp.
      
                                        Kubelet can write a single file, indicated by the credentialBundlePath
                                        field, or separate files, indicated by the keyPath and
                                        certificateChainPath fields.
      
                                        The credential bundle is a single file in PEM format.  The first PEM
                                        entry is the private key (in PKCS#8 format), and the remaining PEM
                                        entries are the certificate chain issued by the signer (typically,
                                        signers will return their certificate chain in leaf-to-root order).
      
                                        Prefer using the credential bundle format, since your application code
                                        can read it atomically.  If you use keyPath and certificateChainPath,
                                        your application must make two separate file reads. If these coincide
                                        with a certificate rotation, it is possible that the private key and leaf
                                        certificate you read may not correspond to each other.  Your application
                                        will need to check for this condition, and re-read until they are
                                        consistent.
      
                                        The named signer controls chooses the format of the certificate it
                                        issues; consult the signer implementation's documentation to learn how to
                                        use the certificates it issues.
                                      properties:
                                        certificateChainPath:
                                          description: |-
                                            Write the certificate chain at this path in the projected volume.
      
                                            Most applications should use credentialBundlePath.  When using keyPath
                                            and certificateChainPath, your application needs to check that the key
                                            and leaf certificate are consistent, because it is possible to read the
                                            files mid-rotation.
                                          type: string
                                        credentialBundlePath:
                                          description: |-
                                            Write the credential bundle at this path in the projected volume.
      
                                            The credential bundle is a single file that contains multiple PEM blocks.
                                            The first PEM block is a PRIVATE KEY block, containing a PKCS#8 private
                                            key.
      
                                            The remaining blocks are CERTIFICATE blocks, containing the issued
                                            certificate chain from the signer (leaf and any intermediates).
      
                                            Using credentialBundlePath lets your Pod's application code make a single
                                            atomic read that retrieves a consistent key and certificate chain.  If you
                                            project them to separate files, your application code will need to
                                            additionally check that the leaf certificate was issued to the key.
                                          type: string
                                        keyPath:
                                          description: |-
                                            Write the key at this path in the projected volume.
      
                                            Most applications should use credentialBundlePath.  When using keyPath
                                            and certificateChainPath, your application needs to check that the key
                                            and leaf certificate are consistent, because it is possible to read the
                                            files mid-rotation.
                                          type: string
                                        keyType:
                                          description: |-
                                            The type of keypair Kubelet will generate for the pod.
      
                                            Valid values are "RSA3072", "RSA4096", "ECDSAP256", "ECDSAP384",
                                            "ECDSAP521", and "ED25519".
                                          type: string
                                        maxExpirationSeconds:
                                          description: |-
                                            maxExpirationSeconds is the maximum lifetime permitted for the
                                            certificate.
      
                                            Kubelet copies this value verbatim into the PodCertificateRequests it
                                            generates for this projection.
      
                                            If omitted, kube-apiserver will set it to 86400(24 hours). kube-apiserver
                                            will reject values shorter than 3600 (1 hour).  The maximum allowable
                                            value is 7862400 (91 days).
      
                                            The signer implementation is then free to issue a certificate with any
                                            lifetime *shorter* than MaxExpirationSeconds, but no shorter than 3600
                                            seconds (1 hour).  This constraint is enforced by kube-apiserver.
                                            `kubernetes.io` signers will never issue certificates with a lifetime
                                            longer than 24 hours.
                                          format: int32
                                          type: integer
                                        signerName:
                                          description: Kubelet's generated CSRs will be
                                            addressed to this signer.
                                          type: string
                                        userAnnotations:
                                          additionalProperties:
                                            type: string
                                          description: |-
                                            userAnnotations allow pod authors to pass additional information to
                                            the signer implementation.  Kubernetes does not restrict or validate this
                                            metadata in any way.
      
                                            These values are copied verbatim into the `spec.unverifiedUserAnnotations` field of
                                            the PodCertificateRequest objects that Kubelet creates.
      
                                            Entries are subject to the same validation as object metadata annotations,
                                            with the addition that all keys must be domain-prefixed. No restrictions
                                            are placed on values, except an overall size limitation on the entire field.
      
                                            Signers should document the keys and values they support. Signers should
                                            deny requests that contain keys they do not recognize.
                                          type: object
                                      required:
                                      - keyType
                                      - signerName
                                      type: object
                                    secret:
                                      description: secret information about the secret data
                                        to project
                                      properties:
                                        items:
                                          description: |-
                                            items if unspecified, each key-value pair in the Data field of the referenced
                                            Secret will be projected into the volume as a file whose name is the
                                            key and content is the value. If specified, the listed keys will be
                                            projected into the specified paths, and unlisted keys will not be
                                            present. If a key is specified which is not present in the Secret,
                                            the volume setup will error unless it is marked optional. Paths must be
                                            relative and may not contain the '..' path or start with '..'.
                                          items:
                                            description: Maps a string key to a path within
                                              a volume.
                                            properties:
                                              key:
                                                description: key is the key to project.
                                                type: string
                                              mode:
                                                description: |-
                                                  mode is Optional: mode bits used to set permissions on this file.
                                                  Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511.
                                                  YAML accepts both octal and decimal values, JSON requires decimal values for mode bits.
                                                  If not specified, the volume defaultMode will be used.
                                                  This might be in conflict with other options that affect the file
                                                  mode, like fsGroup, and the result can be other mode bits set.
                                                format: int32
                                                type: integer
                                              path:
                                                description: |-
                                                  path is the relative path of the file to map the key to.
                                                  May not be an absolute path.
                                                  May not contain the path element '..'.
                                                  May not start with the string '..'.
                                                type: string
                                            required:
                                            - key
                                            - path
                                            type: object
                                          type: array
                                          x-kubernetes-list-type: atomic
                                        name:
                                          default: ""
                                          description: |-
                                            Name of the referent.
                                            This field is effectively required, but due to backwards compatibility is
                                            allowed to be empty. Instances of this type with an empty value here are
                                            almost certainly wrong.
                                            More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                                          type: string
                                        optional:
                                          description: optional field specify whether the
                                            Secret or its key must be defined
                                          type: boolean
                                      type: object
                                      x-kubernetes-map-type: atomic
                                    serviceAccountToken:
                                      description: serviceAccountToken is information about
                                        the serviceAccountToken data to project
                                      properties:
                                        audience:
                                          description: |-
                                            audience is the intended audience of the token. A recipient of a token
                                            must identify itself with an identifier specified in the audience of the
                                            token, and otherwise should reject the token. The audience defaults to the
                                            identifier of the apiserver.
                                          type: string
                                        expirationSeconds:
                                          description: |-
                                            expirationSeconds is the requested duration of validity of the service
                                            account token. As the token approaches expiration, the kubelet volume
                                            plugin will proactively rotate the service account token. The kubelet will
                                            start trying to rotate the token if the token is older than 80 percent of
                                            its time to live or if the token is older than 24 hours.Defaults to 1 hour
                                            and must be at least 10 minutes.
                                          format: int64
                                          type: integer
                                        path:
                                          description: |-
                                            path is the path relative to the mount point of the file to project the
                                            token into.
                                          type: string
                                      required:
                                      - path
                                      type: object
                                  type: object
                                type: array
                                x-kubernetes-list-type: atomic
                            type: object
                          quobyte:
                            description: |-
                              quobyte represents a Quobyte mount on the host that shares a pod's lifetime.
                              Deprecated: Quobyte is deprecated and the in-tree quobyte type is no longer supported.
                            properties:
                              group:
                                description: |-
                                  group to map volume access to
                                  Default is no group
                                type: string
                              readOnly:
                                description: |-
                                  readOnly here will force the Quobyte volume to be mounted with read-only permissions.
                                  Defaults to false.
                                type: boolean
                              registry:
                                description: |-
                                  registry represents a single or multiple Quobyte Registry services
                                  specified as a string as host:port pair (multiple entries are separated with commas)
                                  which acts as the central registry for volumes
                                type: string
                              tenant:
                                description: |-
                                  tenant owning the given Quobyte volume in the Backend
                                  Used with dynamically provisioned Quobyte volumes, value is set by the plugin
                                type: string
                              user:
                                description: |-
                                  user to map volume access to
                                  Defaults to serivceaccount user
                                type: string
                              volume:
                                description: volume is a string that references an already
                                  created Quobyte volume by name.
                                type: string
                            required:
                            - registry
                            - volume
                            type: object
                          rbd:
                            description: |-
                              rbd represents a Rados Block Device mount on the host that shares a pod's lifetime.
                              Deprecated: RBD is deprecated and the in-tree rbd type is no longer supported.
                            properties:
                              fsType:
                                description: |-
                                  fsType is the filesystem type of the volume that you want to mount.
                                  Tip: Ensure that the filesystem type is supported by the host operating system.
                                  Examples: "ext4", "xfs", "ntfs". Implicitly inferred to be "ext4" if unspecified.
                                  More info: https://kubernetes.io/docs/concepts/storage/volumes#rbd
                                type: string
                              image:
                                description: |-
                                  image is the rados image name.
                                  More info: https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it
                                type: string
                              keyring:
                                default: /etc/ceph/keyring
                                description: |-
                                  keyring is the path to key ring for RBDUser.
                                  Default is /etc/ceph/keyring.
                                  More info: https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it
                                type: string
                              monitors:
                                description: |-
                                  monitors is a collection of Ceph monitors.
                                  More info: https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it
                                items:
                                  type: string
                                type: array
                                x-kubernetes-list-type: atomic
                              pool:
                                default: rbd
                                description: |-
                                  pool is the rados pool name.
                                  Default is rbd.
                                  More info: https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it
                                type: string
                              readOnly:
                                description: |-
                                  readOnly here will force the ReadOnly setting in VolumeMounts.
                                  Defaults to false.
                                  More info: https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it
                                type: boolean
                              secretRef:
                                description: |-
                                  secretRef is name of the authentication secret for RBDUser. If provided
                                  overrides keyring.
                                  Default is nil.
                                  More info: https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it
                                properties:
                                  name:
                                    default: ""
                                    description: |-
                                      Name of the referent.
                                      This field is effectively required, but due to backwards compatibility is
                                      allowed to be empty. Instances of this type with an empty value here are
                                      almost certainly wrong.
                                      More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                                    type: string
                                type: object
                                x-kubernetes-map-type: atomic
                              user:
                                default: admin
                                description: |-
                                  user is the rados user name.
                                  Default is admin.
                                  More info: https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it
                                type: string
                            required:
                            - image
                            - monitors
                            type: object
                          scaleIO:
                            description: |-
                              scaleIO represents a ScaleIO persistent volume attached and mounted on Kubernetes nodes.
                              Deprecated: ScaleIO is deprecated and the in-tree scaleIO type is no longer supported.
                            properties:
                              fsType:
                                default: xfs
                                description: |-
                                  fsType is the filesystem type to mount.
                                  Must be a filesystem type supported by the host operating system.
                                  Ex. "ext4", "xfs", "ntfs".
                                  Default is "xfs".
                                type: string
                              gateway:
                                description: gateway is the host address of the ScaleIO
                                  API Gateway.
                                type: string
                              protectionDomain:
                                description: protectionDomain is the name of the ScaleIO
                                  Protection Domain for the configured storage.
                                type: string
                              readOnly:
                                description: |-
                                  readOnly Defaults to false (read/write). ReadOnly here will force
                                  the ReadOnly setting in VolumeMounts.
                                type: boolean
                              secretRef:
                                description: |-
                                  secretRef references to the secret for ScaleIO user and other
                                  sensitive information. If this is not provided, Login operation will fail.
                                properties:
                                  name:
                                    default: ""
                                    description: |-
                                      Name of the referent.
                                      This field is effectively required, but due to backwards compatibility is
                                      allowed to be empty. Instances of this type with an empty value here are
                                      almost certainly wrong.
                                      More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                                    type: string
                                type: object
                                x-kubernetes-map-type: atomic
                              sslEnabled:
                                description: sslEnabled Flag enable/disable SSL communication
                                  with Gateway, default false
                                type: boolean
                              storageMode:
                                default: ThinProvisioned
                                description: |-
                                  storageMode indicates whether the storage for a volume should be ThickProvisioned or ThinProvisioned.
                                  Default is ThinProvisioned.
                                type: string
                              storagePool:
                                description: storagePool is the ScaleIO Storage Pool associated
                                  with the protection domain.
                                type: string
                              system:
                                description: system is the name of the storage system as
                                  configured in ScaleIO.
                                type: string
                              volumeName:
                                description: |-
                                  volumeName is the name of a volume already created in the ScaleIO system
                                  that is associated with this volume source.
                                type: string
                            required:
                            - gateway
                            - secretRef
                            - system
                            type: object
                          secret:
                            description: |-
                              secret represents a secret that should populate this volume.
                              More info: https://kubernetes.io/docs/concepts/storage/volumes#secret
                            properties:
                              defaultMode:
                                description: |-
                                  defaultMode is Optional: mode bits used to set permissions on created files by default.
                                  Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511.
                                  YAML accepts both octal and decimal values, JSON requires decimal values
                                  for mode bits. Defaults to 0644.
                                  Directories within the path are not affected by this setting.
                                  This might be in conflict with other options that affect the file
                                  mode, like fsGroup, and the result can be other mode bits set.
                                format: int32
                                type: integer
                              items:
                                description: |-
                                  items If unspecified, each key-value pair in the Data field of the referenced
                                  Secret will be projected into the volume as a file whose name is the
                                  key and content is the value. If specified, the listed keys will be
                                  projected into the specified paths, and unlisted keys will not be
                                  present. If a key is specified which is not present in the Secret,
                                  the volume setup will error unless it is marked optional. Paths must be
                                  relative and may not contain the '..' path or start with '..'.
                                items:
                                  description: Maps a string key to a path within a volume.
                                  properties:
                                    key:
                                      description: key is the key to project.
                                      type: string
                                    mode:
                                      description: |-
                                        mode is Optional: mode bits used to set permissions on this file.
                                        Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511.
                                        YAML accepts both octal and decimal values, JSON requires decimal values for mode bits.
                                        If not specified, the volume defaultMode will be used.
                                        This might be in conflict with other options that affect the file
                                        mode, like fsGroup, and the result can be other mode bits set.
                                      format: int32
                                      type: integer
                                    path:
                                      description: |-
                                        path is the relative path of the file to map the key to.
                                        May not be an absolute path.
                                        May not contain the path element '..'.
                                        May not start with the string '..'.
                                      type: string
                                  required:
                                  - key
                                  - path
                                  type: object
                                type: array
                                x-kubernetes-list-type: atomic
                              optional:
                                description: optional field specify whether the Secret or
                                  its keys must be defined
                                type: boolean
                              secretName:
                                description: |-
                                  secretName is the name of the secret in the pod's namespace to use.
                                  More info: https://kubernetes.io/docs/concepts/storage/volumes#secret
                                type: string
                            type: object
                          storageos:
                            description: |-
                              storageOS represents a StorageOS volume attached and mounted on Kubernetes nodes.
                              Deprecated: StorageOS is deprecated and the in-tree storageos type is no longer supported.
                            properties:
                              fsType:
                                description: |-
                                  fsType is the filesystem type to mount.
                                  Must be a filesystem type supported by the host operating system.
                                  Ex. "ext4", "xfs", "ntfs". Implicitly inferred to be "ext4" if unspecified.
                                type: string
                              readOnly:
                                description: |-
                                  readOnly defaults to false (read/write). ReadOnly here will force
                                  the ReadOnly setting in VolumeMounts.
                                type: boolean
                              secretRef:
                                description: |-
                                  secretRef specifies the secret to use for obtaining the StorageOS API
                                  credentials.  If not specified, default values will be attempted.
                                properties:
                                  name:
                                    default: ""
                                    description: |-
                                      Name of the referent.
                                      This field is effectively required, but due to backwards compatibility is
                                      allowed to be empty. Instances of this type with an empty value here are
                                      almost certainly wrong.
                                      More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                                    type: string
                                type: object
                                x-kubernetes-map-type: atomic
                              volumeName:
                                description: |-
                                  volumeName is the human-readable name of the StorageOS volume.  Volume
                                  names are only unique within a namespace.
                                type: string
                              volumeNamespace:
                                description: |-
                                  volumeNamespace specifies the scope of the volume within StorageOS.  If no
                                  namespace is specified then the Pod's namespace will be used.  This allows the
                                  Kubernetes name scoping to be mirrored within StorageOS for tighter integration.
                                  Set VolumeName to any name to override the default behaviour.
                                  Set to "default" if you are not using namespaces within StorageOS.
                                  Namespaces that do not pre-exist within StorageOS will be created.
                                type: string
                            type: object
                          vsphereVolume:
                            description: |-
                              vsphereVolume represents a vSphere volume attached and mounted on kubelets host machine.
                              Deprecated: VsphereVolume is deprecated. All operations for the in-tree vsphereVolume type
                              are redirected to the csi.vsphere.vmware.com CSI driver.
                            properties:
                              fsType:
                                description: |-
                                  fsType is filesystem type to mount.
                                  Must be a filesystem type supported by the host operating system.
                                  Ex. "ext4", "xfs", "ntfs". Implicitly inferred to be "ext4" if unspecified.
                                type: string
                              storagePolicyID:
                                description: storagePolicyID is the storage Policy Based
                                  Management (SPBM) profile ID associated with the StoragePolicyName.
                                type: string
                              storagePolicyName:
                                description: storagePolicyName is the storage Policy Based
                                  Management (SPBM) profile name.
                                type: string
                              volumePath:
                                description: volumePath is the path that identifies vSphere
                                  volume vmdk
                                type: string
                            required:
                            - volumePath
                            type: object
                        required:
                        - name
                        type: object
                      type: array
                    githubAppReference:
                      description: |-
                        Reference to a Github App for authentication, this will automatically mount a secret with
                        RENOVATE_TOKEN
                      properties:
                        appIdSecretKey:
                          type: string
                        installationIdSecretKey:
                          type: string
                        pemSecretKey:
                          type: string
                        secretName:
                          type: string
                      required:
                      - appIdSecretKey
                      - installationIdSecretKey
                      - pemSecretKey
                      - secretName
                      type: object
                    image:
                      description: Renovate Docker image to use
                      type: string
                    imagePullSecrets:
                      description: Image pull secrets for the renovate pods
                      items:
                        description: |-
                          LocalObjectReference contains enough information to let you locate the
                          referenced object inside the same namespace.
                        properties:
                          name:
                            default: ""
                            description: |-
                              Name of the referent.
                              This field is effectively required, but due to backwards compatibility is
                              allowed to be empty. Instances of this type with an empty value here are
                              almost certainly wrong.
                              More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                            type: string
                        type: object
                        x-kubernetes-map-type: atomic
                      type: array
                    metadata:
                      description: Metadata that shall be applied to the resulting pod
                      properties:
                        annotations:
                          additionalProperties:
                            type: string
                          type: object
                        labels:
                          additionalProperties:
                            type: string
                          type: object
                      type: object
                    nodeSelector:
                      additionalProperties:
                        type: string
                      description: Node selector for scheduling the resulting pod
                      type: object
                    parallelism:
                      description: Maximum number of projects to process in parallel
                      format: int32
                      type: integer
                    provider:
                      description: Renovate Provider Information to fill "RENOVATE_ENDPOINT"
                        and "RENOVATE_PLATFORM" environment variables in the renovate container
                      properties:
                        endpoint:
                          type: string
                        name:
                          type: string
                      required:
                      - name
                      type: object
                    resources:
                      description: Resource requirements for the renovate container
                      properties:
                        claims:
                          description: |-
                            Claims lists the names of resources, defined in spec.resourceClaims,
                            that are used by this container.
      
                            This field depends on the
                            DynamicResourceAllocation feature gate.
      
                            This field is immutable. It can only be set for containers.
                          items:
                            description: ResourceClaim references one entry in PodSpec.ResourceClaims.
                            properties:
                              name:
                                description: |-
                                  Name must match the name of one entry in pod.spec.resourceClaims of
                                  the Pod where this field is used. It makes that resource available
                                  inside a container.
                                type: string
                              request:
                                description: |-
                                  Request is the name chosen for a request in the referenced claim.
                                  If empty, everything from the claim is made available, otherwise
                                  only the result of this request.
                                type: string
                            required:
                            - name
                            type: object
                          type: array
                          x-kubernetes-list-map-keys:
                          - name
                          x-kubernetes-list-type: map
                        limits:
                          additionalProperties:
                            anyOf:
                            - type: integer
                            - type: string
                            pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
                            x-kubernetes-int-or-string: true
                          description: |-
                            Limits describes the maximum amount of compute resources allowed.
                            More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
                          type: object
                        requests:
                          additionalProperties:
                            anyOf:
                            - type: integer
                            - type: string
                            pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
                            x-kubernetes-int-or-string: true
                          description: |-
                            Requests describes the minimum amount of compute resources required.
                            If Requests is omitted for a container, it defaults to Limits if that is explicitly specified,
                            otherwise to an implementation-defined value. Requests cannot exceed Limits.
                            More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
                          type: object
                      type: object
                    runtimeClassName:
                      description: RuntimeClassName for the resulting pod, used to select
                        a non-default container runtime
                      type: string
                    schedule:
                      description: Cron schedule in standard cron format
                      type: string
                    scratchVolume:
                      description: Configuration for the scratch volume
                      properties:
                        enabled:
                          default: true
                          description: If enabled a scratch volume will be created and RENOVATE_BASE_DIR
                            will be set accordingly
                          type: boolean
                        ephemeral:
                          description: |-
                            Ephemeral uses a Kubernetes generic ephemeral volume for scratch (volume.ephemeral).
                            When set, Medium and SizeLimit are ignored.
                          properties:
                            volumeClaimTemplate:
                              description: |-
                                Will be used to create a stand-alone PVC to provision the volume.
                                The pod in which this EphemeralVolumeSource is embedded will be the
                                owner of the PVC, i.e. the PVC will be deleted together with the
                                pod.  The name of the PVC will be `<pod name>-<volume name>` where
                                `<volume name>` is the name from the `PodSpec.Volumes` array
                                entry. Pod validation will reject the pod if the concatenated name
                                is not valid for a PVC (for example, too long).
      
                                An existing PVC with that name that is not owned by the pod
                                will *not* be used for the pod to avoid using an unrelated
                                volume by mistake. Starting the pod is then blocked until
                                the unrelated PVC is removed. If such a pre-created PVC is
                                meant to be used by the pod, the PVC has to updated with an
                                owner reference to the pod once the pod exists. Normally
                                this should not be necessary, but it may be useful when
                                manually reconstructing a broken cluster.
      
                                This field is read-only and no changes will be made by Kubernetes
                                to the PVC after it has been created.
      
                                Required, must not be nil.
                              properties:
                                metadata:
                                  description: |-
                                    May contain labels and annotations that will be copied into the PVC
                                    when creating it. No other fields are allowed and will be rejected during
                                    validation.
                                  type: object
                                spec:
                                  description: |-
                                    The specification for the PersistentVolumeClaim. The entire content is
                                    copied unchanged into the PVC that gets created from this
                                    template. The same fields as in a PersistentVolumeClaim
                                    are also valid here.
                                  properties:
                                    accessModes:
                                      description: |-
                                        accessModes contains the desired access modes the volume should have.
                                        More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#access-modes-1
                                      items:
                                        type: string
                                      type: array
                                      x-kubernetes-list-type: atomic
                                    dataSource:
                                      description: |-
                                        dataSource field can be used to specify either:
                                        * An existing VolumeSnapshot object (snapshot.storage.k8s.io/VolumeSnapshot)
                                        * An existing PVC (PersistentVolumeClaim)
                                        If the provisioner or an external controller can support the specified data source,
                                        it will create a new volume based on the contents of the specified data source.
                                        When the AnyVolumeDataSource feature gate is enabled, dataSource contents will be copied to dataSourceRef,
                                        and dataSourceRef contents will be copied to dataSource when dataSourceRef.namespace is not specified.
                                        If the namespace is specified, then dataSourceRef will not be copied to dataSource.
                                      properties:
                                        apiGroup:
                                          description: |-
                                            APIGroup is the group for the resource being referenced.
                                            If APIGroup is not specified, the specified Kind must be in the core API group.
                                            For any other third-party types, APIGroup is required.
                                          type: string
                                        kind:
                                          description: Kind is the type of resource being
                                            referenced
                                          type: string
                                        name:
                                          description: Name is the name of resource being
                                            referenced
                                          type: string
                                      required:
                                      - kind
                                      - name
                                      type: object
                                      x-kubernetes-map-type: atomic
                                    dataSourceRef:
                                      description: |-
                                        dataSourceRef specifies the object from which to populate the volume with data, if a non-empty
                                        volume is desired. This may be any object from a non-empty API group (non
                                        core object) or a PersistentVolumeClaim object.
                                        When this field is specified, volume binding will only succeed if the type of
                                        the specified object matches some installed volume populator or dynamic
                                        provisioner.
                                        This field will replace the functionality of the dataSource field and as such
                                        if both fields are non-empty, they must have the same value. For backwards
                                        compatibility, when namespace isn't specified in dataSourceRef,
                                        both fields (dataSource and dataSourceRef) will be set to the same
                                        value automatically if one of them is empty and the other is non-empty.
                                        When namespace is specified in dataSourceRef,
                                        dataSource isn't set to the same value and must be empty.
                                        There are three important differences between dataSource and dataSourceRef:
                                        * While dataSource only allows two specific types of objects, dataSourceRef
                                          allows any non-core object, as well as PersistentVolumeClaim objects.
                                        * While dataSource ignores disallowed values (dropping them), dataSourceRef
                                          preserves all values, and generates an error if a disallowed value is
                                          specified.
                                        * While dataSource only allows local objects, dataSourceRef allows objects
                                          in any namespaces.
                                        (Beta) Using this field requires the AnyVolumeDataSource feature gate to be enabled.
                                        (Alpha) Using the namespace field of dataSourceRef requires the CrossNamespaceVolumeDataSource feature gate to be enabled.
                                      properties:
                                        apiGroup:
                                          description: |-
                                            APIGroup is the group for the resource being referenced.
                                            If APIGroup is not specified, the specified Kind must be in the core API group.
                                            For any other third-party types, APIGroup is required.
                                          type: string
                                        kind:
                                          description: Kind is the type of resource being
                                            referenced
                                          type: string
                                        name:
                                          description: Name is the name of resource being
                                            referenced
                                          type: string
                                        namespace:
                                          description: |-
                                            Namespace is the namespace of resource being referenced
                                            Note that when a namespace is specified, a gateway.networking.k8s.io/ReferenceGrant object is required in the referent namespace to allow that namespace's owner to accept the reference. See the ReferenceGrant documentation for details.
                                            (Alpha) This field requires the CrossNamespaceVolumeDataSource feature gate to be enabled.
                                          type: string
                                      required:
                                      - kind
                                      - name
                                      type: object
                                    resources:
                                      description: |-
                                        resources represents the minimum resources the volume should have.
                                        Users are allowed to specify resource requirements
                                        that are lower than previous value but must still be higher than capacity recorded in the
                                        status field of the claim.
                                        More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#resources
                                      properties:
                                        limits:
                                          additionalProperties:
                                            anyOf:
                                            - type: integer
                                            - type: string
                                            pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
                                            x-kubernetes-int-or-string: true
                                          description: |-
                                            Limits describes the maximum amount of compute resources allowed.
                                            More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
                                          type: object
                                        requests:
                                          additionalProperties:
                                            anyOf:
                                            - type: integer
                                            - type: string
                                            pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
                                            x-kubernetes-int-or-string: true
                                          description: |-
                                            Requests describes the minimum amount of compute resources required.
                                            If Requests is omitted for a container, it defaults to Limits if that is explicitly specified,
                                            otherwise to an implementation-defined value. Requests cannot exceed Limits.
                                            More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
                                          type: object
                                      type: object
                                    selector:
                                      description: selector is a label query over volumes
                                        to consider for binding.
                                      properties:
                                        matchExpressions:
                                          description: matchExpressions is a list of label
                                            selector requirements. The requirements are
                                            ANDed.
                                          items:
                                            description: |-
                                              A label selector requirement is a selector that contains values, a key, and an operator that
                                              relates the key and values.
                                            properties:
                                              key:
                                                description: key is the label key that the
                                                  selector applies to.
                                                type: string
                                              operator:
                                                description: |-
                                                  operator represents a key's relationship to a set of values.
                                                  Valid operators are In, NotIn, Exists and DoesNotExist.
                                                type: string
                                              values:
                                                description: |-
                                                  values is an array of string values. If the operator is In or NotIn,
                                                  the values array must be non-empty. If the operator is Exists or DoesNotExist,
                                                  the values array must be empty. This array is replaced during a strategic
                                                  merge patch.
                                                items:
                                                  type: string
                                                type: array
                                                x-kubernetes-list-type: atomic
                                            required:
                                            - key
                                            - operator
                                            type: object
                                          type: array
                                          x-kubernetes-list-type: atomic
                                        matchLabels:
                                          additionalProperties:
                                            type: string
                                          description: |-
                                            matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
                                            map is equivalent to an element of matchExpressions, whose key field is "key", the
                                            operator is "In", and the values array contains only "value". The requirements are ANDed.
                                          type: object
                                      type: object
                                      x-kubernetes-map-type: atomic
                                    storageClassName:
                                      description: |-
                                        storageClassName is the name of the StorageClass required by the claim.
                                        More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#class-1
                                      type: string
                                    volumeAttributesClassName:
                                      description: |-
                                        volumeAttributesClassName may be used to set the VolumeAttributesClass used by this claim.
                                        If specified, the CSI driver will create or update the volume with the attributes defined
                                        in the corresponding VolumeAttributesClass. This has a different purpose than storageClassName,
                                        it can be changed after the claim is created. An empty string or nil value indicates that no
                                        VolumeAttributesClass will be applied to the claim. If the claim enters an Infeasible error state,
                                        this field can be reset to its previous value (including nil) to cancel the modification.
                                        If the resource referred to by volumeAttributesClass does not exist, this PersistentVolumeClaim will be
                                        set to a Pending state, as reflected by the modifyVolumeStatus field, until such as a resource
                                        exists.
                                        More info: https://kubernetes.io/docs/concepts/storage/volume-attributes-classes/
                                      type: string
                                    volumeMode:
                                      description: |-
                                        volumeMode defines what type of volume is required by the claim.
                                        Value of Filesystem is implied when not included in claim spec.
                                      type: string
                                    volumeName:
                                      description: volumeName is the binding reference to
                                        the PersistentVolume backing this claim.
                                      type: string
                                  type: object
                              required:
                              - spec
                              type: object
                          type: object
                        medium:
                          description: |-
                            Medium for the emptyDir volume. Ignored when Ephemeral is set.
                            Empty uses the node's default medium; Memory uses a tmpfs (corev1.StorageMediumMemory).
                          type: string
                        path:
                          default: /tmp
                          description: Path within the container where the scratch volume
                            will be mounted, RENOVATE_BASE_DIR will be set to this path.
                          type: string
                        sizeLimit:
                          anyOf:
                          - type: integer
                          - type: string
                          description: SizeLimit caps how large the emptyDir may grow (Kubernetes
                            emptyDir.sizeLimit). Ignored when Ephemeral is set.
                          pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
                          x-kubernetes-int-or-string: true
                      type: object
                    secretRef:
                      description: Reference to the secret containing the renovate config
                      type: string
                    securityContext:
                      description: Security context for the resulting pod and container
                      properties:
                        container:
                          description: |-
                            SecurityContext holds security configuration that will be applied to a container.
                            Some fields are present in both SecurityContext and PodSecurityContext.  When both
                            are set, the values in SecurityContext take precedence.
                          properties:
                            allowPrivilegeEscalation:
                              description: |-
                                AllowPrivilegeEscalation controls whether a process can gain more
                                privileges than its parent process. This bool directly controls if
                                the no_new_privs flag will be set on the container process.
                                AllowPrivilegeEscalation is true always when the container is:
                                1) run as Privileged
                                2) has CAP_SYS_ADMIN
                                Note that this field cannot be set when spec.os.name is windows.
                              type: boolean
                            appArmorProfile:
                              description: |-
                                appArmorProfile is the AppArmor options to use by this container. If set, this profile
                                overrides the pod's appArmorProfile.
                                Note that this field cannot be set when spec.os.name is windows.
                              properties:
                                localhostProfile:
                                  description: |-
                                    localhostProfile indicates a profile loaded on the node that should be used.
                                    The profile must be preconfigured on the node to work.
                                    Must match the loaded name of the profile.
                                    Must be set if and only if type is "Localhost".
                                  type: string
                                type:
                                  description: |-
                                    type indicates which kind of AppArmor profile will be applied.
                                    Valid options are:
                                      Localhost - a profile pre-loaded on the node.
                                      RuntimeDefault - the container runtime's default profile.
                                      Unconfined - no AppArmor enforcement.
                                  type: string
                              required:
                              - type
                              type: object
                            capabilities:
                              description: |-
                                The capabilities to add/drop when running containers.
                                Defaults to the default set of capabilities granted by the container runtime.
                                Note that this field cannot be set when spec.os.name is windows.
                              properties:
                                add:
                                  description: Added capabilities
                                  items:
                                    description: Capability represent POSIX capabilities
                                      type
                                    type: string
                                  type: array
                                  x-kubernetes-list-type: atomic
                                drop:
                                  description: Removed capabilities
                                  items:
                                    description: Capability represent POSIX capabilities
                                      type
                                    type: string
                                  type: array
                                  x-kubernetes-list-type: atomic
                              type: object
                            privileged:
                              description: |-
                                Run container in privileged mode.
                                Processes in privileged containers are essentially equivalent to root on the host.
                                Defaults to false.
                                Note that this field cannot be set when spec.os.name is windows.
                              type: boolean
                            procMount:
                              description: |-
                                procMount denotes the type of proc mount to use for the containers.
                                The default value is Default which uses the container runtime defaults for
                                readonly paths and masked paths.
                                Note that this field cannot be set when spec.os.name is windows.
                              type: string
                            readOnlyRootFilesystem:
                              description: |-
                                Whether this container has a read-only root filesystem.
                                Default is false.
                                Note that this field cannot be set when spec.os.name is windows.
                              type: boolean
                            runAsGroup:
                              description: |-
                                The GID to run the entrypoint of the container process.
                                Uses runtime default if unset.
                                May also be set in PodSecurityContext.  If set in both SecurityContext and
                                PodSecurityContext, the value specified in SecurityContext takes precedence.
                                Note that this field cannot be set when spec.os.name is windows.
                              format: int64
                              type: integer
                            runAsNonRoot:
                              description: |-
                                Indicates that the container must run as a non-root user.
                                If true, the Kubelet will validate the image at runtime to ensure that it
                                does not run as UID 0 (root) and fail to start the container if it does.
                                If unset or false, no such validation will be performed.
                                May also be set in PodSecurityContext.  If set in both SecurityContext and
                                PodSecurityContext, the value specified in SecurityContext takes precedence.
                              type: boolean
                            runAsUser:
                              description: |-
                                The UID to run the entrypoint of the container process.
                                Defaults to user specified in image metadata if unspecified.
                                May also be set in PodSecurityContext.  If set in both SecurityContext and
                                PodSecurityContext, the value specified in SecurityContext takes precedence.
                                Note that this field cannot be set when spec.os.name is windows.
                              format: int64
                              type: integer
                            seLinuxOptions:
                              description: |-
                                The SELinux context to be applied to the container.
                                If unspecified, the container runtime will allocate a random SELinux context for each
                                container.  May also be set in PodSecurityContext.  If set in both SecurityContext and
                                PodSecurityContext, the value specified in SecurityContext takes precedence.
                                Note that this field cannot be set when spec.os.name is windows.
                              properties:
                                level:
                                  description: Level is SELinux level label that applies
                                    to the container.
                                  type: string
                                role:
                                  description: Role is a SELinux role label that applies
                                    to the container.
                                  type: string
                                type:
                                  description: Type is a SELinux type label that applies
                                    to the container.
                                  type: string
                                user:
                                  description: User is a SELinux user label that applies
                                    to the container.
                                  type: string
                              type: object
                            seccompProfile:
                              description: |-
                                The seccomp options to use by this container. If seccomp options are
                                provided at both the pod & container level, the container options
                                override the pod options.
                                Note that this field cannot be set when spec.os.name is windows.
                              properties:
                                localhostProfile:
                                  description: |-
                                    localhostProfile indicates a profile defined in a file on the node should be used.
                                    The profile must be preconfigured on the node to work.
                                    Must be a descending path, relative to the kubelet's configured seccomp profile location.
                                    Must be set if type is "Localhost". Must NOT be set for any other type.
                                  type: string
                                type:
                                  description: |-
                                    type indicates which kind of seccomp profile will be applied.
                                    Valid options are:
      
                                    Localhost - a profile defined in a file on the node should be used.
                                    RuntimeDefault - the container runtime default profile should be used.
                                    Unconfined - no profile should be applied.
                                  type: string
                              required:
                              - type
                              type: object
                            windowsOptions:
                              description: |-
                                The Windows specific settings applied to all containers.
                                If unspecified, the options from the PodSecurityContext will be used.
                                If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence.
                                Note that this field cannot be set when spec.os.name is linux.
                              properties:
                                gmsaCredentialSpec:
                                  description: |-
                                    GMSACredentialSpec is where the GMSA admission webhook
                                    (https://github.com/kubernetes-sigs/windows-gmsa) inlines the contents of the
                                    GMSA credential spec named by the GMSACredentialSpecName field.
                                  type: string
                                gmsaCredentialSpecName:
                                  description: GMSACredentialSpecName is the name of the
                                    GMSA credential spec to use.
                                  type: string
                                hostProcess:
                                  description: |-
                                    HostProcess determines if a container should be run as a 'Host Process' container.
                                    All of a Pod's containers must have the same effective HostProcess value
                                    (it is not allowed to have a mix of HostProcess containers and non-HostProcess containers).
                                    In addition, if HostProcess is true then HostNetwork must also be set to true.
                                  type: boolean
                                runAsUserName:
                                  description: |-
                                    The UserName in Windows to run the entrypoint of the container process.
                                    Defaults to the user specified in image metadata if unspecified.
                                    May also be set in PodSecurityContext. If set in both SecurityContext and
                                    PodSecurityContext, the value specified in SecurityContext takes precedence.
                                  type: string
                              type: object
                          type: object
                        pod:
                          description: |-
                            PodSecurityContext holds pod-level security attributes and common container settings.
                            Some fields are also present in container.securityContext.  Field values of
                            container.securityContext take precedence over field values of PodSecurityContext.
                          properties:
                            appArmorProfile:
                              description: |-
                                appArmorProfile is the AppArmor options to use by the containers in this pod.
                                Note that this field cannot be set when spec.os.name is windows.
                              properties:
                                localhostProfile:
                                  description: |-
                                    localhostProfile indicates a profile loaded on the node that should be used.
                                    The profile must be preconfigured on the node to work.
                                    Must match the loaded name of the profile.
                                    Must be set if and only if type is "Localhost".
                                  type: string
                                type:
                                  description: |-
                                    type indicates which kind of AppArmor profile will be applied.
                                    Valid options are:
                                      Localhost - a profile pre-loaded on the node.
                                      RuntimeDefault - the container runtime's default profile.
                                      Unconfined - no AppArmor enforcement.
                                  type: string
                              required:
                              - type
                              type: object
                            fsGroup:
                              description: |-
                                A special supplemental group that applies to all containers in a pod.
                                Some volume types allow the Kubelet to change the ownership of that volume
                                to be owned by the pod:
      
                                1. The owning GID will be the FSGroup
                                2. The setgid bit is set (new files created in the volume will be owned by FSGroup)
                                3. The permission bits are OR'd with rw-rw----
      
                                If unset, the Kubelet will not modify the ownership and permissions of any volume.
                                Note that this field cannot be set when spec.os.name is windows.
                              format: int64
                              type: integer
                            fsGroupChangePolicy:
                              description: |-
                                fsGroupChangePolicy defines behavior of changing ownership and permission of the volume
                                before being exposed inside Pod. This field will only apply to
                                volume types which support fsGroup based ownership(and permissions).
                                It will have no effect on ephemeral volume types such as: secret, configmaps
                                and emptydir.
                                Valid values are "OnRootMismatch" and "Always". If not specified, "Always" is used.
                                Note that this field cannot be set when spec.os.name is windows.
                              type: string
                            runAsGroup:
                              description: |-
                                The GID to run the entrypoint of the container process.
                                Uses runtime default if unset.
                                May also be set in SecurityContext.  If set in both SecurityContext and
                                PodSecurityContext, the value specified in SecurityContext takes precedence
                                for that container.
                                Note that this field cannot be set when spec.os.name is windows.
                              format: int64
                              type: integer
                            runAsNonRoot:
                              description: |-
                                Indicates that the container must run as a non-root user.
                                If true, the Kubelet will validate the image at runtime to ensure that it
                                does not run as UID 0 (root) and fail to start the container if it does.
                                If unset or false, no such validation will be performed.
                                May also be set in SecurityContext.  If set in both SecurityContext and
                                PodSecurityContext, the value specified in SecurityContext takes precedence.
                              type: boolean
                            runAsUser:
                              description: |-
                                The UID to run the entrypoint of the container process.
                                Defaults to user specified in image metadata if unspecified.
                                May also be set in SecurityContext.  If set in both SecurityContext and
                                PodSecurityContext, the value specified in SecurityContext takes precedence
                                for that container.
                                Note that this field cannot be set when spec.os.name is windows.
                              format: int64
                              type: integer
                            seLinuxChangePolicy:
                              description: |-
                                seLinuxChangePolicy defines how the container's SELinux label is applied to all volumes used by the Pod.
                                It has no effect on nodes that do not support SELinux or to volumes does not support SELinux.
                                Valid values are "MountOption" and "Recursive".
      
                                "Recursive" means relabeling of all files on all Pod volumes by the container runtime.
                                This may be slow for large volumes, but allows mixing privileged and unprivileged Pods sharing the same volume on the same node.
      
                                "MountOption" mounts all eligible Pod volumes with `-o context` mount option.
                                This requires all Pods that share the same volume to use the same SELinux label.
                                It is not possible to share the same volume among privileged and unprivileged Pods.
                                Eligible volumes are in-tree FibreChannel and iSCSI volumes, and all CSI volumes
                                whose CSI driver announces SELinux support by setting spec.seLinuxMount: true in their
                                CSIDriver instance. Other volumes are always re-labelled recursively.
                                "MountOption" value is allowed only when SELinuxMount feature gate is enabled.
      
                                If not specified and SELinuxMount feature gate is enabled, "MountOption" is used.
                                If not specified and SELinuxMount feature gate is disabled, "MountOption" is used for ReadWriteOncePod volumes
                                and "Recursive" for all other volumes.
      
                                This field affects only Pods that have SELinux label set, either in PodSecurityContext or in SecurityContext of all containers.
      
                                All Pods that use the same volume should use the same seLinuxChangePolicy, otherwise some pods can get stuck in ContainerCreating state.
                                Note that this field cannot be set when spec.os.name is windows.
                              type: string
                            seLinuxOptions:
                              description: |-
                                The SELinux context to be applied to all containers.
                                If unspecified, the container runtime will allocate a random SELinux context for each
                                container.  May also be set in SecurityContext.  If set in
                                both SecurityContext and PodSecurityContext, the value specified in SecurityContext
                                takes precedence for that container.
                                Note that this field cannot be set when spec.os.name is windows.
                              properties:
                                level:
                                  description: Level is SELinux level label that applies
                                    to the container.
                                  type: string
                                role:
                                  description: Role is a SELinux role label that applies
                                    to the container.
                                  type: string
                                type:
                                  description: Type is a SELinux type label that applies
                                    to the container.
                                  type: string
                                user:
                                  description: User is a SELinux user label that applies
                                    to the container.
                                  type: string
                              type: object
                            seccompProfile:
                              description: |-
                                The seccomp options to use by the containers in this pod.
                                Note that this field cannot be set when spec.os.name is windows.
                              properties:
                                localhostProfile:
                                  description: |-
                                    localhostProfile indicates a profile defined in a file on the node should be used.
                                    The profile must be preconfigured on the node to work.
                                    Must be a descending path, relative to the kubelet's configured seccomp profile location.
                                    Must be set if type is "Localhost". Must NOT be set for any other type.
                                  type: string
                                type:
                                  description: |-
                                    type indicates which kind of seccomp profile will be applied.
                                    Valid options are:
      
                                    Localhost - a profile defined in a file on the node should be used.
                                    RuntimeDefault - the container runtime default profile should be used.
                                    Unconfined - no profile should be applied.
                                  type: string
                              required:
                              - type
                              type: object
                            supplementalGroups:
                              description: |-
                                A list of groups applied to the first process run in each container, in
                                addition to the container's primary GID and fsGroup (if specified).  If
                                the SupplementalGroupsPolicy feature is enabled, the
                                supplementalGroupsPolicy field determines whether these are in addition
                                to or instead of any group memberships defined in the container image.
                                If unspecified, no additional groups are added, though group memberships
                                defined in the container image may still be used, depending on the
                                supplementalGroupsPolicy field.
                                Note that this field cannot be set when spec.os.name is windows.
                              items:
                                format: int64
                                type: integer
                              type: array
                              x-kubernetes-list-type: atomic
                            supplementalGroupsPolicy:
                              description: |-
                                Defines how supplemental groups of the first container processes are calculated.
                                Valid values are "Merge" and "Strict". If not specified, "Merge" is used.
                                (Alpha) Using the field requires the SupplementalGroupsPolicy feature gate to be enabled
                                and the container runtime must implement support for this feature.
                                Note that this field cannot be set when spec.os.name is windows.
                              type: string
                            sysctls:
                              description: |-
                                Sysctls hold a list of namespaced sysctls used for the pod. Pods with unsupported
                                sysctls (by the container runtime) might fail to launch.
                                Note that this field cannot be set when spec.os.name is windows.
                              items:
                                description: Sysctl defines a kernel parameter to be set
                                properties:
                                  name:
                                    description: Name of a property to set
                                    type: string
                                  value:
                                    description: Value of a property to set
                                    type: string
                                required:
                                - name
                                - value
                                type: object
                              type: array
                              x-kubernetes-list-type: atomic
                            windowsOptions:
                              description: |-
                                The Windows specific settings applied to all containers.
                                If unspecified, the options within a container's SecurityContext will be used.
                                If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence.
                                Note that this field cannot be set when spec.os.name is linux.
                              properties:
                                gmsaCredentialSpec:
                                  description: |-
                                    GMSACredentialSpec is where the GMSA admission webhook
                                    (https://github.com/kubernetes-sigs/windows-gmsa) inlines the contents of the
                                    GMSA credential spec named by the GMSACredentialSpecName field.
                                  type: string
                                gmsaCredentialSpecName:
                                  description: GMSACredentialSpecName is the name of the
                                    GMSA credential spec to use.
                                  type: string
                                hostProcess:
                                  description: |-
                                    HostProcess determines if a container should be run as a 'Host Process' container.
                                    All of a Pod's containers must have the same effective HostProcess value
                                    (it is not allowed to have a mix of HostProcess containers and non-HostProcess containers).
                                    In addition, if HostProcess is true then HostNetwork must also be set to true.
                                  type: boolean
                                runAsUserName:
                                  description: |-
                                    The UserName in Windows to run the entrypoint of the container process.
                                    Defaults to the user specified in image metadata if unspecified.
                                    May also be set in PodSecurityContext. If set in both SecurityContext and
                                    PodSecurityContext, the value specified in SecurityContext takes precedence.
                                  type: string
                              type: object
                          type: object
                      type: object
                    serviceAccount:
                      description: Settings for the serviceaccount the renovate pod should
                        use
                      properties:
                        automountServiceAccountToken:
                          type: boolean
                        name:
                          type: string
                      type: object
                    skipForks:
                      description: If true, forked repositories discovered during autodiscovery
                        will be excluded by querying the platform API
                      type: boolean
                    skipPendingDeletion:
                      description: If true, repositories marked for delayed deletion (pending
                        deletion) will be excluded by querying the platform API. Only GitLab
                        exposes this state.
                      type: boolean
                    tolerations:
                      description: Tolerations for scheduling the resulting pod
                      items:
                        description: |-
                          The pod this Toleration is attached to tolerates any taint that matches
                          the triple <key,value,effect> using the matching operator <operator>.
                        properties:
                          effect:
                            description: |-
                              Effect indicates the taint effect to match. Empty means match all taint effects.
                              When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute.
                            type: string
                          key:
                            description: |-
                              Key is the taint key that the toleration applies to. Empty means match all taint keys.
                              If the key is empty, operator must be Exists; this combination means to match all values and all keys.
                            type: string
                          operator:
                            description: |-
                              Operator represents a key's relationship to the value.
                              Valid operators are Exists, Equal, Lt, and Gt. Defaults to Equal.
                              Exists is equivalent to wildcard for value, so that a pod can
                              tolerate all taints of a particular category.
                              Lt and Gt perform numeric comparisons (requires feature gate TaintTolerationComparisonOperators).
                            type: string
                          tolerationSeconds:
                            description: |-
                              TolerationSeconds represents the period of time the toleration (which must be
                              of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default,
                              it is not set, which means tolerate the taint forever (do not evict). Zero and
                              negative values will be treated as 0 (evict immediately) by the system.
                            format: int64
                            type: integer
                          value:
                            description: |-
                              Value is the taint value the toleration matches to.
                              If the operator is Exists, the value should be empty, otherwise just a regular string.
                            type: string
                        type: object
                      type: array
                    topologySpreadConstraints:
                      description: Topology spread constraints for scheduling the resulting
                        pod
                      items:
                        description: TopologySpreadConstraint specifies how to spread matching
                          pods among the given topology.
                        properties:
                          labelSelector:
                            description: |-
                              LabelSelector is used to find matching pods.
                              Pods that match this label selector are counted to determine the number of pods
                              in their corresponding topology domain.
                            properties:
                              matchExpressions:
                                description: matchExpressions is a list of label selector
                                  requirements. The requirements are ANDed.
                                items:
                                  description: |-
                                    A label selector requirement is a selector that contains values, a key, and an operator that
                                    relates the key and values.
                                  properties:
                                    key:
                                      description: key is the label key that the selector
                                        applies to.
                                      type: string
                                    operator:
                                      description: |-
                                        operator represents a key's relationship to a set of values.
                                        Valid operators are In, NotIn, Exists and DoesNotExist.
                                      type: string
                                    values:
                                      description: |-
                                        values is an array of string values. If the operator is In or NotIn,
                                        the values array must be non-empty. If the operator is Exists or DoesNotExist,
                                        the values array must be empty. This array is replaced during a strategic
                                        merge patch.
                                      items:
                                        type: string
                                      type: array
                                      x-kubernetes-list-type: atomic
                                  required:
                                  - key
                                  - operator
                                  type: object
                                type: array
                                x-kubernetes-list-type: atomic
                              matchLabels:
                                additionalProperties:
                                  type: string
                                description: |-
                                  matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
                                  map is equivalent to an element of matchExpressions, whose key field is "key", the
                                  operator is "In", and the values array contains only "value". The requirements are ANDed.
                                type: object
                            type: object
                            x-kubernetes-map-type: atomic
                          matchLabelKeys:
                            description: |-
                              MatchLabelKeys is a set of pod label keys to select the pods over which
                              spreading will be calculated. The keys are used to lookup values from the
                              incoming pod labels, those key-value labels are ANDed with labelSelector
                              to select the group of existing pods over which spreading will be calculated
                              for the incoming pod. The same key is forbidden to exist in both MatchLabelKeys and LabelSelector.
                              MatchLabelKeys cannot be set when LabelSelector isn't set.
                              Keys that don't exist in the incoming pod labels will
                              be ignored. A null or empty list means only match against labelSelector.
      
                              This is a beta field and requires the MatchLabelKeysInPodTopologySpread feature gate to be enabled (enabled by default).
                            items:
                              type: string
                            type: array
                            x-kubernetes-list-type: atomic
                          maxSkew:
                            description: |-
                              MaxSkew describes the degree to which pods may be unevenly distributed.
                              When `whenUnsatisfiable=DoNotSchedule`, it is the maximum permitted difference
                              between the number of matching pods in the target topology and the global minimum.
                              The global minimum is the minimum number of matching pods in an eligible domain
                              or zero if the number of eligible domains is less than MinDomains.
                              For example, in a 3-zone cluster, MaxSkew is set to 1, and pods with the same
                              labelSelector spread as 2/2/1:
                              In this case, the global minimum is 1.
                              | zone1 | zone2 | zone3 |
                              |  P P  |  P P  |   P   |
                              - if MaxSkew is 1, incoming pod can only be scheduled to zone3 to become 2/2/2;
                              scheduling it onto zone1(zone2) would make the ActualSkew(3-1) on zone1(zone2)
                              violate MaxSkew(1).
                              - if MaxSkew is 2, incoming pod can be scheduled onto any zone.
                              When `whenUnsatisfiable=ScheduleAnyway`, it is used to give higher precedence
                              to topologies that satisfy it.
                              It's a required field. Default value is 1 and 0 is not allowed.
                            format: int32
                            type: integer
                          minDomains:
                            description: |-
                              MinDomains indicates a minimum number of eligible domains.
                              When the number of eligible domains with matching topology keys is less than minDomains,
                              Pod Topology Spread treats "global minimum" as 0, and then the calculation of Skew is performed.
                              And when the number of eligible domains with matching topology keys equals or greater than minDomains,
                              this value has no effect on scheduling.
                              As a result, when the number of eligible domains is less than minDomains,
                              scheduler won't schedule more than maxSkew Pods to those domains.
                              If value is nil, the constraint behaves as if MinDomains is equal to 1.
                              Valid values are integers greater than 0.
                              When value is not nil, WhenUnsatisfiable must be DoNotSchedule.
      
                              For example, in a 3-zone cluster, MaxSkew is set to 2, MinDomains is set to 5 and pods with the same
                              labelSelector spread as 2/2/2:
                              | zone1 | zone2 | zone3 |
                              |  P P  |  P P  |  P P  |
                              The number of domains is less than 5(MinDomains), so "global minimum" is treated as 0.
                              In this situation, new pod with the same labelSelector cannot be scheduled,
                              because computed skew will be 3(3 - 0) if new Pod is scheduled to any of the three zones,
                              it will violate MaxSkew.
                            format: int32
                            type: integer
                          nodeAffinityPolicy:
                            description: |-
                              NodeAffinityPolicy indicates how we will treat Pod's nodeAffinity/nodeSelector
                              when calculating pod topology spread skew. Options are:
                              - Honor: only nodes matching nodeAffinity/nodeSelector are included in the calculations.
                              - Ignore: nodeAffinity/nodeSelector are ignored. All nodes are included in the calculations.
      
                              If this value is nil, the behavior is equivalent to the Honor policy.
                            type: string
                          nodeTaintsPolicy:
                            description: |-
                              NodeTaintsPolicy indicates how we will treat node taints when calculating
                              pod topology spread skew. Options are:
                              - Honor: nodes without taints, along with tainted nodes for which the incoming pod
                              has a toleration, are included.
                              - Ignore: node taints are ignored. All nodes are included.
      
                              If this value is nil, the behavior is equivalent to the Ignore policy.
                            type: string
                          topologyKey:
                            description: |-
                              TopologyKey is the key of node labels. Nodes that have a label with this key
                              and identical values are considered to be in the same topology.
                              We consider each <key, value> as a "bucket", and try to put balanced number
                              of pods into each bucket.
                              We define a domain as a particular instance of a topology.
                              Also, we define an eligible domain as a domain whose nodes meet the requirements of
                              nodeAffinityPolicy and nodeTaintsPolicy.
                              e.g. If TopologyKey is "kubernetes.io/hostname", each Node is a domain of that topology.
                              And, if TopologyKey is "topology.kubernetes.io/zone", each zone is a domain of that topology.
                              It's a required field.
                            type: string
                          whenUnsatisfiable:
                            description: |-
                              WhenUnsatisfiable indicates how to deal with a pod if it doesn't satisfy
                              the spread constraint.
                              - DoNotSchedule (default) tells the scheduler not to schedule it.
                              - ScheduleAnyway tells the scheduler to schedule the pod in any location,
                                but giving higher precedence to topologies that would help reduce the
                                skew.
                              A constraint is considered "Unsatisfiable" for an incoming pod
                              if and only if every possible node assignment for that pod would violate
                              "MaxSkew" on some topology.
                              For example, in a 3-zone cluster, MaxSkew is set to 1, and pods with the same
                              labelSelector spread as 3/1/1:
                              | zone1 | zone2 | zone3 |
                              | P P P |   P   |   P   |
                              If WhenUnsatisfiable is set to DoNotSchedule, incoming pod can only be scheduled
                              to zone2(zone3) to become 3/2/1(3/1/2) as ActualSkew(2-1) on zone2(zone3) satisfies
                              MaxSkew(1). In other words, the cluster can still be imbalanced, but scheduler
                              won't make it *more* imbalanced.
                              It's a required field.
                            type: string
                        required:
                        - maxSkew
                        - topologyKey
                        - whenUnsatisfiable
                        type: object
                      type: array
                    webhook:
                      description: Configuration for webhooks to trigger renovate runs
                      properties:
                        authentication:
                          description: authentication configuration for webhooks
                          properties:
                            enabled:
                              type: boolean
                            secretRef:
                              description: reference to a secret and key
                              properties:
                                key:
                                  type: string
                                name:
                                  type: string
                              type: object
                          required:
                          - enabled
                          type: object
                        enabled:
                          type: boolean
                        sync:
                          description: |-
                            configuration for syncing webhooks onto the repositories discovered for this
                            job.
                          properties:
                            enabled:
                              description: Flag to enable the automatic repo webhook sync
                              type: boolean
                            secretRef:
                              description: |-
                                Optional reference to a secret key holding the platform token used for
                                webhook management. When not set, the job's platform token
                                (spec.secretRef or spec.githubAppReference) is used. If key is empty,
                                the common Renovate token key names are tried.
                              properties:
                                key:
                                  type: string
                                name:
                                  type: string
                              type: object
                          required:
                          - enabled
                          type: object
                      required:
                      - enabled
                      type: object
                  required:
                  - image
                  - parallelism
                  - provider
                  - schedule
                  type: object
                status:
                  description: RenovateJobStatus defines the observed state of RenovateJob
                  properties:
                    executionOptions:
                      properties:
                        debug:
                          description: If true, the renovate job will be executed with RENOVATE_LOG_LEVEL=debug
                          type: boolean
                      type: object
                    projects:
                      items:
                        description: Status of a single project within a RenovateJob
                        properties:
                          duration:
                            type: string
                          lastRun:
                            format: date-time
                            type: string
                          logIssues:
                            description: LogIssues contains aggregate counts and individual
                              issue messages from a Renovate run.
                            properties:
                              errorCount:
                                type: integer
                              issues:
                                items:
                                  description: LogIssue represents a single warning or error
                                    from Renovate logs.
                                  properties:
                                    level:
                                      type: integer
                                    message:
                                      type: string
                                  required:
                                  - level
                                  - message
                                  type: object
                                type: array
                              truncated:
                                type: boolean
                              warnCount:
                                type: integer
                            required:
                            - errorCount
                            - warnCount
                            type: object
                          name:
                            type: string
                          prActivity:
                            description: PRActivity contains aggregate counts and individual
                              details of PR activity from a run.
                            properties:
                              automerged:
                                type: integer
                              created:
                                type: integer
                              needsApproval:
                                type: integer
                              prs:
                                items:
                                  description: PRDetail represents a single PR found in
                                    Renovate logs.
                                  properties:
                                    action:
                                      description: PRAction represents what happened to
                                        a PR in a Renovate run.
                                      type: string
                                    branch:
                                      type: string
                                    number:
                                      type: integer
                                    title:
                                      type: string
                                  required:
                                  - action
                                  - branch
                                  type: object
                                type: array
                              truncated:
                                type: boolean
                              unchanged:
                                type: integer
                              updated:
                                type: integer
                            required:
                            - automerged
                            - created
                            - needsApproval
                            - unchanged
                            - updated
                            type: object
                          priority:
                            format: int32
                            type: integer
                          renovateResultStatus:
                            type: string
                          status:
                            type: string
                        required:
                        - lastRun
                        - name
                        - status
                        type: object
                      type: array
                  type: object
              type: object
          served: true
          storage: true
          subresources:
            status: {}
      
  


(root level)
+ one document added:
  apiVersion: rbac.authorization.k8s.io/v1
  kind: ClusterRole
  metadata:
    name: renovate-operator-renovate-operator-crd-hook
    annotations:
      helm.sh/hook: "pre-install,pre-upgrade"
      helm.sh/hook-delete-policy: "before-hook-creation,hook-succeeded"
      helm.sh/hook-weight: "-5"
  rules:
  - resources:
    - customresourcedefinitions
    apiGroups:
    - apiextensions.k8s.io
    verbs:
    - get
    - create
    - update
    - patch

(root level)
+ one document added:
  apiVersion: rbac.authorization.k8s.io/v1
  kind: ClusterRoleBinding
  metadata:
    name: renovate-operator-renovate-operator-crd-hook
    annotations:
      helm.sh/hook: "pre-install,pre-upgrade"
      helm.sh/hook-delete-policy: "before-hook-creation,hook-succeeded"
      helm.sh/hook-weight: "-5"
  roleRef:
    name: renovate-operator-renovate-operator-crd-hook
    apiGroup: rbac.authorization.k8s.io
    kind: ClusterRole
  subjects:
  - name: renovate-operator-renovate-operator-crd-hook
    kind: ServiceAccount
    namespace: apps-renovate

(root level)
+ one document added:
  apiVersion: batch/v1
  kind: Job
  metadata:
    name: renovate-operator-renovate-operator-crd-install
    namespace: apps-renovate
    annotations:
      helm.sh/hook: "pre-install,pre-upgrade"
      helm.sh/hook-delete-policy: "before-hook-creation,hook-succeeded"
      helm.sh/hook-weight: "0"
  spec:
    backoffLimit: 3
    template:
      spec:
        containers:
        - name: kubectl
          image: "registry.k8s.io/kubectl:v1.36.2"
          imagePullPolicy: IfNotPresent
          command:
          - kubectl
          - apply
          - "--server-side"
          - "--force-conflicts"
          - "-f"
          - /crd/renovatejob.yaml
          volumeMounts:
          - name: crd
            mountPath: /crd
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
              - ALL
            privileged: false
            readOnlyRootFilesystem: true
            runAsGroup: 1000
            runAsNonRoot: true
            runAsUser: 1000
            seccompProfile:
              type: RuntimeDefault
        restartPolicy: OnFailure
        securityContext:
          fsGroup: 1000
          runAsGroup: 1000
          runAsNonRoot: true
          runAsUser: 1000
          seccompProfile:
            type: RuntimeDefault
        serviceAccountName: renovate-operator-renovate-operator-crd-hook
        volumes:
        - name: crd
          configMap:
            name: renovate-operator-renovate-operator-crd

(root level)
+ one document added:
  apiVersion: networking.k8s.io/v1
  kind: NetworkPolicy
  metadata:
    name: renovate-operator-valkey
    namespace: apps-renovate
    labels:
      app.kubernetes.io/instance: renovate-operator-valkey
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: valkey
      app.kubernetes.io/part-of: valkey
      helm.toolkit.fluxcd.io/name: renovate-operator-valkey
      helm.toolkit.fluxcd.io/namespace: flux-system
  spec:
    egress:
    -   ingress:
    - ports:
      - port: 6379
    podSelector:
      matchLabels:
        app.kubernetes.io/instance: renovate-operator-valkey
        app.kubernetes.io/name: valkey
    policyTypes:
    - Ingress
    - Egress

(root level)
+ one document added:
  apiVersion: policy/v1
  kind: PodDisruptionBudget
  metadata:
    name: renovate-operator-valkey-primary
    namespace: apps-renovate
    labels:
      app.kubernetes.io/component: primary
      app.kubernetes.io/instance: renovate-operator-valkey
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: valkey
      helm.toolkit.fluxcd.io/name: renovate-operator-valkey
      helm.toolkit.fluxcd.io/namespace: flux-system
  spec:
    maxUnavailable: 1
    selector:
      matchLabels:
        app.kubernetes.io/component: primary
        app.kubernetes.io/instance: renovate-operator-valkey
        app.kubernetes.io/name: valkey

(root level)
+ one document added:
  apiVersion: v1
  kind: ServiceAccount
  metadata:
    name: renovate-operator-valkey-primary
    namespace: apps-renovate
    labels:
      app.kubernetes.io/instance: renovate-operator-valkey
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: valkey
      app.kubernetes.io/part-of: valkey
      helm.toolkit.fluxcd.io/name: renovate-operator-valkey
      helm.toolkit.fluxcd.io/namespace: flux-system
  automountServiceAccountToken: false

(root level)
+ one document added:
  apiVersion: v1
  kind: ConfigMap
  metadata:
    name: renovate-operator-valkey-configuration
    namespace: apps-renovate
    labels:
      app.kubernetes.io/instance: renovate-operator-valkey
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: valkey
      app.kubernetes.io/part-of: valkey
      helm.toolkit.fluxcd.io/name: renovate-operator-valkey
      helm.toolkit.fluxcd.io/namespace: flux-system
  data:
    primary.conf: |
      dir /data
      # User-supplied primary configuration:
      rename-command FLUSHDB ""
      rename-command FLUSHALL ""
      # End of primary configuration
    replica.conf: |
      dir /data
      # User-supplied replica configuration:
      rename-command FLUSHDB ""
      rename-command FLUSHALL ""
      # End of replica configuration
    valkey.conf: |
      # User-supplied common configuration:
      # Enable AOF https://valkey.io/docs/topics/persistence.html
      appendonly yes
      # Disable RDB persistence, AOF persistence already enabled.
      save ""
      # End of common configuration

(root level)
+ one document added:
  apiVersion: v1
  kind: ConfigMap
  metadata:
    name: renovate-operator-valkey-health
    namespace: apps-renovate
    labels:
      app.kubernetes.io/instance: renovate-operator-valkey
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: valkey
      helm.toolkit.fluxcd.io/name: renovate-operator-valkey
      helm.toolkit.fluxcd.io/namespace: flux-system
  data:
    ping_liveness_local.sh: |
      #!/bin/bash
      
      [[ -f $VALKEY_PASSWORD_FILE ]] && export VALKEY_PASSWORD="$(< "${VALKEY_PASSWORD_FILE}")"
      [[ -n "$VALKEY_PASSWORD" ]] && export REDISCLI_AUTH="$VALKEY_PASSWORD"
      response=$(
        timeout -s 15 $1 \
        valkey-cli \
          -h localhost \
          -p $VALKEY_PORT \
          ping
      )
      if [ "$?" -eq "124" ]; then
        echo "Timed out"
        exit 1
      fi
      responseFirstWord=$(echo $response | head -n1 | awk '{print $1;}')
      if [ "$response" != "PONG" ] && [ "$responseFirstWord" != "LOADING" ] && [ "$responseFirstWord" != "MASTERDOWN" ]; then
        echo "$response"
        exit 1
      fi
    ping_liveness_local_and_primary.sh: |
      script_dir="$(dirname "$0")"
      exit_status=0
      "$script_dir/ping_liveness_local.sh" $1 || exit_status=$?
      "$script_dir/ping_liveness_primary.sh" $1 || exit_status=$?
      exit $exit_status
    ping_liveness_primary.sh: |
      #!/bin/bash
      
      [[ -f $VALKEY_PRIMARY_PASSWORD_FILE ]] && export VALKEY_PRIMARY_PASSWORD="$(< "${VALKEY_PRIMARY_PASSWORD_FILE}")"
      [[ -n "$VALKEY_PRIMARY_PASSWORD" ]] && export REDISCLI_AUTH="$VALKEY_PRIMARY_PASSWORD"
      response=$(
        timeout -s 15 $1 \
        valkey-cli \
          -h $VALKEY_PRIMARY_HOST \
          -p $VALKEY_PRIMARY_PORT_NUMBER \
          ping
      )
      if [ "$?" -eq "124" ]; then
        echo "Timed out"
        exit 1
      fi
      responseFirstWord=$(echo $response | head -n1 | awk '{print $1;}')
      if [ "$response" != "PONG" ] && [ "$responseFirstWord" != "LOADING" ]; then
        echo "$response"
        exit 1
      fi
    ping_readiness_local.sh: |
      #!/bin/bash
      
      [[ -f $VALKEY_PASSWORD_FILE ]] && export VALKEY_PASSWORD="$(< "${VALKEY_PASSWORD_FILE}")"
      [[ -n "$VALKEY_PASSWORD" ]] && export REDISCLI_AUTH="$VALKEY_PASSWORD"
      response=$(
        timeout -s 15 $1 \
        valkey-cli \
          -h localhost \
          -p $VALKEY_PORT \
          ping
      )
      if [ "$?" -eq "124" ]; then
        echo "Timed out"
        exit 1
      fi
      if [ "$response" != "PONG" ]; then
        echo "$response"
        exit 1
      fi
    ping_readiness_local_and_primary.sh: |
      script_dir="$(dirname "$0")"
      exit_status=0
      "$script_dir/ping_readiness_local.sh" $1 || exit_status=$?
      "$script_dir/ping_readiness_primary.sh" $1 || exit_status=$?
      exit $exit_status
    ping_readiness_primary.sh: |
      #!/bin/bash
      
      [[ -f $VALKEY_PRIMARY_PASSWORD_FILE ]] && export VALKEY_PRIMARY_PASSWORD="$(< "${VALKEY_PRIMARY_PASSWORD_FILE}")"
      [[ -n "$VALKEY_PRIMARY_PASSWORD" ]] && export REDISCLI_AUTH="$VALKEY_PRIMARY_PASSWORD"
      response=$(
        timeout -s 15 $1 \
        valkey-cli \
          -h $VALKEY_PRIMARY_HOST \
          -p $VALKEY_PRIMARY_PORT_NUMBER \
          ping
      )
      if [ "$?" -eq "124" ]; then
        echo "Timed out"
        exit 1
      fi
      if [ "$response" != "PONG" ]; then
        echo "$response"
        exit 1
      fi
  


(root level)
+ one document added:
  apiVersion: v1
  kind: ConfigMap
  metadata:
    name: renovate-operator-valkey-scripts
    namespace: apps-renovate
    labels:
      app.kubernetes.io/instance: renovate-operator-valkey
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: valkey
      app.kubernetes.io/part-of: valkey
      helm.toolkit.fluxcd.io/name: renovate-operator-valkey
      helm.toolkit.fluxcd.io/namespace: flux-system
  data:
    start-primary.sh: |
      #!/bin/bash
      
      [[ -f $VALKEY_PASSWORD_FILE ]] && export VALKEY_PASSWORD="$(< "${VALKEY_PASSWORD_FILE}")"
      if [[ -f /opt/bitnami/valkey/mounted-etc/primary.conf ]];then
          cp /opt/bitnami/valkey/mounted-etc/primary.conf /opt/bitnami/valkey/etc/primary.conf
      fi
      if [[ -f /opt/bitnami/valkey/mounted-etc/valkey.conf ]];then
          cp /opt/bitnami/valkey/mounted-etc/valkey.conf /opt/bitnami/valkey/etc/valkey.conf
      fi
      ARGS=("--port" "${VALKEY_PORT}")
      ARGS+=("--protected-mode" "no")
      ARGS+=("--include" "/opt/bitnami/valkey/etc/valkey.conf")
      ARGS+=("--include" "/opt/bitnami/valkey/etc/primary.conf")
      exec valkey-server "${ARGS[@]}"
      
  


(root level)
+ one document added:
  apiVersion: v1
  kind: Service
  metadata:
    name: renovate-operator-valkey-headless
    namespace: apps-renovate
    labels:
      app.kubernetes.io/instance: renovate-operator-valkey
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: valkey
      app.kubernetes.io/part-of: valkey
      helm.toolkit.fluxcd.io/name: renovate-operator-valkey
      helm.toolkit.fluxcd.io/namespace: flux-system
  spec:
    type: ClusterIP
    clusterIP: None
    selector:
      app.kubernetes.io/instance: renovate-operator-valkey
      app.kubernetes.io/name: valkey
    ports:
    - name: tcp-redis
      port: 6379
      targetPort: redis

(root level)
+ one document added:
  apiVersion: v1
  kind: Service
  metadata:
    name: renovate-operator-valkey-primary
    namespace: apps-renovate
    labels:
      app.kubernetes.io/component: primary
      app.kubernetes.io/instance: renovate-operator-valkey
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: valkey
      app.kubernetes.io/part-of: valkey
      helm.toolkit.fluxcd.io/name: renovate-operator-valkey
      helm.toolkit.fluxcd.io/namespace: flux-system
  spec:
    type: ClusterIP
    internalTrafficPolicy: Cluster
    selector:
      app.kubernetes.io/component: primary
      app.kubernetes.io/instance: renovate-operator-valkey
      app.kubernetes.io/name: valkey
    ports:
    - name: tcp-redis
      nodePort: null
      port: 6379
      targetPort: redis

(root level)
+ one document added:
  apiVersion: apps/v1
  kind: StatefulSet
  metadata:
    name: renovate-operator-valkey-primary
    namespace: apps-renovate
    labels:
      app.kubernetes.io/component: primary
      app.kubernetes.io/instance: renovate-operator-valkey
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: valkey
      app.kubernetes.io/part-of: valkey
      helm.toolkit.fluxcd.io/name: renovate-operator-valkey
      helm.toolkit.fluxcd.io/namespace: flux-system
  spec:
    replicas: 1
    selector:
      matchLabels:
        app.kubernetes.io/component: primary
        app.kubernetes.io/instance: renovate-operator-valkey
        app.kubernetes.io/name: valkey
    serviceName: renovate-operator-valkey-headless
    template:
      metadata:
        labels:
          app.kubernetes.io/component: primary
          app.kubernetes.io/instance: renovate-operator-valkey
          app.kubernetes.io/managed-by: Helm
          app.kubernetes.io/name: valkey
      spec:
        affinity:
          nodeAffinity: null
          podAffinity: null
          podAntiAffinity:
            preferredDuringSchedulingIgnoredDuringExecution:
            - podAffinityTerm:
                labelSelector:
                  matchLabels:
                    app.kubernetes.io/component: primary
                    app.kubernetes.io/instance: renovate-operator-valkey
                    app.kubernetes.io/name: valkey
                topologyKey: kubernetes.io/hostname
              weight: 1
        automountServiceAccountToken: false
        containers:
        - name: valkey
          image: "registry-1.docker.io/bitnami/valkey:latest"
          imagePullPolicy: IfNotPresent
          args:
          - "-c"
          - /opt/bitnami/scripts/start-scripts/start-primary.sh
          command:
          - /bin/bash
          env:
          - name: BITNAMI_DEBUG
            value: "false"
          - name: VALKEY_REPLICATION_MODE
            value: primary
          - name: ALLOW_EMPTY_PASSWORD
            value: yes
          - name: OPENSSL_FIPS
            value: yes
          - name: VALKEY_TLS_ENABLED
            value: no
          - name: VALKEY_PORT
            value: "6379"
          ports:
          - name: redis
            containerPort: 6379
          resources:
            limits:
              cpu: 150m
              ephemeral-storage: 2Gi
              memory: 192Mi
            requests:
              cpu: 100m
              ephemeral-storage: 50Mi
              memory: 128Mi
          volumeMounts:
          - name: start-scripts
            mountPath: /opt/bitnami/scripts/start-scripts
          - name: health
            mountPath: /health
          - name: valkey-data
            mountPath: /data
          - name: config
            mountPath: /opt/bitnami/valkey/mounted-etc
          - name: empty-dir
            mountPath: /opt/bitnami/valkey/etc/
            subPath: app-conf-dir
          - name: empty-dir
            mountPath: /tmp
            subPath: tmp-dir
          livenessProbe:
            exec:
              command:
              - sh
              - "-c"
              - "/health/ping_liveness_local.sh 5"
            failureThreshold: 5
            initialDelaySeconds: 20
            periodSeconds: 5
            successThreshold: 1
            timeoutSeconds: 6
          readinessProbe:
            exec:
              command:
              - sh
              - "-c"
              - "/health/ping_readiness_local.sh 1"
            failureThreshold: 5
            initialDelaySeconds: 20
            periodSeconds: 5
            successThreshold: 1
            timeoutSeconds: 2
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
              - ALL
            readOnlyRootFilesystem: true
            runAsGroup: 1001
            runAsNonRoot: true
            runAsUser: 1001
            seLinuxOptions: {}
            seccompProfile:
              type: RuntimeDefault
        enableServiceLinks: true
        securityContext:
          fsGroup: 1001
          fsGroupChangePolicy: Always
          supplementalGroups: []
          sysctls: []
        serviceAccountName: renovate-operator-valkey-primary
        terminationGracePeriodSeconds: 30
        volumes:
        - name: start-scripts
          configMap:
            name: renovate-operator-valkey-scripts
            defaultMode: 493
        - name: health
          configMap:
            name: renovate-operator-valkey-health
            defaultMode: 493
        - name: config
          configMap:
            name: renovate-operator-valkey-configuration
        - name: empty-dir
          emptyDir: {}
    updateStrategy:
      type: RollingUpdate
    volumeClaimTemplates:
    - apiVersion: v1
      kind: PersistentVolumeClaim
      metadata:
        name: valkey-data
        labels:
          app.kubernetes.io/component: primary
          app.kubernetes.io/instance: renovate-operator-valkey
          app.kubernetes.io/name: valkey
      spec:
        resources:
          requests:
            storage: 8Gi
        storageClassName: longhorn
        accessModes:
        - ReadWriteOnce

(root level)
+ one document added:
  apiVersion: networking.k8s.io/v1
  kind: NetworkPolicy
  metadata:
    name: romm-valkey
    namespace: apps-romm
    labels:
      app.kubernetes.io/instance: romm-valkey
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: valkey
      app.kubernetes.io/part-of: valkey
      helm.toolkit.fluxcd.io/name: romm-valkey
      helm.toolkit.fluxcd.io/namespace: flux-system
  spec:
    egress:
    -   ingress:
    - ports:
      - port: 6379
    podSelector:
      matchLabels:
        app.kubernetes.io/instance: romm-valkey
        app.kubernetes.io/name: valkey
    policyTypes:
    - Ingress
    - Egress

(root level)
+ one document added:
  apiVersion: policy/v1
  kind: PodDisruptionBudget
  metadata:
    name: romm-valkey-primary
    namespace: apps-romm
    labels:
      app.kubernetes.io/component: primary
      app.kubernetes.io/instance: romm-valkey
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: valkey
      helm.toolkit.fluxcd.io/name: romm-valkey
      helm.toolkit.fluxcd.io/namespace: flux-system
  spec:
    maxUnavailable: 1
    selector:
      matchLabels:
        app.kubernetes.io/component: primary
        app.kubernetes.io/instance: romm-valkey
        app.kubernetes.io/name: valkey

(root level)
+ one document added:
  apiVersion: v1
  kind: ServiceAccount
  metadata:
    name: romm-valkey-primary
    namespace: apps-romm
    labels:
      app.kubernetes.io/instance: romm-valkey
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: valkey
      app.kubernetes.io/part-of: valkey
      helm.toolkit.fluxcd.io/name: romm-valkey
      helm.toolkit.fluxcd.io/namespace: flux-system
  automountServiceAccountToken: false

(root level)
+ one document added:
  apiVersion: v1
  kind: ConfigMap
  metadata:
    name: romm-valkey-configuration
    namespace: apps-romm
    labels:
      app.kubernetes.io/instance: romm-valkey
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: valkey
      app.kubernetes.io/part-of: valkey
      helm.toolkit.fluxcd.io/name: romm-valkey
      helm.toolkit.fluxcd.io/namespace: flux-system
  data:
    primary.conf: |
      dir /data
      # User-supplied primary configuration:
      rename-command FLUSHDB ""
      rename-command FLUSHALL ""
      # End of primary configuration
    replica.conf: |
      dir /data
      # User-supplied replica configuration:
      rename-command FLUSHDB ""
      rename-command FLUSHALL ""
      # End of replica configuration
    valkey.conf: |
      # User-supplied common configuration:
      # Enable AOF https://valkey.io/docs/topics/persistence.html
      appendonly yes
      # Disable RDB persistence, AOF persistence already enabled.
      save ""
      # End of common configuration

(root level)
+ one document added:
  apiVersion: v1
  kind: ConfigMap
  metadata:
    name: romm-valkey-health
    namespace: apps-romm
    labels:
      app.kubernetes.io/instance: romm-valkey
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: valkey
      helm.toolkit.fluxcd.io/name: romm-valkey
      helm.toolkit.fluxcd.io/namespace: flux-system
  data:
    ping_liveness_local.sh: |
      #!/bin/bash
      
      [[ -f $VALKEY_PASSWORD_FILE ]] && export VALKEY_PASSWORD="$(< "${VALKEY_PASSWORD_FILE}")"
      [[ -n "$VALKEY_PASSWORD" ]] && export REDISCLI_AUTH="$VALKEY_PASSWORD"
      response=$(
        timeout -s 15 $1 \
        valkey-cli \
          -h localhost \
          -p $VALKEY_PORT \
          ping
      )
      if [ "$?" -eq "124" ]; then
        echo "Timed out"
        exit 1
      fi
      responseFirstWord=$(echo $response | head -n1 | awk '{print $1;}')
      if [ "$response" != "PONG" ] && [ "$responseFirstWord" != "LOADING" ] && [ "$responseFirstWord" != "MASTERDOWN" ]; then
        echo "$response"
        exit 1
      fi
    ping_liveness_local_and_primary.sh: |
      script_dir="$(dirname "$0")"
      exit_status=0
      "$script_dir/ping_liveness_local.sh" $1 || exit_status=$?
      "$script_dir/ping_liveness_primary.sh" $1 || exit_status=$?
      exit $exit_status
    ping_liveness_primary.sh: |
      #!/bin/bash
      
      [[ -f $VALKEY_PRIMARY_PASSWORD_FILE ]] && export VALKEY_PRIMARY_PASSWORD="$(< "${VALKEY_PRIMARY_PASSWORD_FILE}")"
      [[ -n "$VALKEY_PRIMARY_PASSWORD" ]] && export REDISCLI_AUTH="$VALKEY_PRIMARY_PASSWORD"
      response=$(
        timeout -s 15 $1 \
        valkey-cli \
          -h $VALKEY_PRIMARY_HOST \
          -p $VALKEY_PRIMARY_PORT_NUMBER \
          ping
      )
      if [ "$?" -eq "124" ]; then
        echo "Timed out"
        exit 1
      fi
      responseFirstWord=$(echo $response | head -n1 | awk '{print $1;}')
      if [ "$response" != "PONG" ] && [ "$responseFirstWord" != "LOADING" ]; then
        echo "$response"
        exit 1
      fi
    ping_readiness_local.sh: |
      #!/bin/bash
      
      [[ -f $VALKEY_PASSWORD_FILE ]] && export VALKEY_PASSWORD="$(< "${VALKEY_PASSWORD_FILE}")"
      [[ -n "$VALKEY_PASSWORD" ]] && export REDISCLI_AUTH="$VALKEY_PASSWORD"
      response=$(
        timeout -s 15 $1 \
        valkey-cli \
          -h localhost \
          -p $VALKEY_PORT \
          ping
      )
      if [ "$?" -eq "124" ]; then
        echo "Timed out"
        exit 1
      fi
      if [ "$response" != "PONG" ]; then
        echo "$response"
        exit 1
      fi
    ping_readiness_local_and_primary.sh: |
      script_dir="$(dirname "$0")"
      exit_status=0
      "$script_dir/ping_readiness_local.sh" $1 || exit_status=$?
      "$script_dir/ping_readiness_primary.sh" $1 || exit_status=$?
      exit $exit_status
    ping_readiness_primary.sh: |
      #!/bin/bash
      
      [[ -f $VALKEY_PRIMARY_PASSWORD_FILE ]] && export VALKEY_PRIMARY_PASSWORD="$(< "${VALKEY_PRIMARY_PASSWORD_FILE}")"
      [[ -n "$VALKEY_PRIMARY_PASSWORD" ]] && export REDISCLI_AUTH="$VALKEY_PRIMARY_PASSWORD"
      response=$(
        timeout -s 15 $1 \
        valkey-cli \
          -h $VALKEY_PRIMARY_HOST \
          -p $VALKEY_PRIMARY_PORT_NUMBER \
          ping
      )
      if [ "$?" -eq "124" ]; then
        echo "Timed out"
        exit 1
      fi
      if [ "$response" != "PONG" ]; then
        echo "$response"
        exit 1
      fi
  


(root level)
+ one document added:
  apiVersion: v1
  kind: ConfigMap
  metadata:
    name: romm-valkey-scripts
    namespace: apps-romm
    labels:
      app.kubernetes.io/instance: romm-valkey
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: valkey
      app.kubernetes.io/part-of: valkey
      helm.toolkit.fluxcd.io/name: romm-valkey
      helm.toolkit.fluxcd.io/namespace: flux-system
  data:
    start-primary.sh: |
      #!/bin/bash
      
      [[ -f $VALKEY_PASSWORD_FILE ]] && export VALKEY_PASSWORD="$(< "${VALKEY_PASSWORD_FILE}")"
      if [[ -f /opt/bitnami/valkey/mounted-etc/primary.conf ]];then
          cp /opt/bitnami/valkey/mounted-etc/primary.conf /opt/bitnami/valkey/etc/primary.conf
      fi
      if [[ -f /opt/bitnami/valkey/mounted-etc/valkey.conf ]];then
          cp /opt/bitnami/valkey/mounted-etc/valkey.conf /opt/bitnami/valkey/etc/valkey.conf
      fi
      ARGS=("--port" "${VALKEY_PORT}")
      ARGS+=("--requirepass" "${VALKEY_PASSWORD}")
      ARGS+=("--primaryauth" "${VALKEY_PASSWORD}")
      ARGS+=("--include" "/opt/bitnami/valkey/etc/valkey.conf")
      ARGS+=("--include" "/opt/bitnami/valkey/etc/primary.conf")
      exec valkey-server "${ARGS[@]}"
      
  


(root level)
+ one document added:
  apiVersion: v1
  kind: Service
  metadata:
    name: romm-valkey-headless
    namespace: apps-romm
    labels:
      app.kubernetes.io/instance: romm-valkey
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: valkey
      app.kubernetes.io/part-of: valkey
      helm.toolkit.fluxcd.io/name: romm-valkey
      helm.toolkit.fluxcd.io/namespace: flux-system
  spec:
    type: ClusterIP
    clusterIP: None
    selector:
      app.kubernetes.io/instance: romm-valkey
      app.kubernetes.io/name: valkey
    ports:
    - name: tcp-redis
      port: 6379
      targetPort: redis

(root level)
+ one document added:
  apiVersion: v1
  kind: Service
  metadata:
    name: romm-valkey-primary
    namespace: apps-romm
    labels:
      app.kubernetes.io/component: primary
      app.kubernetes.io/instance: romm-valkey
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: valkey
      app.kubernetes.io/part-of: valkey
      helm.toolkit.fluxcd.io/name: romm-valkey
      helm.toolkit.fluxcd.io/namespace: flux-system
  spec:
    type: ClusterIP
    internalTrafficPolicy: Cluster
    selector:
      app.kubernetes.io/component: primary
      app.kubernetes.io/instance: romm-valkey
      app.kubernetes.io/name: valkey
    ports:
    - name: tcp-redis
      nodePort: null
      port: 6379
      targetPort: redis

(root level)
+ one document added:
  apiVersion: apps/v1
  kind: StatefulSet
  metadata:
    name: romm-valkey-primary
    namespace: apps-romm
    labels:
      app.kubernetes.io/component: primary
      app.kubernetes.io/instance: romm-valkey
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: valkey
      app.kubernetes.io/part-of: valkey
      helm.toolkit.fluxcd.io/name: romm-valkey
      helm.toolkit.fluxcd.io/namespace: flux-system
  spec:
    replicas: 1
    selector:
      matchLabels:
        app.kubernetes.io/component: primary
        app.kubernetes.io/instance: romm-valkey
        app.kubernetes.io/name: valkey
    serviceName: romm-valkey-headless
    template:
      metadata:
        labels:
          app.kubernetes.io/component: primary
          app.kubernetes.io/instance: romm-valkey
          app.kubernetes.io/managed-by: Helm
          app.kubernetes.io/name: valkey
      spec:
        affinity:
          nodeAffinity: null
          podAffinity: null
          podAntiAffinity:
            preferredDuringSchedulingIgnoredDuringExecution:
            - podAffinityTerm:
                labelSelector:
                  matchLabels:
                    app.kubernetes.io/component: primary
                    app.kubernetes.io/instance: romm-valkey
                    app.kubernetes.io/name: valkey
                topologyKey: kubernetes.io/hostname
              weight: 1
        automountServiceAccountToken: false
        containers:
        - name: valkey
          image: "registry-1.docker.io/bitnami/valkey:latest"
          imagePullPolicy: IfNotPresent
          args:
          - "-c"
          - /opt/bitnami/scripts/start-scripts/start-primary.sh
          command:
          - /bin/bash
          env:
          - name: BITNAMI_DEBUG
            value: "false"
          - name: VALKEY_REPLICATION_MODE
            value: primary
          - name: ALLOW_EMPTY_PASSWORD
            value: no
          - name: VALKEY_PASSWORD_FILE
            value: /opt/bitnami/valkey/secrets/valkey-password
          - name: OPENSSL_FIPS
            value: yes
          - name: VALKEY_TLS_ENABLED
            value: no
          - name: VALKEY_PORT
            value: "6379"
          ports:
          - name: redis
            containerPort: 6379
          resources:
            limits:
              cpu: 150m
              ephemeral-storage: 2Gi
              memory: 192Mi
            requests:
              cpu: 100m
              ephemeral-storage: 50Mi
              memory: 128Mi
          volumeMounts:
          - name: start-scripts
            mountPath: /opt/bitnami/scripts/start-scripts
          - name: health
            mountPath: /health
          - name: valkey-password
            mountPath: /opt/bitnami/valkey/secrets/
          - name: valkey-data
            mountPath: /data
          - name: config
            mountPath: /opt/bitnami/valkey/mounted-etc
          - name: empty-dir
            mountPath: /opt/bitnami/valkey/etc/
            subPath: app-conf-dir
          - name: empty-dir
            mountPath: /tmp
            subPath: tmp-dir
          livenessProbe:
            exec:
              command:
              - sh
              - "-c"
              - "/health/ping_liveness_local.sh 5"
            failureThreshold: 5
            initialDelaySeconds: 20
            periodSeconds: 5
            successThreshold: 1
            timeoutSeconds: 6
          readinessProbe:
            exec:
              command:
              - sh
              - "-c"
              - "/health/ping_readiness_local.sh 1"
            failureThreshold: 5
            initialDelaySeconds: 20
            periodSeconds: 5
            successThreshold: 1
            timeoutSeconds: 2
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
              - ALL
            readOnlyRootFilesystem: true
            runAsGroup: 1001
            runAsNonRoot: true
            runAsUser: 1001
            seLinuxOptions: {}
            seccompProfile:
              type: RuntimeDefault
        enableServiceLinks: true
        securityContext:
          fsGroup: 1001
          fsGroupChangePolicy: Always
          supplementalGroups: []
          sysctls: []
        serviceAccountName: romm-valkey-primary
        terminationGracePeriodSeconds: 30
        volumes:
        - name: start-scripts
          configMap:
            name: romm-valkey-scripts
            defaultMode: 493
        - name: health
          configMap:
            name: romm-valkey-health
            defaultMode: 493
        - name: valkey-password
          secret:
            items:
            - key: password
              path: valkey-password
            secretName: romm-valkey-auth
        - name: config
          configMap:
            name: romm-valkey-configuration
        - name: empty-dir
          emptyDir: {}
    updateStrategy:
      type: RollingUpdate
    volumeClaimTemplates:
    - apiVersion: v1
      kind: PersistentVolumeClaim
      metadata:
        name: valkey-data
        labels:
          app.kubernetes.io/component: primary
          app.kubernetes.io/instance: romm-valkey
          app.kubernetes.io/name: valkey
      spec:
        resources:
          requests:
            storage: 8Gi
        storageClassName: longhorn
        accessModes:
        - ReadWriteOnce

(root level)
+ one document added:
  apiVersion: networking.k8s.io/v1
  kind: NetworkPolicy
  metadata:
    name: searxng-valkey
    namespace: apps-searxng
    labels:
      app.kubernetes.io/instance: searxng-valkey
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: valkey
      app.kubernetes.io/part-of: valkey
      helm.toolkit.fluxcd.io/name: searxng-valkey
      helm.toolkit.fluxcd.io/namespace: flux-system
  spec:
    egress:
    -   ingress:
    - ports:
      - port: 6379
    podSelector:
      matchLabels:
        app.kubernetes.io/instance: searxng-valkey
        app.kubernetes.io/name: valkey
    policyTypes:
    - Ingress
    - Egress

(root level)
+ one document added:
  apiVersion: policy/v1
  kind: PodDisruptionBudget
  metadata:
    name: searxng-valkey-primary
    namespace: apps-searxng
    labels:
      app.kubernetes.io/component: primary
      app.kubernetes.io/instance: searxng-valkey
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: valkey
      helm.toolkit.fluxcd.io/name: searxng-valkey
      helm.toolkit.fluxcd.io/namespace: flux-system
  spec:
    maxUnavailable: 1
    selector:
      matchLabels:
        app.kubernetes.io/component: primary
        app.kubernetes.io/instance: searxng-valkey
        app.kubernetes.io/name: valkey

(root level)
+ one document added:
  apiVersion: v1
  kind: ServiceAccount
  metadata:
    name: searxng-valkey-primary
    namespace: apps-searxng
    labels:
      app.kubernetes.io/instance: searxng-valkey
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: valkey
      app.kubernetes.io/part-of: valkey
      helm.toolkit.fluxcd.io/name: searxng-valkey
      helm.toolkit.fluxcd.io/namespace: flux-system
  automountServiceAccountToken: false

(root level)
+ one document added:
  apiVersion: v1
  kind: ConfigMap
  metadata:
    name: searxng-valkey-configuration
    namespace: apps-searxng
    labels:
      app.kubernetes.io/instance: searxng-valkey
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: valkey
      app.kubernetes.io/part-of: valkey
      helm.toolkit.fluxcd.io/name: searxng-valkey
      helm.toolkit.fluxcd.io/namespace: flux-system
  data:
    primary.conf: |
      dir /data
      # User-supplied primary configuration:
      rename-command FLUSHDB ""
      rename-command FLUSHALL ""
      # End of primary configuration
    replica.conf: |
      dir /data
      # User-supplied replica configuration:
      rename-command FLUSHDB ""
      rename-command FLUSHALL ""
      # End of replica configuration
    valkey.conf: |
      # User-supplied common configuration:
      # Enable AOF https://valkey.io/docs/topics/persistence.html
      appendonly yes
      # Disable RDB persistence, AOF persistence already enabled.
      save ""
      # End of common configuration

(root level)
+ one document added:
  apiVersion: v1
  kind: ConfigMap
  metadata:
    name: searxng-valkey-health
    namespace: apps-searxng
    labels:
      app.kubernetes.io/instance: searxng-valkey
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: valkey
      helm.toolkit.fluxcd.io/name: searxng-valkey
      helm.toolkit.fluxcd.io/namespace: flux-system
  data:
    ping_liveness_local.sh: |
      #!/bin/bash
      
      [[ -f $VALKEY_PASSWORD_FILE ]] && export VALKEY_PASSWORD="$(< "${VALKEY_PASSWORD_FILE}")"
      [[ -n "$VALKEY_PASSWORD" ]] && export REDISCLI_AUTH="$VALKEY_PASSWORD"
      response=$(
        timeout -s 15 $1 \
        valkey-cli \
          -h localhost \
          -p $VALKEY_PORT \
          ping
      )
      if [ "$?" -eq "124" ]; then
        echo "Timed out"
        exit 1
      fi
      responseFirstWord=$(echo $response | head -n1 | awk '{print $1;}')
      if [ "$response" != "PONG" ] && [ "$responseFirstWord" != "LOADING" ] && [ "$responseFirstWord" != "MASTERDOWN" ]; then
        echo "$response"
        exit 1
      fi
    ping_liveness_local_and_primary.sh: |
      script_dir="$(dirname "$0")"
      exit_status=0
      "$script_dir/ping_liveness_local.sh" $1 || exit_status=$?
      "$script_dir/ping_liveness_primary.sh" $1 || exit_status=$?
      exit $exit_status
    ping_liveness_primary.sh: |
      #!/bin/bash
      
      [[ -f $VALKEY_PRIMARY_PASSWORD_FILE ]] && export VALKEY_PRIMARY_PASSWORD="$(< "${VALKEY_PRIMARY_PASSWORD_FILE}")"
      [[ -n "$VALKEY_PRIMARY_PASSWORD" ]] && export REDISCLI_AUTH="$VALKEY_PRIMARY_PASSWORD"
      response=$(
        timeout -s 15 $1 \
        valkey-cli \
          -h $VALKEY_PRIMARY_HOST \
          -p $VALKEY_PRIMARY_PORT_NUMBER \
          ping
      )
      if [ "$?" -eq "124" ]; then
        echo "Timed out"
        exit 1
      fi
      responseFirstWord=$(echo $response | head -n1 | awk '{print $1;}')
      if [ "$response" != "PONG" ] && [ "$responseFirstWord" != "LOADING" ]; then
        echo "$response"
        exit 1
      fi
    ping_readiness_local.sh: |
      #!/bin/bash
      
      [[ -f $VALKEY_PASSWORD_FILE ]] && export VALKEY_PASSWORD="$(< "${VALKEY_PASSWORD_FILE}")"
      [[ -n "$VALKEY_PASSWORD" ]] && export REDISCLI_AUTH="$VALKEY_PASSWORD"
      response=$(
        timeout -s 15 $1 \
        valkey-cli \
          -h localhost \
          -p $VALKEY_PORT \
          ping
      )
      if [ "$?" -eq "124" ]; then
        echo "Timed out"
        exit 1
      fi
      if [ "$response" != "PONG" ]; then
        echo "$response"
        exit 1
      fi
    ping_readiness_local_and_primary.sh: |
      script_dir="$(dirname "$0")"
      exit_status=0
      "$script_dir/ping_readiness_local.sh" $1 || exit_status=$?
      "$script_dir/ping_readiness_primary.sh" $1 || exit_status=$?
      exit $exit_status
    ping_readiness_primary.sh: |
      #!/bin/bash
      
      [[ -f $VALKEY_PRIMARY_PASSWORD_FILE ]] && export VALKEY_PRIMARY_PASSWORD="$(< "${VALKEY_PRIMARY_PASSWORD_FILE}")"
      [[ -n "$VALKEY_PRIMARY_PASSWORD" ]] && export REDISCLI_AUTH="$VALKEY_PRIMARY_PASSWORD"
      response=$(
        timeout -s 15 $1 \
        valkey-cli \
          -h $VALKEY_PRIMARY_HOST \
          -p $VALKEY_PRIMARY_PORT_NUMBER \
          ping
      )
      if [ "$?" -eq "124" ]; then
        echo "Timed out"
        exit 1
      fi
      if [ "$response" != "PONG" ]; then
        echo "$response"
        exit 1
      fi
  


(root level)
+ one document added:
  apiVersion: v1
  kind: ConfigMap
  metadata:
    name: searxng-valkey-scripts
    namespace: apps-searxng
    labels:
      app.kubernetes.io/instance: searxng-valkey
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: valkey
      app.kubernetes.io/part-of: valkey
      helm.toolkit.fluxcd.io/name: searxng-valkey
      helm.toolkit.fluxcd.io/namespace: flux-system
  data:
    start-primary.sh: |
      #!/bin/bash
      
      [[ -f $VALKEY_PASSWORD_FILE ]] && export VALKEY_PASSWORD="$(< "${VALKEY_PASSWORD_FILE}")"
      if [[ -f /opt/bitnami/valkey/mounted-etc/primary.conf ]];then
          cp /opt/bitnami/valkey/mounted-etc/primary.conf /opt/bitnami/valkey/etc/primary.conf
      fi
      if [[ -f /opt/bitnami/valkey/mounted-etc/valkey.conf ]];then
          cp /opt/bitnami/valkey/mounted-etc/valkey.conf /opt/bitnami/valkey/etc/valkey.conf
      fi
      ARGS=("--port" "${VALKEY_PORT}")
      ARGS+=("--protected-mode" "no")
      ARGS+=("--include" "/opt/bitnami/valkey/etc/valkey.conf")
      ARGS+=("--include" "/opt/bitnami/valkey/etc/primary.conf")
      exec valkey-server "${ARGS[@]}"
      
  


(root level)
+ one document added:
  apiVersion: v1
  kind: Service
  metadata:
    name: searxng-valkey-headless
    namespace: apps-searxng
    labels:
      app.kubernetes.io/instance: searxng-valkey
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: valkey
      app.kubernetes.io/part-of: valkey
      helm.toolkit.fluxcd.io/name: searxng-valkey
      helm.toolkit.fluxcd.io/namespace: flux-system
  spec:
    type: ClusterIP
    clusterIP: None
    selector:
      app.kubernetes.io/instance: searxng-valkey
      app.kubernetes.io/name: valkey
    ports:
    - name: tcp-redis
      port: 6379
      targetPort: redis

(root level)
+ one document added:
  apiVersion: v1
  kind: Service
  metadata:
    name: searxng-valkey-primary
    namespace: apps-searxng
    labels:
      app.kubernetes.io/component: primary
      app.kubernetes.io/instance: searxng-valkey
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: valkey
      app.kubernetes.io/part-of: valkey
      helm.toolkit.fluxcd.io/name: searxng-valkey
      helm.toolkit.fluxcd.io/namespace: flux-system
  spec:
    type: ClusterIP
    internalTrafficPolicy: Cluster
    selector:
      app.kubernetes.io/component: primary
      app.kubernetes.io/instance: searxng-valkey
      app.kubernetes.io/name: valkey
    ports:
    - name: tcp-redis
      nodePort: null
      port: 6379
      targetPort: redis

(root level)
+ one document added:
  apiVersion: apps/v1
  kind: StatefulSet
  metadata:
    name: searxng-valkey-primary
    namespace: apps-searxng
    labels:
      app.kubernetes.io/component: primary
      app.kubernetes.io/instance: searxng-valkey
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: valkey
      app.kubernetes.io/part-of: valkey
      helm.toolkit.fluxcd.io/name: searxng-valkey
      helm.toolkit.fluxcd.io/namespace: flux-system
  spec:
    replicas: 1
    selector:
      matchLabels:
        app.kubernetes.io/component: primary
        app.kubernetes.io/instance: searxng-valkey
        app.kubernetes.io/name: valkey
    serviceName: searxng-valkey-headless
    template:
      metadata:
        labels:
          app.kubernetes.io/component: primary
          app.kubernetes.io/instance: searxng-valkey
          app.kubernetes.io/managed-by: Helm
          app.kubernetes.io/name: valkey
      spec:
        affinity:
          nodeAffinity: null
          podAffinity: null
          podAntiAffinity:
            preferredDuringSchedulingIgnoredDuringExecution:
            - podAffinityTerm:
                labelSelector:
                  matchLabels:
                    app.kubernetes.io/component: primary
                    app.kubernetes.io/instance: searxng-valkey
                    app.kubernetes.io/name: valkey
                topologyKey: kubernetes.io/hostname
              weight: 1
        automountServiceAccountToken: false
        containers:
        - name: valkey
          image: "registry-1.docker.io/bitnami/valkey:latest"
          imagePullPolicy: IfNotPresent
          args:
          - "-c"
          - /opt/bitnami/scripts/start-scripts/start-primary.sh
          command:
          - /bin/bash
          env:
          - name: BITNAMI_DEBUG
            value: "false"
          - name: VALKEY_REPLICATION_MODE
            value: primary
          - name: ALLOW_EMPTY_PASSWORD
            value: yes
          - name: OPENSSL_FIPS
            value: yes
          - name: VALKEY_TLS_ENABLED
            value: no
          - name: VALKEY_PORT
            value: "6379"
          ports:
          - name: redis
            containerPort: 6379
          resources:
            limits:
              cpu: 150m
              ephemeral-storage: 2Gi
              memory: 192Mi
            requests:
              cpu: 100m
              ephemeral-storage: 50Mi
              memory: 128Mi
          volumeMounts:
          - name: start-scripts
            mountPath: /opt/bitnami/scripts/start-scripts
          - name: health
            mountPath: /health
          - name: valkey-data
            mountPath: /data
          - name: config
            mountPath: /opt/bitnami/valkey/mounted-etc
          - name: empty-dir
            mountPath: /opt/bitnami/valkey/etc/
            subPath: app-conf-dir
          - name: empty-dir
            mountPath: /tmp
            subPath: tmp-dir
          livenessProbe:
            exec:
              command:
              - sh
              - "-c"
              - "/health/ping_liveness_local.sh 5"
            failureThreshold: 5
            initialDelaySeconds: 20
            periodSeconds: 5
            successThreshold: 1
            timeoutSeconds: 6
          readinessProbe:
            exec:
              command:
              - sh
              - "-c"
              - "/health/ping_readiness_local.sh 1"
            failureThreshold: 5
            initialDelaySeconds: 20
            periodSeconds: 5
            successThreshold: 1
            timeoutSeconds: 2
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
              - ALL
            readOnlyRootFilesystem: true
            runAsGroup: 1001
            runAsNonRoot: true
            runAsUser: 1001
            seLinuxOptions: {}
            seccompProfile:
              type: RuntimeDefault
        enableServiceLinks: true
        securityContext:
          fsGroup: 1001
          fsGroupChangePolicy: Always
          supplementalGroups: []
          sysctls: []
        serviceAccountName: searxng-valkey-primary
        terminationGracePeriodSeconds: 30
        volumes:
        - name: start-scripts
          configMap:
            name: searxng-valkey-scripts
            defaultMode: 493
        - name: health
          configMap:
            name: searxng-valkey-health
            defaultMode: 493
        - name: config
          configMap:
            name: searxng-valkey-configuration
        - name: empty-dir
          emptyDir: {}
    updateStrategy:
      type: RollingUpdate
    volumeClaimTemplates:
    - apiVersion: v1
      kind: PersistentVolumeClaim
      metadata:
        name: valkey-data
        labels:
          app.kubernetes.io/component: primary
          app.kubernetes.io/instance: searxng-valkey
          app.kubernetes.io/name: valkey
      spec:
        resources:
          requests:
            storage: 8Gi
        storageClassName: longhorn
        accessModes:
        - ReadWriteOnce

(root level)
+ one document added:
  apiVersion: v1
  kind: ServiceAccount
  metadata:
    name: vmcp-oauth-valkey
    namespace: mcp-servers
    labels:
      app.kubernetes.io/instance: vmcp-oauth-valkey
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: valkey
      helm.toolkit.fluxcd.io/name: vmcp-oauth-valkey
      helm.toolkit.fluxcd.io/namespace: flux-system
  automountServiceAccountToken: false

(root level)
+ one document added:
  apiVersion: v1
  kind: ConfigMap
  metadata:
    name: vmcp-oauth-valkey-init-scripts
    namespace: mcp-servers
    labels:
      app.kubernetes.io/instance: vmcp-oauth-valkey
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: valkey
      helm.toolkit.fluxcd.io/name: vmcp-oauth-valkey
      helm.toolkit.fluxcd.io/namespace: flux-system
  data:
    init.sh: |
      #!/bin/sh
      set -eu
      
      # Default config paths
      VALKEY_CONFIG=${VALKEY_CONFIG_PATH:-/data/conf/valkey.conf}
      
      LOGFILE="/data/init.log"
      DATA_DIR="/data/conf"
      
      # Logging function (outputs to stderr and file)
      log() {
        echo "$(date) $1" | tee -a "$LOGFILE" >&2
      }
      # Function to get password for a user
      # Usage: get_user_password <username> [password_key]
      # Returns: password via stdout, exits with error if not found
      get_user_password() {
        username="$1"
        password_key="${2:-$username}"
        password=""
        # Try to get password from existing secret first (priority)
        if [ -f "/valkey-users-secret/$password_key" ]; then
          password=$(cat "/valkey-users-secret/$password_key")
          log "Using password from existing secret for user $username"
        elif [ -f "/valkey-auth-secret/${username}-password" ]; then
          # Fallback to inline password
          password=$(cat "/valkey-auth-secret/${username}-password")
          log "Using inline password for user $username"
        else
          log "ERROR: No password found for user $username"
          return 1
        fi
      
        echo "$password"
      }
      
      # Clean old log if requested
      if [ "${KEEP_OLD_LOGS:-false}" != "true" ]; then
        rm -f "$LOGFILE"
      fi
      
      if [ -f "$LOGFILE" ]; then
        log "Detected restart of this instance ($HOSTNAME)"
      fi
      
      log "Creating configuration in $DATA_DIR..."
      mkdir -p "$DATA_DIR"
      rm -f "$VALKEY_CONFIG"
      
      
      # Base valkey.conf
      log "Generating base valkey.conf"
      {
        echo "port 6379"
        echo "protected-mode no"
        echo "bind * -::*"
        echo "dir /data"
      } >>"$VALKEY_CONFIG"
      # Create secure directory for ACL file
      log "Creating /etc/valkey directory for ACL file"
      mkdir -p /etc/valkey
      
      # Set aclfile path in valkey.conf
      echo "aclfile /etc/valkey/users.acl" >>"$VALKEY_CONFIG"
      
      # Remove or reset existing ACL file if present (it may be read-only from previous run)
      log "Preparing ACL file at /etc/valkey/users.acl"
      if [ -f /etc/valkey/users.acl ]; then
        log "Removing existing read-only users.acl file"
        chmod 0600 /etc/valkey/users.acl
        rm -f /etc/valkey/users.acl
      fi
      
      # Create ACL file with secure permissions
      touch /etc/valkey/users.acl
      chmod 0600 /etc/valkey/users.acl
      # Generate ACL entries for each user
      log "Generating ACL entries for users"
      
      # User: default
      PASSWORD=$(get_user_password "default" "default-password") || exit 1
      
      # Hash the password and write ACL entry
      PASSHASH=$(echo -n "$PASSWORD" | sha256sum | cut -f 1 -d " ")
      echo "user default on #$PASSHASH ~vmcp-oauth-sessions:* &* +@all -@dangerous" >> /etc/valkey/users.acl
      
      # User: thv-auth
      PASSWORD=$(get_user_password "thv-auth" "thv-auth-password") || exit 1
      
      # Hash the password and write ACL entry
      PASSHASH=$(echo -n "$PASSWORD" | sha256sum | cut -f 1 -d " ")
      echo "user thv-auth on #$PASSHASH +@read +@write +@keyspace +@scripting +@transaction +@connection ~thv:auth:* &*" >> /etc/valkey/users.acl
      
      # Set final permissions
      chmod 0400 /etc/valkey/users.acl
      log "ACL file created with 0400 permissions"
      
      # Append extra configs if present
      if [ -f /usr/local/etc/valkey/valkey.conf ]; then
        log "Appending /usr/local/etc/valkey/valkey.conf"
        cat /usr/local/etc/valkey/valkey.conf >>"$VALKEY_CONFIG"
      fi
      if [ -d /extravalkeyconfigs ]; then
        log "Appending files in /extravalkeyconfigs/"
        cat /extravalkeyconfigs/* >>"$VALKEY_CONFIG"
      fi
  


(root level)
+ one document added:
  apiVersion: v1
  kind: PersistentVolumeClaim
  metadata:
    name: vmcp-oauth-valkey
    namespace: mcp-servers
    labels:
      app.kubernetes.io/instance: vmcp-oauth-valkey
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: valkey
      helm.toolkit.fluxcd.io/name: vmcp-oauth-valkey
      helm.toolkit.fluxcd.io/namespace: flux-system
  spec:
    resources:
      requests:
        storage: 8Gi
    storageClassName: longhorn
    volumeMode: Filesystem
    accessModes:
    - ReadWriteOnce

(root level)
+ one document added:
  apiVersion: v1
  kind: Service
  metadata:
    name: vmcp-oauth-valkey
    namespace: mcp-servers
    labels:
      app.kubernetes.io/component: primary
      app.kubernetes.io/instance: vmcp-oauth-valkey
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: valkey
      helm.toolkit.fluxcd.io/name: vmcp-oauth-valkey
      helm.toolkit.fluxcd.io/namespace: flux-system
  spec:
    type: ClusterIP
    selector:
      app.kubernetes.io/instance: vmcp-oauth-valkey
      app.kubernetes.io/name: valkey
    ports:
    - name: tcp
      port: 6379
      protocol: TCP
      targetPort: tcp

(root level)
+ one document added:
  apiVersion: apps/v1
  kind: Deployment
  metadata:
    name: vmcp-oauth-valkey
    namespace: mcp-servers
    labels:
      app.kubernetes.io/instance: vmcp-oauth-valkey
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: valkey
      helm.toolkit.fluxcd.io/name: vmcp-oauth-valkey
      helm.toolkit.fluxcd.io/namespace: flux-system
  spec:
    replicas: 1
    selector:
      matchLabels:
        app.kubernetes.io/instance: vmcp-oauth-valkey
        app.kubernetes.io/name: valkey
    strategy:
      type: RollingUpdate
    template:
      metadata:
        labels:
          app.kubernetes.io/instance: vmcp-oauth-valkey
          app.kubernetes.io/name: valkey
      spec:
        automountServiceAccountToken: false
        containers:
        - name: vmcp-oauth-valkey
          image: "docker.io/valkey/valkey:9.0.1"
          imagePullPolicy: IfNotPresent
          resources: {}
          args:
          - /data/conf/valkey.conf
          command:
          - valkey-server
          env:
          - name: VALKEY_LOGLEVEL
            value: notice
          ports:
          - name: tcp
            containerPort: 6379
            protocol: TCP
          volumeMounts:
          - name: valkey-data
            mountPath: /data
          - name: valkey-acl
            mountPath: /etc/valkey
          livenessProbe:
            exec:
              command:
              - sh
              - "-c"
              - "valkey-cli ping"
          securityContext:
            capabilities:
              drop:
              - ALL
            readOnlyRootFilesystem: true
            runAsNonRoot: true
            runAsUser: 1000
          startupProbe:
            exec:
              command:
              - sh
              - "-c"
              - "valkey-cli ping"
        initContainers:
        - name: vmcp-oauth-valkey-init
          image: "docker.io/valkey/valkey:9.0.1"
          imagePullPolicy: IfNotPresent
          command:
          - /scripts/init.sh
          volumeMounts:
          - name: valkey-data
            mountPath: /data
          - name: scripts
            mountPath: /scripts
          - name: valkey-acl
            mountPath: /etc/valkey
          - name: valkey-users-secret
            mountPath: /valkey-users-secret
            readOnly: true
          securityContext:
            capabilities:
              drop:
              - ALL
            readOnlyRootFilesystem: true
            runAsNonRoot: true
            runAsUser: 1000
        securityContext:
          fsGroup: 1000
          runAsGroup: 1000
          runAsUser: 1000
        serviceAccountName: vmcp-oauth-valkey
        volumes:
        - name: scripts
          configMap:
            name: vmcp-oauth-valkey-init-scripts
            defaultMode: 365
        - name: valkey-acl
          emptyDir:
            medium: Memory
        - name: valkey-users-secret
          secret:
            defaultMode: 256
            secretName: vmcp-oauth-valkey-acl-passwords
        - name: valkey-data
          persistentVolumeClaim:
            claimName: vmcp-oauth-valkey

Pipeline

## flate diff ``` (root level) + one document added: apiVersion: v1 kind: ServiceAccount metadata: name: bluesky-pds namespace: apps-bluesky-pds labels: app.kubernetes.io/instance: bluesky-pds app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: bluesky-pds helm.toolkit.fluxcd.io/name: bluesky-pds helm.toolkit.fluxcd.io/namespace: flux-system (root level) + one document added: apiVersion: v1 kind: PersistentVolumeClaim metadata: name: bluesky-pds-data namespace: apps-bluesky-pds labels: app.kubernetes.io/instance: bluesky-pds app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: bluesky-pds helm.toolkit.fluxcd.io/name: bluesky-pds helm.toolkit.fluxcd.io/namespace: flux-system spec: resources: requests: storage: 10Gi storageClassName: longhorn accessModes: - ReadWriteOnce (root level) + one document added: apiVersion: v1 kind: Service metadata: name: bluesky-pds namespace: apps-bluesky-pds labels: app.kubernetes.io/instance: bluesky-pds app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: bluesky-pds helm.toolkit.fluxcd.io/name: bluesky-pds helm.toolkit.fluxcd.io/namespace: flux-system spec: type: ClusterIP selector: app.kubernetes.io/instance: bluesky-pds app.kubernetes.io/name: bluesky-pds ports: - name: pds-port port: 3000 protocol: TCP targetPort: pds-port (root level) + one document added: apiVersion: apps/v1 kind: Deployment metadata: name: bluesky-pds namespace: apps-bluesky-pds labels: app.kubernetes.io/instance: bluesky-pds app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: bluesky-pds helm.toolkit.fluxcd.io/name: bluesky-pds helm.toolkit.fluxcd.io/namespace: flux-system spec: replicas: 1 selector: matchLabels: app.kubernetes.io/instance: bluesky-pds app.kubernetes.io/name: bluesky-pds strategy: type: Recreate template: metadata: labels: app.kubernetes.io/instance: bluesky-pds app.kubernetes.io/name: bluesky-pds spec: containers: - name: bluesky-pds image: "ghcr.io/bluesky-social/pds:0.4.158" imagePullPolicy: IfNotPresent resources: {} securityContext: {} livenessProbe: httpGet: path: /xrpc/_health port: pds-port ports: - name: pds-port containerPort: 3000 protocol: TCP volumeMounts: - name: data mountPath: /pds env: - name: PDS_HOSTNAME value: pds.var.aether.earth - name: PDS_JWT_SECRET valueFrom: secretKeyRef: name: pds-sensitive key: jwtSecret - name: PDS_ADMIN_PASSWORD valueFrom: secretKeyRef: name: pds-sensitive key: adminPassword - name: PDS_PLC_ROTATION_KEY_K256_PRIVATE_KEY_HEX valueFrom: secretKeyRef: name: pds-sensitive key: plcRotationKey - name: PDS_EMAIL_SMTP_URL valueFrom: secretKeyRef: name: pds-sensitive key: emailSmtpUrl - name: PDS_DATA_DIRECTORY value: /pds - name: PDS_BLOBSTORE_DISK_LOCATION value: /pds/blocks - name: PDS_DID_PLC_URL value: "https://plc.directory" - name: PDS_BSKY_APP_VIEW_URL value: "https://api.bsky.app" - name: PDS_BSKY_APP_VIEW_DID value: "did:web:api.bsky.app" - name: PDS_REPORT_SERVICE_URL value: "https://mod.bsky.app" - name: PDS_REPORT_SERVICE_DID value: "did:plc:ar7c4by46qjdydhdevvrndac" - name: PDS_CRAWLERS value: "https://bsky.network" - name: LOG_ENABLED value: - name: PDS_EMAIL_FROM_ADDRESS value: atproto@aether.earth securityContext: {} serviceAccountName: bluesky-pds volumes: - name: data persistentVolumeClaim: claimName: bluesky-pds-data (root level) + one document added: apiVersion: v1 kind: ServiceAccount metadata: name: crowci-agent namespace: apps-crowci labels: app.kubernetes.io/instance: crowci app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: crow-server helm.toolkit.fluxcd.io/name: crowci helm.toolkit.fluxcd.io/namespace: flux-system (root level) + one document added: apiVersion: v1 kind: ServiceAccount metadata: name: crowci-server namespace: apps-crowci labels: app.kubernetes.io/instance: crowci app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: crow-server helm.toolkit.fluxcd.io/name: crowci helm.toolkit.fluxcd.io/namespace: flux-system (root level) + one document added: apiVersion: v1 kind: ConfigMap metadata: name: crowci-grafana-dashboards-crow-dashboard.json namespace: apps-crowci labels: app.kubernetes.io/instance: crowci app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: crow-server helm.toolkit.fluxcd.io/name: crowci helm.toolkit.fluxcd.io/namespace: flux-system data: crow-dashboard.json: | { "__inputs": [ { "name": "DS_PROMETHEUS", "label": "Prometheus", "description": "", "type": "datasource", "pluginId": "prometheus", "pluginName": "Prometheus" } ], "__elements": {}, "__requires": [ { "type": "grafana", "id": "grafana", "name": "Grafana", "version": "10.0.0" }, { "type": "datasource", "id": "prometheus", "name": "Prometheus", "version": "1.0.0" }, { "type": "panel", "id": "timeseries", "name": "Time series", "version": "" }, { "type": "panel", "id": "stat", "name": "Stat", "version": "" }, { "type": "panel", "id": "heatmap", "name": "Heatmap", "version": "" } ], "annotations": { "list": [ { "builtIn": 1, "datasource": { "type": "grafana", "uid": "-- Grafana --" }, "enable": true, "hide": true, "iconColor": "rgba(0, 211, 255, 1)", "name": "Annotations & Alerts", "type": "dashboard" } ] }, "editable": true, "fiscalYearStartMonth": 0, "graphTooltip": 1, "id": null, "links": [], "panels": [ { "collapsed": false, "gridPos": { "h": 1, "w": 24, "x": 0, "y": 0 }, "id": 100, "title": "Overview", "type": "row" }, { "datasource": { "type": "prometheus", "uid": "${DS_PROMETHEUS}" }, "fieldConfig": { "defaults": { "thresholds": { "mode": "absolute", "steps": [{ "color": "green", "value": null }] }, "color": { "mode": "thresholds" } }, "overrides": [] }, "gridPos": { "h": 4, "w": 4, "x": 0, "y": 1 }, "id": 1, "options": { "reduceOptions": { "calcs": ["lastNotNull"], "fields": "", "values": false }, "orientation": "auto", "textMode": "auto", "colorMode": "value", "graphMode": "none" }, "title": "Total Pipelines", "type": "stat", "targets": [ { "expr": "sum(crow_pipeline_total_count)", "legendFormat": "", "refId": "A" } ] }, { "datasource": { "type": "prometheus", "uid": "${DS_PROMETHEUS}" }, "fieldConfig": { "defaults": { "thresholds": { "mode": "absolute", "steps": [{ "color": "green", "value": null }] }, "color": { "mode": "thresholds" } }, "overrides": [] }, "gridPos": { "h": 4, "w": 4, "x": 4, "y": 1 }, "id": 2, "options": { "reduceOptions": { "calcs": ["lastNotNull"], "fields": "", "values": false }, "orientation": "auto", "textMode": "auto", "colorMode": "value", "graphMode": "none" }, "title": "Total Repos", "type": "stat", "targets": [ { "expr": "sum(crow_repo_count)", "legendFormat": "", "refId": "A" } ] }, { "datasource": { "type": "prometheus", "uid": "${DS_PROMETHEUS}" }, "fieldConfig": { "defaults": { "thresholds": { "mode": "absolute", "steps": [{ "color": "green", "value": null }] }, "color": { "mode": "thresholds" } }, "overrides": [] }, "gridPos": { "h": 4, "w": 4, "x": 8, "y": 1 }, "id": 3, "options": { "reduceOptions": { "calcs": ["lastNotNull"], "fields": "", "values": false }, "orientation": "auto", "textMode": "auto", "colorMode": "value", "graphMode": "none" }, "title": "Total Users", "type": "stat", "targets": [ { "expr": "sum(crow_user_count)", "legendFormat": "", "refId": "A" } ] }, { "datasource": { "type": "prometheus", "uid": "${DS_PROMETHEUS}" }, "fieldConfig": { "defaults": { "thresholds": { "mode": "absolute", "steps": [ { "color": "red", "value": null }, { "color": "green", "value": 1 } ] }, "color": { "mode": "thresholds" } }, "overrides": [] }, "gridPos": { "h": 4, "w": 4, "x": 12, "y": 1 }, "id": 4, "options": { "reduceOptions": { "calcs": ["lastNotNull"], "fields": "", "values": false }, "orientation": "auto", "textMode": "auto", "colorMode": "value", "graphMode": "area" }, "title": "Connected Agents", "type": "stat", "targets": [ { "expr": "sum(crow_connected_agents)", "legendFormat": "", "refId": "A" } ] }, { "datasource": { "type": "prometheus", "uid": "${DS_PROMETHEUS}" }, "fieldConfig": { "defaults": { "thresholds": { "mode": "absolute", "steps": [{ "color": "green", "value": null }] }, "color": { "mode": "thresholds" } }, "overrides": [] }, "gridPos": { "h": 4, "w": 4, "x": 16, "y": 1 }, "id": 5, "options": { "reduceOptions": { "calcs": ["lastNotNull"], "fields": "", "values": false }, "orientation": "auto", "textMode": "auto", "colorMode": "value", "graphMode": "area" }, "title": "Workers", "type": "stat", "targets": [ { "expr": "sum(crow_worker_count)", "legendFormat": "", "refId": "A" } ] }, { "datasource": { "type": "prometheus", "uid": "${DS_PROMETHEUS}" }, "fieldConfig": { "defaults": { "thresholds": { "mode": "absolute", "steps": [ { "color": "green", "value": null }, { "color": "yellow", "value": 5 }, { "color": "red", "value": 20 } ] }, "color": { "mode": "thresholds" } }, "overrides": [] }, "gridPos": { "h": 4, "w": 4, "x": 20, "y": 1 }, "id": 6, "options": { "reduceOptions": { "calcs": ["lastNotNull"], "fields": "", "values": false }, "orientation": "auto", "textMode": "auto", "colorMode": "value", "graphMode": "area" }, "title": "Pending Steps", "type": "stat", "targets": [ { "expr": "sum(crow_pending_steps)", "legendFormat": "", "refId": "A" } ] }, { "collapsed": false, "gridPos": { "h": 1, "w": 24, "x": 0, "y": 5 }, "id": 101, "title": "Pipeline Activity", "type": "row" }, { "datasource": { "type": "prometheus", "uid": "${DS_PROMETHEUS}" }, "fieldConfig": { "defaults": { "custom": { "drawStyle": "line", "lineInterpolation": "smooth", "fillOpacity": 20, "pointSize": 5, "showPoints": "auto", "stacking": { "mode": "none" }, "axisLabel": "pipelines/min" }, "color": { "mode": "palette-classic" }, "unit": "opm" }, "overrides": [ { "matcher": { "id": "byName", "options": "success" }, "properties": [{ "id": "color", "value": { "fixedColor": "green", "mode": "fixed" } }] }, { "matcher": { "id": "byName", "options": "failure" }, "properties": [{ "id": "color", "value": { "fixedColor": "red", "mode": "fixed" } }] } ] }, "gridPos": { "h": 8, "w": 12, "x": 0, "y": 6 }, "id": 10, "options": { "tooltip": { "mode": "multi", "sort": "desc" }, "legend": { "displayMode": "list", "placement": "bottom" } }, "title": "Pipeline Rate", "type": "timeseries", "targets": [ { "expr": "sum(rate(crow_pipeline_count{repo=~\"$repo\", branch=~\"$branch\", pipeline=\"total\", status=\"success\"}[$__rate_interval]))", "legendFormat": "success", "refId": "A" }, { "expr": "sum(rate(crow_pipeline_count{repo=~\"$repo\", branch=~\"$branch\", pipeline=\"total\", status=\"failure\"}[$__rate_interval]))", "legendFormat": "failure", "refId": "B" } ] }, { "datasource": { "type": "prometheus", "uid": "${DS_PROMETHEUS}" }, "fieldConfig": { "defaults": { "custom": { "drawStyle": "line", "lineInterpolation": "smooth", "fillOpacity": 10, "pointSize": 5, "showPoints": "auto", "stacking": { "mode": "none" } }, "color": { "mode": "palette-classic" }, "unit": "s" }, "overrides": [] }, "gridPos": { "h": 8, "w": 12, "x": 12, "y": 6 }, "id": 11, "options": { "tooltip": { "mode": "multi", "sort": "desc" }, "legend": { "displayMode": "list", "placement": "bottom" } }, "title": "Pipeline Duration Percentiles", "type": "timeseries", "targets": [ { "expr": "histogram_quantile(0.50, sum(rate(crow_pipeline_duration_seconds_bucket{repo=~\"$repo\", branch=~\"$branch\"}[$__rate_interval])) by (le))", "legendFormat": "p50", "refId": "A" }, { "expr": "histogram_quantile(0.90, sum(rate(crow_pipeline_duration_seconds_bucket{repo=~\"$repo\", branch=~\"$branch\"}[$__rate_interval])) by (le))", "legendFormat": "p90", "refId": "B" }, { "expr": "histogram_quantile(0.99, sum(rate(crow_pipeline_duration_seconds_bucket{repo=~\"$repo\", branch=~\"$branch\"}[$__rate_interval])) by (le))", "legendFormat": "p99", "refId": "C" } ] }, { "datasource": { "type": "prometheus", "uid": "${DS_PROMETHEUS}" }, "fieldConfig": { "defaults": { "color": { "mode": "palette-classic" }, "custom": { "drawStyle": "bars", "fillOpacity": 80, "stacking": { "mode": "normal" } }, "unit": "short" }, "overrides": [ { "matcher": { "id": "byRegexp", "options": ".*success" }, "properties": [{ "id": "color", "value": { "fixedColor": "green", "mode": "fixed" } }] }, { "matcher": { "id": "byRegexp", "options": ".*failure" }, "properties": [{ "id": "color", "value": { "fixedColor": "red", "mode": "fixed" } }] } ] }, "gridPos": { "h": 8, "w": 12, "x": 0, "y": 14 }, "id": 12, "options": { "tooltip": { "mode": "multi", "sort": "desc" }, "legend": { "displayMode": "list", "placement": "bottom" } }, "title": "Pipelines by Repo", "type": "timeseries", "targets": [ { "expr": "sum by (repo) (increase(crow_pipeline_count{repo=~\"$repo\", branch=~\"$branch\", pipeline=\"total\", status=\"success\"}[$__rate_interval]))", "legendFormat": "{{repo}} success", "refId": "A" }, { "expr": "sum by (repo) (increase(crow_pipeline_count{repo=~\"$repo\", branch=~\"$branch\", pipeline=\"total\", status=\"failure\"}[$__rate_interval]))", "legendFormat": "{{repo}} failure", "refId": "B" } ] }, { "datasource": { "type": "prometheus", "uid": "${DS_PROMETHEUS}" }, "fieldConfig": { "defaults": { "color": { "mode": "scheme", "schemeName": "YlOrRd" }, "custom": { "hideFrom": { "legend": false, "tooltip": false, "viz": false } } }, "overrides": [] }, "gridPos": { "h": 8, "w": 12, "x": 12, "y": 14 }, "id": 13, "options": { "calculate": false, "yAxis": { "unit": "s" }, "color": { "mode": "scheme", "scheme": "YlOrRd" }, "cellGap": 1 }, "title": "Pipeline Duration Heatmap", "type": "heatmap", "targets": [ { "expr": "sum(rate(crow_pipeline_duration_seconds_bucket{repo=~\"$repo\", branch=~\"$branch\"}[$__rate_interval])) by (le)", "legendFormat": "{{le}}", "refId": "A" } ] }, { "collapsed": false, "gridPos": { "h": 1, "w": 24, "x": 0, "y": 22 }, "id": 102, "title": "Queue & Agents", "type": "row" }, { "datasource": { "type": "prometheus", "uid": "${DS_PROMETHEUS}" }, "fieldConfig": { "defaults": { "custom": { "drawStyle": "line", "lineInterpolation": "smooth", "fillOpacity": 20, "pointSize": 5, "showPoints": "auto", "stacking": { "mode": "none" } }, "color": { "mode": "palette-classic" }, "unit": "short" }, "overrides": [ { "matcher": { "id": "byName", "options": "pending" }, "properties": [{ "id": "color", "value": { "fixedColor": "yellow", "mode": "fixed" } }] }, { "matcher": { "id": "byName", "options": "running" }, "properties": [{ "id": "color", "value": { "fixedColor": "green", "mode": "fixed" } }] }, { "matcher": { "id": "byName", "options": "waiting on deps" }, "properties": [{ "id": "color", "value": { "fixedColor": "orange", "mode": "fixed" } }] } ] }, "gridPos": { "h": 8, "w": 12, "x": 0, "y": 23 }, "id": 20, "options": { "tooltip": { "mode": "multi", "sort": "desc" }, "legend": { "displayMode": "list", "placement": "bottom" } }, "title": "Queue Depth", "type": "timeseries", "targets": [ { "expr": "sum(crow_pending_steps)", "legendFormat": "pending", "refId": "A" }, { "expr": "sum(crow_running_steps)", "legendFormat": "running", "refId": "B" }, { "expr": "sum(crow_waiting_steps)", "legendFormat": "waiting on deps", "refId": "C" } ] }, { "datasource": { "type": "prometheus", "uid": "${DS_PROMETHEUS}" }, "fieldConfig": { "defaults": { "custom": { "drawStyle": "line", "lineInterpolation": "smooth", "fillOpacity": 20, "pointSize": 5, "showPoints": "auto", "stacking": { "mode": "none" } }, "color": { "mode": "palette-classic" }, "unit": "s" }, "overrides": [] }, "gridPos": { "h": 8, "w": 12, "x": 12, "y": 23 }, "id": 21, "options": { "tooltip": { "mode": "multi", "sort": "desc" }, "legend": { "displayMode": "list", "placement": "bottom" } }, "title": "Queue Wait Time Percentiles", "type": "timeseries", "targets": [ { "expr": "histogram_quantile(0.50, sum(rate(crow_queue_wait_seconds_bucket[$__rate_interval])) by (le))", "legendFormat": "p50", "refId": "A" }, { "expr": "histogram_quantile(0.90, sum(rate(crow_queue_wait_seconds_bucket[$__rate_interval])) by (le))", "legendFormat": "p90", "refId": "B" }, { "expr": "histogram_quantile(0.99, sum(rate(crow_queue_wait_seconds_bucket[$__rate_interval])) by (le))", "legendFormat": "p99", "refId": "C" } ] }, { "datasource": { "type": "prometheus", "uid": "${DS_PROMETHEUS}" }, "fieldConfig": { "defaults": { "custom": { "drawStyle": "line", "lineInterpolation": "smooth", "fillOpacity": 20, "pointSize": 5, "showPoints": "auto", "stacking": { "mode": "none" } }, "color": { "mode": "palette-classic" }, "unit": "short" }, "overrides": [] }, "gridPos": { "h": 8, "w": 12, "x": 0, "y": 31 }, "id": 30, "options": { "tooltip": { "mode": "multi", "sort": "desc" }, "legend": { "displayMode": "list", "placement": "bottom" } }, "title": "Connected Agents & Workers", "type": "timeseries", "targets": [ { "expr": "sum(crow_connected_agents)", "legendFormat": "agents", "refId": "A" }, { "expr": "sum(crow_worker_count)", "legendFormat": "workers", "refId": "B" } ] }, { "datasource": { "type": "prometheus", "uid": "${DS_PROMETHEUS}" }, "fieldConfig": { "defaults": { "custom": { "drawStyle": "line", "lineInterpolation": "smooth", "fillOpacity": 20, "pointSize": 5, "showPoints": "auto", "stacking": { "mode": "none" } }, "color": { "mode": "palette-classic" }, "unit": "short" }, "overrides": [ { "matcher": { "id": "byName", "options": "registrations" }, "properties": [{ "id": "color", "value": { "fixedColor": "green", "mode": "fixed" } }] }, { "matcher": { "id": "byName", "options": "unregistrations" }, "properties": [{ "id": "color", "value": { "fixedColor": "red", "mode": "fixed" } }] } ] }, "gridPos": { "h": 8, "w": 12, "x": 12, "y": 31 }, "id": 31, "options": { "tooltip": { "mode": "multi", "sort": "desc" }, "legend": { "displayMode": "list", "placement": "bottom" } }, "title": "Agent Registration Rate", "type": "timeseries", "targets": [ { "expr": "sum(rate(crow_agent_registrations_total[$__rate_interval]))", "legendFormat": "registrations", "refId": "A" }, { "expr": "sum(rate(crow_agent_unregistrations_total[$__rate_interval]))", "legendFormat": "unregistrations", "refId": "B" } ] }, { "collapsed": false, "gridPos": { "h": 1, "w": 24, "x": 0, "y": 39 }, "id": 104, "title": "Server Resources", "type": "row" }, { "datasource": { "type": "prometheus", "uid": "${DS_PROMETHEUS}" }, "fieldConfig": { "defaults": { "custom": { "drawStyle": "line", "lineInterpolation": "smooth", "fillOpacity": 20, "pointSize": 5, "showPoints": "auto", "stacking": { "mode": "none" } }, "color": { "mode": "palette-classic" }, "unit": "bytes" }, "overrides": [] }, "gridPos": { "h": 8, "w": 8, "x": 0, "y": 40 }, "id": 40, "options": { "tooltip": { "mode": "multi", "sort": "desc" }, "legend": { "displayMode": "list", "placement": "bottom" } }, "title": "Memory Usage", "type": "timeseries", "targets": [ { "expr": "sum(go_memstats_alloc_bytes{job=~\"$job\"})", "legendFormat": "alloc", "refId": "A" }, { "expr": "sum(go_memstats_sys_bytes{job=~\"$job\"})", "legendFormat": "sys", "refId": "B" }, { "expr": "sum(process_resident_memory_bytes{job=~\"$job\"})", "legendFormat": "resident", "refId": "C" } ] }, { "datasource": { "type": "prometheus", "uid": "${DS_PROMETHEUS}" }, "fieldConfig": { "defaults": { "custom": { "drawStyle": "line", "lineInterpolation": "smooth", "fillOpacity": 20, "pointSize": 5, "showPoints": "auto", "stacking": { "mode": "none" } }, "color": { "mode": "palette-classic" }, "unit": "short" }, "overrides": [] }, "gridPos": { "h": 8, "w": 8, "x": 8, "y": 40 }, "id": 41, "options": { "tooltip": { "mode": "multi", "sort": "desc" }, "legend": { "displayMode": "list", "placement": "bottom" } }, "title": "Goroutines", "type": "timeseries", "targets": [ { "expr": "sum(go_goroutines{job=~\"$job\"})", "legendFormat": "goroutines", "refId": "A" } ] }, { "datasource": { "type": "prometheus", "uid": "${DS_PROMETHEUS}" }, "fieldConfig": { "defaults": { "custom": { "drawStyle": "line", "lineInterpolation": "smooth", "fillOpacity": 20, "pointSize": 5, "showPoints": "auto", "stacking": { "mode": "none" } }, "color": { "mode": "palette-classic" }, "unit": "percentunit" }, "overrides": [] }, "gridPos": { "h": 8, "w": 8, "x": 16, "y": 40 }, "id": 42, "options": { "tooltip": { "mode": "multi", "sort": "desc" }, "legend": { "displayMode": "list", "placement": "bottom" } }, "title": "CPU Usage", "type": "timeseries", "targets": [ { "expr": "sum(rate(process_cpu_seconds_total{job=~\"$job\"}[$__rate_interval]))", "legendFormat": "cpu", "refId": "A" } ] } ], "schemaVersion": 39, "tags": ["crow", "ci", "cd"], "templating": { "list": [ { "current": { "selected": false, "text": "Prometheus", "value": "Prometheus" }, "hide": 0, "includeAll": false, "name": "DS_PROMETHEUS", "options": [], "query": "prometheus", "refresh": 1, "regex": "", "type": "datasource" }, { "allValue": ".*", "current": { "selected": true, "text": "All", "value": "$__all" }, "datasource": { "type": "prometheus", "uid": "${DS_PROMETHEUS}" }, "definition": "label_values(crow_pipeline_count, repo)", "hide": 0, "includeAll": true, "multi": true, "name": "repo", "options": [], "query": "label_values(crow_pipeline_count, repo)", "refresh": 2, "sort": 1, "type": "query" }, { "allValue": ".*", "current": { "selected": true, "text": "All", "value": "$__all" }, "datasource": { "type": "prometheus", "uid": "${DS_PROMETHEUS}" }, "definition": "label_values(crow_pipeline_count{repo=~\"$repo\"}, branch)", "hide": 0, "includeAll": true, "multi": true, "name": "branch", "options": [], "query": "label_values(crow_pipeline_count{repo=~\"$repo\"}, branch)", "refresh": 2, "sort": 1, "type": "query" }, { "allValue": ".*", "current": { "selected": true, "text": "All", "value": "$__all" }, "datasource": { "type": "prometheus", "uid": "${DS_PROMETHEUS}" }, "definition": "label_values(crow_pipeline_total_count, job)", "hide": 0, "includeAll": true, "multi": false, "name": "job", "options": [], "query": "label_values(crow_pipeline_total_count, job)", "refresh": 2, "sort": 1, "type": "query" } ] }, "time": { "from": "now-6h", "to": "now" }, "timepicker": {}, "timezone": "", "title": "Crow CI", "uid": "crow-ci-overview", "version": 1 } (root level) + one document added: apiVersion: rbac.authorization.k8s.io/v1 kind: Role metadata: name: crowci-agent namespace: apps-crowci labels: app.kubernetes.io/instance: crowci app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: crow-server helm.toolkit.fluxcd.io/name: crowci helm.toolkit.fluxcd.io/namespace: flux-system rules: - resources: - persistentvolumeclaims - services - secrets apiGroups: - verbs: - create - delete - resources: - pods apiGroups: - verbs: - watch - create - delete - get - list - resources: - pods/log apiGroups: - verbs: - get (root level) + one document added: apiVersion: rbac.authorization.k8s.io/v1 kind: Role metadata: name: crowci-server namespace: apps-crowci labels: app.kubernetes.io/instance: crowci app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: crow-server helm.toolkit.fluxcd.io/name: crowci helm.toolkit.fluxcd.io/namespace: flux-system rules: - resources: - services - persistentvolumeclaims - secrets apiGroups: - verbs: - list - delete (root level) + one document added: apiVersion: rbac.authorization.k8s.io/v1 kind: RoleBinding metadata: name: crowci-agent namespace: apps-crowci labels: app.kubernetes.io/instance: crowci app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: crow-server helm.toolkit.fluxcd.io/name: crowci helm.toolkit.fluxcd.io/namespace: flux-system roleRef: name: crowci-agent apiGroup: rbac.authorization.k8s.io kind: Role subjects: - name: crowci-agent kind: ServiceAccount namespace: apps-crowci (root level) + one document added: apiVersion: rbac.authorization.k8s.io/v1 kind: RoleBinding metadata: name: crowci-server namespace: apps-crowci labels: app.kubernetes.io/instance: crowci app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: crow-server helm.toolkit.fluxcd.io/name: crowci helm.toolkit.fluxcd.io/namespace: flux-system roleRef: name: crowci-server apiGroup: rbac.authorization.k8s.io kind: Role subjects: - name: crowci-server kind: ServiceAccount namespace: apps-crowci (root level) + one document added: apiVersion: v1 kind: Service metadata: name: crowci-headless namespace: apps-crowci labels: app.kubernetes.io/instance: crowci app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: crow-server helm.toolkit.fluxcd.io/name: crowci helm.toolkit.fluxcd.io/namespace: flux-system spec: clusterIP: None ports: - name: http port: 80 protocol: TCP targetPort: http - name: grpc port: 9000 protocol: TCP targetPort: grpc - name: metrics port: 9001 protocol: TCP targetPort: metrics selector: app.kubernetes.io/instance: crowci app.kubernetes.io/name: crow-server (root level) + one document added: apiVersion: v1 kind: Service metadata: name: crowci-agent namespace: apps-crowci labels: app.kubernetes.io/instance: crowci app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: crow-agent helm.toolkit.fluxcd.io/name: crowci helm.toolkit.fluxcd.io/namespace: flux-system spec: clusterIP: None ports: - name: http port: 3000 protocol: TCP targetPort: http selector: app.kubernetes.io/instance: crowci app.kubernetes.io/name: crow-agent (root level) + one document added: apiVersion: v1 kind: Service metadata: name: crowci namespace: apps-crowci labels: app.kubernetes.io/instance: crowci app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: crow-server helm.toolkit.fluxcd.io/name: crowci helm.toolkit.fluxcd.io/namespace: flux-system spec: type: ClusterIP selector: app.kubernetes.io/instance: crowci app.kubernetes.io/name: crow-server ports: - name: http port: 80 protocol: TCP targetPort: http - name: grpc port: 9000 protocol: TCP targetPort: grpc - name: metrics port: 9001 protocol: TCP targetPort: metrics (root level) + one document added: apiVersion: apps/v1 kind: StatefulSet metadata: name: crowci-agent namespace: apps-crowci labels: app.kubernetes.io/instance: crowci app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: crow-agent helm.toolkit.fluxcd.io/name: crowci helm.toolkit.fluxcd.io/namespace: flux-system spec: replicas: 2 selector: matchLabels: app.kubernetes.io/instance: crowci app.kubernetes.io/name: crow-agent serviceName: crowci-agent template: metadata: labels: app.kubernetes.io/instance: crowci app.kubernetes.io/name: crow-agent spec: containers: - name: crow image: "codefloe.com/crowci/crow-agent:v6.1.0" imagePullPolicy: IfNotPresent resources: {} securityContext: runAsGroup: 1000 runAsNonRoot: true runAsUser: 1000 env: - name: CROW_SERVER value: "crowci:9000" - name: CROW_BACKEND_K8S_NAMESPACE value: apps-crowci - name: CROW_BACKEND value: kubernetes - name: CROW_BACKEND_K8S_POD_ANNOTATIONS value: - name: CROW_BACKEND_K8S_POD_ANNOTATIONS_ALLOW_FROM_STEP value: "true" - name: CROW_BACKEND_K8S_POD_LABELS value: - name: CROW_BACKEND_K8S_SERVICE_ACCOUNT_NAME_ALLOW_FROM_STEP value: "true" - name: CROW_BACKEND_K8S_STORAGE_CLASS value: longhorn - name: CROW_BACKEND_K8S_STORAGE_RWX value: "true" - name: CROW_BACKEND_K8S_VOLUME_SIZE value: 2Gi - name: CROW_CONNECT_RETRY_COUNT value: "1" - name: CROW_MAX_WORKFLOWS value: "4" ports: - name: http containerPort: 3000 protocol: TCP volumeMounts: - name: agent-config mountPath: /etc/crow envFrom: - secretRef: name: crow-default-agent-secret initContainers: - name: wait-for-server image: "curlimages/curl:latest" args: - | echo "Waiting for server pod to be healthy..." while ! curl -s http://crowci:80/api/healthcheck > /dev/null; do echo "Server not ready yet, waiting 5 seconds..." sleep 5 done echo "Server is healthy, starting agent..." command: - sh - "-c" securityContext: runAsGroup: 1000 runAsNonRoot: true runAsUser: 1000 securityContext: fsGroup: 1000 serviceAccountName: crowci-agent volumeClaimTemplates: - metadata: name: agent-config annotations: null spec: resources: requests: storage: 1Gi accessModes: - ReadWriteOnce (root level) + one document added: apiVersion: apps/v1 kind: StatefulSet metadata: name: crowci-server namespace: apps-crowci annotations: reloader.stakater.com/auto: "true" labels: app.kubernetes.io/instance: crowci app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: crow-server helm.toolkit.fluxcd.io/name: crowci helm.toolkit.fluxcd.io/namespace: flux-system spec: replicas: 1 revisionHistoryLimit: 5 selector: matchLabels: app.kubernetes.io/instance: crowci app.kubernetes.io/name: crow-server serviceName: crowci-headless template: metadata: labels: app.kubernetes.io/instance: crowci app.kubernetes.io/name: crow-server spec: containers: - name: crow image: "codefloe.com/crowci/crow-server:v6.1.0" imagePullPolicy: IfNotPresent resources: {} securityContext: {} env: - name: CROW_ADMIN value: "appboss,crow-admin" - name: CROW_DATABASE_DRIVER value: postgres - name: CROW_FORGES value: aether - name: CROW_FORGE_AETHER_TYPE value: forgejo - name: CROW_FORGE_AETHER_URL value: "https://code.aether.earth" - name: CROW_HOST value: "https://ci.aether.earth/" - name: CROW_OPEN value: "true" - name: CROW_PLUGINS_PRIVILEGED value: "codefloe.com/crow-plugins/docker-buildx:2" - name: CROW_PLUGINS_PRIVILEGED_MATCH_TYPE value: semver - name: CROW_SMTP_FROM value: crowci@aether.earth - name: CROW_SMTP_HOST value: mail-relay.email.svc.cluster.local - name: CROW_SMTP_PORT value: "587" - name: SSL_CERT_FILE value: /etc/ssl/custom-certs/trust-bundle.pem - name: CROW_METRICS_SERVER_ADDR value: ":9001" livenessProbe: httpGet: path: /healthz port: 8000 ports: - name: http containerPort: 8000 protocol: TCP - name: grpc containerPort: 9000 protocol: TCP - name: metrics containerPort: 9001 protocol: TCP readinessProbe: httpGet: path: /healthz port: 8000 startupProbe: failureThreshold: 30 httpGet: path: /healthz port: 8000 periodSeconds: 10 volumeMounts: - name: data mountPath: /var/lib/crow - name: aethernet-certs mountPath: /etc/ssl/custom-certs readOnly: true envFrom: - secretRef: name: crow-default-agent-secret - secretRef: name: crow-stuff initContainers: null securityContext: fsGroup: 1000 serviceAccountName: crowci-server volumes: - name: aethernet-certs configMap: name: aethernet.crt updateStrategy: type: RollingUpdate volumeClaimTemplates: - metadata: name: data spec: resources: requests: storage: 1Gi storageClassName: longhorn accessModes: - ReadWriteOnce (root level) + one document added: apiVersion: v1 kind: ServiceAccount metadata: name: echo namespace: apps-echo labels: app.kubernetes.io/instance: echo app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: echo helm.toolkit.fluxcd.io/name: echo helm.toolkit.fluxcd.io/namespace: flux-system automountServiceAccountToken: false (root level) + one document added: apiVersion: v1 kind: Service metadata: name: echo namespace: apps-echo labels: app.kubernetes.io/instance: echo app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: echo helm.toolkit.fluxcd.io/name: echo helm.toolkit.fluxcd.io/namespace: flux-system spec: type: ClusterIP selector: app.kubernetes.io/instance: echo app.kubernetes.io/name: echo ports: - name: http port: 80 protocol: TCP targetPort: http (root level) + one document added: apiVersion: apps/v1 kind: Deployment metadata: name: echo namespace: apps-echo labels: app.kubernetes.io/instance: echo app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: echo helm.toolkit.fluxcd.io/name: echo helm.toolkit.fluxcd.io/namespace: flux-system spec: replicas: 1 selector: matchLabels: app.kubernetes.io/instance: echo app.kubernetes.io/name: echo template: metadata: labels: app.kubernetes.io/instance: echo app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: echo spec: automountServiceAccountToken: false containers: - name: echo image: "ghcr.io/home-operations/echo@sha256:89e18bc031f50b5fc706a4fc85007f4d44635762146d4f16f49d993fcfde2e39" imagePullPolicy: IfNotPresent env: - name: ECHO_HTTP_PORT value: "8080" - name: ECHO_METRICS_ENABLED value: "false" - name: ECHO_METRICS_PORT value: "8081" - name: ECHO_LOG_LEVEL value: info - name: ECHO_LOG_FORMAT value: json - name: ECHO_DISABLE_REQUEST_LOGS value: "false" - name: ECHO_BACK_TO_CLIENT value: "true" - name: ECHO_MAX_BODY_BYTES value: "1048576" - name: ECHO_COMMANDS_ENABLED value: "true" - name: ECHO_MAX_DELAY value: 10s - name: ECHO_PRETTY_PRINT value: "false" - name: ECHO_WS_ENABLED value: "true" livenessProbe: httpGet: path: /healthz port: http initialDelaySeconds: 5 periodSeconds: 20 ports: - name: http containerPort: 8080 protocol: TCP readinessProbe: httpGet: path: /readyz port: http initialDelaySeconds: 2 periodSeconds: 10 resources: limits: cpu: 100m memory: 64Mi requests: cpu: 10m memory: 32Mi startupProbe: failureThreshold: 30 httpGet: path: /healthz port: http periodSeconds: 5 securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL readOnlyRootFilesystem: true securityContext: fsGroup: 65532 runAsGroup: 65532 runAsNonRoot: true runAsUser: 65532 seccompProfile: type: RuntimeDefault serviceAccountName: echo terminationGracePeriodSeconds: 30 (root level) + one document added: apiVersion: v1 kind: ServiceAccount metadata: name: envoy-gateway namespace: envoy-gateway labels: app.kubernetes.io/instance: envoy-gateway app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: gateway-helm helm.toolkit.fluxcd.io/name: envoy-gateway helm.toolkit.fluxcd.io/namespace: flux-system (root level) + one document added: apiVersion: v1 kind: ConfigMap metadata: name: envoy-gateway-config namespace: envoy-gateway labels: app.kubernetes.io/instance: envoy-gateway app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: gateway-helm helm.toolkit.fluxcd.io/name: envoy-gateway helm.toolkit.fluxcd.io/namespace: flux-system data: envoy-gateway.yaml: | apiVersion: gateway.envoyproxy.io/v1alpha1 kind: EnvoyGateway extensionApis: {} gateway: controllerName: gateway.envoyproxy.io/gatewayclass-controller logging: level: default: info provider: kubernetes: rateLimitDeployment: container: image: mirror.gcr.io/envoyproxy/ratelimit:1e50889b patch: type: StrategicMerge value: spec: template: spec: containers: - imagePullPolicy: IfNotPresent name: envoy-ratelimit shutdownManager: image: mirror.gcr.io/envoyproxy/gateway:v1.8.2 type: Kubernetes (root level) + one document added: apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: name: envoy-gateway-gateway-helm-envoy-gateway-role creationTimestamp: null labels: app.kubernetes.io/instance: envoy-gateway app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: gateway-helm helm.toolkit.fluxcd.io/name: envoy-gateway helm.toolkit.fluxcd.io/namespace: flux-system rules: - resources: - nodes - namespaces apiGroups: - verbs: - get - list - watch - resources: - gatewayclasses apiGroups: - gateway.networking.k8s.io verbs: - get - list - patch - update - watch - resources: - gatewayclasses/status apiGroups: - gateway.networking.k8s.io verbs: - update - resources: - serviceimports apiGroups: - multicluster.x-k8s.io verbs: - get - list - watch - resources: - configmaps - secrets - services apiGroups: - verbs: - get - list - watch - resources: - deployments - daemonsets apiGroups: - apps verbs: - get - list - watch - resources: - endpointslices apiGroups: - discovery.k8s.io verbs: - get - list - watch - resources: - envoyproxies - envoypatchpolicies - clienttrafficpolicies - backendtrafficpolicies - securitypolicies - envoyextensionpolicies - backends - httproutefilters apiGroups: - gateway.envoyproxy.io verbs: - get - list - watch - resources: - envoypatchpolicies/status - clienttrafficpolicies/status - backendtrafficpolicies/status - securitypolicies/status - envoyextensionpolicies/status - backends/status apiGroups: - gateway.envoyproxy.io verbs: - update - resources: - gateways - listenersets - grpcroutes - httproutes - referencegrants - tcproutes - tlsroutes - udproutes - backendtlspolicies apiGroups: - gateway.networking.k8s.io verbs: - get - list - watch - resources: - gateways/status - listenersets/status - grpcroutes/status - httproutes/status - tcproutes/status - tlsroutes/status - udproutes/status - backendtlspolicies/status apiGroups: - gateway.networking.k8s.io verbs: - update - resources: - pods - pods/binding apiGroups: - verbs: - get - list - patch - update - watch (root level) + one document added: apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding metadata: name: envoy-gateway-gateway-helm-envoy-gateway-rolebinding labels: app.kubernetes.io/instance: envoy-gateway app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: gateway-helm helm.toolkit.fluxcd.io/name: envoy-gateway helm.toolkit.fluxcd.io/namespace: flux-system roleRef: name: envoy-gateway-gateway-helm-envoy-gateway-role apiGroup: rbac.authorization.k8s.io kind: ClusterRole subjects: - name: envoy-gateway kind: ServiceAccount namespace: envoy-gateway (root level) + one document added: apiVersion: rbac.authorization.k8s.io/v1 kind: Role metadata: name: envoy-gateway-gateway-helm-infra-manager namespace: envoy-gateway labels: app.kubernetes.io/instance: envoy-gateway app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: gateway-helm helm.toolkit.fluxcd.io/name: envoy-gateway helm.toolkit.fluxcd.io/namespace: flux-system rules: - resources: - serviceaccounts - services - configmaps apiGroups: - verbs: - create - get - list - delete - deletecollection - patch - watch - resources: - deployments - daemonsets apiGroups: - apps verbs: - create - get - list - delete - deletecollection - patch - watch - resources: - horizontalpodautoscalers - poddisruptionbudgets apiGroups: - autoscaling - policy verbs: - create - get - list - delete - deletecollection - patch - watch - resources: - clustertrustbundles apiGroups: - certificates.k8s.io verbs: - list - get - watch (root level) + one document added: apiVersion: rbac.authorization.k8s.io/v1 kind: Role metadata: name: envoy-gateway-gateway-helm-leader-election-role namespace: envoy-gateway labels: app.kubernetes.io/instance: envoy-gateway app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: gateway-helm helm.toolkit.fluxcd.io/name: envoy-gateway helm.toolkit.fluxcd.io/namespace: flux-system rules: - resources: - configmaps apiGroups: - verbs: - get - list - watch - create - update - patch - delete - resources: - leases apiGroups: - coordination.k8s.io verbs: - get - list - watch - create - update - patch - delete - resources: - events apiGroups: - verbs: - create - patch (root level) + one document added: apiVersion: rbac.authorization.k8s.io/v1 kind: RoleBinding metadata: name: envoy-gateway-gateway-helm-infra-manager namespace: envoy-gateway labels: app.kubernetes.io/instance: envoy-gateway app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: gateway-helm helm.toolkit.fluxcd.io/name: envoy-gateway helm.toolkit.fluxcd.io/namespace: flux-system roleRef: name: envoy-gateway-gateway-helm-infra-manager apiGroup: rbac.authorization.k8s.io kind: Role subjects: - name: envoy-gateway kind: ServiceAccount namespace: envoy-gateway (root level) + one document added: apiVersion: rbac.authorization.k8s.io/v1 kind: RoleBinding metadata: name: envoy-gateway-gateway-helm-leader-election-rolebinding namespace: envoy-gateway labels: app.kubernetes.io/instance: envoy-gateway app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: gateway-helm helm.toolkit.fluxcd.io/name: envoy-gateway helm.toolkit.fluxcd.io/namespace: flux-system roleRef: name: envoy-gateway-gateway-helm-leader-election-role apiGroup: rbac.authorization.k8s.io kind: Role subjects: - name: envoy-gateway kind: ServiceAccount namespace: envoy-gateway (root level) + one document added: apiVersion: v1 kind: Service metadata: name: envoy-gateway namespace: envoy-gateway labels: app.kubernetes.io/instance: envoy-gateway app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: gateway-helm control-plane: envoy-gateway helm.toolkit.fluxcd.io/name: envoy-gateway helm.toolkit.fluxcd.io/namespace: flux-system spec: type: ClusterIP selector: app.kubernetes.io/instance: envoy-gateway app.kubernetes.io/name: gateway-helm control-plane: envoy-gateway ports: - name: grpc port: 18000 targetPort: 18000 - name: ratelimit port: 18001 targetPort: 18001 - name: wasm port: 18002 targetPort: 18002 - name: metrics port: 19001 targetPort: 19001 - name: webhook port: 9443 targetPort: 9443 (root level) + one document added: apiVersion: apps/v1 kind: Deployment metadata: name: envoy-gateway namespace: envoy-gateway labels: app.kubernetes.io/instance: envoy-gateway app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: gateway-helm control-plane: envoy-gateway helm.toolkit.fluxcd.io/name: envoy-gateway helm.toolkit.fluxcd.io/namespace: flux-system spec: replicas: 1 selector: matchLabels: app.kubernetes.io/instance: envoy-gateway app.kubernetes.io/name: gateway-helm control-plane: envoy-gateway template: metadata: annotations: prometheus.io/port: "19001" prometheus.io/scrape: "true" labels: app.kubernetes.io/instance: envoy-gateway app.kubernetes.io/name: gateway-helm control-plane: envoy-gateway spec: containers: - name: envoy-gateway image: "mirror.gcr.io/envoyproxy/gateway:v1.8.2" imagePullPolicy: IfNotPresent args: - server - "--config-path=/config/envoy-gateway.yaml" livenessProbe: httpGet: path: /healthz port: 8081 initialDelaySeconds: 15 periodSeconds: 20 ports: - name: grpc containerPort: 18000 - name: ratelimit containerPort: 18001 - name: wasm containerPort: 18002 - name: metrics containerPort: 19001 - name: webhook containerPort: 9443 readinessProbe: httpGet: path: /readyz port: 8081 initialDelaySeconds: 5 periodSeconds: 10 resources: limits: memory: 1024Mi requests: cpu: 100m memory: 256Mi volumeMounts: - name: envoy-gateway-config mountPath: /config readOnly: true - name: certs mountPath: /certs readOnly: true securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL privileged: false runAsGroup: 65532 runAsNonRoot: true runAsUser: 65532 seccompProfile: type: RuntimeDefault env: - name: ENVOY_GATEWAY_NAMESPACE valueFrom: fieldRef: apiVersion: v1 fieldPath: metadata.namespace - name: KUBERNETES_CLUSTER_DOMAIN value: cluster.local imagePullSecrets: [] serviceAccountName: envoy-gateway terminationGracePeriodSeconds: 10 volumes: - name: envoy-gateway-config configMap: name: envoy-gateway-config defaultMode: 420 - name: certs secret: secretName: envoy-gateway (root level) + one document added: apiVersion: admissionregistration.k8s.io/v1 kind: ValidatingAdmissionPolicy metadata: name: safe-upgrades.gateway.networking.k8s.io namespace: envoy-gateway annotations: gateway.networking.k8s.io/bundle-version: v1.5.0-dev gateway.networking.k8s.io/channel: standard labels: helm.toolkit.fluxcd.io/name: envoy-gateway helm.toolkit.fluxcd.io/namespace: flux-system spec: failurePolicy: Fail matchConstraints: resourceRules: - resources: - "*" apiGroups: - apiextensions.k8s.io apiVersions: - v1 operations: - CREATE - UPDATE validations: - expression: "object.spec.group != 'gateway.networking.k8s.io' || oldObject == null || ( has(object.metadata.annotations) && object.metadata.annotations.exists(k, k == 'gateway.networking.k8s.io/channel') && object.metadata.annotations['gateway.networking.k8s.io/channel'] == 'standard' ) || ( oldObject != null && has(oldObject.metadata.annotations) && oldObject.metadata.annotations.exists(k, k == 'gateway.networking.k8s.io/channel') && oldObject.metadata.annotations['gateway.networking.k8s.io/channel'] == 'experimental' )" message: "Installing experimental CRDs on top of standard channel CRDs is prohibited by default. Uninstall ValidatingAdmissionPolicy safe-upgrades.gateway.networking.k8s.io to install experimental CRDs on top of standard channel CRDs." reason: Invalid - expression: "object.spec.group != 'gateway.networking.k8s.io' || (has(object.metadata.annotations) && object.metadata.annotations.exists(k, k == 'gateway.networking.k8s.io/bundle-version') && !matches(object.metadata.annotations['gateway.networking.k8s.io/bundle-version'], 'v1.[0-4].\\\\d+') && !matches(object.metadata.annotations['gateway.networking.k8s.io/bundle-version'], 'v0'))" message: "Installing CRDs with version before v1.5.0 is prohibited by default. Uninstall ValidatingAdmissionPolicy safe-upgrades.gateway.networking.k8s.io to install older versions." reason: Invalid (root level) + one document added: apiVersion: admissionregistration.k8s.io/v1 kind: ValidatingAdmissionPolicyBinding metadata: name: safe-upgrades.gateway.networking.k8s.io namespace: envoy-gateway annotations: gateway.networking.k8s.io/bundle-version: v1.5.0-dev gateway.networking.k8s.io/channel: standard labels: helm.toolkit.fluxcd.io/name: envoy-gateway helm.toolkit.fluxcd.io/namespace: flux-system spec: matchResources: resourceRules: - resources: - customresourcedefinitions apiGroups: - apiextensions.k8s.io apiVersions: - v1 operations: - CREATE - UPDATE policyName: safe-upgrades.gateway.networking.k8s.io validationActions: - Deny (root level) + one document added: apiVersion: v1 kind: ServiceAccount metadata: name: envoy-gateway-gateway-helm-certgen namespace: envoy-gateway annotations: helm.sh/hook: "pre-install, pre-upgrade" helm.sh/hook-weight: "-1" labels: app.kubernetes.io/instance: envoy-gateway app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: gateway-helm (root level) + one document added: apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: name: "envoy-gateway-gateway-helm-certgen:envoy-gateway" annotations: helm.sh/hook: "pre-install, pre-upgrade" helm.sh/hook-weight: "-1" labels: app.kubernetes.io/instance: envoy-gateway app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: gateway-helm rules: - resources: - mutatingwebhookconfigurations apiGroups: - admissionregistration.k8s.io verbs: - get - list - watch - resources: - mutatingwebhookconfigurations apiGroups: - admissionregistration.k8s.io resourceNames: - envoy-gateway-topology-injector.envoy-gateway verbs: - update - patch (root level) + one document added: apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding metadata: name: "envoy-gateway-gateway-helm-certgen:envoy-gateway" annotations: helm.sh/hook: "pre-install, pre-upgrade" helm.sh/hook-weight: "-1" labels: app.kubernetes.io/instance: envoy-gateway app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: gateway-helm roleRef: name: "envoy-gateway-gateway-helm-certgen:envoy-gateway" apiGroup: rbac.authorization.k8s.io kind: ClusterRole subjects: - name: envoy-gateway-gateway-helm-certgen kind: ServiceAccount namespace: envoy-gateway (root level) + one document added: apiVersion: rbac.authorization.k8s.io/v1 kind: Role metadata: name: envoy-gateway-gateway-helm-certgen namespace: envoy-gateway annotations: helm.sh/hook: "pre-install, pre-upgrade" helm.sh/hook-weight: "-1" labels: app.kubernetes.io/instance: envoy-gateway app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: gateway-helm rules: - resources: - secrets apiGroups: - verbs: - get - create - update (root level) + one document added: apiVersion: rbac.authorization.k8s.io/v1 kind: RoleBinding metadata: name: envoy-gateway-gateway-helm-certgen namespace: envoy-gateway annotations: helm.sh/hook: "pre-install, pre-upgrade" helm.sh/hook-weight: "-1" labels: app.kubernetes.io/instance: envoy-gateway app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: gateway-helm roleRef: name: envoy-gateway-gateway-helm-certgen apiGroup: rbac.authorization.k8s.io kind: Role subjects: - name: envoy-gateway-gateway-helm-certgen kind: ServiceAccount namespace: envoy-gateway (root level) + one document added: apiVersion: batch/v1 kind: Job metadata: name: envoy-gateway-gateway-helm-certgen namespace: envoy-gateway annotations: helm.sh/hook: "pre-install, pre-upgrade" labels: app.kubernetes.io/instance: envoy-gateway app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: gateway-helm spec: backoffLimit: 1 completions: 1 parallelism: 1 template: metadata: labels: app: certgen spec: containers: - name: envoy-gateway-certgen image: "mirror.gcr.io/envoyproxy/gateway:v1.8.2" imagePullPolicy: IfNotPresent command: - envoy-gateway - certgen securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL privileged: false readOnlyRootFilesystem: true runAsGroup: 65532 runAsNonRoot: true runAsUser: 65532 seccompProfile: type: RuntimeDefault env: - name: ENVOY_GATEWAY_NAMESPACE valueFrom: fieldRef: apiVersion: v1 fieldPath: metadata.namespace - name: KUBERNETES_CLUSTER_DOMAIN value: cluster.local imagePullSecrets: [] restartPolicy: Never serviceAccountName: envoy-gateway-gateway-helm-certgen ttlSecondsAfterFinished: 30 (root level) + one document added: apiVersion: admissionregistration.k8s.io/v1 kind: MutatingWebhookConfiguration metadata: name: envoy-gateway-topology-injector.envoy-gateway annotations: helm.sh/hook: "pre-install, pre-upgrade" helm.sh/hook-weight: "-1" labels: app.kubernetes.io/component: topology-injector app.kubernetes.io/instance: envoy-gateway app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: gateway-helm webhooks: - name: topology.webhook.gateway.envoyproxy.io failurePolicy: Ignore sideEffects: None admissionReviewVersions: - v1 clientConfig: service: name: envoy-gateway namespace: envoy-gateway path: /inject-pod-topology port: 9443 rules: - resources: - pods/binding apiGroups: - apiVersions: - v1 operations: - CREATE namespaceSelector: matchExpressions: - key: kubernetes.io/metadata.name operator: In values: - envoy-gateway (root level) + one document added: apiVersion: v1 kind: PersistentVolumeClaim metadata: name: gitea-shared-storage namespace: apps-forgejo annotations: helm.sh/resource-policy: keep labels: helm.toolkit.fluxcd.io/name: forgejo helm.toolkit.fluxcd.io/namespace: flux-system spec: resources: requests: storage: 100Gi storageClassName: longhorn volumeMode: Filesystem accessModes: - ReadWriteOnce (root level) + one document added: apiVersion: v1 kind: Service metadata: name: forgejo-http namespace: apps-forgejo labels: version: "15.0.5" app: forgejo app.kubernetes.io/instance: forgejo app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: forgejo helm.toolkit.fluxcd.io/name: forgejo helm.toolkit.fluxcd.io/namespace: flux-system spec: type: ClusterIP selector: app.kubernetes.io/instance: forgejo app.kubernetes.io/name: forgejo ports: - name: http port: 3000 targetPort: http (root level) + one document added: apiVersion: v1 kind: Service metadata: name: forgejo-ssh namespace: apps-forgejo annotations: tailscale.com/hostname: forgejo-ssh labels: version: "15.0.5" app: forgejo app.kubernetes.io/instance: forgejo app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: forgejo helm.toolkit.fluxcd.io/name: forgejo helm.toolkit.fluxcd.io/namespace: flux-system spec: type: LoadBalancer ipFamilyPolicy: RequireDualStack loadBalancerClass: tailscale selector: app.kubernetes.io/instance: forgejo app.kubernetes.io/name: forgejo ports: - name: ssh port: 22 protocol: TCP targetPort: ssh (root level) + one document added: apiVersion: apps/v1 kind: Deployment metadata: name: forgejo annotations: null namespace: apps-forgejo labels: version: "15.0.5" app: forgejo app.kubernetes.io/instance: forgejo app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: forgejo helm.toolkit.fluxcd.io/name: forgejo helm.toolkit.fluxcd.io/namespace: flux-system spec: replicas: 1 selector: matchLabels: app.kubernetes.io/instance: forgejo app.kubernetes.io/name: forgejo strategy: type: Recreate template: metadata: labels: version: "15.0.5" app: forgejo app.kubernetes.io/instance: forgejo app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: forgejo spec: containers: - name: forgejo image: "code.forgejo.org/forgejo/forgejo:15.0.5-rootless" imagePullPolicy: IfNotPresent resources: {} securityContext: {} env: - name: SSH_LISTEN_PORT value: "2222" - name: SSH_PORT value: "2222" - name: GITEA_APP_INI value: /data/gitea/conf/app.ini - name: GITEA_CUSTOM value: /data/gitea - name: GITEA_WORK_DIR value: /data - name: GITEA_TEMP value: /tmp/gitea - name: TMPDIR value: /tmp/gitea - name: HOME value: /data/gitea/git livenessProbe: failureThreshold: 10 initialDelaySeconds: 200 periodSeconds: 10 successThreshold: 1 tcpSocket: port: http timeoutSeconds: 1 ports: - name: ssh containerPort: 2222 - name: http containerPort: 3000 readinessProbe: failureThreshold: 3 httpGet: path: /api/healthz port: http initialDelaySeconds: 5 periodSeconds: 10 successThreshold: 1 timeoutSeconds: 1 volumeMounts: - name: temp mountPath: /tmp - name: data mountPath: /data initContainers: - name: init-directories image: "code.forgejo.org/forgejo/forgejo:15.0.5-rootless" imagePullPolicy: IfNotPresent securityContext: {} command: - /usr/sbin/init_directory_structure.sh env: - name: GITEA_APP_INI value: /data/gitea/conf/app.ini - name: GITEA_CUSTOM value: /data/gitea - name: GITEA_WORK_DIR value: /data - name: GITEA_TEMP value: /tmp/gitea resources: limits: {} requests: cpu: 100m memory: 128Mi volumeMounts: - name: init mountPath: /usr/sbin - name: temp mountPath: /tmp - name: data mountPath: /data - name: init-app-ini image: "code.forgejo.org/forgejo/forgejo:15.0.5-rootless" imagePullPolicy: IfNotPresent securityContext: {} command: - /usr/sbin/config_environment.sh resources: limits: {} requests: cpu: 100m memory: 128Mi volumeMounts: - name: config mountPath: /usr/sbin - name: temp mountPath: /tmp - name: data mountPath: /data - name: inline-config-sources mountPath: /env-to-ini-mounts/inlines/ env: - name: GITEA_APP_INI value: /data/gitea/conf/app.ini - name: GITEA_CUSTOM value: /data/gitea - name: GITEA_WORK_DIR value: /data - name: GITEA_TEMP value: /tmp/gitea - name: FORGEJO__DATABASE__PASSWD valueFrom: secretKeyRef: name: db-forgejo-app key: password - name: FORGEJO__STORAGE__MINIO_ACCESS_KEY_ID valueFrom: secretKeyRef: name: forgejo-s3-creds key: AWS_ACCESS_KEY_ID - name: FORGEJO__STORAGE__MINIO_SECRET_ACCESS_KEY valueFrom: secretKeyRef: name: forgejo-s3-creds key: AWS_SECRET_ACCESS_KEY - name: configure-gitea image: "code.forgejo.org/forgejo/forgejo:15.0.5-rootless" imagePullPolicy: IfNotPresent command: - /usr/sbin/configure_gitea.sh securityContext: runAsUser: 1000 resources: limits: {} requests: cpu: 100m memory: 128Mi volumeMounts: - name: init mountPath: /usr/sbin - name: temp mountPath: /tmp - name: data mountPath: /data env: - name: GITEA_APP_INI value: /data/gitea/conf/app.ini - name: GITEA_CUSTOM value: /data/gitea - name: GITEA_WORK_DIR value: /data - name: GITEA_TEMP value: /tmp/gitea - name: HOME value: /data/gitea/git - name: GITEA_OAUTH_KEY_0 valueFrom: secretKeyRef: name: forgejo-oauth-secret key: key - name: GITEA_OAUTH_SECRET_0 valueFrom: secretKeyRef: name: forgejo-oauth-secret key: secret - name: GITEA_ADMIN_USERNAME valueFrom: secretKeyRef: name: forgejo-admin key: username - name: GITEA_ADMIN_PASSWORD valueFrom: secretKeyRef: name: forgejo-admin key: password - name: GITEA_ADMIN_PASSWORD_MODE value: keepUpdated securityContext: fsGroup: 1000 terminationGracePeriodSeconds: 60 volumes: - name: init secret: defaultMode: 110 secretName: forgejo-init - name: config secret: defaultMode: 110 secretName: forgejo - name: inline-config-sources secret: secretName: forgejo-inline-config - name: temp emptyDir: {} - name: data persistentVolumeClaim: claimName: gitea-shared-storage (root level) + one document added: apiVersion: gateway.networking.k8s.io/v1 kind: HTTPRoute metadata: name: forgejo namespace: apps-forgejo annotations: gatus.home-operations.com/enabled: "true" gatus.home-operations.com/endpoint: "name: \"Forgejo\"" gethomepage.dev/description: "Forgejo code forge" gethomepage.dev/enabled: "true" gethomepage.dev/icon: sh-forgejo gethomepage.dev/name: Forgejo labels: version: "15.0.5" app: forgejo app.kubernetes.io/instance: forgejo app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: forgejo helm.toolkit.fluxcd.io/name: forgejo helm.toolkit.fluxcd.io/namespace: flux-system spec: hostnames: - code.aether.earth parentRefs: - name: envoy-for-outside namespace: envoy-gateway sectionName: https rules: - backendRefs: - name: forgejo-http kind: Service port: 3000 matches: - path: type: PathPrefix value: / (root level) + one document added: apiVersion: monitoring.coreos.com/v1 kind: ServiceMonitor metadata: name: forgejo namespace: apps-forgejo labels: version: "15.0.5" app: forgejo app.kubernetes.io/instance: forgejo app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: forgejo helm.toolkit.fluxcd.io/name: forgejo helm.toolkit.fluxcd.io/namespace: flux-system spec: endpoints: - port: http selector: matchLabels: app.kubernetes.io/instance: forgejo app.kubernetes.io/name: forgejo (root level) + one document added: apiVersion: networking.k8s.io/v1 kind: NetworkPolicy metadata: name: forgejo-valkey namespace: apps-forgejo labels: app.kubernetes.io/instance: forgejo-valkey app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: valkey app.kubernetes.io/part-of: valkey helm.toolkit.fluxcd.io/name: forgejo-valkey helm.toolkit.fluxcd.io/namespace: flux-system spec: egress: - ingress: - ports: - port: 6379 podSelector: matchLabels: app.kubernetes.io/instance: forgejo-valkey app.kubernetes.io/name: valkey policyTypes: - Ingress - Egress (root level) + one document added: apiVersion: policy/v1 kind: PodDisruptionBudget metadata: name: forgejo-valkey-primary namespace: apps-forgejo labels: app.kubernetes.io/component: primary app.kubernetes.io/instance: forgejo-valkey app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: valkey helm.toolkit.fluxcd.io/name: forgejo-valkey helm.toolkit.fluxcd.io/namespace: flux-system spec: maxUnavailable: 1 selector: matchLabels: app.kubernetes.io/component: primary app.kubernetes.io/instance: forgejo-valkey app.kubernetes.io/name: valkey (root level) + one document added: apiVersion: v1 kind: ServiceAccount metadata: name: forgejo-valkey-primary namespace: apps-forgejo labels: app.kubernetes.io/instance: forgejo-valkey app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: valkey app.kubernetes.io/part-of: valkey helm.toolkit.fluxcd.io/name: forgejo-valkey helm.toolkit.fluxcd.io/namespace: flux-system automountServiceAccountToken: false (root level) + one document added: apiVersion: v1 kind: ConfigMap metadata: name: forgejo-valkey-configuration namespace: apps-forgejo labels: app.kubernetes.io/instance: forgejo-valkey app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: valkey app.kubernetes.io/part-of: valkey helm.toolkit.fluxcd.io/name: forgejo-valkey helm.toolkit.fluxcd.io/namespace: flux-system data: primary.conf: | dir /data # User-supplied primary configuration: rename-command FLUSHDB "" rename-command FLUSHALL "" # End of primary configuration replica.conf: | dir /data # User-supplied replica configuration: rename-command FLUSHDB "" rename-command FLUSHALL "" # End of replica configuration valkey.conf: | # User-supplied common configuration: # Enable AOF https://valkey.io/docs/topics/persistence.html appendonly yes # Disable RDB persistence, AOF persistence already enabled. save "" # End of common configuration (root level) + one document added: apiVersion: v1 kind: ConfigMap metadata: name: forgejo-valkey-health namespace: apps-forgejo labels: app.kubernetes.io/instance: forgejo-valkey app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: valkey helm.toolkit.fluxcd.io/name: forgejo-valkey helm.toolkit.fluxcd.io/namespace: flux-system data: ping_liveness_local.sh: | #!/bin/bash [[ -f $VALKEY_PASSWORD_FILE ]] && export VALKEY_PASSWORD="$(< "${VALKEY_PASSWORD_FILE}")" [[ -n "$VALKEY_PASSWORD" ]] && export REDISCLI_AUTH="$VALKEY_PASSWORD" response=$( timeout -s 15 $1 \ valkey-cli \ -h localhost \ -p $VALKEY_PORT \ ping ) if [ "$?" -eq "124" ]; then echo "Timed out" exit 1 fi responseFirstWord=$(echo $response | head -n1 | awk '{print $1;}') if [ "$response" != "PONG" ] && [ "$responseFirstWord" != "LOADING" ] && [ "$responseFirstWord" != "MASTERDOWN" ]; then echo "$response" exit 1 fi ping_liveness_local_and_primary.sh: | script_dir="$(dirname "$0")" exit_status=0 "$script_dir/ping_liveness_local.sh" $1 || exit_status=$? "$script_dir/ping_liveness_primary.sh" $1 || exit_status=$? exit $exit_status ping_liveness_primary.sh: | #!/bin/bash [[ -f $VALKEY_PRIMARY_PASSWORD_FILE ]] && export VALKEY_PRIMARY_PASSWORD="$(< "${VALKEY_PRIMARY_PASSWORD_FILE}")" [[ -n "$VALKEY_PRIMARY_PASSWORD" ]] && export REDISCLI_AUTH="$VALKEY_PRIMARY_PASSWORD" response=$( timeout -s 15 $1 \ valkey-cli \ -h $VALKEY_PRIMARY_HOST \ -p $VALKEY_PRIMARY_PORT_NUMBER \ ping ) if [ "$?" -eq "124" ]; then echo "Timed out" exit 1 fi responseFirstWord=$(echo $response | head -n1 | awk '{print $1;}') if [ "$response" != "PONG" ] && [ "$responseFirstWord" != "LOADING" ]; then echo "$response" exit 1 fi ping_readiness_local.sh: | #!/bin/bash [[ -f $VALKEY_PASSWORD_FILE ]] && export VALKEY_PASSWORD="$(< "${VALKEY_PASSWORD_FILE}")" [[ -n "$VALKEY_PASSWORD" ]] && export REDISCLI_AUTH="$VALKEY_PASSWORD" response=$( timeout -s 15 $1 \ valkey-cli \ -h localhost \ -p $VALKEY_PORT \ ping ) if [ "$?" -eq "124" ]; then echo "Timed out" exit 1 fi if [ "$response" != "PONG" ]; then echo "$response" exit 1 fi ping_readiness_local_and_primary.sh: | script_dir="$(dirname "$0")" exit_status=0 "$script_dir/ping_readiness_local.sh" $1 || exit_status=$? "$script_dir/ping_readiness_primary.sh" $1 || exit_status=$? exit $exit_status ping_readiness_primary.sh: | #!/bin/bash [[ -f $VALKEY_PRIMARY_PASSWORD_FILE ]] && export VALKEY_PRIMARY_PASSWORD="$(< "${VALKEY_PRIMARY_PASSWORD_FILE}")" [[ -n "$VALKEY_PRIMARY_PASSWORD" ]] && export REDISCLI_AUTH="$VALKEY_PRIMARY_PASSWORD" response=$( timeout -s 15 $1 \ valkey-cli \ -h $VALKEY_PRIMARY_HOST \ -p $VALKEY_PRIMARY_PORT_NUMBER \ ping ) if [ "$?" -eq "124" ]; then echo "Timed out" exit 1 fi if [ "$response" != "PONG" ]; then echo "$response" exit 1 fi (root level) + one document added: apiVersion: v1 kind: ConfigMap metadata: name: forgejo-valkey-scripts namespace: apps-forgejo labels: app.kubernetes.io/instance: forgejo-valkey app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: valkey app.kubernetes.io/part-of: valkey helm.toolkit.fluxcd.io/name: forgejo-valkey helm.toolkit.fluxcd.io/namespace: flux-system data: start-primary.sh: | #!/bin/bash [[ -f $VALKEY_PASSWORD_FILE ]] && export VALKEY_PASSWORD="$(< "${VALKEY_PASSWORD_FILE}")" if [[ -f /opt/bitnami/valkey/mounted-etc/primary.conf ]];then cp /opt/bitnami/valkey/mounted-etc/primary.conf /opt/bitnami/valkey/etc/primary.conf fi if [[ -f /opt/bitnami/valkey/mounted-etc/valkey.conf ]];then cp /opt/bitnami/valkey/mounted-etc/valkey.conf /opt/bitnami/valkey/etc/valkey.conf fi ARGS=("--port" "${VALKEY_PORT}") ARGS+=("--protected-mode" "no") ARGS+=("--include" "/opt/bitnami/valkey/etc/valkey.conf") ARGS+=("--include" "/opt/bitnami/valkey/etc/primary.conf") exec valkey-server "${ARGS[@]}" (root level) + one document added: apiVersion: v1 kind: Service metadata: name: forgejo-valkey-headless namespace: apps-forgejo labels: app.kubernetes.io/instance: forgejo-valkey app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: valkey app.kubernetes.io/part-of: valkey helm.toolkit.fluxcd.io/name: forgejo-valkey helm.toolkit.fluxcd.io/namespace: flux-system spec: type: ClusterIP clusterIP: None selector: app.kubernetes.io/instance: forgejo-valkey app.kubernetes.io/name: valkey ports: - name: tcp-redis port: 6379 targetPort: redis (root level) + one document added: apiVersion: v1 kind: Service metadata: name: forgejo-valkey-primary namespace: apps-forgejo labels: app.kubernetes.io/component: primary app.kubernetes.io/instance: forgejo-valkey app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: valkey app.kubernetes.io/part-of: valkey helm.toolkit.fluxcd.io/name: forgejo-valkey helm.toolkit.fluxcd.io/namespace: flux-system spec: type: ClusterIP internalTrafficPolicy: Cluster selector: app.kubernetes.io/component: primary app.kubernetes.io/instance: forgejo-valkey app.kubernetes.io/name: valkey ports: - name: tcp-redis nodePort: null port: 6379 targetPort: redis (root level) + one document added: apiVersion: apps/v1 kind: StatefulSet metadata: name: forgejo-valkey-primary namespace: apps-forgejo labels: app.kubernetes.io/component: primary app.kubernetes.io/instance: forgejo-valkey app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: valkey app.kubernetes.io/part-of: valkey helm.toolkit.fluxcd.io/name: forgejo-valkey helm.toolkit.fluxcd.io/namespace: flux-system spec: replicas: 1 selector: matchLabels: app.kubernetes.io/component: primary app.kubernetes.io/instance: forgejo-valkey app.kubernetes.io/name: valkey serviceName: forgejo-valkey-headless template: metadata: labels: app.kubernetes.io/component: primary app.kubernetes.io/instance: forgejo-valkey app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: valkey spec: affinity: nodeAffinity: null podAffinity: null podAntiAffinity: preferredDuringSchedulingIgnoredDuringExecution: - podAffinityTerm: labelSelector: matchLabels: app.kubernetes.io/component: primary app.kubernetes.io/instance: forgejo-valkey app.kubernetes.io/name: valkey topologyKey: kubernetes.io/hostname weight: 1 automountServiceAccountToken: false containers: - name: valkey image: "registry-1.docker.io/bitnami/valkey:latest" imagePullPolicy: IfNotPresent args: - "-c" - /opt/bitnami/scripts/start-scripts/start-primary.sh command: - /bin/bash env: - name: BITNAMI_DEBUG value: "false" - name: VALKEY_REPLICATION_MODE value: primary - name: ALLOW_EMPTY_PASSWORD value: yes - name: OPENSSL_FIPS value: yes - name: VALKEY_TLS_ENABLED value: no - name: VALKEY_PORT value: "6379" ports: - name: redis containerPort: 6379 resources: limits: cpu: 150m ephemeral-storage: 2Gi memory: 192Mi requests: cpu: 100m ephemeral-storage: 50Mi memory: 128Mi volumeMounts: - name: start-scripts mountPath: /opt/bitnami/scripts/start-scripts - name: health mountPath: /health - name: valkey-data mountPath: /data - name: config mountPath: /opt/bitnami/valkey/mounted-etc - name: empty-dir mountPath: /opt/bitnami/valkey/etc/ subPath: app-conf-dir - name: empty-dir mountPath: /tmp subPath: tmp-dir livenessProbe: exec: command: - sh - "-c" - "/health/ping_liveness_local.sh 5" failureThreshold: 5 initialDelaySeconds: 20 periodSeconds: 5 successThreshold: 1 timeoutSeconds: 6 readinessProbe: exec: command: - sh - "-c" - "/health/ping_readiness_local.sh 1" failureThreshold: 5 initialDelaySeconds: 20 periodSeconds: 5 successThreshold: 1 timeoutSeconds: 2 securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL readOnlyRootFilesystem: true runAsGroup: 1001 runAsNonRoot: true runAsUser: 1001 seLinuxOptions: {} seccompProfile: type: RuntimeDefault enableServiceLinks: true securityContext: fsGroup: 1001 fsGroupChangePolicy: Always supplementalGroups: [] sysctls: [] serviceAccountName: forgejo-valkey-primary terminationGracePeriodSeconds: 30 volumes: - name: start-scripts configMap: name: forgejo-valkey-scripts defaultMode: 493 - name: health configMap: name: forgejo-valkey-health defaultMode: 493 - name: config configMap: name: forgejo-valkey-configuration - name: empty-dir emptyDir: {} updateStrategy: type: RollingUpdate volumeClaimTemplates: - apiVersion: v1 kind: PersistentVolumeClaim metadata: name: valkey-data labels: app.kubernetes.io/component: primary app.kubernetes.io/instance: forgejo-valkey app.kubernetes.io/name: valkey spec: resources: requests: storage: 8Gi storageClassName: longhorn accessModes: - ReadWriteOnce (root level) + one document added: apiVersion: networking.k8s.io/v1 kind: NetworkPolicy metadata: name: gitlab-redis namespace: gitlab labels: app.kubernetes.io/instance: gitlab app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: redis helm.toolkit.fluxcd.io/name: gitlab helm.toolkit.fluxcd.io/namespace: flux-system spec: egress: - ingress: - ports: - port: 6379 - ports: - port: 9121 podSelector: matchLabels: app.kubernetes.io/instance: gitlab app.kubernetes.io/name: redis policyTypes: - Ingress - Egress (root level) + one document added: apiVersion: policy/v1beta1 kind: PodDisruptionBudget metadata: name: gitlab-gitaly namespace: gitlab labels: app: gitaly helm.toolkit.fluxcd.io/name: gitlab helm.toolkit.fluxcd.io/namespace: flux-system heritage: Helm release: gitlab spec: maxUnavailable: 1 selector: matchLabels: app: gitaly release: gitlab (root level) + one document added: apiVersion: policy/v1beta1 kind: PodDisruptionBudget metadata: name: gitlab-gitlab-shell namespace: gitlab labels: app: gitlab-shell helm.toolkit.fluxcd.io/name: gitlab helm.toolkit.fluxcd.io/namespace: flux-system heritage: Helm release: gitlab spec: maxUnavailable: 1 selector: matchLabels: app: gitlab-shell release: gitlab (root level) + one document added: apiVersion: policy/v1beta1 kind: PodDisruptionBudget metadata: name: gitlab-kas namespace: gitlab labels: app: kas helm.toolkit.fluxcd.io/name: gitlab helm.toolkit.fluxcd.io/namespace: flux-system heritage: Helm release: gitlab spec: maxUnavailable: 1 selector: matchLabels: app: kas release: gitlab (root level) + one document added: apiVersion: policy/v1beta1 kind: PodDisruptionBudget metadata: name: gitlab-sidekiq-all-in-1-v1 namespace: gitlab labels: app: sidekiq helm.toolkit.fluxcd.io/name: gitlab helm.toolkit.fluxcd.io/namespace: flux-system heritage: Helm release: gitlab spec: maxUnavailable: 1 selector: matchLabels: app: sidekiq queue-pod-name: all-in-1 release: gitlab (root level) + one document added: apiVersion: policy/v1beta1 kind: PodDisruptionBudget metadata: name: gitlab-webservice-default namespace: gitlab labels: app: webservice gitlab.com/webservice-name: default helm.toolkit.fluxcd.io/name: gitlab helm.toolkit.fluxcd.io/namespace: flux-system heritage: Helm release: gitlab spec: maxUnavailable: 1 selector: matchLabels: app: webservice gitlab.com/webservice-name: default release: gitlab (root level) + one document added: apiVersion: policy/v1beta1 kind: PodDisruptionBudget metadata: name: gitlab-registry-v1 namespace: gitlab labels: app: registry helm.toolkit.fluxcd.io/name: gitlab helm.toolkit.fluxcd.io/namespace: flux-system heritage: Helm release: gitlab spec: maxUnavailable: 1 selector: matchLabels: app: registry release: gitlab (root level) + one document added: apiVersion: v1 kind: ServiceAccount metadata: name: gitlab-runner-access namespace: gitlab labels: app: gitlab-gitlab-runner helm.toolkit.fluxcd.io/name: gitlab helm.toolkit.fluxcd.io/namespace: flux-system heritage: Helm release: gitlab (root level) + one document added: apiVersion: v1 kind: ServiceAccount metadata: name: gitlab-redis-master namespace: gitlab labels: app.kubernetes.io/instance: gitlab app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: redis helm.toolkit.fluxcd.io/name: gitlab helm.toolkit.fluxcd.io/namespace: flux-system automountServiceAccountToken: false (root level) + one document added: apiVersion: v1 kind: ConfigMap metadata: name: gitlab-gitlab-runner namespace: gitlab labels: app: gitlab-gitlab-runner helm.toolkit.fluxcd.io/name: gitlab helm.toolkit.fluxcd.io/namespace: flux-system heritage: Helm release: gitlab data: check-live: | #!/bin/bash set -eou pipefail # default timeout is 3 seconds, can be overriden VERIFY_TIMEOUT=${1:-${VERIFY_TIMEOUT:-3}} if ! /usr/bin/pgrep -f ".*register-the-runner" > /dev/null && ! /usr/bin/pgrep -f "gitlab.*runner" > /dev/null ; then exit 1 fi status=0 # empty --url= helps `gitlab-runner verify` select all configured runners (otherwise filters for $CI_SERVER_URL) verify_output=$(timeout "${VERIFY_TIMEOUT}" gitlab-runner verify --url= 2>&1) || status=$? # timeout exit code is 143 with busybox, and 124 with coreutils if (( status == 143 )) || (( status == 124 )) ; then echo "'gitlab-runner verify' terminated by timeout, not a conclusive failure" >&2 exit 0 elif (( status > 0 )) ; then exit ${status} fi grep -qE "is (alive|valid)" <<<"${verify_output}" config.template.toml: | [[runners]] [runners.kubernetes] image = "archlinux/archlinux:latest" namespace_per_job = true node_selector_overwrite_allowed = "kubernetes.io/arch=.*" pull_policy = ["always", "always"] [runners.kubernetes.node_selector] "kubernetes.io/arch" = "amd64" [runners.cache] Type = "s3" Path = "gitlab-runner" Shared = true [runners.cache.s3] ServerAddress = "brickyard.home.arpa:3900" BucketName = "gitlab-runner-cache" BucketLocation = "apartment" Insecure = true AuthenticationType = "access-key" PathStyle = true config.toml: | shutdown_timeout = 0 concurrent = 10 check_interval = 3 log_level = "info" entrypoint: | #!/bin/bash set -e export CONFIG_PATH_FOR_INIT="/home/gitlab-runner/.gitlab-runner/" mkdir -p ${CONFIG_PATH_FOR_INIT} cp /configmaps/config.toml ${CONFIG_PATH_FOR_INIT} # Set up environment variables for cache if [[ -f /secrets/accesskey && -f /secrets/secretkey ]]; then export CACHE_S3_ACCESS_KEY=$(cat /secrets/accesskey) export CACHE_S3_SECRET_KEY=$(cat /secrets/secretkey) fi if [[ -f /secrets/gcs-applicaton-credentials-file ]]; then export GOOGLE_APPLICATION_CREDENTIALS="/secrets/gcs-applicaton-credentials-file" elif [[ -f /secrets/gcs-application-credentials-file ]]; then export GOOGLE_APPLICATION_CREDENTIALS="/secrets/gcs-application-credentials-file" else if [[ -f /secrets/gcs-access-id && -f /secrets/gcs-private-key ]]; then export CACHE_GCS_ACCESS_ID=$(cat /secrets/gcs-access-id) # echo -e used to make private key multiline (in google json auth key private key is oneline with \n) export CACHE_GCS_PRIVATE_KEY=$(echo -e $(cat /secrets/gcs-private-key)) fi fi if [[ -f /secrets/azure-account-name && -f /secrets/azure-account-key ]]; then export CACHE_AZURE_ACCOUNT_NAME=$(cat /secrets/azure-account-name) export CACHE_AZURE_ACCOUNT_KEY=$(cat /secrets/azure-account-key) fi if [[ -f /secrets/runner-registration-token ]]; then export REGISTRATION_TOKEN=$(cat /secrets/runner-registration-token) fi if [[ -f /secrets/runner-token ]]; then export CI_SERVER_TOKEN=$(cat /secrets/runner-token) fi # Register the runner if ! sh /configmaps/register-the-runner; then exit 1 fi # Run pre-entrypoint-script if ! bash /configmaps/pre-entrypoint-script; then exit 1 fi # Start the runner exec /entrypoint run \ --working-directory=/home/gitlab-runner pre-entrypoint-script: register-the-runner: | #!/bin/sh signal_handler() { if [ ! -d "/proc/$register_pid" ]; then wait $register_pid fi exit } trap 'signal_handler' QUIT INT MAX_REGISTER_ATTEMPTS=30 # Reset/unset the not needed flags when an authentication token RUN_UNTAGGED="" ACCESS_LEVEL="" if [ -n "$CI_SERVER_TOKEN" ] && [ "${CI_SERVER_TOKEN#glrt-}" != "$CI_SERVER_TOKEN" ]; then RUN_UNTAGGED="" ACCESS_LEVEL="" unset REGISTER_LOCKED unset RUNNER_TAG_LIST fi for i in $(seq 1 "${MAX_REGISTER_ATTEMPTS}"); do echo "Registration attempt ${i} of ${MAX_REGISTER_ATTEMPTS}" /entrypoint register \ ${RUN_UNTAGGED} \ ${ACCESS_LEVEL} \ --template-config /configmaps/config.template.toml \ --non-interactive & register_pid=$! wait $register_pid retval=$? if [ ${retval} = 0 ]; then break elif [ ${i} = ${MAX_REGISTER_ATTEMPTS} ]; then exit 1 fi sleep 5 done (root level) + one document added: apiVersion: v1 kind: ConfigMap metadata: name: gitlab-gitaly namespace: gitlab labels: app: gitaly helm.toolkit.fluxcd.io/name: gitlab helm.toolkit.fluxcd.io/namespace: flux-system heritage: Helm release: gitlab data: config.toml.tpl: | # The directory where Gitaly's executables are stored bin_dir = "/usr/local/bin" # listen on a TCP socket. This is insecure (no authentication) listen_addr = ":8075" # Directory where internal sockets reside # note: no value will result in a `/tmp/gitlab-internal-*` path # internal_socket_dir = "/home/git" # If metrics collection is enabled, inform gitaly about that prometheus_listen_addr = ":9236" # Graceful shutdown timeout, how long to wait for in-flight requests to complete graceful_restart_timeout = "25s" # Storage configuration {% $storages := coll.Slice "default" %} {% $hostid := index (.Env.HOSTNAME | strings.Split "-" | coll.Reverse) 0 %} {% $index := 0 %} {% if regexp.Match "^[0-9]+$" $hostid %} {% $index = conv.ToInt64 $hostid %} {% end %} {% if len $storages | lt $index %} [[storage]] name = "{% index $storages $index %}" path = "/home/git/repositories" {% else %} {% printf "Storage for node %d is not present in the storageNames array. Did you use kubectl to scale up? You need to solely use helm for this purpose." $index | fail %} {% end %} [logging] format = "json" dir = "/var/log/gitaly" [auth] token = {% file.Read "/etc/gitlab-secrets/gitaly/gitaly_token" | strings.TrimSpace | data.ToJSON %} [git] use_bundled_binaries = true ignore_gitconfig = true [gitlab-shell] # The directory where gitlab-shell is installed dir = "/srv/gitlab-shell" [gitlab] # location of shared secret for GitLab Shell / API interaction secret_file = "/etc/gitlab-secrets/shell/.gitlab_shell_secret" # URL of API url = "http://gitlab-webservice-default.gitlab.svc:8181/" [gitlab.http-settings] # read_timeout = 300 # user = someone # password = somepass # ca_file = /etc/ssl/cert.pem # ca_path = /etc/pki/tls/certs [hooks] # directory containing custom hooks custom_hooks_dir = "/home/git/custom_hooks" configure: | set -e mkdir -p /init-secrets/gitaly /init-secrets/shell cp -v -r -L /init-config/.gitlab_shell_secret /init-secrets/shell/.gitlab_shell_secret cp -v -r -L /init-config/gitaly_token /init-secrets/gitaly/gitaly_token (root level) + one document added: apiVersion: v1 kind: ConfigMap metadata: name: gitlab-gitlab-exporter namespace: gitlab labels: app: gitlab-exporter helm.toolkit.fluxcd.io/name: gitlab helm.toolkit.fluxcd.io/namespace: flux-system heritage: Helm release: gitlab data: configure: | # BEGIN gitlab.scripts.configure.secrets set -e config_dir="/init-config" secret_dir="/init-secrets" # optional for secret in redis redis-sentinel postgres gitlab-exporter ; do if [ -e "${config_dir}/${secret}" ]; then mkdir -p "${secret_dir}/${secret}" cp -f -v -r -L "${config_dir}/${secret}/." "${secret_dir}/${secret}/" fi done # END gitlab.scripts.configure.secrets gitlab-exporter.yml.erb: | server: name: webrick listen_address: "*" listen_port: 9168 probes: db_common: &db_common methods: - probe_db opts: connection_string: dbname=gitlab-prod user=gitlab host=db-gitlab-rw.gitlab.svc port=5432 password='<%= File.read('/etc/gitlab/postgres/psql-password-main').strip.gsub(/[\'\\]/) { |esc| '\\' + esc } %>' database: multiple: true ci_builds: class_name: Database::CiBuildsProber <<: *db_common tuple_stats: class_name: Database::TuplesProber <<: *db_common rows_count: class_name: Database::RowCountProber <<: *db_common database_bloat: class_name: Database::BloatProber <<: *db_common sidekiq: &sidekiq methods: - probe_queues - probe_workers - probe_retries - probe_stats opts: redis_url: redis://:<%= ERB::Util::url_encode(File.read("/etc/gitlab/redis/redis-password").strip) %>@gitlab-redis-master.gitlab.svc:6379/0 redis_enable_client: false probe_non_namespaced: true ruby: &ruby methods: - probe_gc opts: quantiles: false metrics: multiple: true ruby: <<: *ruby sidekiq: <<: *sidekiq ci_builds: class_name: Database::CiBuildsProber <<: *db_common tuple_stats: class_name: Database::TuplesProber <<: *db_common rows_count: class_name: Database::RowCountProber <<: *db_common pg_sequences: class_name: Database::PgSequencesProber <<: *db_common (root level) + one document added: apiVersion: v1 kind: ConfigMap metadata: name: gitlab-gitlab-shell-sshd namespace: gitlab labels: app: gitlab-shell helm.toolkit.fluxcd.io/name: gitlab helm.toolkit.fluxcd.io/namespace: flux-system heritage: Helm release: gitlab data: sshd_config: | # $OpenBSD: sshd_config,v 1.101 2017/03/14 07:19:07 djm Exp $ # This is the sshd server system-wide configuration file. See # sshd_config(5) for more information. # This sshd was compiled with PATH=/bin:/usr/bin:/sbin:/usr/sbin # The strategy used for options in the default sshd_config shipped with # OpenSSH is to specify options with their default value where # possible, but leave them commented. Uncommented options override the # default value. Port 2222 #AddressFamily any #ListenAddress 0.0.0.0 #ListenAddress :: #HostKey /etc/ssh/ssh_host_rsa_key #HostKey /etc/ssh/ssh_host_dsa_key #HostKey /etc/ssh/ssh_host_ecdsa_key #HostKey /etc/ssh/ssh_host_ed25519_key # Ciphers and keying #RekeyLimit default none # Logging #SyslogFacility AUTH LogLevel ERROR # Authentication: PermitRootLogin no #StrictModes yes #MaxAuthTries 6 #MaxSessions 10 #PubkeyAuthentication yes #AuthorizedPrincipalsFile none # For this to work you will also need host keys in /etc/ssh/ssh_known_hosts #HostbasedAuthentication no # Change to yes if you don't trust ~/.ssh/known_hosts for # HostbasedAuthentication #IgnoreUserKnownHosts no # Don't read the user's ~/.rhosts and ~/.shosts files #IgnoreRhosts yes #PermitEmptyPasswords no # Change to no to disable s/key passwords #ChallengeResponseAuthentication yes # Kerberos options #KerberosAuthentication no #KerberosOrLocalPasswd yes #KerberosTicketCleanup yes #KerberosGetAFSToken no # GSSAPI options #GSSAPIAuthentication no #GSSAPICleanupCredentials yes # Set this to 'yes' to enable PAM authentication, account processing, # and session processing. If this is enabled, PAM authentication will # be allowed through the ChallengeResponseAuthentication and # PasswordAuthentication. Depending on your PAM configuration, # PAM authentication via ChallengeResponseAuthentication may bypass # the setting of "PermitRootLogin without-password". # If you just want the PAM account and session checks to run without # PAM authentication, then enable this but set PasswordAuthentication # and ChallengeResponseAuthentication to 'no'. #UsePAM no #AllowAgentForwarding yes #AllowTcpForwarding yes #GatewayPorts no #X11Forwarding no #X11DisplayOffset 10 #X11UseLocalhost yes #PermitTTY yes #PrintMotd yes #PrintLastLog yes #TCPKeepAlive yes #UseLogin no #PermitUserEnvironment no #Compression delayed ClientAliveInterval 0 #ClientAliveCountMax 3 #UseDNS no PidFile /srv/sshd/sshd.pid #PermitTunnel no #ChrootDirectory none #VersionAddendum none # no default banner path #Banner none # override default of no subsystems # Subsystem sftp /usr/lib/ssh/sftp-server # the following are HPN related configuration options # tcp receive buffer polling. disable in non autotuning kernels #TcpRcvBufPoll yes # disable hpn performance boosts #HPNDisabled no # buffer size for hpn to non-hpn connections #HPNBufferSize 2048 # Example of overriding settings on a per-user basis #Match User anoncvs # X11Forwarding no # AllowTcpForwarding no # PermitTTY no # ForceCommand cvs server # The default is to check both .ssh/authorized_keys and .ssh/authorized_keys2 # but this is overridden so installations will only check .ssh/authorized_keys AuthorizedKeysFile .ssh/authorized_keys AuthorizedKeysCommand /authorized_keys %u %k AuthorizedKeysCommandUser git PasswordAuthentication no AllowUsers git # Enable the use of Git protcol v2 AcceptEnv GIT_PROTOCOL # Hard disable all forwarding DisableForwarding yes # Specifies the maximum number of concurrent unauthenticated connections to the SSH daemon. # See `man sshd_config(5)` MaxStartups 10:30:100 # Specifies amount of time athat the server will disconnect after if the user has not successfully logged in LoginGraceTime 60 # Includes Include /etc/ssh/sshd_config.d/*.conf (root level) + one document added: apiVersion: v1 kind: ConfigMap metadata: name: gitlab-gitlab-shell namespace: gitlab labels: app: gitlab-shell helm.toolkit.fluxcd.io/name: gitlab helm.toolkit.fluxcd.io/namespace: flux-system heritage: Helm release: gitlab data: config.yml.tpl: | # GitLab user. git by default user: git # Url to gitlab instance. Used for api calls. Should end with a slash. gitlab_url: "http://gitlab-webservice-default.gitlab.svc:8181/" secret_file: /etc/gitlab-secrets/shell/.gitlab_shell_secret # File used as authorized_keys for gitlab user auth_file: "/home/git/.ssh/authorized_keys" # Log file. # Default is gitlab-shell.log in the root directory. log_file: "/var/log/gitlab-shell/gitlab-shell.log" log_format: json # Audit usernames. # Set to true to see real usernames in the logs instead of key ids, which is easier to follow, but # incurs an extra API call on every gitlab-shell command. audit_usernames: false lfs: pure_ssh_protocol: false pat: enabled: true allowed_scopes: [] configure: | # BEGIN gitlab.scripts.configure.secrets set -e config_dir="/init-config" secret_dir="/init-secrets" # required for secret in shell ; do mkdir -p "${secret_dir}/${secret}" cp -f -v -r -L "${config_dir}/${secret}/." "${secret_dir}/${secret}/" done # END gitlab.scripts.configure.secrets mkdir -p /${secret_dir}/ssh cp -v -r -L /${config_dir}/ssh_host_* /${secret_dir}/ssh/ chmod 0400 /${secret_dir}/ssh/ssh_host_* krb5.conf: (root level) + one document added: apiVersion: v1 kind: ConfigMap metadata: name: gitlab-nginx-ingress-tcp namespace: gitlab labels: app: gitlab-shell helm.toolkit.fluxcd.io/name: gitlab helm.toolkit.fluxcd.io/namespace: flux-system heritage: Helm release: gitlab data: 22222: "gitlab/gitlab-gitlab-shell:22222:PROXY:" (root level) + one document added: apiVersion: v1 kind: ConfigMap metadata: name: gitlab-kas namespace: gitlab labels: app: kas helm.toolkit.fluxcd.io/name: gitlab helm.toolkit.fluxcd.io/namespace: flux-system heritage: Helm release: gitlab data: config.yaml: | agent: kubernetes_api: listen: address: :8154 url_path_prefix: /k8s-proxy websocket_token_secret_file: /etc/kas/.gitlab_kas_websocket_token_secret listen: address: :8150 websocket: true api: listen: address: :8153 authentication_secret_file: /etc/kas/.gitlab_kas_secret gitlab: address: http://gitlab-webservice-default.gitlab.svc:8181 authentication_secret_file: /etc/kas/.gitlab_kas_secret external_url: https://code.nogweii.net observability: listen: address: :8151 liveness_probe: url_path: /liveness readiness_probe: url_path: /readiness private_api: listen: address: :8155 authentication_secret_file: /etc/kas/.gitlab_kas_private_api_secret redis: database_index: 0 password_file: /etc/kas/redis/redis-password server: address: gitlab-redis-master.gitlab.svc:6379 (root level) + one document added: apiVersion: v1 kind: ConfigMap metadata: name: gitlab-migrations namespace: gitlab labels: app: migrations helm.toolkit.fluxcd.io/name: gitlab helm.toolkit.fluxcd.io/namespace: flux-system heritage: Helm release: gitlab data: cable.yml.erb: | production: url: redis://:<%= ERB::Util::url_encode(File.read("/etc/gitlab/redis/redis-password").strip) %>@gitlab-redis-master.gitlab.svc:6379/0 id: adapter: redis configure: | # BEGIN gitlab.scripts.configure.secrets set -e config_dir="/init-config" secret_dir="/init-secrets" # required for secret in rails-secrets migrations gitaly ; do mkdir -p "${secret_dir}/${secret}" cp -f -v -r -L "${config_dir}/${secret}/." "${secret_dir}/${secret}/" done # optional for secret in redis redis-sentinel minio objectstorage postgres ldap duo omniauth smtp kas pages oauth-secrets mailroom gitlab-exporter microsoft_graph_mailer zoekt clickhouse openbao ; do if [ -e "${config_dir}/${secret}" ]; then mkdir -p "${secret_dir}/${secret}" cp -f -v -r -L "${config_dir}/${secret}/." "${secret_dir}/${secret}/" fi done # END gitlab.scripts.configure.secrets database.yml.erb: | production: main: adapter: postgresql encoding: unicode database: gitlab-prod username: gitlab password: <%= File.read('/etc/gitlab/postgres/psql-password-main').strip.to_json %> host: "db-gitlab-rw.gitlab.svc" port: 5432 connect_timeout: keepalives: keepalives_idle: keepalives_interval: keepalives_count: tcp_user_timeout: application_name: prepared_statements: false database_tasks: true ci: adapter: postgresql encoding: unicode database: gitlab-prod username: gitlab password: <%= File.read('/etc/gitlab/postgres/psql-password-ci').strip.to_json %> host: "db-gitlab-rw.gitlab.svc" port: 5432 connect_timeout: keepalives: keepalives_idle: keepalives_interval: keepalives_count: tcp_user_timeout: application_name: prepared_statements: false database_tasks: false gitlab.yml.erb: | production: &base gitlab: host: code.nogweii.net https: true signup_enabled: false # Consolidated object storage configuration ## property local configuration will override object_store object_store: enabled: true proxy_download: true connection: <%= YAML.load_file("/etc/gitlab/objectstorage/object_store").to_json() %> objects: artifacts: bucket: gitlab-artifacts proxy_download: true lfs: bucket: gitlab-lfs proxy_download: true uploads: bucket: gitlab-uploads proxy_download: true packages: bucket: gitlab-packages proxy_download: true external_diffs: bucket: gitlab-external-diffs proxy_download: true terraform_state: bucket: gitlab-terraform-state dependency_proxy: bucket: gitlab-dependency-proxy proxy_download: true ci_secure_files: bucket: gitlab-ci-secure-files pages: bucket: gitlab-pages artifacts: enabled: true lfs: enabled: true uploads: enabled: true packages: enabled: true external_diffs: enabled: true when: terraform_state: enabled: true ci_secure_files: enabled: true gitaly: client_path: /home/git/gitaly/bin token: <%= File.read('/etc/gitlab/gitaly/gitaly_token').strip.to_json %> repositories: storages: # You must have at least a `default` storage path. default: path: /var/opt/gitlab/repo gitaly_address: tcp://gitlab-gitaly-0.gitlab-gitaly.gitlab.svc:8075 sidekiq: log_format: json oidc_provider: openid_id_token_expire_in_seconds: 120 installation_type: | gitlab-helm-chart pages_redirect_uri: "https://projects.aether.page/auth" redis.action_cable.yml.erb: | production: url: redis://:<%= ERB::Util::url_encode(File.read("/etc/gitlab/redis/redis-password").strip) %>@gitlab-redis-master.gitlab.svc:6379/0 id: resque.yml.erb: | production: url: redis://:<%= ERB::Util::url_encode(File.read("/etc/gitlab/redis/redis-password").strip) %>@gitlab-redis-master.gitlab.svc:6379/0 id: (root level) + one document added: apiVersion: v1 kind: ConfigMap metadata: name: gitlab-sidekiq namespace: gitlab labels: app: sidekiq helm.toolkit.fluxcd.io/name: gitlab helm.toolkit.fluxcd.io/namespace: flux-system heritage: Helm release: gitlab data: cable.yml.erb: | production: url: redis://:<%= ERB::Util::url_encode(File.read("/etc/gitlab/redis/redis-password").strip) %>@gitlab-redis-master.gitlab.svc:6379/0 id: adapter: redis configure: | # BEGIN gitlab.scripts.configure.secrets set -e config_dir="/init-config" secret_dir="/init-secrets" # required for secret in gitaly registry rails-secrets ; do mkdir -p "${secret_dir}/${secret}" cp -f -v -r -L "${config_dir}/${secret}/." "${secret_dir}/${secret}/" done # optional for secret in redis redis-sentinel minio objectstorage postgres ldap duo omniauth smtp kas pages oauth-secrets mailroom gitlab-exporter microsoft_graph_mailer zoekt clickhouse openbao ; do if [ -e "${config_dir}/${secret}" ]; then mkdir -p "${secret_dir}/${secret}" cp -f -v -r -L "${config_dir}/${secret}/." "${secret_dir}/${secret}/" fi done # END gitlab.scripts.configure.secrets database.yml.erb: | production: main: adapter: postgresql encoding: unicode database: gitlab-prod username: gitlab password: <%= File.read('/etc/gitlab/postgres/psql-password-main').strip.to_json %> host: "db-gitlab-rw.gitlab.svc" port: 5432 connect_timeout: keepalives: keepalives_idle: keepalives_interval: keepalives_count: tcp_user_timeout: application_name: prepared_statements: false database_tasks: true ci: adapter: postgresql encoding: unicode database: gitlab-prod username: gitlab password: <%= File.read('/etc/gitlab/postgres/psql-password-ci').strip.to_json %> host: "db-gitlab-rw.gitlab.svc" port: 5432 connect_timeout: keepalives: keepalives_idle: keepalives_interval: keepalives_count: tcp_user_timeout: application_name: prepared_statements: false database_tasks: false gitlab.yml.erb: | production: &base gitlab: host: code.nogweii.net https: true ssh_host: "code.nogweii.net" action_cable_allowed_origins: [] max_request_duration_seconds: 57 impersonation_enabled: application_settings_cache_seconds: 60 usage_ping_enabled: true seat_link_enabled: true username_changing_enabled: true issue_closing_pattern: default_theme: default_projects_features: issues: true merge_requests: true wiki: true snippets: true builds: true container_registry: true signup_enabled: false graphql_timeout: webhook_timeout: trusted_proxies: time_zone: "UTC" email_from: "gitlab@aether.earth" email_display_name: "GitLab" email_reply_to: "gitlab+noreply@aether.earth" email_subject_suffix: "" gravatar: plain_url: ssl_url: extra: # Consolidated object storage configuration ## property local configuration will override object_store object_store: enabled: true proxy_download: true connection: <%= YAML.load_file("/etc/gitlab/objectstorage/object_store").to_json() %> objects: artifacts: bucket: gitlab-artifacts proxy_download: true lfs: bucket: gitlab-lfs proxy_download: true uploads: bucket: gitlab-uploads proxy_download: true packages: bucket: gitlab-packages proxy_download: true external_diffs: bucket: gitlab-external-diffs proxy_download: true terraform_state: bucket: gitlab-terraform-state dependency_proxy: bucket: gitlab-dependency-proxy proxy_download: true ci_secure_files: bucket: gitlab-ci-secure-files pages: bucket: gitlab-pages artifacts: enabled: true lfs: enabled: true uploads: enabled: true packages: enabled: true external_diffs: enabled: true when: terraform_state: enabled: true ci_secure_files: enabled: true dependency_proxy: enabled: true sentry: enabled: false dsn: clientside_dsn: environment: sidekiq: log_format: json oidc_provider: openid_id_token_expire_in_seconds: 120 pages: enabled: false access_control: false artifacts_server: true path: /srv/gitlab/shared/pages host: aether.page port: 443 https: true secret_file: /etc/gitlab/pages/secret external_http: false external_https: false local_store: enabled: false path: namespace_in_path: false mattermost: enabled: false ## Registry Integration registry: enabled: true host: c.code.nogweii.net api_url: http://gitlab-registry.gitlab.svc:5000 key: /etc/gitlab/registry/gitlab-registry.key issuer: gitlab-issuer notification_secret: <%= YAML.load_file("/etc/gitlab/registry/notificationSecret").flatten.first %> gitlab_ci: ldap: enabled: false omniauth: enabled: true sync_profile_from_provider: ["openid_connect"] sync_profile_attributes: ["email","name"] allow_single_sign_on: ["openid_connect"] block_auto_created_users: false auto_link_ldap_user: false auto_link_saml_user: false auto_link_user: ["openid_connect"] external_providers: [] providers: - <%= YAML.load_file("/etc/gitlab/omniauth/authentik-oidc/config.yaml").to_json() %> kerberos: enabled: false keytab: /etc/krb5.keytab use_dedicated_port: false port: 8443 https: true simple_ldap_linking_allowed_realms: [] duo_auth: enabled: false hostname: integration_key: secret_key: duo_auth: enabled: false hostname: integration_key: secret_key: shared: gitaly: client_path: /home/git/gitaly/bin token: <%= File.read('/etc/gitlab/gitaly/gitaly_token').strip.to_json %> repositories: storages: # You must have at least a `default` storage path. default: path: /var/opt/gitlab/repo gitaly_address: tcp://gitlab-gitaly-0.gitlab-gitaly.gitlab.svc:8075 backup: path: "tmp/backups" # Relative paths are relative to Rails.root (default: tmp/backups/) gitlab_kas: enabled: true secret_file: /etc/gitlab/kas/.gitlab_kas_secret external_url: "wss://k.code.nogweii.net" internal_url: "grpc://gitlab-kas.gitlab.svc:8153" # Zoekt secrets are present, load them. zoekt: username_file: /etc/gitlab/zoekt/.gitlab_zoekt_username password_file: /etc/gitlab/zoekt/.gitlab_zoekt_password gitlab_shell: path: /home/git/gitlab-shell/ hooks_path: /home/git/gitlab-shell/hooks/ upload_pack: true receive_pack: true ssh_port: 22222 workhorse: git: bin_path: /usr/bin/git webpack: monitoring: ip_whitelist: - "127.0.0.0/8" - "::1/128" sidekiq_exporter: enabled: true address: "*" port: 3807 log_enabled: false sidekiq_health_checks: enabled: true address: "*" port: 3808 installation_type: | gitlab-helm-chart krb5.conf: redis.action_cable.yml.erb: | production: url: redis://:<%= ERB::Util::url_encode(File.read("/etc/gitlab/redis/redis-password").strip) %>@gitlab-redis-master.gitlab.svc:6379/0 id: resque.yml.erb: | production: url: redis://:<%= ERB::Util::url_encode(File.read("/etc/gitlab/redis/redis-password").strip) %>@gitlab-redis-master.gitlab.svc:6379/0 id: session_store.yml.erb: | production: session_cookie_token_prefix: "" smtp_settings.rb: | smtp_settings = { address: "mail-relay.email.svc.cluster.local", port: 587, ca_file: "/etc/ssl/certs/ca-certificates.crt", enable_starttls_auto: false, tls: false, openssl_verify_mode: "peer", open_timeout: 30, read_timeout: 60 } Rails.application.config.action_mailer.delivery_method = :smtp ActionMailer::Base.delivery_method = :smtp ActionMailer::Base.smtp_settings = smtp_settings (root level) + one document added: apiVersion: v1 kind: ConfigMap metadata: name: gitlab-toolbox namespace: gitlab labels: app: toolbox helm.toolkit.fluxcd.io/name: gitlab helm.toolkit.fluxcd.io/namespace: flux-system heritage: Helm release: gitlab data: cable.yml.erb: | production: url: redis://:<%= ERB::Util::url_encode(File.read("/etc/gitlab/redis/redis-password").strip) %>@gitlab-redis-master.gitlab.svc:6379/0 id: adapter: redis configure: | # BEGIN gitlab.scripts.configure.secrets set -e config_dir="/init-config" secret_dir="/init-secrets" # required for secret in shell gitaly registry rails-secrets ; do mkdir -p "${secret_dir}/${secret}" cp -f -v -r -L "${config_dir}/${secret}/." "${secret_dir}/${secret}/" done # optional for secret in redis redis-sentinel minio objectstorage postgres ldap duo omniauth smtp kas pages oauth-secrets mailroom gitlab-exporter microsoft_graph_mailer zoekt clickhouse openbao ; do if [ -e "${config_dir}/${secret}" ]; then mkdir -p "${secret_dir}/${secret}" cp -f -v -r -L "${config_dir}/${secret}/." "${secret_dir}/${secret}/" fi done # END gitlab.scripts.configure.secrets if [ ! -f "/${secret_dir}/objectstorage/.s3cfg" ]; then cat <<EOF > "/${secret_dir}/.s3cfg" [default] access_key = $(cat /init-secrets/minio/accesskey) secret_key = $(cat /init-secrets/minio/secretkey) bucket_location = us-east-1 host_base = minio.code.nogweii.net host_bucket = minio.code.nogweii.net/%(bucket) default_mime_type = binary/octet-stream enable_multipart = True multipart_max_chunks = 10000 multipart_chunk_size_mb = 128 recursive = True recv_chunk = 65536 send_chunk = 65536 server_side_encryption = False signature_v2 = True socket_timeout = 300 use_mime_magic = False verbosity = WARNING website_endpoint = https://minio.code.nogweii.net EOF else mv "/${secret_dir}/objectstorage/.s3cfg" "/${secret_dir}/.s3cfg" fi configure-gsutil: | if [ -e "$GOOGLE_APPLICATION_CREDENTIALS" ]; then # The following script is used to configure gsutil when creating backups # It provides inputs to the `gsutil config -e` prompt as follows: # 1) Path to service account JSON key file # 2) Do not set permissions for key file # 3) GCP Project ID # 4) Decline anonymous usage statistics printf "$GOOGLE_APPLICATION_CREDENTIALS\nN\n\nN\n" | gsutil config -e else # If the backup config is not configured, assume that # Application Default Credentials are used with a service account. # This enables GKE Workload Identity Federation to work. echo '[GoogleCompute]\nservice_account = default' > ~/.boto fi database.yml.erb: | production: main: adapter: postgresql encoding: unicode database: gitlab-prod username: gitlab password: <%= File.read('/etc/gitlab/postgres/psql-password-main').strip.to_json %> host: "db-gitlab-rw.gitlab.svc" port: 5432 connect_timeout: keepalives: keepalives_idle: keepalives_interval: keepalives_count: tcp_user_timeout: application_name: prepared_statements: false database_tasks: true ci: adapter: postgresql encoding: unicode database: gitlab-prod username: gitlab password: <%= File.read('/etc/gitlab/postgres/psql-password-ci').strip.to_json %> host: "db-gitlab-rw.gitlab.svc" port: 5432 connect_timeout: keepalives: keepalives_idle: keepalives_interval: keepalives_count: tcp_user_timeout: application_name: prepared_statements: false database_tasks: false gitlab.yml.erb: | production: &base gitlab: host: code.nogweii.net https: true ssh_host: "code.nogweii.net" max_request_duration_seconds: 57 impersonation_enabled: application_settings_cache_seconds: 60 usage_ping_enabled: true seat_link_enabled: true username_changing_enabled: true issue_closing_pattern: default_theme: default_projects_features: issues: true merge_requests: true wiki: true snippets: true builds: true container_registry: true signup_enabled: false graphql_timeout: webhook_timeout: trusted_proxies: time_zone: "UTC" email_from: "gitlab@aether.earth" email_display_name: "GitLab" email_reply_to: "gitlab+noreply@aether.earth" email_subject_suffix: "" # Consolidated object storage configuration ## property local configuration will override object_store object_store: enabled: true proxy_download: true connection: <%= YAML.load_file("/etc/gitlab/objectstorage/object_store").to_json() %> objects: artifacts: bucket: gitlab-artifacts proxy_download: true lfs: bucket: gitlab-lfs proxy_download: true uploads: bucket: gitlab-uploads proxy_download: true packages: bucket: gitlab-packages proxy_download: true external_diffs: bucket: gitlab-external-diffs proxy_download: true terraform_state: bucket: gitlab-terraform-state dependency_proxy: bucket: gitlab-dependency-proxy proxy_download: true ci_secure_files: bucket: gitlab-ci-secure-files pages: bucket: gitlab-pages artifacts: enabled: true lfs: enabled: true uploads: enabled: true packages: enabled: true external_diffs: enabled: true when: terraform_state: enabled: true ci_secure_files: enabled: true dependency_proxy: enabled: true sidekiq: log_format: json oidc_provider: openid_id_token_expire_in_seconds: 120 pages: enabled: false access_control: false artifacts_server: true path: /srv/gitlab/shared/pages host: aether.page port: 443 https: true secret_file: /etc/gitlab/pages/secret external_http: false external_https: false local_store: enabled: false path: namespace_in_path: false mattermost: enabled: false ## Registry Integration registry: enabled: true host: c.code.nogweii.net api_url: http://gitlab-registry.gitlab.svc:5000 key: /etc/gitlab/registry/gitlab-registry.key issuer: gitlab-issuer notification_secret: <%= YAML.load_file("/etc/gitlab/registry/notificationSecret").flatten.first %> gitlab_ci: ldap: enabled: false omniauth: enabled: true sync_profile_from_provider: ["openid_connect"] sync_profile_attributes: ["email","name"] allow_single_sign_on: ["openid_connect"] block_auto_created_users: false auto_link_ldap_user: false auto_link_saml_user: false auto_link_user: ["openid_connect"] external_providers: [] providers: - <%= YAML.load_file("/etc/gitlab/omniauth/authentik-oidc/config.yaml").to_json() %> kerberos: enabled: false keytab: /etc/krb5.keytab use_dedicated_port: false port: 8443 https: true simple_ldap_linking_allowed_realms: [] duo_auth: enabled: false hostname: integration_key: secret_key: shared: gitaly: client_path: /home/git/gitaly/bin token: <%= File.read('/etc/gitlab/gitaly/gitaly_token').strip.to_json %> repositories: storages: # You must have at least a `default` storage path. default: path: /var/opt/gitlab/repo gitaly_address: tcp://gitlab-gitaly-0.gitlab-gitaly.gitlab.svc:8075 backup: path: "tmp/backups" # Relative paths are relative to Rails.root (default: tmp/backups/) gitlab_kas: enabled: true secret_file: /etc/gitlab/kas/.gitlab_kas_secret external_url: "wss://k.code.nogweii.net" internal_url: "grpc://gitlab-kas.gitlab.svc:8153" # Zoekt secrets are present, load them. zoekt: username_file: /etc/gitlab/zoekt/.gitlab_zoekt_username password_file: /etc/gitlab/zoekt/.gitlab_zoekt_password gitlab_shell: path: /home/git/gitlab-shell/ hooks_path: /home/git/gitlab-shell/hooks/ upload_pack: true receive_pack: true ssh_port: 22222 secret_file: /etc/gitlab/shell/.gitlab_shell_secret workhorse: git: bin_path: /usr/bin/git webpack: monitoring: ip_whitelist: - 127.0.0.0/8 sidekiq_exporter: extra: krb5.conf: redis.action_cable.yml.erb: | production: url: redis://:<%= ERB::Util::url_encode(File.read("/etc/gitlab/redis/redis-password").strip) %>@gitlab-redis-master.gitlab.svc:6379/0 id: resque.yml.erb: | production: url: redis://:<%= ERB::Util::url_encode(File.read("/etc/gitlab/redis/redis-password").strip) %>@gitlab-redis-master.gitlab.svc:6379/0 id: session_store.yml.erb: | production: session_cookie_token_prefix: "" smtp_settings.rb: | smtp_settings = { address: "mail-relay.email.svc.cluster.local", port: 587, ca_file: "/etc/ssl/certs/ca-certificates.crt", enable_starttls_auto: false, tls: false, openssl_verify_mode: "peer", open_timeout: 30, read_timeout: 60 } Rails.application.config.action_mailer.delivery_method = :smtp ActionMailer::Base.delivery_method = :smtp ActionMailer::Base.smtp_settings = smtp_settings (root level) + one document added: apiVersion: v1 kind: ConfigMap metadata: name: gitlab-webservice namespace: gitlab labels: app: webservice helm.toolkit.fluxcd.io/name: gitlab helm.toolkit.fluxcd.io/namespace: flux-system heritage: Helm release: gitlab data: cable.yml.erb: | production: url: redis://:<%= ERB::Util::url_encode(File.read("/etc/gitlab/redis/redis-password").strip) %>@gitlab-redis-master.gitlab.svc:6379/0 id: adapter: redis configure: | # BEGIN gitlab.scripts.configure.secrets set -e config_dir="/init-config" secret_dir="/init-secrets" # required for secret in shell gitaly registry rails-secrets gitlab-workhorse ; do mkdir -p "${secret_dir}/${secret}" cp -f -v -r -L "${config_dir}/${secret}/." "${secret_dir}/${secret}/" done # optional for secret in redis redis-sentinel minio objectstorage postgres ldap duo omniauth smtp kas pages oauth-secrets mailroom gitlab-exporter microsoft_graph_mailer zoekt clickhouse openbao ; do if [ -e "${config_dir}/${secret}" ]; then mkdir -p "${secret_dir}/${secret}" cp -f -v -r -L "${config_dir}/${secret}/." "${secret_dir}/${secret}/" fi done # END gitlab.scripts.configure.secrets database.yml.erb: | production: main: adapter: postgresql encoding: unicode database: gitlab-prod username: gitlab password: <%= File.read('/etc/gitlab/postgres/psql-password-main').strip.to_json %> host: "db-gitlab-rw.gitlab.svc" port: 5432 connect_timeout: keepalives: keepalives_idle: keepalives_interval: keepalives_count: tcp_user_timeout: application_name: prepared_statements: false database_tasks: true ci: adapter: postgresql encoding: unicode database: gitlab-prod username: gitlab password: <%= File.read('/etc/gitlab/postgres/psql-password-ci').strip.to_json %> host: "db-gitlab-rw.gitlab.svc" port: 5432 connect_timeout: keepalives: keepalives_idle: keepalives_interval: keepalives_count: tcp_user_timeout: application_name: prepared_statements: false database_tasks: false gitlab.yml.erb: | production: &base gitlab: host: code.nogweii.net https: true ssh_host: "code.nogweii.net" action_cable_allowed_origins: [] max_request_duration_seconds: 57 impersonation_enabled: application_settings_cache_seconds: 60 usage_ping_enabled: true seat_link_enabled: true username_changing_enabled: true issue_closing_pattern: default_theme: default_color_mode: default_syntax_highlighting_theme: default_projects_features: issues: true merge_requests: true wiki: true snippets: true builds: true container_registry: true signup_enabled: false graphql_timeout: webhook_timeout: trusted_proxies: time_zone: "UTC" email_from: "gitlab@aether.earth" email_display_name: "GitLab" email_reply_to: "gitlab+noreply@aether.earth" email_subject_suffix: "" gravatar: plain_url: ssl_url: extra: # Consolidated object storage configuration ## property local configuration will override object_store object_store: enabled: true proxy_download: true connection: <%= YAML.load_file("/etc/gitlab/objectstorage/object_store").to_json() %> objects: artifacts: bucket: gitlab-artifacts proxy_download: true lfs: bucket: gitlab-lfs proxy_download: true uploads: bucket: gitlab-uploads proxy_download: true packages: bucket: gitlab-packages proxy_download: true external_diffs: bucket: gitlab-external-diffs proxy_download: true terraform_state: bucket: gitlab-terraform-state dependency_proxy: bucket: gitlab-dependency-proxy proxy_download: true ci_secure_files: bucket: gitlab-ci-secure-files pages: bucket: gitlab-pages artifacts: enabled: true lfs: enabled: true uploads: enabled: true packages: enabled: true external_diffs: enabled: true when: terraform_state: enabled: true ci_secure_files: enabled: true dependency_proxy: enabled: true sentry: enabled: false dsn: clientside_dsn: environment: gitlab_docs: enabled: false host: "" sidekiq: log_format: json oidc_provider: openid_id_token_expire_in_seconds: 120 pages: enabled: false access_control: false artifacts_server: true path: /srv/gitlab/shared/pages host: aether.page port: 443 https: true secret_file: /etc/gitlab/pages/secret external_http: false external_https: false local_store: enabled: false path: namespace_in_path: false mattermost: enabled: false gitlab_ci: ldap: enabled: false omniauth: enabled: true sync_profile_from_provider: ["openid_connect"] sync_profile_attributes: ["email","name"] allow_single_sign_on: ["openid_connect"] block_auto_created_users: false auto_link_ldap_user: false auto_link_saml_user: false auto_link_user: ["openid_connect"] external_providers: [] providers: - <%= YAML.load_file("/etc/gitlab/omniauth/authentik-oidc/config.yaml").to_json() %> kerberos: enabled: false keytab: /etc/krb5.keytab use_dedicated_port: false port: 8443 https: true simple_ldap_linking_allowed_realms: [] duo_auth: enabled: false hostname: integration_key: secret_key: shared: gitaly: client_path: /home/git/gitaly/bin token: <%= File.read('/etc/gitlab/gitaly/gitaly_token').strip.to_json %> repositories: storages: # You must have at least a `default` storage path. default: path: /var/opt/gitlab/repo gitaly_address: tcp://gitlab-gitaly-0.gitlab-gitaly.gitlab.svc:8075 backup: path: "tmp/backups" # Relative paths are relative to Rails.root (default: tmp/backups/) gitlab_kas: enabled: true secret_file: /etc/gitlab/kas/.gitlab_kas_secret external_url: "wss://k.code.nogweii.net" internal_url: "grpc://gitlab-kas.gitlab.svc:8153" # Zoekt secrets are present, load them. zoekt: username_file: /etc/gitlab/zoekt/.gitlab_zoekt_username password_file: /etc/gitlab/zoekt/.gitlab_zoekt_password gitlab_shell: path: /home/git/gitlab-shell/ hooks_path: /home/git/gitlab-shell/hooks/ upload_pack: true receive_pack: true ssh_port: 22222 secret_file: /etc/gitlab/shell/.gitlab_shell_secret workhorse: secret_file: /etc/gitlab/gitlab-workhorse/secret git: bin_path: /usr/bin/git webpack: monitoring: ip_whitelist: - "0.0.0.0/0" - "::/0" web_exporter: enabled: true address: "0.0.0.0" port: 8083 sidekiq_exporter: shutdown: blackout_seconds: <%= ENV["SHUTDOWN_BLACKOUT_SECONDS"] %> rack_attack: git_basic_auth: ## Registry Integration registry: enabled: true host: c.code.nogweii.net api_url: http://gitlab-registry.gitlab.svc:5000 key: /etc/gitlab/registry/gitlab-registry.key issuer: gitlab-issuer notification_secret: <%= YAML.load_file("/etc/gitlab/registry/notificationSecret").flatten.first %> smartcard: enabled: false ca_file: '/etc/gitlab/rails-secrets/smartcard-ca.crt' client_certificate_required_host: smartcard.code.nogweii.net client_certificate_required_port: 443 san_extensions: false required_for_git_access: false installation_type: | gitlab-helm-chart krb5.conf: redis.action_cable.yml.erb: | production: url: redis://:<%= ERB::Util::url_encode(File.read("/etc/gitlab/redis/redis-password").strip) %>@gitlab-redis-master.gitlab.svc:6379/0 id: resque.yml.erb: | production: url: redis://:<%= ERB::Util::url_encode(File.read("/etc/gitlab/redis/redis-password").strip) %>@gitlab-redis-master.gitlab.svc:6379/0 id: session_store.yml.erb: | production: session_cookie_token_prefix: "" smtp_settings.rb: | smtp_settings = { address: "mail-relay.email.svc.cluster.local", port: 587, ca_file: "/etc/ssl/certs/ca-certificates.crt", enable_starttls_auto: false, tls: false, openssl_verify_mode: "peer", open_timeout: 30, read_timeout: 60 } Rails.application.config.action_mailer.delivery_method = :smtp ActionMailer::Base.delivery_method = :smtp ActionMailer::Base.smtp_settings = smtp_settings (root level) + one document added: apiVersion: v1 kind: ConfigMap metadata: name: gitlab-workhorse-default namespace: gitlab labels: app: webservice helm.toolkit.fluxcd.io/name: gitlab helm.toolkit.fluxcd.io/namespace: flux-system heritage: Helm release: gitlab data: configure: | set -e mkdir -p /init-secrets-workhorse/gitlab-workhorse cp -v -r -L /init-config/gitlab-workhorse/secret /init-secrets-workhorse/gitlab-workhorse/secret mkdir -p /init-secrets-workhorse/redis cp -v -r -L /init-config/redis/redis-password /init-secrets-workhorse/redis/ if [ -f /init-config/objectstorage/object_store ]; then mkdir -p /init-secrets-workhorse/objectstorage cp -v -r -L /init-config/objectstorage/object_store /init-secrets-workhorse/objectstorage/ fi installation_type: | gitlab-helm-chart workhorse-config.toml.tpl: | shutdown_timeout = "61s" [redis] DB = 0 URL = "redis://gitlab-redis-master.gitlab.svc:6379" Password = {% file.Read "/etc/gitlab/redis/redis-password" | strings.TrimSpace | data.ToJSON %} {%- $supported_providers := slice "AWS" "AzureRM" "Google" -%} {%- $connection := coll.Dict "provider" "" -%} {%- if file.Exists "/etc/gitlab/minio/accesskey" %} {%- $aws_access_key_id := file.Read "/etc/gitlab/minio/accesskey" | strings.TrimSpace -%} {%- $aws_secret_access_key := file.Read "/etc/gitlab/minio/secretkey" | strings.TrimSpace -%} {%- $connection = coll.Dict "provider" "AWS" "aws_access_key_id" $aws_access_key_id "aws_secret_access_key" $aws_secret_access_key -%} {%- end %} {%- if file.Exists "/etc/gitlab/objectstorage/object_store" %} {%- $connection = file.Read "/etc/gitlab/objectstorage/object_store" | strings.TrimSpace | data.YAML -%} {%- end %} {%- if has $supported_providers $connection.provider %} [object_storage] provider = "{% $connection.provider %}" {%- if eq $connection.provider "AWS" %} {%- $connection = coll.Merge $connection (coll.Dict "aws_access_key_id" "" "aws_secret_access_key" "" ) %} # AWS / S3 object storage configuration. [object_storage.s3] # access/secret can be blank! aws_access_key_id = {% $connection.aws_access_key_id | strings.TrimSpace | data.ToJSON %} aws_secret_access_key = {% $connection.aws_secret_access_key | strings.TrimSpace | data.ToJSON %} {%- else if eq $connection.provider "AzureRM" %} {%- $connection = coll.Merge $connection (coll.Dict "azure_storage_account_name" "" "azure_storage_access_key" "") %} # Azure Blob storage configuration. [object_storage.azurerm] azure_storage_account_name = {% $connection.azure_storage_account_name | strings.TrimSpace | data.ToJSON %} azure_storage_access_key = {% $connection.azure_storage_access_key | strings.TrimSpace | data.ToJSON %} {%- else if eq $connection.provider "Google" %} # Google storage configuration. [object_storage.google] {% $connection | coll.Omit "provider" | data.ToTOML %} {%- end %} {%- end %} [image_resizer] max_scaler_procs = 2 max_filesize = 250000 [[listeners]] network = "tcp" addr = ":8181" (root level) + one document added: apiVersion: v1 kind: ConfigMap metadata: name: gitlab-webservice-tests namespace: gitlab labels: app: webservice helm.toolkit.fluxcd.io/name: gitlab helm.toolkit.fluxcd.io/namespace: flux-system heritage: Helm release: gitlab data: test_login: | set -e echo 'Start Test' endpoint="https://code.nogweii.net" cookie_read="-c /tmp/test_login.cookie" cookie_readwrite="$cookie_read -b /tmp/test_login.cookie" signin_url="$endpoint/users/sign_in" echo "Login to create a session: $signin_url" csrf=$(curl -L $signin_url --fail -s $cookie_read | grep -Po '<meta.*name="csrf-token".*content="\K[a-zA-Z0-9\+=\-\/]*') curl -X POST $signin_url -s $cookie_readwrite -F "authenticity_token=$csrf" -F 'user[login]=root' -F "user[password]=$(cat /initial_root_password)" profile_url="$endpoint/-/profile" echo "Confirm session valid: $profile_url" profile_status=$(curl -L -s -o /tmp/profile_output -w "%{http_code}" $cookie_readwrite $profile_url) if [ "$profile_status" != "200" ]; then echo "Error: Session Invalid" cat /tmp/profile_output exit 1 fi echo 'Test Passed' exit 0 (root level) + one document added: apiVersion: v1 kind: ConfigMap metadata: name: gitlab-redis-configuration namespace: gitlab labels: app.kubernetes.io/instance: gitlab app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: redis helm.toolkit.fluxcd.io/name: gitlab helm.toolkit.fluxcd.io/namespace: flux-system data: master.conf: | dir /data # User-supplied master configuration: rename-command FLUSHDB "" rename-command FLUSHALL "" # End of master configuration redis.conf: | # User-supplied common configuration: # Enable AOF https://redis.io/topics/persistence#append-only-file appendonly yes # Disable RDB persistence, AOF persistence already enabled. save "" # End of common configuration replica.conf: | dir /data # User-supplied replica configuration: rename-command FLUSHDB "" rename-command FLUSHALL "" # End of replica configuration (root level) + one document added: apiVersion: v1 kind: ConfigMap metadata: name: gitlab-redis-health namespace: gitlab labels: app.kubernetes.io/instance: gitlab app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: redis helm.toolkit.fluxcd.io/name: gitlab helm.toolkit.fluxcd.io/namespace: flux-system data: ping_liveness_local.sh: | #!/bin/bash [[ -f $REDIS_PASSWORD_FILE ]] && export REDIS_PASSWORD="$(< "${REDIS_PASSWORD_FILE}")" [[ -n "$REDIS_PASSWORD" ]] && export REDISCLI_AUTH="$REDIS_PASSWORD" response=$( timeout -s 15 $1 \ redis-cli \ -h localhost \ -p $REDIS_PORT \ ping ) if [ "$?" -eq "124" ]; then echo "Timed out" exit 1 fi responseFirstWord=$(echo $response | head -n1 | awk '{print $1;}') if [ "$response" != "PONG" ] && [ "$responseFirstWord" != "LOADING" ] && [ "$responseFirstWord" != "MASTERDOWN" ]; then echo "$response" exit 1 fi ping_liveness_local_and_master.sh: | script_dir="$(dirname "$0")" exit_status=0 "$script_dir/ping_liveness_local.sh" $1 || exit_status=$? "$script_dir/ping_liveness_master.sh" $1 || exit_status=$? exit $exit_status ping_liveness_master.sh: | #!/bin/bash [[ -f $REDIS_MASTER_PASSWORD_FILE ]] && export REDIS_MASTER_PASSWORD="$(< "${REDIS_MASTER_PASSWORD_FILE}")" [[ -n "$REDIS_MASTER_PASSWORD" ]] && export REDISCLI_AUTH="$REDIS_MASTER_PASSWORD" response=$( timeout -s 15 $1 \ redis-cli \ -h $REDIS_MASTER_HOST \ -p $REDIS_MASTER_PORT_NUMBER \ ping ) if [ "$?" -eq "124" ]; then echo "Timed out" exit 1 fi responseFirstWord=$(echo $response | head -n1 | awk '{print $1;}') if [ "$response" != "PONG" ] && [ "$responseFirstWord" != "LOADING" ]; then echo "$response" exit 1 fi ping_readiness_local.sh: | #!/bin/bash [[ -f $REDIS_PASSWORD_FILE ]] && export REDIS_PASSWORD="$(< "${REDIS_PASSWORD_FILE}")" [[ -n "$REDIS_PASSWORD" ]] && export REDISCLI_AUTH="$REDIS_PASSWORD" response=$( timeout -s 15 $1 \ redis-cli \ -h localhost \ -p $REDIS_PORT \ ping ) if [ "$?" -eq "124" ]; then echo "Timed out" exit 1 fi if [ "$response" != "PONG" ]; then echo "$response" exit 1 fi ping_readiness_local_and_master.sh: | script_dir="$(dirname "$0")" exit_status=0 "$script_dir/ping_readiness_local.sh" $1 || exit_status=$? "$script_dir/ping_readiness_master.sh" $1 || exit_status=$? exit $exit_status ping_readiness_master.sh: | #!/bin/bash [[ -f $REDIS_MASTER_PASSWORD_FILE ]] && export REDIS_MASTER_PASSWORD="$(< "${REDIS_MASTER_PASSWORD_FILE}")" [[ -n "$REDIS_MASTER_PASSWORD" ]] && export REDISCLI_AUTH="$REDIS_MASTER_PASSWORD" response=$( timeout -s 15 $1 \ redis-cli \ -h $REDIS_MASTER_HOST \ -p $REDIS_MASTER_PORT_NUMBER \ ping ) if [ "$?" -eq "124" ]; then echo "Timed out" exit 1 fi if [ "$response" != "PONG" ]; then echo "$response" exit 1 fi (root level) + one document added: apiVersion: v1 kind: ConfigMap metadata: name: gitlab-redis-scripts namespace: gitlab labels: app.kubernetes.io/instance: gitlab app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: redis helm.toolkit.fluxcd.io/name: gitlab helm.toolkit.fluxcd.io/namespace: flux-system data: start-master.sh: | #!/bin/bash [[ -f $REDIS_PASSWORD_FILE ]] && export REDIS_PASSWORD="$(< "${REDIS_PASSWORD_FILE}")" if [[ -f /opt/bitnami/redis/mounted-etc/master.conf ]];then cp /opt/bitnami/redis/mounted-etc/master.conf /opt/bitnami/redis/etc/master.conf fi if [[ -f /opt/bitnami/redis/mounted-etc/redis.conf ]];then cp /opt/bitnami/redis/mounted-etc/redis.conf /opt/bitnami/redis/etc/redis.conf fi ARGS=("--port" "${REDIS_PORT}") ARGS+=("--requirepass" "${REDIS_PASSWORD}") ARGS+=("--masterauth" "${REDIS_PASSWORD}") ARGS+=("--include" "/opt/bitnami/redis/etc/redis.conf") ARGS+=("--include" "/opt/bitnami/redis/etc/master.conf") exec redis-server "${ARGS[@]}" (root level) + one document added: apiVersion: v1 kind: ConfigMap metadata: name: gitlab-registry namespace: gitlab labels: app: registry helm.toolkit.fluxcd.io/name: gitlab helm.toolkit.fluxcd.io/namespace: flux-system heritage: Helm release: gitlab data: config.yml.tpl: | version: 0.1 log: fields: service: registry level: info http: addr: :5000 # `host` is not configurable # `prefix` is not configurable debug: addr: :5001 prometheus: enabled: false path: /metrics draintimeout: 0 headers: X-Content-Type-Options: [nosniff] secret: "HTTP_SECRET" relativeurls: false health: storagedriver: enabled: false interval: 10s threshold: 3 auth: token: realm: https://code.nogweii.net/jwt/auth service: container_registry issuer: gitlab-issuer # This is provided from the initContainer execution, at a known path. rootcertbundle: /etc/docker/registry/certificate.crt autoredirect: false validation: disabled: true manifests: referencelimit: 0 payloadsizelimit: 0 urls: allow: deny: notifications: reporting: profiling: storage: maintenance: readonly: enabled: false uploadpurging: enabled: true age: 168h interval: 24h dryrun: false redirect: disable: true exceptions: middleware: database: enabled: true host: "db-gitlab-rw.gitlab.svc" port: 5432 user: registry password: "DB_PASSWORD_FILE" dbname: gl-registry sslmode: disable gc: disabled: false redis: rate_limiter: enabled: false configure: | if [ -e /config/accesskey ] ; then sed -i -e 's@ACCESS_KEY@'"$(cat /config/accesskey)"'@' -e 's@SECRET_KEY@'"$(cat /config/secretkey)"'@' /registry/config.yml fi # Place the `http.secret` value from the kubernetes secret sed -i -e 's@HTTP_SECRET@'"$(cat /config/httpSecret)"'@' /registry/config.yml # Populate sensitive registry notification secrets in the config file if [ -d /config/notifications ]; then for i in /config/notifications/*; do filename=$(basename $i); sed -i -e 's@'"${filename}"'@'"$(cat $i)"'@' /registry/config.yml; done fi # Insert any provided `storage` block from kubernetes secret if [ -d /config/storage ]; then # Copy contents of storage secret(s) mkdir -p /registry/storage cp -v -r -L /config/storage/* /registry/storage/ # Ensure there is a new line in the end echo '' >> /registry/storage/config # Default `delete.enabled: true` if not present. ## Note: busybox grep doesn't support multiline, so we chain `egrep`. if ! $(egrep -A1 '^delete:\s*$' /registry/storage/config | egrep -q '\s{2,4}enabled:') ; then echo 'delete:' >> /registry/storage/config echo ' enabled: true' >> /registry/storage/config fi # Indent /registry/storage/config 2 spaces before inserting into config.yml sed -i 's/^/ /' /registry/storage/config # Insert into /registry/config.yml after `storage:` sed -i '/^storage:/ r /registry/storage/config' /registry/config.yml # Remove the now extraneous `config` file rm /registry/storage/config fi # Copy any middleware.storage if present if [ -d /config/middleware.storage ]; then cp -v -r -L /config/middleware.storage /registry/middleware.storage fi # Set to known path, to used ConfigMap cat /config/certificate.crt > /registry/certificate.crt # Copy the optional profiling keyfile to the expected location if [ -f /config/profiling-key.json ]; then cp /config/profiling-key.json /registry/profiling-key.json fi # Insert Database password, if enabled if [ -f /config/database_password ] ; then sed -i -e 's@DB_PASSWORD_FILE@'"$(cat /config/database_password)"'@' /registry/config.yml fi # Insert Redis(cache) password, if enabled if [ -f /config/registry/redis-password ] ; then sed -i -e 's@REDIS_CACHE_PASSWORD@'"$(cat /config/registry/redis-password)"'@' /registry/config.yml fi # Insert Redis(rate-limiter) password, if enabled if [ -f /config/registry/redis-rateLimiting-password ] ; then sed -i -e 's@REDIS_RATE_LIMITING_PASSWORD@'"$(cat /config/registry/redis-rateLimiting-password)"'@' /registry/config.yml fi # Insert Redis(load balancing) password, if enabled if [ -f /config/registry/redis-loadBalancing-password ] ; then sed -i -e 's@REDIS_LOAD_BALANCING_PASSWORD@'"$(cat /config/registry/redis-loadBalancing-password)"'@' /registry/config.yml fi # Copy the database TLS connection files to the expected location and set permissions if [ -d /config/ssl ]; then cp -r /config/ssl/ /registry/ssl chmod 700 /registry/ssl chmod 600 /registry/ssl/*.pem fi # Copy TLS certificates if present if [ -d /config/tls ]; then cp -r /config/tls/ /registry/tls chmod 700 /registry/tls chmod 600 /registry/tls/* fi migrations-config.yml.tpl: | version: 0.1 log: fields: service: registry level: info database: enabled: true host: "db-gitlab-rw.gitlab.svc" port: 5432 user: registry password: "DB_PASSWORD_FILE" dbname: gl-registry sslmode: disable (root level) + one document added: apiVersion: v1 kind: ConfigMap metadata: name: gitlab-gitlab-chart-info namespace: gitlab labels: app: gitlab helm.toolkit.fluxcd.io/name: gitlab helm.toolkit.fluxcd.io/namespace: flux-system heritage: Helm release: gitlab data: gitlabChartVersion: "9.8.2" gitlabVersion: "18.8.2" (root level) + one document added: apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: name: gitlab-gitlab-runner labels: app: gitlab-gitlab-runner helm.toolkit.fluxcd.io/name: gitlab helm.toolkit.fluxcd.io/namespace: flux-system heritage: Helm release: gitlab rules: - resources: - events apiGroups: - verbs: - list - watch - resources: - namespaces apiGroups: - verbs: - create - delete - resources: - pods apiGroups: - verbs: - create - delete - get - list - watch - resources: - pods/attach - pods/exec apiGroups: - verbs: - get - create - patch - delete - resources: - pods/log apiGroups: - verbs: - get - list - resources: - secrets apiGroups: - verbs: - create - delete - get - update - resources: - serviceaccounts apiGroups: - verbs: - get - resources: - services apiGroups: - verbs: - create - get (root level) + one document added: apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding metadata: name: gitlab-gitlab-runner labels: app: gitlab-gitlab-runner helm.toolkit.fluxcd.io/name: gitlab helm.toolkit.fluxcd.io/namespace: flux-system heritage: Helm release: gitlab roleRef: name: gitlab-gitlab-runner apiGroup: rbac.authorization.k8s.io kind: ClusterRole subjects: - name: gitlab-runner-access kind: ServiceAccount namespace: gitlab (root level) + one document added: apiVersion: v1 kind: Service metadata: name: gitlab-gitaly namespace: gitlab labels: app: gitaly helm.toolkit.fluxcd.io/name: gitlab helm.toolkit.fluxcd.io/namespace: flux-system heritage: Helm release: gitlab spec: type: ClusterIP clusterIP: None selector: app: gitaly release: gitlab ports: - name: tcp-gitaly port: 8075 targetPort: grpc-gitaly - name: http-metrics port: 9236 targetPort: http-metrics (root level) + one document added: apiVersion: v1 kind: Service metadata: name: gitlab-gitlab-exporter namespace: gitlab labels: app: gitlab-exporter helm.toolkit.fluxcd.io/name: gitlab helm.toolkit.fluxcd.io/namespace: flux-system heritage: Helm release: gitlab spec: type: ClusterIP selector: app: gitlab-exporter release: gitlab ports: - name: http-metrics port: 9168 protocol: TCP targetPort: http-metrics (root level) + one document added: apiVersion: v1 kind: Service metadata: name: gitlab-gitlab-shell namespace: gitlab annotations: tailscale.com/expose: "true" tailscale.com/hostname: gitlab-shell labels: app: gitlab-shell helm.toolkit.fluxcd.io/name: gitlab helm.toolkit.fluxcd.io/namespace: flux-system heritage: Helm release: gitlab spec: type: ClusterIP selector: app: gitlab-shell release: gitlab ports: - name: ssh port: 22222 protocol: TCP targetPort: 2222 (root level) + one document added: apiVersion: v1 kind: Service metadata: name: gitlab-kas namespace: gitlab labels: app: kas helm.toolkit.fluxcd.io/name: gitlab helm.toolkit.fluxcd.io/namespace: flux-system heritage: Helm release: gitlab spec: type: ClusterIP selector: app: kas release: gitlab ports: - name: tcp-kas-external-api port: 8150 protocol: TCP targetPort: 8150 - name: tcp-kas-internal-api port: 8153 protocol: TCP targetPort: 8153 - name: tcp-kas-k8s-api port: 8154 protocol: TCP targetPort: 8154 - name: http-metrics port: 8151 protocol: TCP targetPort: http-metrics (root level) + one document added: apiVersion: v1 kind: Service metadata: name: gitlab-webservice-default namespace: gitlab labels: app: webservice gitlab.com/webservice-name: default helm.toolkit.fluxcd.io/name: gitlab helm.toolkit.fluxcd.io/namespace: flux-system heritage: Helm release: gitlab spec: type: ClusterIP selector: app: webservice gitlab.com/webservice-name: default release: gitlab ports: - name: http-webservice port: 8080 protocol: TCP targetPort: http-webservice - name: http-workhorse port: 8181 protocol: TCP targetPort: http-workhorse - name: http-metrics-ws port: 8083 protocol: TCP targetPort: http-metrics-ws (root level) + one document added: apiVersion: v1 kind: Service metadata: name: gitlab-redis-headless namespace: gitlab labels: app.kubernetes.io/instance: gitlab app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: redis helm.toolkit.fluxcd.io/name: gitlab helm.toolkit.fluxcd.io/namespace: flux-system spec: type: ClusterIP clusterIP: None selector: app.kubernetes.io/instance: gitlab app.kubernetes.io/name: redis ports: - name: tcp-redis port: 6379 targetPort: redis (root level) + one document added: apiVersion: v1 kind: Service metadata: name: gitlab-redis-master namespace: gitlab labels: app.kubernetes.io/component: master app.kubernetes.io/instance: gitlab app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: redis helm.toolkit.fluxcd.io/name: gitlab helm.toolkit.fluxcd.io/namespace: flux-system spec: type: ClusterIP internalTrafficPolicy: Cluster sessionAffinity: None selector: app.kubernetes.io/component: master app.kubernetes.io/instance: gitlab app.kubernetes.io/name: redis ports: - name: tcp-redis nodePort: null port: 6379 targetPort: redis (root level) + one document added: apiVersion: v1 kind: Service metadata: name: gitlab-redis-metrics namespace: gitlab labels: app.kubernetes.io/component: metrics app.kubernetes.io/instance: gitlab app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: redis helm.toolkit.fluxcd.io/name: gitlab helm.toolkit.fluxcd.io/namespace: flux-system spec: type: ClusterIP selector: app.kubernetes.io/instance: gitlab app.kubernetes.io/name: redis ports: - name: http-metrics port: 9121 protocol: TCP targetPort: metrics (root level) + one document added: apiVersion: v1 kind: Service metadata: name: gitlab-registry namespace: gitlab labels: app: registry helm.toolkit.fluxcd.io/name: gitlab helm.toolkit.fluxcd.io/namespace: flux-system heritage: Helm release: gitlab spec: type: ClusterIP selector: app: registry release: gitlab ports: - name: http-registry port: 5000 protocol: TCP targetPort: http (root level) + one document added: apiVersion: apps/v1 kind: Deployment metadata: name: gitlab-gitlab-runner namespace: gitlab labels: app: gitlab-gitlab-runner helm.toolkit.fluxcd.io/name: gitlab helm.toolkit.fluxcd.io/namespace: flux-system heritage: Helm release: gitlab spec: revisionHistoryLimit: 10 selector: matchLabels: app: gitlab-gitlab-runner template: metadata: annotations: gitlab.com/prometheus_port: "9252" gitlab.com/prometheus_scrape: "true" labels: app: gitlab-gitlab-runner heritage: Helm release: gitlab spec: containers: - name: gitlab-gitlab-runner image: "registry.gitlab.com/gitlab-org/gitlab-runner:alpine-v18.7.2" imagePullPolicy: IfNotPresent resources: {} command: - /usr/bin/dumb-init - "--" - /bin/bash - /configmaps/entrypoint ports: - name: metrics containerPort: 9252 volumeMounts: - name: projected-secrets mountPath: /secrets - name: etc-gitlab-runner mountPath: /home/gitlab-runner/.gitlab-runner - name: configmaps mountPath: /configmaps livenessProbe: exec: command: - /bin/bash - /configmaps/check-live - "3" failureThreshold: 3 initialDelaySeconds: 60 periodSeconds: 60 successThreshold: 1 timeoutSeconds: 4 readinessProbe: exec: command: - /usr/bin/pgrep - "gitlab.*runner" failureThreshold: 3 initialDelaySeconds: 60 periodSeconds: 60 successThreshold: 1 timeoutSeconds: 4 securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL privileged: false readOnlyRootFilesystem: false runAsNonRoot: true env: - name: CI_SERVER_URL value: "https://code.nogweii.net" - name: RUNNER_EXECUTOR value: kubernetes - name: REGISTER_LOCKED value: "false" - name: RUNNER_TAG_LIST value: - name: KUBERNETES_NAMESPACE value: gitlab - name: CACHE_S3_ACCESS_KEY valueFrom: secretKeyRef: name: gitlab-object-store-configs key: runner_access_key_id - name: CACHE_S3_SECRET_KEY valueFrom: secretKeyRef: name: gitlab-object-store-configs key: runner_secret_access_key - name: SESSION_SERVER_ADDRESS value: null lifecycle: preStop: exec: command: - /entrypoint - unregister - "--all-runners" securityContext: fsGroup: 65533 runAsUser: 100 seccompProfile: type: RuntimeDefault serviceAccountName: gitlab-runner-access terminationGracePeriodSeconds: 3600 volumes: - name: runner-secrets emptyDir: medium: Memory - name: etc-gitlab-runner emptyDir: medium: Memory - name: projected-secrets projected: sources: - secret: name: gitlab-gitlab-runner-secret items: - key: runner-registration-token path: runner-registration-token - key: runner-token path: runner-token - name: configmaps configMap: name: gitlab-gitlab-runner (root level) + one document added: apiVersion: apps/v1 kind: Deployment metadata: name: gitlab-gitlab-exporter namespace: gitlab labels: app: gitlab-exporter app.kubernetes.io/name: gitlab helm.toolkit.fluxcd.io/name: gitlab helm.toolkit.fluxcd.io/namespace: flux-system heritage: Helm release: gitlab spec: replicas: 1 selector: matchLabels: app: gitlab-exporter release: gitlab template: metadata: annotations: gitlab.com/prometheus_path: /metrics gitlab.com/prometheus_port: "9168" gitlab.com/prometheus_scrape: "true" prometheus.io/path: /metrics prometheus.io/port: "9168" prometheus.io/scrape: "true" labels: app: gitlab-exporter app.kubernetes.io/name: gitlab heritage: Helm release: gitlab spec: affinity: podAntiAffinity: preferredDuringSchedulingIgnoredDuringExecution: - podAffinityTerm: labelSelector: matchLabels: app: gitlab-exporter release: gitlab topologyKey: kubernetes.io/hostname weight: 1 automountServiceAccountToken: false containers: - name: gitlab-exporter image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-exporter:16.2.0" env: - name: TZ value: UTC - name: CONFIG_TEMPLATE_DIRECTORY value: /var/opt/gitlab-exporter/templates - name: CONFIG_DIRECTORY value: /etc/gitlab-exporter - name: MALLOC_CONF value: "dirty_decay_ms:0,muzzy_decay_ms:0" - name: RUBY_GC_HEAP_FREE_SLOTS_MAX_RATIO value: "0.111" - name: RUBY_GC_HEAP_FREE_SLOTS_MIN_RATIO value: "0.055" - name: RUBY_GC_HEAP_INIT_SLOTS value: "80000" ports: - name: http-metrics containerPort: 9168 resources: requests: cpu: 75m memory: 100M volumeMounts: - name: gitlab-exporter-config mountPath: /var/opt/gitlab-exporter/templates/gitlab-exporter.yml.erb subPath: gitlab-exporter.yml.erb - name: gitlab-exporter-secrets mountPath: /etc/gitlab readOnly: true - name: etc-ssl-certs mountPath: /etc/ssl/certs/ readOnly: true - name: etc-pki-ca-trust-extracted-pem mountPath: /etc/pki/ca-trust/extracted/pem readOnly: true livenessProbe: exec: command: - pgrep - "-f" - gitlab-exporter readinessProbe: exec: command: - pgrep - "-f" - gitlab-exporter securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL runAsNonRoot: true runAsUser: 1000 lifecycle: preStop: exec: command: - /bin/bash - "-c" - "pkill -f 'gitlab-exporter'" initContainers: - name: certificates image: "registry.gitlab.com/gitlab-org/build/cng/certificates:v18.8.2" env: - name: TZ value: UTC - name: MALLOC_CONF value: "dirty_decay_ms:0,muzzy_decay_ms:0" - name: RUBY_GC_HEAP_FREE_SLOTS_MAX_RATIO value: "0.111" - name: RUBY_GC_HEAP_FREE_SLOTS_MIN_RATIO value: "0.055" - name: RUBY_GC_HEAP_INIT_SLOTS value: "80000" resources: requests: cpu: 50m volumeMounts: - name: etc-ssl-certs mountPath: /etc/ssl/certs readOnly: false - name: etc-pki-ca-trust-extracted-pem mountPath: /etc/pki/ca-trust/extracted/pem readOnly: false - name: custom-ca-certificates mountPath: /usr/local/share/ca-certificates readOnly: true securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL runAsNonRoot: true - name: configure image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-base:v18.8.2" command: - sh - /config/configure env: - name: TZ value: UTC - name: MALLOC_CONF value: "dirty_decay_ms:0,muzzy_decay_ms:0" - name: RUBY_GC_HEAP_FREE_SLOTS_MAX_RATIO value: "0.111" - name: RUBY_GC_HEAP_FREE_SLOTS_MIN_RATIO value: "0.055" - name: RUBY_GC_HEAP_INIT_SLOTS value: "80000" resources: requests: cpu: 50m volumeMounts: - name: gitlab-exporter-config mountPath: /config readOnly: true - name: init-gitlab-exporter-secrets mountPath: /init-config readOnly: true - name: gitlab-exporter-secrets mountPath: /init-secrets readOnly: false securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL runAsNonRoot: true securityContext: fsGroup: 1000 runAsUser: 1000 seccompProfile: type: RuntimeDefault volumes: - name: gitlab-exporter-config configMap: name: gitlab-gitlab-exporter - name: init-gitlab-exporter-secrets projected: defaultMode: 256 sources: - secret: name: db-gitlab-app items: - key: password path: postgres/psql-password-ci - secret: name: db-gitlab-app items: - key: password path: postgres/psql-password-main - secret: name: gitlab-redis-secret items: - key: secret path: redis/redis-password - name: gitlab-exporter-secrets emptyDir: medium: Memory - name: etc-ssl-certs emptyDir: medium: Memory - name: etc-pki-ca-trust-extracted-pem emptyDir: medium: Memory - name: custom-ca-certificates projected: defaultMode: 288 sources: - secret: name: aethernet.crt - secret: name: gitlab-wildcard-tls-ca (root level) + one document added: apiVersion: apps/v1 kind: Deployment metadata: name: gitlab-gitlab-shell namespace: gitlab labels: app: gitlab-shell app.kubernetes.io/name: gitlab helm.toolkit.fluxcd.io/name: gitlab helm.toolkit.fluxcd.io/namespace: flux-system heritage: Helm release: gitlab spec: selector: matchLabels: app: gitlab-shell release: gitlab template: metadata: annotations: cluster-autoscaler.kubernetes.io/safe-to-evict: "true" labels: app: gitlab-shell app.kubernetes.io/name: gitlab heritage: Helm release: gitlab spec: affinity: podAntiAffinity: preferredDuringSchedulingIgnoredDuringExecution: - podAffinityTerm: labelSelector: matchLabels: app: gitlab-shell release: gitlab topologyKey: kubernetes.io/hostname weight: 1 automountServiceAccountToken: false containers: - name: gitlab-shell image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-shell:v14.45.5" env: - name: CONFIG_TEMPLATE_DIRECTORY value: /etc/gitlab-shell - name: CONFIG_DIRECTORY value: /srv/gitlab-shell - name: KEYS_DIRECTORY value: /etc/gitlab-secrets/ssh - name: SSH_DAEMON value: openssh - name: GODEBUG value: "tlsmlkem=0,tlskyber=0" - name: TZ value: UTC ports: - name: ssh containerPort: 2222 readinessProbe: failureThreshold: 2 initialDelaySeconds: 10 periodSeconds: 5 successThreshold: 1 tcpSocket: port: 2222 timeoutSeconds: 3 resources: requests: cpu: 0 memory: 6M volumeMounts: - name: shell-config mountPath: /etc/gitlab-shell - name: shell-secrets mountPath: /etc/gitlab-secrets readOnly: true - name: shell-config mountPath: /etc/krb5.conf readOnly: true subPath: krb5.conf - name: sshd-config mountPath: /etc/ssh/sshd_config readOnly: true subPath: sshd_config - name: etc-ssl-certs mountPath: /etc/ssl/certs/ readOnly: true - name: etc-pki-ca-trust-extracted-pem mountPath: /etc/pki/ca-trust/extracted/pem readOnly: true livenessProbe: exec: command: - /scripts/healthcheck failureThreshold: 3 initialDelaySeconds: 10 periodSeconds: 10 successThreshold: 1 timeoutSeconds: 3 securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL runAsNonRoot: true runAsUser: 1000 initContainers: - name: certificates image: "registry.gitlab.com/gitlab-org/build/cng/certificates:v18.8.2" env: - name: TZ value: UTC resources: requests: cpu: 50m volumeMounts: - name: etc-ssl-certs mountPath: /etc/ssl/certs readOnly: false - name: etc-pki-ca-trust-extracted-pem mountPath: /etc/pki/ca-trust/extracted/pem readOnly: false - name: custom-ca-certificates mountPath: /usr/local/share/ca-certificates readOnly: true securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL runAsNonRoot: true - name: configure image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-base:v18.8.2" command: - sh - /config/configure env: - name: TZ value: UTC resources: requests: cpu: 50m volumeMounts: - name: shell-config mountPath: /config readOnly: true - name: shell-init-secrets mountPath: /init-config readOnly: true - name: shell-secrets mountPath: /init-secrets readOnly: false securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL runAsNonRoot: true securityContext: fsGroup: 1000 runAsUser: 1000 seccompProfile: type: RuntimeDefault terminationGracePeriodSeconds: 30 volumes: - name: shell-config configMap: name: gitlab-gitlab-shell - name: sshd-config configMap: name: gitlab-gitlab-shell-sshd - name: shell-init-secrets projected: defaultMode: 288 sources: - secret: name: gitlab-gitlab-shell-host-keys - secret: name: gitlab-gitlab-shell-secret items: - key: secret path: shell/.gitlab_shell_secret - name: shell-secrets emptyDir: medium: Memory - name: etc-ssl-certs emptyDir: medium: Memory - name: etc-pki-ca-trust-extracted-pem emptyDir: medium: Memory - name: custom-ca-certificates projected: defaultMode: 288 sources: - secret: name: aethernet.crt - secret: name: gitlab-wildcard-tls-ca (root level) + one document added: apiVersion: apps/v1 kind: Deployment metadata: name: gitlab-kas namespace: gitlab labels: app: kas app.kubernetes.io/name: gitlab helm.toolkit.fluxcd.io/name: gitlab helm.toolkit.fluxcd.io/namespace: flux-system heritage: Helm release: gitlab spec: selector: matchLabels: app: kas release: gitlab template: metadata: annotations: cluster-autoscaler.kubernetes.io/safe-to-evict: "true" gitlab.com/prometheus_path: /metrics gitlab.com/prometheus_port: "8151" gitlab.com/prometheus_scrape: "true" prometheus.io/path: /metrics prometheus.io/port: "8151" prometheus.io/scrape: "true" labels: app: kas app.kubernetes.io/name: gitlab heritage: Helm release: gitlab spec: affinity: podAntiAffinity: preferredDuringSchedulingIgnoredDuringExecution: - podAffinityTerm: labelSelector: matchLabels: app: kas release: gitlab topologyKey: kubernetes.io/hostname weight: 1 automountServiceAccountToken: false containers: - name: kas image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-kas:v18.8.2" args: - "--configuration-file=/etc/kas/config.yaml" env: - name: OWN_PRIVATE_API_HOST value: gitlab-kas.gitlab.svc - name: GODEBUG value: "tlsmlkem=0,tlskyber=0" - name: TZ value: UTC livenessProbe: httpGet: path: /liveness port: 8151 initialDelaySeconds: 15 periodSeconds: 20 ports: - name: kas containerPort: 8150 - name: kas-k8s-api containerPort: 8154 - name: kas-private-api containerPort: 8155 - name: http-metrics containerPort: 8151 readinessProbe: httpGet: path: /readiness port: 8151 initialDelaySeconds: 5 periodSeconds: 10 resources: requests: cpu: 100m memory: 256Mi volumeMounts: - name: init-etc-kas mountPath: /etc/kas readOnly: true - name: etc-ssl-certs mountPath: /etc/ssl/certs/ readOnly: true - name: etc-pki-ca-trust-extracted-pem mountPath: /etc/pki/ca-trust/extracted/pem readOnly: true securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL runAsNonRoot: true runAsUser: 65532 initContainers: - name: certificates image: "registry.gitlab.com/gitlab-org/build/cng/certificates:v18.8.2" env: - name: TZ value: UTC resources: requests: cpu: 50m volumeMounts: - name: etc-ssl-certs mountPath: /etc/ssl/certs readOnly: false - name: etc-pki-ca-trust-extracted-pem mountPath: /etc/pki/ca-trust/extracted/pem readOnly: false - name: custom-ca-certificates mountPath: /usr/local/share/ca-certificates readOnly: true securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL runAsNonRoot: true securityContext: fsGroup: 65532 runAsGroup: 65532 runAsUser: 65532 seccompProfile: type: RuntimeDefault terminationGracePeriodSeconds: 300 volumes: - name: etc-ssl-certs emptyDir: medium: Memory - name: etc-pki-ca-trust-extracted-pem emptyDir: medium: Memory - name: custom-ca-certificates projected: defaultMode: 288 sources: - secret: name: aethernet.crt - secret: name: gitlab-wildcard-tls-ca - name: init-etc-kas projected: defaultMode: 288 sources: - configMap: name: gitlab-kas - secret: name: gitlab-gitlab-kas-secret items: - key: kas_shared_secret path: .gitlab_kas_secret - secret: name: gitlab-kas-private-api items: - key: kas_private_api_secret path: .gitlab_kas_private_api_secret - secret: name: gitlab-kas-websocket-token items: - key: kas_websocket_token_secret path: .gitlab_kas_websocket_token_secret - secret: name: gitlab-redis-secret items: - key: secret path: redis/redis-password (root level) + one document added: apiVersion: apps/v1 kind: Deployment metadata: name: gitlab-sidekiq-all-in-1-v2 namespace: gitlab labels: app: sidekiq app.kubernetes.io/name: gitlab helm.toolkit.fluxcd.io/name: gitlab helm.toolkit.fluxcd.io/namespace: flux-system heritage: Helm queue-pod-name: all-in-1 release: gitlab spec: selector: matchLabels: app: sidekiq queue-pod-name: all-in-1 release: gitlab template: metadata: annotations: cluster-autoscaler.kubernetes.io/safe-to-evict: "true" gitlab.com/prometheus_path: /metrics gitlab.com/prometheus_port: "3807" gitlab.com/prometheus_scrape: "true" prometheus.io/path: /metrics prometheus.io/port: "3807" prometheus.io/scrape: "true" labels: app: sidekiq app.kubernetes.io/name: gitlab heritage: Helm queue-pod-name: all-in-1 release: gitlab spec: affinity: podAntiAffinity: preferredDuringSchedulingIgnoredDuringExecution: - podAffinityTerm: labelSelector: matchLabels: app: sidekiq release: gitlab topologyKey: kubernetes.io/hostname weight: 1 automountServiceAccountToken: false containers: - name: sidekiq image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-sidekiq-ce:v18.8.2" env: - name: prometheus_multiproc_dir value: /metrics - name: CONFIG_TEMPLATE_DIRECTORY value: /var/opt/gitlab/templates - name: CONFIG_DIRECTORY value: /srv/gitlab/config - name: SIDEKIQ_CONCURRENCY value: "20" - name: SIDEKIQ_TIMEOUT value: "25" - name: SIDEKIQ_QUEUES value: null - name: SIDEKIQ_DAEMON_MEMORY_KILLER value: "1" - name: SIDEKIQ_MEMORY_KILLER_CHECK_INTERVAL value: "3" - name: SIDEKIQ_MEMORY_KILLER_MAX_RSS value: "2000000" - name: SIDEKIQ_MEMORY_KILLER_GRACE_TIME value: "900" - name: SIDEKIQ_MEMORY_KILLER_SHUTDOWN_WAIT value: "30" - name: ENABLE_BOOTSNAP value: "1" - name: TZ value: UTC livenessProbe: failureThreshold: 3 httpGet: path: /liveness port: 3808 initialDelaySeconds: 20 periodSeconds: 60 successThreshold: 1 timeoutSeconds: 30 ports: - name: http-metrics containerPort: 3807 readinessProbe: failureThreshold: 3 httpGet: path: /readiness port: 3808 initialDelaySeconds: 0 periodSeconds: 10 successThreshold: 1 timeoutSeconds: 2 resources: requests: cpu: 900m memory: 2G volumeMounts: - name: sidekiq-metrics mountPath: /metrics - name: sidekiq-config mountPath: /var/opt/gitlab/templates readOnly: true - name: sidekiq-secrets mountPath: /etc/gitlab readOnly: true - name: sidekiq-secrets mountPath: /srv/gitlab/config/secrets.yml subPath: rails-secrets/secrets.yml - name: sidekiq-config mountPath: /etc/krb5.conf subPath: krb5.conf - name: sidekiq-config mountPath: /srv/gitlab/config/initializers/smtp_settings.rb subPath: smtp_settings.rb - name: sidekiq-config mountPath: /srv/gitlab/INSTALLATION_TYPE subPath: installation_type - name: etc-ssl-certs mountPath: /etc/ssl/certs/ readOnly: true - name: etc-pki-ca-trust-extracted-pem mountPath: /etc/pki/ca-trust/extracted/pem readOnly: true securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL runAsNonRoot: true runAsUser: 1000 lifecycle: preStop: exec: command: - /bin/bash - "-c" - "pkill -f 'sidekiq'" initContainers: - name: certificates image: "registry.gitlab.com/gitlab-org/build/cng/certificates:v18.8.2" env: - name: TZ value: UTC resources: requests: cpu: 50m volumeMounts: - name: etc-ssl-certs mountPath: /etc/ssl/certs readOnly: false - name: etc-pki-ca-trust-extracted-pem mountPath: /etc/pki/ca-trust/extracted/pem readOnly: false - name: custom-ca-certificates mountPath: /usr/local/share/ca-certificates readOnly: true securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL runAsNonRoot: true runAsUser: 1000 - name: configure image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-base:v18.8.2" command: - sh - /config/configure env: - name: TZ value: UTC resources: requests: cpu: 50m volumeMounts: - name: sidekiq-config mountPath: /config readOnly: true - name: init-sidekiq-secrets mountPath: /init-config readOnly: true - name: sidekiq-secrets mountPath: /init-secrets readOnly: false securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL runAsNonRoot: true runAsUser: 1000 - name: dependencies image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-sidekiq-ce:v18.8.2" args: - /scripts/wait-for-deps env: - name: CONFIG_TEMPLATE_DIRECTORY value: /var/opt/gitlab/templates - name: CONFIG_DIRECTORY value: /srv/gitlab/config - name: SIDEKIQ_CONCURRENCY value: "20" - name: SIDEKIQ_TIMEOUT value: "25" - name: ENABLE_BOOTSNAP value: "1" - name: TZ value: UTC resources: requests: cpu: 50m volumeMounts: - name: etc-ssl-certs mountPath: /etc/ssl/certs/ readOnly: true - name: etc-pki-ca-trust-extracted-pem mountPath: /etc/pki/ca-trust/extracted/pem readOnly: true - name: sidekiq-config mountPath: /var/opt/gitlab/templates readOnly: true - name: sidekiq-secrets mountPath: /etc/gitlab readOnly: true - name: sidekiq-secrets mountPath: /srv/gitlab/config/secrets.yml readOnly: true subPath: rails-secrets/secrets.yml securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL runAsNonRoot: true runAsUser: 1000 securityContext: fsGroup: 1000 runAsUser: 1000 seccompProfile: type: RuntimeDefault terminationGracePeriodSeconds: 30 volumes: - name: sidekiq-metrics emptyDir: medium: Memory - name: sidekiq-config projected: sources: - configMap: name: gitlab-sidekiq - name: init-sidekiq-secrets projected: defaultMode: 256 sources: - secret: name: gitlab-rails-secret items: - key: secrets.yml path: rails-secrets/secrets.yml - secret: name: gitlab-gitaly-secret items: - key: token path: gitaly/gitaly_token - secret: name: gitlab-redis-secret items: - key: secret path: redis/redis-password - secret: name: db-gitlab-app items: - key: password path: postgres/psql-password-ci - secret: name: db-gitlab-app items: - key: password path: postgres/psql-password-main - secret: name: gitlab-registry-secret items: - key: registry-auth.key path: registry/gitlab-registry.key - secret: name: gitlab-registry-notification items: - key: secret path: registry/notificationSecret - secret: name: gitlab-gitlab-kas-secret items: - key: kas_shared_secret path: kas/.gitlab_kas_secret - secret: name: gitlab-zoekt-basicauth optional: true items: - key: gitlab_username path: zoekt/.gitlab_zoekt_username - key: gitlab_password path: zoekt/.gitlab_zoekt_password - secret: name: gitlab-object-store-configs items: - key: connection.yaml path: objectstorage/object_store - secret: name: authentik-oidc items: - key: config.yaml path: omniauth/authentik-oidc/config.yaml - name: sidekiq-secrets emptyDir: medium: Memory - name: etc-ssl-certs emptyDir: medium: Memory - name: etc-pki-ca-trust-extracted-pem emptyDir: medium: Memory - name: custom-ca-certificates projected: defaultMode: 288 sources: - secret: name: aethernet.crt - secret: name: gitlab-wildcard-tls-ca (root level) + one document added: apiVersion: apps/v1 kind: Deployment metadata: name: gitlab-toolbox namespace: gitlab labels: app: toolbox app.kubernetes.io/name: gitlab helm.toolkit.fluxcd.io/name: gitlab helm.toolkit.fluxcd.io/namespace: flux-system heritage: Helm release: gitlab spec: replicas: 1 selector: matchLabels: app: toolbox release: gitlab strategy: type: Recreate rollingUpdate: null template: metadata: annotations: cluster-autoscaler.kubernetes.io/safe-to-evict: "true" labels: app: toolbox app.kubernetes.io/name: gitlab heritage: Helm release: gitlab spec: affinity: podAntiAffinity: preferredDuringSchedulingIgnoredDuringExecution: - podAffinityTerm: labelSelector: matchLabels: app: gitaly release: gitlab topologyKey: kubernetes.io/hostname weight: 1 automountServiceAccountToken: false containers: - name: toolbox image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-toolbox-ce:v18.8.2" args: - /bin/bash - "-c" - "cp -v -r -L /etc/gitlab/.s3cfg $HOME/.s3cfg && while sleep 3600; do :; done" env: - name: ARTIFACTS_BUCKET_NAME value: gitlab-artifacts - name: REGISTRY_BUCKET_NAME value: gitlab-container-registry - name: LFS_BUCKET_NAME value: gitlab-lfs - name: UPLOADS_BUCKET_NAME value: gitlab-uploads - name: PACKAGES_BUCKET_NAME value: gitlab-packages - name: EXTERNAL_DIFFS_BUCKET_NAME value: gitlab-external-diffs - name: TERRAFORM_STATE_BUCKET_NAME value: gitlab-terraform-state - name: CI_SECURE_FILES_BUCKET_NAME value: gitlab-ci-secure-files - name: BACKUP_BUCKET_NAME value: gitlab-backup - name: BACKUP_BACKEND value: s3 - name: TMP_BUCKET_NAME value: gitlab-tmp-storage - name: PAGES_BUCKET_NAME value: gitlab-pages - name: ENABLE_BOOTSNAP value: "1" - name: CONFIG_TEMPLATE_DIRECTORY value: /var/opt/gitlab/templates - name: CONFIG_DIRECTORY value: /srv/gitlab/config - name: TZ value: UTC resources: requests: cpu: 50m memory: 350M volumeMounts: - name: toolbox-config mountPath: /var/opt/gitlab/templates - name: toolbox-config mountPath: /etc/krb5.conf subPath: krb5.conf - name: toolbox-config mountPath: /srv/gitlab/config/initializers/smtp_settings.rb subPath: smtp_settings.rb - name: toolbox-secrets mountPath: /etc/gitlab readOnly: true - name: toolbox-secrets mountPath: /srv/gitlab/config/secrets.yml subPath: rails-secrets/secrets.yml - name: toolbox-tmp mountPath: /srv/gitlab/tmp readOnly: false - name: etc-ssl-certs mountPath: /etc/ssl/certs/ readOnly: true - name: etc-pki-ca-trust-extracted-pem mountPath: /etc/pki/ca-trust/extracted/pem readOnly: true securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL runAsNonRoot: true runAsUser: 1000 initContainers: - name: certificates image: "registry.gitlab.com/gitlab-org/build/cng/certificates:v18.8.2" env: - name: TZ value: UTC resources: requests: cpu: 50m volumeMounts: - name: etc-ssl-certs mountPath: /etc/ssl/certs readOnly: false - name: etc-pki-ca-trust-extracted-pem mountPath: /etc/pki/ca-trust/extracted/pem readOnly: false - name: custom-ca-certificates mountPath: /usr/local/share/ca-certificates readOnly: true securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL runAsNonRoot: true runAsUser: 1000 - name: configure image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-base:v18.8.2" command: - sh - /config/configure env: - name: TZ value: UTC resources: requests: cpu: 50m volumeMounts: - name: toolbox-config mountPath: /config readOnly: true - name: init-toolbox-secrets mountPath: /init-config readOnly: true - name: toolbox-secrets mountPath: /init-secrets readOnly: false securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL runAsNonRoot: true runAsUser: 1000 securityContext: fsGroup: 1000 runAsGroup: 1000 runAsUser: 1000 seccompProfile: type: RuntimeDefault volumes: - name: toolbox-config projected: sources: - configMap: name: gitlab-toolbox - name: toolbox-tmp emptyDir: {} - name: init-toolbox-secrets projected: defaultMode: 256 sources: - secret: name: gitlab-rails-secret items: - key: secrets.yml path: rails-secrets/secrets.yml - secret: name: gitlab-gitlab-shell-secret items: - key: secret path: shell/.gitlab_shell_secret - secret: name: gitlab-gitaly-secret items: - key: token path: gitaly/gitaly_token - secret: name: gitlab-redis-secret items: - key: secret path: redis/redis-password - secret: name: db-gitlab-app items: - key: password path: postgres/psql-password-ci - secret: name: db-gitlab-app items: - key: password path: postgres/psql-password-main - secret: name: gitlab-registry-secret items: - key: registry-auth.key path: registry/gitlab-registry.key - secret: name: gitlab-registry-notification items: - key: secret path: registry/notificationSecret - secret: name: gitlab-object-store-configs items: - key: s3cmd.cfg path: objectstorage/.s3cfg - secret: name: gitlab-gitlab-kas-secret items: - key: kas_shared_secret path: kas/.gitlab_kas_secret - secret: name: gitlab-zoekt-basicauth optional: true items: - key: gitlab_username path: zoekt/.gitlab_zoekt_username - key: gitlab_password path: zoekt/.gitlab_zoekt_password - secret: name: gitlab-object-store-configs items: - key: connection.yaml path: objectstorage/object_store - secret: name: authentik-oidc items: - key: config.yaml path: omniauth/authentik-oidc/config.yaml - name: toolbox-secrets emptyDir: medium: Memory - name: etc-ssl-certs emptyDir: medium: Memory - name: etc-pki-ca-trust-extracted-pem emptyDir: medium: Memory - name: custom-ca-certificates projected: defaultMode: 288 sources: - secret: name: aethernet.crt - secret: name: gitlab-wildcard-tls-ca (root level) + one document added: apiVersion: apps/v1 kind: Deployment metadata: name: gitlab-webservice-default namespace: gitlab labels: app: webservice app.kubernetes.io/name: gitlab gitlab.com/webservice-name: default helm.toolkit.fluxcd.io/name: gitlab helm.toolkit.fluxcd.io/namespace: flux-system heritage: Helm release: gitlab spec: selector: matchLabels: app: webservice gitlab.com/webservice-name: default release: gitlab template: metadata: annotations: cluster-autoscaler.kubernetes.io/safe-to-evict: "true" gitlab.com/prometheus_path: /metrics gitlab.com/prometheus_port: "8083" gitlab.com/prometheus_scrape: "true" prometheus.io/path: /metrics prometheus.io/port: "8083" prometheus.io/scrape: "true" labels: app: webservice app.kubernetes.io/name: gitlab gitlab.com/webservice-name: default heritage: Helm release: gitlab spec: affinity: podAntiAffinity: preferredDuringSchedulingIgnoredDuringExecution: - podAffinityTerm: labelSelector: matchLabels: app: webservice gitlab.com/webservice-name: default release: gitlab topologyKey: kubernetes.io/hostname weight: 1 automountServiceAccountToken: false containers: - name: webservice image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-webservice-ce:v18.8.2" env: - name: TZ value: UTC - name: GITLAB_WEBSERVER value: puma - name: TMPDIR value: /tmp/gitlab - name: CONFIG_TEMPLATE_DIRECTORY value: /var/opt/gitlab/templates - name: CONFIG_DIRECTORY value: /srv/gitlab/config - name: prometheus_multiproc_dir value: /metrics - name: ENABLE_BOOTSNAP value: "1" - name: WORKER_PROCESSES value: "2" - name: WORKER_TIMEOUT value: "60" - name: INTERNAL_PORT value: "8080" - name: PUMA_THREADS_MIN value: "4" - name: PUMA_THREADS_MAX value: "4" - name: PUMA_WORKER_MAX_MEMORY value: - name: DISABLE_PUMA_WORKER_KILLER value: "true" - name: BIND_IP6 value: "false" - name: PUMA_CONTROL_PORT value: "9293" - name: SHUTDOWN_BLACKOUT_SECONDS value: "10" - name: WORKHORSE_ARCHIVE_CACHE_DISABLED value: "true" livenessProbe: failureThreshold: 3 httpGet: path: /-/liveness port: 8080 initialDelaySeconds: 20 periodSeconds: 60 successThreshold: 1 timeoutSeconds: 30 ports: - name: http-webservice containerPort: 8080 - name: http-metrics-ws containerPort: 8083 readinessProbe: failureThreshold: 2 httpGet: path: /-/readiness port: 8080 initialDelaySeconds: 0 periodSeconds: 5 successThreshold: 1 timeoutSeconds: 2 resources: requests: cpu: 300m memory: 2.5G volumeMounts: - name: webservice-metrics mountPath: /metrics - name: webservice-config mountPath: /var/opt/gitlab/templates - name: webservice-secrets mountPath: /etc/gitlab readOnly: true - name: webservice-secrets mountPath: /srv/gitlab/config/secrets.yml subPath: rails-secrets/secrets.yml - name: webservice-config mountPath: /etc/krb5.conf subPath: krb5.conf - name: webservice-config mountPath: /srv/gitlab/config/initializers/smtp_settings.rb subPath: smtp_settings.rb - name: webservice-config mountPath: /srv/gitlab/INSTALLATION_TYPE subPath: installation_type - name: shared-upload-directory mountPath: /srv/gitlab/public/uploads/tmp readOnly: false - name: shared-tmp mountPath: /tmp readOnly: false - name: etc-ssl-certs mountPath: /etc/ssl/certs/ readOnly: true - name: etc-pki-ca-trust-extracted-pem mountPath: /etc/pki/ca-trust/extracted/pem readOnly: true securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL runAsNonRoot: true runAsUser: 1000 lifecycle: preStop: exec: command: - /bin/bash - "-c" - "pkill -SIGINT -o ruby" - name: gitlab-workhorse image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-workhorse-ce:v18.8.2" env: - name: TZ value: UTC - name: GODEBUG value: "tlsmlkem=0,tlskyber=0" - name: TMPDIR value: /tmp/gitlab - name: GITLAB_WORKHORSE_AUTH_BACKEND value: "http://localhost:8080" - name: GITLAB_WORKHORSE_EXTRA_ARGS value: - name: GITLAB_WORKHORSE_LISTEN_PORT value: "8181" - name: GITLAB_WORKHORSE_LOG_FORMAT value: json - name: CONFIG_TEMPLATE_DIRECTORY value: /var/opt/gitlab/templates - name: CONFIG_DIRECTORY value: /srv/gitlab/config - name: SHUTDOWN_BLACKOUT_SECONDS value: "10" - name: PUMA_CONTROL_PORT value: "9293" ports: - name: http-workhorse containerPort: 8181 resources: requests: cpu: 100m memory: 100M volumeMounts: - name: workhorse-config mountPath: /var/opt/gitlab/templates - name: workhorse-secrets mountPath: /etc/gitlab readOnly: true - name: shared-upload-directory mountPath: /srv/gitlab/public/uploads/tmp readOnly: false - name: shared-tmp mountPath: /tmp readOnly: false - name: etc-ssl-certs mountPath: /etc/ssl/certs/ readOnly: true - name: etc-pki-ca-trust-extracted-pem mountPath: /etc/pki/ca-trust/extracted/pem readOnly: true livenessProbe: exec: command: - /scripts/healthcheck failureThreshold: 3 initialDelaySeconds: 20 periodSeconds: 60 successThreshold: 1 timeoutSeconds: 30 readinessProbe: exec: command: - /scripts/healthcheck failureThreshold: 3 initialDelaySeconds: 0 periodSeconds: 10 successThreshold: 1 timeoutSeconds: 2 securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL runAsNonRoot: true runAsUser: 1000 lifecycle: preStop: exec: command: - /bin/bash - "-c" - "sleep $SHUTDOWN_BLACKOUT_SECONDS" initContainers: - name: certificates image: "registry.gitlab.com/gitlab-org/build/cng/certificates:v18.8.2" env: - name: TZ value: UTC resources: requests: cpu: 50m volumeMounts: - name: etc-ssl-certs mountPath: /etc/ssl/certs readOnly: false - name: etc-pki-ca-trust-extracted-pem mountPath: /etc/pki/ca-trust/extracted/pem readOnly: false - name: custom-ca-certificates mountPath: /usr/local/share/ca-certificates readOnly: true securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL runAsNonRoot: true runAsUser: 1000 - name: configure image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-base:v18.8.2" args: - "-c" - "sh -x /config-webservice/configure ; sh -x /config-workhorse/configure ; mkdir -p -m 3770 /tmp/gitlab" command: - sh env: - name: TZ value: UTC resources: requests: cpu: 50m volumeMounts: - name: webservice-config mountPath: /config-webservice readOnly: true - name: workhorse-config mountPath: /config-workhorse readOnly: true - name: init-webservice-secrets mountPath: /init-config readOnly: true - name: webservice-secrets mountPath: /init-secrets readOnly: false - name: workhorse-secrets mountPath: /init-secrets-workhorse readOnly: false - name: shared-tmp mountPath: /tmp readOnly: false securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL runAsNonRoot: true runAsUser: 1000 - name: dependencies image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-webservice-ce:v18.8.2" args: - /scripts/wait-for-deps env: - name: TZ value: UTC - name: CONFIG_TEMPLATE_DIRECTORY value: /var/opt/gitlab/templates - name: CONFIG_DIRECTORY value: /srv/gitlab/config - name: WORKHORSE_ARCHIVE_CACHE_DISABLED value: "1" - name: ENABLE_BOOTSNAP value: "1" resources: requests: cpu: 50m volumeMounts: - name: etc-ssl-certs mountPath: /etc/ssl/certs/ readOnly: true - name: etc-pki-ca-trust-extracted-pem mountPath: /etc/pki/ca-trust/extracted/pem readOnly: true - name: webservice-config mountPath: /var/opt/gitlab/templates - name: webservice-secrets mountPath: /etc/gitlab readOnly: true - name: webservice-secrets mountPath: /srv/gitlab/config/secrets.yml readOnly: true subPath: rails-secrets/secrets.yml securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL runAsNonRoot: true runAsUser: 1000 securityContext: fsGroup: 1000 runAsUser: 1000 seccompProfile: type: RuntimeDefault volumes: - name: shared-tmp emptyDir: {} - name: webservice-metrics emptyDir: medium: Memory - name: webservice-config configMap: name: gitlab-webservice - name: workhorse-config configMap: name: gitlab-workhorse-default - name: init-webservice-secrets projected: defaultMode: 256 sources: - secret: name: gitlab-rails-secret items: - key: secrets.yml path: rails-secrets/secrets.yml - secret: name: gitlab-gitlab-shell-secret items: - key: secret path: shell/.gitlab_shell_secret - secret: name: gitlab-gitaly-secret items: - key: token path: gitaly/gitaly_token - secret: name: gitlab-redis-secret items: - key: secret path: redis/redis-password - secret: name: db-gitlab-app items: - key: password path: postgres/psql-password-ci - secret: name: db-gitlab-app items: - key: password path: postgres/psql-password-main - secret: name: gitlab-registry-secret items: - key: registry-auth.key path: registry/gitlab-registry.key - secret: name: gitlab-registry-notification items: - key: secret path: registry/notificationSecret - secret: name: gitlab-gitlab-workhorse-secret items: - key: shared_secret path: gitlab-workhorse/secret - secret: name: gitlab-gitlab-kas-secret items: - key: kas_shared_secret path: kas/.gitlab_kas_secret - secret: name: gitlab-zoekt-basicauth optional: true items: - key: gitlab_username path: zoekt/.gitlab_zoekt_username - key: gitlab_password path: zoekt/.gitlab_zoekt_password - secret: name: gitlab-object-store-configs items: - key: connection.yaml path: objectstorage/object_store - secret: name: authentik-oidc items: - key: config.yaml path: omniauth/authentik-oidc/config.yaml - name: webservice-secrets emptyDir: medium: Memory - name: workhorse-secrets emptyDir: medium: Memory - name: shared-upload-directory emptyDir: {} - name: etc-ssl-certs emptyDir: medium: Memory - name: etc-pki-ca-trust-extracted-pem emptyDir: medium: Memory - name: custom-ca-certificates projected: defaultMode: 288 sources: - secret: name: aethernet.crt - secret: name: gitlab-wildcard-tls-ca (root level) + one document added: apiVersion: apps/v1 kind: Deployment metadata: name: gitlab-registry namespace: gitlab labels: app: registry app.kubernetes.io/name: gitlab helm.toolkit.fluxcd.io/name: gitlab helm.toolkit.fluxcd.io/namespace: flux-system heritage: Helm release: gitlab spec: selector: matchLabels: app: registry release: gitlab template: metadata: annotations: cluster-autoscaler.kubernetes.io/safe-to-evict: "true" labels: app: registry app.kubernetes.io/name: gitlab heritage: Helm release: gitlab spec: affinity: podAntiAffinity: preferredDuringSchedulingIgnoredDuringExecution: - podAffinityTerm: labelSelector: matchLabels: app: registry release: gitlab topologyKey: kubernetes.io/hostname weight: 1 automountServiceAccountToken: false containers: - name: registry image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-container-registry:v4.33.0-gitlab" env: - name: GODEBUG value: "tlsmlkem=0,tlskyber=0" - name: TZ value: UTC livenessProbe: failureThreshold: 3 httpGet: path: /debug/health port: debug scheme: HTTP initialDelaySeconds: 5 periodSeconds: 10 successThreshold: 1 timeoutSeconds: 1 ports: - name: http containerPort: 5000 - name: debug containerPort: 5001 readinessProbe: failureThreshold: 3 httpGet: path: /debug/health port: debug scheme: HTTP initialDelaySeconds: 5 periodSeconds: 5 successThreshold: 1 timeoutSeconds: 1 resources: requests: cpu: 50m memory: 32Mi volumeMounts: - name: registry-server-config mountPath: /etc/docker/registry/ readOnly: true - name: etc-ssl-certs mountPath: /etc/ssl/certs/ readOnly: true - name: etc-pki-ca-trust-extracted-pem mountPath: /etc/pki/ca-trust/extracted/pem readOnly: true securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL runAsNonRoot: true runAsUser: 1000 lifecycle: preStop: exec: command: - /bin/bash - "-c" - "sleep 5" initContainers: - name: certificates image: "registry.gitlab.com/gitlab-org/build/cng/certificates:v18.8.2" env: - name: TZ value: UTC resources: requests: cpu: 50m volumeMounts: - name: etc-ssl-certs mountPath: /etc/ssl/certs readOnly: false - name: etc-pki-ca-trust-extracted-pem mountPath: /etc/pki/ca-trust/extracted/pem readOnly: false - name: custom-ca-certificates mountPath: /usr/local/share/ca-certificates readOnly: true securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL runAsNonRoot: true runAsUser: 1000 - name: configure image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-base:v18.8.2" args: - sh - /config/configure env: - name: CONFIG_TEMPLATE_DIRECTORY value: /templates - name: CONFIG_DIRECTORY value: /registry - name: TZ value: UTC resources: requests: cpu: 50m volumeMounts: - name: registry-secrets mountPath: /config - name: registry-server-config-templates mountPath: /templates readOnly: true - name: registry-server-config mountPath: /registry securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL runAsNonRoot: true runAsUser: 1000 - name: dependencies image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-container-registry:v4.33.0-gitlab" command: - /scripts/wait-for-deps env: - name: TZ value: UTC resources: requests: cpu: 50m volumeMounts: - name: registry-server-config mountPath: /etc/docker/registry/ readOnly: true securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL runAsNonRoot: true runAsUser: 1000 securityContext: fsGroup: 1000 runAsUser: 1000 seccompProfile: type: RuntimeDefault terminationGracePeriodSeconds: 30 volumes: - name: registry-server-config-templates configMap: name: gitlab-registry items: - key: config.yml.tpl path: config.yml.tpl - name: registry-server-config emptyDir: medium: Memory - name: registry-secrets projected: sources: - configMap: name: gitlab-registry - secret: name: gitlab-registry-secret items: - key: registry-auth.crt path: certificate.crt - secret: name: gitlab-registry-httpsecret items: - key: secret path: httpSecret - secret: name: gitlab-object-store-configs items: - key: registry.yaml path: storage/config - secret: name: gitlab-registry-db-pass items: - key: password path: database_password - name: etc-ssl-certs emptyDir: medium: Memory - name: etc-pki-ca-trust-extracted-pem emptyDir: medium: Memory - name: custom-ca-certificates projected: defaultMode: 288 sources: - secret: name: aethernet.crt - secret: name: gitlab-wildcard-tls-ca (root level) + one document added: apiVersion: autoscaling/v2beta1 kind: HorizontalPodAutoscaler metadata: name: gitlab-gitlab-shell namespace: gitlab labels: app: gitlab-shell helm.toolkit.fluxcd.io/name: gitlab helm.toolkit.fluxcd.io/namespace: flux-system heritage: Helm release: gitlab spec: maxReplicas: 10 metrics: - type: Resource resource: name: cpu targetAverageValue: 100m minReplicas: 2 scaleTargetRef: apiVersion: apps/v1 kind: Deployment name: gitlab-gitlab-shell (root level) + one document added: apiVersion: autoscaling/v2beta1 kind: HorizontalPodAutoscaler metadata: name: gitlab-kas namespace: gitlab labels: app: kas helm.toolkit.fluxcd.io/name: gitlab helm.toolkit.fluxcd.io/namespace: flux-system heritage: Helm release: gitlab spec: maxReplicas: 10 metrics: - type: Resource resource: name: cpu targetAverageValue: 100m minReplicas: 2 scaleTargetRef: apiVersion: apps/v1 kind: Deployment name: gitlab-kas (root level) + one document added: apiVersion: autoscaling/v2beta1 kind: HorizontalPodAutoscaler metadata: name: gitlab-sidekiq-all-in-1-v2 namespace: gitlab labels: app: sidekiq helm.toolkit.fluxcd.io/name: gitlab helm.toolkit.fluxcd.io/namespace: flux-system heritage: Helm release: gitlab spec: maxReplicas: 10 metrics: - type: Resource resource: name: cpu targetAverageValue: 350m minReplicas: 1 scaleTargetRef: apiVersion: apps/v1 kind: Deployment name: gitlab-sidekiq-all-in-1-v2 (root level) + one document added: apiVersion: autoscaling/v2beta1 kind: HorizontalPodAutoscaler metadata: name: gitlab-webservice-default namespace: gitlab labels: app: webservice gitlab.com/webservice-name: default helm.toolkit.fluxcd.io/name: gitlab helm.toolkit.fluxcd.io/namespace: flux-system heritage: Helm release: gitlab spec: maxReplicas: 10 metrics: - type: Resource resource: name: cpu targetAverageValue: 1 minReplicas: 2 scaleTargetRef: apiVersion: apps/v1 kind: Deployment name: gitlab-webservice-default (root level) + one document added: apiVersion: autoscaling/v2beta1 kind: HorizontalPodAutoscaler metadata: name: gitlab-registry namespace: gitlab labels: app: registry helm.toolkit.fluxcd.io/name: gitlab helm.toolkit.fluxcd.io/namespace: flux-system heritage: Helm release: gitlab spec: maxReplicas: 10 metrics: - type: Resource resource: name: cpu targetAverageUtilization: 75 minReplicas: 2 scaleTargetRef: apiVersion: apps/v1 kind: Deployment name: gitlab-registry (root level) + one document added: apiVersion: apps/v1 kind: StatefulSet metadata: name: gitlab-gitaly namespace: gitlab labels: app: gitaly app.kubernetes.io/name: gitlab helm.toolkit.fluxcd.io/name: gitlab helm.toolkit.fluxcd.io/namespace: flux-system heritage: Helm release: gitlab spec: podManagementPolicy: Parallel replicas: 1 selector: matchLabels: app: gitaly release: gitlab serviceName: gitlab-gitaly template: metadata: annotations: gitlab.com/prometheus_path: /metrics gitlab.com/prometheus_port: "9236" gitlab.com/prometheus_scrape: "true" prometheus.io/path: /metrics prometheus.io/port: "9236" prometheus.io/scrape: "true" labels: app: gitaly app.kubernetes.io/name: gitlab heritage: Helm release: gitlab spec: affinity: podAntiAffinity: preferredDuringSchedulingIgnoredDuringExecution: - podAffinityTerm: labelSelector: matchLabels: app: gitaly release: gitlab topologyKey: kubernetes.io/hostname weight: 1 automountServiceAccountToken: false containers: - name: gitaly image: "registry.gitlab.com/gitlab-org/build/cng/gitaly:v18.8.2" env: - name: CONFIG_TEMPLATE_DIRECTORY value: /etc/gitaly/templates - name: CONFIG_DIRECTORY value: /etc/gitaly - name: GITALY_CONFIG_FILE value: /etc/gitaly/config.toml - name: SSL_CERT_DIR value: /etc/ssl/certs - name: GODEBUG value: "tlsmlkem=0,tlskyber=0" - name: TZ value: UTC livenessProbe: failureThreshold: 3 grpc: port: 8075 initialDelaySeconds: 0 periodSeconds: 10 successThreshold: 1 timeoutSeconds: 3 ports: - name: grpc-gitaly containerPort: 8075 - name: http-metrics containerPort: 9236 readinessProbe: failureThreshold: 3 grpc: port: 8075 initialDelaySeconds: 0 periodSeconds: 5 successThreshold: 1 timeoutSeconds: 3 resources: requests: cpu: 100m memory: 200Mi startupProbe: failureThreshold: 60 grpc: port: 8075 initialDelaySeconds: 1 periodSeconds: 1 successThreshold: 1 timeoutSeconds: 1 volumeMounts: - name: etc-ssl-certs mountPath: /etc/ssl/certs/ readOnly: true - name: etc-pki-ca-trust-extracted-pem mountPath: /etc/pki/ca-trust/extracted/pem readOnly: true - name: gitaly-config mountPath: /etc/gitaly/templates - name: gitaly-secrets mountPath: /etc/gitlab-secrets readOnly: true - name: repo-data mountPath: /home/git/repositories securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL runAsNonRoot: true runAsUser: 1000 initContainers: - name: certificates image: "registry.gitlab.com/gitlab-org/build/cng/certificates:v18.8.2" env: - name: TZ value: UTC resources: requests: cpu: 50m volumeMounts: - name: etc-ssl-certs mountPath: /etc/ssl/certs readOnly: false - name: etc-pki-ca-trust-extracted-pem mountPath: /etc/pki/ca-trust/extracted/pem readOnly: false - name: custom-ca-certificates mountPath: /usr/local/share/ca-certificates readOnly: true securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL runAsNonRoot: true - name: configure image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-base:v18.8.2" command: - sh - /config/configure env: - name: TZ value: UTC resources: requests: cpu: 50m volumeMounts: - name: gitaly-config mountPath: /config readOnly: true - name: init-gitaly-secrets mountPath: /init-config readOnly: true - name: gitaly-secrets mountPath: /init-secrets readOnly: false securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL runAsNonRoot: true securityContext: fsGroup: 1000 runAsUser: 1000 terminationGracePeriodSeconds: 30 volumes: - name: gitaly-config configMap: name: gitlab-gitaly - name: gitaly-secrets emptyDir: medium: Memory - name: init-gitaly-secrets projected: defaultMode: 288 sources: - secret: name: gitlab-gitaly-secret items: - key: token path: gitaly_token - secret: name: gitlab-gitlab-shell-secret items: - key: secret path: .gitlab_shell_secret - name: etc-ssl-certs emptyDir: medium: Memory - name: etc-pki-ca-trust-extracted-pem emptyDir: medium: Memory - name: custom-ca-certificates projected: defaultMode: 288 sources: - secret: name: aethernet.crt - secret: name: gitlab-wildcard-tls-ca volumeClaimTemplates: - metadata: name: repo-data annotations: null labels: app: gitaly release: gitlab spec: resources: requests: storage: 50Gi selector: null storageClassName: nfs-subdir accessModes: - ReadWriteOnce (root level) + one document added: apiVersion: apps/v1 kind: StatefulSet metadata: name: gitlab-redis-master namespace: gitlab labels: app.kubernetes.io/component: master app.kubernetes.io/instance: gitlab app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: redis helm.toolkit.fluxcd.io/name: gitlab helm.toolkit.fluxcd.io/namespace: flux-system spec: replicas: 1 selector: matchLabels: app.kubernetes.io/component: master app.kubernetes.io/instance: gitlab app.kubernetes.io/name: redis serviceName: gitlab-redis-headless template: metadata: annotations: prometheus.io/port: "9121" prometheus.io/scrape: "true" labels: app.kubernetes.io/component: master app.kubernetes.io/instance: gitlab app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: redis spec: affinity: nodeAffinity: null podAffinity: null podAntiAffinity: preferredDuringSchedulingIgnoredDuringExecution: - podAffinityTerm: labelSelector: matchLabels: app.kubernetes.io/component: master app.kubernetes.io/instance: gitlab app.kubernetes.io/name: redis topologyKey: kubernetes.io/hostname weight: 1 automountServiceAccountToken: false containers: - name: redis image: "docker.io/bitnamilegacy/redis:7.2.4-debian-12-r9" imagePullPolicy: IfNotPresent args: - "-c" - /opt/bitnami/scripts/start-scripts/start-master.sh command: - /bin/bash env: - name: BITNAMI_DEBUG value: "false" - name: REDIS_REPLICATION_MODE value: master - name: ALLOW_EMPTY_PASSWORD value: no - name: REDIS_PASSWORD_FILE value: /opt/bitnami/redis/secrets/redis-password - name: REDIS_TLS_ENABLED value: no - name: REDIS_PORT value: "6379" ports: - name: redis containerPort: 6379 volumeMounts: - name: start-scripts mountPath: /opt/bitnami/scripts/start-scripts - name: health mountPath: /health - name: redis-password mountPath: /opt/bitnami/redis/secrets/ - name: redis-data mountPath: /data - name: config mountPath: /opt/bitnami/redis/mounted-etc - name: empty-dir mountPath: /opt/bitnami/redis/etc/ subPath: app-conf-dir - name: empty-dir mountPath: /tmp subPath: tmp-dir livenessProbe: exec: command: - sh - "-c" - "/health/ping_liveness_local.sh 5" failureThreshold: 5 initialDelaySeconds: 20 periodSeconds: 5 successThreshold: 1 timeoutSeconds: 6 readinessProbe: exec: command: - sh - "-c" - "/health/ping_readiness_local.sh 1" failureThreshold: 5 initialDelaySeconds: 20 periodSeconds: 5 successThreshold: 1 timeoutSeconds: 2 securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL readOnlyRootFilesystem: false runAsGroup: 0 runAsNonRoot: true runAsUser: 1001 seLinuxOptions: null seccompProfile: type: RuntimeDefault - name: metrics image: "docker.io/bitnamilegacy/redis-exporter:1.58.0-debian-12-r4" imagePullPolicy: IfNotPresent command: - /bin/bash - "-c" - | if [[ -f '/secrets/redis-password' ]]; then export REDIS_PASSWORD=$(cat /secrets/redis-password) fi redis_exporter env: - name: REDIS_ALIAS value: gitlab-redis - name: REDIS_EXPORTER_WEB_LISTEN_ADDRESS value: ":9121" - name: REDIS_USER value: default livenessProbe: failureThreshold: 5 initialDelaySeconds: 10 periodSeconds: 10 successThreshold: 1 tcpSocket: port: metrics timeoutSeconds: 5 ports: - name: metrics containerPort: 9121 readinessProbe: failureThreshold: 3 httpGet: path: / port: metrics initialDelaySeconds: 5 periodSeconds: 10 successThreshold: 1 timeoutSeconds: 1 volumeMounts: - name: empty-dir mountPath: /tmp subPath: app-tmp-dir - name: redis-password mountPath: /secrets/ securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL readOnlyRootFilesystem: false runAsGroup: 0 runAsNonRoot: true runAsUser: 1001 seLinuxOptions: null seccompProfile: type: RuntimeDefault enableServiceLinks: true securityContext: fsGroup: 1001 fsGroupChangePolicy: Always supplementalGroups: [] sysctls: [] serviceAccountName: gitlab-redis-master terminationGracePeriodSeconds: 30 volumes: - name: start-scripts configMap: name: gitlab-redis-scripts defaultMode: 493 - name: health configMap: name: gitlab-redis-health defaultMode: 493 - name: redis-password secret: items: - key: secret path: redis-password secretName: gitlab-redis-secret - name: config configMap: name: gitlab-redis-configuration - name: empty-dir emptyDir: {} updateStrategy: type: RollingUpdate volumeClaimTemplates: - apiVersion: v1 kind: PersistentVolumeClaim metadata: name: redis-data labels: app.kubernetes.io/component: master app.kubernetes.io/instance: gitlab app.kubernetes.io/name: redis spec: resources: requests: storage: 8Gi storageClassName: longhorn accessModes: - ReadWriteOnce (root level) + one document added: apiVersion: batch/v1 kind: Job metadata: name: gitlab-migrations-c0164a8 namespace: gitlab labels: app: migrations helm.toolkit.fluxcd.io/name: gitlab helm.toolkit.fluxcd.io/namespace: flux-system heritage: Helm release: gitlab spec: activeDeadlineSeconds: 3600 backoffLimit: 6 template: metadata: labels: app: migrations heritage: Helm release: gitlab spec: automountServiceAccountToken: false containers: - name: migrations image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-toolbox-ce:v18.8.2" args: - /bin/bash - "-c" - | set -e; /scripts/wait-for-deps; /scripts/db-migrate; env: - name: CONFIG_TEMPLATE_DIRECTORY value: /var/opt/gitlab/templates - name: CONFIG_DIRECTORY value: /srv/gitlab/config - name: BYPASS_SCHEMA_VERSION value: "true" - name: ENABLE_BOOTSNAP value: "1" - name: TZ value: UTC resources: requests: cpu: 250m memory: 200Mi volumeMounts: - name: migrations-config mountPath: /var/opt/gitlab/templates - name: migrations-secrets mountPath: /etc/gitlab readOnly: true - name: migrations-secrets mountPath: /srv/gitlab/config/secrets.yml subPath: rails-secrets/secrets.yml - name: migrations-secrets mountPath: /srv/gitlab/config/initial_root_password subPath: migrations/initial_root_password - name: migrations-secrets mountPath: /srv/gitlab/config/gitlab_shared_runners_registration_token subPath: migrations/gitlab_shared_runners_registration_token - name: etc-ssl-certs mountPath: /etc/ssl/certs/ readOnly: true - name: etc-pki-ca-trust-extracted-pem mountPath: /etc/pki/ca-trust/extracted/pem readOnly: true securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL runAsNonRoot: true runAsUser: 1000 initContainers: - name: certificates image: "registry.gitlab.com/gitlab-org/build/cng/certificates:v18.8.2" env: - name: TZ value: UTC resources: requests: cpu: 50m volumeMounts: - name: etc-ssl-certs mountPath: /etc/ssl/certs readOnly: false - name: etc-pki-ca-trust-extracted-pem mountPath: /etc/pki/ca-trust/extracted/pem readOnly: false - name: custom-ca-certificates mountPath: /usr/local/share/ca-certificates readOnly: true securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL runAsNonRoot: true - name: configure image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-base:v18.8.2" command: - sh - /config/configure env: - name: TZ value: UTC resources: requests: cpu: 50m volumeMounts: - name: migrations-config mountPath: /config readOnly: true - name: init-migrations-secrets mountPath: /init-config readOnly: true - name: migrations-secrets mountPath: /init-secrets readOnly: false securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL runAsNonRoot: true restartPolicy: OnFailure securityContext: fsGroup: 1000 runAsUser: 1000 seccompProfile: type: RuntimeDefault volumes: - name: migrations-config configMap: name: gitlab-migrations - name: init-migrations-secrets projected: defaultMode: 256 sources: - secret: name: gitlab-rails-secret items: - key: secrets.yml path: rails-secrets/secrets.yml - secret: name: gitlab-gitaly-secret items: - key: token path: gitaly/gitaly_token - secret: name: gitlab-redis-secret items: - key: secret path: redis/redis-password - secret: name: db-gitlab-app items: - key: password path: postgres/psql-password-ci - secret: name: db-gitlab-app items: - key: password path: postgres/psql-password-main - secret: name: gitlab-object-store-configs items: - key: connection.yaml path: objectstorage/object_store - secret: name: gitlab-gitlab-initial-root-password items: - key: password path: migrations/initial_root_password - secret: name: gitlab-gitlab-runner-secret optional: true items: - key: runner-registration-token path: migrations/gitlab_shared_runners_registration_token - name: migrations-secrets emptyDir: medium: Memory - name: etc-ssl-certs emptyDir: medium: Memory - name: etc-pki-ca-trust-extracted-pem emptyDir: medium: Memory - name: custom-ca-certificates projected: defaultMode: 288 sources: - secret: name: aethernet.crt - secret: name: gitlab-wildcard-tls-ca (root level) + one document added: apiVersion: batch/v1 kind: Job metadata: name: gitlab-registry-migrations-8e2a9a9 namespace: gitlab labels: app: registry-migrations helm.toolkit.fluxcd.io/name: gitlab helm.toolkit.fluxcd.io/namespace: flux-system heritage: Helm release: gitlab spec: activeDeadlineSeconds: 3600 backoffLimit: 6 template: metadata: labels: app: registry-migrations heritage: Helm release: gitlab spec: containers: - name: migrations image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-container-registry:v4.33.0-gitlab" args: - /scripts/wait-for-deps - /scripts/db-migrate env: - name: BYPASS_SCHEMA_VERSION value: "true" resources: requests: cpu: 50m memory: 32Mi volumeMounts: - name: registry-server-config mountPath: /etc/docker/registry/ readOnly: true - name: etc-ssl-certs mountPath: /etc/ssl/certs/ readOnly: true - name: etc-pki-ca-trust-extracted-pem mountPath: /etc/pki/ca-trust/extracted/pem readOnly: true securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL runAsNonRoot: true runAsUser: 1000 initContainers: - name: certificates image: "registry.gitlab.com/gitlab-org/build/cng/certificates:v18.8.2" env: - name: TZ value: UTC resources: requests: cpu: 50m volumeMounts: - name: etc-ssl-certs mountPath: /etc/ssl/certs readOnly: false - name: etc-pki-ca-trust-extracted-pem mountPath: /etc/pki/ca-trust/extracted/pem readOnly: false - name: custom-ca-certificates mountPath: /usr/local/share/ca-certificates readOnly: true securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL runAsNonRoot: true runAsUser: 1000 - name: configure image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-base:v18.8.2" args: - sh - /config/configure env: - name: CONFIG_TEMPLATE_DIRECTORY value: /templates - name: CONFIG_DIRECTORY value: /registry resources: requests: cpu: 50m volumeMounts: - name: registry-secrets mountPath: /config - name: registry-server-config-templates mountPath: /templates readOnly: true - name: registry-server-config mountPath: /registry securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL runAsNonRoot: true runAsUser: 1000 restartPolicy: OnFailure securityContext: fsGroup: 1000 runAsUser: 1000 seccompProfile: type: RuntimeDefault volumes: - name: registry-server-config-templates configMap: name: gitlab-registry items: - key: migrations-config.yml.tpl path: config.yml.tpl - name: registry-server-config emptyDir: medium: Memory - name: registry-secrets projected: sources: - configMap: name: gitlab-registry items: - key: configure path: configure - secret: name: gitlab-registry-db-pass items: - key: password path: database_password - name: etc-ssl-certs emptyDir: medium: Memory - name: etc-pki-ca-trust-extracted-pem emptyDir: medium: Memory - name: custom-ca-certificates projected: defaultMode: 288 sources: - secret: name: aethernet.crt - secret: name: gitlab-wildcard-tls-ca (root level) + one document added: apiVersion: batch/v1beta1 kind: CronJob metadata: name: gitlab-toolbox-backup namespace: gitlab labels: app: toolbox helm.toolkit.fluxcd.io/name: gitlab helm.toolkit.fluxcd.io/namespace: flux-system heritage: Helm release: gitlab spec: concurrencyPolicy: Replace failedJobsHistoryLimit: 1 jobTemplate: spec: backoffLimit: 6 template: metadata: annotations: cluster-autoscaler.kubernetes.io/safe-to-evict: "false" labels: app: toolbox heritage: Helm release: gitlab spec: containers: - name: toolbox-backup image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-toolbox-ce:v18.8.2" args: - /bin/bash - "-c" - "cp /etc/gitlab/.s3cfg $HOME/.s3cfg && backup-utility --skip registry --skip packages --skip pages --skip artifacts" env: - name: ARTIFACTS_BUCKET_NAME value: gitlab-artifacts - name: REGISTRY_BUCKET_NAME value: gitlab-container-registry - name: LFS_BUCKET_NAME value: gitlab-lfs - name: UPLOADS_BUCKET_NAME value: gitlab-uploads - name: PACKAGES_BUCKET_NAME value: gitlab-packages - name: EXTERNAL_DIFFS_BUCKET_NAME value: gitlab-external-diffs - name: TERRAFORM_STATE_BUCKET_NAME value: gitlab-terraform-state - name: CI_SECURE_FILES_BUCKET_NAME value: gitlab-ci-secure-files - name: BACKUP_BUCKET_NAME value: gitlab-backup - name: BACKUP_BACKEND value: s3 - name: TMP_BUCKET_NAME value: gitlab-tmp-storage - name: PAGES_BUCKET_NAME value: gitlab-pages - name: CONFIG_TEMPLATE_DIRECTORY value: /var/opt/gitlab/templates - name: CONFIG_DIRECTORY value: /srv/gitlab/config - name: TZ value: UTC resources: requests: cpu: 50m memory: 350M volumeMounts: - name: toolbox-config mountPath: /var/opt/gitlab/templates - name: toolbox-secrets mountPath: /etc/gitlab readOnly: true - name: toolbox-secrets mountPath: /srv/gitlab/config/secrets.yml subPath: rails-secrets/secrets.yml - name: toolbox-tmp mountPath: /srv/gitlab/tmp readOnly: false - name: etc-ssl-certs mountPath: /etc/ssl/certs/ readOnly: true - name: etc-pki-ca-trust-extracted-pem mountPath: /etc/pki/ca-trust/extracted/pem readOnly: true securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL runAsNonRoot: true runAsUser: 1000 initContainers: - name: certificates image: "registry.gitlab.com/gitlab-org/build/cng/certificates:v18.8.2" env: - name: TZ value: UTC resources: requests: cpu: 50m volumeMounts: - name: etc-ssl-certs mountPath: /etc/ssl/certs readOnly: false - name: etc-pki-ca-trust-extracted-pem mountPath: /etc/pki/ca-trust/extracted/pem readOnly: false - name: custom-ca-certificates mountPath: /usr/local/share/ca-certificates readOnly: true securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL runAsNonRoot: true runAsUser: 1000 - name: configure image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-base:v18.8.2" command: - sh - /config/configure env: - name: TZ value: UTC resources: requests: cpu: 50m volumeMounts: - name: toolbox-config mountPath: /config readOnly: true - name: init-toolbox-secrets mountPath: /init-config readOnly: true - name: toolbox-secrets mountPath: /init-secrets readOnly: false securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL runAsNonRoot: true runAsUser: 1000 restartPolicy: OnFailure securityContext: fsGroup: 1000 runAsGroup: 1000 runAsUser: 1000 seccompProfile: type: RuntimeDefault volumes: - name: toolbox-config projected: sources: - configMap: name: gitlab-toolbox - name: toolbox-tmp emptyDir: {} - name: init-toolbox-secrets projected: defaultMode: 256 sources: - secret: name: gitlab-rails-secret items: - key: secrets.yml path: rails-secrets/secrets.yml - secret: name: gitlab-gitlab-shell-secret items: - key: secret path: shell/.gitlab_shell_secret - secret: name: gitlab-gitaly-secret items: - key: token path: gitaly/gitaly_token - secret: name: gitlab-redis-secret items: - key: secret path: redis/redis-password - secret: name: db-gitlab-app items: - key: password path: postgres/psql-password-ci - secret: name: db-gitlab-app items: - key: password path: postgres/psql-password-main - secret: name: gitlab-registry-secret items: - key: registry-auth.key path: registry/gitlab-registry.key - secret: name: gitlab-registry-notification items: - key: secret path: registry/notificationSecret - secret: name: gitlab-object-store-configs items: - key: s3cmd.cfg path: objectstorage/.s3cfg - secret: name: gitlab-gitlab-kas-secret items: - key: kas_shared_secret path: kas/.gitlab_kas_secret - secret: name: gitlab-object-store-configs items: - key: connection.yaml path: objectstorage/object_store - secret: name: authentik-oidc items: - key: config.yaml path: omniauth/authentik-oidc/config.yaml - name: toolbox-secrets emptyDir: medium: Memory - name: etc-ssl-certs emptyDir: medium: Memory - name: etc-pki-ca-trust-extracted-pem emptyDir: medium: Memory - name: custom-ca-certificates projected: defaultMode: 288 sources: - secret: name: aethernet.crt - secret: name: gitlab-wildcard-tls-ca schedule: @daily startingDeadlineSeconds: null successfulJobsHistoryLimit: 3 suspend: false (root level) + one document added: apiVersion: v1 kind: ServiceAccount metadata: name: gitlab-shared-secrets namespace: gitlab annotations: helm.sh/hook: "pre-install,pre-upgrade" helm.sh/hook-delete-policy: "hook-succeeded,before-hook-creation" helm.sh/hook-weight: "-5" labels: app: gitlab heritage: Helm release: gitlab (root level) + one document added: apiVersion: v1 kind: ConfigMap metadata: name: gitlab-shared-secrets namespace: gitlab annotations: helm.sh/hook: "pre-install,pre-upgrade" helm.sh/hook-delete-policy: "hook-succeeded,before-hook-creation" helm.sh/hook-weight: "-3" labels: app: gitlab heritage: Helm release: gitlab data: generate-secrets: | # vim: set filetype=sh: namespace=gitlab release=gitlab env=production pushd $(mktemp -d) # Args pattern, length function gen_random(){ head -c 4096 /dev/urandom | LC_CTYPE=C tr -cd $1 | head -c $2 } # Args: length function gen_random_base64(){ local len="$1" gen_random_bytes "$len" | base64 -w0 } # Args: length function gen_random_bytes(){ local len="$1" head -c "$len" /dev/urandom } # Args: yaml file, search path function fetch_rails_value(){ local value=$(yq --prettyPrint --no-colors ".${2}" $1) # Don't return null values if [ "${value}" != "null" ]; then echo "${value}"; fi } # Args: secretname function label_secret(){ local secret_name=$1 # Remove application labels if they exist kubectl --namespace=$namespace label \ secret $secret_name $(echo 'app.kubernetes.io/name=gitlab' | sed -E 's/=[^ ]*/-/g') kubectl --namespace=$namespace label \ --overwrite \ secret $secret_name app=gitlab chart=gitlab-9.8.2 release=gitlab heritage=Helm } # Args: secretname, args function generate_secret_if_needed(){ local secret_args=( "${@:2}") local secret_name=$1 if ! $(kubectl --namespace=$namespace get secret $secret_name > /dev/null 2>&1); then kubectl --namespace=$namespace create secret generic $secret_name ${secret_args[@]} else echo "secret \"$secret_name\" already exists." for arg in "${secret_args[@]}"; do local from=$(echo -n ${arg} | cut -d '=' -f1) if [ -z "${from##*literal*}" ]; then local key=$(echo -n ${arg} | cut -d '=' -f2) local desiredValue=$(echo -n ${arg} | cut -d '=' -f3-) local flags="--namespace=$namespace --allow-missing-template-keys=false" if ! $(kubectl $flags get secret $secret_name -ojsonpath="{.data.${key}}" > /dev/null 2>&1); then echo "key \"${key}\" does not exist. patching it in." if [ "${desiredValue}" != "" ]; then desiredValue=$(echo -n "${desiredValue}" | base64 -w 0) fi kubectl --namespace=$namespace patch secret ${secret_name} -p "{\"data\":{\"$key\":\"${desiredValue}\"}}" fi fi done fi label_secret $secret_name } # Initial root password generate_secret_if_needed "gitlab-gitlab-initial-root-password" --from-literal="password"=$(gen_random 'a-zA-Z0-9' 64) # Redis password generate_secret_if_needed "gitlab-redis-secret" --from-literal="secret"=$(gen_random 'a-zA-Z0-9' 64) # Gitlab shell generate_secret_if_needed "gitlab-gitlab-shell-secret" --from-literal="secret"=$(gen_random 'a-zA-Z0-9' 64) # Gitaly secret generate_secret_if_needed "gitlab-gitaly-secret" --from-literal="token"=$(gen_random 'a-zA-Z0-9' 64) # Gitlab runner secret generate_secret_if_needed "gitlab-gitlab-runner-secret" --from-literal=runner-registration-token=$(gen_random 'a-zA-Z0-9' 64) --from-literal=runner-token="" # GitLab Pages API secret # GitLab Pages auth secret for hashing cookie store when using access control # GitLab Pages OAuth secret # Gitlab-kas secret generate_secret_if_needed "gitlab-gitlab-kas-secret" --from-literal="kas_shared_secret"=$(gen_random 'a-zA-Z0-9' 32 | base64) # Gitlab-kas private API secret generate_secret_if_needed "gitlab-kas-private-api" --from-literal="kas_private_api_secret"=$(gen_random 'a-zA-Z0-9' 32 | base64) # Gitlab-kas WebSocket Token secret generate_secret_if_needed "gitlab-kas-websocket-token" --from-literal="kas_websocket_token_secret"=$(gen_random_base64 72) # Registry certificates mkdir -p certs openssl req -new -newkey rsa:4096 -subj "/CN=gitlab-issuer" -nodes -x509 -keyout certs/registry-example-com.key -out certs/registry-example-com.crt -days 3650 generate_secret_if_needed "gitlab-registry-secret" --from-file=registry-auth.key=certs/registry-example-com.key --from-file=registry-auth.crt=certs/registry-example-com.crt # config/secrets.yaml if [ -n "$env" ]; then rails_secret="gitlab-rails-secret" # Fetch the values from the existing secret if it exists if $(kubectl --namespace=$namespace get secret $rails_secret > /dev/null 2>&1); then kubectl --namespace=$namespace get secret $rails_secret -o jsonpath="{.data.secrets\.yml}" | base64 --decode > secrets.yml secret_key_base=$(fetch_rails_value secrets.yml "${env}.secret_key_base") otp_key_base=$(fetch_rails_value secrets.yml "${env}.otp_key_base") db_key_base=$(fetch_rails_value secrets.yml "${env}.db_key_base") openid_connect_signing_key=$(fetch_rails_value secrets.yml "${env}.openid_connect_signing_key") encrypted_settings_key_base=$(fetch_rails_value secrets.yml "${env}.encrypted_settings_key_base") active_record_encryption_primary_keys=$(fetch_rails_value secrets.yml "${env}.active_record_encryption_primary_key") active_record_encryption_deterministic_keys=$(fetch_rails_value secrets.yml "${env}.active_record_encryption_deterministic_key") active_record_encryption_key_derivation_salt=$(fetch_rails_value secrets.yml "${env}.active_record_encryption_key_derivation_salt") fi; # Generate defaults for any unset secrets secret_key_base="${secret_key_base:-$(gen_random 'a-f0-9' 128)}" # equivalent to secureRandom.hex(64) otp_key_base="${otp_key_base:-$(gen_random 'a-f0-9' 128)}" # equivalent to secureRandom.hex(64) db_key_base="${db_key_base:-$(gen_random 'a-f0-9' 128)}" # equivalent to secureRandom.hex(64) openid_connect_signing_key="${openid_connect_signing_key:-$(openssl genrsa 2048)}" encrypted_settings_key_base="${encrypted_settings_key_base:-$(gen_random 'a-f0-9' 128)}" # equivalent to secureRandom.hex(64) # 1. We set the following two keys as an array to support keys rotation. # The last key in the array is always used to encrypt data: # https://github.com/rails/rails/blob/v7.0.8.4/activerecord/lib/active_record/encryption/key_provider.rb#L21 # while all the keys are used (in the order they're defined) to decrypt data: # https://github.com/rails/rails/blob/v7.0.8.4/activerecord/lib/active_record/encryption/cipher.rb#L26. # This allows to rotate keys by adding a new key as the last key, and start a re-encryption process that # runs in the background: https://gitlab.com/gitlab-org/gitlab/-/issues/494976 # 2. We use the same method and length as Rails' defaults: # https://github.com/rails/rails/blob/v7.0.8.4/activerecord/lib/active_record/railties/databases.rake#L537-L540 active_record_encryption_primary_keys=${active_record_encryption_primary_keys:-"- $(gen_random 'a-zA-Z0-9' 32)"} active_record_encryption_deterministic_keys=${active_record_encryption_deterministic_keys:-"- $(gen_random 'a-zA-Z0-9' 32)"} active_record_encryption_key_derivation_salt=${active_record_encryption_key_derivation_salt:-$(gen_random 'a-zA-Z0-9' 32)} # Update the existing secret cat << EOF > rails-secrets.yml apiVersion: v1 kind: Secret metadata: name: $rails_secret type: Opaque stringData: secrets.yml: |- $env: secret_key_base: $secret_key_base otp_key_base: $otp_key_base db_key_base: $db_key_base encrypted_settings_key_base: $encrypted_settings_key_base openid_connect_signing_key: | $(echo "${openid_connect_signing_key}" | awk '{print " " $0}') active_record_encryption_primary_key: $active_record_encryption_primary_keys active_record_encryption_deterministic_key: $active_record_encryption_deterministic_keys active_record_encryption_key_derivation_salt: $active_record_encryption_key_derivation_salt EOF kubectl --validate=false --namespace=$namespace apply -f rails-secrets.yml label_secret $rails_secret fi # Shell ssh host keys ssh-keygen -A mkdir -p host_keys cp /etc/ssh/ssh_host_* host_keys/ generate_secret_if_needed "gitlab-gitlab-shell-host-keys" --from-file host_keys # Gitlab-workhorse secret generate_secret_if_needed "gitlab-gitlab-workhorse-secret" --from-literal="shared_secret"=$(gen_random 'a-zA-Z0-9' 32 | base64) # Registry http.secret secret generate_secret_if_needed "gitlab-registry-httpsecret" --from-literal="secret"=$(gen_random 'a-z0-9' 128 | base64 -w 0) # Container Registry notification_secret generate_secret_if_needed "gitlab-registry-notification" --from-literal="secret"=[\"$(gen_random 'a-zA-Z0-9' 32)\"] (root level) + one document added: apiVersion: v1 kind: ConfigMap metadata: name: gitlab-gitlab-upgrade-check namespace: gitlab annotations: helm.sh/hook: pre-upgrade helm.sh/hook-delete-policy: before-hook-creation helm.sh/hook-weight: "-11" labels: app: gitlab heritage: Helm release: gitlab data: runcheck: | #!/bin/sh set -e notify() { echo "$1" echo -n "$1 " >> /dev/termination-log } greater_version() { test "$(printf '%s\n' "$@" | sort -V | tail -n 1)" = "$1"; } is_semver() { printf '%s' "$1" | grep -Eq "^[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}" return "$?" } # For the PostgreSQL upgrade, you either need both secrets, or no secrets. # If there are no secrets, we will create them for you. # If the secrets aren't in either of these states, we assume you are upgrading from an older version # This is running ahead of version checks to ensure this always runs. This is to account for # installations outside of the official helm repo. secrets_dir="/etc/secrets/postgresql" if [ -d "${secrets_dir}" ]; then if [ ! "$(ls -A ${secrets_dir}/..data/)" = "" ]; then if [ ! -f "${secrets_dir}/postgresql-postgres-password" ] || [ ! -f "${secrets_dir}/password" ]; then notify "You seem to be upgrading from a previous version of GitLab using the bundled PostgreSQL chart" notify "There are some manual steps which need to be performed in order to upgrade the database" notify "Please see the upgrade documentation for instructions on how to proceed:" notify "https://docs.gitlab.com/charts/installation/upgrade.html" exit 1 fi fi fi MIN_VERSION=18.5 CHART_MIN_VERSION=9.5 # Remove 'v' prefix from GitLab version if present (set in Chart.yaml appVersions) GITLAB_VERSION=${GITLAB_VERSION#v} # Only run check for semver releases if ! is_semver "$GITLAB_VERSION"; then exit 0 fi NEW_MAJOR_VERSION=$(echo $GITLAB_VERSION | awk -F "." '{print $1}') NEW_MINOR_VERSION=$(echo $GITLAB_VERSION | awk -F "." '{print $1"."$2}') NEW_CHART_MAJOR_VERSION=$(echo $CHART_VERSION | awk -F "." '{print $1}') NEW_CHART_MINOR_VERSION=$(echo $CHART_VERSION | awk -F "." '{print $1"."$2}') if [ ! -f /chart-info/gitlabVersion ]; then notify "It seems you are attempting an unsupported upgrade path." notify "Please follow the upgrade documentation at https://docs.gitlab.com/update/#upgrade-paths" exit 1 fi OLD_VERSION_STRING=$(cat /chart-info/gitlabVersion) OLD_VERSION_STRING=${OLD_VERSION_STRING#v} OLD_CHART_VERSION_STRING=$(cat /chart-info/gitlabChartVersion) # Skip check if old version wasn't semver if ! is_semver "$OLD_VERSION_STRING"; then exit 0 fi OLD_MAJOR_VERSION=$(echo $OLD_VERSION_STRING | awk -F "." '{print $1}') OLD_MINOR_VERSION=$(echo $OLD_VERSION_STRING | awk -F "." '{print $1"."$2}') OLD_CHART_MAJOR_VERSION=$(echo $OLD_CHART_VERSION_STRING | awk -F "." '{print $1}') OLD_CHART_MINOR_VERSION=$(echo $OLD_CHART_VERSION_STRING | awk -F "." '{print $1"."$2}') # Checking Version if ( ! greater_version "$OLD_MINOR_VERSION" "$MIN_VERSION" ) || ( ! greater_version "$OLD_CHART_MINOR_VERSION" "$CHART_MIN_VERSION" ); then notify "It seems you are upgrading the GitLab Helm Chart from ${OLD_CHART_VERSION_STRING} (GitLab ${OLD_VERSION_STRING}) to ${CHART_VERSION} (GitLab ${GITLAB_VERSION})." notify "It is required to upgrade to the latest ${CHART_MIN_VERSION}.x version first before proceeding." # Link to upgrade docs if it is a major version jump if [ "${OLD_MAJOR_VERSION}" -lt "${NEW_MAJOR_VERSION}" ] || [ "${OLD_CHART_MAJOR_VERSION}" -lt "${NEW_CHART_MAJOR_VERSION}" ]; then notify "Please follow the upgrade documentation at https://docs.gitlab.com/charts/releases/8_0.html" notify "and upgrade to GitLab Helm Chart version ${CHART_MIN_VERSION}.x before upgrading to ${CHART_VERSION}." fi exit 1 fi (root level) + one document added: apiVersion: rbac.authorization.k8s.io/v1 kind: Role metadata: name: gitlab-shared-secrets namespace: gitlab annotations: helm.sh/hook: "pre-install,pre-upgrade" helm.sh/hook-delete-policy: "hook-succeeded,before-hook-creation" helm.sh/hook-weight: "-5" labels: app: shared-secrets heritage: Helm release: gitlab rules: - resources: - secrets apiGroups: - verbs: - get - list - create - patch (root level) + one document added: apiVersion: rbac.authorization.k8s.io/v1 kind: RoleBinding metadata: name: gitlab-shared-secrets namespace: gitlab annotations: helm.sh/hook: "pre-install,pre-upgrade" helm.sh/hook-delete-policy: "hook-succeeded,before-hook-creation" helm.sh/hook-weight: "-5" labels: app: shared-secrets heritage: Helm release: gitlab roleRef: name: gitlab-shared-secrets apiGroup: rbac.authorization.k8s.io kind: Role subjects: - name: gitlab-shared-secrets kind: ServiceAccount namespace: gitlab (root level) + one document added: apiVersion: batch/v1 kind: Job metadata: name: gitlab-shared-secrets-6fff130 namespace: gitlab annotations: helm.sh/hook: "pre-install,pre-upgrade" helm.sh/hook-delete-policy: "hook-succeeded,before-hook-creation" labels: app: gitlab heritage: Helm release: gitlab spec: template: metadata: annotations: null labels: app: gitlab heritage: Helm release: gitlab spec: containers: - name: gitlab image: "registry.gitlab.com/gitlab-org/build/cng/kubectl:v18.8.2" command: - /bin/bash - /scripts/generate-secrets resources: requests: cpu: 50m volumeMounts: - name: scripts mountPath: /scripts - name: ssh mountPath: /etc/ssh securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL runAsNonRoot: true restartPolicy: Never securityContext: fsGroup: 65534 runAsUser: 65534 seccompProfile: type: RuntimeDefault serviceAccountName: gitlab-shared-secrets volumes: - name: scripts configMap: name: gitlab-shared-secrets - name: ssh emptyDir: {} (root level) + one document added: apiVersion: batch/v1 kind: Job metadata: name: gitlab-shared-secrets-6fff130-selfsign namespace: gitlab annotations: helm.sh/hook: "pre-install,pre-upgrade" helm.sh/hook-delete-policy: "hook-succeeded,before-hook-creation" labels: app: gitlab heritage: Helm release: gitlab spec: template: metadata: annotations: null labels: app: gitlab heritage: Helm release: gitlab spec: containers: - name: kubectl image: "registry.gitlab.com/gitlab-org/build/cng/kubectl:v18.8.2" command: - /bin/bash - "-exc" - | certname=gitlab-wildcard-tls # create wildcard certificate secret kubectl create secret tls $certname \ --cert=/output/wildcard.pem --key=/output/wildcard-key.pem || true kubectl --namespace=$namespace label \ secret $certname $(echo 'app.kubernetes.io/name=gitlab' | sed -E 's/=[^ ]*/-/g') kubectl --namespace=$namespace label --overwrite \ secret $certname app=gitlab chart=gitlab-9.8.2 release=gitlab heritage=Helm # create CA certificate secret kubectl create secret generic ${certname}-ca \ --from-file=cfssl_ca=/output/ca.pem || true kubectl --namespace=$namespace label \ secret ${certname}-ca $(echo 'app.kubernetes.io/name=gitlab' | sed -E 's/=[^ ]*/-/g') kubectl --namespace=$namespace label --overwrite \ secret ${certname}-ca app=gitlab chart=gitlab-9.8.2 release=gitlab heritage=Helm # create certificate chain for GitLab Runner cat /output/ca.pem /output/wildcard.pem > /tmp/code.nogweii.net.crt kubectl create secret generic ${certname}-chain \ --from-file=/tmp/code.nogweii.net.crt || true kubectl --namespace=$namespace label \ secret ${certname}-chain $(echo 'app.kubernetes.io/name=gitlab' | sed -E 's/=[^ ]*/-/g') kubectl --namespace=$namespace label --overwrite \ secret ${certname}-chain app=gitlab chart=gitlab-9.8.2 release=gitlab heritage=Helm resources: requests: cpu: 50m volumeMounts: - name: certs-path mountPath: /output initContainers: - name: cfssl-self-sign image: "registry.gitlab.com/gitlab-org/build/cng/cfssl-self-sign:v18.8.2" env: - name: CA_SUBJECT value: "GitLab Helm Chart" - name: CA_ORG value: gitlab - name: CA_ORG_UNIT value: gitlab - name: CERT_SUBJECT value: code.nogweii.net - name: CERT_DOMAIN value: code.nogweii.net - name: EXPIRY value: 3650d - name: ALGORITHM value: rsa - name: KEY_SIZE value: "4096" resources: requests: cpu: 50m volumeMounts: - name: certs-path mountPath: /output restartPolicy: Never securityContext: fsGroup: 65534 runAsUser: 65534 serviceAccountName: gitlab-shared-secrets volumes: - name: certs-path emptyDir: {} (root level) + one document added: apiVersion: batch/v1 kind: Job metadata: name: gitlab-gitlab-upgrade-check namespace: gitlab annotations: helm.sh/hook: pre-upgrade helm.sh/hook-delete-policy: "hook-succeeded,before-hook-creation" helm.sh/hook-weight: "-10" labels: app: gitlab heritage: Helm release: gitlab spec: backoffLimit: 2 template: metadata: labels: app: gitlab heritage: Helm release: gitlab spec: containers: - name: run-check image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-base:v18.8.2" command: - /bin/sh - /scripts/runcheck env: - name: GITLAB_VERSION value: "18.8.2" - name: CHART_VERSION value: "9.8.2" resources: requests: cpu: 50m volumeMounts: - name: chart-info mountPath: /chart-info - name: scripts mountPath: /scripts securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL runAsNonRoot: true runAsUser: 65534 restartPolicy: Never securityContext: fsGroup: 65534 runAsUser: 65534 seccompProfile: type: RuntimeDefault volumes: - name: chart-info configMap: name: gitlab-gitlab-chart-info optional: true - name: scripts configMap: name: gitlab-gitlab-upgrade-check (root level) + one document added: apiVersion: v1 kind: ServiceAccount metadata: name: gitlab-agent-ocs-scanning-pod-sa namespace: gitlab labels: app.kubernetes.io/instance: gitlab-agent app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: gitlab-agent helm.toolkit.fluxcd.io/name: gitlab-agent helm.toolkit.fluxcd.io/namespace: flux-system (root level) + one document added: apiVersion: v1 kind: ServiceAccount metadata: name: gitlab-agent namespace: gitlab labels: app.kubernetes.io/instance: gitlab-agent app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: gitlab-agent helm.toolkit.fluxcd.io/name: gitlab-agent helm.toolkit.fluxcd.io/namespace: flux-system (root level) + one document added: apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: name: "gitlab:gitlab-agent:ocs" labels: app.kubernetes.io/instance: gitlab-agent app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: gitlab-agent helm.toolkit.fluxcd.io/name: gitlab-agent helm.toolkit.fluxcd.io/namespace: flux-system rules: - resources: - cronjobs - jobs apiGroups: - batch verbs: - list - get - resources: - pods - replicationcontrollers - serviceaccounts - namespaces - services - configmaps - resourcequotas - limitranges - nodes - secrets apiGroups: - verbs: - list - get - resources: - replicasets - daemonsets - statefulsets - deployments apiGroups: - apps verbs: - list - get - resources: - roles - rolebindings - clusterroles - clusterrolebindings apiGroups: - rbac.authorization.k8s.io verbs: - list - get - resources: - networkpolicies - ingresses apiGroups: - networking.k8s.io verbs: - list - get (root level) + one document added: apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding metadata: name: "gitlab:gitlab-agent-cluster-admin" labels: app.kubernetes.io/instance: gitlab-agent app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: gitlab-agent helm.toolkit.fluxcd.io/name: gitlab-agent helm.toolkit.fluxcd.io/namespace: flux-system roleRef: name: cluster-admin apiGroup: rbac.authorization.k8s.io kind: ClusterRole subjects: - name: gitlab-agent kind: ServiceAccount namespace: gitlab (root level) + one document added: apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding metadata: name: "gitlab:gitlab-agent:ocs" labels: app.kubernetes.io/instance: gitlab-agent app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: gitlab-agent helm.toolkit.fluxcd.io/name: gitlab-agent helm.toolkit.fluxcd.io/namespace: flux-system roleRef: name: "gitlab:gitlab-agent:ocs" apiGroup: rbac.authorization.k8s.io kind: ClusterRole subjects: - name: gitlab-agent-ocs-scanning-pod-sa kind: ServiceAccount namespace: gitlab (root level) + one document added: apiVersion: rbac.authorization.k8s.io/v1 kind: Role metadata: name: "gitlab-agent:ocs" namespace: gitlab labels: app.kubernetes.io/instance: gitlab-agent app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: gitlab-agent helm.toolkit.fluxcd.io/name: gitlab-agent helm.toolkit.fluxcd.io/namespace: flux-system rules: - resources: - configmaps apiGroups: - verbs: - create (root level) + one document added: apiVersion: rbac.authorization.k8s.io/v1 kind: RoleBinding metadata: name: "gitlab-agent:ocs" namespace: gitlab labels: app.kubernetes.io/instance: gitlab-agent app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: gitlab-agent helm.toolkit.fluxcd.io/name: gitlab-agent helm.toolkit.fluxcd.io/namespace: flux-system roleRef: name: "gitlab-agent:ocs" apiGroup: rbac.authorization.k8s.io kind: Role subjects: - name: gitlab-agent-ocs-scanning-pod-sa kind: ServiceAccount namespace: gitlab (root level) + one document added: apiVersion: v1 kind: Service metadata: name: gitlab-agent-service namespace: gitlab labels: app.kubernetes.io/instance: gitlab-agent app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: gitlab-agent helm.toolkit.fluxcd.io/name: gitlab-agent helm.toolkit.fluxcd.io/namespace: flux-system spec: type: ClusterIP selector: app.kubernetes.io/instance: gitlab-agent app.kubernetes.io/name: gitlab-agent ports: - name: tcp-gitlab-agent-observability port: 8080 protocol: TCP targetPort: observability (root level) + one document added: apiVersion: apps/v1 kind: Deployment metadata: name: gitlab-agent-v2 namespace: gitlab labels: app.kubernetes.io/instance: gitlab-agent app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: gitlab-agent helm.toolkit.fluxcd.io/name: gitlab-agent helm.toolkit.fluxcd.io/namespace: flux-system spec: replicas: 2 selector: matchLabels: app.kubernetes.io/instance: gitlab-agent app.kubernetes.io/name: gitlab-agent strategy: type: RollingUpdate rollingUpdate: maxSurge: 1 maxUnavailable: 0 template: metadata: annotations: prometheus.io/path: /metrics prometheus.io/port: "8080" prometheus.io/scrape: "true" labels: app.kubernetes.io/instance: gitlab-agent app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: gitlab-agent spec: automountServiceAccountToken: false containers: - name: gitlab-agent image: "registry.gitlab.com/gitlab-org/cluster-integration/gitlab-agent/agentk:v18.8.0" imagePullPolicy: IfNotPresent resources: {} securityContext: {} terminationMessagePolicy: FallbackToLogsOnError args: - "--token-file=/etc/agentk/secrets/token" - "--kas-address=wss://k.code.nogweii.net" livenessProbe: httpGet: path: /liveness port: 8080 initialDelaySeconds: 15 periodSeconds: 20 ports: - name: observability containerPort: 8080 protocol: TCP - name: api containerPort: 8082 readinessProbe: httpGet: path: /readiness port: 8080 initialDelaySeconds: 5 periodSeconds: 10 volumeMounts: - name: service-account-token-volume mountPath: /var/run/secrets/kubernetes.io/serviceaccount readOnly: true - name: secret-volume mountPath: /etc/agentk/secrets readOnly: true env: - name: POD_NAMESPACE valueFrom: fieldRef: fieldPath: metadata.namespace - name: POD_NAME valueFrom: fieldRef: fieldPath: metadata.name - name: POD_IP valueFrom: fieldRef: fieldPath: status.podIP - name: GITLAB_AGENT_TELEMETRY_installation_method value: helm-chart - name: GITLAB_AGENT_TELEMETRY_helm_chart_version value: "2.23.0" - name: SERVICE_ACCOUNT_NAME valueFrom: fieldRef: fieldPath: spec.serviceAccountName - name: OCS_ENABLED value: "true" - name: OCS_SERVICE_ACCOUNT_NAME value: gitlab-agent-ocs-scanning-pod-sa securityContext: {} serviceAccountName: gitlab-agent volumes: - name: service-account-token-volume projected: defaultMode: 292 sources: - configMap: name: kube-root-ca.crt - downwardAPI: items: - fieldRef: apiVersion: v1 fieldPath: metadata.namespace path: namespace - serviceAccountToken: expirationSeconds: 3600 path: token - name: secret-volume secret: defaultMode: 292 secretName: agentk-token (root level) + one document added: apiVersion: v1 kind: ServiceAccount metadata: name: k8s-event-logger namespace: kube-utilities labels: app.kubernetes.io/instance: k8s-event-logger app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: k8s-event-logger helm.toolkit.fluxcd.io/name: k8s-event-logger helm.toolkit.fluxcd.io/namespace: flux-system (root level) + one document added: apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: name: k8s-event-logger labels: app.kubernetes.io/instance: k8s-event-logger app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: k8s-event-logger helm.toolkit.fluxcd.io/name: k8s-event-logger helm.toolkit.fluxcd.io/namespace: flux-system rules: - resources: - events apiGroups: - - events.k8s.io verbs: - get - list - watch (root level) + one document added: apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding metadata: name: k8s-event-logger labels: app.kubernetes.io/instance: k8s-event-logger app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: k8s-event-logger helm.toolkit.fluxcd.io/name: k8s-event-logger helm.toolkit.fluxcd.io/namespace: flux-system roleRef: name: k8s-event-logger apiGroup: rbac.authorization.k8s.io kind: ClusterRole subjects: - name: k8s-event-logger kind: ServiceAccount namespace: kube-utilities (root level) + one document added: apiVersion: apps/v1 kind: Deployment metadata: name: k8s-event-logger namespace: kube-utilities labels: app.kubernetes.io/instance: k8s-event-logger app.kubernetes.io/managed-by: Helm helm.toolkit.fluxcd.io/name: k8s-event-logger helm.toolkit.fluxcd.io/namespace: flux-system spec: replicas: 1 selector: matchLabels: app.kubernetes.io/instance: k8s-event-logger app.kubernetes.io/name: k8s-event-logger template: metadata: labels: app.kubernetes.io/instance: k8s-event-logger app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: k8s-event-logger spec: containers: - name: k8s-event-logger env: null image: "maxrocketinternet/k8s-event-logger:2.7" imagePullPolicy: IfNotPresent resources: limits: cpu: 100m memory: 128Mi requests: cpu: 10m memory: 128Mi securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL readOnlyRootFilesystem: true runAsGroup: 10001 runAsNonRoot: true runAsUser: 10001 seccompProfile: type: RuntimeDefault securityContext: {} serviceAccountName: k8s-event-logger (root level) + one document added: apiVersion: v1 kind: ServiceAccount metadata: name: kube-state-metrics namespace: monitoring labels: app.kubernetes.io/component: metrics app.kubernetes.io/instance: kube-prometheus-stack app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: kube-state-metrics app.kubernetes.io/part-of: kube-state-metrics helm.toolkit.fluxcd.io/name: kube-prometheus-stack helm.toolkit.fluxcd.io/namespace: flux-system release: kube-prometheus-stack automountServiceAccountToken: true (root level) + one document added: apiVersion: v1 kind: ServiceAccount metadata: name: node-exporter namespace: kube-privileged labels: app.kubernetes.io/component: metrics app.kubernetes.io/instance: kube-prometheus-stack app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: prometheus-node-exporter app.kubernetes.io/part-of: prometheus-node-exporter helm.toolkit.fluxcd.io/name: kube-prometheus-stack helm.toolkit.fluxcd.io/namespace: flux-system release: kube-prometheus-stack automountServiceAccountToken: false (root level) + one document added: apiVersion: v1 kind: ServiceAccount metadata: name: kube-prometheus-stack-alertmanager namespace: monitoring labels: app: kube-prometheus-stack-alertmanager app.kubernetes.io/component: alertmanager app.kubernetes.io/instance: kube-prometheus-stack app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: kube-prometheus-stack-alertmanager app.kubernetes.io/part-of: kube-prometheus-stack helm.toolkit.fluxcd.io/name: kube-prometheus-stack helm.toolkit.fluxcd.io/namespace: flux-system heritage: Helm release: kube-prometheus-stack automountServiceAccountToken: true (root level) + one document added: apiVersion: v1 kind: ServiceAccount metadata: name: kube-prometheus-stack-operator namespace: monitoring labels: app: kube-prometheus-stack-operator app.kubernetes.io/component: prometheus-operator app.kubernetes.io/instance: kube-prometheus-stack app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: kube-prometheus-stack-prometheus-operator app.kubernetes.io/part-of: kube-prometheus-stack helm.toolkit.fluxcd.io/name: kube-prometheus-stack helm.toolkit.fluxcd.io/namespace: flux-system heritage: Helm release: kube-prometheus-stack automountServiceAccountToken: true (root level) + one document added: apiVersion: v1 kind: ServiceAccount metadata: name: kube-prometheus-stack-prometheus namespace: monitoring labels: app: kube-prometheus-stack-prometheus app.kubernetes.io/component: prometheus app.kubernetes.io/instance: kube-prometheus-stack app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: kube-prometheus-stack-prometheus app.kubernetes.io/part-of: kube-prometheus-stack helm.toolkit.fluxcd.io/name: kube-prometheus-stack helm.toolkit.fluxcd.io/namespace: flux-system heritage: Helm release: kube-prometheus-stack automountServiceAccountToken: true (root level) + one document added: apiVersion: v1 kind: ConfigMap metadata: name: kube-state-metrics-customresourcestate-config namespace: monitoring labels: app.kubernetes.io/component: metrics app.kubernetes.io/instance: kube-prometheus-stack app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: kube-state-metrics app.kubernetes.io/part-of: kube-state-metrics helm.toolkit.fluxcd.io/name: kube-prometheus-stack helm.toolkit.fluxcd.io/namespace: flux-system release: kube-prometheus-stack data: config.yaml: | spec: resources: - groupVersionKind: group: kustomize.toolkit.fluxcd.io kind: Kustomization version: v1 metricNamePrefix: gotk metrics: - each: info: labelsFromPath: name: - metadata - name type: Info help: The current state of a GitOps Toolkit resource. labelsFromPath: exported_namespace: - metadata - namespace ready: - status - conditions - '[type=Ready]' - status revision: - status - lastAppliedRevision source_name: - spec - sourceRef - name suspended: - spec - suspend name: resource_info - groupVersionKind: group: helm.toolkit.fluxcd.io kind: HelmRelease version: v2 metricNamePrefix: gotk metrics: - each: info: labelsFromPath: name: - metadata - name type: Info help: The current state of a GitOps Toolkit resource. labelsFromPath: chart_app_version: - status - history - "0" - appVersion chart_name: - status - history - "0" - chartName chart_ref_name: - spec - chartRef - name chart_source_name: - spec - chart - spec - sourceRef - name exported_namespace: - metadata - namespace ready: - status - conditions - '[type=Ready]' - status revision: - status - history - "0" - chartVersion suspended: - spec - suspend name: resource_info - groupVersionKind: group: source.toolkit.fluxcd.io kind: GitRepository version: v1 metricNamePrefix: gotk metrics: - each: info: labelsFromPath: name: - metadata - name type: Info help: The current state of a GitOps Toolkit resource. labelsFromPath: exported_namespace: - metadata - namespace ready: - status - conditions - '[type=Ready]' - status revision: - status - artifact - revision suspended: - spec - suspend url: - spec - url name: resource_info - groupVersionKind: group: source.toolkit.fluxcd.io kind: Bucket version: v1 metricNamePrefix: gotk metrics: - each: info: labelsFromPath: name: - metadata - name type: Info help: The current state of a GitOps Toolkit resource. labelsFromPath: bucket_name: - spec - bucketName endpoint: - spec - endpoint exported_namespace: - metadata - namespace ready: - status - conditions - '[type=Ready]' - status revision: - status - artifact - revision suspended: - spec - suspend name: resource_info - groupVersionKind: group: source.toolkit.fluxcd.io kind: HelmRepository version: v1 metricNamePrefix: gotk metrics: - each: info: labelsFromPath: name: - metadata - name type: Info help: The current state of a GitOps Toolkit resource. labelsFromPath: exported_namespace: - metadata - namespace ready: - status - conditions - '[type=Ready]' - status revision: - status - artifact - revision suspended: - spec - suspend url: - spec - url name: resource_info - groupVersionKind: group: source.toolkit.fluxcd.io kind: HelmChart version: v1 metricNamePrefix: gotk metrics: - each: info: labelsFromPath: name: - metadata - name type: Info help: The current state of a GitOps Toolkit resource. labelsFromPath: chart_name: - spec - chart chart_version: - spec - version exported_namespace: - metadata - namespace ready: - status - conditions - '[type=Ready]' - status revision: - status - artifact - revision suspended: - spec - suspend name: resource_info - groupVersionKind: group: source.toolkit.fluxcd.io kind: OCIRepository version: v1 metricNamePrefix: gotk metrics: - each: info: labelsFromPath: name: - metadata - name type: Info help: The current state of a GitOps Toolkit resource. labelsFromPath: exported_namespace: - metadata - namespace ready: - status - conditions - '[type=Ready]' - status revision: - status - artifact - revision suspended: - spec - suspend url: - spec - url name: resource_info - groupVersionKind: group: notification.toolkit.fluxcd.io kind: Alert version: v1beta3 metricNamePrefix: gotk metrics: - each: info: labelsFromPath: name: - metadata - name type: Info help: The current state of a GitOps Toolkit resource. labelsFromPath: exported_namespace: - metadata - namespace suspended: - spec - suspend name: resource_info - groupVersionKind: group: notification.toolkit.fluxcd.io kind: Provider version: v1beta3 metricNamePrefix: gotk metrics: - each: info: labelsFromPath: name: - metadata - name type: Info help: The current state of a GitOps Toolkit resource. labelsFromPath: exported_namespace: - metadata - namespace suspended: - spec - suspend name: resource_info - groupVersionKind: group: notification.toolkit.fluxcd.io kind: Receiver version: v1 metricNamePrefix: gotk metrics: - each: info: labelsFromPath: name: - metadata - name type: Info help: The current state of a GitOps Toolkit resource. labelsFromPath: exported_namespace: - metadata - namespace ready: - status - conditions - '[type=Ready]' - status suspended: - spec - suspend webhook_path: - status - webhookPath name: resource_info (root level) + one document added: apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: name: kube-state-metrics labels: app.kubernetes.io/component: metrics app.kubernetes.io/instance: kube-prometheus-stack app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: kube-state-metrics app.kubernetes.io/part-of: kube-state-metrics helm.toolkit.fluxcd.io/name: kube-prometheus-stack helm.toolkit.fluxcd.io/namespace: flux-system release: kube-prometheus-stack rules: - resources: - certificatesigningrequests apiGroups: - certificates.k8s.io verbs: - list - watch - resources: - configmaps apiGroups: - verbs: - list - watch - resources: - cronjobs apiGroups: - batch verbs: - list - watch - resources: - daemonsets apiGroups: - apps verbs: - list - watch - resources: - deployments apiGroups: - apps verbs: - list - watch - resources: - endpointslices apiGroups: - discovery.k8s.io verbs: - list - watch - resources: - horizontalpodautoscalers apiGroups: - autoscaling verbs: - list - watch - resources: - ingresses apiGroups: - networking.k8s.io verbs: - list - watch - resources: - jobs apiGroups: - batch verbs: - list - watch - resources: - leases apiGroups: - coordination.k8s.io verbs: - list - watch - resources: - limitranges apiGroups: - verbs: - list - watch - resources: - mutatingwebhookconfigurations apiGroups: - admissionregistration.k8s.io verbs: - list - watch - resources: - namespaces apiGroups: - verbs: - list - watch - resources: - networkpolicies apiGroups: - networking.k8s.io verbs: - list - watch - resources: - nodes apiGroups: - verbs: - list - watch - resources: - persistentvolumeclaims apiGroups: - verbs: - list - watch - resources: - persistentvolumes apiGroups: - verbs: - list - watch - resources: - poddisruptionbudgets apiGroups: - policy verbs: - list - watch - resources: - pods apiGroups: - verbs: - list - watch - resources: - replicasets apiGroups: - apps verbs: - list - watch - resources: - replicationcontrollers apiGroups: - verbs: - list - watch - resources: - resourcequotas apiGroups: - verbs: - list - watch - resources: - secrets apiGroups: - verbs: - list - watch - resources: - services apiGroups: - verbs: - list - watch - resources: - statefulsets apiGroups: - apps verbs: - list - watch - resources: - storageclasses apiGroups: - storage.k8s.io verbs: - list - watch - resources: - validatingwebhookconfigurations apiGroups: - admissionregistration.k8s.io verbs: - list - watch - resources: - volumeattachments apiGroups: - storage.k8s.io verbs: - list - watch - resources: - customresourcedefinitions apiGroups: - apiextensions.k8s.io verbs: - list - watch - resources: - alerts - buckets - gitrepositories - helmcharts - helmreleases - helmrepositories - kustomizations - ocirepositories - providers - receivers apiGroups: - helm.toolkit.fluxcd.io - kustomize.toolkit.fluxcd.io - notification.toolkit.fluxcd.io - source.toolkit.fluxcd.io verbs: - list - watch (root level) + one document added: apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: name: kube-prometheus-stack-operator labels: app: kube-prometheus-stack-operator app.kubernetes.io/component: prometheus-operator app.kubernetes.io/instance: kube-prometheus-stack app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: kube-prometheus-stack-prometheus-operator app.kubernetes.io/part-of: kube-prometheus-stack helm.toolkit.fluxcd.io/name: kube-prometheus-stack helm.toolkit.fluxcd.io/namespace: flux-system heritage: Helm release: kube-prometheus-stack rules: - resources: - alertmanagers - alertmanagers/finalizers - alertmanagers/status - alertmanagerconfigs - prometheuses - prometheuses/finalizers - prometheuses/status - prometheusagents - prometheusagents/finalizers - prometheusagents/status - thanosrulers - thanosrulers/finalizers - thanosrulers/status - scrapeconfigs - scrapeconfigs/status - servicemonitors - servicemonitors/status - podmonitors - podmonitors/status - probes - probes/status - prometheusrules - prometheusrules/status apiGroups: - monitoring.coreos.com verbs: - "*" - resources: - statefulsets apiGroups: - apps verbs: - "*" - resources: - configmaps - secrets apiGroups: - verbs: - "*" - resources: - pods apiGroups: - verbs: - list - delete - resources: - services - services/finalizers - endpoints apiGroups: - verbs: - get - create - update - delete - resources: - nodes apiGroups: - verbs: - list - watch - resources: - namespaces apiGroups: - verbs: - get - list - watch - resources: - events apiGroups: - - events.k8s.io verbs: - patch - create - resources: - ingresses apiGroups: - networking.k8s.io verbs: - get - list - watch - resources: - storageclasses apiGroups: - storage.k8s.io verbs: - get - resources: - endpointslices apiGroups: - discovery.k8s.io verbs: - get - create - list - watch - update - delete (root level) + one document added: apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: name: kube-prometheus-stack-prometheus labels: app: kube-prometheus-stack-prometheus app.kubernetes.io/instance: kube-prometheus-stack app.kubernetes.io/managed-by: Helm app.kubernetes.io/part-of: kube-prometheus-stack helm.toolkit.fluxcd.io/name: kube-prometheus-stack helm.toolkit.fluxcd.io/namespace: flux-system heritage: Helm release: kube-prometheus-stack rules: - resources: - nodes - nodes/metrics - services - endpoints - pods apiGroups: - verbs: - get - list - watch - resources: - endpointslices apiGroups: - discovery.k8s.io verbs: - get - list - watch - resources: - ingresses apiGroups: - networking.k8s.io verbs: - get - list - watch - nonResourceURLs: - /metrics - /metrics/cadvisor verbs: - get (root level) + one document added: apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding metadata: name: kube-state-metrics labels: app.kubernetes.io/component: metrics app.kubernetes.io/instance: kube-prometheus-stack app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: kube-state-metrics app.kubernetes.io/part-of: kube-state-metrics helm.toolkit.fluxcd.io/name: kube-prometheus-stack helm.toolkit.fluxcd.io/namespace: flux-system release: kube-prometheus-stack roleRef: name: kube-state-metrics apiGroup: rbac.authorization.k8s.io kind: ClusterRole subjects: - name: kube-state-metrics kind: ServiceAccount namespace: monitoring (root level) + one document added: apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding metadata: name: kube-prometheus-stack-operator labels: app: kube-prometheus-stack-operator app.kubernetes.io/component: prometheus-operator app.kubernetes.io/instance: kube-prometheus-stack app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: kube-prometheus-stack-prometheus-operator app.kubernetes.io/part-of: kube-prometheus-stack helm.toolkit.fluxcd.io/name: kube-prometheus-stack helm.toolkit.fluxcd.io/namespace: flux-system heritage: Helm release: kube-prometheus-stack roleRef: name: kube-prometheus-stack-operator apiGroup: rbac.authorization.k8s.io kind: ClusterRole subjects: - name: kube-prometheus-stack-operator kind: ServiceAccount namespace: monitoring (root level) + one document added: apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding metadata: name: kube-prometheus-stack-prometheus labels: app: kube-prometheus-stack-prometheus app.kubernetes.io/instance: kube-prometheus-stack app.kubernetes.io/managed-by: Helm app.kubernetes.io/part-of: kube-prometheus-stack helm.toolkit.fluxcd.io/name: kube-prometheus-stack helm.toolkit.fluxcd.io/namespace: flux-system heritage: Helm release: kube-prometheus-stack roleRef: name: kube-prometheus-stack-prometheus apiGroup: rbac.authorization.k8s.io kind: ClusterRole subjects: - name: kube-prometheus-stack-prometheus kind: ServiceAccount namespace: monitoring (root level) + one document added: apiVersion: v1 kind: Service metadata: name: kube-state-metrics annotations: null namespace: monitoring labels: app.kubernetes.io/component: metrics app.kubernetes.io/instance: kube-prometheus-stack app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: kube-state-metrics app.kubernetes.io/part-of: kube-state-metrics helm.toolkit.fluxcd.io/name: kube-prometheus-stack helm.toolkit.fluxcd.io/namespace: flux-system release: kube-prometheus-stack spec: type: ClusterIP selector: app.kubernetes.io/instance: kube-prometheus-stack app.kubernetes.io/name: kube-state-metrics ports: - name: http port: 8080 protocol: TCP targetPort: http (root level) + one document added: apiVersion: v1 kind: Service metadata: name: node-exporter namespace: kube-privileged annotations: prometheus.io/scrape: "true" labels: app.kubernetes.io/component: metrics app.kubernetes.io/instance: kube-prometheus-stack app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: prometheus-node-exporter app.kubernetes.io/part-of: prometheus-node-exporter helm.toolkit.fluxcd.io/name: kube-prometheus-stack helm.toolkit.fluxcd.io/namespace: flux-system jobLabel: node-exporter release: kube-prometheus-stack spec: type: ClusterIP selector: app.kubernetes.io/instance: kube-prometheus-stack app.kubernetes.io/name: prometheus-node-exporter ports: - name: http-metrics port: 9100 protocol: TCP targetPort: 9100 (root level) + one document added: apiVersion: v1 kind: Service metadata: name: kube-prometheus-stack-alertmanager namespace: monitoring labels: app: kube-prometheus-stack-alertmanager app.kubernetes.io/instance: kube-prometheus-stack app.kubernetes.io/managed-by: Helm app.kubernetes.io/part-of: kube-prometheus-stack helm.toolkit.fluxcd.io/name: kube-prometheus-stack helm.toolkit.fluxcd.io/namespace: flux-system heritage: Helm release: kube-prometheus-stack self-monitor: "true" spec: type: ClusterIP sessionAffinity: None selector: alertmanager: kube-prometheus-stack app.kubernetes.io/name: alertmanager ports: - name: http-web port: 9093 protocol: TCP targetPort: 9093 - name: reloader-web appProtocol: http port: 8080 targetPort: reloader-web (root level) + one document added: apiVersion: v1 kind: Service metadata: name: kube-prometheus-stack-coredns namespace: kube-system labels: app: kube-prometheus-stack-coredns app.kubernetes.io/instance: kube-prometheus-stack app.kubernetes.io/managed-by: Helm app.kubernetes.io/part-of: kube-prometheus-stack helm.toolkit.fluxcd.io/name: kube-prometheus-stack helm.toolkit.fluxcd.io/namespace: flux-system heritage: Helm jobLabel: coredns release: kube-prometheus-stack spec: clusterIP: None ports: - name: http-metrics port: 9153 protocol: TCP targetPort: 9153 selector: k8s-app: kube-dns (root level) + one document added: apiVersion: v1 kind: Service metadata: name: kube-prometheus-stack-kube-controller-manager namespace: kube-system labels: app: kube-prometheus-stack-kube-controller-manager app.kubernetes.io/instance: kube-prometheus-stack app.kubernetes.io/managed-by: Helm app.kubernetes.io/part-of: kube-prometheus-stack helm.toolkit.fluxcd.io/name: kube-prometheus-stack helm.toolkit.fluxcd.io/namespace: flux-system heritage: Helm jobLabel: kube-controller-manager release: kube-prometheus-stack spec: type: ClusterIP clusterIP: None selector: k8s-app: kube-controller-manager ports: - name: http-metrics port: 10257 protocol: TCP targetPort: 10257 (root level) + one document added: apiVersion: v1 kind: Service metadata: name: kube-prometheus-stack-kube-etcd namespace: kube-system labels: app: kube-prometheus-stack-kube-etcd app.kubernetes.io/instance: kube-prometheus-stack app.kubernetes.io/managed-by: Helm app.kubernetes.io/part-of: kube-prometheus-stack helm.toolkit.fluxcd.io/name: kube-prometheus-stack helm.toolkit.fluxcd.io/namespace: flux-system heritage: Helm jobLabel: kube-etcd release: kube-prometheus-stack spec: type: ClusterIP clusterIP: None selector: k8s-app: kube-controller-manager ports: - name: http-metrics port: 2381 protocol: TCP targetPort: 2381 (root level) + one document added: apiVersion: v1 kind: Service metadata: name: kube-prometheus-stack-kube-scheduler namespace: kube-system labels: app: kube-prometheus-stack-kube-scheduler app.kubernetes.io/instance: kube-prometheus-stack app.kubernetes.io/managed-by: Helm app.kubernetes.io/part-of: kube-prometheus-stack helm.toolkit.fluxcd.io/name: kube-prometheus-stack helm.toolkit.fluxcd.io/namespace: flux-system heritage: Helm jobLabel: kube-scheduler release: kube-prometheus-stack spec: type: ClusterIP clusterIP: None selector: k8s-app: kube-scheduler ports: - name: http-metrics port: 10259 protocol: TCP targetPort: 10259 (root level) + one document added: apiVersion: v1 kind: Service metadata: name: kube-prometheus-stack-operator namespace: monitoring labels: app: kube-prometheus-stack-operator app.kubernetes.io/component: prometheus-operator app.kubernetes.io/instance: kube-prometheus-stack app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: kube-prometheus-stack-prometheus-operator app.kubernetes.io/part-of: kube-prometheus-stack helm.toolkit.fluxcd.io/name: kube-prometheus-stack helm.toolkit.fluxcd.io/namespace: flux-system heritage: Helm release: kube-prometheus-stack spec: type: ClusterIP selector: app: kube-prometheus-stack-operator release: kube-prometheus-stack ports: - name: https port: 443 targetPort: https (root level) + one document added: apiVersion: v1 kind: Service metadata: name: kube-prometheus-stack-prometheus namespace: monitoring labels: app: kube-prometheus-stack-prometheus app.kubernetes.io/instance: kube-prometheus-stack app.kubernetes.io/managed-by: Helm app.kubernetes.io/part-of: kube-prometheus-stack helm.toolkit.fluxcd.io/name: kube-prometheus-stack helm.toolkit.fluxcd.io/namespace: flux-system heritage: Helm release: kube-prometheus-stack self-monitor: "true" spec: type: ClusterIP publishNotReadyAddresses: false sessionAffinity: None selector: app.kubernetes.io/name: prometheus operator.prometheus.io/name: kube-prometheus-stack ports: - name: http-web port: 9090 targetPort: 9090 - name: reloader-web appProtocol: http port: 8080 targetPort: reloader-web (root level) + one document added: apiVersion: apps/v1 kind: DaemonSet metadata: name: node-exporter namespace: kube-privileged labels: app.kubernetes.io/component: metrics app.kubernetes.io/instance: kube-prometheus-stack app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: prometheus-node-exporter app.kubernetes.io/part-of: prometheus-node-exporter helm.toolkit.fluxcd.io/name: kube-prometheus-stack helm.toolkit.fluxcd.io/namespace: flux-system release: kube-prometheus-stack spec: revisionHistoryLimit: 10 selector: matchLabels: app.kubernetes.io/instance: kube-prometheus-stack app.kubernetes.io/name: prometheus-node-exporter template: metadata: annotations: cluster-autoscaler.kubernetes.io/safe-to-evict: "true" labels: app.kubernetes.io/component: metrics app.kubernetes.io/instance: kube-prometheus-stack app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: prometheus-node-exporter app.kubernetes.io/part-of: prometheus-node-exporter jobLabel: node-exporter release: kube-prometheus-stack spec: affinity: nodeAffinity: requiredDuringSchedulingIgnoredDuringExecution: nodeSelectorTerms: - matchExpressions: - key: eks.amazonaws.com/compute-type operator: NotIn values: - fargate - key: type operator: NotIn values: - virtual-kubelet automountServiceAccountToken: false containers: - name: node-exporter image: "quay.io/prometheus/node-exporter:v1.12.1-distroless" imagePullPolicy: IfNotPresent args: - "--path.procfs=/host/proc" - "--path.sysfs=/host/sys" - "--path.rootfs=/host/root" - "--path.udev.data=/host/root/run/udev/data" - "--web.listen-address=[$(HOST_IP)]:9100" - "--collector.filesystem.mount-points-exclude=^/(dev|proc|sys|run/containerd/.+|var/lib/docker/.+|var/lib/kubelet/.+)($|/)" - "--collector.filesystem.fs-types-exclude=^(autofs|binfmt_misc|bpf|cgroup2?|configfs|debugfs|devpts|devtmpfs|fusectl|hugetlbfs|iso9660|mqueue|nsfs|overlay|proc|procfs|pstore|rpc_pipefs|securityfs|selinuxfs|squashfs|sysfs|tracefs|erofs)$" securityContext: readOnlyRootFilesystem: true env: - name: HOST_IP value: "0.0.0.0" livenessProbe: failureThreshold: 3 httpGet: httpHeaders: null path: / port: http-metrics scheme: HTTP initialDelaySeconds: 0 periodSeconds: 10 successThreshold: 1 timeoutSeconds: 1 ports: - name: http-metrics containerPort: 9100 protocol: TCP readinessProbe: failureThreshold: 3 httpGet: httpHeaders: null path: / port: http-metrics scheme: HTTP initialDelaySeconds: 0 periodSeconds: 10 successThreshold: 1 timeoutSeconds: 1 volumeMounts: - name: proc mountPath: /host/proc readOnly: true - name: sys mountPath: /host/sys readOnly: true - name: root mountPath: /host/root mountPropagation: HostToContainer readOnly: true hostIPC: false hostNetwork: true hostPID: true nodeSelector: kubernetes.io/os: linux securityContext: fsGroup: 65534 runAsGroup: 65534 runAsNonRoot: true runAsUser: 65534 serviceAccountName: node-exporter tolerations: - effect: NoSchedule operator: Exists volumes: - name: proc hostPath: path: /proc - name: sys hostPath: path: /sys - name: root hostPath: path: / updateStrategy: type: RollingUpdate rollingUpdate: maxUnavailable: 1 (root level) + one document added: apiVersion: apps/v1 kind: Deployment metadata: name: kube-state-metrics namespace: monitoring labels: app.kubernetes.io/component: metrics app.kubernetes.io/instance: kube-prometheus-stack app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: kube-state-metrics app.kubernetes.io/part-of: kube-state-metrics helm.toolkit.fluxcd.io/name: kube-prometheus-stack helm.toolkit.fluxcd.io/namespace: flux-system release: kube-prometheus-stack spec: replicas: 1 revisionHistoryLimit: 10 selector: matchLabels: app.kubernetes.io/instance: kube-prometheus-stack app.kubernetes.io/name: kube-state-metrics strategy: type: RollingUpdate template: metadata: labels: app.kubernetes.io/component: metrics app.kubernetes.io/instance: kube-prometheus-stack app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: kube-state-metrics app.kubernetes.io/part-of: kube-state-metrics release: kube-prometheus-stack spec: automountServiceAccountToken: true containers: - name: kube-state-metrics image: "registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.19.1" imagePullPolicy: IfNotPresent resources: {} args: - "--port=8080" - "--resources=certificatesigningrequests,configmaps,cronjobs,daemonsets,deployments,endpointslices,horizontalpodautoscalers,ingresses,jobs,leases,limitranges,mutatingwebhookconfigurations,namespaces,networkpolicies,nodes,persistentvolumeclaims,persistentvolumes,poddisruptionbudgets,pods,replicasets,replicationcontrollers,resourcequotas,secrets,services,statefulsets,storageclasses,validatingwebhookconfigurations,volumeattachments" - "--metric-labels-allowlist=pods=[*],deployments=[*],persistentvolumeclaims=[*]" - "--custom-resource-state-config-file=/etc/customresourcestate/config.yaml" livenessProbe: failureThreshold: 3 httpGet: path: /livez port: http scheme: HTTP initialDelaySeconds: 5 periodSeconds: 10 successThreshold: 1 timeoutSeconds: 5 ports: - name: http containerPort: 8080 - name: metrics containerPort: 8081 readinessProbe: failureThreshold: 3 httpGet: path: /readyz port: metrics scheme: HTTP initialDelaySeconds: 5 periodSeconds: 10 successThreshold: 1 timeoutSeconds: 5 volumeMounts: - name: customresourcestate-config mountPath: /etc/customresourcestate readOnly: true securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL readOnlyRootFilesystem: true dnsPolicy: ClusterFirst hostNetwork: false securityContext: fsGroup: 65534 runAsGroup: 65534 runAsNonRoot: true runAsUser: 65534 seccompProfile: type: RuntimeDefault serviceAccountName: kube-state-metrics volumes: - name: customresourcestate-config configMap: name: kube-state-metrics-customresourcestate-config (root level) + one document added: apiVersion: apps/v1 kind: Deployment metadata: name: kube-prometheus-stack-operator namespace: monitoring labels: app: kube-prometheus-stack-operator app.kubernetes.io/component: prometheus-operator app.kubernetes.io/instance: kube-prometheus-stack app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: kube-prometheus-stack-prometheus-operator app.kubernetes.io/part-of: kube-prometheus-stack helm.toolkit.fluxcd.io/name: kube-prometheus-stack helm.toolkit.fluxcd.io/namespace: flux-system heritage: Helm release: kube-prometheus-stack spec: replicas: 1 revisionHistoryLimit: 10 selector: matchLabels: app: kube-prometheus-stack-operator release: kube-prometheus-stack template: metadata: labels: app: kube-prometheus-stack-operator app.kubernetes.io/component: prometheus-operator app.kubernetes.io/instance: kube-prometheus-stack app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: kube-prometheus-stack-prometheus-operator app.kubernetes.io/part-of: kube-prometheus-stack heritage: Helm release: kube-prometheus-stack spec: automountServiceAccountToken: true containers: - name: kube-prometheus-stack image: "quay.io/prometheus-operator/prometheus-operator:v0.92.1" imagePullPolicy: IfNotPresent resources: {} args: - "--kubelet-service=kube-system/kube-prometheus-stack-kubelet" - "--kubelet-endpoints=true" - "--kubelet-endpointslice=false" - "--localhost=127.0.0.1" - "--prometheus-config-reloader=quay.io/prometheus-operator/prometheus-config-reloader:v0.92.1" - "--config-reloader-cpu-request=0" - "--config-reloader-cpu-limit=0" - "--config-reloader-memory-request=0" - "--config-reloader-memory-limit=0" - "--thanos-default-base-image=quay.io/thanos/thanos:v0.42.2" - "--secret-field-selector=type!=kubernetes.io/dockercfg,type!=kubernetes.io/service-account-token,type!=helm.sh/release.v1" - "--web.enable-tls=true" - "--web.cert-file=/cert/cert" - "--web.key-file=/cert/key" - "--web.listen-address=:10250" - "--web.tls-min-version=VersionTLS13" env: - name: GOGC value: "30" livenessProbe: failureThreshold: 3 httpGet: path: /healthz port: https scheme: HTTPS initialDelaySeconds: 0 periodSeconds: 10 successThreshold: 1 timeoutSeconds: 1 ports: - name: https containerPort: 10250 readinessProbe: failureThreshold: 3 httpGet: path: /healthz port: https scheme: HTTPS initialDelaySeconds: 0 periodSeconds: 10 successThreshold: 1 timeoutSeconds: 1 volumeMounts: - name: tls-secret mountPath: /cert readOnly: true securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL readOnlyRootFilesystem: true securityContext: fsGroup: 65534 runAsGroup: 65534 runAsNonRoot: true runAsUser: 65534 seccompProfile: type: RuntimeDefault serviceAccountName: kube-prometheus-stack-operator terminationGracePeriodSeconds: 30 volumes: - name: tls-secret secret: defaultMode: 420 secretName: kube-prometheus-stack-admission (root level) + one document added: apiVersion: admissionregistration.k8s.io/v1 kind: MutatingWebhookConfiguration metadata: name: kube-prometheus-stack-admission annotations: null labels: app: kube-prometheus-stack-admission app.kubernetes.io/component: prometheus-operator-webhook app.kubernetes.io/instance: kube-prometheus-stack app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: kube-prometheus-stack-prometheus-operator app.kubernetes.io/part-of: kube-prometheus-stack helm.toolkit.fluxcd.io/name: kube-prometheus-stack helm.toolkit.fluxcd.io/namespace: flux-system heritage: Helm release: kube-prometheus-stack webhooks: - name: prometheusrulemutate.monitoring.coreos.com failurePolicy: Ignore sideEffects: None timeoutSeconds: 10 admissionReviewVersions: - v1 - v1beta1 clientConfig: service: name: kube-prometheus-stack-operator namespace: monitoring path: /admission-prometheusrules/mutate rules: - resources: - prometheusrules apiGroups: - monitoring.coreos.com apiVersions: - "*" operations: - CREATE - UPDATE (root level) + one document added: apiVersion: admissionregistration.k8s.io/v1 kind: ValidatingWebhookConfiguration metadata: name: kube-prometheus-stack-admission annotations: null labels: app: kube-prometheus-stack-admission app.kubernetes.io/component: prometheus-operator-webhook app.kubernetes.io/instance: kube-prometheus-stack app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: kube-prometheus-stack-prometheus-operator app.kubernetes.io/part-of: kube-prometheus-stack helm.toolkit.fluxcd.io/name: kube-prometheus-stack helm.toolkit.fluxcd.io/namespace: flux-system heritage: Helm release: kube-prometheus-stack webhooks: - name: prometheusrulevalidate.monitoring.coreos.com failurePolicy: Ignore sideEffects: None timeoutSeconds: 10 admissionReviewVersions: - v1 - v1beta1 clientConfig: service: name: kube-prometheus-stack-operator namespace: monitoring path: /admission-prometheusrules/validate rules: - resources: - prometheusrules apiGroups: - monitoring.coreos.com apiVersions: - "*" operations: - CREATE - UPDATE - name: alertmanagerconfigsvalidate.monitoring.coreos.com failurePolicy: Ignore sideEffects: None timeoutSeconds: 10 admissionReviewVersions: - v1 - v1beta1 clientConfig: service: name: kube-prometheus-stack-operator namespace: monitoring path: /admission-alertmanagerconfigs/validate rules: - resources: - alertmanagerconfigs apiGroups: - monitoring.coreos.com apiVersions: - v1alpha1 operations: - CREATE - UPDATE (root level) + one document added: apiVersion: monitoring.coreos.com/v1 kind: Alertmanager metadata: name: kube-prometheus-stack namespace: monitoring labels: app: kube-prometheus-stack-alertmanager app.kubernetes.io/instance: kube-prometheus-stack app.kubernetes.io/managed-by: Helm app.kubernetes.io/part-of: kube-prometheus-stack helm.toolkit.fluxcd.io/name: kube-prometheus-stack helm.toolkit.fluxcd.io/namespace: flux-system heritage: Helm release: kube-prometheus-stack spec: version: v0.33.1 logFormat: logfmt portName: http-web alertmanagerConfigNamespaceSelector: {} alertmanagerConfigSelector: {} automountServiceAccountToken: true externalUrl: "https://alertmanager.k8s.aether.earth" hostNetwork: false image: "quay.io/prometheus/alertmanager:v0.33.1" listenLocal: false serviceAccountName: kube-prometheus-stack-alertmanager paused: false logLevel: info routePrefix: / imagePullPolicy: IfNotPresent replicas: 1 retention: 120h alertmanagerConfigMatcherStrategy: type: None securityContext: fsGroup: 2000 runAsGroup: 2000 runAsNonRoot: true runAsUser: 1000 seccompProfile: type: RuntimeDefault storage: volumeClaimTemplate: spec: resources: requests: storage: 1Gi storageClassName: longhorn affinity: podAntiAffinity: preferredDuringSchedulingIgnoredDuringExecution: - podAffinityTerm: labelSelector: matchExpressions: - key: app.kubernetes.io/name operator: In values: - alertmanager - key: alertmanager operator: In values: - kube-prometheus-stack topologyKey: kubernetes.io/hostname weight: 100 (root level) + one document added: apiVersion: gateway.networking.k8s.io/v1 kind: HTTPRoute metadata: name: kube-prometheus-stack-alertmanager namespace: monitoring annotations: gethomepage.dev/enabled: "true" gethomepage.dev/group: Observability gethomepage.dev/icon: "https://raw.githubusercontent.com/jhaezebr/svg_logos/master/alertmanager.svg" gethomepage.dev/name: Alertmanager gethomepage.dev/pod-selector: app.kubernetes.io/name=alertmanager labels: app: kube-prometheus-stack-alertmanager app.kubernetes.io/instance: kube-prometheus-stack app.kubernetes.io/managed-by: Helm app.kubernetes.io/part-of: kube-prometheus-stack helm.toolkit.fluxcd.io/name: kube-prometheus-stack helm.toolkit.fluxcd.io/namespace: flux-system heritage: Helm release: kube-prometheus-stack spec: hostnames: - alertmanager.k8s.aether.earth parentRefs: - name: envoy-over-vpn namespace: envoy-gateway rules: - backendRefs: - name: kube-prometheus-stack-alertmanager group: kind: Service port: 9093 weight: 1 matches: - path: type: PathPrefix value: / (root level) + one document added: apiVersion: gateway.networking.k8s.io/v1 kind: HTTPRoute metadata: name: kube-prometheus-stack-prometheus namespace: monitoring annotations: gethomepage.dev/enabled: "true" gethomepage.dev/group: Observability gethomepage.dev/icon: prometheus gethomepage.dev/name: Prometheus gethomepage.dev/pod-selector: app.kubernetes.io/name=prometheus gethomepage.dev/widget.type: prometheus gethomepage.dev/widget.url: "http://kube-prometheus-stack-prometheus.monitoring:9090" labels: app: kube-prometheus-stack-prometheus app.kubernetes.io/instance: kube-prometheus-stack app.kubernetes.io/managed-by: Helm app.kubernetes.io/part-of: kube-prometheus-stack helm.toolkit.fluxcd.io/name: kube-prometheus-stack helm.toolkit.fluxcd.io/namespace: flux-system heritage: Helm release: kube-prometheus-stack spec: hostnames: - prometheus.k8s.aether.earth parentRefs: - name: envoy-over-vpn namespace: envoy-gateway rules: - backendRefs: - name: kube-prometheus-stack-prometheus group: kind: Service port: 9090 weight: 1 matches: - path: type: PathPrefix value: / (root level) + one document added: apiVersion: monitoring.coreos.com/v1 kind: Prometheus metadata: name: kube-prometheus-stack namespace: monitoring labels: app: kube-prometheus-stack-prometheus app.kubernetes.io/instance: kube-prometheus-stack app.kubernetes.io/managed-by: Helm app.kubernetes.io/part-of: kube-prometheus-stack helm.toolkit.fluxcd.io/name: kube-prometheus-stack helm.toolkit.fluxcd.io/namespace: flux-system heritage: Helm release: kube-prometheus-stack spec: version: v3.13.1-distroless probeNamespaceSelector: {} probeSelector: {} automountServiceAccountToken: true enableAdminAPI: true walCompression: true enableOTLPReceiver: false enableRemoteWriteReceiver: true externalUrl: "https://prometheus.k8s.aether.earth" hostNetwork: false replicas: 1 imagePullPolicy: IfNotPresent listenLocal: false logFormat: logfmt logLevel: info paused: false podMonitorNamespaceSelector: {} podMonitorSelector: {} portName: http-web shards: 1 serviceMonitorSelector: {} image: "quay.io/prometheus/prometheus:v3.13.1-distroless" serviceMonitorNamespaceSelector: {} retention: 14d retentionSize: 85GB routePrefix: / ruleNamespaceSelector: {} ruleSelector: {} scrapeConfigNamespaceSelector: {} scrapeConfigSelector: {} scrapeInterval: 1m serviceAccountName: kube-prometheus-stack-prometheus tsdb: outOfOrderTimeWindow: 0s enableFeatures: - memory-snapshot-on-shutdown securityContext: fsGroup: 2000 runAsGroup: 2000 runAsNonRoot: true runAsUser: 1000 seccompProfile: type: RuntimeDefault resources: limits: memory: 4000Mi requests: cpu: 100m memory: 200Mi alerting: alertmanagers: - name: kube-prometheus-stack-alertmanager apiVersion: v2 namespace: monitoring pathPrefix: / port: http-web storage: volumeClaimTemplate: spec: resources: requests: storage: 100Gi storageClassName: longhorn affinity: podAntiAffinity: preferredDuringSchedulingIgnoredDuringExecution: - podAffinityTerm: labelSelector: matchExpressions: - key: app.kubernetes.io/name operator: In values: - prometheus - key: app.kubernetes.io/instance operator: In values: - kube-prometheus-stack topologyKey: kubernetes.io/hostname weight: 100 (root level) + one document added: apiVersion: monitoring.coreos.com/v1 kind: PrometheusRule metadata: name: kube-prometheus-stack-etcd-fragmentation namespace: monitoring labels: app: kube-prometheus-stack app.kubernetes.io/instance: kube-prometheus-stack app.kubernetes.io/managed-by: Helm app.kubernetes.io/part-of: kube-prometheus-stack helm.toolkit.fluxcd.io/name: kube-prometheus-stack helm.toolkit.fluxcd.io/namespace: flux-system heritage: Helm release: kube-prometheus-stack spec: groups: - name: etcd-fragmentation rules: - alert: etcdDatabaseHighFragmentationRatio annotations: description: "etcd cluster \"{{ $labels.job }}\": database size in use on instance {{ $labels.instance }} is {{ $value | humanizePercentage }} of the actual allocated disk space, please run defragmentation (e.g. etcdctl defrag) to retrieve the unused fragmented disk space." runbook_url: "https://etcd.io/docs/v3.5/op-guide/maintenance/#defragmentation" summary: "etcd database size in use is less than 15% of the actual allocated storage" expr: "(last_over_time(etcd_mvcc_db_total_size_in_use_in_bytes{job=~\".*etcd.*\"}[5m]) / last_over_time(etcd_mvcc_db_total_size_in_bytes{job=~\".*etcd.*\"}[5m])) < 0.15 and etcd_mvcc_db_total_size_in_use_in_bytes{job=~\".*etcd.*\"} > 104857600" for: 15m labels: severity: warning (root level) + one document added: apiVersion: monitoring.coreos.com/v1 kind: PrometheusRule metadata: name: kube-prometheus-stack-alertmanager.rules namespace: monitoring labels: app: kube-prometheus-stack app.kubernetes.io/instance: kube-prometheus-stack app.kubernetes.io/managed-by: Helm app.kubernetes.io/part-of: kube-prometheus-stack helm.toolkit.fluxcd.io/name: kube-prometheus-stack helm.toolkit.fluxcd.io/namespace: flux-system heritage: Helm release: kube-prometheus-stack spec: groups: - name: alertmanager.rules rules: - alert: AlertmanagerFailedReload annotations: description: "Configuration has failed to load for {{ $labels.namespace }}/{{ $labels.pod}}." runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/alertmanager/alertmanagerfailedreload" summary: "Reloading an Alertmanager configuration has failed." expr: | # Without max_over_time, failed scrapes could create false negatives, see # https://www.robustperception.io/alerting-on-gauges-in-prometheus-2-0 for details. max_over_time(alertmanager_config_last_reload_successful{job="kube-prometheus-stack-alertmanager",container="alertmanager",namespace="monitoring"}[5m]) == 0 for: 10m labels: severity: critical - alert: AlertmanagerMembersInconsistent annotations: description: "Alertmanager {{ $labels.namespace }}/{{ $labels.pod}} has only found {{ $value }} members of the {{$labels.job}} cluster." runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/alertmanager/alertmanagermembersinconsistent" summary: "A member of an Alertmanager cluster has not found all other cluster members." expr: | # Without max_over_time, failed scrapes could create false negatives, see # https://www.robustperception.io/alerting-on-gauges-in-prometheus-2-0 for details. max_over_time(alertmanager_cluster_members{job="kube-prometheus-stack-alertmanager",container="alertmanager",namespace="monitoring"}[5m]) < on (namespace,service,cluster) group_left count by (namespace,service,cluster) (max_over_time(alertmanager_cluster_members{job="kube-prometheus-stack-alertmanager",container="alertmanager",namespace="monitoring"}[5m])) for: 15m labels: severity: critical - alert: AlertmanagerFailedToSendAlerts annotations: description: "Alertmanager {{ $labels.namespace }}/{{ $labels.pod}} failed to send {{ $value | humanizePercentage }} of notifications to {{ $labels.integration }}." runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/alertmanager/alertmanagerfailedtosendalerts" summary: "An Alertmanager instance failed to send notifications." expr: | ( rate(alertmanager_notifications_failed_total{job="kube-prometheus-stack-alertmanager",container="alertmanager",namespace="monitoring"}[15m]) / ignoring (reason) group_left rate(alertmanager_notifications_total{job="kube-prometheus-stack-alertmanager",container="alertmanager",namespace="monitoring"}[15m]) ) > 0.01 for: 5m labels: severity: warning - alert: AlertmanagerClusterFailedToSendAlerts annotations: description: "The minimum notification failure rate to {{ $labels.integration }} sent from any instance in the {{$labels.job}} cluster is {{ $value | humanizePercentage }}." runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/alertmanager/alertmanagerclusterfailedtosendalerts" summary: "All Alertmanager instances in a cluster failed to send notifications to a critical integration." expr: | min by (namespace,service, integration) ( rate(alertmanager_notifications_failed_total{job="kube-prometheus-stack-alertmanager",container="alertmanager",namespace="monitoring", integration=~`.*`}[15m]) / ignoring (reason) group_left rate(alertmanager_notifications_total{job="kube-prometheus-stack-alertmanager",container="alertmanager",namespace="monitoring", integration=~`.*`}[15m]) > 0 ) > 0.01 for: 5m labels: severity: critical - alert: AlertmanagerClusterFailedToSendAlerts annotations: description: "The minimum notification failure rate to {{ $labels.integration }} sent from any instance in the {{$labels.job}} cluster is {{ $value | humanizePercentage }}." runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/alertmanager/alertmanagerclusterfailedtosendalerts" summary: "All Alertmanager instances in a cluster failed to send notifications to a non-critical integration." expr: | min by (namespace,service, integration) ( rate(alertmanager_notifications_failed_total{job="kube-prometheus-stack-alertmanager",container="alertmanager",namespace="monitoring", integration!~`.*`}[15m]) / ignoring (reason) group_left rate(alertmanager_notifications_total{job="kube-prometheus-stack-alertmanager",container="alertmanager",namespace="monitoring", integration!~`.*`}[15m]) > 0 ) > 0.01 for: 5m labels: severity: warning - alert: AlertmanagerConfigInconsistent annotations: description: "Alertmanager instances within the {{$labels.job}} cluster have different configurations." runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/alertmanager/alertmanagerconfiginconsistent" summary: "Alertmanager instances within the same cluster have different configurations." expr: | count by (namespace,service,cluster) ( count_values by (namespace,service,cluster) ("config_hash", alertmanager_config_hash{job="kube-prometheus-stack-alertmanager",container="alertmanager",namespace="monitoring"}) ) != 1 for: 20m labels: severity: critical - alert: AlertmanagerClusterDown annotations: description: "{{ $value | humanizePercentage }} of Alertmanager instances within the {{$labels.job}} cluster have been up for less than half of the last 5m." runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/alertmanager/alertmanagerclusterdown" summary: "Half or more of the Alertmanager instances within the same cluster are down." expr: | ( count by (namespace,service,cluster) ( avg_over_time(up{job="kube-prometheus-stack-alertmanager",container="alertmanager",namespace="monitoring"}[5m]) < 0.5 ) / count by (namespace,service,cluster) ( up{job="kube-prometheus-stack-alertmanager",container="alertmanager",namespace="monitoring"} ) ) >= 0.5 for: 5m labels: severity: critical - alert: AlertmanagerClusterCrashlooping annotations: description: "{{ $value | humanizePercentage }} of Alertmanager instances within the {{$labels.job}} cluster have restarted at least 5 times in the last 10m." runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/alertmanager/alertmanagerclustercrashlooping" summary: "Half or more of the Alertmanager instances within the same cluster are crashlooping." expr: | ( count by (namespace,service,cluster) ( changes(process_start_time_seconds{job="kube-prometheus-stack-alertmanager",container="alertmanager",namespace="monitoring"}[10m]) > 4 ) / count by (namespace,service,cluster) ( up{job="kube-prometheus-stack-alertmanager",container="alertmanager",namespace="monitoring"} ) ) >= 0.5 for: 5m labels: severity: critical - alert: AlertmanagerClusterFailedPeers annotations: description: "Alertmanager {{ $labels.namespace }}/{{ $labels.pod}} has {{ $value }} failed peers in the {{$labels.job}} cluster." runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/alertmanager/alertmanagerclusterfailedpeers" summary: "An Alertmanager instance has failed peers in the cluster." expr: | # Without max_over_time, failed scrapes could create false negatives, see # https://www.robustperception.io/alerting-on-gauges-in-prometheus-2-0 for details. max_over_time(alertmanager_cluster_failed_peers{job="kube-prometheus-stack-alertmanager",container="alertmanager",namespace="monitoring"}[5m]) > 0 for: 15m labels: severity: warning (root level) + one document added: apiVersion: monitoring.coreos.com/v1 kind: PrometheusRule metadata: name: kube-prometheus-stack-config-reloaders namespace: monitoring labels: app: kube-prometheus-stack app.kubernetes.io/instance: kube-prometheus-stack app.kubernetes.io/managed-by: Helm app.kubernetes.io/part-of: kube-prometheus-stack helm.toolkit.fluxcd.io/name: kube-prometheus-stack helm.toolkit.fluxcd.io/namespace: flux-system heritage: Helm release: kube-prometheus-stack spec: groups: - name: config-reloaders rules: - alert: ConfigReloaderSidecarErrors annotations: description: | Errors encountered while the {{$labels.pod}} config-reloader sidecar attempts to sync config in {{$labels.namespace}} namespace. As a result, configuration for service running in {{$labels.pod}} may be stale and cannot be updated anymore. runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/prometheus-operator/configreloadersidecarerrors" summary: "config-reloader sidecar has not had a successful reload for 10m" expr: "max_over_time(reloader_last_reload_successful{namespace=~\".+\"}[5m]) == 0" for: 10m labels: severity: warning (root level) + one document added: apiVersion: monitoring.coreos.com/v1 kind: PrometheusRule metadata: name: kube-prometheus-stack-etcd namespace: monitoring labels: app: kube-prometheus-stack app.kubernetes.io/instance: kube-prometheus-stack app.kubernetes.io/managed-by: Helm app.kubernetes.io/part-of: kube-prometheus-stack helm.toolkit.fluxcd.io/name: kube-prometheus-stack helm.toolkit.fluxcd.io/namespace: flux-system heritage: Helm release: kube-prometheus-stack spec: groups: - name: etcd rules: - alert: etcdMembersDown annotations: description: "etcd cluster \"{{ $labels.job }}\": members are down ({{ $value }})." runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/etcd/etcdmembersdown" summary: "etcd cluster members are down." expr: | max without (endpoint) ( sum without (instance, pod) (up{job=~".*etcd.*"} == bool 0) or count without (To) ( sum without (instance, pod) (rate(etcd_network_peer_sent_failures_total{job=~".*etcd.*"}[120s])) > 0.01 ) ) > 0 for: 20m labels: severity: warning - alert: etcdInsufficientMembers annotations: description: "etcd cluster \"{{ $labels.job }}\": insufficient members ({{ $value }})." runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/etcd/etcdinsufficientmembers" summary: "etcd cluster has insufficient number of members." expr: "sum(up{job=~\".*etcd.*\"} == bool 1) without (instance, pod) < ((count(up{job=~\".*etcd.*\"}) without (instance, pod) + 1) / 2)" for: 3m labels: severity: critical - alert: etcdNoLeader annotations: description: "etcd cluster \"{{ $labels.job }}\": member {{ $labels.instance }} has no leader." runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/etcd/etcdnoleader" summary: "etcd cluster has no leader." expr: "etcd_server_has_leader{job=~\".*etcd.*\"} == 0" for: 1m labels: severity: critical - alert: etcdHighNumberOfLeaderChanges annotations: description: "etcd cluster \"{{ $labels.job }}\": {{ $value }} leader changes within the last 15 minutes. Frequent elections may be a sign of insufficient resources, high network latency, or disruptions by other components and should be investigated." runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/etcd/etcdhighnumberofleaderchanges" summary: "etcd cluster has high number of leader changes." expr: "increase((max without (instance, pod) (etcd_server_leader_changes_seen_total{job=~\".*etcd.*\"}) or 0*absent(etcd_server_leader_changes_seen_total{job=~\".*etcd.*\"}))[15m:1m]) >= 4" for: 5m labels: severity: warning - alert: etcdHighNumberOfFailedGRPCRequests annotations: description: "etcd cluster \"{{ $labels.job }}\": {{ $value }}% of requests for {{ $labels.grpc_method }} failed on etcd instance {{ $labels.instance }}." runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/etcd/etcdhighnumberoffailedgrpcrequests" summary: "etcd cluster has high number of failed grpc requests." expr: | 100 * sum(rate(grpc_server_handled_total{job=~".*etcd.*", grpc_code=~"Unknown|FailedPrecondition|ResourceExhausted|Internal|Unavailable|DataLoss|DeadlineExceeded"}[5m])) without (grpc_type, grpc_code) / sum(rate(grpc_server_handled_total{job=~".*etcd.*"}[5m])) without (grpc_type, grpc_code) > 1 for: 10m labels: severity: warning - alert: etcdHighNumberOfFailedGRPCRequests annotations: description: "etcd cluster \"{{ $labels.job }}\": {{ $value }}% of requests for {{ $labels.grpc_method }} failed on etcd instance {{ $labels.instance }}." runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/etcd/etcdhighnumberoffailedgrpcrequests" summary: "etcd cluster has high number of failed grpc requests." expr: | 100 * sum(rate(grpc_server_handled_total{job=~".*etcd.*", grpc_code=~"Unknown|FailedPrecondition|ResourceExhausted|Internal|Unavailable|DataLoss|DeadlineExceeded"}[5m])) without (grpc_type, grpc_code) / sum(rate(grpc_server_handled_total{job=~".*etcd.*"}[5m])) without (grpc_type, grpc_code) > 5 for: 5m labels: severity: critical - alert: etcdGRPCRequestsSlow annotations: description: "etcd cluster \"{{ $labels.job }}\": 99th percentile of gRPC requests is {{ $value }}s on etcd instance {{ $labels.instance }} for {{ $labels.grpc_method }} method." runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/etcd/etcdgrpcrequestsslow" summary: "etcd grpc requests are slow" expr: | histogram_quantile(0.99, sum(rate(grpc_server_handling_seconds_bucket{job=~".*etcd.*", grpc_method!="Defragment", grpc_type="unary"}[5m])) without(grpc_type)) > 0.15 for: 10m labels: severity: critical - alert: etcdMemberCommunicationSlow annotations: description: "etcd cluster \"{{ $labels.job }}\": member communication with {{ $labels.To }} is taking {{ $value }}s on etcd instance {{ $labels.instance }}." runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/etcd/etcdmembercommunicationslow" summary: "etcd cluster member communication is slow." expr: | histogram_quantile(0.99, rate(etcd_network_peer_round_trip_time_seconds_bucket{job=~".*etcd.*"}[5m])) > 0.15 for: 10m labels: severity: warning - alert: etcdHighNumberOfFailedProposals annotations: description: "etcd cluster \"{{ $labels.job }}\": {{ $value }} proposal failures within the last 30 minutes on etcd instance {{ $labels.instance }}." runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/etcd/etcdhighnumberoffailedproposals" summary: "etcd cluster has high number of proposal failures." expr: "rate(etcd_server_proposals_failed_total{job=~\".*etcd.*\"}[15m]) > 5" for: 15m labels: severity: warning - alert: etcdHighFsyncDurations annotations: description: "etcd cluster \"{{ $labels.job }}\": 99th percentile fsync durations are {{ $value }}s on etcd instance {{ $labels.instance }}." runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/etcd/etcdhighfsyncdurations" summary: "etcd cluster 99th percentile fsync durations are too high." expr: | histogram_quantile(0.99, rate(etcd_disk_wal_fsync_duration_seconds_bucket{job=~".*etcd.*"}[5m])) > 0.5 for: 10m labels: severity: warning - alert: etcdHighFsyncDurations annotations: description: "etcd cluster \"{{ $labels.job }}\": 99th percentile fsync durations are {{ $value }}s on etcd instance {{ $labels.instance }}." runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/etcd/etcdhighfsyncdurations" summary: "etcd cluster 99th percentile fsync durations are too high." expr: | histogram_quantile(0.99, rate(etcd_disk_wal_fsync_duration_seconds_bucket{job=~".*etcd.*"}[5m])) > 1 for: 10m labels: severity: critical - alert: etcdHighCommitDurations annotations: description: "etcd cluster \"{{ $labels.job }}\": 99th percentile commit durations {{ $value }}s on etcd instance {{ $labels.instance }}." runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/etcd/etcdhighcommitdurations" summary: "etcd cluster 99th percentile commit durations are too high." expr: | histogram_quantile(0.99, rate(etcd_disk_backend_commit_duration_seconds_bucket{job=~".*etcd.*"}[5m])) > 0.25 for: 10m labels: severity: warning - alert: etcdDatabaseQuotaLowSpace annotations: description: "etcd cluster \"{{ $labels.job }}\": database size exceeds the defined quota on etcd instance {{ $labels.instance }}, please defrag or increase the quota as the writes to etcd will be disabled when it is full." runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/etcd/etcddatabasequotalowspace" summary: "etcd cluster database is running full." expr: "(last_over_time(etcd_mvcc_db_total_size_in_bytes{job=~\".*etcd.*\"}[5m]) / last_over_time(etcd_server_quota_backend_bytes{job=~\".*etcd.*\"}[5m]))*100 > 95" for: 10m labels: severity: critical - alert: etcdExcessiveDatabaseGrowth annotations: description: "etcd cluster \"{{ $labels.job }}\": Predicting running out of disk space in the next four hours, based on write observations within the past four hours on etcd instance {{ $labels.instance }}, please check as it might be disruptive." runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/etcd/etcdexcessivedatabasegrowth" summary: "etcd cluster database growing very fast." expr: "predict_linear(etcd_mvcc_db_total_size_in_bytes{job=~\".*etcd.*\"}[4h], 4*60*60) > etcd_server_quota_backend_bytes{job=~\".*etcd.*\"}" for: 10m labels: severity: warning (root level) + one document added: apiVersion: monitoring.coreos.com/v1 kind: PrometheusRule metadata: name: kube-prometheus-stack-general.rules namespace: monitoring labels: app: kube-prometheus-stack app.kubernetes.io/instance: kube-prometheus-stack app.kubernetes.io/managed-by: Helm app.kubernetes.io/part-of: kube-prometheus-stack helm.toolkit.fluxcd.io/name: kube-prometheus-stack helm.toolkit.fluxcd.io/namespace: flux-system heritage: Helm release: kube-prometheus-stack spec: groups: - name: general.rules rules: - alert: TargetDown annotations: description: "{{ printf \"%.4g\" $value }}% of the {{ $labels.job }}/{{ $labels.service }} targets in {{ $labels.namespace }} namespace are down." runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/general/targetdown" summary: "One or more targets are unreachable." expr: "100 * (count(up == 0) BY (cluster, job, namespace, service) / count(up) BY (cluster, job, namespace, service)) > 10" for: 10m labels: severity: warning - alert: Watchdog annotations: description: | This is an alert meant to ensure that the entire alerting pipeline is functional. This alert is always firing, therefore it should always be firing in Alertmanager and always fire against a receiver. There are integrations with various notification mechanisms that send a notification when this alert is not firing. For example the "DeadMansSnitch" integration in PagerDuty. runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/general/watchdog" summary: "An alert that should always be firing to certify that Alertmanager is working properly." expr: vector(1) labels: severity: none - alert: InfoInhibitor annotations: description: | This is an alert that is used to inhibit info alerts. By themselves, the info-level alerts are sometimes very noisy, but they are relevant when combined with other alerts. This alert fires whenever there's a severity="info" alert, and stops firing when another alert with a severity of 'warning' or 'critical' starts firing on the same namespace. This alert should be routed to a null receiver and configured to inhibit alerts with severity="info". runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/general/infoinhibitor" summary: "Info-level alert inhibition." expr: "group by (namespace) (ALERTS{severity = \"info\"} == 1) unless on (namespace) group by (namespace) (ALERTS{alertname != \"InfoInhibitor\", alertstate = \"firing\", severity =~ \"warning|critical\"} == 1)" labels: severity: none (root level) + one document added: apiVersion: monitoring.coreos.com/v1 kind: PrometheusRule metadata: name: kube-prometheus-stack-k8s.rules.container-cpu-usage-seconds-tot namespace: monitoring labels: app: kube-prometheus-stack app.kubernetes.io/instance: kube-prometheus-stack app.kubernetes.io/managed-by: Helm app.kubernetes.io/part-of: kube-prometheus-stack helm.toolkit.fluxcd.io/name: kube-prometheus-stack helm.toolkit.fluxcd.io/namespace: flux-system heritage: Helm release: kube-prometheus-stack spec: groups: - name: k8s.rules.container_cpu_usage_seconds_total rules: - expr: | sum by (cluster, namespace, pod, container) ( rate(container_cpu_usage_seconds_total{job="kubelet", metrics_path="/metrics/cadvisor", image!=""}[5m]) ) * on (cluster, namespace, pod) group_left(node) topk by (cluster, namespace, pod) ( 1, max by (cluster, namespace, pod, node) (kube_pod_info{node!=""}) ) record: "node_namespace_pod_container:container_cpu_usage_seconds_total:sum_rate5m" - expr: | sum by (cluster, namespace, pod, container) ( irate(container_cpu_usage_seconds_total{job="kubelet", metrics_path="/metrics/cadvisor", image!=""}[5m]) ) * on (cluster, namespace, pod) group_left(node) topk by (cluster, namespace, pod) ( 1, max by (cluster, namespace, pod, node) (kube_pod_info{node!=""}) ) record: "node_namespace_pod_container:container_cpu_usage_seconds_total:sum_irate" (root level) + one document added: apiVersion: monitoring.coreos.com/v1 kind: PrometheusRule metadata: name: kube-prometheus-stack-k8s.rules.container-memory-cache namespace: monitoring labels: app: kube-prometheus-stack app.kubernetes.io/instance: kube-prometheus-stack app.kubernetes.io/managed-by: Helm app.kubernetes.io/part-of: kube-prometheus-stack helm.toolkit.fluxcd.io/name: kube-prometheus-stack helm.toolkit.fluxcd.io/namespace: flux-system heritage: Helm release: kube-prometheus-stack spec: groups: - name: k8s.rules.container_memory_cache rules: - expr: | container_memory_cache{job="kubelet", metrics_path="/metrics/cadvisor", image!=""} * on (cluster, namespace, pod) group_left(node) topk by (cluster, namespace, pod) (1, max by (cluster, namespace, pod, node) (kube_pod_info{node!=""}) ) record: "node_namespace_pod_container:container_memory_cache" (root level) + one document added: apiVersion: monitoring.coreos.com/v1 kind: PrometheusRule metadata: name: kube-prometheus-stack-k8s.rules.container-memory-rss namespace: monitoring labels: app: kube-prometheus-stack app.kubernetes.io/instance: kube-prometheus-stack app.kubernetes.io/managed-by: Helm app.kubernetes.io/part-of: kube-prometheus-stack helm.toolkit.fluxcd.io/name: kube-prometheus-stack helm.toolkit.fluxcd.io/namespace: flux-system heritage: Helm release: kube-prometheus-stack spec: groups: - name: k8s.rules.container_memory_rss rules: - expr: | container_memory_rss{job="kubelet", metrics_path="/metrics/cadvisor", image!=""} * on (cluster, namespace, pod) group_left(node) topk by (cluster, namespace, pod) (1, max by (cluster, namespace, pod, node) (kube_pod_info{node!=""}) ) record: "node_namespace_pod_container:container_memory_rss" (root level) + one document added: apiVersion: monitoring.coreos.com/v1 kind: PrometheusRule metadata: name: kube-prometheus-stack-k8s.rules.container-memory-swap namespace: monitoring labels: app: kube-prometheus-stack app.kubernetes.io/instance: kube-prometheus-stack app.kubernetes.io/managed-by: Helm app.kubernetes.io/part-of: kube-prometheus-stack helm.toolkit.fluxcd.io/name: kube-prometheus-stack helm.toolkit.fluxcd.io/namespace: flux-system heritage: Helm release: kube-prometheus-stack spec: groups: - name: k8s.rules.container_memory_swap rules: - expr: | container_memory_swap{job="kubelet", metrics_path="/metrics/cadvisor", image!=""} * on (cluster, namespace, pod) group_left(node) topk by (cluster, namespace, pod) (1, max by (cluster, namespace, pod, node) (kube_pod_info{node!=""}) ) record: "node_namespace_pod_container:container_memory_swap" (root level) + one document added: apiVersion: monitoring.coreos.com/v1 kind: PrometheusRule metadata: name: kube-prometheus-stack-k8s.rules.container-memory-working-set-by namespace: monitoring labels: app: kube-prometheus-stack app.kubernetes.io/instance: kube-prometheus-stack app.kubernetes.io/managed-by: Helm app.kubernetes.io/part-of: kube-prometheus-stack helm.toolkit.fluxcd.io/name: kube-prometheus-stack helm.toolkit.fluxcd.io/namespace: flux-system heritage: Helm release: kube-prometheus-stack spec: groups: - name: k8s.rules.container_memory_working_set_bytes rules: - expr: | container_memory_working_set_bytes{job="kubelet", metrics_path="/metrics/cadvisor", image!=""} * on (cluster, namespace, pod) group_left(node) topk by (cluster, namespace, pod) (1, max by (cluster, namespace, pod, node) (kube_pod_info{node!=""}) ) record: "node_namespace_pod_container:container_memory_working_set_bytes" (root level) + one document added: apiVersion: monitoring.coreos.com/v1 kind: PrometheusRule metadata: name: kube-prometheus-stack-k8s.rules.container-resource namespace: monitoring labels: app: kube-prometheus-stack app.kubernetes.io/instance: kube-prometheus-stack app.kubernetes.io/managed-by: Helm app.kubernetes.io/part-of: kube-prometheus-stack helm.toolkit.fluxcd.io/name: kube-prometheus-stack helm.toolkit.fluxcd.io/namespace: flux-system heritage: Helm release: kube-prometheus-stack spec: groups: - name: k8s.rules.container_resource rules: - expr: | kube_pod_container_resource_requests{resource="memory",job="kube-state-metrics"} * on (namespace, pod, cluster) group_left() max by (namespace, pod, cluster) ( (kube_pod_status_phase{phase=~"Pending|Running"} == 1) ) record: "cluster:namespace:pod_memory:active:kube_pod_container_resource_requests" - expr: | sum by (namespace, cluster) ( sum by (namespace, pod, cluster) ( max by (namespace, pod, container, cluster) ( kube_pod_container_resource_requests{resource="memory",job="kube-state-metrics"} ) * on (namespace, pod, cluster) group_left() max by (namespace, pod, cluster) ( kube_pod_status_phase{phase=~"Pending|Running"} == 1 ) ) ) record: "namespace_memory:kube_pod_container_resource_requests:sum" - expr: | kube_pod_container_resource_requests{resource="cpu",job="kube-state-metrics"} * on (namespace, pod, cluster) group_left() max by (namespace, pod, cluster) ( (kube_pod_status_phase{phase=~"Pending|Running"} == 1) ) record: "cluster:namespace:pod_cpu:active:kube_pod_container_resource_requests" - expr: | sum by (namespace, cluster) ( sum by (namespace, pod, cluster) ( max by (namespace, pod, container, cluster) ( kube_pod_container_resource_requests{resource="cpu",job="kube-state-metrics"} ) * on (namespace, pod, cluster) group_left() max by (namespace, pod, cluster) ( kube_pod_status_phase{phase=~"Pending|Running"} == 1 ) ) ) record: "namespace_cpu:kube_pod_container_resource_requests:sum" - expr: | kube_pod_container_resource_limits{resource="memory",job="kube-state-metrics"} * on (namespace, pod, cluster) group_left() max by (namespace, pod, cluster) ( (kube_pod_status_phase{phase=~"Pending|Running"} == 1) ) record: "cluster:namespace:pod_memory:active:kube_pod_container_resource_limits" - expr: | sum by (namespace, cluster) ( sum by (namespace, pod, cluster) ( max by (namespace, pod, container, cluster) ( kube_pod_container_resource_limits{resource="memory",job="kube-state-metrics"} ) * on (namespace, pod, cluster) group_left() max by (namespace, pod, cluster) ( kube_pod_status_phase{phase=~"Pending|Running"} == 1 ) ) ) record: "namespace_memory:kube_pod_container_resource_limits:sum" - expr: | kube_pod_container_resource_limits{resource="cpu",job="kube-state-metrics"} * on (namespace, pod, cluster) group_left() max by (namespace, pod, cluster) ( (kube_pod_status_phase{phase=~"Pending|Running"} == 1) ) record: "cluster:namespace:pod_cpu:active:kube_pod_container_resource_limits" - expr: | sum by (namespace, cluster) ( sum by (namespace, pod, cluster) ( max by (namespace, pod, container, cluster) ( kube_pod_container_resource_limits{resource="cpu",job="kube-state-metrics"} ) * on (namespace, pod, cluster) group_left() max by (namespace, pod, cluster) ( kube_pod_status_phase{phase=~"Pending|Running"} == 1 ) ) ) record: "namespace_cpu:kube_pod_container_resource_limits:sum" (root level) + one document added: apiVersion: monitoring.coreos.com/v1 kind: PrometheusRule metadata: name: kube-prometheus-stack-k8s.rules.pod-owner namespace: monitoring labels: app: kube-prometheus-stack app.kubernetes.io/instance: kube-prometheus-stack app.kubernetes.io/managed-by: Helm app.kubernetes.io/part-of: kube-prometheus-stack helm.toolkit.fluxcd.io/name: kube-prometheus-stack helm.toolkit.fluxcd.io/namespace: flux-system heritage: Helm release: kube-prometheus-stack spec: groups: - name: k8s.rules.pod_owner rules: - expr: | max by (cluster, namespace, workload, pod) ( label_replace( label_replace( kube_pod_owner{job="kube-state-metrics", owner_kind="ReplicaSet"}, "replicaset", "$1", "owner_name", "(.*)" ) * on (cluster, replicaset, namespace) group_left(owner_name) topk by (cluster, replicaset, namespace) ( 1, max by (cluster, replicaset, namespace, owner_name) ( kube_replicaset_owner{job="kube-state-metrics", owner_kind=""} ) ), "workload", "$1", "replicaset", "(.*)" ) ) labels: workload_type: replicaset record: "namespace_workload_pod:kube_pod_owner:relabel" - expr: | max by (cluster, namespace, workload, pod) ( label_replace( label_replace( kube_pod_owner{job="kube-state-metrics", owner_kind="ReplicaSet"}, "replicaset", "$1", "owner_name", "(.*)" ) * on (replicaset, namespace, cluster) group_left(owner_name) topk by (cluster, replicaset, namespace) ( 1, max by (cluster, replicaset, namespace, owner_name) ( kube_replicaset_owner{job="kube-state-metrics", owner_kind="Deployment"} ) ), "workload", "$1", "owner_name", "(.*)" ) ) labels: workload_type: deployment record: "namespace_workload_pod:kube_pod_owner:relabel" - expr: | max by (cluster, namespace, workload, pod) ( label_replace( kube_pod_owner{job="kube-state-metrics", owner_kind="DaemonSet"}, "workload", "$1", "owner_name", "(.*)" ) ) labels: workload_type: daemonset record: "namespace_workload_pod:kube_pod_owner:relabel" - expr: | max by (cluster, namespace, workload, pod) ( label_replace( kube_pod_owner{job="kube-state-metrics", owner_kind="StatefulSet"}, "workload", "$1", "owner_name", "(.*)") ) labels: workload_type: statefulset record: "namespace_workload_pod:kube_pod_owner:relabel" - expr: | group by (cluster, namespace, workload, pod) ( label_join( group by (cluster, namespace, job_name, pod, owner_name) ( label_join( kube_pod_owner{job="kube-state-metrics", owner_kind="Job"} , "job_name", "", "owner_name") ) * on (cluster, namespace, job_name) group_left() group by (cluster, namespace, job_name) ( kube_job_owner{job="kube-state-metrics", owner_kind=~"Pod|"} ) , "workload", "", "owner_name") ) labels: workload_type: job record: "namespace_workload_pod:kube_pod_owner:relabel" - expr: | max by (cluster, namespace, workload, pod) ( label_replace( kube_pod_owner{job="kube-state-metrics", owner_kind="", owner_name=""}, "workload", "$1", "pod", "(.+)") ) labels: workload_type: barepod record: "namespace_workload_pod:kube_pod_owner:relabel" - expr: | max by (cluster, namespace, workload, pod) ( label_replace( kube_pod_owner{job="kube-state-metrics", owner_kind="Node"}, "workload", "$1", "pod", "(.+)") ) labels: workload_type: staticpod record: "namespace_workload_pod:kube_pod_owner:relabel" - expr: | group by (cluster, namespace, workload, workload_type, pod) ( label_join( label_join( group by (cluster, namespace, job_name, pod) ( label_join( kube_pod_owner{job="kube-state-metrics", owner_kind="Job"} , "job_name", "", "owner_name") ) * on (cluster, namespace, job_name) group_left(owner_kind, owner_name) group by (cluster, namespace, job_name, owner_kind, owner_name) ( kube_job_owner{job="kube-state-metrics", owner_kind!="Pod", owner_kind!=""} ) , "workload", "", "owner_name") , "workload_type", "", "owner_kind") OR label_replace( label_replace( label_replace( kube_pod_owner{job="kube-state-metrics", owner_kind="ReplicaSet"} , "replicaset", "$1", "owner_name", "(.+)" ) * on (cluster, namespace, replicaset) group_left(owner_kind, owner_name) group by (cluster, namespace, replicaset, owner_kind, owner_name) ( kube_replicaset_owner{job="kube-state-metrics", owner_kind!="Deployment", owner_kind!=""} ) , "workload", "$1", "owner_name", "(.+)") OR label_replace( group by (cluster, namespace, pod, owner_name, owner_kind) ( kube_pod_owner{job="kube-state-metrics", owner_kind!="ReplicaSet", owner_kind!="DaemonSet", owner_kind!="StatefulSet", owner_kind!="Job", owner_kind!="Node", owner_kind!=""} ) , "workload", "$1", "owner_name", "(.+)" ) , "workload_type", "$1", "owner_kind", "(.+)") ) record: "namespace_workload_pod:kube_pod_owner:relabel" (root level) + one document added: apiVersion: monitoring.coreos.com/v1 kind: PrometheusRule metadata: name: kube-prometheus-stack-kube-apiserver-availability.rules namespace: monitoring labels: app: kube-prometheus-stack app.kubernetes.io/instance: kube-prometheus-stack app.kubernetes.io/managed-by: Helm app.kubernetes.io/part-of: kube-prometheus-stack helm.toolkit.fluxcd.io/name: kube-prometheus-stack helm.toolkit.fluxcd.io/namespace: flux-system heritage: Helm release: kube-prometheus-stack spec: groups: - name: kube-apiserver-availability.rules interval: 3m rules: - expr: "avg_over_time(code_verb:apiserver_request_total:increase1h[30d]) * 24 * 30" record: "code_verb:apiserver_request_total:increase30d" - expr: "sum by (cluster, code) (code_verb:apiserver_request_total:increase30d{verb=~\"LIST|GET\"})" labels: verb: read record: "code:apiserver_request_total:increase30d" - expr: "sum by (cluster, code) (code_verb:apiserver_request_total:increase30d{verb=~\"POST|PUT|PATCH|DELETE\"})" labels: verb: write record: "code:apiserver_request_total:increase30d" - expr: "sum by (cluster, verb, scope, le) (increase(apiserver_request_sli_duration_seconds_bucket[1h]))" record: "cluster_verb_scope_le:apiserver_request_sli_duration_seconds_bucket:increase1h" - expr: "sum by (cluster, verb, scope, le) (avg_over_time(cluster_verb_scope_le:apiserver_request_sli_duration_seconds_bucket:increase1h[30d]) * 24 * 30)" record: "cluster_verb_scope_le:apiserver_request_sli_duration_seconds_bucket:increase30d" - expr: "sum by (cluster, verb, scope) (cluster_verb_scope_le:apiserver_request_sli_duration_seconds_bucket:increase1h{le=\"+Inf\"})" record: "cluster_verb_scope:apiserver_request_sli_duration_seconds_count:increase1h" - expr: "sum by (cluster, verb, scope) (cluster_verb_scope_le:apiserver_request_sli_duration_seconds_bucket:increase30d{le=\"+Inf\"})" record: "cluster_verb_scope:apiserver_request_sli_duration_seconds_count:increase30d" - expr: | 1 - ( ( # write too slow sum by (cluster) (cluster_verb_scope:apiserver_request_sli_duration_seconds_count:increase30d{verb=~"POST|PUT|PATCH|DELETE"}) - sum by (cluster) (cluster_verb_scope_le:apiserver_request_sli_duration_seconds_bucket:increase30d{verb=~"POST|PUT|PATCH|DELETE",le=~"1(\\.0)?"} or vector(0)) ) + ( # read too slow sum by (cluster) (cluster_verb_scope:apiserver_request_sli_duration_seconds_count:increase30d{verb=~"LIST|GET"}) - ( sum by (cluster) (cluster_verb_scope_le:apiserver_request_sli_duration_seconds_bucket:increase30d{verb=~"LIST|GET",scope=~"resource|",le=~"1(\\.0)?"} or vector(0)) + sum by (cluster) (cluster_verb_scope_le:apiserver_request_sli_duration_seconds_bucket:increase30d{verb=~"LIST|GET",scope="namespace",le=~"5(\\.0)?"} or vector(0)) + sum by (cluster) (cluster_verb_scope_le:apiserver_request_sli_duration_seconds_bucket:increase30d{verb=~"LIST|GET",scope="cluster",le=~"30(\\.0)?"} or vector(0)) ) ) + # errors sum by (cluster) (code:apiserver_request_total:increase30d{code=~"5.."} or vector(0)) ) / sum by (cluster) (code:apiserver_request_total:increase30d) labels: verb: all record: "apiserver_request:availability30d" - expr: | 1 - ( sum by (cluster) (cluster_verb_scope:apiserver_request_sli_duration_seconds_count:increase30d{verb=~"LIST|GET"}) - ( # too slow sum by (cluster) (cluster_verb_scope_le:apiserver_request_sli_duration_seconds_bucket:increase30d{verb=~"LIST|GET",scope=~"resource|",le=~"1(\\.0)?"} or vector(0)) + sum by (cluster) (cluster_verb_scope_le:apiserver_request_sli_duration_seconds_bucket:increase30d{verb=~"LIST|GET",scope="namespace",le=~"5(\\.0)?"} or vector(0)) + sum by (cluster) (cluster_verb_scope_le:apiserver_request_sli_duration_seconds_bucket:increase30d{verb=~"LIST|GET",scope="cluster",le=~"30(\\.0)?"} or vector(0)) ) + # errors sum by (cluster) (code:apiserver_request_total:increase30d{verb="read",code=~"5.."} or vector(0)) ) / sum by (cluster) (code:apiserver_request_total:increase30d{verb="read"}) labels: verb: read record: "apiserver_request:availability30d" - expr: | 1 - ( ( # too slow sum by (cluster) (cluster_verb_scope:apiserver_request_sli_duration_seconds_count:increase30d{verb=~"POST|PUT|PATCH|DELETE"}) - sum by (cluster) (cluster_verb_scope_le:apiserver_request_sli_duration_seconds_bucket:increase30d{verb=~"POST|PUT|PATCH|DELETE",le=~"1(\\.0)?"} or vector(0)) ) + # errors sum by (cluster) (code:apiserver_request_total:increase30d{verb="write",code=~"5.."} or vector(0)) ) / sum by (cluster) (code:apiserver_request_total:increase30d{verb="write"}) labels: verb: write record: "apiserver_request:availability30d" - expr: "sum by (cluster,code,resource) (rate(apiserver_request_total{job=\"apiserver\",verb=~\"LIST|GET\"}[5m]))" labels: verb: read record: "code_resource:apiserver_request_total:rate5m" - expr: "sum by (cluster,code,resource) (rate(apiserver_request_total{job=\"apiserver\",verb=~\"POST|PUT|PATCH|DELETE\"}[5m]))" labels: verb: write record: "code_resource:apiserver_request_total:rate5m" - expr: "sum by (cluster, code, verb) (increase(apiserver_request_total{job=\"apiserver\",verb=~\"LIST|GET|POST|PUT|PATCH|DELETE\",code=~\"2..\"}[1h]))" record: "code_verb:apiserver_request_total:increase1h" - expr: "sum by (cluster, code, verb) (increase(apiserver_request_total{job=\"apiserver\",verb=~\"LIST|GET|POST|PUT|PATCH|DELETE\",code=~\"3..\"}[1h]))" record: "code_verb:apiserver_request_total:increase1h" - expr: "sum by (cluster, code, verb) (increase(apiserver_request_total{job=\"apiserver\",verb=~\"LIST|GET|POST|PUT|PATCH|DELETE\",code=~\"4..\"}[1h]))" record: "code_verb:apiserver_request_total:increase1h" - expr: "sum by (cluster, code, verb) (increase(apiserver_request_total{job=\"apiserver\",verb=~\"LIST|GET|POST|PUT|PATCH|DELETE\",code=~\"5..\"}[1h]))" record: "code_verb:apiserver_request_total:increase1h" (root level) + one document added: apiVersion: monitoring.coreos.com/v1 kind: PrometheusRule metadata: name: kube-prometheus-stack-kube-apiserver-burnrate.rules namespace: monitoring labels: app: kube-prometheus-stack app.kubernetes.io/instance: kube-prometheus-stack app.kubernetes.io/managed-by: Helm app.kubernetes.io/part-of: kube-prometheus-stack helm.toolkit.fluxcd.io/name: kube-prometheus-stack helm.toolkit.fluxcd.io/namespace: flux-system heritage: Helm release: kube-prometheus-stack spec: groups: - name: kube-apiserver-burnrate.rules rules: - expr: | ( ( # too slow sum by (cluster) (rate(apiserver_request_sli_duration_seconds_count{job="apiserver",verb=~"LIST|GET",subresource!~"proxy|attach|log|exec|portforward"}[1d])) - ( ( sum by (cluster) (rate(apiserver_request_sli_duration_seconds_bucket{job="apiserver",verb=~"LIST|GET",subresource!~"proxy|attach|log|exec|portforward",scope=~"resource|",le=~"1(\\.0)?"}[1d])) or vector(0) ) + sum by (cluster) (rate(apiserver_request_sli_duration_seconds_bucket{job="apiserver",verb=~"LIST|GET",subresource!~"proxy|attach|log|exec|portforward",scope="namespace",le=~"5(\\.0)?"}[1d])) + sum by (cluster) (rate(apiserver_request_sli_duration_seconds_bucket{job="apiserver",verb=~"LIST|GET",subresource!~"proxy|attach|log|exec|portforward",scope="cluster",le=~"30(\\.0)?"}[1d])) ) ) + # errors sum by (cluster) (rate(apiserver_request_total{job="apiserver",verb=~"LIST|GET",code=~"5.."}[1d])) ) / sum by (cluster) (rate(apiserver_request_total{job="apiserver",verb=~"LIST|GET"}[1d])) labels: verb: read record: "apiserver_request:burnrate1d" - expr: | ( ( # too slow sum by (cluster) (rate(apiserver_request_sli_duration_seconds_count{job="apiserver",verb=~"LIST|GET",subresource!~"proxy|attach|log|exec|portforward"}[1h])) - ( ( sum by (cluster) (rate(apiserver_request_sli_duration_seconds_bucket{job="apiserver",verb=~"LIST|GET",subresource!~"proxy|attach|log|exec|portforward",scope=~"resource|",le=~"1(\\.0)?"}[1h])) or vector(0) ) + sum by (cluster) (rate(apiserver_request_sli_duration_seconds_bucket{job="apiserver",verb=~"LIST|GET",subresource!~"proxy|attach|log|exec|portforward",scope="namespace",le=~"5(\\.0)?"}[1h])) + sum by (cluster) (rate(apiserver_request_sli_duration_seconds_bucket{job="apiserver",verb=~"LIST|GET",subresource!~"proxy|attach|log|exec|portforward",scope="cluster",le=~"30(\\.0)?"}[1h])) ) ) + # errors sum by (cluster) (rate(apiserver_request_total{job="apiserver",verb=~"LIST|GET",code=~"5.."}[1h])) ) / sum by (cluster) (rate(apiserver_request_total{job="apiserver",verb=~"LIST|GET"}[1h])) labels: verb: read record: "apiserver_request:burnrate1h" - expr: | ( ( # too slow sum by (cluster) (rate(apiserver_request_sli_duration_seconds_count{job="apiserver",verb=~"LIST|GET",subresource!~"proxy|attach|log|exec|portforward"}[2h])) - ( ( sum by (cluster) (rate(apiserver_request_sli_duration_seconds_bucket{job="apiserver",verb=~"LIST|GET",subresource!~"proxy|attach|log|exec|portforward",scope=~"resource|",le=~"1(\\.0)?"}[2h])) or vector(0) ) + sum by (cluster) (rate(apiserver_request_sli_duration_seconds_bucket{job="apiserver",verb=~"LIST|GET",subresource!~"proxy|attach|log|exec|portforward",scope="namespace",le=~"5(\\.0)?"}[2h])) + sum by (cluster) (rate(apiserver_request_sli_duration_seconds_bucket{job="apiserver",verb=~"LIST|GET",subresource!~"proxy|attach|log|exec|portforward",scope="cluster",le=~"30(\\.0)?"}[2h])) ) ) + # errors sum by (cluster) (rate(apiserver_request_total{job="apiserver",verb=~"LIST|GET",code=~"5.."}[2h])) ) / sum by (cluster) (rate(apiserver_request_total{job="apiserver",verb=~"LIST|GET"}[2h])) labels: verb: read record: "apiserver_request:burnrate2h" - expr: | ( ( # too slow sum by (cluster) (rate(apiserver_request_sli_duration_seconds_count{job="apiserver",verb=~"LIST|GET",subresource!~"proxy|attach|log|exec|portforward"}[30m])) - ( ( sum by (cluster) (rate(apiserver_request_sli_duration_seconds_bucket{job="apiserver",verb=~"LIST|GET",subresource!~"proxy|attach|log|exec|portforward",scope=~"resource|",le=~"1(\\.0)?"}[30m])) or vector(0) ) + sum by (cluster) (rate(apiserver_request_sli_duration_seconds_bucket{job="apiserver",verb=~"LIST|GET",subresource!~"proxy|attach|log|exec|portforward",scope="namespace",le=~"5(\\.0)?"}[30m])) + sum by (cluster) (rate(apiserver_request_sli_duration_seconds_bucket{job="apiserver",verb=~"LIST|GET",subresource!~"proxy|attach|log|exec|portforward",scope="cluster",le=~"30(\\.0)?"}[30m])) ) ) + # errors sum by (cluster) (rate(apiserver_request_total{job="apiserver",verb=~"LIST|GET",code=~"5.."}[30m])) ) / sum by (cluster) (rate(apiserver_request_total{job="apiserver",verb=~"LIST|GET"}[30m])) labels: verb: read record: "apiserver_request:burnrate30m" - expr: | ( ( # too slow sum by (cluster) (rate(apiserver_request_sli_duration_seconds_count{job="apiserver",verb=~"LIST|GET",subresource!~"proxy|attach|log|exec|portforward"}[3d])) - ( ( sum by (cluster) (rate(apiserver_request_sli_duration_seconds_bucket{job="apiserver",verb=~"LIST|GET",subresource!~"proxy|attach|log|exec|portforward",scope=~"resource|",le=~"1(\\.0)?"}[3d])) or vector(0) ) + sum by (cluster) (rate(apiserver_request_sli_duration_seconds_bucket{job="apiserver",verb=~"LIST|GET",subresource!~"proxy|attach|log|exec|portforward",scope="namespace",le=~"5(\\.0)?"}[3d])) + sum by (cluster) (rate(apiserver_request_sli_duration_seconds_bucket{job="apiserver",verb=~"LIST|GET",subresource!~"proxy|attach|log|exec|portforward",scope="cluster",le=~"30(\\.0)?"}[3d])) ) ) + # errors sum by (cluster) (rate(apiserver_request_total{job="apiserver",verb=~"LIST|GET",code=~"5.."}[3d])) ) / sum by (cluster) (rate(apiserver_request_total{job="apiserver",verb=~"LIST|GET"}[3d])) labels: verb: read record: "apiserver_request:burnrate3d" - expr: | ( ( # too slow sum by (cluster) (rate(apiserver_request_sli_duration_seconds_count{job="apiserver",verb=~"LIST|GET",subresource!~"proxy|attach|log|exec|portforward"}[5m])) - ( ( sum by (cluster) (rate(apiserver_request_sli_duration_seconds_bucket{job="apiserver",verb=~"LIST|GET",subresource!~"proxy|attach|log|exec|portforward",scope=~"resource|",le=~"1(\\.0)?"}[5m])) or vector(0) ) + sum by (cluster) (rate(apiserver_request_sli_duration_seconds_bucket{job="apiserver",verb=~"LIST|GET",subresource!~"proxy|attach|log|exec|portforward",scope="namespace",le=~"5(\\.0)?"}[5m])) + sum by (cluster) (rate(apiserver_request_sli_duration_seconds_bucket{job="apiserver",verb=~"LIST|GET",subresource!~"proxy|attach|log|exec|portforward",scope="cluster",le=~"30(\\.0)?"}[5m])) ) ) + # errors sum by (cluster) (rate(apiserver_request_total{job="apiserver",verb=~"LIST|GET",code=~"5.."}[5m])) ) / sum by (cluster) (rate(apiserver_request_total{job="apiserver",verb=~"LIST|GET"}[5m])) labels: verb: read record: "apiserver_request:burnrate5m" - expr: | ( ( # too slow sum by (cluster) (rate(apiserver_request_sli_duration_seconds_count{job="apiserver",verb=~"LIST|GET",subresource!~"proxy|attach|log|exec|portforward"}[6h])) - ( ( sum by (cluster) (rate(apiserver_request_sli_duration_seconds_bucket{job="apiserver",verb=~"LIST|GET",subresource!~"proxy|attach|log|exec|portforward",scope=~"resource|",le=~"1(\\.0)?"}[6h])) or vector(0) ) + sum by (cluster) (rate(apiserver_request_sli_duration_seconds_bucket{job="apiserver",verb=~"LIST|GET",subresource!~"proxy|attach|log|exec|portforward",scope="namespace",le=~"5(\\.0)?"}[6h])) + sum by (cluster) (rate(apiserver_request_sli_duration_seconds_bucket{job="apiserver",verb=~"LIST|GET",subresource!~"proxy|attach|log|exec|portforward",scope="cluster",le=~"30(\\.0)?"}[6h])) ) ) + # errors sum by (cluster) (rate(apiserver_request_total{job="apiserver",verb=~"LIST|GET",code=~"5.."}[6h])) ) / sum by (cluster) (rate(apiserver_request_total{job="apiserver",verb=~"LIST|GET"}[6h])) labels: verb: read record: "apiserver_request:burnrate6h" - expr: | ( ( # too slow sum by (cluster) (rate(apiserver_request_sli_duration_seconds_count{job="apiserver",verb=~"POST|PUT|PATCH|DELETE",subresource!~"proxy|attach|log|exec|portforward"}[1d])) - sum by (cluster) (rate(apiserver_request_sli_duration_seconds_bucket{job="apiserver",verb=~"POST|PUT|PATCH|DELETE",subresource!~"proxy|attach|log|exec|portforward",le=~"1(\\.0)?"}[1d])) ) + sum by (cluster) (rate(apiserver_request_total{job="apiserver",verb=~"POST|PUT|PATCH|DELETE",code=~"5.."}[1d])) ) / sum by (cluster) (rate(apiserver_request_total{job="apiserver",verb=~"POST|PUT|PATCH|DELETE"}[1d])) labels: verb: write record: "apiserver_request:burnrate1d" - expr: | ( ( # too slow sum by (cluster) (rate(apiserver_request_sli_duration_seconds_count{job="apiserver",verb=~"POST|PUT|PATCH|DELETE",subresource!~"proxy|attach|log|exec|portforward"}[1h])) - sum by (cluster) (rate(apiserver_request_sli_duration_seconds_bucket{job="apiserver",verb=~"POST|PUT|PATCH|DELETE",subresource!~"proxy|attach|log|exec|portforward",le=~"1(\\.0)?"}[1h])) ) + sum by (cluster) (rate(apiserver_request_total{job="apiserver",verb=~"POST|PUT|PATCH|DELETE",code=~"5.."}[1h])) ) / sum by (cluster) (rate(apiserver_request_total{job="apiserver",verb=~"POST|PUT|PATCH|DELETE"}[1h])) labels: verb: write record: "apiserver_request:burnrate1h" - expr: | ( ( # too slow sum by (cluster) (rate(apiserver_request_sli_duration_seconds_count{job="apiserver",verb=~"POST|PUT|PATCH|DELETE",subresource!~"proxy|attach|log|exec|portforward"}[2h])) - sum by (cluster) (rate(apiserver_request_sli_duration_seconds_bucket{job="apiserver",verb=~"POST|PUT|PATCH|DELETE",subresource!~"proxy|attach|log|exec|portforward",le=~"1(\\.0)?"}[2h])) ) + sum by (cluster) (rate(apiserver_request_total{job="apiserver",verb=~"POST|PUT|PATCH|DELETE",code=~"5.."}[2h])) ) / sum by (cluster) (rate(apiserver_request_total{job="apiserver",verb=~"POST|PUT|PATCH|DELETE"}[2h])) labels: verb: write record: "apiserver_request:burnrate2h" - expr: | ( ( # too slow sum by (cluster) (rate(apiserver_request_sli_duration_seconds_count{job="apiserver",verb=~"POST|PUT|PATCH|DELETE",subresource!~"proxy|attach|log|exec|portforward"}[30m])) - sum by (cluster) (rate(apiserver_request_sli_duration_seconds_bucket{job="apiserver",verb=~"POST|PUT|PATCH|DELETE",subresource!~"proxy|attach|log|exec|portforward",le=~"1(\\.0)?"}[30m])) ) + sum by (cluster) (rate(apiserver_request_total{job="apiserver",verb=~"POST|PUT|PATCH|DELETE",code=~"5.."}[30m])) ) / sum by (cluster) (rate(apiserver_request_total{job="apiserver",verb=~"POST|PUT|PATCH|DELETE"}[30m])) labels: verb: write record: "apiserver_request:burnrate30m" - expr: | ( ( # too slow sum by (cluster) (rate(apiserver_request_sli_duration_seconds_count{job="apiserver",verb=~"POST|PUT|PATCH|DELETE",subresource!~"proxy|attach|log|exec|portforward"}[3d])) - sum by (cluster) (rate(apiserver_request_sli_duration_seconds_bucket{job="apiserver",verb=~"POST|PUT|PATCH|DELETE",subresource!~"proxy|attach|log|exec|portforward",le=~"1(\\.0)?"}[3d])) ) + sum by (cluster) (rate(apiserver_request_total{job="apiserver",verb=~"POST|PUT|PATCH|DELETE",code=~"5.."}[3d])) ) / sum by (cluster) (rate(apiserver_request_total{job="apiserver",verb=~"POST|PUT|PATCH|DELETE"}[3d])) labels: verb: write record: "apiserver_request:burnrate3d" - expr: | ( ( # too slow sum by (cluster) (rate(apiserver_request_sli_duration_seconds_count{job="apiserver",verb=~"POST|PUT|PATCH|DELETE",subresource!~"proxy|attach|log|exec|portforward"}[5m])) - sum by (cluster) (rate(apiserver_request_sli_duration_seconds_bucket{job="apiserver",verb=~"POST|PUT|PATCH|DELETE",subresource!~"proxy|attach|log|exec|portforward",le=~"1(\\.0)?"}[5m])) ) + sum by (cluster) (rate(apiserver_request_total{job="apiserver",verb=~"POST|PUT|PATCH|DELETE",code=~"5.."}[5m])) ) / sum by (cluster) (rate(apiserver_request_total{job="apiserver",verb=~"POST|PUT|PATCH|DELETE"}[5m])) labels: verb: write record: "apiserver_request:burnrate5m" - expr: | ( ( # too slow sum by (cluster) (rate(apiserver_request_sli_duration_seconds_count{job="apiserver",verb=~"POST|PUT|PATCH|DELETE",subresource!~"proxy|attach|log|exec|portforward"}[6h])) - sum by (cluster) (rate(apiserver_request_sli_duration_seconds_bucket{job="apiserver",verb=~"POST|PUT|PATCH|DELETE",subresource!~"proxy|attach|log|exec|portforward",le=~"1(\\.0)?"}[6h])) ) + sum by (cluster) (rate(apiserver_request_total{job="apiserver",verb=~"POST|PUT|PATCH|DELETE",code=~"5.."}[6h])) ) / sum by (cluster) (rate(apiserver_request_total{job="apiserver",verb=~"POST|PUT|PATCH|DELETE"}[6h])) labels: verb: write record: "apiserver_request:burnrate6h" (root level) + one document added: apiVersion: monitoring.coreos.com/v1 kind: PrometheusRule metadata: name: kube-prometheus-stack-kube-apiserver-histogram.rules namespace: monitoring labels: app: kube-prometheus-stack app.kubernetes.io/instance: kube-prometheus-stack app.kubernetes.io/managed-by: Helm app.kubernetes.io/part-of: kube-prometheus-stack helm.toolkit.fluxcd.io/name: kube-prometheus-stack helm.toolkit.fluxcd.io/namespace: flux-system heritage: Helm release: kube-prometheus-stack spec: groups: - name: kube-apiserver-histogram.rules rules: - expr: "histogram_quantile(0.99, sum by (cluster, le, resource) (rate(apiserver_request_sli_duration_seconds_bucket{job=\"apiserver\",verb=~\"LIST|GET\",subresource!~\"proxy|attach|log|exec|portforward\"}[5m]))) > 0" labels: quantile: "0.99" verb: read record: "cluster_quantile:apiserver_request_sli_duration_seconds:histogram_quantile" - expr: "histogram_quantile(0.99, sum by (cluster, le, resource) (rate(apiserver_request_sli_duration_seconds_bucket{job=\"apiserver\",verb=~\"POST|PUT|PATCH|DELETE\",subresource!~\"proxy|attach|log|exec|portforward\"}[5m]))) > 0" labels: quantile: "0.99" verb: write record: "cluster_quantile:apiserver_request_sli_duration_seconds:histogram_quantile" (root level) + one document added: apiVersion: monitoring.coreos.com/v1 kind: PrometheusRule metadata: name: kube-prometheus-stack-kube-apiserver-slos namespace: monitoring labels: app: kube-prometheus-stack app.kubernetes.io/instance: kube-prometheus-stack app.kubernetes.io/managed-by: Helm app.kubernetes.io/part-of: kube-prometheus-stack helm.toolkit.fluxcd.io/name: kube-prometheus-stack helm.toolkit.fluxcd.io/namespace: flux-system heritage: Helm release: kube-prometheus-stack spec: groups: - name: kube-apiserver-slos rules: - alert: KubeAPIErrorBudgetBurn annotations: description: "The Kube API server is burning too much error budget on cluster {{ $labels.cluster }}." runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/kubernetes/kubeapierrorbudgetburn" summary: "The Kube API server is burning too much error budget." expr: | sum by (cluster) (apiserver_request:burnrate1h) > (14.40 * 0.01000) and on (cluster) sum by (cluster) (apiserver_request:burnrate5m) > (14.40 * 0.01000) for: 2m labels: long: 1h severity: critical short: 5m - alert: KubeAPIErrorBudgetBurn annotations: description: "The Kube API server is burning too much error budget on cluster {{ $labels.cluster }}." runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/kubernetes/kubeapierrorbudgetburn" summary: "The Kube API server is burning too much error budget." expr: | sum by (cluster) (apiserver_request:burnrate6h) > (6.00 * 0.01000) and on (cluster) sum by (cluster) (apiserver_request:burnrate30m) > (6.00 * 0.01000) for: 15m labels: long: 6h severity: critical short: 30m - alert: KubeAPIErrorBudgetBurn annotations: description: "The Kube API server is burning too much error budget on cluster {{ $labels.cluster }}." runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/kubernetes/kubeapierrorbudgetburn" summary: "The Kube API server is burning too much error budget." expr: | sum by (cluster) (apiserver_request:burnrate1d) > (3.00 * 0.01000) and on (cluster) sum by (cluster) (apiserver_request:burnrate2h) > (3.00 * 0.01000) for: 1h labels: long: 1d severity: warning short: 2h - alert: KubeAPIErrorBudgetBurn annotations: description: "The Kube API server is burning too much error budget on cluster {{ $labels.cluster }}." runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/kubernetes/kubeapierrorbudgetburn" summary: "The Kube API server is burning too much error budget." expr: | sum by (cluster) (apiserver_request:burnrate3d) > (1.00 * 0.01000) and on (cluster) sum by (cluster) (apiserver_request:burnrate6h) > (1.00 * 0.01000) for: 3h labels: long: 3d severity: warning short: 6h (root level) + one document added: apiVersion: monitoring.coreos.com/v1 kind: PrometheusRule metadata: name: kube-prometheus-stack-kube-prometheus-general.rules namespace: monitoring labels: app: kube-prometheus-stack app.kubernetes.io/instance: kube-prometheus-stack app.kubernetes.io/managed-by: Helm app.kubernetes.io/part-of: kube-prometheus-stack helm.toolkit.fluxcd.io/name: kube-prometheus-stack helm.toolkit.fluxcd.io/namespace: flux-system heritage: Helm release: kube-prometheus-stack spec: groups: - name: kube-prometheus-general.rules rules: - expr: "count without(instance, pod, node) (up == 1)" record: "count:up1" - expr: "count without(instance, pod, node) (up == 0)" record: "count:up0" (root level) + one document added: apiVersion: monitoring.coreos.com/v1 kind: PrometheusRule metadata: name: kube-prometheus-stack-kube-prometheus-node-recording.rules namespace: monitoring labels: app: kube-prometheus-stack app.kubernetes.io/instance: kube-prometheus-stack app.kubernetes.io/managed-by: Helm app.kubernetes.io/part-of: kube-prometheus-stack helm.toolkit.fluxcd.io/name: kube-prometheus-stack helm.toolkit.fluxcd.io/namespace: flux-system heritage: Helm release: kube-prometheus-stack spec: groups: - name: kube-prometheus-node-recording.rules rules: - expr: "sum(rate(node_cpu_seconds_total{mode!=\"idle\",mode!=\"iowait\",mode!=\"steal\"}[3m])) BY (instance)" record: "instance:node_cpu:rate:sum" - expr: "sum(rate(node_network_receive_bytes_total[3m])) BY (instance)" record: "instance:node_network_receive_bytes:rate:sum" - expr: "sum(rate(node_network_transmit_bytes_total[3m])) BY (instance)" record: "instance:node_network_transmit_bytes:rate:sum" - expr: "sum(rate(node_cpu_seconds_total{mode!=\"idle\",mode!=\"iowait\",mode!=\"steal\"}[5m])) WITHOUT (cpu, mode) / ON (instance) GROUP_LEFT() count(sum(node_cpu_seconds_total) BY (instance, cpu)) BY (instance)" record: "instance:node_cpu:ratio" - expr: "sum(rate(node_cpu_seconds_total{mode!=\"idle\",mode!=\"iowait\",mode!=\"steal\"}[5m]))" record: "cluster:node_cpu:sum_rate5m" - expr: "cluster:node_cpu:sum_rate5m / count(sum(node_cpu_seconds_total) BY (instance, cpu))" record: "cluster:node_cpu:ratio" (root level) + one document added: apiVersion: monitoring.coreos.com/v1 kind: PrometheusRule metadata: name: kube-prometheus-stack-kube-scheduler.rules namespace: monitoring labels: app: kube-prometheus-stack app.kubernetes.io/instance: kube-prometheus-stack app.kubernetes.io/managed-by: Helm app.kubernetes.io/part-of: kube-prometheus-stack helm.toolkit.fluxcd.io/name: kube-prometheus-stack helm.toolkit.fluxcd.io/namespace: flux-system heritage: Helm release: kube-prometheus-stack spec: groups: - name: kube-scheduler.rules rules: - expr: "histogram_quantile(0.99, sum(rate(scheduler_scheduling_attempt_duration_seconds_bucket{job=\"kube-scheduler\"}[5m])) without(instance, pod))" labels: quantile: "0.99" record: "cluster_quantile:scheduler_scheduling_attempt_duration_seconds:histogram_quantile" - expr: "histogram_quantile(0.99, sum(rate(scheduler_scheduling_algorithm_duration_seconds_bucket{job=\"kube-scheduler\"}[5m])) without(instance, pod))" labels: quantile: "0.99" record: "cluster_quantile:scheduler_scheduling_algorithm_duration_seconds:histogram_quantile" - expr: "histogram_quantile(0.99, sum(rate(scheduler_pod_scheduling_sli_duration_seconds_bucket{job=\"kube-scheduler\"}[5m])) without(instance, pod))" labels: quantile: "0.99" record: "cluster_quantile:scheduler_pod_scheduling_sli_duration_seconds:histogram_quantile" - expr: "histogram_quantile(0.9, sum(rate(scheduler_scheduling_attempt_duration_seconds_bucket{job=\"kube-scheduler\"}[5m])) without(instance, pod))" labels: quantile: "0.9" record: "cluster_quantile:scheduler_scheduling_attempt_duration_seconds:histogram_quantile" - expr: "histogram_quantile(0.9, sum(rate(scheduler_scheduling_algorithm_duration_seconds_bucket{job=\"kube-scheduler\"}[5m])) without(instance, pod))" labels: quantile: "0.9" record: "cluster_quantile:scheduler_scheduling_algorithm_duration_seconds:histogram_quantile" - expr: "histogram_quantile(0.9, sum(rate(scheduler_pod_scheduling_sli_duration_seconds_bucket{job=\"kube-scheduler\"}[5m])) without(instance, pod))" labels: quantile: "0.9" record: "cluster_quantile:scheduler_pod_scheduling_sli_duration_seconds:histogram_quantile" - expr: "histogram_quantile(0.5, sum(rate(scheduler_scheduling_attempt_duration_seconds_bucket{job=\"kube-scheduler\"}[5m])) without(instance, pod))" labels: quantile: "0.5" record: "cluster_quantile:scheduler_scheduling_attempt_duration_seconds:histogram_quantile" - expr: "histogram_quantile(0.5, sum(rate(scheduler_scheduling_algorithm_duration_seconds_bucket{job=\"kube-scheduler\"}[5m])) without(instance, pod))" labels: quantile: "0.5" record: "cluster_quantile:scheduler_scheduling_algorithm_duration_seconds:histogram_quantile" - expr: "histogram_quantile(0.5, sum(rate(scheduler_pod_scheduling_sli_duration_seconds_bucket{job=\"kube-scheduler\"}[5m])) without(instance, pod))" labels: quantile: "0.5" record: "cluster_quantile:scheduler_pod_scheduling_sli_duration_seconds:histogram_quantile" (root level) + one document added: apiVersion: monitoring.coreos.com/v1 kind: PrometheusRule metadata: name: kube-prometheus-stack-kube-state-metrics namespace: monitoring labels: app: kube-prometheus-stack app.kubernetes.io/instance: kube-prometheus-stack app.kubernetes.io/managed-by: Helm app.kubernetes.io/part-of: kube-prometheus-stack helm.toolkit.fluxcd.io/name: kube-prometheus-stack helm.toolkit.fluxcd.io/namespace: flux-system heritage: Helm release: kube-prometheus-stack spec: groups: - name: kube-state-metrics rules: - alert: KubeStateMetricsListErrors annotations: description: "kube-state-metrics is experiencing errors at an elevated rate in list operations. This is likely causing it to not be able to expose metrics about Kubernetes objects correctly or at all." runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/kube-state-metrics/kubestatemetricslisterrors" summary: "kube-state-metrics is experiencing errors in list operations." expr: | (sum(rate(kube_state_metrics_list_total{job="kube-state-metrics",result="error"}[5m])) by (cluster) / sum(rate(kube_state_metrics_list_total{job="kube-state-metrics"}[5m])) by (cluster)) > 0.01 for: 15m labels: severity: critical - alert: KubeStateMetricsWatchErrors annotations: description: "kube-state-metrics is experiencing errors at an elevated rate in watch operations. This is likely causing it to not be able to expose metrics about Kubernetes objects correctly or at all." runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/kube-state-metrics/kubestatemetricswatcherrors" summary: "kube-state-metrics is experiencing errors in watch operations." expr: | (sum(rate(kube_state_metrics_watch_total{job="kube-state-metrics",result="error"}[5m])) by (cluster) / sum(rate(kube_state_metrics_watch_total{job="kube-state-metrics"}[5m])) by (cluster)) > 0.01 for: 15m labels: severity: critical - alert: KubeStateMetricsShardingMismatch annotations: description: "kube-state-metrics pods are running with different --total-shards configuration, some Kubernetes objects may be exposed multiple times or not exposed at all." runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/kube-state-metrics/kubestatemetricsshardingmismatch" summary: "kube-state-metrics sharding is misconfigured." expr: "stdvar (kube_state_metrics_total_shards{job=\"kube-state-metrics\"}) by (cluster) != 0" for: 15m labels: severity: critical - alert: KubeStateMetricsShardsMissing annotations: description: "kube-state-metrics shards are missing, some Kubernetes objects are not being exposed." runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/kube-state-metrics/kubestatemetricsshardsmissing" summary: "kube-state-metrics shards are missing." expr: | 2^max(kube_state_metrics_total_shards{job="kube-state-metrics"}) by (cluster) - 1 - sum( 2 ^ max by (cluster, shard_ordinal) (kube_state_metrics_shard_ordinal{job="kube-state-metrics"}) ) by (cluster) != 0 for: 15m labels: severity: critical (root level) + one document added: apiVersion: monitoring.coreos.com/v1 kind: PrometheusRule metadata: name: kube-prometheus-stack-kubelet.rules namespace: monitoring labels: app: kube-prometheus-stack app.kubernetes.io/instance: kube-prometheus-stack app.kubernetes.io/managed-by: Helm app.kubernetes.io/part-of: kube-prometheus-stack helm.toolkit.fluxcd.io/name: kube-prometheus-stack helm.toolkit.fluxcd.io/namespace: flux-system heritage: Helm release: kube-prometheus-stack spec: groups: - name: kubelet.rules rules: - expr: | histogram_quantile( 0.99, sum(rate(kubelet_pleg_relist_duration_seconds_bucket{job="kubelet", metrics_path="/metrics"}[5m])) by (cluster, instance, le) * on (cluster, instance) group_left (node) max by (cluster, instance, node) (kubelet_node_name{job="kubelet", metrics_path="/metrics"}) ) labels: quantile: "0.99" record: "node_quantile:kubelet_pleg_relist_duration_seconds:histogram_quantile" - expr: | histogram_quantile( 0.9, sum(rate(kubelet_pleg_relist_duration_seconds_bucket{job="kubelet", metrics_path="/metrics"}[5m])) by (cluster, instance, le) * on (cluster, instance) group_left (node) max by (cluster, instance, node) (kubelet_node_name{job="kubelet", metrics_path="/metrics"}) ) labels: quantile: "0.9" record: "node_quantile:kubelet_pleg_relist_duration_seconds:histogram_quantile" - expr: | histogram_quantile( 0.5, sum(rate(kubelet_pleg_relist_duration_seconds_bucket{job="kubelet", metrics_path="/metrics"}[5m])) by (cluster, instance, le) * on (cluster, instance) group_left (node) max by (cluster, instance, node) (kubelet_node_name{job="kubelet", metrics_path="/metrics"}) ) labels: quantile: "0.5" record: "node_quantile:kubelet_pleg_relist_duration_seconds:histogram_quantile" (root level) + one document added: apiVersion: monitoring.coreos.com/v1 kind: PrometheusRule metadata: name: kube-prometheus-stack-kubernetes-apps namespace: monitoring labels: app: kube-prometheus-stack app.kubernetes.io/instance: kube-prometheus-stack app.kubernetes.io/managed-by: Helm app.kubernetes.io/part-of: kube-prometheus-stack helm.toolkit.fluxcd.io/name: kube-prometheus-stack helm.toolkit.fluxcd.io/namespace: flux-system heritage: Helm release: kube-prometheus-stack spec: groups: - name: kubernetes-apps rules: - alert: KubePodCrashLooping annotations: description: "Pod {{ $labels.namespace }}/{{ $labels.pod }} ({{ $labels.container }}) is in waiting state (reason: \"CrashLoopBackOff\") on cluster {{ $labels.cluster }}." runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/kubernetes/kubepodcrashlooping" summary: "Pod is crash looping." expr: "max_over_time(kube_pod_container_status_waiting_reason{reason=\"CrashLoopBackOff\", job=\"kube-state-metrics\", namespace=~\".*\"}[5m]) >= 1" for: 15m labels: severity: warning - alert: KubePodNotReady annotations: description: "Pod {{ $labels.namespace }}/{{ $labels.pod }} has been in a non-ready state for longer than 15 minutes on cluster {{ $labels.cluster }}." runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/kubernetes/kubepodnotready" summary: "Pod has been in a non-ready state for more than 15 minutes." expr: | sum by (namespace, pod, job, cluster) ( max by (namespace, pod, job, cluster) ( kube_pod_status_phase{job="kube-state-metrics", namespace=~".*", phase=~"Pending|Unknown"} or ( kube_pod_status_phase{job="kube-state-metrics", namespace=~".*", phase="Running"} == 1 and on (namespace, pod, cluster) kube_pod_status_ready{job="kube-state-metrics", namespace=~".*", condition="true"} == 0 ) ) * on (namespace, pod, cluster) group_left() topk by (namespace, pod, cluster) ( 1, max by (namespace, pod, owner_kind, cluster) (kube_pod_owner{owner_kind!="Job"}) ) ) > 0 unless on (namespace, pod, cluster) kube_pod_status_reason{job="kube-state-metrics", namespace=~".*", reason="SchedulingGated"} == 1 for: 15m labels: severity: warning - alert: KubeDeploymentGenerationMismatch annotations: description: "Deployment generation for {{ $labels.namespace }}/{{ $labels.deployment }} does not match, this indicates that the Deployment has failed but has not been rolled back on cluster {{ $labels.cluster }}." runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/kubernetes/kubedeploymentgenerationmismatch" summary: "Deployment generation mismatch due to possible roll-back" expr: | kube_deployment_status_observed_generation{job="kube-state-metrics", namespace=~".*"} != kube_deployment_metadata_generation{job="kube-state-metrics", namespace=~".*"} for: 15m labels: severity: warning - alert: KubeDeploymentReplicasMismatch annotations: description: "Deployment {{ $labels.namespace }}/{{ $labels.deployment }} has not matched the expected number of replicas for longer than 15 minutes on cluster {{ $labels.cluster }}." runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/kubernetes/kubedeploymentreplicasmismatch" summary: "Deployment has not matched the expected number of replicas." expr: | ( kube_deployment_spec_replicas{job="kube-state-metrics", namespace=~".*"} > kube_deployment_status_replicas_available{job="kube-state-metrics", namespace=~".*"} ) and ( changes(kube_deployment_status_replicas_updated{job="kube-state-metrics", namespace=~".*"}[10m]) == 0 ) for: 15m labels: severity: warning - alert: KubeDeploymentRolloutStuck annotations: description: "Rollout of deployment {{ $labels.namespace }}/{{ $labels.deployment }} is not progressing for longer than 15 minutes on cluster {{ $labels.cluster }}." runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/kubernetes/kubedeploymentrolloutstuck" summary: "Deployment rollout is not progressing." expr: | kube_deployment_status_condition{condition="Progressing", status="false",job="kube-state-metrics", namespace=~".*"} != 0 for: 15m labels: severity: warning - alert: KubeStatefulSetReplicasMismatch annotations: description: "StatefulSet {{ $labels.namespace }}/{{ $labels.statefulset }} has not matched the expected number of replicas for longer than 15 minutes on cluster {{ $labels.cluster }}." runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/kubernetes/kubestatefulsetreplicasmismatch" summary: "StatefulSet has not matched the expected number of replicas." expr: | ( kube_statefulset_status_replicas_ready{job="kube-state-metrics", namespace=~".*"} != kube_statefulset_replicas{job="kube-state-metrics", namespace=~".*"} ) and ( changes(kube_statefulset_status_replicas_updated{job="kube-state-metrics", namespace=~".*"}[10m]) == 0 ) for: 15m labels: severity: warning - alert: KubeStatefulSetGenerationMismatch annotations: description: "StatefulSet generation for {{ $labels.namespace }}/{{ $labels.statefulset }} does not match, this indicates that the StatefulSet has failed but has not been rolled back on cluster {{ $labels.cluster }}." runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/kubernetes/kubestatefulsetgenerationmismatch" summary: "StatefulSet generation mismatch due to possible roll-back" expr: | kube_statefulset_status_observed_generation{job="kube-state-metrics", namespace=~".*"} != kube_statefulset_metadata_generation{job="kube-state-metrics", namespace=~".*"} for: 15m labels: severity: warning - alert: KubeStatefulSetUpdateNotRolledOut annotations: description: "StatefulSet {{ $labels.namespace }}/{{ $labels.statefulset }} update has not been rolled out on cluster {{ $labels.cluster }}." runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/kubernetes/kubestatefulsetupdatenotrolledout" summary: "StatefulSet update has not been rolled out." expr: | ( max by (namespace, statefulset, job, cluster) ( kube_statefulset_status_current_revision{job="kube-state-metrics", namespace=~".*"} unless kube_statefulset_status_update_revision{job="kube-state-metrics", namespace=~".*"} ) * on (namespace, statefulset, job, cluster) ( kube_statefulset_replicas{job="kube-state-metrics", namespace=~".*"} != kube_statefulset_status_replicas_updated{job="kube-state-metrics", namespace=~".*"} ) ) and on (namespace, statefulset, job, cluster) ( changes(kube_statefulset_status_replicas_updated{job="kube-state-metrics", namespace=~".*"}[5m]) == 0 ) for: 15m labels: severity: warning - alert: KubeDaemonSetRolloutStuck annotations: description: "DaemonSet {{ $labels.namespace }}/{{ $labels.daemonset }} has not finished or progressed for at least 15m on cluster {{ $labels.cluster }}." runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/kubernetes/kubedaemonsetrolloutstuck" summary: "DaemonSet rollout is stuck." expr: | ( ( kube_daemonset_status_current_number_scheduled{job="kube-state-metrics", namespace=~".*"} != kube_daemonset_status_desired_number_scheduled{job="kube-state-metrics", namespace=~".*"} ) or ( kube_daemonset_status_number_misscheduled{job="kube-state-metrics", namespace=~".*"} != 0 ) or ( kube_daemonset_status_updated_number_scheduled{job="kube-state-metrics", namespace=~".*"} != kube_daemonset_status_desired_number_scheduled{job="kube-state-metrics", namespace=~".*"} ) or ( kube_daemonset_status_number_available{job="kube-state-metrics", namespace=~".*"} != kube_daemonset_status_desired_number_scheduled{job="kube-state-metrics", namespace=~".*"} ) ) and ( changes(kube_daemonset_status_updated_number_scheduled{job="kube-state-metrics", namespace=~".*"}[5m]) == 0 ) for: 15m labels: severity: warning - alert: KubeContainerWaiting annotations: description: "pod/{{ $labels.pod }} in namespace {{ $labels.namespace }} on container {{ $labels.container}} has been in waiting state for longer than 1 hour. (reason: \"{{ $labels.reason }}\") on cluster {{ $labels.cluster }}." runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/kubernetes/kubecontainerwaiting" summary: "Pod container waiting longer than 1 hour" expr: "kube_pod_container_status_waiting_reason{reason!=\"CrashLoopBackOff\", job=\"kube-state-metrics\", namespace=~\".*\"} > 0" for: 1h labels: severity: warning - alert: KubeDaemonSetNotScheduled annotations: description: "{{ $value }} Pods of DaemonSet {{ $labels.namespace }}/{{ $labels.daemonset }} are not scheduled on cluster {{ $labels.cluster }}." runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/kubernetes/kubedaemonsetnotscheduled" summary: "DaemonSet pods are not scheduled." expr: | kube_daemonset_status_desired_number_scheduled{job="kube-state-metrics", namespace=~".*"} - kube_daemonset_status_current_number_scheduled{job="kube-state-metrics", namespace=~".*"} > 0 for: 10m labels: severity: warning - alert: KubeDaemonSetMisScheduled annotations: description: "{{ $value }} Pods of DaemonSet {{ $labels.namespace }}/{{ $labels.daemonset }} are running where they are not supposed to run on cluster {{ $labels.cluster }}." runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/kubernetes/kubedaemonsetmisscheduled" summary: "DaemonSet pods are misscheduled." expr: "kube_daemonset_status_number_misscheduled{job=\"kube-state-metrics\", namespace=~\".*\"} > 0" for: 15m labels: severity: warning - alert: KubeJobNotCompleted annotations: description: "Job {{ $labels.namespace }}/{{ $labels.job_name }} is taking more than {{ \"43200\" | humanizeDuration }} to complete on cluster {{ $labels.cluster }}." runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/kubernetes/kubejobnotcompleted" summary: "Job did not complete in time" expr: | time() - max by (namespace, job_name, cluster) (kube_job_status_start_time{job="kube-state-metrics", namespace=~".*"} and kube_job_status_active{job="kube-state-metrics", namespace=~".*"} > 0) > 43200 labels: severity: warning - alert: KubeJobFailed annotations: description: "Job {{ $labels.namespace }}/{{ $labels.job_name }} failed to complete. Removing failed job after investigation should clear this alert on cluster {{ $labels.cluster }}." runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/kubernetes/kubejobfailed" summary: "Job failed to complete." expr: "kube_job_failed{job=\"kube-state-metrics\", namespace=~\".*\"} > 0" for: 15m labels: severity: warning - alert: KubeHpaReplicasMismatch annotations: description: "HPA {{ $labels.namespace }}/{{ $labels.horizontalpodautoscaler }} has not matched the desired number of replicas for longer than 15 minutes on cluster {{ $labels.cluster }}." runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/kubernetes/kubehpareplicasmismatch" summary: "HPA has not matched desired number of replicas." expr: | (kube_horizontalpodautoscaler_status_desired_replicas{job="kube-state-metrics", namespace=~".*"} != kube_horizontalpodautoscaler_status_current_replicas{job="kube-state-metrics", namespace=~".*"}) and (kube_horizontalpodautoscaler_status_current_replicas{job="kube-state-metrics", namespace=~".*"} > kube_horizontalpodautoscaler_spec_min_replicas{job="kube-state-metrics", namespace=~".*"}) and (kube_horizontalpodautoscaler_status_current_replicas{job="kube-state-metrics", namespace=~".*"} < kube_horizontalpodautoscaler_spec_max_replicas{job="kube-state-metrics", namespace=~".*"}) and changes(kube_horizontalpodautoscaler_status_current_replicas{job="kube-state-metrics", namespace=~".*"}[15m]) == 0 for: 15m labels: severity: warning - alert: KubeHpaMaxedOut annotations: description: "HPA {{ $labels.namespace }}/{{ $labels.horizontalpodautoscaler }} has been running at max replicas for longer than 15 minutes on cluster {{ $labels.cluster }}." runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/kubernetes/kubehpamaxedout" summary: "HPA is running at max replicas" expr: | ( kube_horizontalpodautoscaler_status_current_replicas{job="kube-state-metrics", namespace=~".*"} == kube_horizontalpodautoscaler_spec_max_replicas{job="kube-state-metrics", namespace=~".*"} ) and on (namespace, horizontalpodautoscaler, cluster) ( kube_horizontalpodautoscaler_spec_max_replicas{job="kube-state-metrics", namespace=~".*"} != kube_horizontalpodautoscaler_spec_min_replicas{job="kube-state-metrics", namespace=~".*"} ) for: 15m labels: severity: warning - alert: KubePdbNotEnoughHealthyPods annotations: description: "PDB {{ $labels.cluster }}/{{ $labels.namespace }}/{{ $labels.poddisruptionbudget }} expects {{ $value }} more healthy pods. The desired number of healthy pods has not been met for at least 15m." runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/kubernetes/kubepdbnotenoughhealthypods" summary: "PDB does not have enough healthy pods." expr: | ( kube_poddisruptionbudget_status_desired_healthy{job="kube-state-metrics", namespace=~".*"} - kube_poddisruptionbudget_status_current_healthy{job="kube-state-metrics", namespace=~".*"} ) > 0 for: 15m labels: severity: warning (root level) + one document added: apiVersion: monitoring.coreos.com/v1 kind: PrometheusRule metadata: name: kube-prometheus-stack-kubernetes-resources namespace: monitoring labels: app: kube-prometheus-stack app.kubernetes.io/instance: kube-prometheus-stack app.kubernetes.io/managed-by: Helm app.kubernetes.io/part-of: kube-prometheus-stack helm.toolkit.fluxcd.io/name: kube-prometheus-stack helm.toolkit.fluxcd.io/namespace: flux-system heritage: Helm release: kube-prometheus-stack spec: groups: - name: kubernetes-resources rules: - alert: KubeCPUOvercommit annotations: description: "Cluster {{ $labels.cluster }} has overcommitted CPU resource requests for Pods by {{ printf \"%.2f\" $value }} CPU shares and cannot tolerate node failure." runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/kubernetes/kubecpuovercommit" summary: "Cluster has overcommitted CPU resource requests." expr: | # Non-HA clusters. ( ( sum by (cluster) (namespace_cpu:kube_pod_container_resource_requests:sum{}) - sum by (cluster) (kube_node_status_allocatable{job="kube-state-metrics",resource="cpu"}) > 0 ) and count by (cluster) (max by (cluster, node) (kube_node_role{job="kube-state-metrics", role="control-plane"})) < 3 ) or # HA clusters. ( sum by (cluster) (namespace_cpu:kube_pod_container_resource_requests:sum{}) - ( # Skip clusters with only one allocatable node. ( sum by (cluster) (kube_node_status_allocatable{job="kube-state-metrics",resource="cpu"}) - max by (cluster) (kube_node_status_allocatable{job="kube-state-metrics",resource="cpu"}) ) > 0 ) > 0 ) for: 10m labels: severity: warning - alert: KubeMemoryOvercommit annotations: description: "Cluster {{ $labels.cluster }} has overcommitted memory resource requests for Pods by {{ $value | humanize }} bytes and cannot tolerate node failure." runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/kubernetes/kubememoryovercommit" summary: "Cluster has overcommitted memory resource requests." expr: | # Non-HA clusters. ( ( sum by (cluster) (namespace_memory:kube_pod_container_resource_requests:sum{}) - sum by (cluster) (kube_node_status_allocatable{job="kube-state-metrics",resource="memory"}) > 0 ) and count by (cluster) (max by (cluster, node) (kube_node_role{job="kube-state-metrics", role="control-plane"})) < 3 ) or # HA clusters. ( sum by (cluster) (namespace_memory:kube_pod_container_resource_requests:sum{}) - ( # Skip clusters with only one allocatable node. ( sum by (cluster) (kube_node_status_allocatable{job="kube-state-metrics",resource="memory"}) - max by (cluster) (kube_node_status_allocatable{job="kube-state-metrics",resource="memory"}) ) > 0 ) > 0 ) for: 10m labels: severity: warning - alert: KubeCPUQuotaOvercommit annotations: description: "Cluster {{ $labels.cluster }} has overcommitted CPU resource requests for Namespaces." runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/kubernetes/kubecpuquotaovercommit" summary: "Cluster has overcommitted CPU resource requests." expr: | sum by (cluster) ( min without(resource) (kube_resourcequota{job="kube-state-metrics", type="hard", resource=~"(cpu|requests.cpu)"}) ) / sum by (cluster) ( kube_node_status_allocatable{resource="cpu", job="kube-state-metrics"} ) > 1.5 for: 5m labels: severity: warning - alert: KubeMemoryQuotaOvercommit annotations: description: "Cluster {{ $labels.cluster }} has overcommitted memory resource requests for Namespaces." runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/kubernetes/kubememoryquotaovercommit" summary: "Cluster has overcommitted memory resource requests." expr: | sum by (cluster) ( min without(resource) (kube_resourcequota{job="kube-state-metrics", type="hard", resource=~"(memory|requests.memory)"}) ) / sum by (cluster) ( kube_node_status_allocatable{resource="memory", job="kube-state-metrics"} ) > 1.5 for: 5m labels: severity: warning - alert: KubeQuotaAlmostFull annotations: description: "Namespace {{ $labels.namespace }} is using {{ $value | humanizePercentage }} of its {{ $labels.resource }} quota on cluster {{ $labels.cluster }}." runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/kubernetes/kubequotaalmostfull" summary: "Namespace quota is going to be full." expr: | topk by (cluster, namespace, resource, resourcequota) (1, max without (instance, job, type) ( kube_resourcequota{job="kube-state-metrics", type="used"} ) ) / on (cluster, namespace, resource, resourcequota) group_left() topk by (cluster, namespace, resource, resourcequota) (1, max without (instance, job, type) ( kube_resourcequota{job="kube-state-metrics", type="hard"} ) > 0 ) > 0.9 < 1 for: 15m labels: severity: info - alert: KubeQuotaFullyUsed annotations: description: "Namespace {{ $labels.namespace }} is using {{ $value | humanizePercentage }} of its {{ $labels.resource }} quota on cluster {{ $labels.cluster }}." runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/kubernetes/kubequotafullyused" summary: "Namespace quota is fully used." expr: | topk by (cluster, namespace, resource, resourcequota) (1, max without (instance, job, type) ( kube_resourcequota{job="kube-state-metrics", type="used"} ) ) / on (cluster, namespace, resource, resourcequota) group_left() topk by (cluster, namespace, resource, resourcequota) (1, max without (instance, job, type) ( kube_resourcequota{job="kube-state-metrics", type="hard"} ) > 0 ) == 1 for: 15m labels: severity: info - alert: KubeQuotaExceeded annotations: description: "Namespace {{ $labels.namespace }} is using {{ $value | humanizePercentage }} of its {{ $labels.resource }} quota on cluster {{ $labels.cluster }}." runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/kubernetes/kubequotaexceeded" summary: "Namespace quota has exceeded the limits." expr: | topk by (cluster, namespace, resource, resourcequota) (1, max without (instance, job, type) ( kube_resourcequota{job="kube-state-metrics", type="used"} ) ) / on (cluster, namespace, resource, resourcequota) group_left() topk by (cluster, namespace, resource, resourcequota) (1, max without (instance, job, type) ( kube_resourcequota{job="kube-state-metrics", type="hard"} ) > 0 ) > 1 for: 15m labels: severity: warning - alert: CPUThrottlingHigh annotations: description: "{{ $value | humanizePercentage }} throttling of CPU in namespace {{ $labels.namespace }} for container {{ $labels.container }} in pod {{ $labels.pod }} on cluster {{ $labels.cluster }}." runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/kubernetes/cputhrottlinghigh" summary: "Processes experience elevated CPU throttling." expr: | sum without (id, metrics_path, name, image, endpoint, job, node) ( topk by (cluster, namespace, pod, container, instance) (1, increase( container_cpu_cfs_throttled_periods_total{container!="", job="kubelet", metrics_path="/metrics/cadvisor", } [5m]) ) ) / on (cluster, namespace, pod, container, instance) group_left sum without (id, metrics_path, name, image, endpoint, job, node) ( topk by (cluster, namespace, pod, container, instance) (1, increase( container_cpu_cfs_periods_total{job="kubelet", metrics_path="/metrics/cadvisor", } [5m]) ) ) > ( 25 / 100 ) for: 15m labels: severity: info (root level) + one document added: apiVersion: monitoring.coreos.com/v1 kind: PrometheusRule metadata: name: kube-prometheus-stack-kubernetes-storage namespace: monitoring labels: app: kube-prometheus-stack app.kubernetes.io/instance: kube-prometheus-stack app.kubernetes.io/managed-by: Helm app.kubernetes.io/part-of: kube-prometheus-stack helm.toolkit.fluxcd.io/name: kube-prometheus-stack helm.toolkit.fluxcd.io/namespace: flux-system heritage: Helm release: kube-prometheus-stack spec: groups: - name: kubernetes-storage rules: - alert: KubePersistentVolumeFillingUp annotations: description: "The PersistentVolume claimed by {{ $labels.persistentvolumeclaim }} in Namespace {{ $labels.namespace }} {{ with $labels.cluster -}} on Cluster {{ . }} {{- end }} is only {{ $value | humanizePercentage }} free." runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/kubernetes/kubepersistentvolumefillingup" summary: "PersistentVolume is filling up." expr: | ( kubelet_volume_stats_available_bytes{job="kubelet", namespace=~".*", metrics_path="/metrics"} / kubelet_volume_stats_capacity_bytes{job="kubelet", namespace=~".*", metrics_path="/metrics"} ) < 0.03 and kubelet_volume_stats_used_bytes{job="kubelet", namespace=~".*", metrics_path="/metrics"} > 0 unless on (cluster, namespace, persistentvolumeclaim) kube_persistentvolumeclaim_access_mode{ access_mode="ReadOnlyMany"} == 1 unless on (cluster, namespace, persistentvolumeclaim) kube_persistentvolumeclaim_labels{label_excluded_from_alerts="true"} == 1 for: 1m labels: severity: critical - alert: KubePersistentVolumeFillingUp annotations: description: "Based on recent sampling, the PersistentVolume claimed by {{ $labels.persistentvolumeclaim }} in Namespace {{ $labels.namespace }} {{ with $labels.cluster -}} on Cluster {{ . }} {{- end }} is expected to fill up within four days. Currently {{ $value | humanizePercentage }} is available." runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/kubernetes/kubepersistentvolumefillingup" summary: "PersistentVolume is filling up." expr: | ( kubelet_volume_stats_available_bytes{job="kubelet", namespace=~".*", metrics_path="/metrics"} / kubelet_volume_stats_capacity_bytes{job="kubelet", namespace=~".*", metrics_path="/metrics"} ) < 0.15 and kubelet_volume_stats_used_bytes{job="kubelet", namespace=~".*", metrics_path="/metrics"} > 0 and predict_linear(kubelet_volume_stats_available_bytes{job="kubelet", namespace=~".*", metrics_path="/metrics"}[6h], 4 * 24 * 3600) < 0 unless on (cluster, namespace, persistentvolumeclaim) kube_persistentvolumeclaim_access_mode{ access_mode="ReadOnlyMany"} == 1 unless on (cluster, namespace, persistentvolumeclaim) kube_persistentvolumeclaim_labels{label_excluded_from_alerts="true"} == 1 for: 1h labels: severity: warning - alert: KubePersistentVolumeInodesFillingUp annotations: description: "The PersistentVolume claimed by {{ $labels.persistentvolumeclaim }} in Namespace {{ $labels.namespace }} {{ with $labels.cluster -}} on Cluster {{ . }} {{- end }} only has {{ $value | humanizePercentage }} free inodes." runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/kubernetes/kubepersistentvolumeinodesfillingup" summary: "PersistentVolumeInodes are filling up." expr: | ( kubelet_volume_stats_inodes_free{job="kubelet", namespace=~".*", metrics_path="/metrics"} / kubelet_volume_stats_inodes{job="kubelet", namespace=~".*", metrics_path="/metrics"} ) < 0.03 and kubelet_volume_stats_inodes_used{job="kubelet", namespace=~".*", metrics_path="/metrics"} > 0 unless on (cluster, namespace, persistentvolumeclaim) kube_persistentvolumeclaim_access_mode{ access_mode="ReadOnlyMany"} == 1 unless on (cluster, namespace, persistentvolumeclaim) kube_persistentvolumeclaim_labels{label_excluded_from_alerts="true"} == 1 for: 1m labels: severity: critical - alert: KubePersistentVolumeInodesFillingUp annotations: description: "Based on recent sampling, the PersistentVolume claimed by {{ $labels.persistentvolumeclaim }} in Namespace {{ $labels.namespace }} {{ with $labels.cluster -}} on Cluster {{ . }} {{- end }} is expected to run out of inodes within four days. Currently {{ $value | humanizePercentage }} of its inodes are free." runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/kubernetes/kubepersistentvolumeinodesfillingup" summary: "PersistentVolumeInodes are filling up." expr: | ( kubelet_volume_stats_inodes_free{job="kubelet", namespace=~".*", metrics_path="/metrics"} / kubelet_volume_stats_inodes{job="kubelet", namespace=~".*", metrics_path="/metrics"} ) < 0.15 and kubelet_volume_stats_inodes_used{job="kubelet", namespace=~".*", metrics_path="/metrics"} > 0 and predict_linear(kubelet_volume_stats_inodes_free{job="kubelet", namespace=~".*", metrics_path="/metrics"}[6h], 4 * 24 * 3600) < 0 unless on (cluster, namespace, persistentvolumeclaim) kube_persistentvolumeclaim_access_mode{ access_mode="ReadOnlyMany"} == 1 unless on (cluster, namespace, persistentvolumeclaim) kube_persistentvolumeclaim_labels{label_excluded_from_alerts="true"} == 1 for: 1h labels: severity: warning - alert: KubePersistentVolumeErrors annotations: description: "The persistent volume {{ $labels.persistentvolume }} {{ with $labels.cluster -}} on Cluster {{ . }} {{- end }} has status {{ $labels.phase }}." runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/kubernetes/kubepersistentvolumeerrors" summary: "PersistentVolume is having issues with provisioning." expr: "kube_persistentvolume_status_phase{phase=~\"Failed|Pending\",job=\"kube-state-metrics\"} > 0" for: 5m labels: severity: critical (root level) + one document added: apiVersion: monitoring.coreos.com/v1 kind: PrometheusRule metadata: name: kube-prometheus-stack-kubernetes-system-apiserver namespace: monitoring labels: app: kube-prometheus-stack app.kubernetes.io/instance: kube-prometheus-stack app.kubernetes.io/managed-by: Helm app.kubernetes.io/part-of: kube-prometheus-stack helm.toolkit.fluxcd.io/name: kube-prometheus-stack helm.toolkit.fluxcd.io/namespace: flux-system heritage: Helm release: kube-prometheus-stack spec: groups: - name: kubernetes-system-apiserver rules: - alert: KubeClientCertificateExpiration annotations: description: "A client certificate used to authenticate to kubernetes apiserver is expiring in less than 7.0 days on cluster {{ $labels.cluster }}." runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/kubernetes/kubeclientcertificateexpiration" summary: "Client certificate is about to expire." expr: | histogram_quantile(0.01, sum without (namespace, service, endpoint) (rate(apiserver_client_certificate_expiration_seconds_bucket{job="apiserver"}[5m]))) < 604800 and on (job, cluster, instance) apiserver_client_certificate_expiration_seconds_count{job="apiserver"} > 0 for: 5m labels: severity: warning - alert: KubeClientCertificateExpiration annotations: description: "A client certificate used to authenticate to kubernetes apiserver is expiring in less than 24.0 hours on cluster {{ $labels.cluster }}." runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/kubernetes/kubeclientcertificateexpiration" summary: "Client certificate is about to expire." expr: | histogram_quantile(0.01, sum without (namespace, service, endpoint) (rate(apiserver_client_certificate_expiration_seconds_bucket{job="apiserver"}[5m]))) < 86400 and on (job, cluster, instance) apiserver_client_certificate_expiration_seconds_count{job="apiserver"} > 0 for: 5m labels: severity: critical - alert: KubeAggregatedAPIErrors annotations: description: "Kubernetes aggregated API {{ $labels.instance }}/{{ $labels.name }} has reported {{ $labels.reason }} errors on cluster {{ $labels.cluster }}." runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/kubernetes/kubeaggregatedapierrors" summary: "Kubernetes aggregated API has reported errors." expr: "sum by (cluster, instance, name, reason)(increase(aggregator_unavailable_apiservice_total{job=\"apiserver\"}[1m])) > 0" for: 10m labels: severity: warning - alert: KubeAggregatedAPIDown annotations: description: "Kubernetes aggregated API {{ $labels.name }}/{{ $labels.namespace }} has been only {{ $value | humanize }}% available over the last 10m on cluster {{ $labels.cluster }}." runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/kubernetes/kubeaggregatedapidown" summary: "Kubernetes aggregated API is down." expr: "(1 - max by (name, namespace, cluster)(avg_over_time(aggregator_unavailable_apiservice{job=\"apiserver\"}[10m]))) * 100 < 85" for: 5m labels: severity: warning - alert: KubeAPIDown annotations: description: "KubeAPI has disappeared from Prometheus target discovery." runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/kubernetes/kubeapidown" summary: "Target disappeared from Prometheus target discovery." expr: absent(up{job="apiserver"}) for: 15m labels: severity: critical - alert: KubeAPIInstanceUnreachable annotations: description: "A KubeAPI instance has been unreachable for more than 15 minutes." runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/kubernetes/kubeapiinstanceunreachable" summary: "KubeAPI instance is unreachable." expr: "up{job=\"apiserver\"} == 0" for: 15m labels: severity: warning - alert: KubeAPITerminatedRequests annotations: description: "The kubernetes apiserver has terminated {{ $value | humanizePercentage }} of its incoming requests on cluster {{ $labels.cluster }}." runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/kubernetes/kubeapiterminatedrequests" summary: "The kubernetes apiserver has terminated {{ $value | humanizePercentage }} of its incoming requests." expr: "sum by (cluster) (rate(apiserver_request_terminations_total{job=\"apiserver\"}[10m])) / ( sum by (cluster) (rate(apiserver_request_total{job=\"apiserver\"}[10m])) + sum by (cluster) (rate(apiserver_request_terminations_total{job=\"apiserver\"}[10m])) ) > 0.20" for: 5m labels: severity: warning (root level) + one document added: apiVersion: monitoring.coreos.com/v1 kind: PrometheusRule metadata: name: kube-prometheus-stack-kubernetes-system-controller-manager namespace: monitoring labels: app: kube-prometheus-stack app.kubernetes.io/instance: kube-prometheus-stack app.kubernetes.io/managed-by: Helm app.kubernetes.io/part-of: kube-prometheus-stack helm.toolkit.fluxcd.io/name: kube-prometheus-stack helm.toolkit.fluxcd.io/namespace: flux-system heritage: Helm release: kube-prometheus-stack spec: groups: - name: kubernetes-system-controller-manager rules: - alert: KubeControllerManagerDown annotations: description: "KubeControllerManager has disappeared from Prometheus target discovery." runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/kubernetes/kubecontrollermanagerdown" summary: "Target disappeared from Prometheus target discovery." expr: absent(up{job="kube-controller-manager"}) for: 15m labels: severity: critical - alert: KubeControllerManagerInstanceUnreachable annotations: description: "A KubeControllerManager instance has been unreachable for more than 15 minutes." runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/kubernetes/kubecontrollermanagerinstanceunreachable" summary: "KubeControllerManager instance is unreachable." expr: "up{job=\"kube-controller-manager\"} == 0" for: 15m labels: severity: warning (root level) + one document added: apiVersion: monitoring.coreos.com/v1 kind: PrometheusRule metadata: name: kube-prometheus-stack-kubernetes-system-kubelet namespace: monitoring labels: app: kube-prometheus-stack app.kubernetes.io/instance: kube-prometheus-stack app.kubernetes.io/managed-by: Helm app.kubernetes.io/part-of: kube-prometheus-stack helm.toolkit.fluxcd.io/name: kube-prometheus-stack helm.toolkit.fluxcd.io/namespace: flux-system heritage: Helm release: kube-prometheus-stack spec: groups: - name: kubernetes-system-kubelet rules: - alert: KubeNodeNotReady annotations: description: "{{ $labels.node }} has been unready for more than 15 minutes on cluster {{ $labels.cluster }}." runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/kubernetes/kubenodenotready" summary: "Node is not ready." expr: | kube_node_status_condition{job="kube-state-metrics",condition="Ready",status="true"} == 0 and on (cluster, node) kube_node_spec_unschedulable{job="kube-state-metrics"} == 0 for: 15m labels: severity: warning - alert: KubeNodePressure annotations: description: "{{ $labels.node }} on cluster {{ $labels.cluster }} has active Condition {{ $labels.condition }}. This is caused by resource usage exceeding eviction thresholds." runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/kubernetes/kubenodepressure" summary: "Node has as active Condition." expr: | kube_node_status_condition{job="kube-state-metrics",condition=~"(MemoryPressure|DiskPressure|PIDPressure)",status="true"} == 1 and on (cluster, node) kube_node_spec_unschedulable{job="kube-state-metrics"} == 0 for: 10m labels: severity: info - alert: KubeNodeUnreachable annotations: description: "{{ $labels.node }} is unreachable and some workloads may be rescheduled on cluster {{ $labels.cluster }}." runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/kubernetes/kubenodeunreachable" summary: "Node is unreachable." expr: "(kube_node_spec_taint{job=\"kube-state-metrics\",key=\"node.kubernetes.io/unreachable\",effect=\"NoSchedule\"} unless ignoring(key,value) kube_node_spec_taint{job=\"kube-state-metrics\",key=~\"ToBeDeletedByClusterAutoscaler|cloud.google.com/impending-node-termination|aws-node-termination-handler/spot-itn\"}) == 1" for: 15m labels: severity: warning - alert: KubeletTooManyPods annotations: description: "Kubelet '{{ $labels.node }}' is running at {{ $value | humanizePercentage }} of its Pod capacity on cluster {{ $labels.cluster }}." runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/kubernetes/kubelettoomanypods" summary: "Kubelet is running at capacity." expr: | ( max by (cluster, instance) ( kubelet_running_pods{job="kubelet", metrics_path="/metrics"} > 1 ) * on (cluster, instance) group_left(node) max by (cluster, instance, node) ( kubelet_node_name{job="kubelet", metrics_path="/metrics"} ) ) / on (cluster, node) group_left() max by (cluster, node) ( kube_node_status_capacity{job="kube-state-metrics", resource="pods"} != 1 ) > 0.95 for: 15m labels: severity: info - alert: KubeNodeReadinessFlapping annotations: description: "The readiness status of node {{ $labels.node }} has changed {{ $value }} times in the last 15 minutes on cluster {{ $labels.cluster }}." runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/kubernetes/kubenodereadinessflapping" summary: "Node readiness status is flapping." expr: | sum(changes(kube_node_status_condition{job="kube-state-metrics",status="true",condition="Ready"}[15m])) by (cluster, node) > 2 and on (cluster, node) kube_node_spec_unschedulable{job="kube-state-metrics"} == 0 for: 15m labels: severity: warning - alert: KubeNodeEviction annotations: description: "Node {{ $labels.node }} on {{ $labels.cluster }} is evicting Pods due to {{ $labels.eviction_signal }}. Eviction occurs when eviction thresholds are crossed, typically caused by Pods exceeding RAM/ephemeral-storage limits." runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/kubernetes/kubenodeeviction" summary: "Node is evicting pods." expr: | sum(rate(kubelet_evictions{job="kubelet", metrics_path="/metrics"}[15m])) by (cluster, eviction_signal, instance) * on (cluster, instance) group_left(node) max by (cluster, instance, node) ( kubelet_node_name{job="kubelet", metrics_path="/metrics"} ) > 0 for: 0s labels: severity: info - alert: KubeletPlegDurationHigh annotations: description: "The Kubelet Pod Lifecycle Event Generator has a 99th percentile duration of {{ $value }} seconds on node {{ $labels.node }} on cluster {{ $labels.cluster }}." runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/kubernetes/kubeletplegdurationhigh" summary: "Kubelet Pod Lifecycle Event Generator is taking too long to relist." expr: "node_quantile:kubelet_pleg_relist_duration_seconds:histogram_quantile{quantile=\"0.99\"} >= 10" for: 5m labels: severity: warning - alert: KubeletPodStartUpLatencyHigh annotations: description: "Kubelet Pod startup 99th percentile latency is {{ $value }} seconds on node {{ $labels.node }} on cluster {{ $labels.cluster }}." runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/kubernetes/kubeletpodstartuplatencyhigh" summary: "Kubelet Pod startup latency is too high." expr: | histogram_quantile(0.99, sum by (cluster, instance, le) ( topk by (cluster, instance, le, operation_type) (1, rate(kubelet_pod_worker_duration_seconds_bucket{job="kubelet", metrics_path="/metrics"}[5m]) ) ) ) * on (cluster, instance) group_left(node) topk by (cluster, instance, node) (1, kubelet_node_name{job="kubelet", metrics_path="/metrics"} ) > 60 for: 15m labels: severity: warning - alert: KubeletClientCertificateExpiration annotations: description: "Client certificate for Kubelet on node {{ $labels.node }} expires in {{ $value | humanizeDuration }} on cluster {{ $labels.cluster }}." runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/kubernetes/kubeletclientcertificateexpiration" summary: "Kubelet client certificate is about to expire." expr: "kubelet_certificate_manager_client_ttl_seconds < 604800" labels: severity: warning - alert: KubeletClientCertificateExpiration annotations: description: "Client certificate for Kubelet on node {{ $labels.node }} expires in {{ $value | humanizeDuration }} on cluster {{ $labels.cluster }}." runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/kubernetes/kubeletclientcertificateexpiration" summary: "Kubelet client certificate is about to expire." expr: "kubelet_certificate_manager_client_ttl_seconds < 86400" labels: severity: critical - alert: KubeletServerCertificateExpiration annotations: description: "Server certificate for Kubelet on node {{ $labels.node }} expires in {{ $value | humanizeDuration }} on cluster {{ $labels.cluster }}." runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/kubernetes/kubeletservercertificateexpiration" summary: "Kubelet server certificate is about to expire." expr: "kubelet_certificate_manager_server_ttl_seconds < 604800" labels: severity: warning - alert: KubeletServerCertificateExpiration annotations: description: "Server certificate for Kubelet on node {{ $labels.node }} expires in {{ $value | humanizeDuration }} on cluster {{ $labels.cluster }}." runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/kubernetes/kubeletservercertificateexpiration" summary: "Kubelet server certificate is about to expire." expr: "kubelet_certificate_manager_server_ttl_seconds < 86400" labels: severity: critical - alert: KubeletClientCertificateRenewalErrors annotations: description: "Kubelet on node {{ $labels.node }} has failed to renew its client certificate ({{ $value | humanize }} errors in the last 5 minutes) on cluster {{ $labels.cluster }}." runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/kubernetes/kubeletclientcertificaterenewalerrors" summary: "Kubelet has failed to renew its client certificate." expr: "increase(kubelet_certificate_manager_client_expiration_renew_errors[5m]) > 0" for: 15m labels: severity: warning - alert: KubeletServerCertificateRenewalErrors annotations: description: "Kubelet on node {{ $labels.node }} has failed to renew its server certificate ({{ $value | humanize }} errors in the last 5 minutes) on cluster {{ $labels.cluster }}." runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/kubernetes/kubeletservercertificaterenewalerrors" summary: "Kubelet has failed to renew its server certificate." expr: "increase(kubelet_server_expiration_renew_errors[5m]) > 0" for: 15m labels: severity: warning - alert: KubeletInstanceUnreachable annotations: description: "A Kubelet instance has been unreachable for more than 15 minutes." runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/kubernetes/kubeletinstanceunreachable" summary: "Kubelet instance is unreachable." expr: "up{job=\"kubelet\", metrics_path=\"/metrics\"} == 0" for: 15m labels: severity: warning - alert: KubeletDown annotations: description: "Kubelet has disappeared from Prometheus target discovery on cluster {{ $labels.cluster }}." runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/kubernetes/kubeletdown" summary: "Target disappeared from Prometheus target discovery." expr: | count by (cluster) (kube_node_info{job="kube-state-metrics"}) unless on (cluster) count by (cluster) (up{job="kubelet", metrics_path="/metrics"} == 1) for: 15m labels: severity: critical (root level) + one document added: apiVersion: monitoring.coreos.com/v1 kind: PrometheusRule metadata: name: kube-prometheus-stack-kubernetes-system-scheduler namespace: monitoring labels: app: kube-prometheus-stack app.kubernetes.io/instance: kube-prometheus-stack app.kubernetes.io/managed-by: Helm app.kubernetes.io/part-of: kube-prometheus-stack helm.toolkit.fluxcd.io/name: kube-prometheus-stack helm.toolkit.fluxcd.io/namespace: flux-system heritage: Helm release: kube-prometheus-stack spec: groups: - name: kubernetes-system-scheduler rules: - alert: KubeSchedulerDown annotations: description: "KubeScheduler has disappeared from Prometheus target discovery." runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/kubernetes/kubeschedulerdown" summary: "Target disappeared from Prometheus target discovery." expr: absent(up{job="kube-scheduler"}) for: 15m labels: severity: critical - alert: KubeSchedulerInstanceUnreachable annotations: description: "A KubeScheduler instance has been unreachable for more than 15 minutes." runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/kubernetes/kubeschedulerinstanceunreachable" summary: "KubeScheduler instance is unreachable." expr: "up{job=\"kube-scheduler\"} == 0" for: 15m labels: severity: warning (root level) + one document added: apiVersion: monitoring.coreos.com/v1 kind: PrometheusRule metadata: name: kube-prometheus-stack-kubernetes-system namespace: monitoring labels: app: kube-prometheus-stack app.kubernetes.io/instance: kube-prometheus-stack app.kubernetes.io/managed-by: Helm app.kubernetes.io/part-of: kube-prometheus-stack helm.toolkit.fluxcd.io/name: kube-prometheus-stack helm.toolkit.fluxcd.io/namespace: flux-system heritage: Helm release: kube-prometheus-stack spec: groups: - name: kubernetes-system rules: - alert: KubeVersionMismatch annotations: description: "There are {{ $value }} different semantic versions of Kubernetes components running on cluster {{ $labels.cluster }}." runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/kubernetes/kubeversionmismatch" summary: "Different semantic versions of Kubernetes components running." expr: "count by (cluster) (count by (git_version, cluster) (label_replace(kubernetes_build_info{job!~\"kube-dns|coredns\"},\"git_version\",\"$1\",\"git_version\",\"(v[0-9]*.[0-9]*).*\"))) > 1" for: 15m labels: severity: warning - alert: KubeClientErrors annotations: description: "Kubernetes API server client '{{ $labels.job }}/{{ $labels.instance }}' is experiencing {{ $value | humanizePercentage }} errors on cluster {{ $labels.cluster }}." runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/kubernetes/kubeclienterrors" summary: "Kubernetes API server client is experiencing errors." expr: | (sum(rate(rest_client_requests_total{job="apiserver",code=~"5.."}[5m])) by (cluster, instance, job, namespace) / sum(rate(rest_client_requests_total{job="apiserver"}[5m])) by (cluster, instance, job, namespace)) > 0.01 for: 15m labels: severity: warning (root level) + one document added: apiVersion: monitoring.coreos.com/v1 kind: PrometheusRule metadata: name: kube-prometheus-stack-node-exporter.rules namespace: monitoring labels: app: kube-prometheus-stack app.kubernetes.io/instance: kube-prometheus-stack app.kubernetes.io/managed-by: Helm app.kubernetes.io/part-of: kube-prometheus-stack helm.toolkit.fluxcd.io/name: kube-prometheus-stack helm.toolkit.fluxcd.io/namespace: flux-system heritage: Helm release: kube-prometheus-stack spec: groups: - name: node-exporter.rules rules: - expr: | count without (cpu, mode) ( node_cpu_seconds_total{job="node-exporter",mode="idle"} ) record: "instance:node_num_cpu:sum" - expr: | 1 - avg without (cpu) ( sum without (mode) (rate(node_cpu_seconds_total{job="node-exporter", mode=~"idle|iowait|steal"}[5m])) ) record: "instance:node_cpu_utilisation:rate5m" - expr: | ( node_load1{job="node-exporter"} / instance:node_num_cpu:sum{job="node-exporter"} ) record: "instance:node_load1_per_cpu:ratio" - expr: | 1 - ( ( node_memory_MemAvailable_bytes{job="node-exporter"} or ( node_memory_Buffers_bytes{job="node-exporter"} + node_memory_Cached_bytes{job="node-exporter"} + node_memory_MemFree_bytes{job="node-exporter"} + node_memory_Slab_bytes{job="node-exporter"} ) ) / node_memory_MemTotal_bytes{job="node-exporter"} ) record: "instance:node_memory_utilisation:ratio" - expr: rate(node_vmstat_pgmajfault{job="node-exporter"}[5m]) record: "instance:node_vmstat_pgmajfault:rate5m" - expr: "rate(node_disk_io_time_seconds_total{job=\"node-exporter\", device=~\"(/dev/)?(mmcblk.p.+|nvme.+|rbd.+|sd.+|vd.+|xvd.+|dm-.+|md.+|dasd.+)\"}[5m])" record: "instance_device:node_disk_io_time_seconds:rate5m" - expr: "rate(node_disk_io_time_weighted_seconds_total{job=\"node-exporter\", device=~\"(/dev/)?(mmcblk.p.+|nvme.+|rbd.+|sd.+|vd.+|xvd.+|dm-.+|md.+|dasd.+)\"}[5m])" record: "instance_device:node_disk_io_time_weighted_seconds:rate5m" - expr: | sum without (device) ( rate(node_network_receive_bytes_total{job="node-exporter", device!="lo"}[5m]) ) record: "instance:node_network_receive_bytes_excluding_lo:rate5m" - expr: | sum without (device) ( rate(node_network_transmit_bytes_total{job="node-exporter", device!="lo"}[5m]) ) record: "instance:node_network_transmit_bytes_excluding_lo:rate5m" - expr: | sum without (device) ( rate(node_network_receive_drop_total{job="node-exporter", device!="lo"}[5m]) ) record: "instance:node_network_receive_drop_excluding_lo:rate5m" - expr: | sum without (device) ( rate(node_network_transmit_drop_total{job="node-exporter", device!="lo"}[5m]) ) record: "instance:node_network_transmit_drop_excluding_lo:rate5m" - expr: | sum without (device) ( rate(node_network_receive_bytes_total{job="node-exporter", device!~"lo|veth.+"}[5m]) ) record: "instance:node_network_receive_bytes_physical:rate5m" - expr: | sum without (device) ( rate(node_network_transmit_bytes_total{job="node-exporter", device!~"lo|veth.+"}[5m]) ) record: "instance:node_network_transmit_bytes_physical:rate5m" - expr: | sum without (device) ( rate(node_network_receive_drop_total{job="node-exporter", device!~"lo|veth.+"}[5m]) ) record: "instance:node_network_receive_drop_physical:rate5m" - expr: | sum without (device) ( rate(node_network_transmit_drop_total{job="node-exporter", device!~"lo|veth.+"}[5m]) ) record: "instance:node_network_transmit_drop_physical:rate5m" (root level) + one document added: apiVersion: monitoring.coreos.com/v1 kind: PrometheusRule metadata: name: kube-prometheus-stack-node-exporter namespace: monitoring labels: app: kube-prometheus-stack app.kubernetes.io/instance: kube-prometheus-stack app.kubernetes.io/managed-by: Helm app.kubernetes.io/part-of: kube-prometheus-stack helm.toolkit.fluxcd.io/name: kube-prometheus-stack helm.toolkit.fluxcd.io/namespace: flux-system heritage: Helm release: kube-prometheus-stack spec: groups: - name: node-exporter rules: - alert: NodeFilesystemSpaceFillingUp annotations: description: "Filesystem on {{ $labels.device }}, mounted on {{ $labels.mountpoint }}, at {{ $labels.instance }} has only {{ printf \"%.2f\" $value }}% available space left and is filling up." runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/node/nodefilesystemspacefillingup" summary: "Filesystem is predicted to run out of space within the next 24 hours." expr: | ( node_filesystem_avail_bytes{job="node-exporter",fstype!="",mountpoint!=""} / node_filesystem_size_bytes{job="node-exporter",fstype!="",mountpoint!=""} * 100 < 15 and predict_linear(node_filesystem_avail_bytes{job="node-exporter",fstype!="",mountpoint!=""}[6h], 24*60*60) < 0 and node_filesystem_readonly{job="node-exporter",fstype!="",mountpoint!=""} == 0 ) for: 1h labels: severity: warning - alert: NodeFilesystemSpaceFillingUp annotations: description: "Filesystem on {{ $labels.device }}, mounted on {{ $labels.mountpoint }}, at {{ $labels.instance }} has only {{ printf \"%.2f\" $value }}% available space left and is filling up fast." runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/node/nodefilesystemspacefillingup" summary: "Filesystem is predicted to run out of space within the next 4 hours." expr: | ( node_filesystem_avail_bytes{job="node-exporter",fstype!="",mountpoint!=""} / node_filesystem_size_bytes{job="node-exporter",fstype!="",mountpoint!=""} * 100 < 10 and predict_linear(node_filesystem_avail_bytes{job="node-exporter",fstype!="",mountpoint!=""}[6h], 4*60*60) < 0 and node_filesystem_readonly{job="node-exporter",fstype!="",mountpoint!=""} == 0 ) for: 1h labels: severity: critical - alert: NodeFilesystemAlmostOutOfSpace annotations: description: "Filesystem on {{ $labels.device }}, mounted on {{ $labels.mountpoint }}, at {{ $labels.instance }} has only {{ printf \"%.2f\" $value }}% available space left." runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/node/nodefilesystemalmostoutofspace" summary: "Filesystem has less than 5% space left." expr: | ( node_filesystem_avail_bytes{job="node-exporter",fstype!="",mountpoint!=""} / node_filesystem_size_bytes{job="node-exporter",fstype!="",mountpoint!=""} * 100 < 5 and node_filesystem_readonly{job="node-exporter",fstype!="",mountpoint!=""} == 0 ) for: 30m labels: severity: warning - alert: NodeFilesystemAlmostOutOfSpace annotations: description: "Filesystem on {{ $labels.device }}, mounted on {{ $labels.mountpoint }}, at {{ $labels.instance }} has only {{ printf \"%.2f\" $value }}% available space left." runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/node/nodefilesystemalmostoutofspace" summary: "Filesystem has less than 3% space left." expr: | ( node_filesystem_avail_bytes{job="node-exporter",fstype!="",mountpoint!=""} / node_filesystem_size_bytes{job="node-exporter",fstype!="",mountpoint!=""} * 100 < 3 and node_filesystem_readonly{job="node-exporter",fstype!="",mountpoint!=""} == 0 ) for: 30m labels: severity: critical - alert: NodeFilesystemFilesFillingUp annotations: description: "Filesystem on {{ $labels.device }}, mounted on {{ $labels.mountpoint }}, at {{ $labels.instance }} has only {{ printf \"%.2f\" $value }}% available inodes left and is filling up." runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/node/nodefilesystemfilesfillingup" summary: "Filesystem is predicted to run out of inodes within the next 24 hours." expr: | ( node_filesystem_files_free{job="node-exporter",fstype!="",mountpoint!=""} / node_filesystem_files{job="node-exporter",fstype!="",mountpoint!=""} * 100 < 40 and predict_linear(node_filesystem_files_free{job="node-exporter",fstype!="",mountpoint!=""}[6h], 24*60*60) < 0 and node_filesystem_readonly{job="node-exporter",fstype!="",mountpoint!=""} == 0 ) for: 1h labels: severity: warning - alert: NodeFilesystemFilesFillingUp annotations: description: "Filesystem on {{ $labels.device }}, mounted on {{ $labels.mountpoint }}, at {{ $labels.instance }} has only {{ printf \"%.2f\" $value }}% available inodes left and is filling up fast." runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/node/nodefilesystemfilesfillingup" summary: "Filesystem is predicted to run out of inodes within the next 4 hours." expr: | ( node_filesystem_files_free{job="node-exporter",fstype!="",mountpoint!=""} / node_filesystem_files{job="node-exporter",fstype!="",mountpoint!=""} * 100 < 20 and predict_linear(node_filesystem_files_free{job="node-exporter",fstype!="",mountpoint!=""}[6h], 4*60*60) < 0 and node_filesystem_readonly{job="node-exporter",fstype!="",mountpoint!=""} == 0 ) for: 1h labels: severity: critical - alert: NodeFilesystemAlmostOutOfFiles annotations: description: "Filesystem on {{ $labels.device }}, mounted on {{ $labels.mountpoint }}, at {{ $labels.instance }} has only {{ printf \"%.2f\" $value }}% available inodes left." runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/node/nodefilesystemalmostoutoffiles" summary: "Filesystem has less than 5% inodes left." expr: | ( node_filesystem_files_free{job="node-exporter",fstype!="",mountpoint!=""} / node_filesystem_files{job="node-exporter",fstype!="",mountpoint!=""} * 100 < 5 and node_filesystem_readonly{job="node-exporter",fstype!="",mountpoint!=""} == 0 ) for: 1h labels: severity: warning - alert: NodeFilesystemAlmostOutOfFiles annotations: description: "Filesystem on {{ $labels.device }}, mounted on {{ $labels.mountpoint }}, at {{ $labels.instance }} has only {{ printf \"%.2f\" $value }}% available inodes left." runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/node/nodefilesystemalmostoutoffiles" summary: "Filesystem has less than 3% inodes left." expr: | ( node_filesystem_files_free{job="node-exporter",fstype!="",mountpoint!=""} / node_filesystem_files{job="node-exporter",fstype!="",mountpoint!=""} * 100 < 3 and node_filesystem_readonly{job="node-exporter",fstype!="",mountpoint!=""} == 0 ) for: 1h labels: severity: critical - alert: NodeNetworkReceiveErrs annotations: description: "{{ $labels.instance }} interface {{ $labels.device }} has encountered {{ printf \"%.0f\" $value }} receive errors in the last two minutes." runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/node/nodenetworkreceiveerrs" summary: "Network interface is reporting many receive errors." expr: "rate(node_network_receive_errs_total{job=\"node-exporter\"}[2m]) / rate(node_network_receive_packets_total{job=\"node-exporter\"}[2m]) > 0.01" for: 1h labels: severity: warning - alert: NodeNetworkTransmitErrs annotations: description: "{{ $labels.instance }} interface {{ $labels.device }} has encountered {{ printf \"%.0f\" $value }} transmit errors in the last two minutes." runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/node/nodenetworktransmiterrs" summary: "Network interface is reporting many transmit errors." expr: "rate(node_network_transmit_errs_total{job=\"node-exporter\"}[2m]) / rate(node_network_transmit_packets_total{job=\"node-exporter\"}[2m]) > 0.01" for: 1h labels: severity: warning - alert: NodeHighNumberConntrackEntriesUsed annotations: description: "{{ $labels.instance }} {{ $value | humanizePercentage }} of conntrack entries are used." runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/node/nodehighnumberconntrackentriesused" summary: "Number of conntrack are getting close to the limit." expr: "(node_nf_conntrack_entries{job=\"node-exporter\"} / node_nf_conntrack_entries_limit) > 0.75" labels: severity: warning - alert: NodeTextFileCollectorScrapeError annotations: description: "Node Exporter text file collector on {{ $labels.instance }} failed to scrape." runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/node/nodetextfilecollectorscrapeerror" summary: "Node Exporter text file collector failed to scrape." expr: "node_textfile_scrape_error{job=\"node-exporter\"} == 1" labels: severity: warning - alert: NodeClockSkewDetected annotations: description: "Clock at {{ $labels.instance }} is out of sync by more than 0.05s. Ensure NTP is configured correctly on this host." runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/node/nodeclockskewdetected" summary: "Clock skew detected." expr: | ( node_timex_offset_seconds{job="node-exporter"} > 0.05 and deriv(node_timex_offset_seconds{job="node-exporter"}[5m]) >= 0 ) or ( node_timex_offset_seconds{job="node-exporter"} < -0.05 and deriv(node_timex_offset_seconds{job="node-exporter"}[5m]) <= 0 ) for: 10m labels: severity: warning - alert: NodeClockNotSynchronising annotations: description: "Clock at {{ $labels.instance }} is not synchronising. Ensure NTP is configured on this host." runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/node/nodeclocknotsynchronising" summary: "Clock not synchronising." expr: | min_over_time(node_timex_sync_status{job="node-exporter"}[5m]) == 0 and node_timex_maxerror_seconds{job="node-exporter"} >= 16 for: 10m labels: severity: warning - alert: NodeRAIDDegraded annotations: description: "RAID array '{{ $labels.device }}' at {{ $labels.instance }} is in degraded state due to one or more disks failures. Number of spare drives is insufficient to fix issue automatically." runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/node/noderaiddegraded" summary: "RAID Array is degraded." expr: "node_md_disks_required{job=\"node-exporter\",device=~\"(/dev/)?(mmcblk.p.+|nvme.+|rbd.+|sd.+|vd.+|xvd.+|dm-.+|md.+|dasd.+)\"} - ignoring (state) (node_md_disks{state=\"active\",job=\"node-exporter\",device=~\"(/dev/)?(mmcblk.p.+|nvme.+|rbd.+|sd.+|vd.+|xvd.+|dm-.+|md.+|dasd.+)\"}) > 0" for: 15m labels: severity: critical - alert: NodeRAIDDiskFailure annotations: description: "At least one device in RAID array at {{ $labels.instance }} failed. Array '{{ $labels.device }}' needs attention and possibly a disk swap." runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/node/noderaiddiskfailure" summary: "Failed device in RAID array." expr: "node_md_disks{state=\"failed\",job=\"node-exporter\",device=~\"(/dev/)?(mmcblk.p.+|nvme.+|rbd.+|sd.+|vd.+|xvd.+|dm-.+|md.+|dasd.+)\"} > 0" labels: severity: warning - alert: NodeFileDescriptorLimit annotations: description: "File descriptors limit at {{ $labels.instance }} is currently at {{ printf \"%.2f\" $value }}%." runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/node/nodefiledescriptorlimit" summary: "Kernel is predicted to exhaust file descriptors limit soon." expr: | ( node_filefd_allocated{job="node-exporter"} * 100 / node_filefd_maximum{job="node-exporter"} > 70 ) for: 15m labels: severity: warning - alert: NodeFileDescriptorLimit annotations: description: "File descriptors limit at {{ $labels.instance }} is currently at {{ printf \"%.2f\" $value }}%." runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/node/nodefiledescriptorlimit" summary: "Kernel is predicted to exhaust file descriptors limit soon." expr: | ( node_filefd_allocated{job="node-exporter"} * 100 / node_filefd_maximum{job="node-exporter"} > 90 ) for: 15m labels: severity: critical - alert: NodeCPUHighUsage annotations: description: | CPU usage at {{ $labels.instance }} has been above 90% for the last 15 minutes, is currently at {{ printf "%.2f" $value }}%. runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/node/nodecpuhighusage" summary: "High CPU usage." expr: "sum without(mode) (avg without (cpu) (rate(node_cpu_seconds_total{job=\"node-exporter\", mode!~\"idle|iowait\"}[2m]))) * 100 > 90" for: 15m labels: severity: info - alert: NodeSystemSaturation annotations: description: | System load per core at {{ $labels.instance }} has been above 2 for the last 15 minutes, is currently at {{ printf "%.2f" $value }}. This might indicate this instance resources saturation and can cause it becoming unresponsive. runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/node/nodesystemsaturation" summary: "System saturated, load per core is very high." expr: | node_load1{job="node-exporter"} / count without (cpu, mode) (node_cpu_seconds_total{job="node-exporter", mode="idle"}) > 2 for: 15m labels: severity: warning - alert: NodeMemoryMajorPagesFaults annotations: description: | Memory major pages are occurring at very high rate at {{ $labels.instance }}, 500 major page faults per second for the last 15 minutes, is currently at {{ printf "%.2f" $value }}. Please check that there is enough memory available at this instance. runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/node/nodememorymajorpagesfaults" summary: "Memory major page faults are occurring at very high rate." expr: "rate(node_vmstat_pgmajfault{job=\"node-exporter\"}[5m]) > 500" for: 15m labels: severity: warning - alert: NodeMemoryHighUtilization annotations: description: | Memory is filling up at {{ $labels.instance }}, has been above 90% for the last 15 minutes, is currently at {{ printf "%.2f" $value }}%. runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/node/nodememoryhighutilization" summary: "Host is running out of memory." expr: "100 - (node_memory_MemAvailable_bytes{job=\"node-exporter\"} / node_memory_MemTotal_bytes{job=\"node-exporter\"} * 100) > 90" for: 15m labels: severity: warning - alert: NodeDiskIOSaturation annotations: description: | Disk IO queue (aqu-sq) is high on {{ $labels.device }} at {{ $labels.instance }}, has been above 10 for the last 30 minutes, is currently at {{ printf "%.2f" $value }}. This symptom might indicate disk saturation. runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/node/nodediskiosaturation" summary: "Disk IO queue is high." expr: "rate(node_disk_io_time_weighted_seconds_total{job=\"node-exporter\", device=~\"(/dev/)?(mmcblk.p.+|nvme.+|rbd.+|sd.+|vd.+|xvd.+|dm-.+|md.+|dasd.+)\"}[5m]) > 10" for: 30m labels: severity: warning - alert: NodeSystemdServiceFailed annotations: description: "Systemd service {{ $labels.name }} has entered failed state at {{ $labels.instance }}" runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/node/nodesystemdservicefailed" summary: "Systemd service has entered failed state." expr: "node_systemd_unit_state{job=\"node-exporter\", state=\"failed\"} == 1" for: 5m labels: severity: warning - alert: NodeSystemdServiceCrashlooping annotations: description: "Systemd service {{ $labels.name }} has being restarted too many times at {{ $labels.instance }} for the last 15 minutes. Please check if service is crash looping." runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/node/nodesystemdservicecrashlooping" summary: "Systemd service keeps restaring, possibly crash looping." expr: "increase(node_systemd_service_restart_total{job=\"node-exporter\"}[5m]) > 2" for: 15m labels: severity: warning - alert: NodeBondingDegraded annotations: description: "Bonding interface {{ $labels.master }} on {{ $labels.instance }} is in degraded state due to one or more slave failures." runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/node/nodebondingdegraded" summary: "Bonding interface is degraded." expr: "(node_bonding_slaves{job=\"node-exporter\"} - node_bonding_active{job=\"node-exporter\"}) != 0" for: 5m labels: severity: warning (root level) + one document added: apiVersion: monitoring.coreos.com/v1 kind: PrometheusRule metadata: name: kube-prometheus-stack-node-network namespace: monitoring labels: app: kube-prometheus-stack app.kubernetes.io/instance: kube-prometheus-stack app.kubernetes.io/managed-by: Helm app.kubernetes.io/part-of: kube-prometheus-stack helm.toolkit.fluxcd.io/name: kube-prometheus-stack helm.toolkit.fluxcd.io/namespace: flux-system heritage: Helm release: kube-prometheus-stack spec: groups: - name: node-network rules: - alert: NodeNetworkInterfaceFlapping annotations: description: "Network interface \"{{ $labels.device }}\" changing its up status often on node-exporter {{ $labels.namespace }}/{{ $labels.pod }}" runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/general/nodenetworkinterfaceflapping" summary: "Network interface is often changing its status" expr: "changes(node_network_up{job=\"node-exporter\",device!~\"veth.+\"}[2m]) > 2" for: 2m labels: severity: warning (root level) + one document added: apiVersion: monitoring.coreos.com/v1 kind: PrometheusRule metadata: name: kube-prometheus-stack-node.rules namespace: monitoring labels: app: kube-prometheus-stack app.kubernetes.io/instance: kube-prometheus-stack app.kubernetes.io/managed-by: Helm app.kubernetes.io/part-of: kube-prometheus-stack helm.toolkit.fluxcd.io/name: kube-prometheus-stack helm.toolkit.fluxcd.io/namespace: flux-system heritage: Helm release: kube-prometheus-stack spec: groups: - name: node.rules rules: - expr: | topk by (cluster, namespace, pod) (1, max by (cluster, node, namespace, pod) ( label_replace(kube_pod_info{job="kube-state-metrics",node!=""}, "pod", "$1", "pod", "(.*)") )) record: "node_namespace_pod:kube_pod_info:" - expr: | count by (cluster, node) ( node_cpu_seconds_total{mode="idle",job="node-exporter"} * on (cluster, namespace, pod) group_left(node) topk by (cluster, namespace, pod) (1, node_namespace_pod:kube_pod_info:) ) record: "node:node_num_cpu:sum" - expr: | sum( node_memory_MemAvailable_bytes{job="node-exporter"} or ( node_memory_Buffers_bytes{job="node-exporter"} + node_memory_Cached_bytes{job="node-exporter"} + node_memory_MemFree_bytes{job="node-exporter"} + node_memory_Slab_bytes{job="node-exporter"} ) ) by (cluster) record: ":node_memory_MemAvailable_bytes:sum" - expr: | avg by (cluster, node) ( sum without (mode) ( rate(node_cpu_seconds_total{mode!="idle",mode!="iowait",mode!="steal",job="node-exporter"}[5m]) ) ) record: "node:node_cpu_utilization:ratio_rate5m" - expr: | avg by (cluster) ( node:node_cpu_utilization:ratio_rate5m ) record: "cluster:node_cpu:ratio_rate5m" (root level) + one document added: apiVersion: monitoring.coreos.com/v1 kind: PrometheusRule metadata: name: kube-prometheus-stack-prometheus-operator namespace: monitoring labels: app: kube-prometheus-stack app.kubernetes.io/instance: kube-prometheus-stack app.kubernetes.io/managed-by: Helm app.kubernetes.io/part-of: kube-prometheus-stack helm.toolkit.fluxcd.io/name: kube-prometheus-stack helm.toolkit.fluxcd.io/namespace: flux-system heritage: Helm release: kube-prometheus-stack spec: groups: - name: prometheus-operator rules: - alert: PrometheusOperatorListErrors annotations: description: "Errors while performing List operations in controller {{$labels.controller}} in {{$labels.namespace}} namespace." runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/prometheus-operator/prometheusoperatorlisterrors" summary: "Errors while performing list operations in controller." expr: "(sum by (cluster,controller,namespace) (rate(prometheus_operator_list_operations_failed_total{job=\"kube-prometheus-stack-operator\",namespace=\"monitoring\"}[10m])) / sum by (cluster,controller,namespace) (rate(prometheus_operator_list_operations_total{job=\"kube-prometheus-stack-operator\",namespace=\"monitoring\"}[10m]))) > 0.4" for: 15m labels: severity: warning - alert: PrometheusOperatorWatchErrors annotations: description: "Errors while performing watch operations in controller {{$labels.controller}} in {{$labels.namespace}} namespace." runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/prometheus-operator/prometheusoperatorwatcherrors" summary: "Errors while performing watch operations in controller." expr: "(sum by (cluster,controller,namespace) (rate(prometheus_operator_watch_operations_failed_total{job=\"kube-prometheus-stack-operator\",namespace=\"monitoring\"}[5m])) / sum by (cluster,controller,namespace) (rate(prometheus_operator_watch_operations_total{job=\"kube-prometheus-stack-operator\",namespace=\"monitoring\"}[5m]))) > 0.4" for: 15m labels: severity: warning - alert: PrometheusOperatorSyncFailed annotations: description: "Controller {{ $labels.controller }} in {{ $labels.namespace }} namespace fails to reconcile {{ $value }} objects." runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/prometheus-operator/prometheusoperatorsyncfailed" summary: "Last controller reconciliation failed" expr: "min_over_time(prometheus_operator_syncs{status=\"failed\",job=\"kube-prometheus-stack-operator\",namespace=\"monitoring\"}[5m]) > 0" for: 10m labels: severity: warning - alert: PrometheusOperatorReconcileErrors annotations: description: "{{ $value | humanizePercentage }} of reconciling operations failed for {{ $labels.controller }} controller in {{ $labels.namespace }} namespace." runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/prometheus-operator/prometheusoperatorreconcileerrors" summary: "Errors while reconciling objects." expr: "(sum by (cluster,controller,namespace) (rate(prometheus_operator_reconcile_errors_total{job=\"kube-prometheus-stack-operator\",namespace=\"monitoring\"}[5m]))) / (sum by (cluster,controller,namespace) (rate(prometheus_operator_reconcile_operations_total{job=\"kube-prometheus-stack-operator\",namespace=\"monitoring\"}[5m]))) > 0.1" for: 10m labels: severity: warning - alert: PrometheusOperatorStatusUpdateErrors annotations: description: "{{ $value | humanizePercentage }} of status update operations failed for {{ $labels.controller }} controller in {{ $labels.namespace }} namespace." runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/prometheus-operator/prometheusoperatorstatusupdateerrors" summary: "Errors while updating objects status." expr: "(sum by (cluster,controller,namespace) (rate(prometheus_operator_status_update_errors_total{job=\"kube-prometheus-stack-operator\",namespace=\"monitoring\"}[5m]))) / (sum by (cluster,controller,namespace) (rate(prometheus_operator_status_update_operations_total{job=\"kube-prometheus-stack-operator\",namespace=\"monitoring\"}[5m]))) > 0.1" for: 10m labels: severity: warning - alert: PrometheusOperatorNodeLookupErrors annotations: description: "Errors while reconciling Prometheus in {{ $labels.namespace }} Namespace." runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/prometheus-operator/prometheusoperatornodelookuperrors" summary: "Errors while reconciling Prometheus." expr: "rate(prometheus_operator_node_address_lookup_errors_total{job=\"kube-prometheus-stack-operator\",namespace=\"monitoring\"}[5m]) > 0.1" for: 10m labels: severity: warning - alert: PrometheusOperatorNotReady annotations: description: "Prometheus operator in {{ $labels.namespace }} namespace isn't ready to reconcile {{ $labels.controller }} resources." runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/prometheus-operator/prometheusoperatornotready" summary: "Prometheus operator not ready" expr: "min by (cluster,controller,namespace) (max_over_time(prometheus_operator_ready{job=\"kube-prometheus-stack-operator\",namespace=\"monitoring\"}[5m]) == 0)" for: 5m labels: severity: warning - alert: PrometheusOperatorRejectedResources annotations: description: "Prometheus operator in {{ $labels.namespace }} namespace rejected {{ printf \"%0.0f\" $value }} {{ $labels.controller }}/{{ $labels.resource }} resources." runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/prometheus-operator/prometheusoperatorrejectedresources" summary: "Resources rejected by Prometheus operator" expr: "min_over_time(prometheus_operator_managed_resources{state=\"rejected\",job=\"kube-prometheus-stack-operator\",namespace=\"monitoring\"}[5m]) > 0" for: 5m labels: severity: warning (root level) + one document added: apiVersion: monitoring.coreos.com/v1 kind: PrometheusRule metadata: name: kube-prometheus-stack-prometheus namespace: monitoring labels: app: kube-prometheus-stack app.kubernetes.io/instance: kube-prometheus-stack app.kubernetes.io/managed-by: Helm app.kubernetes.io/part-of: kube-prometheus-stack helm.toolkit.fluxcd.io/name: kube-prometheus-stack helm.toolkit.fluxcd.io/namespace: flux-system heritage: Helm release: kube-prometheus-stack spec: groups: - name: prometheus rules: - alert: PrometheusBadConfig annotations: description: "Prometheus {{$labels.namespace}}/{{$labels.pod}} has failed to reload its configuration." runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/prometheus/prometheusbadconfig" summary: "Failed Prometheus configuration reload." expr: | # Without max_over_time, failed scrapes could create false negatives, see # https://www.robustperception.io/alerting-on-gauges-in-prometheus-2-0 for details. max_over_time(prometheus_config_last_reload_successful{job="kube-prometheus-stack-prometheus",namespace="monitoring"}[5m]) == 0 for: 10m labels: severity: critical - alert: PrometheusSDRefreshFailure annotations: description: "Prometheus {{$labels.namespace}}/{{$labels.pod}} has failed to refresh SD with mechanism {{$labels.mechanism}}." runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/prometheus/prometheussdrefreshfailure" summary: "Failed Prometheus SD refresh." expr: "increase(prometheus_sd_refresh_failures_total{job=\"kube-prometheus-stack-prometheus\",namespace=\"monitoring\"}[10m]) > 0" for: 20m labels: severity: warning - alert: PrometheusKubernetesListWatchFailures annotations: description: "Kubernetes service discovery of Prometheus {{$labels.namespace}}/{{$labels.pod}} is experiencing {{ printf \"%.0f\" $value }} failures with LIST/WATCH requests to the Kubernetes API in the last 5 minutes." runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/prometheus/prometheuskuberneteslistwatchfailures" summary: "Requests in Kubernetes SD are failing." expr: "increase(prometheus_sd_kubernetes_failures_total{job=\"kube-prometheus-stack-prometheus\",namespace=\"monitoring\"}[5m]) > 0" for: 15m labels: severity: warning - alert: PrometheusNotificationQueueRunningFull annotations: description: "Alert notification queue of Prometheus {{$labels.namespace}}/{{$labels.pod}} is running full." runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/prometheus/prometheusnotificationqueuerunningfull" summary: "Prometheus alert notification queue predicted to run full in less than 30m." expr: | # Without min_over_time, failed scrapes could create false negatives, see # https://www.robustperception.io/alerting-on-gauges-in-prometheus-2-0 for details. ( predict_linear(prometheus_notifications_queue_length{job="kube-prometheus-stack-prometheus",namespace="monitoring"}[5m], 60 * 30) > min_over_time(prometheus_notifications_queue_capacity{job="kube-prometheus-stack-prometheus",namespace="monitoring"}[5m]) ) for: 15m labels: severity: warning - alert: PrometheusErrorSendingAlertsToSomeAlertmanagers annotations: description: "{{ printf \"%.1f\" $value }}% of alerts sent by Prometheus {{$labels.namespace}}/{{$labels.pod}} to Alertmanager {{$labels.alertmanager}} were affected by errors." runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/prometheus/prometheuserrorsendingalertstosomealertmanagers" summary: "More than 1% of alerts sent by Prometheus to a specific Alertmanager were affected by errors." expr: | ( rate(prometheus_notifications_errors_total{job="kube-prometheus-stack-prometheus",namespace="monitoring"}[5m]) / rate(prometheus_notifications_sent_total{job="kube-prometheus-stack-prometheus",namespace="monitoring"}[5m]) ) * 100 > 1 for: 15m labels: severity: warning - alert: PrometheusNotConnectedToAlertmanagers annotations: description: "Prometheus {{$labels.namespace}}/{{$labels.pod}} is not connected to any Alertmanagers." runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/prometheus/prometheusnotconnectedtoalertmanagers" summary: "Prometheus is not connected to any Alertmanagers." expr: | # Without max_over_time, failed scrapes could create false negatives, see # https://www.robustperception.io/alerting-on-gauges-in-prometheus-2-0 for details. max_over_time(prometheus_notifications_alertmanagers_discovered{job="kube-prometheus-stack-prometheus",namespace="monitoring"}[5m]) < 1 for: 10m labels: severity: warning - alert: PrometheusTSDBReloadsFailing annotations: description: "Prometheus {{$labels.namespace}}/{{$labels.pod}} has detected {{$value | humanize}} reload failures over the last 3h." runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/prometheus/prometheustsdbreloadsfailing" summary: "Prometheus has issues reloading blocks from disk." expr: "increase(prometheus_tsdb_reloads_failures_total{job=\"kube-prometheus-stack-prometheus\",namespace=\"monitoring\"}[3h]) > 0" for: 4h labels: severity: warning - alert: PrometheusTSDBCompactionsFailing annotations: description: "Prometheus {{$labels.namespace}}/{{$labels.pod}} has detected {{$value | humanize}} compaction failures over the last 3h." runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/prometheus/prometheustsdbcompactionsfailing" summary: "Prometheus has issues compacting blocks." expr: "increase(prometheus_tsdb_compactions_failed_total{job=\"kube-prometheus-stack-prometheus\",namespace=\"monitoring\"}[3h]) > 0" for: 4h labels: severity: warning - alert: PrometheusNotIngestingSamples annotations: description: "Prometheus {{$labels.namespace}}/{{$labels.pod}} is not ingesting samples." runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/prometheus/prometheusnotingestingsamples" summary: "Prometheus is not ingesting samples." expr: | ( sum without(type) (rate(prometheus_tsdb_head_samples_appended_total{job="kube-prometheus-stack-prometheus",namespace="monitoring"}[5m])) <= 0 and ( sum without(scrape_job) (prometheus_target_metadata_cache_entries{job="kube-prometheus-stack-prometheus",namespace="monitoring"}) > 0 or sum without(rule_group) (prometheus_rule_group_rules{job="kube-prometheus-stack-prometheus",namespace="monitoring"}) > 0 ) ) for: 10m labels: severity: warning - alert: PrometheusDuplicateTimestamps annotations: description: "Prometheus {{$labels.namespace}}/{{$labels.pod}} is dropping {{ printf \"%.4g\" $value }} samples/s with different values but duplicated timestamp." runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/prometheus/prometheusduplicatetimestamps" summary: "Prometheus is dropping samples with duplicate timestamps." expr: "rate(prometheus_target_scrapes_sample_duplicate_timestamp_total{job=\"kube-prometheus-stack-prometheus\",namespace=\"monitoring\"}[5m]) > 0" for: 10m labels: severity: warning - alert: PrometheusOutOfOrderTimestamps annotations: description: "Prometheus {{$labels.namespace}}/{{$labels.pod}} is dropping {{ printf \"%.4g\" $value }} samples/s with timestamps arriving out of order." runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/prometheus/prometheusoutofordertimestamps" summary: "Prometheus drops samples with out-of-order timestamps." expr: "rate(prometheus_target_scrapes_sample_out_of_order_total{job=\"kube-prometheus-stack-prometheus\",namespace=\"monitoring\"}[5m]) > 0" for: 10m labels: severity: warning - alert: PrometheusRemoteStorageFailures annotations: description: "Prometheus {{$labels.namespace}}/{{$labels.pod}} failed to send {{ printf \"%.1f\" $value }}% of the samples to {{ $labels.remote_name}}:{{ $labels.url }}" runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/prometheus/prometheusremotestoragefailures" summary: "Prometheus fails to send samples to remote storage." expr: | ( (rate(prometheus_remote_storage_failed_samples_total{job="kube-prometheus-stack-prometheus",namespace="monitoring"}[5m]) or rate(prometheus_remote_storage_samples_failed_total{job="kube-prometheus-stack-prometheus",namespace="monitoring"}[5m])) / ( (rate(prometheus_remote_storage_failed_samples_total{job="kube-prometheus-stack-prometheus",namespace="monitoring"}[5m]) or rate(prometheus_remote_storage_samples_failed_total{job="kube-prometheus-stack-prometheus",namespace="monitoring"}[5m])) + (rate(prometheus_remote_storage_succeeded_samples_total{job="kube-prometheus-stack-prometheus",namespace="monitoring"}[5m]) or rate(prometheus_remote_storage_samples_total{job="kube-prometheus-stack-prometheus",namespace="monitoring"}[5m])) ) ) * 100 > 1 for: 15m labels: severity: critical - alert: PrometheusRemoteWriteBehind annotations: description: "Prometheus {{$labels.namespace}}/{{$labels.pod}} remote write is {{ printf \"%.1f\" $value }}s behind for {{ $labels.remote_name}}:{{ $labels.url }}." runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/prometheus/prometheusremotewritebehind" summary: "Prometheus remote write is behind." expr: | # Without max_over_time, failed scrapes could create false negatives, see # https://www.robustperception.io/alerting-on-gauges-in-prometheus-2-0 for details. ( max_over_time(prometheus_remote_storage_queue_highest_timestamp_seconds{job="kube-prometheus-stack-prometheus",namespace="monitoring"}[5m]) - max_over_time(prometheus_remote_storage_queue_highest_sent_timestamp_seconds{job="kube-prometheus-stack-prometheus",namespace="monitoring"}[5m]) ) > 120 for: 15m labels: severity: critical - alert: PrometheusRemoteWriteDesiredShards annotations: description: "Prometheus {{$labels.namespace}}/{{$labels.pod}} remote write desired shards calculation wants to run {{ $value }} shards for queue {{ $labels.remote_name}}:{{ $labels.url }}, which is more than the max of {{ printf `prometheus_remote_storage_shards_max{instance=\"%s\",job=\"kube-prometheus-stack-prometheus\",namespace=\"monitoring\"}` $labels.instance | query | first | value }}." runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/prometheus/prometheusremotewritedesiredshards" summary: "Prometheus remote write desired shards calculation wants to run more than configured max shards." expr: | # Without max_over_time, failed scrapes could create false negatives, see # https://www.robustperception.io/alerting-on-gauges-in-prometheus-2-0 for details. ( max_over_time(prometheus_remote_storage_shards_desired{job="kube-prometheus-stack-prometheus",namespace="monitoring"}[5m]) > max_over_time(prometheus_remote_storage_shards_max{job="kube-prometheus-stack-prometheus",namespace="monitoring"}[5m]) ) for: 15m labels: severity: warning - alert: PrometheusRuleFailures annotations: description: "Prometheus {{$labels.namespace}}/{{$labels.pod}} has failed to evaluate {{ printf \"%.0f\" $value }} rules in the last 5m." runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/prometheus/prometheusrulefailures" summary: "Prometheus is failing rule evaluations." expr: "increase(prometheus_rule_evaluation_failures_total{job=\"kube-prometheus-stack-prometheus\",namespace=\"monitoring\"}[5m]) > 0" for: 15m labels: severity: critical - alert: PrometheusMissingRuleEvaluations annotations: description: "Prometheus {{$labels.namespace}}/{{$labels.pod}} has missed {{ printf \"%.0f\" $value }} rule group evaluations in the last 5m." runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/prometheus/prometheusmissingruleevaluations" summary: "Prometheus is missing rule evaluations due to slow rule group evaluation." expr: "increase(prometheus_rule_group_iterations_missed_total{job=\"kube-prometheus-stack-prometheus\",namespace=\"monitoring\"}[5m]) > 0" for: 15m labels: severity: warning - alert: PrometheusTargetLimitHit annotations: description: "Prometheus {{$labels.namespace}}/{{$labels.pod}} has dropped {{ printf \"%.0f\" $value }} targets because the number of targets exceeded the configured target_limit." runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/prometheus/prometheustargetlimithit" summary: "Prometheus has dropped targets because some scrape configs have exceeded the targets limit." expr: "increase(prometheus_target_scrape_pool_exceeded_target_limit_total{job=\"kube-prometheus-stack-prometheus\",namespace=\"monitoring\"}[5m]) > 0" for: 15m labels: severity: warning - alert: PrometheusLabelLimitHit annotations: description: "Prometheus {{$labels.namespace}}/{{$labels.pod}} has dropped {{ printf \"%.0f\" $value }} targets because some samples exceeded the configured label_limit, label_name_length_limit or label_value_length_limit." runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/prometheus/prometheuslabellimithit" summary: "Prometheus has dropped targets because some scrape configs have exceeded the labels limit." expr: "increase(prometheus_target_scrape_pool_exceeded_label_limits_total{job=\"kube-prometheus-stack-prometheus\",namespace=\"monitoring\"}[5m]) > 0" for: 15m labels: severity: warning - alert: PrometheusScrapeBodySizeLimitHit annotations: description: "Prometheus {{$labels.namespace}}/{{$labels.pod}} has failed {{ printf \"%.0f\" $value }} scrapes in the last 5m because some targets exceeded the configured body_size_limit." runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/prometheus/prometheusscrapebodysizelimithit" summary: "Prometheus has dropped some targets that exceeded body size limit." expr: "increase(prometheus_target_scrapes_exceeded_body_size_limit_total{job=\"kube-prometheus-stack-prometheus\",namespace=\"monitoring\"}[5m]) > 0" for: 15m labels: severity: warning - alert: PrometheusScrapeSampleLimitHit annotations: description: "Prometheus {{$labels.namespace}}/{{$labels.pod}} has failed {{ printf \"%.0f\" $value }} scrapes in the last 5m because some targets exceeded the configured sample_limit." runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/prometheus/prometheusscrapesamplelimithit" summary: "Prometheus has failed scrapes that have exceeded the configured sample limit." expr: "increase(prometheus_target_scrapes_exceeded_sample_limit_total{job=\"kube-prometheus-stack-prometheus\",namespace=\"monitoring\"}[5m]) > 0" for: 15m labels: severity: warning - alert: PrometheusTargetSyncFailure annotations: description: "{{ printf \"%.0f\" $value }} targets in Prometheus {{$labels.namespace}}/{{$labels.pod}} have failed to sync because invalid configuration was supplied." runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/prometheus/prometheustargetsyncfailure" summary: "Prometheus has failed to sync targets." expr: "increase(prometheus_target_sync_failed_total{job=\"kube-prometheus-stack-prometheus\",namespace=\"monitoring\"}[30m]) > 0" for: 5m labels: severity: critical - alert: PrometheusHighQueryLoad annotations: description: "Prometheus {{$labels.namespace}}/{{$labels.pod}} query API has less than 20% available capacity in its query engine for the last 15 minutes." runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/prometheus/prometheushighqueryload" summary: "Prometheus is reaching its maximum capacity serving concurrent requests." expr: "avg_over_time(prometheus_engine_queries{job=\"kube-prometheus-stack-prometheus\",namespace=\"monitoring\"}[5m]) / max_over_time(prometheus_engine_queries_concurrent_max{job=\"kube-prometheus-stack-prometheus\",namespace=\"monitoring\"}[5m]) > 0.8" for: 15m labels: severity: warning - alert: PrometheusErrorSendingAlertsToAnyAlertmanager annotations: description: "{{ printf \"%.1f\" $value }}% minimum errors while sending alerts from Prometheus {{$labels.namespace}}/{{$labels.pod}} to any Alertmanager." runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/prometheus/prometheuserrorsendingalertstoanyalertmanager" summary: "Prometheus encounters more than 3% errors sending alerts to any Alertmanager." expr: | min without (alertmanager) ( rate(prometheus_notifications_errors_total{job="kube-prometheus-stack-prometheus",namespace="monitoring",alertmanager!~``}[5m]) / rate(prometheus_notifications_sent_total{job="kube-prometheus-stack-prometheus",namespace="monitoring",alertmanager!~``}[5m]) ) * 100 > 3 for: 15m labels: severity: critical (root level) + one document added: apiVersion: monitoring.coreos.com/v1 kind: ServiceMonitor metadata: name: kube-state-metrics namespace: monitoring labels: app.kubernetes.io/component: metrics app.kubernetes.io/instance: kube-prometheus-stack app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: kube-state-metrics app.kubernetes.io/part-of: kube-state-metrics helm.toolkit.fluxcd.io/name: kube-prometheus-stack helm.toolkit.fluxcd.io/namespace: flux-system release: kube-prometheus-stack spec: endpoints: - honorLabels: true port: http relabelings: - action: replace regex: "(.*)" replacement: $1 sourceLabels: - __meta_kubernetes_pod_node_name targetLabel: kubernetes_node jobLabel: app.kubernetes.io/name selector: matchLabels: app.kubernetes.io/instance: kube-prometheus-stack app.kubernetes.io/name: kube-state-metrics (root level) + one document added: apiVersion: monitoring.coreos.com/v1 kind: ServiceMonitor metadata: name: node-exporter namespace: kube-privileged labels: app.kubernetes.io/component: metrics app.kubernetes.io/instance: kube-prometheus-stack app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: prometheus-node-exporter app.kubernetes.io/part-of: prometheus-node-exporter helm.toolkit.fluxcd.io/name: kube-prometheus-stack helm.toolkit.fluxcd.io/namespace: flux-system release: kube-prometheus-stack spec: attachMetadata: node: false endpoints: - port: http-metrics relabelings: - action: replace regex: "(.*)" replacement: $1 sourceLabels: - __meta_kubernetes_pod_node_name targetLabel: kubernetes_node scheme: http jobLabel: jobLabel selector: matchLabels: app.kubernetes.io/instance: kube-prometheus-stack app.kubernetes.io/name: prometheus-node-exporter (root level) + one document added: apiVersion: monitoring.coreos.com/v1 kind: ServiceMonitor metadata: name: kube-prometheus-stack-alertmanager namespace: monitoring labels: app: kube-prometheus-stack-alertmanager app.kubernetes.io/instance: kube-prometheus-stack app.kubernetes.io/managed-by: Helm app.kubernetes.io/part-of: kube-prometheus-stack helm.toolkit.fluxcd.io/name: kube-prometheus-stack helm.toolkit.fluxcd.io/namespace: flux-system heritage: Helm release: kube-prometheus-stack spec: endpoints: - enableHttp2: true path: /metrics port: http-web - path: /metrics port: reloader-web namespaceSelector: matchNames: - monitoring selector: matchLabels: app: kube-prometheus-stack-alertmanager release: kube-prometheus-stack self-monitor: "true" (root level) + one document added: apiVersion: monitoring.coreos.com/v1 kind: ServiceMonitor metadata: name: kube-prometheus-stack-coredns namespace: monitoring labels: app: kube-prometheus-stack-coredns app.kubernetes.io/instance: kube-prometheus-stack app.kubernetes.io/managed-by: Helm app.kubernetes.io/part-of: kube-prometheus-stack helm.toolkit.fluxcd.io/name: kube-prometheus-stack helm.toolkit.fluxcd.io/namespace: flux-system heritage: Helm release: kube-prometheus-stack spec: endpoints: - bearerTokenFile: /var/run/secrets/kubernetes.io/serviceaccount/token port: http-metrics jobLabel: jobLabel namespaceSelector: matchNames: - kube-system selector: matchLabels: app: kube-prometheus-stack-coredns release: kube-prometheus-stack (root level) + one document added: apiVersion: monitoring.coreos.com/v1 kind: ServiceMonitor metadata: name: kube-prometheus-stack-apiserver namespace: monitoring labels: app: kube-prometheus-stack-apiserver app.kubernetes.io/instance: kube-prometheus-stack app.kubernetes.io/managed-by: Helm app.kubernetes.io/part-of: kube-prometheus-stack helm.toolkit.fluxcd.io/name: kube-prometheus-stack helm.toolkit.fluxcd.io/namespace: flux-system heritage: Helm release: kube-prometheus-stack spec: endpoints: - bearerTokenFile: /var/run/secrets/kubernetes.io/serviceaccount/token metricRelabelings: - action: drop regex: (etcd_request|apiserver_request_slo|apiserver_request_sli|apiserver_request)_duration_seconds_bucket;(0\.15|0\.2|0\.3|0\.35|0\.4|0\.45|0\.6|0\.7|0\.8|0\.9|1\.25|1\.5|1\.75|2|3|3\.5|4|4\.5|6|7|8|9|15|20|40|45|50)(\.0)? sourceLabels: - __name__ - le port: https scheme: https tlsConfig: caFile: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt insecureSkipVerify: false serverName: kubernetes jobLabel: component namespaceSelector: matchNames: - default selector: matchLabels: component: apiserver provider: kubernetes (root level) + one document added: apiVersion: monitoring.coreos.com/v1 kind: ServiceMonitor metadata: name: kube-prometheus-stack-kube-controller-manager namespace: monitoring labels: app: kube-prometheus-stack-kube-controller-manager app.kubernetes.io/instance: kube-prometheus-stack app.kubernetes.io/managed-by: Helm app.kubernetes.io/part-of: kube-prometheus-stack helm.toolkit.fluxcd.io/name: kube-prometheus-stack helm.toolkit.fluxcd.io/namespace: flux-system heritage: Helm release: kube-prometheus-stack spec: endpoints: - bearerTokenFile: /var/run/secrets/kubernetes.io/serviceaccount/token port: http-metrics scheme: https tlsConfig: caFile: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt insecureSkipVerify: true jobLabel: jobLabel namespaceSelector: matchNames: - kube-system selector: matchLabels: app: kube-prometheus-stack-kube-controller-manager release: kube-prometheus-stack (root level) + one document added: apiVersion: monitoring.coreos.com/v1 kind: ServiceMonitor metadata: name: kube-prometheus-stack-kube-etcd namespace: monitoring labels: app: kube-prometheus-stack-kube-etcd app.kubernetes.io/instance: kube-prometheus-stack app.kubernetes.io/managed-by: Helm app.kubernetes.io/part-of: kube-prometheus-stack helm.toolkit.fluxcd.io/name: kube-prometheus-stack helm.toolkit.fluxcd.io/namespace: flux-system heritage: Helm release: kube-prometheus-stack spec: endpoints: - bearerTokenFile: /var/run/secrets/kubernetes.io/serviceaccount/token port: http-metrics jobLabel: jobLabel namespaceSelector: matchNames: - kube-system selector: matchLabels: app: kube-prometheus-stack-kube-etcd release: kube-prometheus-stack (root level) + one document added: apiVersion: monitoring.coreos.com/v1 kind: ServiceMonitor metadata: name: kube-prometheus-stack-kube-scheduler namespace: monitoring labels: app: kube-prometheus-stack-kube-scheduler app.kubernetes.io/instance: kube-prometheus-stack app.kubernetes.io/managed-by: Helm app.kubernetes.io/part-of: kube-prometheus-stack helm.toolkit.fluxcd.io/name: kube-prometheus-stack helm.toolkit.fluxcd.io/namespace: flux-system heritage: Helm release: kube-prometheus-stack spec: endpoints: - bearerTokenFile: /var/run/secrets/kubernetes.io/serviceaccount/token port: http-metrics scheme: https tlsConfig: caFile: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt insecureSkipVerify: true jobLabel: jobLabel namespaceSelector: matchNames: - kube-system selector: matchLabels: app: kube-prometheus-stack-kube-scheduler release: kube-prometheus-stack (root level) + one document added: apiVersion: monitoring.coreos.com/v1 kind: ServiceMonitor metadata: name: kube-prometheus-stack-kubelet namespace: monitoring labels: app: kube-prometheus-stack-kubelet app.kubernetes.io/instance: kube-prometheus-stack app.kubernetes.io/managed-by: Helm app.kubernetes.io/part-of: kube-prometheus-stack helm.toolkit.fluxcd.io/name: kube-prometheus-stack helm.toolkit.fluxcd.io/namespace: flux-system heritage: Helm release: kube-prometheus-stack spec: attachMetadata: node: false endpoints: - bearerTokenFile: /var/run/secrets/kubernetes.io/serviceaccount/token honorLabels: true honorTimestamps: true metricRelabelings: - action: drop regex: (csi_operations|storage_operation_duration)_seconds_bucket;(0.25|2.5|15|25|120|600)(\.0)? sourceLabels: - __name__ - le port: https-metrics relabelings: - action: replace sourceLabels: - __metrics_path__ targetLabel: metrics_path scheme: https tlsConfig: caFile: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt insecureSkipVerify: true - bearerTokenFile: /var/run/secrets/kubernetes.io/serviceaccount/token honorLabels: true honorTimestamps: true interval: 10s metricRelabelings: - action: drop regex: container_cpu_(cfs_throttled_seconds_total|load_average_10s|system_seconds_total|user_seconds_total) sourceLabels: - __name__ - action: drop regex: container_fs_(io_current|io_time_seconds_total|io_time_weighted_seconds_total|reads_merged_total|sector_reads_total|sector_writes_total|writes_merged_total) sourceLabels: - __name__ - action: drop regex: container_memory_(mapped_file|swap) sourceLabels: - __name__ - action: drop regex: container_(file_descriptors|tasks_state|threads_max) sourceLabels: - __name__ - action: drop regex: container_memory_failures_total;hierarchy sourceLabels: - __name__ - scope - action: drop regex: "container_network_.*;(cali|cilium|cni|lxc|nodelocaldns|tunl).*" sourceLabels: - __name__ - interface - action: drop regex: "container_spec.*" sourceLabels: - __name__ - action: drop regex: .+; sourceLabels: - id - pod path: /metrics/cadvisor port: https-metrics relabelings: - action: replace sourceLabels: - __metrics_path__ targetLabel: metrics_path scheme: https tlsConfig: caFile: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt insecureSkipVerify: true trackTimestampsStaleness: true - bearerTokenFile: /var/run/secrets/kubernetes.io/serviceaccount/token honorLabels: true honorTimestamps: true path: /metrics/probes port: https-metrics relabelings: - action: replace sourceLabels: - __metrics_path__ targetLabel: metrics_path scheme: https tlsConfig: caFile: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt insecureSkipVerify: true jobLabel: k8s-app namespaceSelector: matchNames: - kube-system selector: matchLabels: app.kubernetes.io/name: kubelet k8s-app: kubelet (root level) + one document added: apiVersion: monitoring.coreos.com/v1 kind: ServiceMonitor metadata: name: kube-prometheus-stack-operator namespace: monitoring labels: app: kube-prometheus-stack-operator app.kubernetes.io/component: prometheus-operator app.kubernetes.io/instance: kube-prometheus-stack app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: kube-prometheus-stack-prometheus-operator app.kubernetes.io/part-of: kube-prometheus-stack helm.toolkit.fluxcd.io/name: kube-prometheus-stack helm.toolkit.fluxcd.io/namespace: flux-system heritage: Helm release: kube-prometheus-stack spec: endpoints: - honorLabels: true port: https scheme: https tlsConfig: ca: secret: name: kube-prometheus-stack-admission key: ca optional: false serverName: kube-prometheus-stack-operator namespaceSelector: matchNames: - monitoring selector: matchLabels: app: kube-prometheus-stack-operator release: kube-prometheus-stack (root level) + one document added: apiVersion: monitoring.coreos.com/v1 kind: ServiceMonitor metadata: name: kube-prometheus-stack-prometheus namespace: monitoring labels: app: kube-prometheus-stack-prometheus app.kubernetes.io/instance: kube-prometheus-stack app.kubernetes.io/managed-by: Helm app.kubernetes.io/part-of: kube-prometheus-stack helm.toolkit.fluxcd.io/name: kube-prometheus-stack helm.toolkit.fluxcd.io/namespace: flux-system heritage: Helm release: kube-prometheus-stack spec: endpoints: - path: /metrics port: http-web - path: /metrics port: reloader-web namespaceSelector: matchNames: - monitoring selector: matchLabels: app: kube-prometheus-stack-prometheus release: kube-prometheus-stack self-monitor: "true" (root level) + one document added: apiVersion: v1 kind: ServiceAccount metadata: name: kube-prometheus-stack-admission namespace: monitoring annotations: helm.sh/hook: "pre-install,pre-upgrade,post-install,post-upgrade" helm.sh/hook-delete-policy: "before-hook-creation,hook-succeeded" labels: app: kube-prometheus-stack-admission app.kubernetes.io/component: prometheus-operator-webhook app.kubernetes.io/instance: kube-prometheus-stack app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: kube-prometheus-stack-prometheus-operator app.kubernetes.io/part-of: kube-prometheus-stack heritage: Helm release: kube-prometheus-stack automountServiceAccountToken: true (root level) + one document added: apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: name: kube-prometheus-stack-admission annotations: helm.sh/hook: "pre-install,pre-upgrade,post-install,post-upgrade" helm.sh/hook-delete-policy: "before-hook-creation,hook-succeeded" labels: app: kube-prometheus-stack-admission app.kubernetes.io/component: prometheus-operator-webhook app.kubernetes.io/instance: kube-prometheus-stack app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: kube-prometheus-stack-prometheus-operator app.kubernetes.io/part-of: kube-prometheus-stack heritage: Helm release: kube-prometheus-stack rules: - resources: - validatingwebhookconfigurations - mutatingwebhookconfigurations apiGroups: - admissionregistration.k8s.io verbs: - get - update - patch (root level) + one document added: apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding metadata: name: kube-prometheus-stack-admission annotations: helm.sh/hook: "pre-install,pre-upgrade,post-install,post-upgrade" helm.sh/hook-delete-policy: "before-hook-creation,hook-succeeded" labels: app: kube-prometheus-stack-admission app.kubernetes.io/component: prometheus-operator-webhook app.kubernetes.io/instance: kube-prometheus-stack app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: kube-prometheus-stack-prometheus-operator app.kubernetes.io/part-of: kube-prometheus-stack heritage: Helm release: kube-prometheus-stack roleRef: name: kube-prometheus-stack-admission apiGroup: rbac.authorization.k8s.io kind: ClusterRole subjects: - name: kube-prometheus-stack-admission kind: ServiceAccount namespace: monitoring (root level) + one document added: apiVersion: rbac.authorization.k8s.io/v1 kind: Role metadata: name: kube-prometheus-stack-admission namespace: monitoring annotations: helm.sh/hook: "pre-install,pre-upgrade,post-install,post-upgrade" helm.sh/hook-delete-policy: "before-hook-creation,hook-succeeded" labels: app: kube-prometheus-stack-admission app.kubernetes.io/component: prometheus-operator-webhook app.kubernetes.io/instance: kube-prometheus-stack app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: kube-prometheus-stack-prometheus-operator app.kubernetes.io/part-of: kube-prometheus-stack heritage: Helm release: kube-prometheus-stack rules: - resources: - secrets apiGroups: - verbs: - get - create (root level) + one document added: apiVersion: rbac.authorization.k8s.io/v1 kind: RoleBinding metadata: name: kube-prometheus-stack-admission namespace: monitoring annotations: helm.sh/hook: "pre-install,pre-upgrade,post-install,post-upgrade" helm.sh/hook-delete-policy: "before-hook-creation,hook-succeeded" labels: app: kube-prometheus-stack-admission app.kubernetes.io/component: prometheus-operator-webhook app.kubernetes.io/instance: kube-prometheus-stack app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: kube-prometheus-stack-prometheus-operator app.kubernetes.io/part-of: kube-prometheus-stack heritage: Helm release: kube-prometheus-stack roleRef: name: kube-prometheus-stack-admission apiGroup: rbac.authorization.k8s.io kind: Role subjects: - name: kube-prometheus-stack-admission kind: ServiceAccount namespace: monitoring (root level) + one document added: apiVersion: batch/v1 kind: Job metadata: name: kube-prometheus-stack-admission-create namespace: monitoring annotations: helm.sh/hook: "pre-install,pre-upgrade" helm.sh/hook-delete-policy: "before-hook-creation,hook-succeeded" labels: app: kube-prometheus-stack-admission-create app.kubernetes.io/component: prometheus-operator-webhook app.kubernetes.io/instance: kube-prometheus-stack app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: kube-prometheus-stack-prometheus-operator app.kubernetes.io/part-of: kube-prometheus-stack heritage: Helm release: kube-prometheus-stack spec: template: metadata: name: kube-prometheus-stack-admission-create labels: app: kube-prometheus-stack-admission-create app.kubernetes.io/component: prometheus-operator-webhook app.kubernetes.io/instance: kube-prometheus-stack app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: kube-prometheus-stack-prometheus-operator app.kubernetes.io/part-of: kube-prometheus-stack heritage: Helm release: kube-prometheus-stack spec: containers: - name: create image: "ghcr.io/jkroepke/kube-webhook-certgen:1.8.4" imagePullPolicy: IfNotPresent resources: {} args: - create - "--host=kube-prometheus-stack-operator,kube-prometheus-stack-operator.monitoring.svc" - "--namespace=monitoring" - "--secret-name=kube-prometheus-stack-admission" securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL readOnlyRootFilesystem: true restartPolicy: OnFailure securityContext: runAsGroup: 2000 runAsNonRoot: true runAsUser: 2000 seccompProfile: type: RuntimeDefault serviceAccountName: kube-prometheus-stack-admission ttlSecondsAfterFinished: 60 (root level) + one document added: apiVersion: batch/v1 kind: Job metadata: name: kube-prometheus-stack-admission-patch namespace: monitoring annotations: helm.sh/hook: "post-install,post-upgrade" helm.sh/hook-delete-policy: "before-hook-creation,hook-succeeded" labels: app: kube-prometheus-stack-admission-patch app.kubernetes.io/component: prometheus-operator-webhook app.kubernetes.io/instance: kube-prometheus-stack app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: kube-prometheus-stack-prometheus-operator app.kubernetes.io/part-of: kube-prometheus-stack heritage: Helm release: kube-prometheus-stack spec: template: metadata: name: kube-prometheus-stack-admission-patch labels: app: kube-prometheus-stack-admission-patch app.kubernetes.io/component: prometheus-operator-webhook app.kubernetes.io/instance: kube-prometheus-stack app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: kube-prometheus-stack-prometheus-operator app.kubernetes.io/part-of: kube-prometheus-stack heritage: Helm release: kube-prometheus-stack spec: containers: - name: patch image: "ghcr.io/jkroepke/kube-webhook-certgen:1.8.4" imagePullPolicy: IfNotPresent resources: {} args: - patch - "--webhook-name=kube-prometheus-stack-admission" - "--namespace=monitoring" - "--secret-name=kube-prometheus-stack-admission" - "--patch-failure-policy=" securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL readOnlyRootFilesystem: true restartPolicy: OnFailure securityContext: runAsGroup: 2000 runAsNonRoot: true runAsUser: 2000 seccompProfile: type: RuntimeDefault serviceAccountName: kube-prometheus-stack-admission ttlSecondsAfterFinished: 60 (root level) + one document added: apiVersion: networking.k8s.io/v1 kind: NetworkPolicy metadata: name: local-ai-valkey namespace: local-ai labels: app.kubernetes.io/instance: local-ai-valkey app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: valkey app.kubernetes.io/part-of: valkey helm.toolkit.fluxcd.io/name: local-ai-valkey helm.toolkit.fluxcd.io/namespace: flux-system spec: egress: - ingress: - ports: - port: 6379 podSelector: matchLabels: app.kubernetes.io/instance: local-ai-valkey app.kubernetes.io/name: valkey policyTypes: - Ingress - Egress (root level) + one document added: apiVersion: policy/v1 kind: PodDisruptionBudget metadata: name: local-ai-valkey-primary namespace: local-ai labels: app.kubernetes.io/component: primary app.kubernetes.io/instance: local-ai-valkey app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: valkey helm.toolkit.fluxcd.io/name: local-ai-valkey helm.toolkit.fluxcd.io/namespace: flux-system spec: maxUnavailable: 1 selector: matchLabels: app.kubernetes.io/component: primary app.kubernetes.io/instance: local-ai-valkey app.kubernetes.io/name: valkey (root level) + one document added: apiVersion: v1 kind: ServiceAccount metadata: name: local-ai-valkey-primary namespace: local-ai labels: app.kubernetes.io/instance: local-ai-valkey app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: valkey app.kubernetes.io/part-of: valkey helm.toolkit.fluxcd.io/name: local-ai-valkey helm.toolkit.fluxcd.io/namespace: flux-system automountServiceAccountToken: false (root level) + one document added: apiVersion: v1 kind: ConfigMap metadata: name: local-ai-valkey-configuration namespace: local-ai labels: app.kubernetes.io/instance: local-ai-valkey app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: valkey app.kubernetes.io/part-of: valkey helm.toolkit.fluxcd.io/name: local-ai-valkey helm.toolkit.fluxcd.io/namespace: flux-system data: primary.conf: | dir /data # User-supplied primary configuration: rename-command FLUSHDB "" rename-command FLUSHALL "" # End of primary configuration replica.conf: | dir /data # User-supplied replica configuration: rename-command FLUSHDB "" rename-command FLUSHALL "" # End of replica configuration valkey.conf: | # User-supplied common configuration: # Enable AOF https://valkey.io/docs/topics/persistence.html appendonly yes # Disable RDB persistence, AOF persistence already enabled. save "" # End of common configuration (root level) + one document added: apiVersion: v1 kind: ConfigMap metadata: name: local-ai-valkey-health namespace: local-ai labels: app.kubernetes.io/instance: local-ai-valkey app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: valkey helm.toolkit.fluxcd.io/name: local-ai-valkey helm.toolkit.fluxcd.io/namespace: flux-system data: ping_liveness_local.sh: | #!/bin/bash [[ -f $VALKEY_PASSWORD_FILE ]] && export VALKEY_PASSWORD="$(< "${VALKEY_PASSWORD_FILE}")" [[ -n "$VALKEY_PASSWORD" ]] && export REDISCLI_AUTH="$VALKEY_PASSWORD" response=$( timeout -s 15 $1 \ valkey-cli \ -h localhost \ -p $VALKEY_PORT \ ping ) if [ "$?" -eq "124" ]; then echo "Timed out" exit 1 fi responseFirstWord=$(echo $response | head -n1 | awk '{print $1;}') if [ "$response" != "PONG" ] && [ "$responseFirstWord" != "LOADING" ] && [ "$responseFirstWord" != "MASTERDOWN" ]; then echo "$response" exit 1 fi ping_liveness_local_and_primary.sh: | script_dir="$(dirname "$0")" exit_status=0 "$script_dir/ping_liveness_local.sh" $1 || exit_status=$? "$script_dir/ping_liveness_primary.sh" $1 || exit_status=$? exit $exit_status ping_liveness_primary.sh: | #!/bin/bash [[ -f $VALKEY_PRIMARY_PASSWORD_FILE ]] && export VALKEY_PRIMARY_PASSWORD="$(< "${VALKEY_PRIMARY_PASSWORD_FILE}")" [[ -n "$VALKEY_PRIMARY_PASSWORD" ]] && export REDISCLI_AUTH="$VALKEY_PRIMARY_PASSWORD" response=$( timeout -s 15 $1 \ valkey-cli \ -h $VALKEY_PRIMARY_HOST \ -p $VALKEY_PRIMARY_PORT_NUMBER \ ping ) if [ "$?" -eq "124" ]; then echo "Timed out" exit 1 fi responseFirstWord=$(echo $response | head -n1 | awk '{print $1;}') if [ "$response" != "PONG" ] && [ "$responseFirstWord" != "LOADING" ]; then echo "$response" exit 1 fi ping_readiness_local.sh: | #!/bin/bash [[ -f $VALKEY_PASSWORD_FILE ]] && export VALKEY_PASSWORD="$(< "${VALKEY_PASSWORD_FILE}")" [[ -n "$VALKEY_PASSWORD" ]] && export REDISCLI_AUTH="$VALKEY_PASSWORD" response=$( timeout -s 15 $1 \ valkey-cli \ -h localhost \ -p $VALKEY_PORT \ ping ) if [ "$?" -eq "124" ]; then echo "Timed out" exit 1 fi if [ "$response" != "PONG" ]; then echo "$response" exit 1 fi ping_readiness_local_and_primary.sh: | script_dir="$(dirname "$0")" exit_status=0 "$script_dir/ping_readiness_local.sh" $1 || exit_status=$? "$script_dir/ping_readiness_primary.sh" $1 || exit_status=$? exit $exit_status ping_readiness_primary.sh: | #!/bin/bash [[ -f $VALKEY_PRIMARY_PASSWORD_FILE ]] && export VALKEY_PRIMARY_PASSWORD="$(< "${VALKEY_PRIMARY_PASSWORD_FILE}")" [[ -n "$VALKEY_PRIMARY_PASSWORD" ]] && export REDISCLI_AUTH="$VALKEY_PRIMARY_PASSWORD" response=$( timeout -s 15 $1 \ valkey-cli \ -h $VALKEY_PRIMARY_HOST \ -p $VALKEY_PRIMARY_PORT_NUMBER \ ping ) if [ "$?" -eq "124" ]; then echo "Timed out" exit 1 fi if [ "$response" != "PONG" ]; then echo "$response" exit 1 fi (root level) + one document added: apiVersion: v1 kind: ConfigMap metadata: name: local-ai-valkey-scripts namespace: local-ai labels: app.kubernetes.io/instance: local-ai-valkey app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: valkey app.kubernetes.io/part-of: valkey helm.toolkit.fluxcd.io/name: local-ai-valkey helm.toolkit.fluxcd.io/namespace: flux-system data: start-primary.sh: | #!/bin/bash [[ -f $VALKEY_PASSWORD_FILE ]] && export VALKEY_PASSWORD="$(< "${VALKEY_PASSWORD_FILE}")" if [[ -f /opt/bitnami/valkey/mounted-etc/primary.conf ]];then cp /opt/bitnami/valkey/mounted-etc/primary.conf /opt/bitnami/valkey/etc/primary.conf fi if [[ -f /opt/bitnami/valkey/mounted-etc/valkey.conf ]];then cp /opt/bitnami/valkey/mounted-etc/valkey.conf /opt/bitnami/valkey/etc/valkey.conf fi ARGS=("--port" "${VALKEY_PORT}") ARGS+=("--protected-mode" "no") ARGS+=("--include" "/opt/bitnami/valkey/etc/valkey.conf") ARGS+=("--include" "/opt/bitnami/valkey/etc/primary.conf") exec valkey-server "${ARGS[@]}" (root level) + one document added: apiVersion: v1 kind: Service metadata: name: local-ai-valkey-headless namespace: local-ai labels: app.kubernetes.io/instance: local-ai-valkey app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: valkey app.kubernetes.io/part-of: valkey helm.toolkit.fluxcd.io/name: local-ai-valkey helm.toolkit.fluxcd.io/namespace: flux-system spec: type: ClusterIP clusterIP: None selector: app.kubernetes.io/instance: local-ai-valkey app.kubernetes.io/name: valkey ports: - name: tcp-redis port: 6379 targetPort: redis (root level) + one document added: apiVersion: v1 kind: Service metadata: name: local-ai-valkey-primary namespace: local-ai labels: app.kubernetes.io/component: primary app.kubernetes.io/instance: local-ai-valkey app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: valkey app.kubernetes.io/part-of: valkey helm.toolkit.fluxcd.io/name: local-ai-valkey helm.toolkit.fluxcd.io/namespace: flux-system spec: type: ClusterIP internalTrafficPolicy: Cluster selector: app.kubernetes.io/component: primary app.kubernetes.io/instance: local-ai-valkey app.kubernetes.io/name: valkey ports: - name: tcp-redis nodePort: null port: 6379 targetPort: redis (root level) + one document added: apiVersion: apps/v1 kind: StatefulSet metadata: name: local-ai-valkey-primary namespace: local-ai labels: app.kubernetes.io/component: primary app.kubernetes.io/instance: local-ai-valkey app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: valkey app.kubernetes.io/part-of: valkey helm.toolkit.fluxcd.io/name: local-ai-valkey helm.toolkit.fluxcd.io/namespace: flux-system spec: replicas: 1 selector: matchLabels: app.kubernetes.io/component: primary app.kubernetes.io/instance: local-ai-valkey app.kubernetes.io/name: valkey serviceName: local-ai-valkey-headless template: metadata: labels: app.kubernetes.io/component: primary app.kubernetes.io/instance: local-ai-valkey app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: valkey spec: affinity: nodeAffinity: null podAffinity: null podAntiAffinity: preferredDuringSchedulingIgnoredDuringExecution: - podAffinityTerm: labelSelector: matchLabels: app.kubernetes.io/component: primary app.kubernetes.io/instance: local-ai-valkey app.kubernetes.io/name: valkey topologyKey: kubernetes.io/hostname weight: 1 automountServiceAccountToken: false containers: - name: valkey image: "registry-1.docker.io/bitnami/valkey:latest" imagePullPolicy: IfNotPresent args: - "-c" - /opt/bitnami/scripts/start-scripts/start-primary.sh command: - /bin/bash env: - name: BITNAMI_DEBUG value: "false" - name: VALKEY_REPLICATION_MODE value: primary - name: ALLOW_EMPTY_PASSWORD value: yes - name: OPENSSL_FIPS value: yes - name: VALKEY_TLS_ENABLED value: no - name: VALKEY_PORT value: "6379" ports: - name: redis containerPort: 6379 resources: limits: cpu: 150m ephemeral-storage: 2Gi memory: 192Mi requests: cpu: 100m ephemeral-storage: 50Mi memory: 128Mi volumeMounts: - name: start-scripts mountPath: /opt/bitnami/scripts/start-scripts - name: health mountPath: /health - name: valkey-data mountPath: /data - name: config mountPath: /opt/bitnami/valkey/mounted-etc - name: empty-dir mountPath: /opt/bitnami/valkey/etc/ subPath: app-conf-dir - name: empty-dir mountPath: /tmp subPath: tmp-dir livenessProbe: exec: command: - sh - "-c" - "/health/ping_liveness_local.sh 5" failureThreshold: 5 initialDelaySeconds: 20 periodSeconds: 5 successThreshold: 1 timeoutSeconds: 6 readinessProbe: exec: command: - sh - "-c" - "/health/ping_readiness_local.sh 1" failureThreshold: 5 initialDelaySeconds: 20 periodSeconds: 5 successThreshold: 1 timeoutSeconds: 2 securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL readOnlyRootFilesystem: true runAsGroup: 1001 runAsNonRoot: true runAsUser: 1001 seLinuxOptions: {} seccompProfile: type: RuntimeDefault enableServiceLinks: true securityContext: fsGroup: 1001 fsGroupChangePolicy: Always supplementalGroups: [] sysctls: [] serviceAccountName: local-ai-valkey-primary terminationGracePeriodSeconds: 30 volumes: - name: start-scripts configMap: name: local-ai-valkey-scripts defaultMode: 493 - name: health configMap: name: local-ai-valkey-health defaultMode: 493 - name: config configMap: name: local-ai-valkey-configuration - name: empty-dir emptyDir: {} updateStrategy: type: RollingUpdate volumeClaimTemplates: - apiVersion: v1 kind: PersistentVolumeClaim metadata: name: valkey-data labels: app.kubernetes.io/component: primary app.kubernetes.io/instance: local-ai-valkey app.kubernetes.io/name: valkey spec: resources: requests: storage: 8Gi storageClassName: longhorn accessModes: - ReadWriteOnce (root level) + one document added: apiVersion: scheduling.k8s.io/v1 kind: PriorityClass metadata: name: longhorn-critical labels: app.kubernetes.io/instance: longhorn app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: longhorn helm.toolkit.fluxcd.io/name: longhorn helm.toolkit.fluxcd.io/namespace: flux-system description: "Ensure Longhorn pods have the highest priority to prevent any unexpected eviction by the Kubernetes scheduler under node pressure" globalDefault: false preemptionPolicy: PreemptLowerPriority value: 1000000000 (root level) + one document added: apiVersion: v1 kind: ServiceAccount metadata: name: longhorn-service-account namespace: longhorn-system labels: app.kubernetes.io/instance: longhorn app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: longhorn helm.toolkit.fluxcd.io/name: longhorn helm.toolkit.fluxcd.io/namespace: flux-system (root level) + one document added: apiVersion: v1 kind: ServiceAccount metadata: name: longhorn-ui-service-account namespace: longhorn-system labels: app.kubernetes.io/instance: longhorn app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: longhorn helm.toolkit.fluxcd.io/name: longhorn helm.toolkit.fluxcd.io/namespace: flux-system (root level) + one document added: apiVersion: v1 kind: ServiceAccount metadata: name: longhorn-support-bundle namespace: longhorn-system labels: app.kubernetes.io/instance: longhorn app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: longhorn helm.toolkit.fluxcd.io/name: longhorn helm.toolkit.fluxcd.io/namespace: flux-system (root level) + one document added: apiVersion: v1 kind: ConfigMap metadata: name: longhorn-default-resource namespace: longhorn-system labels: app.kubernetes.io/instance: longhorn app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: longhorn helm.toolkit.fluxcd.io/name: longhorn helm.toolkit.fluxcd.io/namespace: flux-system data: default-resource.yaml: "backup-target: nfs://brickyard.home.arpa:/volume1/k8s/longhorn-backups" (root level) + one document added: apiVersion: v1 kind: ConfigMap metadata: name: longhorn-default-setting namespace: longhorn-system labels: app.kubernetes.io/instance: longhorn app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: longhorn helm.toolkit.fluxcd.io/name: longhorn helm.toolkit.fluxcd.io/namespace: flux-system data: default-setting.yaml: | priority-class: "longhorn-critical" disable-revision-counter: "{\"v1\":\"true\"}" (root level) + one document added: apiVersion: v1 kind: ConfigMap metadata: name: longhorn-storageclass namespace: longhorn-system labels: app.kubernetes.io/instance: longhorn app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: longhorn helm.toolkit.fluxcd.io/name: longhorn helm.toolkit.fluxcd.io/namespace: flux-system data: storageclass.yaml: | kind: StorageClass apiVersion: storage.k8s.io/v1 metadata: name: longhorn annotations: storageclass.kubernetes.io/is-default-class: "true" provisioner: driver.longhorn.io allowVolumeExpansion: true reclaimPolicy: "Delete" volumeBindingMode: Immediate parameters: numberOfReplicas: "2" staleReplicaTimeout: "30" fromBackup: "" fsType: "ext4" migratable: "true" dataLocality: "best-effort" unmapMarkSnapChainRemoved: "ignored" disableRevisionCounter: "true" dataEngine: "v1" backupTargetName: "default" (root level) + one document added: apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: name: longhorn-role labels: app.kubernetes.io/instance: longhorn app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: longhorn helm.toolkit.fluxcd.io/name: longhorn helm.toolkit.fluxcd.io/namespace: flux-system rules: - resources: - customresourcedefinitions apiGroups: - apiextensions.k8s.io verbs: - "*" - resources: - pods apiGroups: - verbs: - get - list - watch - delete - deletecollection - resources: - secrets - services - endpoints - configmaps - serviceaccounts - pods/log apiGroups: - verbs: - get - list - watch - resources: - events - persistentvolumes - persistentvolumeclaims - persistentvolumeclaims/status - nodes apiGroups: - verbs: - "*" - resources: - namespaces apiGroups: - verbs: - get - list - resources: - daemonsets - statefulsets - deployments - replicasets apiGroups: - apps verbs: - get - list - watch - resources: - jobs - cronjobs apiGroups: - batch verbs: - get - list - watch - resources: - poddisruptionbudgets apiGroups: - policy verbs: - get - list - watch - resources: - priorityclasses apiGroups: - scheduling.k8s.io verbs: - watch - list - resources: - storageclasses - volumeattachments - volumeattachments/status - volumeattributesclasses - csinodes - csidrivers - csistoragecapacities apiGroups: - storage.k8s.io verbs: - "*" - resources: - volumesnapshotclasses - volumesnapshots - volumesnapshotcontents - volumesnapshotcontents/status apiGroups: - snapshot.storage.k8s.io verbs: - "*" - resources: - volumes - volumes/status - enginefrontends - enginefrontends/status - engines - engines/status - replicas - replicas/status - settings - settings/status - engineimages - engineimages/status - nodes - nodes/status - instancemanagers - instancemanagers/status - sharemanagers - sharemanagers/status - backingimages - backingimages/status - backingimagemanagers - backingimagemanagers/status - backingimagedatasources - backingimagedatasources/status - backuptargets - backuptargets/status - backupvolumes - backupvolumes/status - backups - backups/status - recurringjobs - recurringjobs/status - orphans - orphans/status - snapshots - snapshots/status - supportbundles - supportbundles/status - systembackups - systembackups/status - systemrestores - systemrestores/status - volumeattachments - volumeattachments/status - backupbackingimages - backupbackingimages/status apiGroups: - longhorn.io verbs: - "*" - resources: - leases apiGroups: - coordination.k8s.io verbs: - get - list - watch - resources: - pods - nodes apiGroups: - metrics.k8s.io verbs: - get - list - resources: - apiservices apiGroups: - apiregistration.k8s.io verbs: - list - watch - resources: - mutatingwebhookconfigurations - validatingwebhookconfigurations apiGroups: - admissionregistration.k8s.io verbs: - get - list - create - patch - delete - resources: - roles - rolebindings apiGroups: - rbac.authorization.k8s.io verbs: - get - list - watch - resources: - endpointslices apiGroups: - discovery.k8s.io verbs: - get - list - watch - resources: - clusterrolebindings - clusterroles apiGroups: - rbac.authorization.k8s.io verbs: - "*" (root level) + one document added: apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding metadata: name: longhorn-bind labels: app.kubernetes.io/instance: longhorn app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: longhorn helm.toolkit.fluxcd.io/name: longhorn helm.toolkit.fluxcd.io/namespace: flux-system roleRef: name: longhorn-role apiGroup: rbac.authorization.k8s.io kind: ClusterRole subjects: - name: longhorn-service-account kind: ServiceAccount namespace: longhorn-system (root level) + one document added: apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding metadata: name: longhorn-support-bundle labels: app.kubernetes.io/instance: longhorn app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: longhorn helm.toolkit.fluxcd.io/name: longhorn helm.toolkit.fluxcd.io/namespace: flux-system roleRef: name: cluster-admin apiGroup: rbac.authorization.k8s.io kind: ClusterRole subjects: - name: longhorn-support-bundle kind: ServiceAccount namespace: longhorn-system (root level) + one document added: apiVersion: rbac.authorization.k8s.io/v1 kind: Role metadata: name: longhorn namespace: longhorn-system labels: app.kubernetes.io/instance: longhorn app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: longhorn helm.toolkit.fluxcd.io/name: longhorn helm.toolkit.fluxcd.io/namespace: flux-system rules: - resources: - pods - pods/log - events - secrets - services - endpoints - configmaps - serviceaccounts - persistentvolumeclaims - persistentvolumeclaims/status apiGroups: - verbs: - "*" - resources: - daemonsets - deployments - statefulsets - replicasets apiGroups: - apps verbs: - "*" - resources: - jobs - cronjobs apiGroups: - batch verbs: - "*" - resources: - poddisruptionbudgets apiGroups: - policy verbs: - "*" - resources: - leases apiGroups: - coordination.k8s.io verbs: - "*" - resources: - roles - rolebindings apiGroups: - rbac.authorization.k8s.io verbs: - "*" - resources: - endpointslices apiGroups: - discovery.k8s.io verbs: - "*" (root level) + one document added: apiVersion: rbac.authorization.k8s.io/v1 kind: RoleBinding metadata: name: longhorn namespace: longhorn-system labels: helm.toolkit.fluxcd.io/name: longhorn helm.toolkit.fluxcd.io/namespace: flux-system roleRef: name: longhorn apiGroup: rbac.authorization.k8s.io kind: Role subjects: - name: longhorn-service-account kind: ServiceAccount namespace: longhorn-system (root level) + one document added: apiVersion: v1 kind: Service metadata: name: longhorn-backend namespace: longhorn-system labels: app: longhorn-manager app.kubernetes.io/instance: longhorn app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: longhorn helm.toolkit.fluxcd.io/name: longhorn helm.toolkit.fluxcd.io/namespace: flux-system spec: type: ClusterIP selector: app: longhorn-manager ports: - name: manager port: 9500 targetPort: manager (root level) + one document added: apiVersion: v1 kind: Service metadata: name: longhorn-frontend namespace: longhorn-system labels: app: longhorn-ui app.kubernetes.io/instance: longhorn app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: longhorn helm.toolkit.fluxcd.io/name: longhorn helm.toolkit.fluxcd.io/namespace: flux-system spec: type: ClusterIP selector: app: longhorn-ui ports: - name: http nodePort: null port: 80 targetPort: http (root level) + one document added: apiVersion: v1 kind: Service metadata: name: longhorn-admission-webhook namespace: longhorn-system labels: app: longhorn-admission-webhook app.kubernetes.io/instance: longhorn app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: longhorn helm.toolkit.fluxcd.io/name: longhorn helm.toolkit.fluxcd.io/namespace: flux-system spec: type: ClusterIP selector: longhorn.io/admission-webhook: longhorn-admission-webhook ports: - name: admission-webhook port: 9502 targetPort: admission-wh (root level) + one document added: apiVersion: v1 kind: Service metadata: name: longhorn-recovery-backend namespace: longhorn-system labels: app: longhorn-recovery-backend app.kubernetes.io/instance: longhorn app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: longhorn helm.toolkit.fluxcd.io/name: longhorn helm.toolkit.fluxcd.io/namespace: flux-system spec: type: ClusterIP selector: longhorn.io/recovery-backend: longhorn-recovery-backend ports: - name: recovery-backend port: 9503 targetPort: recov-backend (root level) + one document added: apiVersion: apps/v1 kind: DaemonSet metadata: name: longhorn-manager namespace: longhorn-system labels: app: longhorn-manager app.kubernetes.io/instance: longhorn app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: longhorn helm.toolkit.fluxcd.io/name: longhorn helm.toolkit.fluxcd.io/namespace: flux-system spec: selector: matchLabels: app: longhorn-manager template: metadata: labels: app: longhorn-manager app.kubernetes.io/instance: longhorn app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: longhorn spec: containers: - name: longhorn-manager image: "docker.io/longhornio/longhorn-manager:v1.12.0" imagePullPolicy: IfNotPresent command: - longhorn-manager - "-d" - daemon - "--engine-image" - "docker.io/longhornio/longhorn-engine:v1.12.0" - "--instance-manager-image" - "docker.io/longhornio/longhorn-instance-manager:v1.12.0" - "--share-manager-image" - "docker.io/longhornio/longhorn-share-manager:v1.12.0" - "--backing-image-manager-image" - "docker.io/longhornio/backing-image-manager:v1.12.0" - "--support-bundle-manager-image" - "docker.io/longhornio/support-bundle-kit:v0.0.86" - "--manager-image" - "docker.io/longhornio/longhorn-manager:v1.12.0" - "--service-account" - longhorn-service-account - "--upgrade-version-check" securityContext: privileged: true ports: - name: manager containerPort: 9500 - name: admission-wh containerPort: 9502 - name: recov-backend containerPort: 9503 readinessProbe: httpGet: path: /v1/healthz port: 9502 scheme: HTTPS volumeMounts: - name: boot mountPath: /host/boot/ readOnly: true - name: dev mountPath: /host/dev/ - name: proc mountPath: /host/proc/ readOnly: true - name: etc mountPath: /host/etc/ readOnly: true - name: longhorn mountPath: /var/lib/longhorn/ mountPropagation: Bidirectional - name: longhorn-grpc-tls mountPath: /tls-files/ env: - name: POD_NAME valueFrom: fieldRef: fieldPath: metadata.name - name: POD_NAMESPACE valueFrom: fieldRef: fieldPath: metadata.namespace - name: POD_IP valueFrom: fieldRef: fieldPath: status.podIP - name: NODE_NAME valueFrom: fieldRef: fieldPath: spec.nodeName - name: LONGHORN_DISTRO value: longhorn - name: pre-pull-share-manager-image image: "docker.io/longhornio/longhorn-share-manager:v1.12.0" imagePullPolicy: IfNotPresent command: - sh - "-c" - "echo share-manager image pulled && sleep infinity" priorityClassName: longhorn-critical serviceAccountName: longhorn-service-account volumes: - name: boot hostPath: path: /boot/ - name: dev hostPath: path: /dev/ - name: proc hostPath: path: /proc/ - name: etc hostPath: path: /etc/ - name: longhorn hostPath: path: /var/lib/longhorn/ - name: longhorn-grpc-tls secret: optional: true secretName: longhorn-grpc-tls updateStrategy: rollingUpdate: maxUnavailable: 100% (root level) + one document added: apiVersion: apps/v1 kind: Deployment metadata: name: longhorn-driver-deployer namespace: longhorn-system labels: app.kubernetes.io/instance: longhorn app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: longhorn helm.toolkit.fluxcd.io/name: longhorn helm.toolkit.fluxcd.io/namespace: flux-system spec: replicas: 1 selector: matchLabels: app: longhorn-driver-deployer template: metadata: labels: app: longhorn-driver-deployer app.kubernetes.io/instance: longhorn app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: longhorn spec: containers: - name: longhorn-driver-deployer image: "docker.io/longhornio/longhorn-manager:v1.12.0" imagePullPolicy: IfNotPresent command: - longhorn-manager - "-d" - deploy-driver - "--manager-image" - "docker.io/longhornio/longhorn-manager:v1.12.0" - "--manager-url" - "http://longhorn-backend:9500/v1" env: - name: POD_NAMESPACE valueFrom: fieldRef: fieldPath: metadata.namespace - name: NODE_NAME valueFrom: fieldRef: fieldPath: spec.nodeName - name: SERVICE_ACCOUNT valueFrom: fieldRef: fieldPath: spec.serviceAccountName - name: CSI_ATTACHER_IMAGE value: "docker.io/longhornio/csi-attacher:v4.12.0" - name: CSI_PROVISIONER_IMAGE value: "docker.io/longhornio/csi-provisioner:v5.3.0-20260514" - name: CSI_NODE_DRIVER_REGISTRAR_IMAGE value: "docker.io/longhornio/csi-node-driver-registrar:v2.17.0" - name: CSI_RESIZER_IMAGE value: "docker.io/longhornio/csi-resizer:v2.1.0-20260514" - name: CSI_SNAPSHOTTER_IMAGE value: "docker.io/longhornio/csi-snapshotter:v8.5.0-20260514" - name: CSI_LIVENESS_PROBE_IMAGE value: "docker.io/longhornio/livenessprobe:v2.19.0" initContainers: - name: wait-longhorn-manager image: "docker.io/longhornio/longhorn-manager:v1.12.0" command: - sh - "-c" - "while [ $(curl -m 1 -s -o /dev/null -w \"%{http_code}\" http://longhorn-backend:9500/v1) != \"200\" ]; do echo waiting; sleep 2; done" priorityClassName: longhorn-critical securityContext: runAsUser: 0 serviceAccountName: longhorn-service-account (root level) + one document added: apiVersion: apps/v1 kind: Deployment metadata: name: longhorn-ui namespace: longhorn-system labels: app: longhorn-ui app.kubernetes.io/instance: longhorn app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: longhorn helm.toolkit.fluxcd.io/name: longhorn helm.toolkit.fluxcd.io/namespace: flux-system spec: replicas: 2 selector: matchLabels: app: longhorn-ui template: metadata: labels: app: longhorn-ui app.kubernetes.io/instance: longhorn app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: longhorn spec: affinity: podAntiAffinity: preferredDuringSchedulingIgnoredDuringExecution: - podAffinityTerm: labelSelector: matchExpressions: - key: app operator: In values: - longhorn-ui topologyKey: kubernetes.io/hostname weight: 1 containers: - name: longhorn-ui image: "docker.io/longhornio/longhorn-ui:v1.12.0" imagePullPolicy: IfNotPresent env: - name: LONGHORN_MANAGER_IP value: "http://longhorn-backend:9500" - name: LONGHORN_UI_PORT value: "8000" ports: - name: http containerPort: 8000 volumeMounts: - name: nginx-cache mountPath: /var/cache/nginx/ - name: nginx-config mountPath: /var/config/nginx/ - name: var-run mountPath: /var/run/ priorityClassName: longhorn-critical serviceAccountName: longhorn-ui-service-account volumes: - name: nginx-cache emptyDir: {} - name: nginx-config emptyDir: {} - name: var-run emptyDir: {} (root level) + one document added: apiVersion: monitoring.coreos.com/v1 kind: ServiceMonitor metadata: name: longhorn-prometheus-servicemonitor namespace: longhorn-system labels: name: longhorn-prometheus-servicemonitor app.kubernetes.io/instance: longhorn app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: longhorn helm.toolkit.fluxcd.io/name: longhorn helm.toolkit.fluxcd.io/namespace: flux-system spec: endpoints: - port: manager namespaceSelector: matchNames: - longhorn-system selector: matchLabels: app: longhorn-manager (root level) + one document added: apiVersion: batch/v1 kind: Job metadata: name: longhorn-post-upgrade namespace: longhorn-system annotations: helm.sh/hook: post-upgrade helm.sh/hook-delete-policy: "hook-succeeded,before-hook-creation" labels: app.kubernetes.io/instance: longhorn app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: longhorn spec: activeDeadlineSeconds: 900 backoffLimit: 1 template: metadata: name: longhorn-post-upgrade labels: app.kubernetes.io/instance: longhorn app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: longhorn spec: containers: - name: longhorn-post-upgrade image: "docker.io/longhornio/longhorn-manager:v1.12.0" imagePullPolicy: IfNotPresent command: - longhorn-manager - post-upgrade env: - name: POD_NAMESPACE valueFrom: fieldRef: fieldPath: metadata.namespace priorityClassName: longhorn-critical restartPolicy: OnFailure serviceAccountName: longhorn-service-account (root level) + one document added: apiVersion: batch/v1 kind: Job metadata: name: longhorn-pre-upgrade namespace: longhorn-system annotations: helm.sh/hook: pre-upgrade helm.sh/hook-delete-policy: "hook-succeeded,before-hook-creation,hook-failed" labels: app.kubernetes.io/instance: longhorn app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: longhorn spec: activeDeadlineSeconds: 900 backoffLimit: 1 template: metadata: name: longhorn-pre-upgrade labels: app.kubernetes.io/instance: longhorn app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: longhorn spec: containers: - name: longhorn-pre-upgrade image: "docker.io/longhornio/longhorn-manager:v1.12.0" imagePullPolicy: IfNotPresent command: - longhorn-manager - pre-upgrade securityContext: privileged: true volumeMounts: - name: proc mountPath: /host/proc/ env: - name: LONGHORN_DISTRO value: longhorn - name: POD_NAMESPACE valueFrom: fieldRef: fieldPath: metadata.namespace restartPolicy: OnFailure serviceAccountName: longhorn-service-account volumes: - name: proc hostPath: path: /proc/ (root level) + one document added: apiVersion: batch/v1 kind: Job metadata: name: longhorn-uninstall namespace: longhorn-system annotations: helm.sh/hook: pre-delete helm.sh/hook-delete-policy: "before-hook-creation,hook-succeeded" labels: app.kubernetes.io/instance: longhorn app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: longhorn spec: activeDeadlineSeconds: 900 backoffLimit: 1 template: metadata: name: longhorn-uninstall labels: app.kubernetes.io/instance: longhorn app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: longhorn spec: containers: - name: longhorn-uninstall image: "docker.io/longhornio/longhorn-manager:v1.12.0" imagePullPolicy: IfNotPresent command: - longhorn-manager - uninstall - "--force" env: - name: LONGHORN_NAMESPACE valueFrom: fieldRef: fieldPath: metadata.namespace priorityClassName: longhorn-critical restartPolicy: Never serviceAccountName: longhorn-service-account (root level) + one document added: apiVersion: v1 kind: ServiceAccount metadata: name: memini namespace: local-ai labels: app.kubernetes.io/instance: memini app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: memini helm.toolkit.fluxcd.io/name: memini helm.toolkit.fluxcd.io/namespace: flux-system (root level) + one document added: apiVersion: v1 kind: ConfigMap metadata: name: memini-memini namespace: local-ai annotations: grafana_dashboard_folder: memini meta.helm.sh/release-name: memini meta.helm.sh/release-namespace: local-ai labels: app.kubernetes.io/instance: memini app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: memini grafana_dashboard: "1" helm.toolkit.fluxcd.io/name: memini helm.toolkit.fluxcd.io/namespace: flux-system data: memini.json: | { "annotations": { "list": [] }, "description": "memini \u2014 what the service is actually doing for your agents. Live memory counts, write/recall traffic by tier, consolidation outcomes, store health, embedder & rerank latency & saturation, HTTP surface.", "editable": true, "graphTooltip": 1, "id": null, "links": [], "panels": [ { "id": 1, "type": "row", "title": "Now", "gridPos": { "h": 1, "w": 24, "x": 0, "y": 0 }, "collapsed": false, "panels": [] }, { "id": 2, "type": "stat", "title": "Live memories", "description": "Live (non-superseded, non-expired) memories by tier.", "datasource": { "type": "prometheus", "uid": "${DS_PROMETHEUS}" }, "gridPos": { "h": 6, "w": 6, "x": 0, "y": 1 }, "options": { "colorMode": "value", "graphMode": "area", "justifyMode": "auto", "orientation": "horizontal", "reduceOptions": { "calcs": ["lastNotNull"], "fields": "", "values": false }, "textMode": "auto" }, "targets": [ { "datasource": { "type": "prometheus", "uid": "${DS_PROMETHEUS}" }, "expr": "memini_memories_active", "legendFormat": "{{tier}}", "refId": "A" } ] }, { "id": 3, "type": "stat", "title": "Writes (5m rate)", "description": "Successful Remember calls per second, by tier.", "datasource": { "type": "prometheus", "uid": "${DS_PROMETHEUS}" }, "gridPos": { "h": 6, "w": 6, "x": 6, "y": 1 }, "options": { "colorMode": "value", "graphMode": "area", "justifyMode": "auto", "orientation": "horizontal", "reduceOptions": { "calcs": ["lastNotNull"], "fields": "", "values": false }, "textMode": "auto" }, "fieldConfig": { "defaults": { "unit": "ops" } }, "targets": [ { "datasource": { "type": "prometheus", "uid": "${DS_PROMETHEUS}" }, "expr": "sum by (tier) (rate(memini_remember_results_total{result=\"ok\"}[5m]))", "legendFormat": "{{tier}}", "refId": "A" } ] }, { "id": 4, "type": "stat", "title": "Recalls (5m rate)", "description": "Successful Recall calls per second.", "datasource": { "type": "prometheus", "uid": "${DS_PROMETHEUS}" }, "gridPos": { "h": 6, "w": 6, "x": 12, "y": 1 }, "options": { "colorMode": "value", "graphMode": "area", "justifyMode": "auto", "orientation": "horizontal", "reduceOptions": { "calcs": ["lastNotNull"], "fields": "", "values": false }, "textMode": "auto" }, "fieldConfig": { "defaults": { "unit": "ops" } }, "targets": [ { "datasource": { "type": "prometheus", "uid": "${DS_PROMETHEUS}" }, "expr": "sum(rate(memini_recall_results_total{result=\"ok\"}[5m]))", "legendFormat": "recalls/s", "refId": "A" } ] }, { "id": 18, "type": "stat", "title": "Consolidation queue", "description": "Backlog of memories awaiting async consolidation. Sustained > 0 means the worker can't keep up with Remember writes.", "datasource": { "type": "prometheus", "uid": "${DS_PROMETHEUS}" }, "gridPos": { "h": 6, "w": 6, "x": 18, "y": 1 }, "options": { "colorMode": "value", "graphMode": "area", "justifyMode": "auto", "orientation": "horizontal", "reduceOptions": { "calcs": ["lastNotNull"], "fields": "", "values": false }, "textMode": "auto" }, "fieldConfig": { "defaults": { "unit": "short", "thresholds": { "mode": "absolute", "steps": [ { "color": "green", "value": null }, { "color": "yellow", "value": 50 }, { "color": "red", "value": 500 } ] } } }, "targets": [ { "datasource": { "type": "prometheus", "uid": "${DS_PROMETHEUS}" }, "expr": "memini_consolidate_queue_depth", "legendFormat": "queued", "refId": "A" } ] }, { "id": 5, "type": "row", "title": "Writes & Recalls", "gridPos": { "h": 1, "w": 24, "x": 0, "y": 7 }, "collapsed": false, "panels": [] }, { "id": 6, "type": "timeseries", "title": "Remembers per second (by tier)", "datasource": { "type": "prometheus", "uid": "${DS_PROMETHEUS}" }, "gridPos": { "h": 8, "w": 12, "x": 0, "y": 8 }, "fieldConfig": { "defaults": { "custom": { "drawStyle": "line", "lineInterpolation": "smooth", "fillOpacity": 10, "showPoints": "never" }, "unit": "ops" } }, "options": { "legend": { "displayMode": "table", "placement": "bottom", "showLegend": true, "calcs": ["mean", "max"] }, "tooltip": { "mode": "multi", "sort": "desc" } }, "targets": [ { "datasource": { "type": "prometheus", "uid": "${DS_PROMETHEUS}" }, "expr": "sum by (tier) (rate(memini_remember_results_total{result=\"ok\"}[5m]))", "legendFormat": "{{tier}}", "refId": "A" } ] }, { "id": 7, "type": "timeseries", "title": "Recalls per second (by hit-count bucket)", "description": "How many memories a typical recall returns. '0' means no matches \u2014 investigate if persistent.", "datasource": { "type": "prometheus", "uid": "${DS_PROMETHEUS}" }, "gridPos": { "h": 8, "w": 12, "x": 12, "y": 8 }, "fieldConfig": { "defaults": { "custom": { "drawStyle": "line", "lineInterpolation": "smooth", "fillOpacity": 10, "showPoints": "never" }, "unit": "ops" } }, "options": { "legend": { "displayMode": "table", "placement": "bottom", "showLegend": true, "calcs": ["mean", "max"] }, "tooltip": { "mode": "multi", "sort": "desc" } }, "targets": [ { "datasource": { "type": "prometheus", "uid": "${DS_PROMETHEUS}" }, "expr": "sum by (hits_bucket) (rate(memini_recall_results_total{result=\"ok\"}[5m]))", "legendFormat": "{{hits_bucket}}", "refId": "A" } ] }, { "id": 19, "type": "row", "title": "Retrieval quality", "gridPos": { "h": 1, "w": 24, "x": 0, "y": 16 }, "collapsed": false, "panels": [] }, { "id": 20, "type": "timeseries", "title": "Rerank outcomes by backend", "description": "Per-recall reranker traffic: ok = reranker reordered the fused candidates; fallback = reranker timed out / errored and the fused order was kept.", "datasource": { "type": "prometheus", "uid": "${DS_PROMETHEUS}" }, "gridPos": { "h": 8, "w": 12, "x": 0, "y": 17 }, "fieldConfig": { "defaults": { "custom": { "drawStyle": "line", "lineInterpolation": "smooth", "fillOpacity": 15, "showPoints": "never" }, "unit": "ops" } }, "options": { "legend": { "displayMode": "table", "placement": "bottom", "showLegend": true, "calcs": ["mean", "max"] }, "tooltip": { "mode": "multi", "sort": "desc" } }, "targets": [ { "datasource": { "type": "prometheus", "uid": "${DS_PROMETHEUS}" }, "expr": "sum by (backend, result) (rate(memini_rerank_results_total[5m]))", "legendFormat": "{{backend}}/{{result}}", "refId": "A" } ] }, { "id": 21, "type": "timeseries", "title": "Recall degradation reasons", "description": "Recalls that fell back to keyword-only search because the embedder was slow or errored. embed_timeout = the recall embed budget elapsed; embed_error = the embed call failed.", "datasource": { "type": "prometheus", "uid": "${DS_PROMETHEUS}" }, "gridPos": { "h": 8, "w": 12, "x": 12, "y": 17 }, "fieldConfig": { "defaults": { "custom": { "drawStyle": "line", "lineInterpolation": "smooth", "fillOpacity": 15, "showPoints": "never" }, "unit": "ops" } }, "options": { "legend": { "displayMode": "table", "placement": "bottom", "showLegend": true, "calcs": ["mean", "max"] }, "tooltip": { "mode": "multi", "sort": "desc" } }, "targets": [ { "datasource": { "type": "prometheus", "uid": "${DS_PROMETHEUS}" }, "expr": "sum by (reason) (rate(memini_recall_degraded_total[5m]))", "legendFormat": "{{reason}}", "refId": "A" } ] }, { "id": 22, "type": "timeseries", "title": "Recall reinforcement (best-effort)", "description": "Background access-count bump on recalled memories. Errors are swallowed \u2014 a sustained nonzero error rate means the store write path is unhealthy but recall still served.", "datasource": { "type": "prometheus", "uid": "${DS_PROMETHEUS}" }, "gridPos": { "h": 8, "w": 12, "x": 0, "y": 25 }, "fieldConfig": { "defaults": { "custom": { "drawStyle": "line", "lineInterpolation": "smooth", "fillOpacity": 15, "showPoints": "never" }, "unit": "ops" } }, "options": { "legend": { "displayMode": "table", "placement": "bottom", "showLegend": true, "calcs": ["mean", "max"] }, "tooltip": { "mode": "multi", "sort": "desc" } }, "targets": [ { "datasource": { "type": "prometheus", "uid": "${DS_PROMETHEUS}" }, "expr": "sum by (result) (rate(memini_reinforce_results_total[5m]))", "legendFormat": "{{result}}", "refId": "A" } ] }, { "id": 23, "type": "stat", "title": "Recall success ratio", "description": "Fraction of recall calls that succeeded. A drop means the recall path is erroring (embed + keyword + rerank + RRF + everything).", "datasource": { "type": "prometheus", "uid": "${DS_PROMETHEUS}" }, "gridPos": { "h": 8, "w": 12, "x": 12, "y": 25 }, "options": { "colorMode": "value", "graphMode": "area", "reduceOptions": { "calcs": ["lastNotNull"], "fields": "", "values": false }, "textMode": "auto" }, "fieldConfig": { "defaults": { "unit": "percentunit", "min": 0, "max": 1, "thresholds": { "mode": "absolute", "steps": [ { "color": "red", "value": null }, { "color": "yellow", "value": 0.95 }, { "color": "green", "value": 0.99 } ] } } }, "targets": [ { "datasource": { "type": "prometheus", "uid": "${DS_PROMETHEUS}" }, "expr": "sum(rate(memini_recall_results_total{result=\"ok\"}[15m])) / clamp_min(sum(rate(memini_recall_results_total[15m])), 1e-9)", "legendFormat": "ok ratio", "refId": "A" } ] }, { "id": 8, "type": "row", "title": "Consolidation (LLM dedup)", "gridPos": { "h": 1, "w": 24, "x": 0, "y": 33 }, "collapsed": false, "panels": [] }, { "id": 9, "type": "timeseries", "title": "Consolidation outcomes per minute", "description": "gated = similarity gate skipped the LLM; new = nothing to merge; update = merged into an existing memory; supersede = contradiction-tombstoned an old one; noop = nothing to do; error/dropped = failure modes.", "datasource": { "type": "prometheus", "uid": "${DS_PROMETHEUS}" }, "gridPos": { "h": 8, "w": 16, "x": 0, "y": 34 }, "fieldConfig": { "defaults": { "custom": { "drawStyle": "line", "lineInterpolation": "smooth", "fillOpacity": 20, "showPoints": "never", "stacking": { "mode": "normal" } }, "unit": "ops" } }, "options": { "legend": { "displayMode": "table", "placement": "right", "showLegend": true, "calcs": ["sum"] }, "tooltip": { "mode": "multi", "sort": "desc" } }, "targets": [ { "datasource": { "type": "prometheus", "uid": "${DS_PROMETHEUS}" }, "expr": "sum by (result) (rate(memini_consolidate_results_total[5m]))", "legendFormat": "{{result}}", "refId": "A" } ] }, { "id": 10, "type": "stat", "title": "Dedup effectiveness", "description": "Fraction of consolidations that actually used the LLM (update+supersede+new+noop) vs the similarity gate skipping it. Higher = busier corpus or noisier dedup signal.", "datasource": { "type": "prometheus", "uid": "${DS_PROMETHEUS}" }, "gridPos": { "h": 8, "w": 8, "x": 16, "y": 34 }, "options": { "colorMode": "value", "graphMode": "area", "reduceOptions": { "calcs": ["lastNotNull"], "fields": "", "values": false }, "textMode": "auto" }, "fieldConfig": { "defaults": { "unit": "percentunit", "min": 0, "max": 1 } }, "targets": [ { "datasource": { "type": "prometheus", "uid": "${DS_PROMETHEUS}" }, "expr": "sum(rate(memini_consolidate_results_total{result=~\"update|supersede|new|noop\"}[15m])) / clamp_min(sum(rate(memini_consolidate_results_total{result!~\"error|dropped\"}[15m])), 1e-9)", "legendFormat": "LLM use ratio", "refId": "A" } ] }, { "id": 11, "type": "row", "title": "Storage & decay", "gridPos": { "h": 1, "w": 24, "x": 0, "y": 42 }, "collapsed": false, "panels": [] }, { "id": 12, "type": "timeseries", "title": "Live memories by tier", "datasource": { "type": "prometheus", "uid": "${DS_PROMETHEUS}" }, "gridPos": { "h": 8, "w": 12, "x": 0, "y": 43 }, "fieldConfig": { "defaults": { "custom": { "drawStyle": "line", "lineInterpolation": "stepAfter", "fillOpacity": 15, "showPoints": "never", "stacking": { "mode": "normal" } }, "unit": "short" } }, "options": { "legend": { "displayMode": "table", "placement": "right", "showLegend": true, "calcs": ["mean", "max"] }, "tooltip": { "mode": "multi", "sort": "desc" } }, "targets": [ { "datasource": { "type": "prometheus", "uid": "${DS_PROMETHEUS}" }, "expr": "memini_memories_active", "legendFormat": "{{tier}}", "refId": "A" } ] }, { "id": 13, "type": "timeseries", "title": "Decay sweep + tombstones (per minute)", "description": "Swept = memories purged by TTL; soft deletes = contradictions tombstoned by consolidation; dedup tombstones = tombstoned by the periodic dedup pass.", "datasource": { "type": "prometheus", "uid": "${DS_PROMETHEUS}" }, "gridPos": { "h": 8, "w": 12, "x": 12, "y": 43 }, "fieldConfig": { "defaults": { "custom": { "drawStyle": "line", "lineInterpolation": "stepAfter", "fillOpacity": 15, "showPoints": "never" }, "unit": "ops" } }, "options": { "legend": { "displayMode": "table", "placement": "bottom", "showLegend": true, "calcs": ["sum"] }, "tooltip": { "mode": "multi", "sort": "desc" } }, "targets": [ { "datasource": { "type": "prometheus", "uid": "${DS_PROMETHEUS}" }, "expr": "sum by (tier) (rate(memini_store_swept_total[5m]))", "legendFormat": "swept/{{tier}}", "refId": "A" }, { "datasource": { "type": "prometheus", "uid": "${DS_PROMETHEUS}" }, "expr": "rate(memini_store_soft_deletes_total[5m])", "legendFormat": "consolidate tombstones", "refId": "B" }, { "datasource": { "type": "prometheus", "uid": "${DS_PROMETHEUS}" }, "expr": "rate(memini_dedup_tombstoned_total[5m])", "legendFormat": "dedup tombstones", "refId": "C" } ] }, { "id": 14, "type": "row", "title": "Embedder & rerank", "gridPos": { "h": 1, "w": 24, "x": 0, "y": 51 }, "collapsed": false, "panels": [] }, { "id": 15, "type": "timeseries", "title": "Embedder p95 latency (by backend)", "description": "openai = real network calls; cached/diskcache/batched = local cache or fan-out; disabled = no endpoint configured.", "datasource": { "type": "prometheus", "uid": "${DS_PROMETHEUS}" }, "gridPos": { "h": 8, "w": 12, "x": 0, "y": 52 }, "fieldConfig": { "defaults": { "custom": { "drawStyle": "line", "lineInterpolation": "smooth", "fillOpacity": 10, "showPoints": "never" }, "unit": "s" } }, "options": { "legend": { "displayMode": "table", "placement": "bottom", "showLegend": true, "calcs": ["mean", "max"] }, "tooltip": { "mode": "multi", "sort": "desc" } }, "targets": [ { "datasource": { "type": "prometheus", "uid": "${DS_PROMETHEUS}" }, "expr": "histogram_quantile(0.95, sum by (backend, le) (rate(memini_embed_duration_seconds_bucket[5m])))", "legendFormat": "p95 {{backend}}", "refId": "A" } ] }, { "id": 16, "type": "timeseries", "title": "Embedder tokens + error rate", "datasource": { "type": "prometheus", "uid": "${DS_PROMETHEUS}" }, "gridPos": { "h": 8, "w": 12, "x": 12, "y": 52 }, "fieldConfig": { "defaults": { "custom": { "drawStyle": "line", "lineInterpolation": "smooth", "fillOpacity": 10, "showPoints": "never" } } }, "options": { "legend": { "displayMode": "table", "placement": "bottom", "showLegend": true, "calcs": ["mean", "max"] }, "tooltip": { "mode": "multi", "sort": "desc" } }, "targets": [ { "datasource": { "type": "prometheus", "uid": "${DS_PROMETHEUS}" }, "expr": "sum by (backend) (rate(memini_embed_tokens_total[5m]))", "legendFormat": "tokens/s {{backend}}", "refId": "A" }, { "datasource": { "type": "prometheus", "uid": "${DS_PROMETHEUS}" }, "expr": "sum by (backend) (rate(memini_embed_errors_total[5m]))", "legendFormat": "err/s {{backend}}", "refId": "B" } ] }, { "id": 24, "type": "stat", "title": "Embedder in-flight", "description": "Concurrent embed calls against the backend (post-cap, excludes cache hits). Spikes during ingest storms are normal; sustained values near the cap mean the embedder is the bottleneck.", "datasource": { "type": "prometheus", "uid": "${DS_PROMETHEUS}" }, "gridPos": { "h": 4, "w": 8, "x": 0, "y": 60 }, "options": { "colorMode": "value", "graphMode": "area", "justifyMode": "auto", "orientation": "horizontal", "reduceOptions": { "calcs": ["lastNotNull"], "fields": "", "values": false }, "textMode": "auto" }, "fieldConfig": { "defaults": { "unit": "short" } }, "targets": [ { "datasource": { "type": "prometheus", "uid": "${DS_PROMETHEUS}" }, "expr": "memini_embed_in_flight", "legendFormat": "embed in-flight", "refId": "A" } ] }, { "id": 25, "type": "stat", "title": "Rerank in-flight", "description": "Concurrent rerank calls. A nonzero value indicates rerank is configured; if this stays pinned at the cap, the reranker is the bottleneck.", "datasource": { "type": "prometheus", "uid": "${DS_PROMETHEUS}" }, "gridPos": { "h": 4, "w": 8, "x": 8, "y": 60 }, "options": { "colorMode": "value", "graphMode": "area", "justifyMode": "auto", "orientation": "horizontal", "reduceOptions": { "calcs": ["lastNotNull"], "fields": "", "values": false }, "textMode": "auto" }, "fieldConfig": { "defaults": { "unit": "short" } }, "targets": [ { "datasource": { "type": "prometheus", "uid": "${DS_PROMETHEUS}" }, "expr": "memini_rerank_in_flight", "legendFormat": "rerank in-flight", "refId": "A" } ] }, { "id": 26, "type": "timeseries", "title": "Embedder batch size (p50 vs p95)", "description": "Items per embed call, by backend. batched shows a single high-p95 bar; cached should be ~1.", "datasource": { "type": "prometheus", "uid": "${DS_PROMETHEUS}" }, "gridPos": { "h": 4, "w": 8, "x": 16, "y": 60 }, "fieldConfig": { "defaults": { "custom": { "drawStyle": "line", "lineInterpolation": "smooth", "fillOpacity": 5, "showPoints": "never" } } }, "options": { "legend": { "displayMode": "list", "placement": "bottom", "showLegend": true, "calcs": ["mean"] }, "tooltip": { "mode": "multi", "sort": "desc" } }, "targets": [ { "datasource": { "type": "prometheus", "uid": "${DS_PROMETHEUS}" }, "expr": "histogram_quantile(0.5, sum by (backend, le) (rate(memini_embed_items_bucket[5m])))", "legendFormat": "p50 {{backend}}", "refId": "A" }, { "datasource": { "type": "prometheus", "uid": "${DS_PROMETHEUS}" }, "expr": "histogram_quantile(0.95, sum by (backend, le) (rate(memini_embed_items_bucket[5m])))", "legendFormat": "p95 {{backend}}", "refId": "B" } ] }, { "id": 27, "type": "row", "title": "HTTP surface", "gridPos": { "h": 1, "w": 24, "x": 0, "y": 64 }, "collapsed": false, "panels": [] }, { "id": 28, "type": "timeseries", "title": "HTTP requests by route (status class)", "description": "Per-route request rate broken down by 2xx / 4xx / 5xx. 5xx spikes point at a broken handler; 4xx spikes usually mean client misuse or a misconfigured agent.", "datasource": { "type": "prometheus", "uid": "${DS_PROMETHEUS}" }, "gridPos": { "h": 8, "w": 16, "x": 0, "y": 65 }, "fieldConfig": { "defaults": { "custom": { "drawStyle": "line", "lineInterpolation": "smooth", "fillOpacity": 15, "showPoints": "never", "stacking": { "mode": "normal" } }, "unit": "ops" } }, "options": { "legend": { "displayMode": "table", "placement": "right", "showLegend": true, "calcs": ["mean", "max"] }, "tooltip": { "mode": "multi", "sort": "desc" } }, "targets": [ { "datasource": { "type": "prometheus", "uid": "${DS_PROMETHEUS}" }, "expr": "sum by (route, status) (label_replace(rate(memini_http_requests_total[5m]), \"status_class\", \"$1\", \"status\", \"(...).\"))", "legendFormat": "{{route}} {{status_class}}xx", "refId": "A" } ] }, { "id": 29, "type": "timeseries", "title": "HTTP p95 latency by route", "datasource": { "type": "prometheus", "uid": "${DS_PROMETHEUS}" }, "gridPos": { "h": 8, "w": 8, "x": 16, "y": 65 }, "fieldConfig": { "defaults": { "custom": { "drawStyle": "line", "lineInterpolation": "smooth", "fillOpacity": 10, "showPoints": "never" }, "unit": "s" } }, "options": { "legend": { "displayMode": "table", "placement": "bottom", "showLegend": true, "calcs": ["mean", "max"] }, "tooltip": { "mode": "multi", "sort": "desc" } }, "targets": [ { "datasource": { "type": "prometheus", "uid": "${DS_PROMETHEUS}" }, "expr": "histogram_quantile(0.95, sum by (route, le) (rate(memini_http_request_duration_seconds_bucket[5m])))", "legendFormat": "p95 {{route}}", "refId": "A" } ] }, { "id": 17, "type": "timeseries", "title": "End-to-end op latency p95 (by op)", "datasource": { "type": "prometheus", "uid": "${DS_PROMETHEUS}" }, "gridPos": { "h": 8, "w": 16, "x": 0, "y": 73 }, "fieldConfig": { "defaults": { "custom": { "drawStyle": "line", "lineInterpolation": "smooth", "fillOpacity": 5, "showPoints": "never" }, "unit": "s" } }, "options": { "legend": { "displayMode": "table", "placement": "right", "showLegend": true, "calcs": ["mean", "max"] }, "tooltip": { "mode": "multi", "sort": "desc" } }, "targets": [ { "datasource": { "type": "prometheus", "uid": "${DS_PROMETHEUS}" }, "expr": "histogram_quantile(0.95, sum by (op, le) (rate(memini_op_duration_seconds_bucket[5m])))", "legendFormat": "{{op}}", "refId": "A" } ] }, { "id": 34, "type": "timeseries", "title": "HTTP response size by route (p50/p90)", "description": "Body bytes shipped per response. The recall/briefing routes are what hooks inject from — watch these when tuning context-injection volume.", "datasource": { "type": "prometheus", "uid": "${DS_PROMETHEUS}" }, "gridPos": { "h": 8, "w": 8, "x": 16, "y": 73 }, "fieldConfig": { "defaults": { "custom": { "drawStyle": "line", "lineInterpolation": "smooth", "fillOpacity": 10, "showPoints": "never" }, "unit": "bytes" } }, "options": { "legend": { "displayMode": "table", "placement": "bottom", "showLegend": true, "calcs": ["mean", "max"] }, "tooltip": { "mode": "multi", "sort": "desc" } }, "targets": [ { "datasource": { "type": "prometheus", "uid": "${DS_PROMETHEUS}" }, "expr": "histogram_quantile(0.90, sum by (route, le) (rate(memini_http_response_bytes_bucket{route=~\"/v1/search|/v1/namespaces/briefing\"}[5m])))", "legendFormat": "p90 {{route}}", "refId": "A" }, { "datasource": { "type": "prometheus", "uid": "${DS_PROMETHEUS}" }, "expr": "histogram_quantile(0.50, sum by (route, le) (rate(memini_http_response_bytes_bucket{route=~\"/v1/search|/v1/namespaces/briefing\"}[5m])))", "legendFormat": "p50 {{route}}", "refId": "B" } ] }, { "id": 30, "type": "row", "title": "Write-path signals", "collapsed": false, "gridPos": { "h": 1, "w": 24, "x": 0, "y": 82 }, "panels": [] }, { "id": 31, "type": "timeseries", "title": "Corroboration routing", "description": "A fresh short-term write restating a durable fact: corroborated (confidence grown), cooldown (inside the 24h per-fact window), miss (no durable neighbour), error.", "datasource": { "type": "prometheus", "uid": "${DS_PROMETHEUS}" }, "gridPos": { "h": 8, "w": 12, "x": 0, "y": 83 }, "fieldConfig": { "defaults": { "custom": { "drawStyle": "line", "lineInterpolation": "smooth", "fillOpacity": 10, "showPoints": "never" }, "unit": "short" } }, "options": { "legend": { "displayMode": "table", "placement": "bottom", "showLegend": true, "calcs": ["mean", "max"] }, "tooltip": { "mode": "multi", "sort": "desc" } }, "targets": [ { "datasource": { "type": "prometheus", "uid": "${DS_PROMETHEUS}" }, "expr": "sum by (result) (rate(memini_corroborate_results_total[5m]))", "legendFormat": "{{result}}", "refId": "A" } ] }, { "id": 33, "type": "timeseries", "title": "Contradiction routing", "description": "A fresh durable write that changes a fact's value or flips its polarity: contradicted (stale fact invalidated via valid_to + confidence shrink), no_signal (durable neighbour found but not a real change), cooldown (inside the 24h per-fact window), miss (no durable neighbour), error. Default-on; a contradicted rate far above expectation is the misfire smoke alarm (set MEMINI_CONTRADICT_DOWNRANK=false to disable).", "datasource": { "type": "prometheus", "uid": "${DS_PROMETHEUS}" }, "gridPos": { "h": 8, "w": 12, "x": 0, "y": 91 }, "fieldConfig": { "defaults": { "custom": { "drawStyle": "line", "lineInterpolation": "smooth", "fillOpacity": 10, "showPoints": "never" }, "unit": "short" } }, "options": { "legend": { "displayMode": "table", "placement": "bottom", "showLegend": true, "calcs": ["mean", "max"] }, "tooltip": { "mode": "multi", "sort": "desc" } }, "targets": [ { "datasource": { "type": "prometheus", "uid": "${DS_PROMETHEUS}" }, "expr": "sum by (result) (rate(memini_contradict_results_total[5m]))", "legendFormat": "{{result}}", "refId": "A" } ] }, { "id": 32, "type": "timeseries", "title": "Tier classification & promotion", "description": "Omitted-tier writes the marker classifier routed to a durable tier, and facts produced by the promotion pass (LLM or marker extractor).", "datasource": { "type": "prometheus", "uid": "${DS_PROMETHEUS}" }, "gridPos": { "h": 8, "w": 12, "x": 12, "y": 83 }, "fieldConfig": { "defaults": { "custom": { "drawStyle": "line", "lineInterpolation": "smooth", "fillOpacity": 10, "showPoints": "never" }, "unit": "short" } }, "options": { "legend": { "displayMode": "table", "placement": "bottom", "showLegend": true, "calcs": ["mean", "max"] }, "tooltip": { "mode": "multi", "sort": "desc" } }, "targets": [ { "datasource": { "type": "prometheus", "uid": "${DS_PROMETHEUS}" }, "expr": "sum by (tier) (rate(memini_tier_classified_total[5m]))", "legendFormat": "classified -> {{tier}}", "refId": "A" }, { "datasource": { "type": "prometheus", "uid": "${DS_PROMETHEUS}" }, "expr": "sum(rate(memini_promote_facts_total[5m]))", "legendFormat": "promoted facts", "refId": "B" } ] }, { "id": 40, "type": "row", "title": "Injection efficiency (client telemetry)", "collapsed": false, "gridPos": { "h": 1, "w": 24, "x": 0, "y": 99 }, "panels": [] }, { "id": 41, "type": "timeseries", "title": "Injection outcomes (by result)", "description": "What hooks reported actually reaching model context vs held back by their local gates (seen/cooldown/budget/unchanged/score). Absent entirely means no integration is reporting.", "datasource": { "type": "prometheus", "uid": "${DS_PROMETHEUS}" }, "gridPos": { "h": 8, "w": 8, "x": 0, "y": 100 }, "fieldConfig": { "defaults": { "custom": { "drawStyle": "line", "lineInterpolation": "smooth", "fillOpacity": 10, "showPoints": "never", "stacking": { "mode": "normal" } } } }, "options": { "legend": { "displayMode": "table", "placement": "bottom", "showLegend": true, "calcs": ["mean", "max"] }, "tooltip": { "mode": "multi", "sort": "desc" } }, "targets": [ { "datasource": { "type": "prometheus", "uid": "${DS_PROMETHEUS}" }, "expr": "sum by (result) (rate(memini_injected_memories_total[5m]))", "legendFormat": "{{result}}", "refId": "A" } ] }, { "id": 42, "type": "timeseries", "title": "Injected memories (by surface)", "description": "Memories that reached context, split by which hook surface put them there.", "datasource": { "type": "prometheus", "uid": "${DS_PROMETHEUS}" }, "gridPos": { "h": 8, "w": 8, "x": 8, "y": 100 }, "fieldConfig": { "defaults": { "custom": { "drawStyle": "line", "lineInterpolation": "smooth", "fillOpacity": 10, "showPoints": "never" } } }, "options": { "legend": { "displayMode": "table", "placement": "bottom", "showLegend": true, "calcs": ["mean", "max"] }, "tooltip": { "mode": "multi", "sort": "desc" } }, "targets": [ { "datasource": { "type": "prometheus", "uid": "${DS_PROMETHEUS}" }, "expr": "sum by (surface) (rate(memini_injected_memories_total{result=\"injected\"}[5m]))", "legendFormat": "{{surface}}", "refId": "A" } ] }, { "id": 43, "type": "timeseries", "title": "Injected tokens per hour (by surface)", "description": "Client-estimated tokens the hooks added to context. The number injection tuning should push down.", "datasource": { "type": "prometheus", "uid": "${DS_PROMETHEUS}" }, "gridPos": { "h": 8, "w": 8, "x": 16, "y": 100 }, "fieldConfig": { "defaults": { "custom": { "drawStyle": "line", "lineInterpolation": "smooth", "fillOpacity": 10, "showPoints": "never" } } }, "options": { "legend": { "displayMode": "table", "placement": "bottom", "showLegend": true, "calcs": ["mean", "max"] }, "tooltip": { "mode": "multi", "sort": "desc" } }, "targets": [ { "datasource": { "type": "prometheus", "uid": "${DS_PROMETHEUS}" }, "expr": "sum by (surface) (increase(memini_injected_tokens_total[1h]))", "legendFormat": "{{surface}}", "refId": "A" } ] } ], "refresh": "30s", "schemaVersion": 39, "tags": ["memini"], "templating": { "list": [ { "current": { "selected": false, "text": "Prometheus", "value": "Prometheus" }, "hide": 0, "includeAll": false, "label": "Datasource", "multi": false, "name": "DS_PROMETHEUS", "options": [], "query": "prometheus", "queryValue": "", "refresh": 1, "regex": "", "skipUrlSync": false, "type": "datasource" } ] }, "time": { "from": "now-6h", "to": "now" }, "timepicker": {}, "timezone": "", "title": "memini", "uid": "memini", "version": 2, "weekStart": "" } (root level) + one document added: apiVersion: v1 kind: PersistentVolumeClaim metadata: name: memini namespace: local-ai labels: app.kubernetes.io/instance: memini app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: memini helm.toolkit.fluxcd.io/name: memini helm.toolkit.fluxcd.io/namespace: flux-system spec: resources: requests: storage: 10Gi storageClassName: longhorn accessModes: - ReadWriteOnce (root level) + one document added: apiVersion: v1 kind: Service metadata: name: memini namespace: local-ai labels: app.kubernetes.io/instance: memini app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: memini app.kubernetes.io/service: memini helm.toolkit.fluxcd.io/name: memini helm.toolkit.fluxcd.io/namespace: flux-system spec: type: ClusterIP selector: app.kubernetes.io/controller: main app.kubernetes.io/instance: memini app.kubernetes.io/name: memini ports: - name: http port: 8080 protocol: TCP targetPort: 8080 - name: metrics port: 9090 protocol: TCP targetPort: 9090 - name: ui port: 8081 protocol: TCP targetPort: 8081 (root level) + one document added: apiVersion: apps/v1 kind: StatefulSet metadata: name: memini namespace: local-ai labels: app.kubernetes.io/controller: main app.kubernetes.io/instance: memini app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: memini helm.toolkit.fluxcd.io/name: memini helm.toolkit.fluxcd.io/namespace: flux-system spec: podManagementPolicy: OrderedReady replicas: 1 revisionHistoryLimit: 3 selector: matchLabels: app.kubernetes.io/controller: main app.kubernetes.io/instance: memini app.kubernetes.io/name: memini serviceName: memini template: metadata: labels: app.kubernetes.io/controller: main app.kubernetes.io/instance: memini app.kubernetes.io/name: memini spec: automountServiceAccountToken: false containers: - name: main image: "registry.erwanleboucher.dev/eleboucher/memini@sha256:2d388222bca3d65673a4072e99e0970fe0d5cdab0030ce0effdfdd78307ae7e2" imagePullPolicy: IfNotPresent env: - name: MEMINI_BACKEND value: sqlite - name: MEMINI_DEFAULT_NAMESPACE value: default - name: MEMINI_EMBED_BASE_URL value: "http://energon.home.arpa:8080/v1" - name: MEMINI_EMBED_DIMS value: "1024" - name: MEMINI_EMBED_MODEL value: qwen3-embedding-0.6b - name: MEMINI_HTTP_ADDR value: ":8080" - name: MEMINI_LLM_BASE_URL value: "http://energon.home.arpa:8080/v1" - name: MEMINI_LLM_MODEL value: gemma4-12b - name: MEMINI_LOG_FORMAT value: json - name: MEMINI_LOG_LEVEL value: info - name: MEMINI_METRICS_ADDR value: ":9090" - name: MEMINI_RERANK value: "true" - name: MEMINI_RERANK_MODEL value: "http://energon.home.arpa:8080/v1" - name: MEMINI_SQLITE_PATH value: /data/memini.db - name: MEMINI_SWEEP_INTERVAL value: 1h - name: MEMINI_UI_ADDR value: ":8081" - name: MEMINI_UI_ENABLED value: "true" - name: NODE_EXTRA_CA_CERTS value: /etc/ssl/certs/aethernet-ca.pem - name: SSL_CERT_FILE value: /etc/ssl/certs/aethernet-ca.pem livenessProbe: httpGet: path: /healthz port: 8080 initialDelaySeconds: 5 periodSeconds: 15 readinessProbe: httpGet: path: /readyz port: 8080 initialDelaySeconds: 3 periodSeconds: 10 resources: limits: cpu: "1" memory: 512Mi requests: cpu: 25m memory: 128Mi volumeMounts: - name: data mountPath: /data envFrom: - secretRef: name: memini-api-key securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL readOnlyRootFilesystem: true dnsPolicy: ClusterFirst enableServiceLinks: false hostIPC: false hostNetwork: false hostPID: false securityContext: fsGroup: 65532 runAsNonRoot: true runAsUser: 65532 serviceAccountName: memini volumes: - name: data persistentVolumeClaim: claimName: memini updateStrategy: type: RollingUpdate (root level) + one document added: apiVersion: gateway.networking.k8s.io/v1alpha2 kind: HTTPRoute metadata: name: memini-main namespace: local-ai labels: app.kubernetes.io/instance: memini app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: memini helm.toolkit.fluxcd.io/name: memini helm.toolkit.fluxcd.io/namespace: flux-system spec: hostnames: - memini.k8s.aether.earth parentRefs: - name: envoy-over-vpn group: gateway.networking.k8s.io kind: Gateway namespace: envoy-gateway sectionName: https rules: - backendRefs: - name: memini group: kind: Service namespace: local-ai port: 8080 weight: 1 (root level) + one document added: apiVersion: gateway.networking.k8s.io/v1alpha2 kind: HTTPRoute metadata: name: memini-ui namespace: local-ai labels: app.kubernetes.io/instance: memini app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: memini helm.toolkit.fluxcd.io/name: memini helm.toolkit.fluxcd.io/namespace: flux-system spec: hostnames: - memini-admin.k8s.aether.earth parentRefs: - name: envoy-over-vpn group: gateway.networking.k8s.io kind: Gateway namespace: envoy-gateway sectionName: https rules: - backendRefs: - name: memini group: kind: Service namespace: local-ai port: 8081 weight: 1 (root level) + one document added: apiVersion: monitoring.coreos.com/v1 kind: ServiceMonitor metadata: name: memini namespace: local-ai labels: app.kubernetes.io/instance: memini app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: memini helm.toolkit.fluxcd.io/name: memini helm.toolkit.fluxcd.io/namespace: flux-system spec: endpoints: - interval: 30s path: /metrics port: metrics scrapeTimeout: 10s jobLabel: app.kubernetes.io/name namespaceSelector: matchNames: - local-ai selector: matchLabels: app.kubernetes.io/instance: memini app.kubernetes.io/name: memini app.kubernetes.io/service: memini (root level) + one document added: apiVersion: v1 kind: ServiceAccount metadata: name: metrics-server namespace: monitoring labels: app.kubernetes.io/instance: metrics-server app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: metrics-server helm.toolkit.fluxcd.io/name: metrics-server helm.toolkit.fluxcd.io/namespace: flux-system (root level) + one document added: apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: name: "system:metrics-server-aggregated-reader" labels: app.kubernetes.io/instance: metrics-server app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: metrics-server helm.toolkit.fluxcd.io/name: metrics-server helm.toolkit.fluxcd.io/namespace: flux-system rbac.authorization.k8s.io/aggregate-to-admin: "true" rbac.authorization.k8s.io/aggregate-to-edit: "true" rbac.authorization.k8s.io/aggregate-to-view: "true" rules: - resources: - pods - nodes apiGroups: - metrics.k8s.io verbs: - get - list - watch (root level) + one document added: apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: name: "system:metrics-server" labels: app.kubernetes.io/instance: metrics-server app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: metrics-server helm.toolkit.fluxcd.io/name: metrics-server helm.toolkit.fluxcd.io/namespace: flux-system rules: - resources: - nodes/metrics apiGroups: - verbs: - get - resources: - pods - nodes - namespaces - configmaps apiGroups: - verbs: - get - list - watch (root level) + one document added: apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding metadata: name: "metrics-server:system:auth-delegator" labels: app.kubernetes.io/instance: metrics-server app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: metrics-server helm.toolkit.fluxcd.io/name: metrics-server helm.toolkit.fluxcd.io/namespace: flux-system roleRef: name: "system:auth-delegator" apiGroup: rbac.authorization.k8s.io kind: ClusterRole subjects: - name: metrics-server kind: ServiceAccount namespace: monitoring (root level) + one document added: apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding metadata: name: "system:metrics-server" labels: app.kubernetes.io/instance: metrics-server app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: metrics-server helm.toolkit.fluxcd.io/name: metrics-server helm.toolkit.fluxcd.io/namespace: flux-system roleRef: name: "system:metrics-server" apiGroup: rbac.authorization.k8s.io kind: ClusterRole subjects: - name: metrics-server kind: ServiceAccount namespace: monitoring (root level) + one document added: apiVersion: rbac.authorization.k8s.io/v1 kind: RoleBinding metadata: name: metrics-server-auth-reader namespace: kube-system labels: app.kubernetes.io/instance: metrics-server app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: metrics-server helm.toolkit.fluxcd.io/name: metrics-server helm.toolkit.fluxcd.io/namespace: flux-system roleRef: name: extension-apiserver-authentication-reader apiGroup: rbac.authorization.k8s.io kind: Role subjects: - name: metrics-server kind: ServiceAccount namespace: monitoring (root level) + one document added: apiVersion: v1 kind: Service metadata: name: metrics-server namespace: monitoring labels: app.kubernetes.io/instance: metrics-server app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: metrics-server helm.toolkit.fluxcd.io/name: metrics-server helm.toolkit.fluxcd.io/namespace: flux-system spec: type: ClusterIP selector: app.kubernetes.io/instance: metrics-server app.kubernetes.io/name: metrics-server ports: - name: https appProtocol: https port: 443 protocol: TCP targetPort: https (root level) + one document added: apiVersion: apps/v1 kind: Deployment metadata: name: metrics-server namespace: monitoring labels: app.kubernetes.io/instance: metrics-server app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: metrics-server helm.toolkit.fluxcd.io/name: metrics-server helm.toolkit.fluxcd.io/namespace: flux-system spec: replicas: 1 selector: matchLabels: app.kubernetes.io/instance: metrics-server app.kubernetes.io/name: metrics-server template: metadata: labels: app.kubernetes.io/instance: metrics-server app.kubernetes.io/name: metrics-server spec: containers: - name: metrics-server image: "registry.k8s.io/metrics-server/metrics-server:v0.8.0" imagePullPolicy: IfNotPresent args: - "--secure-port=10250" - "--cert-dir=/tmp" - "--kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname" - "--kubelet-use-node-status-port" - "--metric-resolution=15s" - "--authorization-always-allow-paths=/metrics" - "--kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname" - "--kubelet-use-node-status-port" - "--metric-resolution=15s" livenessProbe: failureThreshold: 3 httpGet: path: /livez port: https scheme: HTTPS initialDelaySeconds: 0 periodSeconds: 10 ports: - name: https containerPort: 10250 protocol: TCP readinessProbe: failureThreshold: 3 httpGet: path: /readyz port: https scheme: HTTPS initialDelaySeconds: 20 periodSeconds: 10 resources: requests: cpu: 100m memory: 200Mi volumeMounts: - name: tmp mountPath: /tmp securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL readOnlyRootFilesystem: true runAsNonRoot: true runAsUser: 1000 seccompProfile: type: RuntimeDefault priorityClassName: system-cluster-critical serviceAccountName: metrics-server volumes: - name: tmp emptyDir: {} (root level) + one document added: apiVersion: apiregistration.k8s.io/v1 kind: APIService metadata: name: v1beta1.metrics.k8s.io annotations: null labels: app.kubernetes.io/instance: metrics-server app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: metrics-server helm.toolkit.fluxcd.io/name: metrics-server helm.toolkit.fluxcd.io/namespace: flux-system spec: version: v1beta1 group: metrics.k8s.io groupPriorityMinimum: 100 insecureSkipTLSVerify: true versionPriority: 100 service: name: metrics-server namespace: monitoring port: 443 (root level) + one document added: apiVersion: monitoring.coreos.com/v1 kind: ServiceMonitor metadata: name: metrics-server namespace: monitoring labels: app.kubernetes.io/instance: metrics-server app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: metrics-server helm.toolkit.fluxcd.io/name: metrics-server helm.toolkit.fluxcd.io/namespace: flux-system spec: endpoints: - interval: 1m path: /metrics port: https scheme: https scrapeTimeout: 10s tlsConfig: insecureSkipVerify: true jobLabel: app.kubernetes.io/instance namespaceSelector: matchNames: - monitoring selector: matchLabels: app.kubernetes.io/instance: metrics-server app.kubernetes.io/name: metrics-server (root level) + one document added: apiVersion: v1 kind: ServiceAccount metadata: name: netbox-valkey namespace: it-inventory labels: app.kubernetes.io/instance: netbox-valkey app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: valkey helm.toolkit.fluxcd.io/name: netbox-valkey helm.toolkit.fluxcd.io/namespace: flux-system automountServiceAccountToken: false (root level) + one document added: apiVersion: v1 kind: ConfigMap metadata: name: netbox-valkey-init-scripts namespace: it-inventory labels: app.kubernetes.io/instance: netbox-valkey app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: valkey helm.toolkit.fluxcd.io/name: netbox-valkey helm.toolkit.fluxcd.io/namespace: flux-system data: init.sh: | #!/bin/sh set -eu # Default config paths VALKEY_CONFIG=${VALKEY_CONFIG_PATH:-/data/conf/valkey.conf} LOGFILE="/data/init.log" DATA_DIR="/data/conf" # Logging function (outputs to stderr and file) log() { echo "$(date) $1" | tee -a "$LOGFILE" >&2 } # Function to get password for a user # Usage: get_user_password <username> [password_key] # Returns: password via stdout, exits with error if not found get_user_password() { username="$1" password_key="${2:-$username}" password="" # Try to get password from existing secret first (priority) if [ -f "/valkey-users-secret/$password_key" ]; then password=$(cat "/valkey-users-secret/$password_key") log "Using password from existing secret for user $username" elif [ -f "/valkey-auth-secret/${username}-password" ]; then # Fallback to inline password password=$(cat "/valkey-auth-secret/${username}-password") log "Using inline password for user $username" else log "ERROR: No password found for user $username" return 1 fi echo "$password" } # Clean old log if requested if [ "${KEEP_OLD_LOGS:-false}" != "true" ]; then rm -f "$LOGFILE" fi if [ -f "$LOGFILE" ]; then log "Detected restart of this instance ($HOSTNAME)" fi log "Creating configuration in $DATA_DIR..." mkdir -p "$DATA_DIR" rm -f "$VALKEY_CONFIG" # Base valkey.conf log "Generating base valkey.conf" { echo "tls-cert-file /tls/tls.crt" echo "tls-key-file /tls/tls.key" echo "tls-ca-cert-file /tls/ca.crt" echo "tls-auth-clients no" echo "port 0" echo "tls-port 6379" echo "protected-mode no" echo "bind * -::*" echo "dir /data" } >>"$VALKEY_CONFIG" # Create secure directory for ACL file log "Creating /etc/valkey directory for ACL file" mkdir -p /etc/valkey # Set aclfile path in valkey.conf echo "aclfile /etc/valkey/users.acl" >>"$VALKEY_CONFIG" # Remove or reset existing ACL file if present (it may be read-only from previous run) log "Preparing ACL file at /etc/valkey/users.acl" if [ -f /etc/valkey/users.acl ]; then log "Removing existing read-only users.acl file" chmod 0600 /etc/valkey/users.acl rm -f /etc/valkey/users.acl fi # Create ACL file with secure permissions touch /etc/valkey/users.acl chmod 0600 /etc/valkey/users.acl # Generate ACL entries for each user log "Generating ACL entries for users" # User: cacheuser PASSWORD=$(get_user_password "cacheuser" "cacheuser-password") || exit 1 # Hash the password and write ACL entry PASSHASH=$(echo -n "$PASSWORD" | sha256sum | cut -f 1 -d " ") echo "user cacheuser on #$PASSHASH +@all ~* &*" >> /etc/valkey/users.acl # User: default PASSWORD=$(get_user_password "default" "default-password") || exit 1 # Hash the password and write ACL entry PASSHASH=$(echo -n "$PASSWORD" | sha256sum | cut -f 1 -d " ") echo "user default on #$PASSHASH off" >> /etc/valkey/users.acl # Set final permissions chmod 0400 /etc/valkey/users.acl log "ACL file created with 0400 permissions" # Append extra configs if present if [ -f /usr/local/etc/valkey/valkey.conf ]; then log "Appending /usr/local/etc/valkey/valkey.conf" cat /usr/local/etc/valkey/valkey.conf >>"$VALKEY_CONFIG" fi if [ -d /extravalkeyconfigs ]; then log "Appending files in /extravalkeyconfigs/" cat /extravalkeyconfigs/* >>"$VALKEY_CONFIG" fi (root level) + one document added: apiVersion: v1 kind: PersistentVolumeClaim metadata: name: netbox-valkey namespace: it-inventory labels: app.kubernetes.io/instance: netbox-valkey app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: valkey helm.toolkit.fluxcd.io/name: netbox-valkey helm.toolkit.fluxcd.io/namespace: flux-system spec: resources: requests: storage: 8Gi storageClassName: longhorn volumeMode: Filesystem accessModes: - ReadWriteOnce (root level) + one document added: apiVersion: v1 kind: Service metadata: name: netbox-valkey namespace: it-inventory labels: app.kubernetes.io/component: primary app.kubernetes.io/instance: netbox-valkey app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: valkey helm.toolkit.fluxcd.io/name: netbox-valkey helm.toolkit.fluxcd.io/namespace: flux-system spec: type: ClusterIP selector: app.kubernetes.io/instance: netbox-valkey app.kubernetes.io/name: valkey ports: - name: tcp port: 6379 protocol: TCP targetPort: tcp (root level) + one document added: apiVersion: apps/v1 kind: Deployment metadata: name: netbox-valkey namespace: it-inventory labels: app.kubernetes.io/instance: netbox-valkey app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: valkey helm.toolkit.fluxcd.io/name: netbox-valkey helm.toolkit.fluxcd.io/namespace: flux-system spec: replicas: 1 selector: matchLabels: app.kubernetes.io/instance: netbox-valkey app.kubernetes.io/name: valkey strategy: type: RollingUpdate template: metadata: labels: app.kubernetes.io/instance: netbox-valkey app.kubernetes.io/name: valkey spec: automountServiceAccountToken: false containers: - name: netbox-valkey image: "docker.io/valkey/valkey:9.0.1" imagePullPolicy: IfNotPresent resources: {} args: - /data/conf/valkey.conf command: - valkey-server env: - name: VALKEY_LOGLEVEL value: notice ports: - name: tcp containerPort: 6379 protocol: TCP volumeMounts: - name: valkey-data mountPath: /data - name: netbox-valkey-tls mountPath: /tls - name: valkey-acl mountPath: /etc/valkey livenessProbe: exec: command: - sh - "-c" - "valkey-cli --cacert /tls/ca.crt --tls ping" securityContext: capabilities: drop: - ALL readOnlyRootFilesystem: true runAsNonRoot: true runAsUser: 1000 startupProbe: exec: command: - sh - "-c" - "valkey-cli --cacert /tls/ca.crt --tls ping" initContainers: - name: netbox-valkey-init image: "docker.io/valkey/valkey:9.0.1" imagePullPolicy: IfNotPresent command: - /scripts/init.sh volumeMounts: - name: valkey-data mountPath: /data - name: scripts mountPath: /scripts - name: valkey-acl mountPath: /etc/valkey - name: valkey-users-secret mountPath: /valkey-users-secret readOnly: true securityContext: capabilities: drop: - ALL readOnlyRootFilesystem: true runAsNonRoot: true runAsUser: 1000 securityContext: fsGroup: 1000 runAsGroup: 1000 runAsUser: 1000 serviceAccountName: netbox-valkey volumes: - name: scripts configMap: name: netbox-valkey-init-scripts defaultMode: 365 - name: valkey-acl emptyDir: medium: Memory - name: netbox-valkey-tls secret: defaultMode: 256 secretName: netbox-valkey-tls - name: valkey-users-secret secret: defaultMode: 256 secretName: netbox-valkey-acl-passwords - name: valkey-data persistentVolumeClaim: claimName: netbox-valkey (root level) + one document added: apiVersion: policy/v1 kind: PodDisruptionBudget metadata: name: nginx-for-outside-ingress-nginx-controller namespace: cluster-ingress labels: app.kubernetes.io/component: controller app.kubernetes.io/instance: nginx-for-outside app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx helm.toolkit.fluxcd.io/name: nginx-for-outside helm.toolkit.fluxcd.io/namespace: flux-system spec: minAvailable: 1 selector: matchLabels: app.kubernetes.io/component: controller app.kubernetes.io/instance: nginx-for-outside app.kubernetes.io/name: ingress-nginx (root level) + one document added: apiVersion: v1 kind: ServiceAccount metadata: name: nginx-for-outside-ingress-nginx namespace: cluster-ingress labels: app.kubernetes.io/component: controller app.kubernetes.io/instance: nginx-for-outside app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx helm.toolkit.fluxcd.io/name: nginx-for-outside helm.toolkit.fluxcd.io/namespace: flux-system automountServiceAccountToken: true (root level) + one document added: apiVersion: v1 kind: ServiceAccount metadata: name: nginx-for-outside-ingress-nginx-backend namespace: cluster-ingress labels: app.kubernetes.io/component: default-backend app.kubernetes.io/instance: nginx-for-outside app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx helm.toolkit.fluxcd.io/name: nginx-for-outside helm.toolkit.fluxcd.io/namespace: flux-system automountServiceAccountToken: true (root level) + one document added: apiVersion: v1 kind: ConfigMap metadata: name: nginx-for-outside-ingress-nginx-controller namespace: cluster-ingress labels: app.kubernetes.io/component: controller app.kubernetes.io/instance: nginx-for-outside app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx helm.toolkit.fluxcd.io/name: nginx-for-outside helm.toolkit.fluxcd.io/namespace: flux-system data: allow-snippet-annotations: "true" annotations-risk-level: Critical compute-full-forwarded-for: "true" custom-http-errors: "400,401,403,404,405,407,408,409,410,411,413,416,418,429,500,502,503,504,505" enable-brotli: "true" enable-ocsp: "false" enable-real-ip: "true" hide-headers: "Server,X-Powered-By" log-format-upstream: "nginx-http from=\"nginx-for-outside\" time=\"$time_iso8601\" remote.addr=\"$proxy_protocol_addr\" remote.user=\"$remote_user\" request.proto=\"$server_protocol\" request.verb=\"$request_method\" request.size=\"$request_length\" url.domain=\"$host\" url.path=\"$uri\" url.query=\"$args\" response.size=\"$bytes_sent\" response.status=\"$status\" response.duration=\"$upstream_response_time\" response.servers=\"$upstream_addr\" user.agent=\"$http_user_agent\" user.referrer=\"$http_referer\" k8s.ing.namespace=\"$namespace\" k8s.ing.name=\"$ingress_name\" k8s.svc.name=\"$service_name\" k8s.svc.port=\"$service_port\" request.id=\"$req_id\"" proxy-real-ip-cidr: "100.64.0.0/10,fd7a:115c:a1e0::/48,172.27.0.0/16,fda3:a0a0:cafe::/48" use-geoip: "false" use-geoip2: "false" use-gzip: "true" use-proxy-protocol: "true" (root level) + one document added: apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: name: nginx-for-outside-ingress-nginx labels: app.kubernetes.io/instance: nginx-for-outside app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx helm.toolkit.fluxcd.io/name: nginx-for-outside helm.toolkit.fluxcd.io/namespace: flux-system rules: - resources: - configmaps - endpoints - nodes - pods - secrets - namespaces apiGroups: - verbs: - list - watch - resources: - leases apiGroups: - coordination.k8s.io verbs: - list - watch - resources: - nodes apiGroups: - verbs: - get - resources: - services apiGroups: - verbs: - get - list - watch - resources: - ingresses apiGroups: - networking.k8s.io verbs: - get - list - watch - resources: - events apiGroups: - verbs: - create - patch - resources: - ingresses/status apiGroups: - networking.k8s.io verbs: - update - resources: - ingressclasses apiGroups: - networking.k8s.io verbs: - get - list - watch - resources: - endpointslices apiGroups: - discovery.k8s.io verbs: - list - watch - get (root level) + one document added: apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding metadata: name: nginx-for-outside-ingress-nginx labels: app.kubernetes.io/instance: nginx-for-outside app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx helm.toolkit.fluxcd.io/name: nginx-for-outside helm.toolkit.fluxcd.io/namespace: flux-system roleRef: name: nginx-for-outside-ingress-nginx apiGroup: rbac.authorization.k8s.io kind: ClusterRole subjects: - name: nginx-for-outside-ingress-nginx kind: ServiceAccount namespace: cluster-ingress (root level) + one document added: apiVersion: rbac.authorization.k8s.io/v1 kind: Role metadata: name: nginx-for-outside-ingress-nginx namespace: cluster-ingress labels: app.kubernetes.io/component: controller app.kubernetes.io/instance: nginx-for-outside app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx helm.toolkit.fluxcd.io/name: nginx-for-outside helm.toolkit.fluxcd.io/namespace: flux-system rules: - resources: - namespaces apiGroups: - verbs: - get - resources: - configmaps - pods - secrets - endpoints apiGroups: - verbs: - get - list - watch - resources: - services apiGroups: - verbs: - get - list - watch - resources: - ingresses apiGroups: - networking.k8s.io verbs: - get - list - watch - resources: - ingresses/status apiGroups: - networking.k8s.io verbs: - update - resources: - ingressclasses apiGroups: - networking.k8s.io verbs: - get - list - watch - resources: - leases apiGroups: - coordination.k8s.io resourceNames: - nginx-for-outside-controller-leader verbs: - get - update - resources: - leases apiGroups: - coordination.k8s.io verbs: - create - resources: - events apiGroups: - verbs: - create - patch - resources: - endpointslices apiGroups: - discovery.k8s.io verbs: - list - watch - get (root level) + one document added: apiVersion: rbac.authorization.k8s.io/v1 kind: RoleBinding metadata: name: nginx-for-outside-ingress-nginx namespace: cluster-ingress labels: app.kubernetes.io/component: controller app.kubernetes.io/instance: nginx-for-outside app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx helm.toolkit.fluxcd.io/name: nginx-for-outside helm.toolkit.fluxcd.io/namespace: flux-system roleRef: name: nginx-for-outside-ingress-nginx apiGroup: rbac.authorization.k8s.io kind: Role subjects: - name: nginx-for-outside-ingress-nginx kind: ServiceAccount namespace: cluster-ingress (root level) + one document added: apiVersion: v1 kind: Service metadata: name: nginx-for-outside-ingress-nginx-controller-metrics namespace: cluster-ingress labels: app.kubernetes.io/component: controller app.kubernetes.io/instance: nginx-for-outside app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx helm.toolkit.fluxcd.io/name: nginx-for-outside helm.toolkit.fluxcd.io/namespace: flux-system spec: type: ClusterIP selector: app.kubernetes.io/component: controller app.kubernetes.io/instance: nginx-for-outside app.kubernetes.io/name: ingress-nginx ports: - name: metrics port: 10254 protocol: TCP targetPort: metrics (root level) + one document added: apiVersion: v1 kind: Service metadata: name: nginx-for-outside-ingress-nginx-controller-admission namespace: cluster-ingress labels: app.kubernetes.io/component: controller app.kubernetes.io/instance: nginx-for-outside app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx helm.toolkit.fluxcd.io/name: nginx-for-outside helm.toolkit.fluxcd.io/namespace: flux-system spec: type: ClusterIP selector: app.kubernetes.io/component: controller app.kubernetes.io/instance: nginx-for-outside app.kubernetes.io/name: ingress-nginx ports: - name: https-webhook appProtocol: https port: 443 targetPort: webhook (root level) + one document added: apiVersion: v1 kind: Service metadata: name: nginx-for-outside-ingress-nginx-controller namespace: cluster-ingress annotations: tailscale.com/hostname: ingress-nginx-for-outside labels: app.kubernetes.io/component: controller app.kubernetes.io/instance: nginx-for-outside app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx helm.toolkit.fluxcd.io/name: nginx-for-outside helm.toolkit.fluxcd.io/namespace: flux-system spec: type: LoadBalancer ipFamilyPolicy: PreferDualStack loadBalancerClass: tailscale ipFamilies: - IPv4 - IPv6 selector: app.kubernetes.io/component: controller app.kubernetes.io/instance: nginx-for-outside app.kubernetes.io/name: ingress-nginx ports: - name: http appProtocol: http port: 80 protocol: TCP targetPort: http - name: https appProtocol: https port: 443 protocol: TCP targetPort: https (root level) + one document added: apiVersion: v1 kind: Service metadata: name: nginx-for-outside-ingress-nginx-defaultbackend namespace: cluster-ingress labels: app.kubernetes.io/component: default-backend app.kubernetes.io/instance: nginx-for-outside app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx helm.toolkit.fluxcd.io/name: nginx-for-outside helm.toolkit.fluxcd.io/namespace: flux-system spec: type: ClusterIP selector: app.kubernetes.io/component: default-backend app.kubernetes.io/instance: nginx-for-outside app.kubernetes.io/name: ingress-nginx ports: - name: http appProtocol: http port: 80 protocol: TCP targetPort: http (root level) + one document added: apiVersion: apps/v1 kind: Deployment metadata: name: nginx-for-outside-ingress-nginx-controller namespace: cluster-ingress labels: app.kubernetes.io/component: controller app.kubernetes.io/instance: nginx-for-outside app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx helm.toolkit.fluxcd.io/name: nginx-for-outside helm.toolkit.fluxcd.io/namespace: flux-system spec: minReadySeconds: 0 replicas: 2 revisionHistoryLimit: 10 selector: matchLabels: app.kubernetes.io/component: controller app.kubernetes.io/instance: nginx-for-outside app.kubernetes.io/name: ingress-nginx template: metadata: labels: app.kubernetes.io/component: controller app.kubernetes.io/instance: nginx-for-outside app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx spec: automountServiceAccountToken: true containers: - name: controller image: "registry.k8s.io/ingress-nginx/controller:v1.13.3@sha256:1b044f6dcac3afbb59e05d98463f1dec6f3d3fb99940bc12ca5d80270358e3bd" imagePullPolicy: IfNotPresent args: - /nginx-ingress-controller - "--default-backend-service=$(POD_NAMESPACE)/nginx-for-outside-ingress-nginx-defaultbackend" - "--publish-service=$(POD_NAMESPACE)/nginx-for-outside-ingress-nginx-controller" - "--election-id=nginx-for-outside-controller-leader" - "--controller-class=infra.aether.earth/nginx-for-outside" - "--ingress-class=nginx" - "--configmap=$(POD_NAMESPACE)/nginx-for-outside-ingress-nginx-controller" - "--validating-webhook=:8443" - "--validating-webhook-certificate=/usr/local/certificates/cert" - "--validating-webhook-key=/usr/local/certificates/key" - "--enable-metrics=true" livenessProbe: failureThreshold: 5 httpGet: path: /healthz port: 10254 scheme: HTTP initialDelaySeconds: 10 periodSeconds: 10 successThreshold: 1 timeoutSeconds: 1 ports: - name: http containerPort: 80 protocol: TCP - name: https containerPort: 443 protocol: TCP - name: metrics containerPort: 10254 protocol: TCP - name: webhook containerPort: 8443 protocol: TCP readinessProbe: failureThreshold: 3 httpGet: path: /healthz port: 10254 scheme: HTTP initialDelaySeconds: 10 periodSeconds: 10 successThreshold: 1 timeoutSeconds: 1 resources: requests: cpu: 100m memory: 90Mi volumeMounts: - name: webhook-cert mountPath: /usr/local/certificates/ readOnly: true securityContext: allowPrivilegeEscalation: false capabilities: add: - NET_BIND_SERVICE drop: - ALL readOnlyRootFilesystem: false runAsGroup: 82 runAsNonRoot: true runAsUser: 101 seccompProfile: type: RuntimeDefault env: - name: POD_NAME valueFrom: fieldRef: fieldPath: metadata.name - name: POD_NAMESPACE valueFrom: fieldRef: fieldPath: metadata.namespace - name: LD_PRELOAD value: /usr/local/lib/libmimalloc.so lifecycle: preStop: exec: command: - /wait-shutdown dnsPolicy: ClusterFirst nodeSelector: kubernetes.io/os: linux serviceAccountName: nginx-for-outside-ingress-nginx terminationGracePeriodSeconds: 300 volumes: - name: webhook-cert secret: items: - key: tls.crt path: cert - key: tls.key path: key secretName: nginx-for-outside-ingress-nginx-admission (root level) + one document added: apiVersion: apps/v1 kind: Deployment metadata: name: nginx-for-outside-ingress-nginx-defaultbackend namespace: cluster-ingress labels: app.kubernetes.io/component: default-backend app.kubernetes.io/instance: nginx-for-outside app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx helm.toolkit.fluxcd.io/name: nginx-for-outside helm.toolkit.fluxcd.io/namespace: flux-system spec: minReadySeconds: 0 replicas: 1 revisionHistoryLimit: 10 selector: matchLabels: app.kubernetes.io/component: default-backend app.kubernetes.io/instance: nginx-for-outside app.kubernetes.io/name: ingress-nginx template: metadata: labels: app.kubernetes.io/component: default-backend app.kubernetes.io/instance: nginx-for-outside app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx spec: automountServiceAccountToken: true containers: - name: ingress-nginx-default-backend image: "ghcr.io/tarampampam/error-pages:3.3.2" imagePullPolicy: IfNotPresent env: - name: TEMPLATE_NAME value: connection - name: SHOW_DETAILS value: "true" - name: SEND_SAME_HTTP_CODE value: "true" - name: DISABLE_MINIFICATION value: "true" livenessProbe: failureThreshold: 3 httpGet: path: /healthz port: 8080 scheme: HTTP initialDelaySeconds: 30 periodSeconds: 10 successThreshold: 1 timeoutSeconds: 5 ports: - name: http containerPort: 8080 protocol: TCP readinessProbe: failureThreshold: 6 httpGet: path: /healthz port: 8080 scheme: HTTP initialDelaySeconds: 0 periodSeconds: 5 successThreshold: 1 timeoutSeconds: 5 securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL readOnlyRootFilesystem: true runAsGroup: 65534 runAsNonRoot: true runAsUser: 65534 seccompProfile: type: RuntimeDefault nodeSelector: kubernetes.io/os: linux serviceAccountName: nginx-for-outside-ingress-nginx-backend terminationGracePeriodSeconds: 60 (root level) + one document added: apiVersion: networking.k8s.io/v1 kind: IngressClass metadata: name: nginx-for-outside labels: app.kubernetes.io/component: controller app.kubernetes.io/instance: nginx-for-outside app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx helm.toolkit.fluxcd.io/name: nginx-for-outside helm.toolkit.fluxcd.io/namespace: flux-system spec: controller: infra.aether.earth/nginx-for-outside (root level) + one document added: apiVersion: admissionregistration.k8s.io/v1 kind: ValidatingWebhookConfiguration metadata: name: nginx-for-outside-ingress-nginx-admission annotations: cert-manager.io/inject-ca-from: cluster-ingress/nginx-for-outside-ingress-nginx-admission certmanager.k8s.io/inject-ca-from: cluster-ingress/nginx-for-outside-ingress-nginx-admission labels: app.kubernetes.io/component: admission-webhook app.kubernetes.io/instance: nginx-for-outside app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx helm.toolkit.fluxcd.io/name: nginx-for-outside helm.toolkit.fluxcd.io/namespace: flux-system webhooks: - name: validate.nginx.ingress.kubernetes.io failurePolicy: Fail matchPolicy: Equivalent sideEffects: None admissionReviewVersions: - v1 clientConfig: service: name: nginx-for-outside-ingress-nginx-controller-admission namespace: cluster-ingress path: /networking/v1/ingresses port: 443 rules: - resources: - ingresses apiGroups: - networking.k8s.io apiVersions: - v1 operations: - CREATE - UPDATE (root level) + one document added: apiVersion: cert-manager.io/v1 kind: Certificate metadata: name: nginx-for-outside-ingress-nginx-admission namespace: cluster-ingress labels: helm.toolkit.fluxcd.io/name: nginx-for-outside helm.toolkit.fluxcd.io/namespace: flux-system spec: dnsNames: - nginx-for-outside-ingress-nginx-controller-admission - nginx-for-outside-ingress-nginx-controller-admission.cluster-ingress - nginx-for-outside-ingress-nginx-controller-admission.cluster-ingress.svc duration: 8760h0m0s issuerRef: name: in-cluster-ca group: cert-manager.io kind: ClusterIssuer secretName: nginx-for-outside-ingress-nginx-admission subject: organizations: - ingress-nginx-admission (root level) + one document added: apiVersion: monitoring.coreos.com/v1 kind: ServiceMonitor metadata: name: nginx-for-outside-ingress-nginx-controller namespace: cluster-ingress labels: app.kubernetes.io/component: controller app.kubernetes.io/instance: nginx-for-outside app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx helm.toolkit.fluxcd.io/name: nginx-for-outside helm.toolkit.fluxcd.io/namespace: flux-system spec: endpoints: - interval: 30s port: metrics namespaceSelector: matchNames: - cluster-ingress selector: matchLabels: app.kubernetes.io/component: controller app.kubernetes.io/instance: nginx-for-outside app.kubernetes.io/name: ingress-nginx (root level) + one document added: apiVersion: policy/v1 kind: PodDisruptionBudget metadata: name: nginx-on-lan-ingress-nginx-controller namespace: cluster-ingress labels: app.kubernetes.io/component: controller app.kubernetes.io/instance: nginx-on-lan app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx helm.toolkit.fluxcd.io/name: nginx-on-lan helm.toolkit.fluxcd.io/namespace: flux-system spec: minAvailable: 1 selector: matchLabels: app.kubernetes.io/component: controller app.kubernetes.io/instance: nginx-on-lan app.kubernetes.io/name: ingress-nginx (root level) + one document added: apiVersion: v1 kind: ServiceAccount metadata: name: nginx-on-lan-ingress-nginx namespace: cluster-ingress labels: app.kubernetes.io/component: controller app.kubernetes.io/instance: nginx-on-lan app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx helm.toolkit.fluxcd.io/name: nginx-on-lan helm.toolkit.fluxcd.io/namespace: flux-system automountServiceAccountToken: true (root level) + one document added: apiVersion: v1 kind: ServiceAccount metadata: name: nginx-on-lan-ingress-nginx-backend namespace: cluster-ingress labels: app.kubernetes.io/component: default-backend app.kubernetes.io/instance: nginx-on-lan app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx helm.toolkit.fluxcd.io/name: nginx-on-lan helm.toolkit.fluxcd.io/namespace: flux-system automountServiceAccountToken: true (root level) + one document added: apiVersion: v1 kind: ConfigMap metadata: name: nginx-on-lan-ingress-nginx-controller namespace: cluster-ingress labels: app.kubernetes.io/component: controller app.kubernetes.io/instance: nginx-on-lan app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx helm.toolkit.fluxcd.io/name: nginx-on-lan helm.toolkit.fluxcd.io/namespace: flux-system data: allow-snippet-annotations: "true" annotations-risk-level: Critical compute-full-forwarded-for: "true" custom-http-errors: "400,401,403,404,405,407,408,409,410,411,413,416,418,429,500,502,503,504,505" enable-brotli: "true" enable-ocsp: "false" enable-real-ip: "true" hide-headers: "Server,X-Powered-By" log-format-upstream: "nginx-http from=\"nginx-on-lan\" time=\"$time_iso8601\" remote.addr=\"$proxy_protocol_addr\" remote.user=\"$remote_user\" request.proto=\"$server_protocol\" request.verb=\"$request_method\" request.size=\"$request_length\" url.domain=\"$host\" url.path=\"$uri\" url.query=\"$args\" response.size=\"$bytes_sent\" response.status=\"$status\" response.duration=\"$upstream_response_time\" response.servers=\"$upstream_addr\" user.agent=\"$http_user_agent\" user.referrer=\"$http_referer\" k8s.ing.namespace=\"$namespace\" k8s.ing.name=\"$ingress_name\" k8s.svc.name=\"$service_name\" k8s.svc.port=\"$service_port\" request.id=\"$req_id\"" proxy-real-ip-cidr: "100.64.0.0/10,fd7a:115c:a1e0::/48,172.27.0.0/16,fda3:a0a0:cafe::/48" use-geoip: "false" use-geoip2: "false" use-gzip: "true" (root level) + one document added: apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: name: nginx-on-lan-ingress-nginx labels: app.kubernetes.io/instance: nginx-on-lan app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx helm.toolkit.fluxcd.io/name: nginx-on-lan helm.toolkit.fluxcd.io/namespace: flux-system rules: - resources: - configmaps - endpoints - nodes - pods - secrets - namespaces apiGroups: - verbs: - list - watch - resources: - leases apiGroups: - coordination.k8s.io verbs: - list - watch - resources: - nodes apiGroups: - verbs: - get - resources: - services apiGroups: - verbs: - get - list - watch - resources: - ingresses apiGroups: - networking.k8s.io verbs: - get - list - watch - resources: - events apiGroups: - verbs: - create - patch - resources: - ingresses/status apiGroups: - networking.k8s.io verbs: - update - resources: - ingressclasses apiGroups: - networking.k8s.io verbs: - get - list - watch - resources: - endpointslices apiGroups: - discovery.k8s.io verbs: - list - watch - get (root level) + one document added: apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding metadata: name: nginx-on-lan-ingress-nginx labels: app.kubernetes.io/instance: nginx-on-lan app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx helm.toolkit.fluxcd.io/name: nginx-on-lan helm.toolkit.fluxcd.io/namespace: flux-system roleRef: name: nginx-on-lan-ingress-nginx apiGroup: rbac.authorization.k8s.io kind: ClusterRole subjects: - name: nginx-on-lan-ingress-nginx kind: ServiceAccount namespace: cluster-ingress (root level) + one document added: apiVersion: rbac.authorization.k8s.io/v1 kind: Role metadata: name: nginx-on-lan-ingress-nginx namespace: cluster-ingress labels: app.kubernetes.io/component: controller app.kubernetes.io/instance: nginx-on-lan app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx helm.toolkit.fluxcd.io/name: nginx-on-lan helm.toolkit.fluxcd.io/namespace: flux-system rules: - resources: - namespaces apiGroups: - verbs: - get - resources: - configmaps - pods - secrets - endpoints apiGroups: - verbs: - get - list - watch - resources: - services apiGroups: - verbs: - get - list - watch - resources: - ingresses apiGroups: - networking.k8s.io verbs: - get - list - watch - resources: - ingresses/status apiGroups: - networking.k8s.io verbs: - update - resources: - ingressclasses apiGroups: - networking.k8s.io verbs: - get - list - watch - resources: - leases apiGroups: - coordination.k8s.io resourceNames: - nginx-on-lan-controller-leader verbs: - get - update - resources: - leases apiGroups: - coordination.k8s.io verbs: - create - resources: - events apiGroups: - verbs: - create - patch - resources: - endpointslices apiGroups: - discovery.k8s.io verbs: - list - watch - get (root level) + one document added: apiVersion: rbac.authorization.k8s.io/v1 kind: RoleBinding metadata: name: nginx-on-lan-ingress-nginx namespace: cluster-ingress labels: app.kubernetes.io/component: controller app.kubernetes.io/instance: nginx-on-lan app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx helm.toolkit.fluxcd.io/name: nginx-on-lan helm.toolkit.fluxcd.io/namespace: flux-system roleRef: name: nginx-on-lan-ingress-nginx apiGroup: rbac.authorization.k8s.io kind: Role subjects: - name: nginx-on-lan-ingress-nginx kind: ServiceAccount namespace: cluster-ingress (root level) + one document added: apiVersion: v1 kind: Service metadata: name: nginx-on-lan-ingress-nginx-controller-metrics namespace: cluster-ingress labels: app.kubernetes.io/component: controller app.kubernetes.io/instance: nginx-on-lan app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx helm.toolkit.fluxcd.io/name: nginx-on-lan helm.toolkit.fluxcd.io/namespace: flux-system spec: type: ClusterIP selector: app.kubernetes.io/component: controller app.kubernetes.io/instance: nginx-on-lan app.kubernetes.io/name: ingress-nginx ports: - name: metrics port: 10254 protocol: TCP targetPort: metrics (root level) + one document added: apiVersion: v1 kind: Service metadata: name: nginx-on-lan-ingress-nginx-controller-admission namespace: cluster-ingress labels: app.kubernetes.io/component: controller app.kubernetes.io/instance: nginx-on-lan app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx helm.toolkit.fluxcd.io/name: nginx-on-lan helm.toolkit.fluxcd.io/namespace: flux-system spec: type: ClusterIP selector: app.kubernetes.io/component: controller app.kubernetes.io/instance: nginx-on-lan app.kubernetes.io/name: ingress-nginx ports: - name: https-webhook appProtocol: https port: 443 targetPort: webhook (root level) + one document added: apiVersion: v1 kind: Service metadata: name: nginx-on-lan-ingress-nginx-controller namespace: cluster-ingress annotations: external-dns.alpha.kubernetes.io/hostname: nginx-on-lan.home.arpa labels: app.kubernetes.io/component: controller app.kubernetes.io/instance: nginx-on-lan app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx helm.toolkit.fluxcd.io/name: nginx-on-lan helm.toolkit.fluxcd.io/namespace: flux-system spec: type: LoadBalancer ipFamilyPolicy: RequireDualStack loadBalancerClass: io.cilium/bgp-control-plane ipFamilies: - IPv6 - IPv4 selector: app.kubernetes.io/component: controller app.kubernetes.io/instance: nginx-on-lan app.kubernetes.io/name: ingress-nginx ports: - name: http appProtocol: http port: 80 protocol: TCP targetPort: http - name: https appProtocol: https port: 443 protocol: TCP targetPort: https (root level) + one document added: apiVersion: v1 kind: Service metadata: name: nginx-on-lan-ingress-nginx-defaultbackend namespace: cluster-ingress labels: app.kubernetes.io/component: default-backend app.kubernetes.io/instance: nginx-on-lan app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx helm.toolkit.fluxcd.io/name: nginx-on-lan helm.toolkit.fluxcd.io/namespace: flux-system spec: type: ClusterIP selector: app.kubernetes.io/component: default-backend app.kubernetes.io/instance: nginx-on-lan app.kubernetes.io/name: ingress-nginx ports: - name: http appProtocol: http port: 80 protocol: TCP targetPort: http (root level) + one document added: apiVersion: apps/v1 kind: Deployment metadata: name: nginx-on-lan-ingress-nginx-controller namespace: cluster-ingress labels: app.kubernetes.io/component: controller app.kubernetes.io/instance: nginx-on-lan app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx helm.toolkit.fluxcd.io/name: nginx-on-lan helm.toolkit.fluxcd.io/namespace: flux-system spec: minReadySeconds: 0 replicas: 2 revisionHistoryLimit: 10 selector: matchLabels: app.kubernetes.io/component: controller app.kubernetes.io/instance: nginx-on-lan app.kubernetes.io/name: ingress-nginx template: metadata: labels: app.kubernetes.io/component: controller app.kubernetes.io/instance: nginx-on-lan app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx spec: automountServiceAccountToken: true containers: - name: controller image: "registry.k8s.io/ingress-nginx/controller:v1.13.3@sha256:1b044f6dcac3afbb59e05d98463f1dec6f3d3fb99940bc12ca5d80270358e3bd" imagePullPolicy: IfNotPresent args: - /nginx-ingress-controller - "--default-backend-service=$(POD_NAMESPACE)/nginx-on-lan-ingress-nginx-defaultbackend" - "--publish-service=$(POD_NAMESPACE)/nginx-on-lan-ingress-nginx-controller" - "--election-id=nginx-on-lan-controller-leader" - "--controller-class=infra.aether.earth/nginx-on-lan" - "--ingress-class=nginx" - "--configmap=$(POD_NAMESPACE)/nginx-on-lan-ingress-nginx-controller" - "--validating-webhook=:8443" - "--validating-webhook-certificate=/usr/local/certificates/cert" - "--validating-webhook-key=/usr/local/certificates/key" - "--enable-metrics=true" livenessProbe: failureThreshold: 5 httpGet: path: /healthz port: 10254 scheme: HTTP initialDelaySeconds: 10 periodSeconds: 10 successThreshold: 1 timeoutSeconds: 1 ports: - name: http containerPort: 80 protocol: TCP - name: https containerPort: 443 protocol: TCP - name: metrics containerPort: 10254 protocol: TCP - name: webhook containerPort: 8443 protocol: TCP readinessProbe: failureThreshold: 3 httpGet: path: /healthz port: 10254 scheme: HTTP initialDelaySeconds: 10 periodSeconds: 10 successThreshold: 1 timeoutSeconds: 1 resources: requests: cpu: 100m memory: 90Mi volumeMounts: - name: webhook-cert mountPath: /usr/local/certificates/ readOnly: true securityContext: allowPrivilegeEscalation: false capabilities: add: - NET_BIND_SERVICE drop: - ALL readOnlyRootFilesystem: false runAsGroup: 82 runAsNonRoot: true runAsUser: 101 seccompProfile: type: RuntimeDefault env: - name: POD_NAME valueFrom: fieldRef: fieldPath: metadata.name - name: POD_NAMESPACE valueFrom: fieldRef: fieldPath: metadata.namespace - name: LD_PRELOAD value: /usr/local/lib/libmimalloc.so lifecycle: preStop: exec: command: - /wait-shutdown dnsPolicy: ClusterFirst nodeSelector: kubernetes.io/os: linux serviceAccountName: nginx-on-lan-ingress-nginx terminationGracePeriodSeconds: 300 volumes: - name: webhook-cert secret: items: - key: tls.crt path: cert - key: tls.key path: key secretName: nginx-on-lan-ingress-nginx-admission (root level) + one document added: apiVersion: apps/v1 kind: Deployment metadata: name: nginx-on-lan-ingress-nginx-defaultbackend namespace: cluster-ingress labels: app.kubernetes.io/component: default-backend app.kubernetes.io/instance: nginx-on-lan app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx helm.toolkit.fluxcd.io/name: nginx-on-lan helm.toolkit.fluxcd.io/namespace: flux-system spec: minReadySeconds: 0 replicas: 1 revisionHistoryLimit: 10 selector: matchLabels: app.kubernetes.io/component: default-backend app.kubernetes.io/instance: nginx-on-lan app.kubernetes.io/name: ingress-nginx template: metadata: labels: app.kubernetes.io/component: default-backend app.kubernetes.io/instance: nginx-on-lan app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx spec: automountServiceAccountToken: true containers: - name: ingress-nginx-default-backend image: "ghcr.io/tarampampam/error-pages:3.3.2" imagePullPolicy: IfNotPresent env: - name: TEMPLATE_NAME value: connection - name: SHOW_DETAILS value: "true" - name: SEND_SAME_HTTP_CODE value: "true" - name: DISABLE_MINIFICATION value: "true" livenessProbe: failureThreshold: 3 httpGet: path: /healthz port: 8080 scheme: HTTP initialDelaySeconds: 30 periodSeconds: 10 successThreshold: 1 timeoutSeconds: 5 ports: - name: http containerPort: 8080 protocol: TCP readinessProbe: failureThreshold: 6 httpGet: path: /healthz port: 8080 scheme: HTTP initialDelaySeconds: 0 periodSeconds: 5 successThreshold: 1 timeoutSeconds: 5 securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL readOnlyRootFilesystem: true runAsGroup: 65534 runAsNonRoot: true runAsUser: 65534 seccompProfile: type: RuntimeDefault nodeSelector: kubernetes.io/os: linux serviceAccountName: nginx-on-lan-ingress-nginx-backend terminationGracePeriodSeconds: 60 (root level) + one document added: apiVersion: networking.k8s.io/v1 kind: IngressClass metadata: name: nginx-on-lan labels: app.kubernetes.io/component: controller app.kubernetes.io/instance: nginx-on-lan app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx helm.toolkit.fluxcd.io/name: nginx-on-lan helm.toolkit.fluxcd.io/namespace: flux-system spec: controller: infra.aether.earth/nginx-on-lan (root level) + one document added: apiVersion: admissionregistration.k8s.io/v1 kind: ValidatingWebhookConfiguration metadata: name: nginx-on-lan-ingress-nginx-admission annotations: cert-manager.io/inject-ca-from: cluster-ingress/nginx-on-lan-ingress-nginx-admission certmanager.k8s.io/inject-ca-from: cluster-ingress/nginx-on-lan-ingress-nginx-admission labels: app.kubernetes.io/component: admission-webhook app.kubernetes.io/instance: nginx-on-lan app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx helm.toolkit.fluxcd.io/name: nginx-on-lan helm.toolkit.fluxcd.io/namespace: flux-system webhooks: - name: validate.nginx.ingress.kubernetes.io failurePolicy: Fail matchPolicy: Equivalent sideEffects: None admissionReviewVersions: - v1 clientConfig: service: name: nginx-on-lan-ingress-nginx-controller-admission namespace: cluster-ingress path: /networking/v1/ingresses port: 443 rules: - resources: - ingresses apiGroups: - networking.k8s.io apiVersions: - v1 operations: - CREATE - UPDATE (root level) + one document added: apiVersion: cert-manager.io/v1 kind: Certificate metadata: name: nginx-on-lan-ingress-nginx-admission namespace: cluster-ingress labels: helm.toolkit.fluxcd.io/name: nginx-on-lan helm.toolkit.fluxcd.io/namespace: flux-system spec: dnsNames: - nginx-on-lan-ingress-nginx-controller-admission - nginx-on-lan-ingress-nginx-controller-admission.cluster-ingress - nginx-on-lan-ingress-nginx-controller-admission.cluster-ingress.svc duration: 8760h0m0s issuerRef: name: in-cluster-ca group: cert-manager.io kind: ClusterIssuer secretName: nginx-on-lan-ingress-nginx-admission subject: organizations: - ingress-nginx-admission (root level) + one document added: apiVersion: monitoring.coreos.com/v1 kind: ServiceMonitor metadata: name: nginx-on-lan-ingress-nginx-controller namespace: cluster-ingress labels: app.kubernetes.io/component: controller app.kubernetes.io/instance: nginx-on-lan app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx helm.toolkit.fluxcd.io/name: nginx-on-lan helm.toolkit.fluxcd.io/namespace: flux-system spec: endpoints: - interval: 30s port: metrics namespaceSelector: matchNames: - cluster-ingress selector: matchLabels: app.kubernetes.io/component: controller app.kubernetes.io/instance: nginx-on-lan app.kubernetes.io/name: ingress-nginx (root level) + one document added: apiVersion: policy/v1 kind: PodDisruptionBudget metadata: name: nginx-over-vpn-ingress-nginx-controller namespace: cluster-ingress labels: app.kubernetes.io/component: controller app.kubernetes.io/instance: nginx-over-vpn app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx helm.toolkit.fluxcd.io/name: nginx-over-vpn helm.toolkit.fluxcd.io/namespace: flux-system spec: minAvailable: 1 selector: matchLabels: app.kubernetes.io/component: controller app.kubernetes.io/instance: nginx-over-vpn app.kubernetes.io/name: ingress-nginx (root level) + one document added: apiVersion: v1 kind: ServiceAccount metadata: name: nginx-over-vpn-ingress-nginx namespace: cluster-ingress labels: app.kubernetes.io/component: controller app.kubernetes.io/instance: nginx-over-vpn app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx helm.toolkit.fluxcd.io/name: nginx-over-vpn helm.toolkit.fluxcd.io/namespace: flux-system automountServiceAccountToken: true (root level) + one document added: apiVersion: v1 kind: ServiceAccount metadata: name: nginx-over-vpn-ingress-nginx-backend namespace: cluster-ingress labels: app.kubernetes.io/component: default-backend app.kubernetes.io/instance: nginx-over-vpn app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx helm.toolkit.fluxcd.io/name: nginx-over-vpn helm.toolkit.fluxcd.io/namespace: flux-system automountServiceAccountToken: true (root level) + one document added: apiVersion: v1 kind: ConfigMap metadata: name: nginx-over-vpn-ingress-nginx-controller namespace: cluster-ingress labels: app.kubernetes.io/component: controller app.kubernetes.io/instance: nginx-over-vpn app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx helm.toolkit.fluxcd.io/name: nginx-over-vpn helm.toolkit.fluxcd.io/namespace: flux-system data: allow-snippet-annotations: "true" annotations-risk-level: Critical compute-full-forwarded-for: "true" custom-http-errors: "400,401,403,404,405,407,408,409,410,411,413,416,418,429,500,502,503,504,505" enable-brotli: "true" enable-ocsp: "false" enable-real-ip: "true" hide-headers: "Server,X-Powered-By" log-format-upstream: "nginx-http from=\"nginx-over-vpn\" time=\"$time_iso8601\" remote.addr=\"$proxy_protocol_addr\" remote.user=\"$remote_user\" request.proto=\"$server_protocol\" request.verb=\"$request_method\" request.size=\"$request_length\" url.domain=\"$host\" url.path=\"$uri\" url.query=\"$args\" response.size=\"$bytes_sent\" response.status=\"$status\" response.duration=\"$upstream_response_time\" response.servers=\"$upstream_addr\" user.agent=\"$http_user_agent\" user.referrer=\"$http_referer\" k8s.ing.namespace=\"$namespace\" k8s.ing.name=\"$ingress_name\" k8s.svc.name=\"$service_name\" k8s.svc.port=\"$service_port\" request.id=\"$req_id\"" proxy-real-ip-cidr: "100.64.0.0/10,fd7a:115c:a1e0::/48,172.27.0.0/16,fda3:a0a0:cafe::/48" use-geoip: "false" use-geoip2: "false" use-gzip: "true" (root level) + one document added: apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: name: nginx-over-vpn-ingress-nginx labels: app.kubernetes.io/instance: nginx-over-vpn app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx helm.toolkit.fluxcd.io/name: nginx-over-vpn helm.toolkit.fluxcd.io/namespace: flux-system rules: - resources: - configmaps - endpoints - nodes - pods - secrets - namespaces apiGroups: - verbs: - list - watch - resources: - leases apiGroups: - coordination.k8s.io verbs: - list - watch - resources: - nodes apiGroups: - verbs: - get - resources: - services apiGroups: - verbs: - get - list - watch - resources: - ingresses apiGroups: - networking.k8s.io verbs: - get - list - watch - resources: - events apiGroups: - verbs: - create - patch - resources: - ingresses/status apiGroups: - networking.k8s.io verbs: - update - resources: - ingressclasses apiGroups: - networking.k8s.io verbs: - get - list - watch - resources: - endpointslices apiGroups: - discovery.k8s.io verbs: - list - watch - get (root level) + one document added: apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding metadata: name: nginx-over-vpn-ingress-nginx labels: app.kubernetes.io/instance: nginx-over-vpn app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx helm.toolkit.fluxcd.io/name: nginx-over-vpn helm.toolkit.fluxcd.io/namespace: flux-system roleRef: name: nginx-over-vpn-ingress-nginx apiGroup: rbac.authorization.k8s.io kind: ClusterRole subjects: - name: nginx-over-vpn-ingress-nginx kind: ServiceAccount namespace: cluster-ingress (root level) + one document added: apiVersion: rbac.authorization.k8s.io/v1 kind: Role metadata: name: nginx-over-vpn-ingress-nginx namespace: cluster-ingress labels: app.kubernetes.io/component: controller app.kubernetes.io/instance: nginx-over-vpn app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx helm.toolkit.fluxcd.io/name: nginx-over-vpn helm.toolkit.fluxcd.io/namespace: flux-system rules: - resources: - namespaces apiGroups: - verbs: - get - resources: - configmaps - pods - secrets - endpoints apiGroups: - verbs: - get - list - watch - resources: - services apiGroups: - verbs: - get - list - watch - resources: - ingresses apiGroups: - networking.k8s.io verbs: - get - list - watch - resources: - ingresses/status apiGroups: - networking.k8s.io verbs: - update - resources: - ingressclasses apiGroups: - networking.k8s.io verbs: - get - list - watch - resources: - leases apiGroups: - coordination.k8s.io resourceNames: - nginx-over-vpn-controller-leader verbs: - get - update - resources: - leases apiGroups: - coordination.k8s.io verbs: - create - resources: - events apiGroups: - verbs: - create - patch - resources: - endpointslices apiGroups: - discovery.k8s.io verbs: - list - watch - get (root level) + one document added: apiVersion: rbac.authorization.k8s.io/v1 kind: RoleBinding metadata: name: nginx-over-vpn-ingress-nginx namespace: cluster-ingress labels: app.kubernetes.io/component: controller app.kubernetes.io/instance: nginx-over-vpn app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx helm.toolkit.fluxcd.io/name: nginx-over-vpn helm.toolkit.fluxcd.io/namespace: flux-system roleRef: name: nginx-over-vpn-ingress-nginx apiGroup: rbac.authorization.k8s.io kind: Role subjects: - name: nginx-over-vpn-ingress-nginx kind: ServiceAccount namespace: cluster-ingress (root level) + one document added: apiVersion: v1 kind: Service metadata: name: nginx-over-vpn-ingress-nginx-controller-metrics namespace: cluster-ingress labels: app.kubernetes.io/component: controller app.kubernetes.io/instance: nginx-over-vpn app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx helm.toolkit.fluxcd.io/name: nginx-over-vpn helm.toolkit.fluxcd.io/namespace: flux-system spec: type: ClusterIP selector: app.kubernetes.io/component: controller app.kubernetes.io/instance: nginx-over-vpn app.kubernetes.io/name: ingress-nginx ports: - name: metrics port: 10254 protocol: TCP targetPort: metrics (root level) + one document added: apiVersion: v1 kind: Service metadata: name: nginx-over-vpn-ingress-nginx-controller-admission namespace: cluster-ingress labels: app.kubernetes.io/component: controller app.kubernetes.io/instance: nginx-over-vpn app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx helm.toolkit.fluxcd.io/name: nginx-over-vpn helm.toolkit.fluxcd.io/namespace: flux-system spec: type: ClusterIP selector: app.kubernetes.io/component: controller app.kubernetes.io/instance: nginx-over-vpn app.kubernetes.io/name: ingress-nginx ports: - name: https-webhook appProtocol: https port: 443 targetPort: webhook (root level) + one document added: apiVersion: v1 kind: Service metadata: name: nginx-over-vpn-ingress-nginx-controller namespace: cluster-ingress annotations: tailscale.com/hostname: ingress-nginx-over-vpn labels: app.kubernetes.io/component: controller app.kubernetes.io/instance: nginx-over-vpn app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx helm.toolkit.fluxcd.io/name: nginx-over-vpn helm.toolkit.fluxcd.io/namespace: flux-system spec: type: LoadBalancer ipFamilyPolicy: PreferDualStack loadBalancerClass: tailscale ipFamilies: - IPv4 - IPv6 selector: app.kubernetes.io/component: controller app.kubernetes.io/instance: nginx-over-vpn app.kubernetes.io/name: ingress-nginx ports: - name: http appProtocol: http port: 80 protocol: TCP targetPort: http - name: https appProtocol: https port: 443 protocol: TCP targetPort: https (root level) + one document added: apiVersion: v1 kind: Service metadata: name: nginx-over-vpn-ingress-nginx-defaultbackend namespace: cluster-ingress labels: app.kubernetes.io/component: default-backend app.kubernetes.io/instance: nginx-over-vpn app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx helm.toolkit.fluxcd.io/name: nginx-over-vpn helm.toolkit.fluxcd.io/namespace: flux-system spec: type: ClusterIP selector: app.kubernetes.io/component: default-backend app.kubernetes.io/instance: nginx-over-vpn app.kubernetes.io/name: ingress-nginx ports: - name: http appProtocol: http port: 80 protocol: TCP targetPort: http (root level) + one document added: apiVersion: apps/v1 kind: Deployment metadata: name: nginx-over-vpn-ingress-nginx-controller namespace: cluster-ingress labels: app.kubernetes.io/component: controller app.kubernetes.io/instance: nginx-over-vpn app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx helm.toolkit.fluxcd.io/name: nginx-over-vpn helm.toolkit.fluxcd.io/namespace: flux-system spec: minReadySeconds: 0 replicas: 2 revisionHistoryLimit: 10 selector: matchLabels: app.kubernetes.io/component: controller app.kubernetes.io/instance: nginx-over-vpn app.kubernetes.io/name: ingress-nginx template: metadata: labels: app.kubernetes.io/component: controller app.kubernetes.io/instance: nginx-over-vpn app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx spec: automountServiceAccountToken: true containers: - name: controller image: "registry.k8s.io/ingress-nginx/controller:v1.13.3@sha256:1b044f6dcac3afbb59e05d98463f1dec6f3d3fb99940bc12ca5d80270358e3bd" imagePullPolicy: IfNotPresent args: - /nginx-ingress-controller - "--default-backend-service=$(POD_NAMESPACE)/nginx-over-vpn-ingress-nginx-defaultbackend" - "--publish-service=$(POD_NAMESPACE)/nginx-over-vpn-ingress-nginx-controller" - "--election-id=nginx-over-vpn-controller-leader" - "--controller-class=infra.aether.earth/nginx-over-vpn" - "--ingress-class=nginx" - "--configmap=$(POD_NAMESPACE)/nginx-over-vpn-ingress-nginx-controller" - "--validating-webhook=:8443" - "--validating-webhook-certificate=/usr/local/certificates/cert" - "--validating-webhook-key=/usr/local/certificates/key" - "--enable-metrics=true" livenessProbe: failureThreshold: 5 httpGet: path: /healthz port: 10254 scheme: HTTP initialDelaySeconds: 10 periodSeconds: 10 successThreshold: 1 timeoutSeconds: 1 ports: - name: http containerPort: 80 protocol: TCP - name: https containerPort: 443 protocol: TCP - name: metrics containerPort: 10254 protocol: TCP - name: webhook containerPort: 8443 protocol: TCP readinessProbe: failureThreshold: 3 httpGet: path: /healthz port: 10254 scheme: HTTP initialDelaySeconds: 10 periodSeconds: 10 successThreshold: 1 timeoutSeconds: 1 resources: requests: cpu: 100m memory: 90Mi volumeMounts: - name: webhook-cert mountPath: /usr/local/certificates/ readOnly: true securityContext: allowPrivilegeEscalation: false capabilities: add: - NET_BIND_SERVICE drop: - ALL readOnlyRootFilesystem: false runAsGroup: 82 runAsNonRoot: true runAsUser: 101 seccompProfile: type: RuntimeDefault env: - name: POD_NAME valueFrom: fieldRef: fieldPath: metadata.name - name: POD_NAMESPACE valueFrom: fieldRef: fieldPath: metadata.namespace - name: LD_PRELOAD value: /usr/local/lib/libmimalloc.so lifecycle: preStop: exec: command: - /wait-shutdown dnsPolicy: ClusterFirst nodeSelector: kubernetes.io/os: linux serviceAccountName: nginx-over-vpn-ingress-nginx terminationGracePeriodSeconds: 300 volumes: - name: webhook-cert secret: items: - key: tls.crt path: cert - key: tls.key path: key secretName: nginx-over-vpn-ingress-nginx-admission (root level) + one document added: apiVersion: apps/v1 kind: Deployment metadata: name: nginx-over-vpn-ingress-nginx-defaultbackend namespace: cluster-ingress labels: app.kubernetes.io/component: default-backend app.kubernetes.io/instance: nginx-over-vpn app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx helm.toolkit.fluxcd.io/name: nginx-over-vpn helm.toolkit.fluxcd.io/namespace: flux-system spec: minReadySeconds: 0 replicas: 1 revisionHistoryLimit: 10 selector: matchLabels: app.kubernetes.io/component: default-backend app.kubernetes.io/instance: nginx-over-vpn app.kubernetes.io/name: ingress-nginx template: metadata: labels: app.kubernetes.io/component: default-backend app.kubernetes.io/instance: nginx-over-vpn app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx spec: automountServiceAccountToken: true containers: - name: ingress-nginx-default-backend image: "ghcr.io/tarampampam/error-pages:3.3.2" imagePullPolicy: IfNotPresent env: - name: TEMPLATE_NAME value: connection - name: SHOW_DETAILS value: "true" - name: SEND_SAME_HTTP_CODE value: "true" - name: DISABLE_MINIFICATION value: "true" livenessProbe: failureThreshold: 3 httpGet: path: /healthz port: 8080 scheme: HTTP initialDelaySeconds: 30 periodSeconds: 10 successThreshold: 1 timeoutSeconds: 5 ports: - name: http containerPort: 8080 protocol: TCP readinessProbe: failureThreshold: 6 httpGet: path: /healthz port: 8080 scheme: HTTP initialDelaySeconds: 0 periodSeconds: 5 successThreshold: 1 timeoutSeconds: 5 securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL readOnlyRootFilesystem: true runAsGroup: 65534 runAsNonRoot: true runAsUser: 65534 seccompProfile: type: RuntimeDefault nodeSelector: kubernetes.io/os: linux serviceAccountName: nginx-over-vpn-ingress-nginx-backend terminationGracePeriodSeconds: 60 (root level) + one document added: apiVersion: networking.k8s.io/v1 kind: IngressClass metadata: name: nginx-over-vpn labels: app.kubernetes.io/component: controller app.kubernetes.io/instance: nginx-over-vpn app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx helm.toolkit.fluxcd.io/name: nginx-over-vpn helm.toolkit.fluxcd.io/namespace: flux-system spec: controller: infra.aether.earth/nginx-over-vpn (root level) + one document added: apiVersion: admissionregistration.k8s.io/v1 kind: ValidatingWebhookConfiguration metadata: name: nginx-over-vpn-ingress-nginx-admission annotations: cert-manager.io/inject-ca-from: cluster-ingress/nginx-over-vpn-ingress-nginx-admission certmanager.k8s.io/inject-ca-from: cluster-ingress/nginx-over-vpn-ingress-nginx-admission labels: app.kubernetes.io/component: admission-webhook app.kubernetes.io/instance: nginx-over-vpn app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx helm.toolkit.fluxcd.io/name: nginx-over-vpn helm.toolkit.fluxcd.io/namespace: flux-system webhooks: - name: validate.nginx.ingress.kubernetes.io failurePolicy: Fail matchPolicy: Equivalent sideEffects: None admissionReviewVersions: - v1 clientConfig: service: name: nginx-over-vpn-ingress-nginx-controller-admission namespace: cluster-ingress path: /networking/v1/ingresses port: 443 rules: - resources: - ingresses apiGroups: - networking.k8s.io apiVersions: - v1 operations: - CREATE - UPDATE (root level) + one document added: apiVersion: cert-manager.io/v1 kind: Certificate metadata: name: nginx-over-vpn-ingress-nginx-admission namespace: cluster-ingress labels: helm.toolkit.fluxcd.io/name: nginx-over-vpn helm.toolkit.fluxcd.io/namespace: flux-system spec: dnsNames: - nginx-over-vpn-ingress-nginx-controller-admission - nginx-over-vpn-ingress-nginx-controller-admission.cluster-ingress - nginx-over-vpn-ingress-nginx-controller-admission.cluster-ingress.svc duration: 8760h0m0s issuerRef: name: in-cluster-ca group: cert-manager.io kind: ClusterIssuer secretName: nginx-over-vpn-ingress-nginx-admission subject: organizations: - ingress-nginx-admission (root level) + one document added: apiVersion: monitoring.coreos.com/v1 kind: ServiceMonitor metadata: name: nginx-over-vpn-ingress-nginx-controller namespace: cluster-ingress labels: app.kubernetes.io/component: controller app.kubernetes.io/instance: nginx-over-vpn app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx helm.toolkit.fluxcd.io/name: nginx-over-vpn helm.toolkit.fluxcd.io/namespace: flux-system spec: endpoints: - interval: 30s port: metrics namespaceSelector: matchNames: - cluster-ingress selector: matchLabels: app.kubernetes.io/component: controller app.kubernetes.io/instance: nginx-over-vpn app.kubernetes.io/name: ingress-nginx (root level) + one document added: apiVersion: v1 kind: ServiceAccount metadata: name: node-feature-discovery namespace: kube-privileged labels: app.kubernetes.io/instance: node-feature-discovery app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: node-feature-discovery helm.toolkit.fluxcd.io/name: node-feature-discovery helm.toolkit.fluxcd.io/namespace: flux-system (root level) + one document added: apiVersion: v1 kind: ServiceAccount metadata: name: node-feature-discovery-gc namespace: kube-privileged labels: app.kubernetes.io/instance: node-feature-discovery app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: node-feature-discovery helm.toolkit.fluxcd.io/name: node-feature-discovery helm.toolkit.fluxcd.io/namespace: flux-system (root level) + one document added: apiVersion: v1 kind: ServiceAccount metadata: name: node-feature-discovery-worker namespace: kube-privileged labels: app.kubernetes.io/instance: node-feature-discovery app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: node-feature-discovery helm.toolkit.fluxcd.io/name: node-feature-discovery helm.toolkit.fluxcd.io/namespace: flux-system (root level) + one document added: apiVersion: v1 kind: ConfigMap metadata: name: node-feature-discovery-master-conf namespace: kube-privileged labels: app.kubernetes.io/instance: node-feature-discovery app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: node-feature-discovery helm.toolkit.fluxcd.io/name: node-feature-discovery helm.toolkit.fluxcd.io/namespace: flux-system data: nfd-master.conf: "null" (root level) + one document added: apiVersion: v1 kind: ConfigMap metadata: name: node-feature-discovery-worker-conf namespace: kube-privileged labels: app.kubernetes.io/instance: node-feature-discovery app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: node-feature-discovery helm.toolkit.fluxcd.io/name: node-feature-discovery helm.toolkit.fluxcd.io/namespace: flux-system data: nfd-worker.conf: "null" (root level) + one document added: apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: name: node-feature-discovery labels: app.kubernetes.io/instance: node-feature-discovery app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: node-feature-discovery helm.toolkit.fluxcd.io/name: node-feature-discovery helm.toolkit.fluxcd.io/namespace: flux-system rules: - resources: - namespaces apiGroups: - verbs: - watch - list - resources: - nodes - nodes/status apiGroups: - verbs: - get - patch - update - list - resources: - nodefeatures - nodefeaturerules - nodefeaturegroups apiGroups: - nfd.k8s-sigs.io verbs: - get - list - watch - resources: - nodefeaturegroups/status apiGroups: - nfd.k8s-sigs.io verbs: - patch - update - resources: - leases apiGroups: - coordination.k8s.io verbs: - create - resources: - leases apiGroups: - coordination.k8s.io resourceNames: - nfd-master.nfd.kubernetes.io verbs: - get - update (root level) + one document added: apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: name: node-feature-discovery-gc labels: app.kubernetes.io/instance: node-feature-discovery app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: node-feature-discovery helm.toolkit.fluxcd.io/name: node-feature-discovery helm.toolkit.fluxcd.io/namespace: flux-system rules: - resources: - nodes apiGroups: - verbs: - list - watch - resources: - noderesourcetopologies apiGroups: - topology.node.k8s.io verbs: - delete - list - resources: - nodefeatures apiGroups: - nfd.k8s-sigs.io verbs: - delete - list (root level) + one document added: apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding metadata: name: node-feature-discovery labels: app.kubernetes.io/instance: node-feature-discovery app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: node-feature-discovery helm.toolkit.fluxcd.io/name: node-feature-discovery helm.toolkit.fluxcd.io/namespace: flux-system roleRef: name: node-feature-discovery apiGroup: rbac.authorization.k8s.io kind: ClusterRole subjects: - name: node-feature-discovery kind: ServiceAccount namespace: kube-privileged (root level) + one document added: apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding metadata: name: node-feature-discovery-gc labels: app.kubernetes.io/instance: node-feature-discovery app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: node-feature-discovery helm.toolkit.fluxcd.io/name: node-feature-discovery helm.toolkit.fluxcd.io/namespace: flux-system roleRef: name: node-feature-discovery-gc apiGroup: rbac.authorization.k8s.io kind: ClusterRole subjects: - name: node-feature-discovery-gc kind: ServiceAccount namespace: kube-privileged (root level) + one document added: apiVersion: rbac.authorization.k8s.io/v1 kind: Role metadata: name: node-feature-discovery-worker namespace: kube-privileged labels: app.kubernetes.io/instance: node-feature-discovery app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: node-feature-discovery helm.toolkit.fluxcd.io/name: node-feature-discovery helm.toolkit.fluxcd.io/namespace: flux-system rules: - resources: - nodefeatures apiGroups: - nfd.k8s-sigs.io verbs: - create - get - update - delete - resources: - pods apiGroups: - verbs: - get (root level) + one document added: apiVersion: rbac.authorization.k8s.io/v1 kind: RoleBinding metadata: name: node-feature-discovery-worker namespace: kube-privileged labels: app.kubernetes.io/instance: node-feature-discovery app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: node-feature-discovery helm.toolkit.fluxcd.io/name: node-feature-discovery helm.toolkit.fluxcd.io/namespace: flux-system roleRef: name: node-feature-discovery-worker apiGroup: rbac.authorization.k8s.io kind: Role subjects: - name: node-feature-discovery-worker kind: ServiceAccount namespace: kube-privileged (root level) + one document added: apiVersion: apps/v1 kind: DaemonSet metadata: name: node-feature-discovery-worker namespace: kube-privileged labels: app.kubernetes.io/instance: node-feature-discovery app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: node-feature-discovery helm.toolkit.fluxcd.io/name: node-feature-discovery helm.toolkit.fluxcd.io/namespace: flux-system role: worker spec: revisionHistoryLimit: null selector: matchLabels: app.kubernetes.io/instance: node-feature-discovery app.kubernetes.io/name: node-feature-discovery role: worker template: metadata: labels: app.kubernetes.io/instance: node-feature-discovery app.kubernetes.io/name: node-feature-discovery role: worker spec: containers: - name: worker image: "registry.k8s.io/nfd/node-feature-discovery:v0.19.0" imagePullPolicy: IfNotPresent args: - "-owner-refs=pod,ds" - "-port=8080" command: - nfd-worker livenessProbe: httpGet: path: /healthz port: http initialDelaySeconds: 10 ports: - name: http containerPort: 8080 readinessProbe: failureThreshold: 10 httpGet: path: /healthz port: http initialDelaySeconds: 5 resources: limits: memory: 512Mi requests: cpu: 5m memory: 64Mi volumeMounts: - name: host-boot mountPath: /host-boot readOnly: true - name: host-os-release mountPath: /host-etc/os-release readOnly: true - name: host-sys mountPath: /host-sys readOnly: true - name: host-usr-lib mountPath: /host-usr/lib readOnly: true - name: host-lib mountPath: /host-lib readOnly: true - name: host-proc-swaps mountPath: /host-proc/swaps readOnly: true - name: features-d mountPath: /etc/kubernetes/node-feature-discovery/features.d/ readOnly: true - name: nfd-worker-conf mountPath: /etc/kubernetes/node-feature-discovery readOnly: true securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL readOnlyRootFilesystem: true runAsNonRoot: true env: - name: NODE_NAME valueFrom: fieldRef: fieldPath: spec.nodeName - name: POD_NAME valueFrom: fieldRef: fieldPath: metadata.name - name: POD_UID valueFrom: fieldRef: fieldPath: metadata.uid dnsPolicy: ClusterFirstWithHostNet hostNetwork: false imagePullSecrets: null securityContext: {} serviceAccountName: node-feature-discovery-worker volumes: - name: host-boot hostPath: path: /boot - name: host-os-release hostPath: path: /etc/os-release - name: host-sys hostPath: path: /sys - name: host-usr-lib hostPath: path: /usr/lib - name: host-lib hostPath: path: /lib - name: host-proc-swaps hostPath: path: /proc/swaps - name: features-d hostPath: path: /etc/kubernetes/node-feature-discovery/features.d/ - name: nfd-worker-conf configMap: name: node-feature-discovery-worker-conf items: - key: nfd-worker.conf path: nfd-worker.conf updateStrategy: rollingUpdate: maxUnavailable: 10% (root level) + one document added: apiVersion: apps/v1 kind: Deployment metadata: name: node-feature-discovery-master namespace: kube-privileged labels: app.kubernetes.io/instance: node-feature-discovery app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: node-feature-discovery helm.toolkit.fluxcd.io/name: node-feature-discovery helm.toolkit.fluxcd.io/namespace: flux-system role: master spec: replicas: 1 revisionHistoryLimit: null selector: matchLabels: app.kubernetes.io/instance: node-feature-discovery app.kubernetes.io/name: node-feature-discovery role: master template: metadata: labels: app.kubernetes.io/instance: node-feature-discovery app.kubernetes.io/name: node-feature-discovery role: master spec: affinity: nodeAffinity: preferredDuringSchedulingIgnoredDuringExecution: - preference: matchExpressions: - key: node-role.kubernetes.io/control-plane operator: In values: - weight: 1 containers: - name: master image: "registry.k8s.io/nfd/node-feature-discovery:v0.19.0" imagePullPolicy: IfNotPresent args: - "-port=8080" command: - nfd-master livenessProbe: httpGet: path: /healthz port: http ports: - name: http containerPort: 8080 readinessProbe: failureThreshold: 10 httpGet: path: /healthz port: http resources: limits: memory: 4Gi requests: cpu: 100m memory: 128Mi startupProbe: failureThreshold: 30 httpGet: path: /healthz port: http volumeMounts: - name: nfd-master-conf mountPath: /etc/kubernetes/node-feature-discovery readOnly: true securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL readOnlyRootFilesystem: true runAsNonRoot: true env: - name: NODE_NAME valueFrom: fieldRef: fieldPath: spec.nodeName dnsPolicy: ClusterFirstWithHostNet enableServiceLinks: false hostNetwork: false imagePullSecrets: null securityContext: {} serviceAccountName: node-feature-discovery tolerations: - key: node-role.kubernetes.io/control-plane effect: NoSchedule operator: Equal value: volumes: - name: nfd-master-conf configMap: name: node-feature-discovery-master-conf items: - key: nfd-master.conf path: nfd-master.conf (root level) + one document added: apiVersion: apps/v1 kind: Deployment metadata: name: node-feature-discovery-gc namespace: kube-privileged labels: app.kubernetes.io/instance: node-feature-discovery app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: node-feature-discovery helm.toolkit.fluxcd.io/name: node-feature-discovery helm.toolkit.fluxcd.io/namespace: flux-system role: gc spec: replicas: 1 revisionHistoryLimit: null selector: matchLabels: app.kubernetes.io/instance: node-feature-discovery app.kubernetes.io/name: node-feature-discovery role: gc template: metadata: labels: app.kubernetes.io/instance: node-feature-discovery app.kubernetes.io/name: node-feature-discovery role: gc spec: containers: - name: gc image: "registry.k8s.io/nfd/node-feature-discovery:v0.19.0" imagePullPolicy: IfNotPresent args: - "-gc-interval=1h" command: - nfd-gc livenessProbe: httpGet: path: /healthz port: http initialDelaySeconds: 10 ports: - name: http containerPort: 8080 readinessProbe: httpGet: path: /healthz port: http initialDelaySeconds: 5 resources: limits: memory: 1Gi requests: cpu: 10m memory: 128Mi securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL readOnlyRootFilesystem: true runAsNonRoot: true env: - name: NODE_NAME valueFrom: fieldRef: fieldPath: spec.nodeName dnsPolicy: ClusterFirstWithHostNet hostNetwork: false imagePullSecrets: null securityContext: {} serviceAccountName: node-feature-discovery-gc (root level) + one document added: apiVersion: monitoring.coreos.com/v1 kind: PodMonitor metadata: name: node-feature-discovery namespace: kube-privileged labels: app.kubernetes.io/instance: node-feature-discovery app.kubernetes.io/name: node-feature-discovery helm.toolkit.fluxcd.io/name: node-feature-discovery helm.toolkit.fluxcd.io/namespace: flux-system spec: namespaceSelector: matchNames: - kube-privileged podMetricsEndpoints: - honorLabels: true interval: 10s path: /metrics port: http scheme: http selector: matchExpressions: - key: app.kubernetes.io/instance operator: In values: - node-feature-discovery - key: app.kubernetes.io/name operator: In values: - node-feature-discovery (root level) + one document added: apiVersion: v1 kind: ServiceAccount metadata: name: node-feature-discovery-prune namespace: kube-privileged annotations: helm.sh/hook: post-delete helm.sh/hook-delete-policy: "before-hook-creation,hook-succeeded" labels: app.kubernetes.io/instance: node-feature-discovery app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: node-feature-discovery (root level) + one document added: apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: name: node-feature-discovery-prune annotations: helm.sh/hook: post-delete helm.sh/hook-delete-policy: "before-hook-creation,hook-succeeded" labels: app.kubernetes.io/instance: node-feature-discovery app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: node-feature-discovery rules: - resources: - nodes - nodes/status apiGroups: - verbs: - get - patch - update - list (root level) + one document added: apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding metadata: name: node-feature-discovery-prune annotations: helm.sh/hook: post-delete helm.sh/hook-delete-policy: "before-hook-creation,hook-succeeded" labels: app.kubernetes.io/instance: node-feature-discovery app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: node-feature-discovery roleRef: name: node-feature-discovery-prune apiGroup: rbac.authorization.k8s.io kind: ClusterRole subjects: - name: node-feature-discovery-prune kind: ServiceAccount namespace: kube-privileged (root level) + one document added: apiVersion: batch/v1 kind: Job metadata: name: node-feature-discovery-prune namespace: kube-privileged annotations: helm.sh/hook: post-delete helm.sh/hook-delete-policy: "before-hook-creation,hook-succeeded" labels: app.kubernetes.io/instance: node-feature-discovery app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: node-feature-discovery spec: template: metadata: labels: app.kubernetes.io/instance: node-feature-discovery app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: node-feature-discovery role: prune spec: affinity: nodeAffinity: preferredDuringSchedulingIgnoredDuringExecution: - preference: matchExpressions: - key: node-role.kubernetes.io/control-plane operator: In values: - weight: 1 containers: - name: nfd-master image: "registry.k8s.io/nfd/node-feature-discovery:v0.19.0" imagePullPolicy: IfNotPresent args: - "-prune" command: - nfd-master resources: limits: memory: 4Gi requests: cpu: 100m memory: 128Mi securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL readOnlyRootFilesystem: true runAsNonRoot: true imagePullSecrets: null restartPolicy: Never serviceAccountName: node-feature-discovery-prune tolerations: - key: node-role.kubernetes.io/control-plane effect: NoSchedule operator: Equal value: ttlSecondsAfterFinished: 3600 (root level) + one document added: apiVersion: v1 kind: ServiceAccount metadata: name: node-problem-detector namespace: kube-privileged labels: app.kubernetes.io/instance: node-problem-detector app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: node-problem-detector helm.toolkit.fluxcd.io/name: node-problem-detector helm.toolkit.fluxcd.io/namespace: flux-system (root level) + one document added: apiVersion: v1 kind: ConfigMap metadata: name: node-problem-detector-custom-config namespace: kube-privileged labels: app.kubernetes.io/instance: node-problem-detector app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: node-problem-detector helm.toolkit.fluxcd.io/name: node-problem-detector helm.toolkit.fluxcd.io/namespace: flux-system data: {} (root level) + one document added: apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: name: node-problem-detector labels: app.kubernetes.io/instance: node-problem-detector app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: node-problem-detector helm.toolkit.fluxcd.io/name: node-problem-detector helm.toolkit.fluxcd.io/namespace: flux-system rules: - resources: - nodes apiGroups: - verbs: - get - resources: - nodes/status apiGroups: - verbs: - patch - resources: - events apiGroups: - verbs: - create - patch - update (root level) + one document added: apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding metadata: name: node-problem-detector labels: app.kubernetes.io/instance: node-problem-detector app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: node-problem-detector helm.toolkit.fluxcd.io/name: node-problem-detector helm.toolkit.fluxcd.io/namespace: flux-system roleRef: name: node-problem-detector apiGroup: rbac.authorization.k8s.io kind: ClusterRole subjects: - name: node-problem-detector kind: ServiceAccount namespace: kube-privileged (root level) + one document added: apiVersion: v1 kind: Service metadata: name: node-problem-detector namespace: kube-privileged annotations: prometheus.io/path: /metrics prometheus.io/port: "20257" prometheus.io/scheme: http prometheus.io/scrape: "true" labels: app: node-problem-detector app.kubernetes.io/instance: node-problem-detector app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: node-problem-detector helm.toolkit.fluxcd.io/name: node-problem-detector helm.toolkit.fluxcd.io/namespace: flux-system spec: type: ClusterIP clusterIP: None selector: app: node-problem-detector ports: - name: exporter port: 20257 protocol: TCP (root level) + one document added: apiVersion: apps/v1 kind: DaemonSet metadata: name: node-problem-detector namespace: kube-privileged labels: app.kubernetes.io/instance: node-problem-detector app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: node-problem-detector helm.toolkit.fluxcd.io/name: node-problem-detector helm.toolkit.fluxcd.io/namespace: flux-system spec: selector: matchLabels: app: node-problem-detector app.kubernetes.io/instance: node-problem-detector app.kubernetes.io/name: node-problem-detector template: metadata: labels: app: node-problem-detector app.kubernetes.io/instance: node-problem-detector app.kubernetes.io/name: node-problem-detector spec: containers: - name: node-problem-detector image: "registry.k8s.io/node-problem-detector/node-problem-detector:v0.8.19" imagePullPolicy: IfNotPresent resources: {} command: - /bin/sh - "-c" - "exec /node-problem-detector --logtostderr --config.system-log-monitor=/config/kernel-monitor.json,/config/docker-monitor.json --prometheus-address=0.0.0.0 --prometheus-port=20257 --k8s-exporter-heartbeat-period=5m0s " securityContext: privileged: true ports: - name: exporter containerPort: 20257 volumeMounts: - name: log mountPath: /var/log/ readOnly: true - name: localtime mountPath: /etc/localtime readOnly: true - name: custom-config mountPath: /custom-config readOnly: true env: - name: NODE_NAME valueFrom: fieldRef: fieldPath: spec.nodeName hostNetwork: false hostPID: false priorityClassName: system-node-critical serviceAccountName: node-problem-detector terminationGracePeriodSeconds: 30 tolerations: - effect: NoSchedule operator: Exists volumes: - name: log hostPath: path: /var/log/ - name: localtime hostPath: type: FileOrCreate path: /etc/localtime - name: custom-config configMap: name: node-problem-detector-custom-config defaultMode: 493 updateStrategy: type: RollingUpdate rollingUpdate: maxUnavailable: 1 (root level) + one document added: apiVersion: monitoring.coreos.com/v1 kind: PrometheusRule metadata: name: node-problem-detector namespace: kube-privileged labels: app.kubernetes.io/instance: node-problem-detector app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: node-problem-detector helm.toolkit.fluxcd.io/name: node-problem-detector helm.toolkit.fluxcd.io/namespace: flux-system spec: groups: - name: node-problem-detector.rules rules: - alert: NodeProblemTaskHung annotations: description: "Task hung in node {{ $labels.node }}" summary: "Task hung" expr: "increase(problem_counter{reason=\"TaskHung\"}[2m]) > 0" for: 1s labels: severity: warning - alert: NodeProblemOOMKilling annotations: description: "Process Out-Of-Memory Killed in node {{ $labels.node }}" summary: "Process Out-Of-Memory Killed" expr: "increase(problem_counter{reason=\"OOMKilling\"}[2m]) > 0" for: 1s labels: severity: warning - alert: NodeProblemUnregisterNetDevice annotations: description: "Unable to unregister a network device in node {{ $labels.node }}" summary: "Unregister Network Device" expr: "increase(problem_counter{reason=\"UnregisterNetDevice\"}[2m]) > 0" for: 1s labels: severity: warning - alert: NodeProblemMemoryReadError annotations: description: "CE memory read error in node {{ $labels.node }}" summary: "Memory Read Error" expr: "increase(problem_counter{reason=\"MemoryReadError\"}[2m]) > 0" for: 1s labels: severity: warning - alert: NodeProblemKernelOops annotations: description: "Kernel oops detected in node {{ $labels.node }}" summary: "Kernel oops" expr: "increase(problem_counter{reason=\"KernelOops\"}[2m]) > 0" for: 1s labels: severity: warning - alert: NodeProblemIOError annotations: description: "Buffer I/O error in node {{ $labels.node }}" summary: "Buffer I/O error" expr: "increase(problem_counter{reason=\"IOError\"}[2m]) > 0" for: 1s labels: severity: warning - alert: NodeProblemFilesystemIsReadOnly annotations: description: "Filesystem is read only in node {{ $labels.node }}" summary: "Filesystem is read only" expr: "increase(problem_counter{reason=\"FilesystemIsReadOnly\"}[2m]) > 0" for: 1s labels: severity: warning - alert: NodeProblemExt4Warning annotations: description: "EXT4-fs warning in node {{ $labels.node }}" summary: "EXT4-fs warning" expr: "increase(problem_counter{reason=\"Ext4Warning\"}[2m]) > 0" for: 1s labels: severity: warning - alert: NodeProblemExt4Error annotations: description: "EXT4-fs error in node {{ $labels.node }}" summary: "EXT4-fs error" expr: "increase(problem_counter{reason=\"Ext4Error\"}[2m]) > 0" for: 1s labels: severity: warning - alert: NodeProblemDockerHung annotations: description: "Docker hung in node {{ $labels.node }}" summary: "Docker hung" expr: "increase(problem_counter{reason=\"DockerHung\"}[2m]) > 0" for: 1s labels: severity: warning - alert: NodeProblemDockerContainerStartupFailure annotations: description: "Docker container startup failure in node {{ $labels.node }}" summary: "Docker container startup failure" expr: "increase(problem_counter{reason=\"DockerContainerStartupFailure\"}[2m]) > 0" for: 1s labels: severity: warning - alert: NodeProblemCorruptDockerOverlay2 annotations: description: "Corrupt docker overlay2 in node {{ $labels.node }}" summary: "Corrupt docker overlay2" expr: "increase(problem_counter{reason=\"CorruptDockerOverlay2\"}[2m]) > 0" for: 1s labels: severity: warning - alert: NodeProblemCorruptDockerImage annotations: description: "Corrupt docker image in node {{ $labels.node }}" summary: "Corrupt docker image" expr: "increase(problem_counter{reason=\"CorruptDockerImage\"}[2m]) > 0" for: 1s labels: severity: warning - alert: NodeProblemGaugeCorruptDockerOverlay2 annotations: description: "Corrupt docker overlay2 is affecting node {{ $labels.node }}" summary: "Corrupt docker overlay2" expr: "increase(problem_gauge{reason=\"CorruptDockerOverlay2\",type=\"CorruptDockerOverlay2\"}[2m]) > 0" for: 1s labels: severity: critical - alert: NodeProblemGaugeDockerHung annotations: description: "Docker hung (Kernel deadlock) is affecting node {{ $labels.node }}" summary: "Docker hung" expr: "increase(problem_gauge{reason=\"DockerHung\",type=\"KernelDeadlock\"}[2m]) > 0" for: 1s labels: severity: critical - alert: NodeProblemGaugeFilesystemIsReadOnly annotations: description: "Read only filesystem is affecting node {{ $labels.node }}" summary: "Filesystem is read only" expr: "increase(problem_gauge{reason=\"FilesystemIsReadOnly\",type=\"ReadonlyFilesystem\"}[2m]) > 0" for: 1s labels: severity: critical (root level) + one document added: apiVersion: monitoring.coreos.com/v1 kind: ServiceMonitor metadata: name: node-problem-detector namespace: kube-privileged labels: app.kubernetes.io/instance: node-problem-detector app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: node-problem-detector helm.toolkit.fluxcd.io/name: node-problem-detector helm.toolkit.fluxcd.io/namespace: flux-system spec: endpoints: - interval: 60s path: /metrics port: exporter relabelings: - action: replace sourceLabels: - __meta_kubernetes_pod_node_name targetLabel: node - action: replace sourceLabels: - __meta_kubernetes_pod_host_ip targetLabel: host_ip namespaceSelector: matchNames: - kube-privileged selector: matchLabels: app: node-problem-detector (root level) + one document added: apiVersion: v1 kind: ServiceAccount metadata: name: node-feature-discovery namespace: nvidia labels: app.kubernetes.io/instance: nvidia-device-plugin app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: node-feature-discovery helm.toolkit.fluxcd.io/name: nvidia-device-plugin helm.toolkit.fluxcd.io/namespace: flux-system (root level) + one document added: apiVersion: v1 kind: ServiceAccount metadata: name: nvidia-device-plugin-node-feature-discovery-gc namespace: nvidia labels: app.kubernetes.io/instance: nvidia-device-plugin app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: node-feature-discovery helm.toolkit.fluxcd.io/name: nvidia-device-plugin helm.toolkit.fluxcd.io/namespace: flux-system (root level) + one document added: apiVersion: v1 kind: ServiceAccount metadata: name: nvidia-device-plugin-node-feature-discovery-worker namespace: nvidia labels: app.kubernetes.io/instance: nvidia-device-plugin app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: node-feature-discovery helm.toolkit.fluxcd.io/name: nvidia-device-plugin helm.toolkit.fluxcd.io/namespace: flux-system (root level) + one document added: apiVersion: v1 kind: ServiceAccount metadata: name: nvidia-device-plugin-service-account namespace: nvidia labels: app.kubernetes.io/instance: nvidia-device-plugin app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: nvidia-device-plugin helm.toolkit.fluxcd.io/name: nvidia-device-plugin helm.toolkit.fluxcd.io/namespace: flux-system (root level) + one document added: apiVersion: v1 kind: ConfigMap metadata: name: nvidia-device-plugin-node-feature-discovery-master-conf namespace: nvidia labels: app.kubernetes.io/instance: nvidia-device-plugin app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: node-feature-discovery helm.toolkit.fluxcd.io/name: nvidia-device-plugin helm.toolkit.fluxcd.io/namespace: flux-system data: nfd-master.conf: | extraLabelNs: - nvidia.com (root level) + one document added: apiVersion: v1 kind: ConfigMap metadata: name: nvidia-device-plugin-node-feature-discovery-worker-conf namespace: nvidia labels: app.kubernetes.io/instance: nvidia-device-plugin app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: node-feature-discovery helm.toolkit.fluxcd.io/name: nvidia-device-plugin helm.toolkit.fluxcd.io/namespace: flux-system data: nfd-worker.conf: | sources: pci: deviceClassWhitelist: - "02" - "03" deviceLabelFields: - vendor (root level) + one document added: apiVersion: v1 kind: ConfigMap metadata: name: nvidia-device-plugin-configs namespace: nvidia labels: app.kubernetes.io/instance: nvidia-device-plugin app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: nvidia-device-plugin helm.toolkit.fluxcd.io/name: nvidia-device-plugin helm.toolkit.fluxcd.io/namespace: flux-system data: default: | "flags": "migStrategy": "none" "sharing": "timeSlicing": "resources": - "name": "nvidia.com/gpu" "replicas": 64 "version": "v1" (root level) + one document added: apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: name: nvidia-device-plugin-node-feature-discovery labels: app.kubernetes.io/instance: nvidia-device-plugin app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: node-feature-discovery helm.toolkit.fluxcd.io/name: nvidia-device-plugin helm.toolkit.fluxcd.io/namespace: flux-system rules: - resources: - namespaces apiGroups: - verbs: - watch - list - resources: - nodes - nodes/status apiGroups: - verbs: - get - patch - update - list - resources: - nodefeatures - nodefeaturerules - nodefeaturegroups apiGroups: - nfd.k8s-sigs.io verbs: - get - list - watch - resources: - nodefeaturegroups/status apiGroups: - nfd.k8s-sigs.io verbs: - patch - update - resources: - leases apiGroups: - coordination.k8s.io verbs: - create - resources: - leases apiGroups: - coordination.k8s.io resourceNames: - nfd-master.nfd.kubernetes.io verbs: - get - update (root level) + one document added: apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: name: nvidia-device-plugin-node-feature-discovery-gc labels: app.kubernetes.io/instance: nvidia-device-plugin app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: node-feature-discovery helm.toolkit.fluxcd.io/name: nvidia-device-plugin helm.toolkit.fluxcd.io/namespace: flux-system rules: - resources: - nodes apiGroups: - verbs: - list - watch - resources: - nodes/proxy apiGroups: - verbs: - get - resources: - noderesourcetopologies apiGroups: - topology.node.k8s.io verbs: - delete - list - resources: - nodefeatures apiGroups: - nfd.k8s-sigs.io verbs: - delete - list (root level) + one document added: apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: name: nvidia-device-plugin-role labels: app.kubernetes.io/instance: nvidia-device-plugin app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: nvidia-device-plugin helm.toolkit.fluxcd.io/name: nvidia-device-plugin helm.toolkit.fluxcd.io/namespace: flux-system rules: - resources: - nodes apiGroups: - verbs: - get - list - watch - resources: - nodefeatures apiGroups: - nfd.k8s-sigs.io verbs: - get - list - watch - create - update - resources: - pods apiGroups: - verbs: - get (root level) + one document added: apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding metadata: name: nvidia-device-plugin-node-feature-discovery labels: app.kubernetes.io/instance: nvidia-device-plugin app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: node-feature-discovery helm.toolkit.fluxcd.io/name: nvidia-device-plugin helm.toolkit.fluxcd.io/namespace: flux-system roleRef: name: nvidia-device-plugin-node-feature-discovery apiGroup: rbac.authorization.k8s.io kind: ClusterRole subjects: - name: node-feature-discovery kind: ServiceAccount namespace: nvidia (root level) + one document added: apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding metadata: name: nvidia-device-plugin-node-feature-discovery-gc labels: app.kubernetes.io/instance: nvidia-device-plugin app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: node-feature-discovery helm.toolkit.fluxcd.io/name: nvidia-device-plugin helm.toolkit.fluxcd.io/namespace: flux-system roleRef: name: nvidia-device-plugin-node-feature-discovery-gc apiGroup: rbac.authorization.k8s.io kind: ClusterRole subjects: - name: nvidia-device-plugin-node-feature-discovery-gc kind: ServiceAccount namespace: nvidia (root level) + one document added: apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding metadata: name: nvidia-device-plugin-role-binding labels: app.kubernetes.io/instance: nvidia-device-plugin app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: nvidia-device-plugin helm.toolkit.fluxcd.io/name: nvidia-device-plugin helm.toolkit.fluxcd.io/namespace: flux-system roleRef: name: nvidia-device-plugin-role apiGroup: rbac.authorization.k8s.io kind: ClusterRole subjects: - name: nvidia-device-plugin-service-account kind: ServiceAccount namespace: nvidia (root level) + one document added: apiVersion: rbac.authorization.k8s.io/v1 kind: Role metadata: name: nvidia-device-plugin-node-feature-discovery-worker namespace: nvidia labels: app.kubernetes.io/instance: nvidia-device-plugin app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: node-feature-discovery helm.toolkit.fluxcd.io/name: nvidia-device-plugin helm.toolkit.fluxcd.io/namespace: flux-system rules: - resources: - nodefeatures apiGroups: - nfd.k8s-sigs.io verbs: - create - get - update - delete - resources: - pods apiGroups: - verbs: - get (root level) + one document added: apiVersion: rbac.authorization.k8s.io/v1 kind: RoleBinding metadata: name: nvidia-device-plugin-node-feature-discovery-worker namespace: nvidia labels: app.kubernetes.io/instance: nvidia-device-plugin app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: node-feature-discovery helm.toolkit.fluxcd.io/name: nvidia-device-plugin helm.toolkit.fluxcd.io/namespace: flux-system roleRef: name: nvidia-device-plugin-node-feature-discovery-worker apiGroup: rbac.authorization.k8s.io kind: Role subjects: - name: nvidia-device-plugin-node-feature-discovery-worker kind: ServiceAccount namespace: nvidia (root level) + one document added: apiVersion: apps/v1 kind: DaemonSet metadata: name: nvidia-device-plugin-node-feature-discovery-worker namespace: nvidia labels: app.kubernetes.io/instance: nvidia-device-plugin app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: node-feature-discovery helm.toolkit.fluxcd.io/name: nvidia-device-plugin helm.toolkit.fluxcd.io/namespace: flux-system role: worker spec: revisionHistoryLimit: null selector: matchLabels: app.kubernetes.io/instance: nvidia-device-plugin app.kubernetes.io/name: node-feature-discovery role: worker template: metadata: labels: app.kubernetes.io/instance: nvidia-device-plugin app.kubernetes.io/name: node-feature-discovery role: worker spec: containers: - name: worker image: "registry.k8s.io/nfd/node-feature-discovery:v0.17.3" imagePullPolicy: IfNotPresent args: - "-feature-gates=NodeFeatureGroupAPI=false" - "-metrics=8081" - "-grpc-health=8082" command: - nfd-worker livenessProbe: grpc: port: 8082 initialDelaySeconds: 10 ports: - name: metrics containerPort: 8081 - name: health containerPort: 8082 readinessProbe: failureThreshold: 10 grpc: port: 8082 initialDelaySeconds: 5 resources: limits: memory: 512Mi requests: cpu: 5m memory: 64Mi volumeMounts: - name: host-boot mountPath: /host-boot readOnly: true - name: host-os-release mountPath: /host-etc/os-release readOnly: true - name: host-sys mountPath: /host-sys readOnly: true - name: host-usr-lib mountPath: /host-usr/lib readOnly: true - name: host-lib mountPath: /host-lib readOnly: true - name: host-proc-swaps mountPath: /host-proc/swaps readOnly: true - name: features-d mountPath: /etc/kubernetes/node-feature-discovery/features.d/ readOnly: true - name: nfd-worker-conf mountPath: /etc/kubernetes/node-feature-discovery readOnly: true securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL readOnlyRootFilesystem: true runAsNonRoot: true env: - name: NODE_NAME valueFrom: fieldRef: fieldPath: spec.nodeName - name: POD_NAME valueFrom: fieldRef: fieldPath: metadata.name - name: POD_UID valueFrom: fieldRef: fieldPath: metadata.uid dnsPolicy: ClusterFirstWithHostNet hostNetwork: false securityContext: {} serviceAccountName: nvidia-device-plugin-node-feature-discovery-worker tolerations: - key: node-role.kubernetes.io/master effect: NoSchedule operator: Equal value: - key: nvidia.com/gpu effect: NoSchedule operator: Equal value: present volumes: - name: host-boot hostPath: path: /boot - name: host-os-release hostPath: path: /etc/os-release - name: host-sys hostPath: path: /sys - name: host-usr-lib hostPath: path: /usr/lib - name: host-lib hostPath: path: /lib - name: host-proc-swaps hostPath: path: /proc/swaps - name: features-d hostPath: path: /etc/kubernetes/node-feature-discovery/features.d/ - name: nfd-worker-conf configMap: name: nvidia-device-plugin-node-feature-discovery-worker-conf items: - key: nfd-worker.conf path: nfd-worker.conf (root level) + one document added: apiVersion: apps/v1 kind: DaemonSet metadata: name: nvidia-device-plugin namespace: nvidia labels: app.kubernetes.io/instance: nvidia-device-plugin app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: nvidia-device-plugin helm.toolkit.fluxcd.io/name: nvidia-device-plugin helm.toolkit.fluxcd.io/namespace: flux-system spec: selector: matchLabels: app.kubernetes.io/instance: nvidia-device-plugin app.kubernetes.io/name: nvidia-device-plugin template: metadata: labels: app.kubernetes.io/instance: nvidia-device-plugin app.kubernetes.io/name: nvidia-device-plugin spec: affinity: nodeAffinity: requiredDuringSchedulingIgnoredDuringExecution: nodeSelectorTerms: - matchExpressions: - key: feature.node.kubernetes.io/pci-10de.present operator: In values: - "true" - matchExpressions: - key: feature.node.kubernetes.io/cpu-model.vendor_id operator: In values: - NVIDIA - matchExpressions: - key: nvidia.com/gpu.present operator: In values: - "true" containers: - name: nvidia-device-plugin-sidecar image: "nvcr.io/nvidia/k8s-device-plugin:v0.19.3" command: - config-manager volumeMounts: - name: available-configs mountPath: /available-configs - name: config mountPath: /config securityContext: capabilities: add: - SYS_ADMIN env: - name: ONESHOT value: "false" - name: KUBECONFIG value: - name: NODE_NAME valueFrom: fieldRef: fieldPath: spec.nodeName - name: NODE_LABEL value: nvidia.com/device-plugin.config - name: CONFIG_FILE_SRCDIR value: /available-configs - name: CONFIG_FILE_DST value: /config/config.yaml - name: DEFAULT_CONFIG value: null - name: FALLBACK_STRATEGIES value: "named,single" - name: SEND_SIGNAL value: "true" - name: SIGNAL value: "1" - name: PROCESS_TO_SIGNAL value: nvidia-device-plugin - name: nvidia-device-plugin-ctr image: "nvcr.io/nvidia/k8s-device-plugin:v0.19.3" imagePullPolicy: IfNotPresent command: - nvidia-device-plugin env: - name: MPS_ROOT value: /run/nvidia/mps - name: CONFIG_FILE value: /config/config.yaml - name: NVIDIA_MIG_MONITOR_DEVICES value: all - name: NVIDIA_VISIBLE_DEVICES value: all - name: NVIDIA_DRIVER_CAPABILITIES value: "compute,utility" volumeMounts: - name: kubelet-device-plugins-dir mountPath: /var/lib/kubelet/device-plugins - name: mps-shm mountPath: /dev/shm - name: mps-root mountPath: /mps - name: cdi-root mountPath: /var/run/cdi - name: available-configs mountPath: /available-configs - name: config mountPath: /config securityContext: capabilities: add: - SYS_ADMIN initContainers: - name: nvidia-device-plugin-init image: "nvcr.io/nvidia/k8s-device-plugin:v0.19.3" command: - config-manager volumeMounts: - name: available-configs mountPath: /available-configs - name: config mountPath: /config env: - name: ONESHOT value: "true" - name: KUBECONFIG value: - name: NODE_NAME valueFrom: fieldRef: fieldPath: spec.nodeName - name: NODE_LABEL value: nvidia.com/device-plugin.config - name: CONFIG_FILE_SRCDIR value: /available-configs - name: CONFIG_FILE_DST value: /config/config.yaml - name: DEFAULT_CONFIG value: null - name: FALLBACK_STRATEGIES value: "named,single" - name: SEND_SIGNAL value: "false" - name: SIGNAL value: - name: PROCESS_TO_SIGNAL value: priorityClassName: system-node-critical runtimeClassName: nvidia securityContext: {} serviceAccountName: nvidia-device-plugin-service-account shareProcessNamespace: true tolerations: - key: CriticalAddonsOnly operator: Exists - key: nvidia.com/gpu effect: NoSchedule operator: Exists volumes: - name: kubelet-device-plugins-dir hostPath: type: Directory path: /var/lib/kubelet/device-plugins - name: mps-root hostPath: type: DirectoryOrCreate path: /run/nvidia/mps - name: mps-shm hostPath: path: /run/nvidia/mps/shm - name: cdi-root hostPath: type: DirectoryOrCreate path: /var/run/cdi - name: available-configs configMap: name: nvidia-device-plugin-configs - name: config emptyDir: {} updateStrategy: type: RollingUpdate (root level) + one document added: apiVersion: apps/v1 kind: DaemonSet metadata: name: nvidia-device-plugin-gpu-feature-discovery namespace: nvidia labels: app.kubernetes.io/instance: nvidia-device-plugin app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: nvidia-device-plugin helm.toolkit.fluxcd.io/name: nvidia-device-plugin helm.toolkit.fluxcd.io/namespace: flux-system spec: selector: matchLabels: app.kubernetes.io/instance: nvidia-device-plugin app.kubernetes.io/name: nvidia-device-plugin template: metadata: labels: app.kubernetes.io/instance: nvidia-device-plugin app.kubernetes.io/name: nvidia-device-plugin spec: affinity: nodeAffinity: requiredDuringSchedulingIgnoredDuringExecution: nodeSelectorTerms: - matchExpressions: - key: feature.node.kubernetes.io/pci-10de.present operator: In values: - "true" - matchExpressions: - key: feature.node.kubernetes.io/cpu-model.vendor_id operator: In values: - NVIDIA - matchExpressions: - key: nvidia.com/gpu.present operator: In values: - "true" containers: - name: gpu-feature-discovery-sidecar image: "nvcr.io/nvidia/k8s-device-plugin:v0.19.3" command: - config-manager securityContext: privileged: true volumeMounts: - name: available-configs mountPath: /available-configs - name: config mountPath: /config env: - name: ONESHOT value: "false" - name: KUBECONFIG value: - name: NODE_NAME valueFrom: fieldRef: fieldPath: spec.nodeName - name: NODE_LABEL value: nvidia.com/device-plugin.config - name: CONFIG_FILE_SRCDIR value: /available-configs - name: CONFIG_FILE_DST value: /config/config.yaml - name: DEFAULT_CONFIG value: null - name: FALLBACK_STRATEGIES value: "named,single" - name: SEND_SIGNAL value: "true" - name: SIGNAL value: "1" - name: PROCESS_TO_SIGNAL value: gpu-feature-discovery - name: gpu-feature-discovery-ctr image: "nvcr.io/nvidia/k8s-device-plugin:v0.19.3" imagePullPolicy: IfNotPresent command: - gpu-feature-discovery securityContext: privileged: true volumeMounts: - name: output-dir mountPath: /etc/kubernetes/node-feature-discovery/features.d - name: host-sys mountPath: /sys - name: available-configs mountPath: /available-configs - name: config mountPath: /config env: - name: NODE_NAME valueFrom: fieldRef: fieldPath: spec.nodeName - name: NAMESPACE valueFrom: fieldRef: fieldPath: metadata.namespace - name: POD_NAME valueFrom: fieldRef: fieldPath: metadata.name - name: CONFIG_FILE value: /config/config.yaml - name: NVIDIA_MIG_MONITOR_DEVICES value: all initContainers: - name: gpu-feature-discovery-init image: "nvcr.io/nvidia/k8s-device-plugin:v0.19.3" command: - config-manager volumeMounts: - name: available-configs mountPath: /available-configs - name: config mountPath: /config env: - name: ONESHOT value: "true" - name: KUBECONFIG value: - name: NODE_NAME valueFrom: fieldRef: fieldPath: spec.nodeName - name: NODE_LABEL value: nvidia.com/device-plugin.config - name: CONFIG_FILE_SRCDIR value: /available-configs - name: CONFIG_FILE_DST value: /config/config.yaml - name: DEFAULT_CONFIG value: null - name: FALLBACK_STRATEGIES value: "named,single" - name: SEND_SIGNAL value: "false" - name: SIGNAL value: - name: PROCESS_TO_SIGNAL value: priorityClassName: system-node-critical runtimeClassName: nvidia securityContext: {} serviceAccountName: nvidia-device-plugin-service-account shareProcessNamespace: true tolerations: - key: CriticalAddonsOnly operator: Exists - key: nvidia.com/gpu effect: NoSchedule operator: Exists volumes: - name: output-dir hostPath: type: DirectoryOrCreate path: /etc/kubernetes/node-feature-discovery/features.d - name: host-sys hostPath: type: Directory path: /sys - name: driver-root hostPath: type: Directory path: / - name: available-configs configMap: name: nvidia-device-plugin-configs - name: config emptyDir: {} updateStrategy: type: RollingUpdate (root level) + one document added: apiVersion: apps/v1 kind: DaemonSet metadata: name: nvidia-device-plugin-mps-control-daemon namespace: nvidia labels: app.kubernetes.io/instance: nvidia-device-plugin app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: nvidia-device-plugin helm.toolkit.fluxcd.io/name: nvidia-device-plugin helm.toolkit.fluxcd.io/namespace: flux-system spec: selector: matchLabels: app.kubernetes.io/instance: nvidia-device-plugin app.kubernetes.io/name: nvidia-device-plugin template: metadata: labels: app.kubernetes.io/instance: nvidia-device-plugin app.kubernetes.io/name: nvidia-device-plugin spec: affinity: nodeAffinity: requiredDuringSchedulingIgnoredDuringExecution: nodeSelectorTerms: - matchExpressions: - key: feature.node.kubernetes.io/pci-10de.present operator: In values: - "true" - matchExpressions: - key: feature.node.kubernetes.io/cpu-model.vendor_id operator: In values: - NVIDIA - matchExpressions: - key: nvidia.com/gpu.present operator: In values: - "true" containers: - name: mps-control-daemon-sidecar image: "nvcr.io/nvidia/k8s-device-plugin:v0.19.3" command: - config-manager volumeMounts: - name: available-configs mountPath: /available-configs - name: config mountPath: /config env: - name: ONESHOT value: "false" - name: KUBECONFIG value: - name: NODE_NAME valueFrom: fieldRef: fieldPath: spec.nodeName - name: NODE_LABEL value: nvidia.com/device-plugin.config - name: CONFIG_FILE_SRCDIR value: /available-configs - name: CONFIG_FILE_DST value: /config/config.yaml - name: DEFAULT_CONFIG value: null - name: FALLBACK_STRATEGIES value: "named,single" - name: SEND_SIGNAL value: "true" - name: SIGNAL value: "1" - name: PROCESS_TO_SIGNAL value: /usr/bin/mps-control-daemon - name: mps-control-daemon-ctr image: "nvcr.io/nvidia/k8s-device-plugin:v0.19.3" imagePullPolicy: IfNotPresent command: - mps-control-daemon securityContext: privileged: true volumeMounts: - name: mps-shm mountPath: /dev/shm - name: mps-root mountPath: /mps - name: available-configs mountPath: /available-configs - name: config mountPath: /config env: - name: NODE_NAME valueFrom: fieldRef: apiVersion: v1 fieldPath: spec.nodeName - name: CONFIG_FILE value: /config/config.yaml - name: NVIDIA_MIG_MONITOR_DEVICES value: all - name: NVIDIA_VISIBLE_DEVICES value: all - name: NVIDIA_DRIVER_CAPABILITIES value: "compute,utility" hostPID: true initContainers: - name: mps-control-daemon-mounts image: "nvcr.io/nvidia/k8s-device-plugin:v0.19.3" command: - mps-control-daemon - mount-shm securityContext: privileged: true volumeMounts: - name: mps-root mountPath: /mps mountPropagation: Bidirectional - name: mps-control-daemon-init image: "nvcr.io/nvidia/k8s-device-plugin:v0.19.3" command: - config-manager volumeMounts: - name: available-configs mountPath: /available-configs - name: config mountPath: /config env: - name: ONESHOT value: "true" - name: KUBECONFIG value: - name: NODE_NAME valueFrom: fieldRef: fieldPath: spec.nodeName - name: NODE_LABEL value: nvidia.com/device-plugin.config - name: CONFIG_FILE_SRCDIR value: /available-configs - name: CONFIG_FILE_DST value: /config/config.yaml - name: DEFAULT_CONFIG value: null - name: FALLBACK_STRATEGIES value: "named,single" - name: SEND_SIGNAL value: "false" - name: SIGNAL value: - name: PROCESS_TO_SIGNAL value: nodeSelector: nvidia.com/mps.capable: "true" priorityClassName: system-node-critical runtimeClassName: nvidia securityContext: {} serviceAccountName: nvidia-device-plugin-service-account tolerations: - key: CriticalAddonsOnly operator: Exists - key: nvidia.com/gpu effect: NoSchedule operator: Exists volumes: - name: mps-root hostPath: type: DirectoryOrCreate path: /run/nvidia/mps - name: mps-shm hostPath: path: /run/nvidia/mps/shm - name: available-configs configMap: name: nvidia-device-plugin-configs - name: config emptyDir: {} updateStrategy: type: RollingUpdate (root level) + one document added: apiVersion: apps/v1 kind: Deployment metadata: name: nvidia-device-plugin-node-feature-discovery-master namespace: nvidia labels: app.kubernetes.io/instance: nvidia-device-plugin app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: node-feature-discovery helm.toolkit.fluxcd.io/name: nvidia-device-plugin helm.toolkit.fluxcd.io/namespace: flux-system role: master spec: replicas: 1 revisionHistoryLimit: null selector: matchLabels: app.kubernetes.io/instance: nvidia-device-plugin app.kubernetes.io/name: node-feature-discovery role: master template: metadata: labels: app.kubernetes.io/instance: nvidia-device-plugin app.kubernetes.io/name: node-feature-discovery role: master spec: affinity: nodeAffinity: preferredDuringSchedulingIgnoredDuringExecution: - preference: matchExpressions: - key: node-role.kubernetes.io/master operator: In values: - weight: 1 - preference: matchExpressions: - key: node-role.kubernetes.io/control-plane operator: In values: - weight: 1 containers: - name: master image: "registry.k8s.io/nfd/node-feature-discovery:v0.17.3" imagePullPolicy: IfNotPresent args: - "-enable-leader-election" - "-feature-gates=NodeFeatureGroupAPI=false" - "-metrics=8081" - "-grpc-health=8082" command: - nfd-master livenessProbe: grpc: port: 8082 ports: - name: metrics containerPort: 8081 - name: health containerPort: 8082 readinessProbe: failureThreshold: 10 grpc: port: 8082 resources: limits: memory: 4Gi requests: cpu: 100m memory: 128Mi startupProbe: failureThreshold: 30 grpc: port: 8082 volumeMounts: - name: nfd-master-conf mountPath: /etc/kubernetes/node-feature-discovery readOnly: true securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL readOnlyRootFilesystem: true runAsNonRoot: true env: - name: NODE_NAME valueFrom: fieldRef: fieldPath: spec.nodeName enableServiceLinks: false hostNetwork: false securityContext: {} serviceAccountName: node-feature-discovery tolerations: - key: node-role.kubernetes.io/master effect: NoSchedule operator: Equal value: - key: node-role.kubernetes.io/control-plane effect: NoSchedule operator: Equal value: volumes: - name: nfd-master-conf configMap: name: nvidia-device-plugin-node-feature-discovery-master-conf items: - key: nfd-master.conf path: nfd-master.conf (root level) + one document added: apiVersion: apps/v1 kind: Deployment metadata: name: nvidia-device-plugin-node-feature-discovery-gc namespace: nvidia labels: app.kubernetes.io/instance: nvidia-device-plugin app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: node-feature-discovery helm.toolkit.fluxcd.io/name: nvidia-device-plugin helm.toolkit.fluxcd.io/namespace: flux-system role: gc spec: replicas: 1 revisionHistoryLimit: null selector: matchLabels: app.kubernetes.io/instance: nvidia-device-plugin app.kubernetes.io/name: node-feature-discovery role: gc template: metadata: labels: app.kubernetes.io/instance: nvidia-device-plugin app.kubernetes.io/name: node-feature-discovery role: gc spec: containers: - name: gc image: "registry.k8s.io/nfd/node-feature-discovery:v0.17.3" imagePullPolicy: IfNotPresent args: - "-gc-interval=1h" command: - nfd-gc ports: - name: metrics containerPort: 8081 resources: limits: memory: 1Gi requests: cpu: 10m memory: 128Mi securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL readOnlyRootFilesystem: true runAsNonRoot: true env: - name: NODE_NAME valueFrom: fieldRef: fieldPath: spec.nodeName dnsPolicy: ClusterFirstWithHostNet hostNetwork: false securityContext: {} serviceAccountName: nvidia-device-plugin-node-feature-discovery-gc (root level) + one document added: apiVersion: v1 kind: ServiceAccount metadata: name: nvidia-device-plugin-node-feature-discovery-prune namespace: nvidia annotations: helm.sh/hook: post-delete helm.sh/hook-delete-policy: "before-hook-creation,hook-succeeded" labels: app.kubernetes.io/instance: nvidia-device-plugin app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: node-feature-discovery (root level) + one document added: apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: name: nvidia-device-plugin-node-feature-discovery-prune annotations: helm.sh/hook: post-delete helm.sh/hook-delete-policy: "before-hook-creation,hook-succeeded" labels: app.kubernetes.io/instance: nvidia-device-plugin app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: node-feature-discovery rules: - resources: - nodes - nodes/status apiGroups: - verbs: - get - patch - update - list (root level) + one document added: apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding metadata: name: nvidia-device-plugin-node-feature-discovery-prune annotations: helm.sh/hook: post-delete helm.sh/hook-delete-policy: "before-hook-creation,hook-succeeded" labels: app.kubernetes.io/instance: nvidia-device-plugin app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: node-feature-discovery roleRef: name: nvidia-device-plugin-node-feature-discovery-prune apiGroup: rbac.authorization.k8s.io kind: ClusterRole subjects: - name: nvidia-device-plugin-node-feature-discovery-prune kind: ServiceAccount namespace: nvidia (root level) + one document added: apiVersion: batch/v1 kind: Job metadata: name: nvidia-device-plugin-node-feature-discovery-prune namespace: nvidia annotations: helm.sh/hook: post-delete helm.sh/hook-delete-policy: "before-hook-creation,hook-succeeded" labels: app.kubernetes.io/instance: nvidia-device-plugin app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: node-feature-discovery spec: template: metadata: labels: app.kubernetes.io/instance: nvidia-device-plugin app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: node-feature-discovery role: prune spec: affinity: nodeAffinity: preferredDuringSchedulingIgnoredDuringExecution: - preference: matchExpressions: - key: node-role.kubernetes.io/master operator: In values: - weight: 1 - preference: matchExpressions: - key: node-role.kubernetes.io/control-plane operator: In values: - weight: 1 containers: - name: nfd-master image: "registry.k8s.io/nfd/node-feature-discovery:v0.17.3" imagePullPolicy: IfNotPresent args: - "-prune" command: - nfd-master securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL readOnlyRootFilesystem: true runAsNonRoot: true restartPolicy: Never serviceAccountName: nvidia-device-plugin-node-feature-discovery-prune tolerations: - key: node-role.kubernetes.io/master effect: NoSchedule operator: Equal value: - key: node-role.kubernetes.io/control-plane effect: NoSchedule operator: Equal value: (root level) + one document added: apiVersion: v1 kind: ServiceAccount metadata: name: nvidia-gpu-exporter namespace: nvidia labels: app.kubernetes.io/instance: nvidia-gpu-exporter app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: nvidia-gpu-exporter helm.toolkit.fluxcd.io/name: nvidia-gpu-exporter helm.toolkit.fluxcd.io/namespace: flux-system (root level) + one document added: apiVersion: v1 kind: Service metadata: name: nvidia-gpu-exporter namespace: nvidia labels: app.kubernetes.io/instance: nvidia-gpu-exporter app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: nvidia-gpu-exporter helm.toolkit.fluxcd.io/name: nvidia-gpu-exporter helm.toolkit.fluxcd.io/namespace: flux-system spec: type: ClusterIP selector: app.kubernetes.io/instance: nvidia-gpu-exporter app.kubernetes.io/name: nvidia-gpu-exporter ports: - name: http port: 9835 protocol: TCP targetPort: http (root level) + one document added: apiVersion: apps/v1 kind: DaemonSet metadata: name: nvidia-gpu-exporter namespace: nvidia labels: app.kubernetes.io/instance: nvidia-gpu-exporter app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: nvidia-gpu-exporter helm.toolkit.fluxcd.io/name: nvidia-gpu-exporter helm.toolkit.fluxcd.io/namespace: flux-system spec: selector: matchLabels: app.kubernetes.io/instance: nvidia-gpu-exporter app.kubernetes.io/name: nvidia-gpu-exporter template: metadata: labels: app.kubernetes.io/instance: nvidia-gpu-exporter app.kubernetes.io/name: nvidia-gpu-exporter spec: affinity: nodeAffinity: requiredDuringSchedulingIgnoredDuringExecution: nodeSelectorTerms: - matchExpressions: - key: nvidia.com/gpu.count operator: Exists automountServiceAccountToken: false containers: - name: nvidia-gpu-exporter image: "docker.io/utkuozdemir/nvidia_gpu_exporter:1.13.0" imagePullPolicy: IfNotPresent args: - "--web.listen-address" - ":9835" - "--web.telemetry-path" - /metrics - "--nvidia-smi-command" - nvidia-smi - "--query-field-names" - AUTO - "--log.level" - info - "--log.format" - logfmt env: - name: NVIDIA_VISIBLE_DEVICES value: all - name: NVIDIA_DRIVER_CAPABILITIES value: utility livenessProbe: httpGet: path: /-/healthy port: http ports: - name: http containerPort: 9835 protocol: TCP readinessProbe: httpGet: path: /-/ready port: http hostNetwork: false hostPID: false nodeSelector: kubernetes.io/os: linux runtimeClassName: nvidia serviceAccountName: nvidia-gpu-exporter updateStrategy: type: RollingUpdate rollingUpdate: maxUnavailable: 1 (root level) + one document added: apiVersion: monitoring.coreos.com/v1 kind: ServiceMonitor metadata: name: nvidia-gpu-exporter namespace: nvidia labels: app.kubernetes.io/instance: nvidia-gpu-exporter app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: nvidia-gpu-exporter helm.toolkit.fluxcd.io/name: nvidia-gpu-exporter helm.toolkit.fluxcd.io/namespace: flux-system spec: endpoints: - interval: 15s path: /metrics port: http scheme: http selector: matchLabels: app.kubernetes.io/instance: nvidia-gpu-exporter app.kubernetes.io/name: nvidia-gpu-exporter (root level) + one document added: apiVersion: v1 kind: ServiceAccount metadata: name: open-webui-tika namespace: local-ai labels: app.kubernetes.io/instance: open-webui app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: tika helm.toolkit.fluxcd.io/name: open-webui helm.toolkit.fluxcd.io/namespace: flux-system (root level) + one document added: apiVersion: v1 kind: ServiceAccount metadata: name: open-webui-sa namespace: local-ai labels: app.kubernetes.io/component: open-webui app.kubernetes.io/instance: open-webui app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: open-webui helm.toolkit.fluxcd.io/name: open-webui helm.toolkit.fluxcd.io/namespace: flux-system automountServiceAccountToken: false (root level) + one document added: apiVersion: v1 kind: Service metadata: name: open-webui-tika annotations: null namespace: local-ai labels: app.kubernetes.io/instance: open-webui app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: tika helm.toolkit.fluxcd.io/name: open-webui helm.toolkit.fluxcd.io/namespace: flux-system spec: type: ClusterIP selector: app.kubernetes.io/instance: open-webui app.kubernetes.io/name: tika ports: - name: http port: 9998 protocol: TCP targetPort: http (root level) + one document added: apiVersion: v1 kind: Service metadata: name: open-webui namespace: local-ai labels: app.kubernetes.io/component: open-webui app.kubernetes.io/instance: open-webui app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: open-webui helm.toolkit.fluxcd.io/name: open-webui helm.toolkit.fluxcd.io/namespace: flux-system spec: type: ClusterIP selector: app.kubernetes.io/component: open-webui app.kubernetes.io/instance: open-webui ports: - name: http port: 80 protocol: TCP targetPort: http (root level) + one document added: apiVersion: apps/v1 kind: Deployment metadata: name: open-webui-tika namespace: local-ai labels: app.kubernetes.io/instance: open-webui app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: tika helm.toolkit.fluxcd.io/name: open-webui helm.toolkit.fluxcd.io/namespace: flux-system spec: replicas: 1 selector: matchLabels: app.kubernetes.io/instance: open-webui app.kubernetes.io/name: tika template: metadata: labels: app.kubernetes.io/instance: open-webui app.kubernetes.io/name: tika spec: containers: - name: tika image: "apache/tika:3.2.2.0-full" imagePullPolicy: IfNotPresent livenessProbe: failureThreshold: 20 httpGet: path: / port: 9998 scheme: HTTP initialDelaySeconds: 15 periodSeconds: 5 timeoutSeconds: 30 ports: - name: http containerPort: 9998 protocol: TCP readinessProbe: failureThreshold: 20 httpGet: path: / port: 9998 scheme: HTTP initialDelaySeconds: 15 periodSeconds: 5 timeoutSeconds: 30 resources: limits: cpu: "2" memory: 2000Mi requests: cpu: "1" memory: 1500Mi volumeMounts: - name: sec-ctx-vol mountPath: /tmp securityContext: allowPrivilegeEscalation: true capabilities: drop: - ALL readOnlyRootFilesystem: true runAsGroup: 35002 runAsNonRoot: true runAsUser: 35002 securityContext: {} serviceAccountName: open-webui-tika volumes: - name: sec-ctx-vol emptyDir: {} (root level) + one document added: apiVersion: apps/v1 kind: Deployment metadata: name: open-webui namespace: local-ai labels: app.kubernetes.io/component: open-webui app.kubernetes.io/instance: open-webui app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: open-webui helm.toolkit.fluxcd.io/name: open-webui helm.toolkit.fluxcd.io/namespace: flux-system spec: replicas: 1 revisionHistoryLimit: 10 selector: matchLabels: app.kubernetes.io/component: open-webui app.kubernetes.io/instance: open-webui template: metadata: labels: app.kubernetes.io/component: open-webui app.kubernetes.io/instance: open-webui app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: open-webui spec: automountServiceAccountToken: false containers: - name: open-webui image: "ghcr.io/open-webui/open-webui:0.10.2" imagePullPolicy: IfNotPresent tty: true ports: - name: http containerPort: 8080 volumeMounts: - name: data mountPath: /app/backend/data - name: aethernet-ca mountPath: /etc/ssl/certs/aethernet-ca.pem readOnly: true subPath: trust-bundle.pem env: - name: ENABLE_OLLAMA_API value: False - name: OPENAI_API_BASE_URL value: "http://energon.home.arpa:8080/v1" - name: OPENAI_API_KEY valueFrom: secretKeyRef: name: litellm-master-key key: masterkey - name: CONTENT_EXTRACTION_ENGINE value: Tika - name: TIKA_SERVER_URL value: "http://open-webui-tika:9998" - name: STORAGE_PROVIDER value: s3 - name: S3_ACCESS_KEY_ID valueFrom: secretKeyRef: name: open-webui-s3-creds key: access-key - name: S3_SECRET_ACCESS_KEY valueFrom: secretKeyRef: name: open-webui-s3-creds key: secret-key - name: S3_ENDPOINT_URL value: "http://brickyard.home.arpa:3900" - name: S3_BUCKET_NAME value: open-webui - name: S3_REGION_NAME value: apartment - name: S3_KEY_PREFIX value: null - name: ENABLE_WEBSOCKET_SUPPORT value: True - name: WEBSOCKET_MANAGER value: redis - name: REDIS_URL value: "redis://local-ai-valkey-primary.local-ai.svc.cluster.local:6379/1" - name: WEBSOCKET_REDIS_URL value: "redis://local-ai-valkey-primary.local-ai.svc.cluster.local:6379/1" - name: ENABLE_OAUTH_SIGNUP value: True - name: OAUTH_MERGE_ACCOUNTS_BY_EMAIL value: True - name: OAUTH_CLIENT_ID valueFrom: secretKeyRef: name: bitwarden-oidc-open-webui key: client-id - name: OAUTH_CLIENT_SECRET valueFrom: secretKeyRef: name: bitwarden-oidc-open-webui key: client-secret - name: OPENID_PROVIDER_URL value: "https://log.me.in.aether.earth/application/o/open-webui/.well-known/openid-configuration" - name: OAUTH_PROVIDER_NAME value: Authentik - name: OAUTH_SCOPES value: "openid email profile groups" - name: ENABLE_OAUTH_ROLE_MANAGEMENT value: True - name: OAUTH_ROLES_CLAIM value: groups - name: OAUTH_ALLOWED_ROLES value: "Open WebUI Users" - name: OAUTH_ADMIN_ROLES value: "Open WebUI Admins" - name: ENABLE_OAUTH_GROUP_MANAGEMENT value: True - name: OAUTH_GROUP_CLAIM value: groups - name: ENABLE_PERSISTENT_CONFIG value: "true" - name: ENABLE_LOGIN_FORM value: "false" - name: WEBUI_URL value: "https://ai.k8s.aether.earth" - name: CORS_ALLOW_ORIGIN value: "https://ai.k8s.aether.earth" - name: BYPASS_MODEL_ACCESS_CONTROL value: "true" - name: ENABLE_RAG_WEB_SEARCH value: "true" - name: RAG_WEB_SEARCH_ENGINE value: searxng - name: SEARXNG_QUERY_URL value: "http://searxng.apps-searxng.svc.cluster.local:8080/search?q=<query>" - name: AIOHTTP_CLIENT_SSL_CERT_FILE value: /etc/ssl/certs/aethernet-ca.pem - name: SSL_CERT_FILE value: /etc/ssl/certs/aethernet-ca.pem - name: REQUESTS_CA_BUNDLE value: /etc/ssl/certs/aethernet-ca.pem - name: WEBUI_SECRET_KEY valueFrom: secretKeyRef: name: open-webui-secret-key key: secret_key - name: DATABASE_URL valueFrom: secretKeyRef: name: local-ai-db-app key: uri enableServiceLinks: false initContainers: - name: copy-app-data image: "ghcr.io/open-webui/open-webui:0.10.2" imagePullPolicy: IfNotPresent command: - sh - "-c" - "cp -R -n /app/backend/data/* /tmp/app-data/" volumeMounts: - name: data mountPath: /tmp/app-data serviceAccountName: open-webui-sa volumes: - name: data emptyDir: {} - name: aethernet-ca configMap: name: aethernet.crt (root level) + one document added: apiVersion: gateway.networking.k8s.io/v1 kind: HTTPRoute metadata: name: open-webui namespace: local-ai annotations: gatus.home-operations.com/enabled: "true" gatus.home-operations.com/endpoint: | name: "Open WebUI" url: "https://ai.k8s.aether.earth/" gethomepage.dev/description: "Open WebUI" gethomepage.dev/enabled: "true" gethomepage.dev/group: AI gethomepage.dev/icon: sh-open-webui gethomepage.dev/name: "Open WebUI" labels: app.kubernetes.io/component: open-webui app.kubernetes.io/instance: open-webui app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: open-webui helm.toolkit.fluxcd.io/name: open-webui helm.toolkit.fluxcd.io/namespace: flux-system spec: hostnames: - ai.k8s.aether.earth parentRefs: - name: envoy-over-vpn namespace: envoy-gateway sectionName: https rules: - backendRefs: - name: open-webui group: kind: Service port: 80 weight: 1 matches: - path: type: PathPrefix value: / (root level) + one document added: apiVersion: networking.k8s.io/v1 kind: NetworkPolicy metadata: name: paperless-valkey namespace: apps-paperless labels: app.kubernetes.io/instance: paperless-valkey app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: valkey app.kubernetes.io/part-of: valkey helm.toolkit.fluxcd.io/name: paperless-valkey helm.toolkit.fluxcd.io/namespace: flux-system spec: egress: - ingress: - ports: - port: 6379 podSelector: matchLabels: app.kubernetes.io/instance: paperless-valkey app.kubernetes.io/name: valkey policyTypes: - Ingress - Egress (root level) + one document added: apiVersion: policy/v1 kind: PodDisruptionBudget metadata: name: paperless-valkey-primary namespace: apps-paperless labels: app.kubernetes.io/component: primary app.kubernetes.io/instance: paperless-valkey app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: valkey helm.toolkit.fluxcd.io/name: paperless-valkey helm.toolkit.fluxcd.io/namespace: flux-system spec: maxUnavailable: 1 selector: matchLabels: app.kubernetes.io/component: primary app.kubernetes.io/instance: paperless-valkey app.kubernetes.io/name: valkey (root level) + one document added: apiVersion: v1 kind: ServiceAccount metadata: name: paperless-valkey-primary namespace: apps-paperless labels: app.kubernetes.io/instance: paperless-valkey app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: valkey app.kubernetes.io/part-of: valkey helm.toolkit.fluxcd.io/name: paperless-valkey helm.toolkit.fluxcd.io/namespace: flux-system automountServiceAccountToken: false (root level) + one document added: apiVersion: v1 kind: ConfigMap metadata: name: paperless-valkey-configuration namespace: apps-paperless labels: app.kubernetes.io/instance: paperless-valkey app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: valkey app.kubernetes.io/part-of: valkey helm.toolkit.fluxcd.io/name: paperless-valkey helm.toolkit.fluxcd.io/namespace: flux-system data: primary.conf: | dir /data # User-supplied primary configuration: rename-command FLUSHDB "" rename-command FLUSHALL "" # End of primary configuration replica.conf: | dir /data # User-supplied replica configuration: rename-command FLUSHDB "" rename-command FLUSHALL "" # End of replica configuration valkey.conf: | # User-supplied common configuration: # Enable AOF https://valkey.io/docs/topics/persistence.html appendonly yes # Disable RDB persistence, AOF persistence already enabled. save "" # End of common configuration (root level) + one document added: apiVersion: v1 kind: ConfigMap metadata: name: paperless-valkey-health namespace: apps-paperless labels: app.kubernetes.io/instance: paperless-valkey app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: valkey helm.toolkit.fluxcd.io/name: paperless-valkey helm.toolkit.fluxcd.io/namespace: flux-system data: ping_liveness_local.sh: | #!/bin/bash [[ -f $VALKEY_PASSWORD_FILE ]] && export VALKEY_PASSWORD="$(< "${VALKEY_PASSWORD_FILE}")" [[ -n "$VALKEY_PASSWORD" ]] && export REDISCLI_AUTH="$VALKEY_PASSWORD" response=$( timeout -s 15 $1 \ valkey-cli \ -h localhost \ -p $VALKEY_PORT \ ping ) if [ "$?" -eq "124" ]; then echo "Timed out" exit 1 fi responseFirstWord=$(echo $response | head -n1 | awk '{print $1;}') if [ "$response" != "PONG" ] && [ "$responseFirstWord" != "LOADING" ] && [ "$responseFirstWord" != "MASTERDOWN" ]; then echo "$response" exit 1 fi ping_liveness_local_and_primary.sh: | script_dir="$(dirname "$0")" exit_status=0 "$script_dir/ping_liveness_local.sh" $1 || exit_status=$? "$script_dir/ping_liveness_primary.sh" $1 || exit_status=$? exit $exit_status ping_liveness_primary.sh: | #!/bin/bash [[ -f $VALKEY_PRIMARY_PASSWORD_FILE ]] && export VALKEY_PRIMARY_PASSWORD="$(< "${VALKEY_PRIMARY_PASSWORD_FILE}")" [[ -n "$VALKEY_PRIMARY_PASSWORD" ]] && export REDISCLI_AUTH="$VALKEY_PRIMARY_PASSWORD" response=$( timeout -s 15 $1 \ valkey-cli \ -h $VALKEY_PRIMARY_HOST \ -p $VALKEY_PRIMARY_PORT_NUMBER \ ping ) if [ "$?" -eq "124" ]; then echo "Timed out" exit 1 fi responseFirstWord=$(echo $response | head -n1 | awk '{print $1;}') if [ "$response" != "PONG" ] && [ "$responseFirstWord" != "LOADING" ]; then echo "$response" exit 1 fi ping_readiness_local.sh: | #!/bin/bash [[ -f $VALKEY_PASSWORD_FILE ]] && export VALKEY_PASSWORD="$(< "${VALKEY_PASSWORD_FILE}")" [[ -n "$VALKEY_PASSWORD" ]] && export REDISCLI_AUTH="$VALKEY_PASSWORD" response=$( timeout -s 15 $1 \ valkey-cli \ -h localhost \ -p $VALKEY_PORT \ ping ) if [ "$?" -eq "124" ]; then echo "Timed out" exit 1 fi if [ "$response" != "PONG" ]; then echo "$response" exit 1 fi ping_readiness_local_and_primary.sh: | script_dir="$(dirname "$0")" exit_status=0 "$script_dir/ping_readiness_local.sh" $1 || exit_status=$? "$script_dir/ping_readiness_primary.sh" $1 || exit_status=$? exit $exit_status ping_readiness_primary.sh: | #!/bin/bash [[ -f $VALKEY_PRIMARY_PASSWORD_FILE ]] && export VALKEY_PRIMARY_PASSWORD="$(< "${VALKEY_PRIMARY_PASSWORD_FILE}")" [[ -n "$VALKEY_PRIMARY_PASSWORD" ]] && export REDISCLI_AUTH="$VALKEY_PRIMARY_PASSWORD" response=$( timeout -s 15 $1 \ valkey-cli \ -h $VALKEY_PRIMARY_HOST \ -p $VALKEY_PRIMARY_PORT_NUMBER \ ping ) if [ "$?" -eq "124" ]; then echo "Timed out" exit 1 fi if [ "$response" != "PONG" ]; then echo "$response" exit 1 fi (root level) + one document added: apiVersion: v1 kind: ConfigMap metadata: name: paperless-valkey-scripts namespace: apps-paperless labels: app.kubernetes.io/instance: paperless-valkey app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: valkey app.kubernetes.io/part-of: valkey helm.toolkit.fluxcd.io/name: paperless-valkey helm.toolkit.fluxcd.io/namespace: flux-system data: start-primary.sh: | #!/bin/bash [[ -f $VALKEY_PASSWORD_FILE ]] && export VALKEY_PASSWORD="$(< "${VALKEY_PASSWORD_FILE}")" if [[ -f /opt/bitnami/valkey/mounted-etc/primary.conf ]];then cp /opt/bitnami/valkey/mounted-etc/primary.conf /opt/bitnami/valkey/etc/primary.conf fi if [[ -f /opt/bitnami/valkey/mounted-etc/valkey.conf ]];then cp /opt/bitnami/valkey/mounted-etc/valkey.conf /opt/bitnami/valkey/etc/valkey.conf fi ARGS=("--port" "${VALKEY_PORT}") ARGS+=("--protected-mode" "no") ARGS+=("--include" "/opt/bitnami/valkey/etc/valkey.conf") ARGS+=("--include" "/opt/bitnami/valkey/etc/primary.conf") exec valkey-server "${ARGS[@]}" (root level) + one document added: apiVersion: v1 kind: Service metadata: name: paperless-valkey-headless namespace: apps-paperless labels: app.kubernetes.io/instance: paperless-valkey app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: valkey app.kubernetes.io/part-of: valkey helm.toolkit.fluxcd.io/name: paperless-valkey helm.toolkit.fluxcd.io/namespace: flux-system spec: type: ClusterIP clusterIP: None selector: app.kubernetes.io/instance: paperless-valkey app.kubernetes.io/name: valkey ports: - name: tcp-redis port: 6379 targetPort: redis (root level) + one document added: apiVersion: v1 kind: Service metadata: name: paperless-valkey-primary namespace: apps-paperless labels: app.kubernetes.io/component: primary app.kubernetes.io/instance: paperless-valkey app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: valkey app.kubernetes.io/part-of: valkey helm.toolkit.fluxcd.io/name: paperless-valkey helm.toolkit.fluxcd.io/namespace: flux-system spec: type: ClusterIP internalTrafficPolicy: Cluster selector: app.kubernetes.io/component: primary app.kubernetes.io/instance: paperless-valkey app.kubernetes.io/name: valkey ports: - name: tcp-redis nodePort: null port: 6379 targetPort: redis (root level) + one document added: apiVersion: apps/v1 kind: StatefulSet metadata: name: paperless-valkey-primary namespace: apps-paperless labels: app.kubernetes.io/component: primary app.kubernetes.io/instance: paperless-valkey app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: valkey app.kubernetes.io/part-of: valkey helm.toolkit.fluxcd.io/name: paperless-valkey helm.toolkit.fluxcd.io/namespace: flux-system spec: replicas: 1 selector: matchLabels: app.kubernetes.io/component: primary app.kubernetes.io/instance: paperless-valkey app.kubernetes.io/name: valkey serviceName: paperless-valkey-headless template: metadata: labels: app.kubernetes.io/component: primary app.kubernetes.io/instance: paperless-valkey app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: valkey spec: affinity: nodeAffinity: null podAffinity: null podAntiAffinity: preferredDuringSchedulingIgnoredDuringExecution: - podAffinityTerm: labelSelector: matchLabels: app.kubernetes.io/component: primary app.kubernetes.io/instance: paperless-valkey app.kubernetes.io/name: valkey topologyKey: kubernetes.io/hostname weight: 1 automountServiceAccountToken: false containers: - name: valkey image: "registry-1.docker.io/bitnami/valkey:latest" imagePullPolicy: IfNotPresent args: - "-c" - /opt/bitnami/scripts/start-scripts/start-primary.sh command: - /bin/bash env: - name: BITNAMI_DEBUG value: "false" - name: VALKEY_REPLICATION_MODE value: primary - name: ALLOW_EMPTY_PASSWORD value: yes - name: OPENSSL_FIPS value: yes - name: VALKEY_TLS_ENABLED value: no - name: VALKEY_PORT value: "6379" ports: - name: redis containerPort: 6379 resources: limits: cpu: 150m ephemeral-storage: 2Gi memory: 192Mi requests: cpu: 100m ephemeral-storage: 50Mi memory: 128Mi volumeMounts: - name: start-scripts mountPath: /opt/bitnami/scripts/start-scripts - name: health mountPath: /health - name: valkey-data mountPath: /data - name: config mountPath: /opt/bitnami/valkey/mounted-etc - name: empty-dir mountPath: /opt/bitnami/valkey/etc/ subPath: app-conf-dir - name: empty-dir mountPath: /tmp subPath: tmp-dir livenessProbe: exec: command: - sh - "-c" - "/health/ping_liveness_local.sh 5" failureThreshold: 5 initialDelaySeconds: 20 periodSeconds: 5 successThreshold: 1 timeoutSeconds: 6 readinessProbe: exec: command: - sh - "-c" - "/health/ping_readiness_local.sh 1" failureThreshold: 5 initialDelaySeconds: 20 periodSeconds: 5 successThreshold: 1 timeoutSeconds: 2 securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL readOnlyRootFilesystem: true runAsGroup: 1001 runAsNonRoot: true runAsUser: 1001 seLinuxOptions: {} seccompProfile: type: RuntimeDefault enableServiceLinks: true securityContext: fsGroup: 1001 fsGroupChangePolicy: Always supplementalGroups: [] sysctls: [] serviceAccountName: paperless-valkey-primary terminationGracePeriodSeconds: 30 volumes: - name: start-scripts configMap: name: paperless-valkey-scripts defaultMode: 493 - name: health configMap: name: paperless-valkey-health defaultMode: 493 - name: config configMap: name: paperless-valkey-configuration - name: empty-dir emptyDir: {} updateStrategy: type: RollingUpdate volumeClaimTemplates: - apiVersion: v1 kind: PersistentVolumeClaim metadata: name: valkey-data labels: app.kubernetes.io/component: primary app.kubernetes.io/instance: paperless-valkey app.kubernetes.io/name: valkey spec: resources: requests: storage: 8Gi storageClassName: longhorn accessModes: - ReadWriteOnce (root level) + one document added: apiVersion: v1 kind: ServiceAccount metadata: name: renovate-operator-renovate-operator namespace: apps-renovate labels: helm.toolkit.fluxcd.io/name: renovate-operator helm.toolkit.fluxcd.io/namespace: flux-system (root level) + one document added: apiVersion: v1 kind: ConfigMap metadata: name: renovate-operator-dashboard namespace: apps-renovate labels: grafana_dashboard: "1" helm.toolkit.fluxcd.io/name: renovate-operator helm.toolkit.fluxcd.io/namespace: flux-system data: renovate-operator.json: | { "annotations": { "list": [ { "builtIn": 1, "datasource": { "type": "grafana", "uid": "-- Grafana --" }, "enable": true, "hide": true, "iconColor": "rgba(0, 211, 255, 1)", "name": "Annotations & Alerts", "type": "dashboard" } ] }, "editable": true, "fiscalYearStartMonth": 0, "graphTooltip": 0, "id": 37, "links": [], "panels": [ { "datasource": { "type": "prometheus", "uid": "$datasource" }, "fieldConfig": { "defaults": { "color": { "mode": "thresholds" }, "mappings": [], "thresholds": { "mode": "absolute", "steps": [ { "color": "green", "value": 0 } ] } }, "overrides": [] }, "gridPos": { "h": 4, "w": 7, "x": 0, "y": 0 }, "id": 6, "options": { "colorMode": "value", "graphMode": "area", "justifyMode": "auto", "orientation": "auto", "percentChangeColorMode": "standard", "reduceOptions": { "calcs": [ "lastNotNull" ], "fields": "", "values": false }, "showPercentChange": false, "textMode": "auto", "wideLayout": true }, "pluginVersion": "12.3.1", "targets": [ { "editorMode": "code", "exemplar": false, "expr": "count(group by(project) (renovate_operator_project_executions_total{\"renovate_namespace\"=~\"$RenovateNamespace\", \"renovate_job\"=~\"$RenovateJob\"}))", "instant": false, "legendFormat": "__auto", "range": true, "refId": "A" } ], "title": "Repository Count", "type": "stat" }, { "datasource": { "type": "prometheus", "uid": "$datasource" }, "fieldConfig": { "defaults": { "color": { "mode": "thresholds" }, "mappings": [], "thresholds": { "mode": "absolute", "steps": [ { "color": "green", "value": 0 } ] } }, "overrides": [] }, "gridPos": { "h": 4, "w": 5, "x": 7, "y": 0 }, "id": 2, "options": { "colorMode": "value", "graphMode": "area", "justifyMode": "auto", "orientation": "auto", "percentChangeColorMode": "standard", "reduceOptions": { "calcs": [ "lastNotNull" ], "fields": "", "values": false }, "showPercentChange": false, "textMode": "auto", "wideLayout": true }, "pluginVersion": "12.3.1", "targets": [ { "editorMode": "builder", "exemplar": false, "expr": "sum(renovate_operator_project_executions_total{\"renovate_namespace\"=~\"$RenovateNamespace\", \"renovate_job\"=~\"$RenovateJob\", status=\"completed\"})", "instant": true, "legendFormat": "__auto", "range": false, "refId": "A" } ], "title": "Completed", "type": "stat" }, { "datasource": { "type": "prometheus", "uid": "$datasource" }, "fieldConfig": { "defaults": { "color": { "mode": "thresholds" }, "mappings": [], "thresholds": { "mode": "absolute", "steps": [ { "color": "green", "value": 0 }, { "color": "yellow", "value": 5 }, { "color": "orange", "value": 50 }, { "color": "red", "value": 100 } ] } }, "overrides": [] }, "gridPos": { "h": 4, "w": 5, "x": 12, "y": 0 }, "id": 3, "options": { "colorMode": "value", "graphMode": "area", "justifyMode": "auto", "orientation": "auto", "percentChangeColorMode": "standard", "reduceOptions": { "calcs": [ "lastNotNull" ], "fields": "", "values": false }, "showPercentChange": false, "textMode": "auto", "wideLayout": true }, "pluginVersion": "12.3.1", "targets": [ { "editorMode": "builder", "exemplar": false, "expr": "sum(renovate_operator_project_executions_total{\"renovate_namespace\"=~\"$RenovateNamespace\", \"renovate_job\"=~\"$RenovateJob\", status=\"failed\"})", "instant": true, "legendFormat": "__auto", "range": false, "refId": "A" } ], "title": "Failed", "type": "stat" }, { "datasource": { "type": "prometheus", "uid": "$datasource" }, "fieldConfig": { "defaults": { "color": { "mode": "thresholds" }, "mappings": [], "thresholds": { "mode": "absolute", "steps": [ { "color": "green", "value": 0 }, { "color": "#EAB839", "value": 1 }, { "color": "orange", "value": 5 }, { "color": "red", "value": 10 } ] } }, "overrides": [] }, "gridPos": { "h": 4, "w": 7, "x": 17, "y": 0 }, "id": 5, "options": { "colorMode": "value", "graphMode": "area", "justifyMode": "auto", "orientation": "auto", "percentChangeColorMode": "standard", "reduceOptions": { "calcs": [ "lastNotNull" ], "fields": "", "values": false }, "showPercentChange": false, "textMode": "auto", "wideLayout": true }, "pluginVersion": "12.3.1", "targets": [ { "editorMode": "code", "exemplar": false, "expr": "sum(renovate_operator_project_executions_total{\"renovate_namespace\"=~\"$RenovateNamespace\", \"renovate_job\"=~\"$RenovateJob\", status=\"failed\"}) / sum (renovate_operator_project_executions_total{\"renovate_namespace\"=~\"$RenovateNamespace\", \"renovate_job\"=~\"$RenovateJob\"}) * 100", "instant": false, "legendFormat": "__auto", "range": true, "refId": "A" } ], "title": "Failure Rate %", "type": "stat" }, { "datasource": { "type": "prometheus", "uid": "$datasource" }, "fieldConfig": { "defaults": { "color": { "mode": "palette-classic" }, "custom": { "axisBorderShow": false, "axisCenteredZero": false, "axisColorMode": "text", "axisLabel": "", "axisPlacement": "auto", "fillOpacity": 80, "gradientMode": "none", "hideFrom": { "legend": false, "tooltip": false, "viz": false }, "lineWidth": 1, "scaleDistribution": { "type": "linear" }, "thresholdsStyle": { "mode": "off" } }, "mappings": [], "thresholds": { "mode": "absolute", "steps": [ { "color": "green", "value": 0 }, { "color": "red", "value": 80 } ] } }, "overrides": [] }, "gridPos": { "h": 9, "w": 12, "x": 0, "y": 4 }, "id": 1, "options": { "barRadius": 0, "barWidth": 0.97, "fullHighlight": false, "groupWidth": 0.7, "legend": { "calcs": [], "displayMode": "list", "placement": "bottom", "showLegend": true }, "orientation": "auto", "showValue": "auto", "stacking": "none", "tooltip": { "hideZeros": false, "mode": "single", "sort": "none" }, "xTickLabelRotation": 0, "xTickLabelSpacing": 0 }, "pluginVersion": "12.3.1", "targets": [ { "datasource": { "type": "prometheus", "uid": "$datasource" }, "editorMode": "code", "exemplar": false, "expr": "sum by(project) (renovate_operator_project_executions_total{\"renovate_namespace\"=~\"$RenovateNamespace\", \"renovate_job\"=~\"$RenovateJob\", status=\"completed\"})", "instant": true, "legendFormat": "{{project}} - {{status}}", "range": false, "refId": "A" } ], "title": "Renovate Executions - Completed", "type": "barchart" }, { "datasource": { "type": "prometheus", "uid": "$datasource" }, "fieldConfig": { "defaults": { "color": { "mode": "palette-classic" }, "custom": { "axisBorderShow": false, "axisCenteredZero": false, "axisColorMode": "text", "axisLabel": "", "axisPlacement": "auto", "fillOpacity": 80, "gradientMode": "none", "hideFrom": { "legend": false, "tooltip": false, "viz": false }, "lineWidth": 1, "scaleDistribution": { "type": "linear" }, "thresholdsStyle": { "mode": "off" } }, "mappings": [], "thresholds": { "mode": "absolute", "steps": [ { "color": "green", "value": 0 }, { "color": "red", "value": 80 } ] } }, "overrides": [] }, "gridPos": { "h": 9, "w": 12, "x": 12, "y": 4 }, "id": 4, "options": { "barRadius": 0, "barWidth": 0.97, "fullHighlight": false, "groupWidth": 0.7, "legend": { "calcs": [], "displayMode": "list", "placement": "bottom", "showLegend": true }, "orientation": "auto", "showValue": "auto", "stacking": "none", "tooltip": { "hideZeros": false, "mode": "single", "sort": "none" }, "xTickLabelRotation": 0, "xTickLabelSpacing": 0 }, "pluginVersion": "12.3.1", "targets": [ { "datasource": { "type": "prometheus", "uid": "$datasource" }, "editorMode": "builder", "exemplar": false, "expr": "sum by(project) (renovate_operator_project_executions_total{\"renovate_namespace\"=~\"$RenovateNamespace\", \"renovate_job\"=~\"$RenovateJob\", status=\"failed\"})", "instant": true, "legendFormat": "{{project}} - {{status}}", "range": false, "refId": "A" } ], "title": "Renovate Executions - Failed", "type": "barchart" }, { "datasource": { "type": "prometheus", "uid": "$datasource" }, "fieldConfig": { "defaults": { "color": { "mode": "thresholds" }, "mappings": [], "thresholds": { "mode": "absolute", "steps": [ { "color": "green", "value": 0 }, { "color": "red", "value": 1 } ] } }, "overrides": [] }, "gridPos": { "h": 4, "w": 6, "x": 0, "y": 13 }, "id": 7, "options": { "colorMode": "value", "graphMode": "area", "justifyMode": "auto", "orientation": "auto", "percentChangeColorMode": "standard", "reduceOptions": { "calcs": [ "lastNotNull" ], "fields": "", "values": false }, "showPercentChange": false, "textMode": "auto", "wideLayout": true }, "pluginVersion": "12.3.1", "targets": [ { "editorMode": "code", "exemplar": false, "expr": "count(renovate_operator_run_failed{\"renovate_namespace\"=~\"$RenovateNamespace\", \"renovate_job\"=~\"$RenovateJob\"} == 1) or vector(0)", "instant": true, "legendFormat": "__auto", "range": false, "refId": "A" } ], "title": "Currently Failed Runs", "type": "stat" }, { "datasource": { "type": "prometheus", "uid": "$datasource" }, "fieldConfig": { "defaults": { "color": { "mode": "thresholds" }, "mappings": [], "thresholds": { "mode": "absolute", "steps": [ { "color": "green", "value": 0 }, { "color": "orange", "value": 1 } ] } }, "overrides": [] }, "gridPos": { "h": 4, "w": 6, "x": 6, "y": 13 }, "id": 8, "options": { "colorMode": "value", "graphMode": "area", "justifyMode": "auto", "orientation": "auto", "percentChangeColorMode": "standard", "reduceOptions": { "calcs": [ "lastNotNull" ], "fields": "", "values": false }, "showPercentChange": false, "textMode": "auto", "wideLayout": true }, "pluginVersion": "12.3.1", "targets": [ { "editorMode": "code", "exemplar": false, "expr": "count(renovate_operator_dependency_issues{\"renovate_namespace\"=~\"$RenovateNamespace\", \"renovate_job\"=~\"$RenovateJob\"} == 1) or vector(0)", "instant": true, "legendFormat": "__auto", "range": false, "refId": "A" } ], "title": "Projects with Dependency Issues", "type": "stat" }, { "datasource": { "type": "prometheus", "uid": "$datasource" }, "fieldConfig": { "defaults": { "color": { "mode": "thresholds" }, "custom": { "align": "auto", "cellOptions": { "type": "auto" }, "inspect": false }, "mappings": [], "thresholds": { "mode": "absolute", "steps": [ { "color": "green", "value": null } ] } }, "overrides": [ { "matcher": { "id": "byName", "options": "project" }, "properties": [ { "id": "custom.width", "value": 300 } ] } ] }, "gridPos": { "h": 8, "w": 12, "x": 12, "y": 13 }, "id": 9, "options": { "cellHeight": "sm", "footer": { "countRows": false, "fields": "", "reducer": [ "sum" ], "show": false }, "showHeader": true }, "pluginVersion": "12.3.1", "targets": [ { "datasource": { "type": "prometheus", "uid": "$datasource" }, "editorMode": "code", "exemplar": false, "expr": "renovate_operator_run_failed{\"renovate_namespace\"=~\"$RenovateNamespace\", \"renovate_job\"=~\"$RenovateJob\"} == 1 or renovate_operator_dependency_issues{\"renovate_namespace\"=~\"$RenovateNamespace\", \"renovate_job\"=~\"$RenovateJob\"} == 1", "format": "table", "instant": true, "legendFormat": "__auto", "range": false, "refId": "A" } ], "title": "Projects with Issues", "transformations": [ { "id": "organize", "options": { "excludeByName": { "Time": true, "Value": true, "__name__": true }, "indexByName": { "Time": 0, "Value": 5, "__name__": 1, "project": 4, "renovate_job": 3, "renovate_namespace": 2 }, "renameByName": { "project": "Project", "renovate_job": "Renovate Job", "renovate_namespace": "Namespace" } } } ], "type": "table" } ], "preload": false, "schemaVersion": 42, "tags": [], "templating": { "list": [ { "current": { "text": "default", "value": "default" }, "label": "Data Source", "name": "datasource", "options": [], "query": "prometheus", "refresh": 1, "regex": "", "type": "datasource" }, { "current": { "text": "All", "value": [ "$__all" ] }, "definition": "label_values(renovate_operator_project_executions_total,renovate_namespace)", "includeAll": true, "multi": true, "name": "RenovateNamespace", "options": [], "query": { "qryType": 1, "query": "label_values(renovate_operator_project_executions_total,renovate_namespace)", "refId": "PrometheusVariableQueryEditor-VariableQuery" }, "refresh": 1, "regex": "", "type": "query" }, { "current": { "text": "All", "value": [ "$__all" ] }, "definition": "label_values(renovate_operator_project_executions_total{\"renovate_namespace\"=~\"$RenovateNamespace\"},renovate_job)", "includeAll": true, "multi": true, "name": "RenovateJob", "options": [], "query": { "qryType": 1, "query": "label_values(renovate_operator_project_executions_total{\"renovate_namespace\"=~\"$RenovateNamespace\"},renovate_job)", "refId": "PrometheusVariableQueryEditor-VariableQuery" }, "refresh": 1, "regex": "", "type": "query" } ] }, "time": { "from": "now-12h", "to": "now" }, "timepicker": {}, "timezone": "browser", "title": "Renovate Operator", "uid": "lu79xfd", "version": 10 } (root level) + one document added: apiVersion: rbac.authorization.k8s.io/v1 kind: Role metadata: name: renovate-operator-renovate-operator namespace: apps-renovate labels: helm.toolkit.fluxcd.io/name: renovate-operator helm.toolkit.fluxcd.io/namespace: flux-system rules: - resources: - renovatejobs - renovatejobs/status apiGroups: - renovate-operator.mogenius.com verbs: - get - list - watch - update - patch - resources: - pods apiGroups: - verbs: - create - get - list - watch - update - delete - resources: - jobs apiGroups: - batch verbs: - create - get - list - watch - update - delete - patch - resources: - pods/log apiGroups: - verbs: - get - list - resources: - secrets apiGroups: - verbs: - create - get - list - watch - update - delete (root level) + one document added: apiVersion: rbac.authorization.k8s.io/v1 kind: RoleBinding metadata: name: renovate-operator-renovate-operator namespace: apps-renovate labels: helm.toolkit.fluxcd.io/name: renovate-operator helm.toolkit.fluxcd.io/namespace: flux-system roleRef: name: renovate-operator-renovate-operator apiGroup: rbac.authorization.k8s.io kind: Role subjects: - name: renovate-operator-renovate-operator kind: ServiceAccount namespace: apps-renovate (root level) + one document added: apiVersion: v1 kind: Service metadata: name: renovate-operator-renovate-operator namespace: apps-renovate labels: app: renovate-operator-renovate-operator helm.toolkit.fluxcd.io/name: renovate-operator helm.toolkit.fluxcd.io/namespace: flux-system spec: ports: - name: http port: 8081 protocol: TCP targetPort: http - name: webhook port: 8082 protocol: TCP targetPort: webhook - name: metrics port: 8080 protocol: TCP targetPort: metrics selector: app: renovate-operator-renovate-operator (root level) + one document added: apiVersion: apps/v1 kind: Deployment metadata: name: renovate-operator-renovate-operator namespace: apps-renovate labels: helm.toolkit.fluxcd.io/name: renovate-operator helm.toolkit.fluxcd.io/namespace: flux-system spec: replicas: 1 revisionHistoryLimit: 10 selector: matchLabels: app: renovate-operator-renovate-operator template: metadata: labels: app: renovate-operator-renovate-operator spec: containers: - name: renovate-operator image: "ghcr.io/mogenius/renovate-operator:5.2.0" imagePullPolicy: IfNotPresent args: - "--zap-log-level=info" - "--zap-encoder=json" ports: - name: http containerPort: 8081 protocol: TCP - name: metrics containerPort: 8080 protocol: TCP - name: webhook containerPort: 8082 protocol: TCP securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL privileged: false readOnlyRootFilesystem: true runAsGroup: 1000 runAsNonRoot: true runAsUser: 1000 seccompProfile: type: RuntimeDefault env: - name: POD_NAMESPACE valueFrom: fieldRef: fieldPath: metadata.namespace - name: JOB_TIMEOUT_SECONDS value: "1800" - name: JOB_BACKOFF_LIMIT value: "1" - name: DELETE_SUCCESSFUL_JOBS value: "true" - name: JOB_TTL_SECONDS_AFTER_FINISHED value: "86400" - name: IMAGE_PULL_SECRETS value: [] - name: SERVER_PORT value: "8081" - name: WATCH_NAMESPACE valueFrom: fieldRef: fieldPath: metadata.namespace - name: WEBHOOK_SERVER_PORT value: "8082" - name: WEBHOOK_SERVER_ENABLED value: "true" - name: WEBHOOK_SERVER_UNIFIED_HOST value: "false" - name: WEBHOOK_BASE_URL value: "https://renovate-webhook.k8s.aether.earth" - name: OIDC_ISSUER_URL value: "https://log.me.in.aether.earth/application/o/renovate-operator/" - name: OIDC_CLIENT_ID value: Qa486D0v13qAPfsRWUMHY8QoIeRAxnB0vcGXp9x8 - name: OIDC_CLIENT_SECRET valueFrom: secretKeyRef: name: bitwarden-oidc-renovate-operator key: client-secret - name: OIDC_REDIRECT_URL value: "https://renovate.k8s.aether.earth/auth/callback" - name: OIDC_PKCE_ENABLED value: "true" - name: VALKEY_URL valueFrom: secretKeyRef: name: renovate-operator-valkey-url key: valkey-url - name: VALKEY_FORWARD_CACHE_TO_JOBS value: "true" - name: GLOBAL_PARALLELISM_LIMIT value: "0" - name: LOG_STORE_MODE value: valkey securityContext: fsGroup: 1000 runAsGroup: 1000 runAsNonRoot: true runAsUser: 1000 seccompProfile: type: RuntimeDefault serviceAccountName: renovate-operator-renovate-operator (root level) + one document added: apiVersion: gateway.networking.k8s.io/v1 kind: HTTPRoute metadata: name: renovate-operator-renovate-operator namespace: apps-renovate annotations: gatus.home-operations.com/enabled: "true" gatus.home-operations.com/endpoint: | name: "Renovate Operator" path: "/health" gethomepage.dev/description: "Cross-platform dependency automation dashboard" gethomepage.dev/enabled: "true" gethomepage.dev/icon: sh-mend-renovate gethomepage.dev/name: "Renovate Operator" labels: helm.toolkit.fluxcd.io/name: renovate-operator helm.toolkit.fluxcd.io/namespace: flux-system spec: hostnames: - renovate.k8s.aether.earth parentRefs: - name: envoy-over-vpn namespace: envoy-gateway sectionName: https rules: - backendRefs: - name: renovate-operator-renovate-operator group: kind: Service port: 8081 weight: 1 matches: - path: type: PathPrefix value: / (root level) + one document added: apiVersion: gateway.networking.k8s.io/v1 kind: HTTPRoute metadata: name: renovate-operator-renovate-operator-webhook namespace: apps-renovate labels: helm.toolkit.fluxcd.io/name: renovate-operator helm.toolkit.fluxcd.io/namespace: flux-system spec: hostnames: - renovate-webhook.k8s.aether.earth parentRefs: - name: envoy-over-vpn namespace: envoy-gateway sectionName: https rules: - backendRefs: - name: renovate-operator-renovate-operator group: kind: Service port: 8082 weight: 1 matches: - path: type: PathPrefix value: / (root level) + one document added: apiVersion: monitoring.coreos.com/v1 kind: ServiceMonitor metadata: name: renovate-operator-renovate-operator namespace: apps-renovate labels: helm.toolkit.fluxcd.io/name: renovate-operator helm.toolkit.fluxcd.io/namespace: flux-system spec: endpoints: - path: /metrics port: metrics namespaceSelector: matchNames: - apps-renovate selector: matchLabels: app: renovate-operator-renovate-operator (root level) + one document added: apiVersion: v1 kind: ServiceAccount metadata: name: renovate-operator-renovate-operator-crd-hook namespace: apps-renovate annotations: helm.sh/hook: "pre-install,pre-upgrade" helm.sh/hook-delete-policy: "before-hook-creation,hook-succeeded" helm.sh/hook-weight: "-5" (root level) + one document added: apiVersion: v1 kind: ConfigMap metadata: name: renovate-operator-renovate-operator-crd namespace: apps-renovate annotations: argocd.argoproj.io/sync-options: ServerSideApply=true helm.sh/hook: "pre-install,pre-upgrade" helm.sh/hook-delete-policy: "before-hook-creation,hook-succeeded" helm.sh/hook-weight: "-5" data: renovatejob.yaml: | --- apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: controller-gen.kubebuilder.io/version: v0.21.0 name: renovatejobs.renovate-operator.mogenius.com spec: group: renovate-operator.mogenius.com names: kind: RenovateJob listKind: RenovateJobList plural: renovatejobs singular: renovatejob scope: Namespaced versions: - name: v1alpha1 schema: openAPIV3Schema: properties: apiVersion: description: |- APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources type: string kind: description: |- Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds type: string metadata: type: object spec: description: RenovateJobSpec defines the desired state of RenovateJob properties: affinity: description: Affinity settings for scheduling the resulting pod properties: nodeAffinity: description: Describes node affinity scheduling rules for the pod. properties: preferredDuringSchedulingIgnoredDuringExecution: description: |- The scheduler will prefer to schedule pods to nodes that satisfy the affinity expressions specified by this field, but it may choose a node that violates one or more of the expressions. The node that is most preferred is the one with the greatest sum of weights, i.e. for each node that meets all of the scheduling requirements (resource request, requiredDuringScheduling affinity expressions, etc.), compute a sum by iterating through the elements of this field and adding "weight" to the sum if the node matches the corresponding matchExpressions; the node(s) with the highest sum are the most preferred. items: description: |- An empty preferred scheduling term matches all objects with implicit weight 0 (i.e. it's a no-op). A null preferred scheduling term matches no objects (i.e. is also a no-op). properties: preference: description: A node selector term, associated with the corresponding weight. properties: matchExpressions: description: A list of node selector requirements by node's labels. items: description: |- A node selector requirement is a selector that contains values, a key, and an operator that relates the key and values. properties: key: description: The label key that the selector applies to. type: string operator: description: |- Represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. type: string values: description: |- An array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. If the operator is Gt or Lt, the values array must have a single element, which will be interpreted as an integer. This array is replaced during a strategic merge patch. items: type: string type: array x-kubernetes-list-type: atomic required: - key - operator type: object type: array x-kubernetes-list-type: atomic matchFields: description: A list of node selector requirements by node's fields. items: description: |- A node selector requirement is a selector that contains values, a key, and an operator that relates the key and values. properties: key: description: The label key that the selector applies to. type: string operator: description: |- Represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. type: string values: description: |- An array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. If the operator is Gt or Lt, the values array must have a single element, which will be interpreted as an integer. This array is replaced during a strategic merge patch. items: type: string type: array x-kubernetes-list-type: atomic required: - key - operator type: object type: array x-kubernetes-list-type: atomic type: object x-kubernetes-map-type: atomic weight: description: Weight associated with matching the corresponding nodeSelectorTerm, in the range 1-100. format: int32 type: integer required: - preference - weight type: object type: array x-kubernetes-list-type: atomic requiredDuringSchedulingIgnoredDuringExecution: description: |- If the affinity requirements specified by this field are not met at scheduling time, the pod will not be scheduled onto the node. If the affinity requirements specified by this field cease to be met at some point during pod execution (e.g. due to an update), the system may or may not try to eventually evict the pod from its node. properties: nodeSelectorTerms: description: Required. A list of node selector terms. The terms are ORed. items: description: |- A null or empty node selector term matches no objects. The requirements of them are ANDed. The TopologySelectorTerm type implements a subset of the NodeSelectorTerm. properties: matchExpressions: description: A list of node selector requirements by node's labels. items: description: |- A node selector requirement is a selector that contains values, a key, and an operator that relates the key and values. properties: key: description: The label key that the selector applies to. type: string operator: description: |- Represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. type: string values: description: |- An array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. If the operator is Gt or Lt, the values array must have a single element, which will be interpreted as an integer. This array is replaced during a strategic merge patch. items: type: string type: array x-kubernetes-list-type: atomic required: - key - operator type: object type: array x-kubernetes-list-type: atomic matchFields: description: A list of node selector requirements by node's fields. items: description: |- A node selector requirement is a selector that contains values, a key, and an operator that relates the key and values. properties: key: description: The label key that the selector applies to. type: string operator: description: |- Represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. type: string values: description: |- An array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. If the operator is Gt or Lt, the values array must have a single element, which will be interpreted as an integer. This array is replaced during a strategic merge patch. items: type: string type: array x-kubernetes-list-type: atomic required: - key - operator type: object type: array x-kubernetes-list-type: atomic type: object x-kubernetes-map-type: atomic type: array x-kubernetes-list-type: atomic required: - nodeSelectorTerms type: object x-kubernetes-map-type: atomic type: object podAffinity: description: Describes pod affinity scheduling rules (e.g. co-locate this pod in the same node, zone, etc. as some other pod(s)). properties: preferredDuringSchedulingIgnoredDuringExecution: description: |- The scheduler will prefer to schedule pods to nodes that satisfy the affinity expressions specified by this field, but it may choose a node that violates one or more of the expressions. The node that is most preferred is the one with the greatest sum of weights, i.e. for each node that meets all of the scheduling requirements (resource request, requiredDuringScheduling affinity expressions, etc.), compute a sum by iterating through the elements of this field and adding "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the node(s) with the highest sum are the most preferred. items: description: The weights of all of the matched WeightedPodAffinityTerm fields are added per-node to find the most preferred node(s) properties: podAffinityTerm: description: Required. A pod affinity term, associated with the corresponding weight. properties: labelSelector: description: |- A label query over a set of resources, in this case pods. If it's null, this PodAffinityTerm matches with no Pods. properties: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. items: description: |- A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. properties: key: description: key is the label key that the selector applies to. type: string operator: description: |- operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. type: string values: description: |- values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. items: type: string type: array x-kubernetes-list-type: atomic required: - key - operator type: object type: array x-kubernetes-list-type: atomic matchLabels: additionalProperties: type: string description: |- matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. type: object type: object x-kubernetes-map-type: atomic matchLabelKeys: description: |- MatchLabelKeys is a set of pod label keys to select which pods will be taken into consideration. The keys are used to lookup values from the incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)` to select the group of existing pods which pods will be taken into consideration for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both matchLabelKeys and labelSelector. Also, matchLabelKeys cannot be set when labelSelector isn't set. items: type: string type: array x-kubernetes-list-type: atomic mismatchLabelKeys: description: |- MismatchLabelKeys is a set of pod label keys to select which pods will be taken into consideration. The keys are used to lookup values from the incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)` to select the group of existing pods which pods will be taken into consideration for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both mismatchLabelKeys and labelSelector. Also, mismatchLabelKeys cannot be set when labelSelector isn't set. items: type: string type: array x-kubernetes-list-type: atomic namespaceSelector: description: |- A label query over the set of namespaces that the term applies to. The term is applied to the union of the namespaces selected by this field and the ones listed in the namespaces field. null selector and null or empty namespaces list means "this pod's namespace". An empty selector ({}) matches all namespaces. properties: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. items: description: |- A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. properties: key: description: key is the label key that the selector applies to. type: string operator: description: |- operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. type: string values: description: |- values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. items: type: string type: array x-kubernetes-list-type: atomic required: - key - operator type: object type: array x-kubernetes-list-type: atomic matchLabels: additionalProperties: type: string description: |- matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. type: object type: object x-kubernetes-map-type: atomic namespaces: description: |- namespaces specifies a static list of namespace names that the term applies to. The term is applied to the union of the namespaces listed in this field and the ones selected by namespaceSelector. null or empty namespaces list and null namespaceSelector means "this pod's namespace". items: type: string type: array x-kubernetes-list-type: atomic topologyKey: description: |- This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching the labelSelector in the specified namespaces, where co-located is defined as running on a node whose value of the label with key topologyKey matches that of any node on which any of the selected pods is running. Empty topologyKey is not allowed. type: string required: - topologyKey type: object weight: description: |- weight associated with matching the corresponding podAffinityTerm, in the range 1-100. format: int32 type: integer required: - podAffinityTerm - weight type: object type: array x-kubernetes-list-type: atomic requiredDuringSchedulingIgnoredDuringExecution: description: |- If the affinity requirements specified by this field are not met at scheduling time, the pod will not be scheduled onto the node. If the affinity requirements specified by this field cease to be met at some point during pod execution (e.g. due to a pod label update), the system may or may not try to eventually evict the pod from its node. When there are multiple elements, the lists of nodes corresponding to each podAffinityTerm are intersected, i.e. all terms must be satisfied. items: description: |- Defines a set of pods (namely those matching the labelSelector relative to the given namespace(s)) that this pod should be co-located (affinity) or not co-located (anti-affinity) with, where co-located is defined as running on a node whose value of the label with key <topologyKey> matches that of any node on which a pod of the set of pods is running properties: labelSelector: description: |- A label query over a set of resources, in this case pods. If it's null, this PodAffinityTerm matches with no Pods. properties: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. items: description: |- A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. properties: key: description: key is the label key that the selector applies to. type: string operator: description: |- operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. type: string values: description: |- values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. items: type: string type: array x-kubernetes-list-type: atomic required: - key - operator type: object type: array x-kubernetes-list-type: atomic matchLabels: additionalProperties: type: string description: |- matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. type: object type: object x-kubernetes-map-type: atomic matchLabelKeys: description: |- MatchLabelKeys is a set of pod label keys to select which pods will be taken into consideration. The keys are used to lookup values from the incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)` to select the group of existing pods which pods will be taken into consideration for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both matchLabelKeys and labelSelector. Also, matchLabelKeys cannot be set when labelSelector isn't set. items: type: string type: array x-kubernetes-list-type: atomic mismatchLabelKeys: description: |- MismatchLabelKeys is a set of pod label keys to select which pods will be taken into consideration. The keys are used to lookup values from the incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)` to select the group of existing pods which pods will be taken into consideration for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both mismatchLabelKeys and labelSelector. Also, mismatchLabelKeys cannot be set when labelSelector isn't set. items: type: string type: array x-kubernetes-list-type: atomic namespaceSelector: description: |- A label query over the set of namespaces that the term applies to. The term is applied to the union of the namespaces selected by this field and the ones listed in the namespaces field. null selector and null or empty namespaces list means "this pod's namespace". An empty selector ({}) matches all namespaces. properties: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. items: description: |- A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. properties: key: description: key is the label key that the selector applies to. type: string operator: description: |- operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. type: string values: description: |- values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. items: type: string type: array x-kubernetes-list-type: atomic required: - key - operator type: object type: array x-kubernetes-list-type: atomic matchLabels: additionalProperties: type: string description: |- matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. type: object type: object x-kubernetes-map-type: atomic namespaces: description: |- namespaces specifies a static list of namespace names that the term applies to. The term is applied to the union of the namespaces listed in this field and the ones selected by namespaceSelector. null or empty namespaces list and null namespaceSelector means "this pod's namespace". items: type: string type: array x-kubernetes-list-type: atomic topologyKey: description: |- This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching the labelSelector in the specified namespaces, where co-located is defined as running on a node whose value of the label with key topologyKey matches that of any node on which any of the selected pods is running. Empty topologyKey is not allowed. type: string required: - topologyKey type: object type: array x-kubernetes-list-type: atomic type: object podAntiAffinity: description: Describes pod anti-affinity scheduling rules (e.g. avoid putting this pod in the same node, zone, etc. as some other pod(s)). properties: preferredDuringSchedulingIgnoredDuringExecution: description: |- The scheduler will prefer to schedule pods to nodes that satisfy the anti-affinity expressions specified by this field, but it may choose a node that violates one or more of the expressions. The node that is most preferred is the one with the greatest sum of weights, i.e. for each node that meets all of the scheduling requirements (resource request, requiredDuringScheduling anti-affinity expressions, etc.), compute a sum by iterating through the elements of this field and subtracting "weight" from the sum if the node has pods which matches the corresponding podAffinityTerm; the node(s) with the highest sum are the most preferred. items: description: The weights of all of the matched WeightedPodAffinityTerm fields are added per-node to find the most preferred node(s) properties: podAffinityTerm: description: Required. A pod affinity term, associated with the corresponding weight. properties: labelSelector: description: |- A label query over a set of resources, in this case pods. If it's null, this PodAffinityTerm matches with no Pods. properties: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. items: description: |- A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. properties: key: description: key is the label key that the selector applies to. type: string operator: description: |- operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. type: string values: description: |- values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. items: type: string type: array x-kubernetes-list-type: atomic required: - key - operator type: object type: array x-kubernetes-list-type: atomic matchLabels: additionalProperties: type: string description: |- matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. type: object type: object x-kubernetes-map-type: atomic matchLabelKeys: description: |- MatchLabelKeys is a set of pod label keys to select which pods will be taken into consideration. The keys are used to lookup values from the incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)` to select the group of existing pods which pods will be taken into consideration for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both matchLabelKeys and labelSelector. Also, matchLabelKeys cannot be set when labelSelector isn't set. items: type: string type: array x-kubernetes-list-type: atomic mismatchLabelKeys: description: |- MismatchLabelKeys is a set of pod label keys to select which pods will be taken into consideration. The keys are used to lookup values from the incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)` to select the group of existing pods which pods will be taken into consideration for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both mismatchLabelKeys and labelSelector. Also, mismatchLabelKeys cannot be set when labelSelector isn't set. items: type: string type: array x-kubernetes-list-type: atomic namespaceSelector: description: |- A label query over the set of namespaces that the term applies to. The term is applied to the union of the namespaces selected by this field and the ones listed in the namespaces field. null selector and null or empty namespaces list means "this pod's namespace". An empty selector ({}) matches all namespaces. properties: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. items: description: |- A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. properties: key: description: key is the label key that the selector applies to. type: string operator: description: |- operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. type: string values: description: |- values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. items: type: string type: array x-kubernetes-list-type: atomic required: - key - operator type: object type: array x-kubernetes-list-type: atomic matchLabels: additionalProperties: type: string description: |- matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. type: object type: object x-kubernetes-map-type: atomic namespaces: description: |- namespaces specifies a static list of namespace names that the term applies to. The term is applied to the union of the namespaces listed in this field and the ones selected by namespaceSelector. null or empty namespaces list and null namespaceSelector means "this pod's namespace". items: type: string type: array x-kubernetes-list-type: atomic topologyKey: description: |- This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching the labelSelector in the specified namespaces, where co-located is defined as running on a node whose value of the label with key topologyKey matches that of any node on which any of the selected pods is running. Empty topologyKey is not allowed. type: string required: - topologyKey type: object weight: description: |- weight associated with matching the corresponding podAffinityTerm, in the range 1-100. format: int32 type: integer required: - podAffinityTerm - weight type: object type: array x-kubernetes-list-type: atomic requiredDuringSchedulingIgnoredDuringExecution: description: |- If the anti-affinity requirements specified by this field are not met at scheduling time, the pod will not be scheduled onto the node. If the anti-affinity requirements specified by this field cease to be met at some point during pod execution (e.g. due to a pod label update), the system may or may not try to eventually evict the pod from its node. When there are multiple elements, the lists of nodes corresponding to each podAffinityTerm are intersected, i.e. all terms must be satisfied. items: description: |- Defines a set of pods (namely those matching the labelSelector relative to the given namespace(s)) that this pod should be co-located (affinity) or not co-located (anti-affinity) with, where co-located is defined as running on a node whose value of the label with key <topologyKey> matches that of any node on which a pod of the set of pods is running properties: labelSelector: description: |- A label query over a set of resources, in this case pods. If it's null, this PodAffinityTerm matches with no Pods. properties: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. items: description: |- A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. properties: key: description: key is the label key that the selector applies to. type: string operator: description: |- operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. type: string values: description: |- values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. items: type: string type: array x-kubernetes-list-type: atomic required: - key - operator type: object type: array x-kubernetes-list-type: atomic matchLabels: additionalProperties: type: string description: |- matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. type: object type: object x-kubernetes-map-type: atomic matchLabelKeys: description: |- MatchLabelKeys is a set of pod label keys to select which pods will be taken into consideration. The keys are used to lookup values from the incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)` to select the group of existing pods which pods will be taken into consideration for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both matchLabelKeys and labelSelector. Also, matchLabelKeys cannot be set when labelSelector isn't set. items: type: string type: array x-kubernetes-list-type: atomic mismatchLabelKeys: description: |- MismatchLabelKeys is a set of pod label keys to select which pods will be taken into consideration. The keys are used to lookup values from the incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)` to select the group of existing pods which pods will be taken into consideration for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both mismatchLabelKeys and labelSelector. Also, mismatchLabelKeys cannot be set when labelSelector isn't set. items: type: string type: array x-kubernetes-list-type: atomic namespaceSelector: description: |- A label query over the set of namespaces that the term applies to. The term is applied to the union of the namespaces selected by this field and the ones listed in the namespaces field. null selector and null or empty namespaces list means "this pod's namespace". An empty selector ({}) matches all namespaces. properties: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. items: description: |- A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. properties: key: description: key is the label key that the selector applies to. type: string operator: description: |- operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. type: string values: description: |- values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. items: type: string type: array x-kubernetes-list-type: atomic required: - key - operator type: object type: array x-kubernetes-list-type: atomic matchLabels: additionalProperties: type: string description: |- matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. type: object type: object x-kubernetes-map-type: atomic namespaces: description: |- namespaces specifies a static list of namespace names that the term applies to. The term is applied to the union of the namespaces listed in this field and the ones selected by namespaceSelector. null or empty namespaces list and null namespaceSelector means "this pod's namespace". items: type: string type: array x-kubernetes-list-type: atomic topologyKey: description: |- This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching the labelSelector in the specified namespaces, where co-located is defined as running on a node whose value of the label with key topologyKey matches that of any node on which any of the selected pods is running. Empty topologyKey is not allowed. type: string required: - topologyKey type: object type: array x-kubernetes-list-type: atomic type: object type: object allowedGroups: description: |- Groups allowed to view this RenovateJob when authentication is enabled. If empty or not set, the job is hidden from all users. items: type: string type: array discoverTopics: description: Topics to discover projects from, will be concatenated using , separator items: type: string type: array discoveryFilters: description: Filter to select which projects to process, will be concatenated using , separator items: type: string type: array dnsPolicy: description: DNS Policy for the renovate pods type: string extraEnv: description: Additional environment variables to set in the renovate container items: description: EnvVar represents an environment variable present in a Container. properties: name: description: |- Name of the environment variable. May consist of any printable ASCII characters except '='. type: string value: description: |- Variable references $(VAR_NAME) are expanded using the previously defined environment variables in the container and any service environment variables. If a variable cannot be resolved, the reference in the input string will be unchanged. Double $$ are reduced to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. "$$(VAR_NAME)" will produce the string literal "$(VAR_NAME)". Escaped references will never be expanded, regardless of whether the variable exists or not. Defaults to "". type: string valueFrom: description: Source for the environment variable's value. Cannot be used if value is not empty. properties: configMapKeyRef: description: Selects a key of a ConfigMap. properties: key: description: The key to select. type: string name: default: "" description: |- Name of the referent. This field is effectively required, but due to backwards compatibility is allowed to be empty. Instances of this type with an empty value here are almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: description: Specify whether the ConfigMap or its key must be defined type: boolean required: - key type: object x-kubernetes-map-type: atomic fieldRef: description: |- Selects a field of the pod: supports metadata.name, metadata.namespace, `metadata.labels['<KEY>']`, `metadata.annotations['<KEY>']`, spec.nodeName, spec.serviceAccountName, status.hostIP, status.podIP, status.podIPs. properties: apiVersion: description: Version of the schema the FieldPath is written in terms of, defaults to "v1". type: string fieldPath: description: Path of the field to select in the specified API version. type: string required: - fieldPath type: object x-kubernetes-map-type: atomic fileKeyRef: description: |- FileKeyRef selects a key of the env file. Requires the EnvFiles feature gate to be enabled. properties: key: description: |- The key within the env file. An invalid key will prevent the pod from starting. The keys defined within a source may consist of any printable ASCII characters except '='. During Alpha stage of the EnvFiles feature gate, the key size is limited to 128 characters. type: string optional: default: false description: |- Specify whether the file or its key must be defined. If the file or key does not exist, then the env var is not published. If optional is set to true and the specified key does not exist, the environment variable will not be set in the Pod's containers. If optional is set to false and the specified key does not exist, an error will be returned during Pod creation. type: boolean path: description: |- The path within the volume from which to select the file. Must be relative and may not contain the '..' path or start with '..'. type: string volumeName: description: The name of the volume mount containing the env file. type: string required: - key - path - volumeName type: object x-kubernetes-map-type: atomic resourceFieldRef: description: |- Selects a resource of the container: only resources limits and requests (limits.cpu, limits.memory, limits.ephemeral-storage, requests.cpu, requests.memory and requests.ephemeral-storage) are currently supported. properties: containerName: description: 'Container name: required for volumes, optional for env vars' type: string divisor: anyOf: - type: integer - type: string description: Specifies the output format of the exposed resources, defaults to "1" pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ x-kubernetes-int-or-string: true resource: description: 'Required: resource to select' type: string required: - resource type: object x-kubernetes-map-type: atomic secretKeyRef: description: Selects a key of a secret in the pod's namespace properties: key: description: The key of the secret to select from. Must be a valid secret key. type: string name: default: "" description: |- Name of the referent. This field is effectively required, but due to backwards compatibility is allowed to be empty. Instances of this type with an empty value here are almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: description: Specify whether the Secret or its key must be defined type: boolean required: - key type: object x-kubernetes-map-type: atomic type: object required: - name type: object type: array extraEnvFrom: description: Additional environment variable sources to set in the renovate container items: description: EnvFromSource represents the source of a set of ConfigMaps or Secrets properties: configMapRef: description: The ConfigMap to select from properties: name: default: "" description: |- Name of the referent. This field is effectively required, but due to backwards compatibility is allowed to be empty. Instances of this type with an empty value here are almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: description: Specify whether the ConfigMap must be defined type: boolean type: object x-kubernetes-map-type: atomic prefix: description: |- Optional text to prepend to the name of each environment variable. May consist of any printable ASCII characters except '='. type: string secretRef: description: The Secret to select from properties: name: default: "" description: |- Name of the referent. This field is effectively required, but due to backwards compatibility is allowed to be empty. Instances of this type with an empty value here are almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: description: Specify whether the Secret must be defined type: boolean type: object x-kubernetes-map-type: atomic type: object type: array extraVolumeMounts: description: Additional volume mounts for the renovate pods items: description: VolumeMount describes a mounting of a Volume within a container. properties: mountPath: description: |- Path within the container at which the volume should be mounted. Must not contain ':'. type: string mountPropagation: description: |- mountPropagation determines how mounts are propagated from the host to container and the other way around. When not set, MountPropagationNone is used. This field is beta in 1.10. When RecursiveReadOnly is set to IfPossible or to Enabled, MountPropagation must be None or unspecified (which defaults to None). type: string name: description: This must match the Name of a Volume. type: string readOnly: description: |- Mounted read-only if true, read-write otherwise (false or unspecified). Defaults to false. type: boolean recursiveReadOnly: description: |- RecursiveReadOnly specifies whether read-only mounts should be handled recursively. If ReadOnly is false, this field has no meaning and must be unspecified. If ReadOnly is true, and this field is set to Disabled, the mount is not made recursively read-only. If this field is set to IfPossible, the mount is made recursively read-only, if it is supported by the container runtime. If this field is set to Enabled, the mount is made recursively read-only if it is supported by the container runtime, otherwise the pod will not be started and an error will be generated to indicate the reason. If this field is set to IfPossible or Enabled, MountPropagation must be set to None (or be unspecified, which defaults to None). If this field is not specified, it is treated as an equivalent of Disabled. type: string subPath: description: |- Path within the volume from which the container's volume should be mounted. Defaults to "" (volume's root). type: string subPathExpr: description: |- Expanded path within the volume from which the container's volume should be mounted. Behaves similarly to SubPath but environment variable references $(VAR_NAME) are expanded using the container's environment. Defaults to "" (volume's root). SubPathExpr and SubPath are mutually exclusive. type: string required: - mountPath - name type: object type: array extraVolumes: description: Additional volumes to mount in the renovate pods items: description: Volume represents a named volume in a pod that may be accessed by any container in the pod. properties: awsElasticBlockStore: description: |- awsElasticBlockStore represents an AWS Disk resource that is attached to a kubelet's host machine and then exposed to the pod. Deprecated: AWSElasticBlockStore is deprecated. All operations for the in-tree awsElasticBlockStore type are redirected to the ebs.csi.aws.com CSI driver. More info: https://kubernetes.io/docs/concepts/storage/volumes#awselasticblockstore properties: fsType: description: |- fsType is the filesystem type of the volume that you want to mount. Tip: Ensure that the filesystem type is supported by the host operating system. Examples: "ext4", "xfs", "ntfs". Implicitly inferred to be "ext4" if unspecified. More info: https://kubernetes.io/docs/concepts/storage/volumes#awselasticblockstore type: string partition: description: |- partition is the partition in the volume that you want to mount. If omitted, the default is to mount by volume name. Examples: For volume /dev/sda1, you specify the partition as "1". Similarly, the volume partition for /dev/sda is "0" (or you can leave the property empty). format: int32 type: integer readOnly: description: |- readOnly value true will force the readOnly setting in VolumeMounts. More info: https://kubernetes.io/docs/concepts/storage/volumes#awselasticblockstore type: boolean volumeID: description: |- volumeID is unique ID of the persistent disk resource in AWS (Amazon EBS volume). More info: https://kubernetes.io/docs/concepts/storage/volumes#awselasticblockstore type: string required: - volumeID type: object azureDisk: description: |- azureDisk represents an Azure Data Disk mount on the host and bind mount to the pod. Deprecated: AzureDisk is deprecated. All operations for the in-tree azureDisk type are redirected to the disk.csi.azure.com CSI driver. properties: cachingMode: description: 'cachingMode is the Host Caching mode: None, Read Only, Read Write.' type: string diskName: description: diskName is the Name of the data disk in the blob storage type: string diskURI: description: diskURI is the URI of data disk in the blob storage type: string fsType: default: ext4 description: |- fsType is Filesystem type to mount. Must be a filesystem type supported by the host operating system. Ex. "ext4", "xfs", "ntfs". Implicitly inferred to be "ext4" if unspecified. type: string kind: description: 'kind expected values are Shared: multiple blob disks per storage account Dedicated: single blob disk per storage account Managed: azure managed data disk (only in managed availability set). defaults to shared' type: string readOnly: default: false description: |- readOnly Defaults to false (read/write). ReadOnly here will force the ReadOnly setting in VolumeMounts. type: boolean required: - diskName - diskURI type: object azureFile: description: |- azureFile represents an Azure File Service mount on the host and bind mount to the pod. Deprecated: AzureFile is deprecated. All operations for the in-tree azureFile type are redirected to the file.csi.azure.com CSI driver. properties: readOnly: description: |- readOnly defaults to false (read/write). ReadOnly here will force the ReadOnly setting in VolumeMounts. type: boolean secretName: description: secretName is the name of secret that contains Azure Storage Account Name and Key type: string shareName: description: shareName is the azure share Name type: string required: - secretName - shareName type: object cephfs: description: |- cephFS represents a Ceph FS mount on the host that shares a pod's lifetime. Deprecated: CephFS is deprecated and the in-tree cephfs type is no longer supported. properties: monitors: description: |- monitors is Required: Monitors is a collection of Ceph monitors More info: https://examples.k8s.io/volumes/cephfs/README.md#how-to-use-it items: type: string type: array x-kubernetes-list-type: atomic path: description: 'path is Optional: Used as the mounted root, rather than the full Ceph tree, default is /' type: string readOnly: description: |- readOnly is Optional: Defaults to false (read/write). ReadOnly here will force the ReadOnly setting in VolumeMounts. More info: https://examples.k8s.io/volumes/cephfs/README.md#how-to-use-it type: boolean secretFile: description: |- secretFile is Optional: SecretFile is the path to key ring for User, default is /etc/ceph/user.secret More info: https://examples.k8s.io/volumes/cephfs/README.md#how-to-use-it type: string secretRef: description: |- secretRef is Optional: SecretRef is reference to the authentication secret for User, default is empty. More info: https://examples.k8s.io/volumes/cephfs/README.md#how-to-use-it properties: name: default: "" description: |- Name of the referent. This field is effectively required, but due to backwards compatibility is allowed to be empty. Instances of this type with an empty value here are almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string type: object x-kubernetes-map-type: atomic user: description: |- user is optional: User is the rados user name, default is admin More info: https://examples.k8s.io/volumes/cephfs/README.md#how-to-use-it type: string required: - monitors type: object cinder: description: |- cinder represents a cinder volume attached and mounted on kubelets host machine. Deprecated: Cinder is deprecated. All operations for the in-tree cinder type are redirected to the cinder.csi.openstack.org CSI driver. More info: https://examples.k8s.io/mysql-cinder-pd/README.md properties: fsType: description: |- fsType is the filesystem type to mount. Must be a filesystem type supported by the host operating system. Examples: "ext4", "xfs", "ntfs". Implicitly inferred to be "ext4" if unspecified. More info: https://examples.k8s.io/mysql-cinder-pd/README.md type: string readOnly: description: |- readOnly defaults to false (read/write). ReadOnly here will force the ReadOnly setting in VolumeMounts. More info: https://examples.k8s.io/mysql-cinder-pd/README.md type: boolean secretRef: description: |- secretRef is optional: points to a secret object containing parameters used to connect to OpenStack. properties: name: default: "" description: |- Name of the referent. This field is effectively required, but due to backwards compatibility is allowed to be empty. Instances of this type with an empty value here are almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string type: object x-kubernetes-map-type: atomic volumeID: description: |- volumeID used to identify the volume in cinder. More info: https://examples.k8s.io/mysql-cinder-pd/README.md type: string required: - volumeID type: object configMap: description: configMap represents a configMap that should populate this volume properties: defaultMode: description: |- defaultMode is optional: mode bits used to set permissions on created files by default. Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. Defaults to 0644. Directories within the path are not affected by this setting. This might be in conflict with other options that affect the file mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer items: description: |- items if unspecified, each key-value pair in the Data field of the referenced ConfigMap will be projected into the volume as a file whose name is the key and content is the value. If specified, the listed keys will be projected into the specified paths, and unlisted keys will not be present. If a key is specified which is not present in the ConfigMap, the volume setup will error unless it is marked optional. Paths must be relative and may not contain the '..' path or start with '..'. items: description: Maps a string key to a path within a volume. properties: key: description: key is the key to project. type: string mode: description: |- mode is Optional: mode bits used to set permissions on this file. Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. If not specified, the volume defaultMode will be used. This might be in conflict with other options that affect the file mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer path: description: |- path is the relative path of the file to map the key to. May not be an absolute path. May not contain the path element '..'. May not start with the string '..'. type: string required: - key - path type: object type: array x-kubernetes-list-type: atomic name: default: "" description: |- Name of the referent. This field is effectively required, but due to backwards compatibility is allowed to be empty. Instances of this type with an empty value here are almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: description: optional specify whether the ConfigMap or its keys must be defined type: boolean type: object x-kubernetes-map-type: atomic csi: description: csi (Container Storage Interface) represents ephemeral storage that is handled by certain external CSI drivers. properties: driver: description: |- driver is the name of the CSI driver that handles this volume. Consult with your admin for the correct name as registered in the cluster. type: string fsType: description: |- fsType to mount. Ex. "ext4", "xfs", "ntfs". If not provided, the empty value is passed to the associated CSI driver which will determine the default filesystem to apply. type: string nodePublishSecretRef: description: |- nodePublishSecretRef is a reference to the secret object containing sensitive information to pass to the CSI driver to complete the CSI NodePublishVolume and NodeUnpublishVolume calls. This field is optional, and may be empty if no secret is required. If the secret object contains more than one secret, all secret references are passed. properties: name: default: "" description: |- Name of the referent. This field is effectively required, but due to backwards compatibility is allowed to be empty. Instances of this type with an empty value here are almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string type: object x-kubernetes-map-type: atomic readOnly: description: |- readOnly specifies a read-only configuration for the volume. Defaults to false (read/write). type: boolean volumeAttributes: additionalProperties: type: string description: |- volumeAttributes stores driver-specific properties that are passed to the CSI driver. Consult your driver's documentation for supported values. type: object required: - driver type: object downwardAPI: description: downwardAPI represents downward API about the pod that should populate this volume properties: defaultMode: description: |- Optional: mode bits to use on created files by default. Must be a Optional: mode bits used to set permissions on created files by default. Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. Defaults to 0644. Directories within the path are not affected by this setting. This might be in conflict with other options that affect the file mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer items: description: Items is a list of downward API volume file items: description: DownwardAPIVolumeFile represents information to create the file containing the pod field properties: fieldRef: description: 'Required: Selects a field of the pod: only annotations, labels, name, namespace and uid are supported.' properties: apiVersion: description: Version of the schema the FieldPath is written in terms of, defaults to "v1". type: string fieldPath: description: Path of the field to select in the specified API version. type: string required: - fieldPath type: object x-kubernetes-map-type: atomic mode: description: |- Optional: mode bits used to set permissions on this file, must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. If not specified, the volume defaultMode will be used. This might be in conflict with other options that affect the file mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer path: description: 'Required: Path is the relative path name of the file to be created. Must not be absolute or contain the ''..'' path. Must be utf-8 encoded. The first item of the relative path must not start with ''..''' type: string resourceFieldRef: description: |- Selects a resource of the container: only resources limits and requests (limits.cpu, limits.memory, requests.cpu and requests.memory) are currently supported. properties: containerName: description: 'Container name: required for volumes, optional for env vars' type: string divisor: anyOf: - type: integer - type: string description: Specifies the output format of the exposed resources, defaults to "1" pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ x-kubernetes-int-or-string: true resource: description: 'Required: resource to select' type: string required: - resource type: object x-kubernetes-map-type: atomic required: - path type: object type: array x-kubernetes-list-type: atomic type: object emptyDir: description: |- emptyDir represents a temporary directory that shares a pod's lifetime. More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir properties: medium: description: |- medium represents what type of storage medium should back this directory. The default is "" which means to use the node's default medium. Must be an empty string (default) or Memory. More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir type: string sizeLimit: anyOf: - type: integer - type: string description: |- sizeLimit is the total amount of local storage required for this EmptyDir volume. The size limit is also applicable for memory medium. The maximum usage on memory medium EmptyDir would be the minimum value between the SizeLimit specified here and the sum of memory limits of all containers in a pod. The default is nil which means that the limit is undefined. More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ x-kubernetes-int-or-string: true type: object ephemeral: description: |- ephemeral represents a volume that is handled by a cluster storage driver. The volume's lifecycle is tied to the pod that defines it - it will be created before the pod starts, and deleted when the pod is removed. Use this if: a) the volume is only needed while the pod runs, b) features of normal volumes like restoring from snapshot or capacity tracking are needed, c) the storage driver is specified through a storage class, and d) the storage driver supports dynamic volume provisioning through a PersistentVolumeClaim (see EphemeralVolumeSource for more information on the connection between this volume type and PersistentVolumeClaim). Use PersistentVolumeClaim or one of the vendor-specific APIs for volumes that persist for longer than the lifecycle of an individual pod. Use CSI for light-weight local ephemeral volumes if the CSI driver is meant to be used that way - see the documentation of the driver for more information. A pod can use both types of ephemeral volumes and persistent volumes at the same time. properties: volumeClaimTemplate: description: |- Will be used to create a stand-alone PVC to provision the volume. The pod in which this EphemeralVolumeSource is embedded will be the owner of the PVC, i.e. the PVC will be deleted together with the pod. The name of the PVC will be `<pod name>-<volume name>` where `<volume name>` is the name from the `PodSpec.Volumes` array entry. Pod validation will reject the pod if the concatenated name is not valid for a PVC (for example, too long). An existing PVC with that name that is not owned by the pod will *not* be used for the pod to avoid using an unrelated volume by mistake. Starting the pod is then blocked until the unrelated PVC is removed. If such a pre-created PVC is meant to be used by the pod, the PVC has to updated with an owner reference to the pod once the pod exists. Normally this should not be necessary, but it may be useful when manually reconstructing a broken cluster. This field is read-only and no changes will be made by Kubernetes to the PVC after it has been created. Required, must not be nil. properties: metadata: description: |- May contain labels and annotations that will be copied into the PVC when creating it. No other fields are allowed and will be rejected during validation. type: object spec: description: |- The specification for the PersistentVolumeClaim. The entire content is copied unchanged into the PVC that gets created from this template. The same fields as in a PersistentVolumeClaim are also valid here. properties: accessModes: description: |- accessModes contains the desired access modes the volume should have. More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#access-modes-1 items: type: string type: array x-kubernetes-list-type: atomic dataSource: description: |- dataSource field can be used to specify either: * An existing VolumeSnapshot object (snapshot.storage.k8s.io/VolumeSnapshot) * An existing PVC (PersistentVolumeClaim) If the provisioner or an external controller can support the specified data source, it will create a new volume based on the contents of the specified data source. When the AnyVolumeDataSource feature gate is enabled, dataSource contents will be copied to dataSourceRef, and dataSourceRef contents will be copied to dataSource when dataSourceRef.namespace is not specified. If the namespace is specified, then dataSourceRef will not be copied to dataSource. properties: apiGroup: description: |- APIGroup is the group for the resource being referenced. If APIGroup is not specified, the specified Kind must be in the core API group. For any other third-party types, APIGroup is required. type: string kind: description: Kind is the type of resource being referenced type: string name: description: Name is the name of resource being referenced type: string required: - kind - name type: object x-kubernetes-map-type: atomic dataSourceRef: description: |- dataSourceRef specifies the object from which to populate the volume with data, if a non-empty volume is desired. This may be any object from a non-empty API group (non core object) or a PersistentVolumeClaim object. When this field is specified, volume binding will only succeed if the type of the specified object matches some installed volume populator or dynamic provisioner. This field will replace the functionality of the dataSource field and as such if both fields are non-empty, they must have the same value. For backwards compatibility, when namespace isn't specified in dataSourceRef, both fields (dataSource and dataSourceRef) will be set to the same value automatically if one of them is empty and the other is non-empty. When namespace is specified in dataSourceRef, dataSource isn't set to the same value and must be empty. There are three important differences between dataSource and dataSourceRef: * While dataSource only allows two specific types of objects, dataSourceRef allows any non-core object, as well as PersistentVolumeClaim objects. * While dataSource ignores disallowed values (dropping them), dataSourceRef preserves all values, and generates an error if a disallowed value is specified. * While dataSource only allows local objects, dataSourceRef allows objects in any namespaces. (Beta) Using this field requires the AnyVolumeDataSource feature gate to be enabled. (Alpha) Using the namespace field of dataSourceRef requires the CrossNamespaceVolumeDataSource feature gate to be enabled. properties: apiGroup: description: |- APIGroup is the group for the resource being referenced. If APIGroup is not specified, the specified Kind must be in the core API group. For any other third-party types, APIGroup is required. type: string kind: description: Kind is the type of resource being referenced type: string name: description: Name is the name of resource being referenced type: string namespace: description: |- Namespace is the namespace of resource being referenced Note that when a namespace is specified, a gateway.networking.k8s.io/ReferenceGrant object is required in the referent namespace to allow that namespace's owner to accept the reference. See the ReferenceGrant documentation for details. (Alpha) This field requires the CrossNamespaceVolumeDataSource feature gate to be enabled. type: string required: - kind - name type: object resources: description: |- resources represents the minimum resources the volume should have. Users are allowed to specify resource requirements that are lower than previous value but must still be higher than capacity recorded in the status field of the claim. More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#resources properties: limits: additionalProperties: anyOf: - type: integer - type: string pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ x-kubernetes-int-or-string: true description: |- Limits describes the maximum amount of compute resources allowed. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ type: object requests: additionalProperties: anyOf: - type: integer - type: string pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ x-kubernetes-int-or-string: true description: |- Requests describes the minimum amount of compute resources required. If Requests is omitted for a container, it defaults to Limits if that is explicitly specified, otherwise to an implementation-defined value. Requests cannot exceed Limits. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ type: object type: object selector: description: selector is a label query over volumes to consider for binding. properties: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. items: description: |- A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. properties: key: description: key is the label key that the selector applies to. type: string operator: description: |- operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. type: string values: description: |- values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. items: type: string type: array x-kubernetes-list-type: atomic required: - key - operator type: object type: array x-kubernetes-list-type: atomic matchLabels: additionalProperties: type: string description: |- matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. type: object type: object x-kubernetes-map-type: atomic storageClassName: description: |- storageClassName is the name of the StorageClass required by the claim. More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#class-1 type: string volumeAttributesClassName: description: |- volumeAttributesClassName may be used to set the VolumeAttributesClass used by this claim. If specified, the CSI driver will create or update the volume with the attributes defined in the corresponding VolumeAttributesClass. This has a different purpose than storageClassName, it can be changed after the claim is created. An empty string or nil value indicates that no VolumeAttributesClass will be applied to the claim. If the claim enters an Infeasible error state, this field can be reset to its previous value (including nil) to cancel the modification. If the resource referred to by volumeAttributesClass does not exist, this PersistentVolumeClaim will be set to a Pending state, as reflected by the modifyVolumeStatus field, until such as a resource exists. More info: https://kubernetes.io/docs/concepts/storage/volume-attributes-classes/ type: string volumeMode: description: |- volumeMode defines what type of volume is required by the claim. Value of Filesystem is implied when not included in claim spec. type: string volumeName: description: volumeName is the binding reference to the PersistentVolume backing this claim. type: string type: object required: - spec type: object type: object fc: description: fc represents a Fibre Channel resource that is attached to a kubelet's host machine and then exposed to the pod. properties: fsType: description: |- fsType is the filesystem type to mount. Must be a filesystem type supported by the host operating system. Ex. "ext4", "xfs", "ntfs". Implicitly inferred to be "ext4" if unspecified. type: string lun: description: 'lun is Optional: FC target lun number' format: int32 type: integer readOnly: description: |- readOnly is Optional: Defaults to false (read/write). ReadOnly here will force the ReadOnly setting in VolumeMounts. type: boolean targetWWNs: description: 'targetWWNs is Optional: FC target worldwide names (WWNs)' items: type: string type: array x-kubernetes-list-type: atomic wwids: description: |- wwids Optional: FC volume world wide identifiers (wwids) Either wwids or combination of targetWWNs and lun must be set, but not both simultaneously. items: type: string type: array x-kubernetes-list-type: atomic type: object flexVolume: description: |- flexVolume represents a generic volume resource that is provisioned/attached using an exec based plugin. Deprecated: FlexVolume is deprecated. Consider using a CSIDriver instead. properties: driver: description: driver is the name of the driver to use for this volume. type: string fsType: description: |- fsType is the filesystem type to mount. Must be a filesystem type supported by the host operating system. Ex. "ext4", "xfs", "ntfs". The default filesystem depends on FlexVolume script. type: string options: additionalProperties: type: string description: 'options is Optional: this field holds extra command options if any.' type: object readOnly: description: |- readOnly is Optional: defaults to false (read/write). ReadOnly here will force the ReadOnly setting in VolumeMounts. type: boolean secretRef: description: |- secretRef is Optional: secretRef is reference to the secret object containing sensitive information to pass to the plugin scripts. This may be empty if no secret object is specified. If the secret object contains more than one secret, all secrets are passed to the plugin scripts. properties: name: default: "" description: |- Name of the referent. This field is effectively required, but due to backwards compatibility is allowed to be empty. Instances of this type with an empty value here are almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string type: object x-kubernetes-map-type: atomic required: - driver type: object flocker: description: |- flocker represents a Flocker volume attached to a kubelet's host machine. This depends on the Flocker control service being running. Deprecated: Flocker is deprecated and the in-tree flocker type is no longer supported. properties: datasetName: description: |- datasetName is Name of the dataset stored as metadata -> name on the dataset for Flocker should be considered as deprecated type: string datasetUUID: description: datasetUUID is the UUID of the dataset. This is unique identifier of a Flocker dataset type: string type: object gcePersistentDisk: description: |- gcePersistentDisk represents a GCE Disk resource that is attached to a kubelet's host machine and then exposed to the pod. Deprecated: GCEPersistentDisk is deprecated. All operations for the in-tree gcePersistentDisk type are redirected to the pd.csi.storage.gke.io CSI driver. More info: https://kubernetes.io/docs/concepts/storage/volumes#gcepersistentdisk properties: fsType: description: |- fsType is filesystem type of the volume that you want to mount. Tip: Ensure that the filesystem type is supported by the host operating system. Examples: "ext4", "xfs", "ntfs". Implicitly inferred to be "ext4" if unspecified. More info: https://kubernetes.io/docs/concepts/storage/volumes#gcepersistentdisk type: string partition: description: |- partition is the partition in the volume that you want to mount. If omitted, the default is to mount by volume name. Examples: For volume /dev/sda1, you specify the partition as "1". Similarly, the volume partition for /dev/sda is "0" (or you can leave the property empty). More info: https://kubernetes.io/docs/concepts/storage/volumes#gcepersistentdisk format: int32 type: integer pdName: description: |- pdName is unique name of the PD resource in GCE. Used to identify the disk in GCE. More info: https://kubernetes.io/docs/concepts/storage/volumes#gcepersistentdisk type: string readOnly: description: |- readOnly here will force the ReadOnly setting in VolumeMounts. Defaults to false. More info: https://kubernetes.io/docs/concepts/storage/volumes#gcepersistentdisk type: boolean required: - pdName type: object gitRepo: description: |- gitRepo represents a git repository at a particular revision. Deprecated: GitRepo is deprecated. To provision a container with a git repo, mount an EmptyDir into an InitContainer that clones the repo using git, then mount the EmptyDir into the Pod's container. properties: directory: description: |- directory is the target directory name. Must not contain or start with '..'. If '.' is supplied, the volume directory will be the git repository. Otherwise, if specified, the volume will contain the git repository in the subdirectory with the given name. type: string repository: description: repository is the URL type: string revision: description: revision is the commit hash for the specified revision. type: string required: - repository type: object glusterfs: description: |- glusterfs represents a Glusterfs mount on the host that shares a pod's lifetime. Deprecated: Glusterfs is deprecated and the in-tree glusterfs type is no longer supported. properties: endpoints: description: endpoints is the endpoint name that details Glusterfs topology. type: string path: description: |- path is the Glusterfs volume path. More info: https://examples.k8s.io/volumes/glusterfs/README.md#create-a-pod type: string readOnly: description: |- readOnly here will force the Glusterfs volume to be mounted with read-only permissions. Defaults to false. More info: https://examples.k8s.io/volumes/glusterfs/README.md#create-a-pod type: boolean required: - endpoints - path type: object hostPath: description: |- hostPath represents a pre-existing file or directory on the host machine that is directly exposed to the container. This is generally used for system agents or other privileged things that are allowed to see the host machine. Most containers will NOT need this. More info: https://kubernetes.io/docs/concepts/storage/volumes#hostpath properties: path: description: |- path of the directory on the host. If the path is a symlink, it will follow the link to the real path. More info: https://kubernetes.io/docs/concepts/storage/volumes#hostpath type: string type: description: |- type for HostPath Volume Defaults to "" More info: https://kubernetes.io/docs/concepts/storage/volumes#hostpath type: string required: - path type: object image: description: |- image represents an OCI object (a container image or artifact) pulled and mounted on the kubelet's host machine. The volume is resolved at pod startup depending on which PullPolicy value is provided: - Always: the kubelet always attempts to pull the reference. Container creation will fail If the pull fails. - Never: the kubelet never pulls the reference and only uses a local image or artifact. Container creation will fail if the reference isn't present. - IfNotPresent: the kubelet pulls if the reference isn't already present on disk. Container creation will fail if the reference isn't present and the pull fails. The volume gets re-resolved if the pod gets deleted and recreated, which means that new remote content will become available on pod recreation. A failure to resolve or pull the image during pod startup will block containers from starting and may add significant latency. Failures will be retried using normal volume backoff and will be reported on the pod reason and message. The types of objects that may be mounted by this volume are defined by the container runtime implementation on a host machine and at minimum must include all valid types supported by the container image field. The OCI object gets mounted in a single directory (spec.containers[*].volumeMounts.mountPath) by merging the manifest layers in the same way as for container images. The volume will be mounted read-only (ro). Sub path mounts for containers are not supported (spec.containers[*].volumeMounts.subpath) before 1.33. The field spec.securityContext.fsGroupChangePolicy has no effect on this volume type. properties: pullPolicy: description: |- Policy for pulling OCI objects. Possible values are: Always: the kubelet always attempts to pull the reference. Container creation will fail If the pull fails. Never: the kubelet never pulls the reference and only uses a local image or artifact. Container creation will fail if the reference isn't present. IfNotPresent: the kubelet pulls if the reference isn't already present on disk. Container creation will fail if the reference isn't present and the pull fails. Defaults to Always if :latest tag is specified, or IfNotPresent otherwise. type: string reference: description: |- Required: Image or artifact reference to be used. Behaves in the same way as pod.spec.containers[*].image. Pull secrets will be assembled in the same way as for the container image by looking up node credentials, SA image pull secrets, and pod spec image pull secrets. More info: https://kubernetes.io/docs/concepts/containers/images This field is optional to allow higher level config management to default or override container images in workload controllers like Deployments and StatefulSets. type: string type: object iscsi: description: |- iscsi represents an ISCSI Disk resource that is attached to a kubelet's host machine and then exposed to the pod. More info: https://kubernetes.io/docs/concepts/storage/volumes/#iscsi properties: chapAuthDiscovery: description: chapAuthDiscovery defines whether support iSCSI Discovery CHAP authentication type: boolean chapAuthSession: description: chapAuthSession defines whether support iSCSI Session CHAP authentication type: boolean fsType: description: |- fsType is the filesystem type of the volume that you want to mount. Tip: Ensure that the filesystem type is supported by the host operating system. Examples: "ext4", "xfs", "ntfs". Implicitly inferred to be "ext4" if unspecified. More info: https://kubernetes.io/docs/concepts/storage/volumes#iscsi type: string initiatorName: description: |- initiatorName is the custom iSCSI Initiator Name. If initiatorName is specified with iscsiInterface simultaneously, new iSCSI interface <target portal>:<volume name> will be created for the connection. type: string iqn: description: iqn is the target iSCSI Qualified Name. type: string iscsiInterface: default: default description: |- iscsiInterface is the interface Name that uses an iSCSI transport. Defaults to 'default' (tcp). type: string lun: description: lun represents iSCSI Target Lun number. format: int32 type: integer portals: description: |- portals is the iSCSI Target Portal List. The portal is either an IP or ip_addr:port if the port is other than default (typically TCP ports 860 and 3260). items: type: string type: array x-kubernetes-list-type: atomic readOnly: description: |- readOnly here will force the ReadOnly setting in VolumeMounts. Defaults to false. type: boolean secretRef: description: secretRef is the CHAP Secret for iSCSI target and initiator authentication properties: name: default: "" description: |- Name of the referent. This field is effectively required, but due to backwards compatibility is allowed to be empty. Instances of this type with an empty value here are almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string type: object x-kubernetes-map-type: atomic targetPortal: description: |- targetPortal is iSCSI Target Portal. The Portal is either an IP or ip_addr:port if the port is other than default (typically TCP ports 860 and 3260). type: string required: - iqn - lun - targetPortal type: object name: description: |- name of the volume. Must be a DNS_LABEL and unique within the pod. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string nfs: description: |- nfs represents an NFS mount on the host that shares a pod's lifetime More info: https://kubernetes.io/docs/concepts/storage/volumes#nfs properties: path: description: |- path that is exported by the NFS server. More info: https://kubernetes.io/docs/concepts/storage/volumes#nfs type: string readOnly: description: |- readOnly here will force the NFS export to be mounted with read-only permissions. Defaults to false. More info: https://kubernetes.io/docs/concepts/storage/volumes#nfs type: boolean server: description: |- server is the hostname or IP address of the NFS server. More info: https://kubernetes.io/docs/concepts/storage/volumes#nfs type: string required: - path - server type: object persistentVolumeClaim: description: |- persistentVolumeClaimVolumeSource represents a reference to a PersistentVolumeClaim in the same namespace. More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#persistentvolumeclaims properties: claimName: description: |- claimName is the name of a PersistentVolumeClaim in the same namespace as the pod using this volume. More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#persistentvolumeclaims type: string readOnly: description: |- readOnly Will force the ReadOnly setting in VolumeMounts. Default false. type: boolean required: - claimName type: object photonPersistentDisk: description: |- photonPersistentDisk represents a PhotonController persistent disk attached and mounted on kubelets host machine. Deprecated: PhotonPersistentDisk is deprecated and the in-tree photonPersistentDisk type is no longer supported. properties: fsType: description: |- fsType is the filesystem type to mount. Must be a filesystem type supported by the host operating system. Ex. "ext4", "xfs", "ntfs". Implicitly inferred to be "ext4" if unspecified. type: string pdID: description: pdID is the ID that identifies Photon Controller persistent disk type: string required: - pdID type: object portworxVolume: description: |- portworxVolume represents a portworx volume attached and mounted on kubelets host machine. Deprecated: PortworxVolume is deprecated. All operations for the in-tree portworxVolume type are redirected to the pxd.portworx.com CSI driver. properties: fsType: description: |- fSType represents the filesystem type to mount Must be a filesystem type supported by the host operating system. Ex. "ext4", "xfs". Implicitly inferred to be "ext4" if unspecified. type: string readOnly: description: |- readOnly defaults to false (read/write). ReadOnly here will force the ReadOnly setting in VolumeMounts. type: boolean volumeID: description: volumeID uniquely identifies a Portworx volume type: string required: - volumeID type: object projected: description: projected items for all in one resources secrets, configmaps, and downward API properties: defaultMode: description: |- defaultMode are the mode bits used to set permissions on created files by default. Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. Directories within the path are not affected by this setting. This might be in conflict with other options that affect the file mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer sources: description: |- sources is the list of volume projections. Each entry in this list handles one source. items: description: |- Projection that may be projected along with other supported volume types. Exactly one of these fields must be set. properties: clusterTrustBundle: description: |- ClusterTrustBundle allows a pod to access the `.spec.trustBundle` field of ClusterTrustBundle objects in an auto-updating file. Alpha, gated by the ClusterTrustBundleProjection feature gate. ClusterTrustBundle objects can either be selected by name, or by the combination of signer name and a label selector. Kubelet performs aggressive normalization of the PEM contents written into the pod filesystem. Esoteric PEM features such as inter-block comments and block headers are stripped. Certificates are deduplicated. The ordering of certificates within the file is arbitrary, and Kubelet may change the order over time. properties: labelSelector: description: |- Select all ClusterTrustBundles that match this label selector. Only has effect if signerName is set. Mutually-exclusive with name. If unset, interpreted as "match nothing". If set but empty, interpreted as "match everything". properties: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. items: description: |- A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. properties: key: description: key is the label key that the selector applies to. type: string operator: description: |- operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. type: string values: description: |- values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. items: type: string type: array x-kubernetes-list-type: atomic required: - key - operator type: object type: array x-kubernetes-list-type: atomic matchLabels: additionalProperties: type: string description: |- matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. type: object type: object x-kubernetes-map-type: atomic name: description: |- Select a single ClusterTrustBundle by object name. Mutually-exclusive with signerName and labelSelector. type: string optional: description: |- If true, don't block pod startup if the referenced ClusterTrustBundle(s) aren't available. If using name, then the named ClusterTrustBundle is allowed not to exist. If using signerName, then the combination of signerName and labelSelector is allowed to match zero ClusterTrustBundles. type: boolean path: description: Relative path from the volume root to write the bundle. type: string signerName: description: |- Select all ClusterTrustBundles that match this signer name. Mutually-exclusive with name. The contents of all selected ClusterTrustBundles will be unified and deduplicated. type: string required: - path type: object configMap: description: configMap information about the configMap data to project properties: items: description: |- items if unspecified, each key-value pair in the Data field of the referenced ConfigMap will be projected into the volume as a file whose name is the key and content is the value. If specified, the listed keys will be projected into the specified paths, and unlisted keys will not be present. If a key is specified which is not present in the ConfigMap, the volume setup will error unless it is marked optional. Paths must be relative and may not contain the '..' path or start with '..'. items: description: Maps a string key to a path within a volume. properties: key: description: key is the key to project. type: string mode: description: |- mode is Optional: mode bits used to set permissions on this file. Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. If not specified, the volume defaultMode will be used. This might be in conflict with other options that affect the file mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer path: description: |- path is the relative path of the file to map the key to. May not be an absolute path. May not contain the path element '..'. May not start with the string '..'. type: string required: - key - path type: object type: array x-kubernetes-list-type: atomic name: default: "" description: |- Name of the referent. This field is effectively required, but due to backwards compatibility is allowed to be empty. Instances of this type with an empty value here are almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: description: optional specify whether the ConfigMap or its keys must be defined type: boolean type: object x-kubernetes-map-type: atomic downwardAPI: description: downwardAPI information about the downwardAPI data to project properties: items: description: Items is a list of DownwardAPIVolume file items: description: DownwardAPIVolumeFile represents information to create the file containing the pod field properties: fieldRef: description: 'Required: Selects a field of the pod: only annotations, labels, name, namespace and uid are supported.' properties: apiVersion: description: Version of the schema the FieldPath is written in terms of, defaults to "v1". type: string fieldPath: description: Path of the field to select in the specified API version. type: string required: - fieldPath type: object x-kubernetes-map-type: atomic mode: description: |- Optional: mode bits used to set permissions on this file, must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. If not specified, the volume defaultMode will be used. This might be in conflict with other options that affect the file mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer path: description: 'Required: Path is the relative path name of the file to be created. Must not be absolute or contain the ''..'' path. Must be utf-8 encoded. The first item of the relative path must not start with ''..''' type: string resourceFieldRef: description: |- Selects a resource of the container: only resources limits and requests (limits.cpu, limits.memory, requests.cpu and requests.memory) are currently supported. properties: containerName: description: 'Container name: required for volumes, optional for env vars' type: string divisor: anyOf: - type: integer - type: string description: Specifies the output format of the exposed resources, defaults to "1" pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ x-kubernetes-int-or-string: true resource: description: 'Required: resource to select' type: string required: - resource type: object x-kubernetes-map-type: atomic required: - path type: object type: array x-kubernetes-list-type: atomic type: object podCertificate: description: |- Projects an auto-rotating credential bundle (private key and certificate chain) that the pod can use either as a TLS client or server. Kubelet generates a private key and uses it to send a PodCertificateRequest to the named signer. Once the signer approves the request and issues a certificate chain, Kubelet writes the key and certificate chain to the pod filesystem. The pod does not start until certificates have been issued for each podCertificate projected volume source in its spec. Kubelet will begin trying to rotate the certificate at the time indicated by the signer using the PodCertificateRequest.Status.BeginRefreshAt timestamp. Kubelet can write a single file, indicated by the credentialBundlePath field, or separate files, indicated by the keyPath and certificateChainPath fields. The credential bundle is a single file in PEM format. The first PEM entry is the private key (in PKCS#8 format), and the remaining PEM entries are the certificate chain issued by the signer (typically, signers will return their certificate chain in leaf-to-root order). Prefer using the credential bundle format, since your application code can read it atomically. If you use keyPath and certificateChainPath, your application must make two separate file reads. If these coincide with a certificate rotation, it is possible that the private key and leaf certificate you read may not correspond to each other. Your application will need to check for this condition, and re-read until they are consistent. The named signer controls chooses the format of the certificate it issues; consult the signer implementation's documentation to learn how to use the certificates it issues. properties: certificateChainPath: description: |- Write the certificate chain at this path in the projected volume. Most applications should use credentialBundlePath. When using keyPath and certificateChainPath, your application needs to check that the key and leaf certificate are consistent, because it is possible to read the files mid-rotation. type: string credentialBundlePath: description: |- Write the credential bundle at this path in the projected volume. The credential bundle is a single file that contains multiple PEM blocks. The first PEM block is a PRIVATE KEY block, containing a PKCS#8 private key. The remaining blocks are CERTIFICATE blocks, containing the issued certificate chain from the signer (leaf and any intermediates). Using credentialBundlePath lets your Pod's application code make a single atomic read that retrieves a consistent key and certificate chain. If you project them to separate files, your application code will need to additionally check that the leaf certificate was issued to the key. type: string keyPath: description: |- Write the key at this path in the projected volume. Most applications should use credentialBundlePath. When using keyPath and certificateChainPath, your application needs to check that the key and leaf certificate are consistent, because it is possible to read the files mid-rotation. type: string keyType: description: |- The type of keypair Kubelet will generate for the pod. Valid values are "RSA3072", "RSA4096", "ECDSAP256", "ECDSAP384", "ECDSAP521", and "ED25519". type: string maxExpirationSeconds: description: |- maxExpirationSeconds is the maximum lifetime permitted for the certificate. Kubelet copies this value verbatim into the PodCertificateRequests it generates for this projection. If omitted, kube-apiserver will set it to 86400(24 hours). kube-apiserver will reject values shorter than 3600 (1 hour). The maximum allowable value is 7862400 (91 days). The signer implementation is then free to issue a certificate with any lifetime *shorter* than MaxExpirationSeconds, but no shorter than 3600 seconds (1 hour). This constraint is enforced by kube-apiserver. `kubernetes.io` signers will never issue certificates with a lifetime longer than 24 hours. format: int32 type: integer signerName: description: Kubelet's generated CSRs will be addressed to this signer. type: string userAnnotations: additionalProperties: type: string description: |- userAnnotations allow pod authors to pass additional information to the signer implementation. Kubernetes does not restrict or validate this metadata in any way. These values are copied verbatim into the `spec.unverifiedUserAnnotations` field of the PodCertificateRequest objects that Kubelet creates. Entries are subject to the same validation as object metadata annotations, with the addition that all keys must be domain-prefixed. No restrictions are placed on values, except an overall size limitation on the entire field. Signers should document the keys and values they support. Signers should deny requests that contain keys they do not recognize. type: object required: - keyType - signerName type: object secret: description: secret information about the secret data to project properties: items: description: |- items if unspecified, each key-value pair in the Data field of the referenced Secret will be projected into the volume as a file whose name is the key and content is the value. If specified, the listed keys will be projected into the specified paths, and unlisted keys will not be present. If a key is specified which is not present in the Secret, the volume setup will error unless it is marked optional. Paths must be relative and may not contain the '..' path or start with '..'. items: description: Maps a string key to a path within a volume. properties: key: description: key is the key to project. type: string mode: description: |- mode is Optional: mode bits used to set permissions on this file. Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. If not specified, the volume defaultMode will be used. This might be in conflict with other options that affect the file mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer path: description: |- path is the relative path of the file to map the key to. May not be an absolute path. May not contain the path element '..'. May not start with the string '..'. type: string required: - key - path type: object type: array x-kubernetes-list-type: atomic name: default: "" description: |- Name of the referent. This field is effectively required, but due to backwards compatibility is allowed to be empty. Instances of this type with an empty value here are almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string optional: description: optional field specify whether the Secret or its key must be defined type: boolean type: object x-kubernetes-map-type: atomic serviceAccountToken: description: serviceAccountToken is information about the serviceAccountToken data to project properties: audience: description: |- audience is the intended audience of the token. A recipient of a token must identify itself with an identifier specified in the audience of the token, and otherwise should reject the token. The audience defaults to the identifier of the apiserver. type: string expirationSeconds: description: |- expirationSeconds is the requested duration of validity of the service account token. As the token approaches expiration, the kubelet volume plugin will proactively rotate the service account token. The kubelet will start trying to rotate the token if the token is older than 80 percent of its time to live or if the token is older than 24 hours.Defaults to 1 hour and must be at least 10 minutes. format: int64 type: integer path: description: |- path is the path relative to the mount point of the file to project the token into. type: string required: - path type: object type: object type: array x-kubernetes-list-type: atomic type: object quobyte: description: |- quobyte represents a Quobyte mount on the host that shares a pod's lifetime. Deprecated: Quobyte is deprecated and the in-tree quobyte type is no longer supported. properties: group: description: |- group to map volume access to Default is no group type: string readOnly: description: |- readOnly here will force the Quobyte volume to be mounted with read-only permissions. Defaults to false. type: boolean registry: description: |- registry represents a single or multiple Quobyte Registry services specified as a string as host:port pair (multiple entries are separated with commas) which acts as the central registry for volumes type: string tenant: description: |- tenant owning the given Quobyte volume in the Backend Used with dynamically provisioned Quobyte volumes, value is set by the plugin type: string user: description: |- user to map volume access to Defaults to serivceaccount user type: string volume: description: volume is a string that references an already created Quobyte volume by name. type: string required: - registry - volume type: object rbd: description: |- rbd represents a Rados Block Device mount on the host that shares a pod's lifetime. Deprecated: RBD is deprecated and the in-tree rbd type is no longer supported. properties: fsType: description: |- fsType is the filesystem type of the volume that you want to mount. Tip: Ensure that the filesystem type is supported by the host operating system. Examples: "ext4", "xfs", "ntfs". Implicitly inferred to be "ext4" if unspecified. More info: https://kubernetes.io/docs/concepts/storage/volumes#rbd type: string image: description: |- image is the rados image name. More info: https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it type: string keyring: default: /etc/ceph/keyring description: |- keyring is the path to key ring for RBDUser. Default is /etc/ceph/keyring. More info: https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it type: string monitors: description: |- monitors is a collection of Ceph monitors. More info: https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it items: type: string type: array x-kubernetes-list-type: atomic pool: default: rbd description: |- pool is the rados pool name. Default is rbd. More info: https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it type: string readOnly: description: |- readOnly here will force the ReadOnly setting in VolumeMounts. Defaults to false. More info: https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it type: boolean secretRef: description: |- secretRef is name of the authentication secret for RBDUser. If provided overrides keyring. Default is nil. More info: https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it properties: name: default: "" description: |- Name of the referent. This field is effectively required, but due to backwards compatibility is allowed to be empty. Instances of this type with an empty value here are almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string type: object x-kubernetes-map-type: atomic user: default: admin description: |- user is the rados user name. Default is admin. More info: https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it type: string required: - image - monitors type: object scaleIO: description: |- scaleIO represents a ScaleIO persistent volume attached and mounted on Kubernetes nodes. Deprecated: ScaleIO is deprecated and the in-tree scaleIO type is no longer supported. properties: fsType: default: xfs description: |- fsType is the filesystem type to mount. Must be a filesystem type supported by the host operating system. Ex. "ext4", "xfs", "ntfs". Default is "xfs". type: string gateway: description: gateway is the host address of the ScaleIO API Gateway. type: string protectionDomain: description: protectionDomain is the name of the ScaleIO Protection Domain for the configured storage. type: string readOnly: description: |- readOnly Defaults to false (read/write). ReadOnly here will force the ReadOnly setting in VolumeMounts. type: boolean secretRef: description: |- secretRef references to the secret for ScaleIO user and other sensitive information. If this is not provided, Login operation will fail. properties: name: default: "" description: |- Name of the referent. This field is effectively required, but due to backwards compatibility is allowed to be empty. Instances of this type with an empty value here are almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string type: object x-kubernetes-map-type: atomic sslEnabled: description: sslEnabled Flag enable/disable SSL communication with Gateway, default false type: boolean storageMode: default: ThinProvisioned description: |- storageMode indicates whether the storage for a volume should be ThickProvisioned or ThinProvisioned. Default is ThinProvisioned. type: string storagePool: description: storagePool is the ScaleIO Storage Pool associated with the protection domain. type: string system: description: system is the name of the storage system as configured in ScaleIO. type: string volumeName: description: |- volumeName is the name of a volume already created in the ScaleIO system that is associated with this volume source. type: string required: - gateway - secretRef - system type: object secret: description: |- secret represents a secret that should populate this volume. More info: https://kubernetes.io/docs/concepts/storage/volumes#secret properties: defaultMode: description: |- defaultMode is Optional: mode bits used to set permissions on created files by default. Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. Defaults to 0644. Directories within the path are not affected by this setting. This might be in conflict with other options that affect the file mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer items: description: |- items If unspecified, each key-value pair in the Data field of the referenced Secret will be projected into the volume as a file whose name is the key and content is the value. If specified, the listed keys will be projected into the specified paths, and unlisted keys will not be present. If a key is specified which is not present in the Secret, the volume setup will error unless it is marked optional. Paths must be relative and may not contain the '..' path or start with '..'. items: description: Maps a string key to a path within a volume. properties: key: description: key is the key to project. type: string mode: description: |- mode is Optional: mode bits used to set permissions on this file. Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. If not specified, the volume defaultMode will be used. This might be in conflict with other options that affect the file mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer path: description: |- path is the relative path of the file to map the key to. May not be an absolute path. May not contain the path element '..'. May not start with the string '..'. type: string required: - key - path type: object type: array x-kubernetes-list-type: atomic optional: description: optional field specify whether the Secret or its keys must be defined type: boolean secretName: description: |- secretName is the name of the secret in the pod's namespace to use. More info: https://kubernetes.io/docs/concepts/storage/volumes#secret type: string type: object storageos: description: |- storageOS represents a StorageOS volume attached and mounted on Kubernetes nodes. Deprecated: StorageOS is deprecated and the in-tree storageos type is no longer supported. properties: fsType: description: |- fsType is the filesystem type to mount. Must be a filesystem type supported by the host operating system. Ex. "ext4", "xfs", "ntfs". Implicitly inferred to be "ext4" if unspecified. type: string readOnly: description: |- readOnly defaults to false (read/write). ReadOnly here will force the ReadOnly setting in VolumeMounts. type: boolean secretRef: description: |- secretRef specifies the secret to use for obtaining the StorageOS API credentials. If not specified, default values will be attempted. properties: name: default: "" description: |- Name of the referent. This field is effectively required, but due to backwards compatibility is allowed to be empty. Instances of this type with an empty value here are almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string type: object x-kubernetes-map-type: atomic volumeName: description: |- volumeName is the human-readable name of the StorageOS volume. Volume names are only unique within a namespace. type: string volumeNamespace: description: |- volumeNamespace specifies the scope of the volume within StorageOS. If no namespace is specified then the Pod's namespace will be used. This allows the Kubernetes name scoping to be mirrored within StorageOS for tighter integration. Set VolumeName to any name to override the default behaviour. Set to "default" if you are not using namespaces within StorageOS. Namespaces that do not pre-exist within StorageOS will be created. type: string type: object vsphereVolume: description: |- vsphereVolume represents a vSphere volume attached and mounted on kubelets host machine. Deprecated: VsphereVolume is deprecated. All operations for the in-tree vsphereVolume type are redirected to the csi.vsphere.vmware.com CSI driver. properties: fsType: description: |- fsType is filesystem type to mount. Must be a filesystem type supported by the host operating system. Ex. "ext4", "xfs", "ntfs". Implicitly inferred to be "ext4" if unspecified. type: string storagePolicyID: description: storagePolicyID is the storage Policy Based Management (SPBM) profile ID associated with the StoragePolicyName. type: string storagePolicyName: description: storagePolicyName is the storage Policy Based Management (SPBM) profile name. type: string volumePath: description: volumePath is the path that identifies vSphere volume vmdk type: string required: - volumePath type: object required: - name type: object type: array githubAppReference: description: |- Reference to a Github App for authentication, this will automatically mount a secret with RENOVATE_TOKEN properties: appIdSecretKey: type: string installationIdSecretKey: type: string pemSecretKey: type: string secretName: type: string required: - appIdSecretKey - installationIdSecretKey - pemSecretKey - secretName type: object image: description: Renovate Docker image to use type: string imagePullSecrets: description: Image pull secrets for the renovate pods items: description: |- LocalObjectReference contains enough information to let you locate the referenced object inside the same namespace. properties: name: default: "" description: |- Name of the referent. This field is effectively required, but due to backwards compatibility is allowed to be empty. Instances of this type with an empty value here are almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string type: object x-kubernetes-map-type: atomic type: array metadata: description: Metadata that shall be applied to the resulting pod properties: annotations: additionalProperties: type: string type: object labels: additionalProperties: type: string type: object type: object nodeSelector: additionalProperties: type: string description: Node selector for scheduling the resulting pod type: object parallelism: description: Maximum number of projects to process in parallel format: int32 type: integer provider: description: Renovate Provider Information to fill "RENOVATE_ENDPOINT" and "RENOVATE_PLATFORM" environment variables in the renovate container properties: endpoint: type: string name: type: string required: - name type: object resources: description: Resource requirements for the renovate container properties: claims: description: |- Claims lists the names of resources, defined in spec.resourceClaims, that are used by this container. This field depends on the DynamicResourceAllocation feature gate. This field is immutable. It can only be set for containers. items: description: ResourceClaim references one entry in PodSpec.ResourceClaims. properties: name: description: |- Name must match the name of one entry in pod.spec.resourceClaims of the Pod where this field is used. It makes that resource available inside a container. type: string request: description: |- Request is the name chosen for a request in the referenced claim. If empty, everything from the claim is made available, otherwise only the result of this request. type: string required: - name type: object type: array x-kubernetes-list-map-keys: - name x-kubernetes-list-type: map limits: additionalProperties: anyOf: - type: integer - type: string pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ x-kubernetes-int-or-string: true description: |- Limits describes the maximum amount of compute resources allowed. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ type: object requests: additionalProperties: anyOf: - type: integer - type: string pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ x-kubernetes-int-or-string: true description: |- Requests describes the minimum amount of compute resources required. If Requests is omitted for a container, it defaults to Limits if that is explicitly specified, otherwise to an implementation-defined value. Requests cannot exceed Limits. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ type: object type: object runtimeClassName: description: RuntimeClassName for the resulting pod, used to select a non-default container runtime type: string schedule: description: Cron schedule in standard cron format type: string scratchVolume: description: Configuration for the scratch volume properties: enabled: default: true description: If enabled a scratch volume will be created and RENOVATE_BASE_DIR will be set accordingly type: boolean ephemeral: description: |- Ephemeral uses a Kubernetes generic ephemeral volume for scratch (volume.ephemeral). When set, Medium and SizeLimit are ignored. properties: volumeClaimTemplate: description: |- Will be used to create a stand-alone PVC to provision the volume. The pod in which this EphemeralVolumeSource is embedded will be the owner of the PVC, i.e. the PVC will be deleted together with the pod. The name of the PVC will be `<pod name>-<volume name>` where `<volume name>` is the name from the `PodSpec.Volumes` array entry. Pod validation will reject the pod if the concatenated name is not valid for a PVC (for example, too long). An existing PVC with that name that is not owned by the pod will *not* be used for the pod to avoid using an unrelated volume by mistake. Starting the pod is then blocked until the unrelated PVC is removed. If such a pre-created PVC is meant to be used by the pod, the PVC has to updated with an owner reference to the pod once the pod exists. Normally this should not be necessary, but it may be useful when manually reconstructing a broken cluster. This field is read-only and no changes will be made by Kubernetes to the PVC after it has been created. Required, must not be nil. properties: metadata: description: |- May contain labels and annotations that will be copied into the PVC when creating it. No other fields are allowed and will be rejected during validation. type: object spec: description: |- The specification for the PersistentVolumeClaim. The entire content is copied unchanged into the PVC that gets created from this template. The same fields as in a PersistentVolumeClaim are also valid here. properties: accessModes: description: |- accessModes contains the desired access modes the volume should have. More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#access-modes-1 items: type: string type: array x-kubernetes-list-type: atomic dataSource: description: |- dataSource field can be used to specify either: * An existing VolumeSnapshot object (snapshot.storage.k8s.io/VolumeSnapshot) * An existing PVC (PersistentVolumeClaim) If the provisioner or an external controller can support the specified data source, it will create a new volume based on the contents of the specified data source. When the AnyVolumeDataSource feature gate is enabled, dataSource contents will be copied to dataSourceRef, and dataSourceRef contents will be copied to dataSource when dataSourceRef.namespace is not specified. If the namespace is specified, then dataSourceRef will not be copied to dataSource. properties: apiGroup: description: |- APIGroup is the group for the resource being referenced. If APIGroup is not specified, the specified Kind must be in the core API group. For any other third-party types, APIGroup is required. type: string kind: description: Kind is the type of resource being referenced type: string name: description: Name is the name of resource being referenced type: string required: - kind - name type: object x-kubernetes-map-type: atomic dataSourceRef: description: |- dataSourceRef specifies the object from which to populate the volume with data, if a non-empty volume is desired. This may be any object from a non-empty API group (non core object) or a PersistentVolumeClaim object. When this field is specified, volume binding will only succeed if the type of the specified object matches some installed volume populator or dynamic provisioner. This field will replace the functionality of the dataSource field and as such if both fields are non-empty, they must have the same value. For backwards compatibility, when namespace isn't specified in dataSourceRef, both fields (dataSource and dataSourceRef) will be set to the same value automatically if one of them is empty and the other is non-empty. When namespace is specified in dataSourceRef, dataSource isn't set to the same value and must be empty. There are three important differences between dataSource and dataSourceRef: * While dataSource only allows two specific types of objects, dataSourceRef allows any non-core object, as well as PersistentVolumeClaim objects. * While dataSource ignores disallowed values (dropping them), dataSourceRef preserves all values, and generates an error if a disallowed value is specified. * While dataSource only allows local objects, dataSourceRef allows objects in any namespaces. (Beta) Using this field requires the AnyVolumeDataSource feature gate to be enabled. (Alpha) Using the namespace field of dataSourceRef requires the CrossNamespaceVolumeDataSource feature gate to be enabled. properties: apiGroup: description: |- APIGroup is the group for the resource being referenced. If APIGroup is not specified, the specified Kind must be in the core API group. For any other third-party types, APIGroup is required. type: string kind: description: Kind is the type of resource being referenced type: string name: description: Name is the name of resource being referenced type: string namespace: description: |- Namespace is the namespace of resource being referenced Note that when a namespace is specified, a gateway.networking.k8s.io/ReferenceGrant object is required in the referent namespace to allow that namespace's owner to accept the reference. See the ReferenceGrant documentation for details. (Alpha) This field requires the CrossNamespaceVolumeDataSource feature gate to be enabled. type: string required: - kind - name type: object resources: description: |- resources represents the minimum resources the volume should have. Users are allowed to specify resource requirements that are lower than previous value but must still be higher than capacity recorded in the status field of the claim. More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#resources properties: limits: additionalProperties: anyOf: - type: integer - type: string pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ x-kubernetes-int-or-string: true description: |- Limits describes the maximum amount of compute resources allowed. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ type: object requests: additionalProperties: anyOf: - type: integer - type: string pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ x-kubernetes-int-or-string: true description: |- Requests describes the minimum amount of compute resources required. If Requests is omitted for a container, it defaults to Limits if that is explicitly specified, otherwise to an implementation-defined value. Requests cannot exceed Limits. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ type: object type: object selector: description: selector is a label query over volumes to consider for binding. properties: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. items: description: |- A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. properties: key: description: key is the label key that the selector applies to. type: string operator: description: |- operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. type: string values: description: |- values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. items: type: string type: array x-kubernetes-list-type: atomic required: - key - operator type: object type: array x-kubernetes-list-type: atomic matchLabels: additionalProperties: type: string description: |- matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. type: object type: object x-kubernetes-map-type: atomic storageClassName: description: |- storageClassName is the name of the StorageClass required by the claim. More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#class-1 type: string volumeAttributesClassName: description: |- volumeAttributesClassName may be used to set the VolumeAttributesClass used by this claim. If specified, the CSI driver will create or update the volume with the attributes defined in the corresponding VolumeAttributesClass. This has a different purpose than storageClassName, it can be changed after the claim is created. An empty string or nil value indicates that no VolumeAttributesClass will be applied to the claim. If the claim enters an Infeasible error state, this field can be reset to its previous value (including nil) to cancel the modification. If the resource referred to by volumeAttributesClass does not exist, this PersistentVolumeClaim will be set to a Pending state, as reflected by the modifyVolumeStatus field, until such as a resource exists. More info: https://kubernetes.io/docs/concepts/storage/volume-attributes-classes/ type: string volumeMode: description: |- volumeMode defines what type of volume is required by the claim. Value of Filesystem is implied when not included in claim spec. type: string volumeName: description: volumeName is the binding reference to the PersistentVolume backing this claim. type: string type: object required: - spec type: object type: object medium: description: |- Medium for the emptyDir volume. Ignored when Ephemeral is set. Empty uses the node's default medium; Memory uses a tmpfs (corev1.StorageMediumMemory). type: string path: default: /tmp description: Path within the container where the scratch volume will be mounted, RENOVATE_BASE_DIR will be set to this path. type: string sizeLimit: anyOf: - type: integer - type: string description: SizeLimit caps how large the emptyDir may grow (Kubernetes emptyDir.sizeLimit). Ignored when Ephemeral is set. pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ x-kubernetes-int-or-string: true type: object secretRef: description: Reference to the secret containing the renovate config type: string securityContext: description: Security context for the resulting pod and container properties: container: description: |- SecurityContext holds security configuration that will be applied to a container. Some fields are present in both SecurityContext and PodSecurityContext. When both are set, the values in SecurityContext take precedence. properties: allowPrivilegeEscalation: description: |- AllowPrivilegeEscalation controls whether a process can gain more privileges than its parent process. This bool directly controls if the no_new_privs flag will be set on the container process. AllowPrivilegeEscalation is true always when the container is: 1) run as Privileged 2) has CAP_SYS_ADMIN Note that this field cannot be set when spec.os.name is windows. type: boolean appArmorProfile: description: |- appArmorProfile is the AppArmor options to use by this container. If set, this profile overrides the pod's appArmorProfile. Note that this field cannot be set when spec.os.name is windows. properties: localhostProfile: description: |- localhostProfile indicates a profile loaded on the node that should be used. The profile must be preconfigured on the node to work. Must match the loaded name of the profile. Must be set if and only if type is "Localhost". type: string type: description: |- type indicates which kind of AppArmor profile will be applied. Valid options are: Localhost - a profile pre-loaded on the node. RuntimeDefault - the container runtime's default profile. Unconfined - no AppArmor enforcement. type: string required: - type type: object capabilities: description: |- The capabilities to add/drop when running containers. Defaults to the default set of capabilities granted by the container runtime. Note that this field cannot be set when spec.os.name is windows. properties: add: description: Added capabilities items: description: Capability represent POSIX capabilities type type: string type: array x-kubernetes-list-type: atomic drop: description: Removed capabilities items: description: Capability represent POSIX capabilities type type: string type: array x-kubernetes-list-type: atomic type: object privileged: description: |- Run container in privileged mode. Processes in privileged containers are essentially equivalent to root on the host. Defaults to false. Note that this field cannot be set when spec.os.name is windows. type: boolean procMount: description: |- procMount denotes the type of proc mount to use for the containers. The default value is Default which uses the container runtime defaults for readonly paths and masked paths. Note that this field cannot be set when spec.os.name is windows. type: string readOnlyRootFilesystem: description: |- Whether this container has a read-only root filesystem. Default is false. Note that this field cannot be set when spec.os.name is windows. type: boolean runAsGroup: description: |- The GID to run the entrypoint of the container process. Uses runtime default if unset. May also be set in PodSecurityContext. If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence. Note that this field cannot be set when spec.os.name is windows. format: int64 type: integer runAsNonRoot: description: |- Indicates that the container must run as a non-root user. If true, the Kubelet will validate the image at runtime to ensure that it does not run as UID 0 (root) and fail to start the container if it does. If unset or false, no such validation will be performed. May also be set in PodSecurityContext. If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence. type: boolean runAsUser: description: |- The UID to run the entrypoint of the container process. Defaults to user specified in image metadata if unspecified. May also be set in PodSecurityContext. If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence. Note that this field cannot be set when spec.os.name is windows. format: int64 type: integer seLinuxOptions: description: |- The SELinux context to be applied to the container. If unspecified, the container runtime will allocate a random SELinux context for each container. May also be set in PodSecurityContext. If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence. Note that this field cannot be set when spec.os.name is windows. properties: level: description: Level is SELinux level label that applies to the container. type: string role: description: Role is a SELinux role label that applies to the container. type: string type: description: Type is a SELinux type label that applies to the container. type: string user: description: User is a SELinux user label that applies to the container. type: string type: object seccompProfile: description: |- The seccomp options to use by this container. If seccomp options are provided at both the pod & container level, the container options override the pod options. Note that this field cannot be set when spec.os.name is windows. properties: localhostProfile: description: |- localhostProfile indicates a profile defined in a file on the node should be used. The profile must be preconfigured on the node to work. Must be a descending path, relative to the kubelet's configured seccomp profile location. Must be set if type is "Localhost". Must NOT be set for any other type. type: string type: description: |- type indicates which kind of seccomp profile will be applied. Valid options are: Localhost - a profile defined in a file on the node should be used. RuntimeDefault - the container runtime default profile should be used. Unconfined - no profile should be applied. type: string required: - type type: object windowsOptions: description: |- The Windows specific settings applied to all containers. If unspecified, the options from the PodSecurityContext will be used. If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence. Note that this field cannot be set when spec.os.name is linux. properties: gmsaCredentialSpec: description: |- GMSACredentialSpec is where the GMSA admission webhook (https://github.com/kubernetes-sigs/windows-gmsa) inlines the contents of the GMSA credential spec named by the GMSACredentialSpecName field. type: string gmsaCredentialSpecName: description: GMSACredentialSpecName is the name of the GMSA credential spec to use. type: string hostProcess: description: |- HostProcess determines if a container should be run as a 'Host Process' container. All of a Pod's containers must have the same effective HostProcess value (it is not allowed to have a mix of HostProcess containers and non-HostProcess containers). In addition, if HostProcess is true then HostNetwork must also be set to true. type: boolean runAsUserName: description: |- The UserName in Windows to run the entrypoint of the container process. Defaults to the user specified in image metadata if unspecified. May also be set in PodSecurityContext. If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence. type: string type: object type: object pod: description: |- PodSecurityContext holds pod-level security attributes and common container settings. Some fields are also present in container.securityContext. Field values of container.securityContext take precedence over field values of PodSecurityContext. properties: appArmorProfile: description: |- appArmorProfile is the AppArmor options to use by the containers in this pod. Note that this field cannot be set when spec.os.name is windows. properties: localhostProfile: description: |- localhostProfile indicates a profile loaded on the node that should be used. The profile must be preconfigured on the node to work. Must match the loaded name of the profile. Must be set if and only if type is "Localhost". type: string type: description: |- type indicates which kind of AppArmor profile will be applied. Valid options are: Localhost - a profile pre-loaded on the node. RuntimeDefault - the container runtime's default profile. Unconfined - no AppArmor enforcement. type: string required: - type type: object fsGroup: description: |- A special supplemental group that applies to all containers in a pod. Some volume types allow the Kubelet to change the ownership of that volume to be owned by the pod: 1. The owning GID will be the FSGroup 2. The setgid bit is set (new files created in the volume will be owned by FSGroup) 3. The permission bits are OR'd with rw-rw---- If unset, the Kubelet will not modify the ownership and permissions of any volume. Note that this field cannot be set when spec.os.name is windows. format: int64 type: integer fsGroupChangePolicy: description: |- fsGroupChangePolicy defines behavior of changing ownership and permission of the volume before being exposed inside Pod. This field will only apply to volume types which support fsGroup based ownership(and permissions). It will have no effect on ephemeral volume types such as: secret, configmaps and emptydir. Valid values are "OnRootMismatch" and "Always". If not specified, "Always" is used. Note that this field cannot be set when spec.os.name is windows. type: string runAsGroup: description: |- The GID to run the entrypoint of the container process. Uses runtime default if unset. May also be set in SecurityContext. If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence for that container. Note that this field cannot be set when spec.os.name is windows. format: int64 type: integer runAsNonRoot: description: |- Indicates that the container must run as a non-root user. If true, the Kubelet will validate the image at runtime to ensure that it does not run as UID 0 (root) and fail to start the container if it does. If unset or false, no such validation will be performed. May also be set in SecurityContext. If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence. type: boolean runAsUser: description: |- The UID to run the entrypoint of the container process. Defaults to user specified in image metadata if unspecified. May also be set in SecurityContext. If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence for that container. Note that this field cannot be set when spec.os.name is windows. format: int64 type: integer seLinuxChangePolicy: description: |- seLinuxChangePolicy defines how the container's SELinux label is applied to all volumes used by the Pod. It has no effect on nodes that do not support SELinux or to volumes does not support SELinux. Valid values are "MountOption" and "Recursive". "Recursive" means relabeling of all files on all Pod volumes by the container runtime. This may be slow for large volumes, but allows mixing privileged and unprivileged Pods sharing the same volume on the same node. "MountOption" mounts all eligible Pod volumes with `-o context` mount option. This requires all Pods that share the same volume to use the same SELinux label. It is not possible to share the same volume among privileged and unprivileged Pods. Eligible volumes are in-tree FibreChannel and iSCSI volumes, and all CSI volumes whose CSI driver announces SELinux support by setting spec.seLinuxMount: true in their CSIDriver instance. Other volumes are always re-labelled recursively. "MountOption" value is allowed only when SELinuxMount feature gate is enabled. If not specified and SELinuxMount feature gate is enabled, "MountOption" is used. If not specified and SELinuxMount feature gate is disabled, "MountOption" is used for ReadWriteOncePod volumes and "Recursive" for all other volumes. This field affects only Pods that have SELinux label set, either in PodSecurityContext or in SecurityContext of all containers. All Pods that use the same volume should use the same seLinuxChangePolicy, otherwise some pods can get stuck in ContainerCreating state. Note that this field cannot be set when spec.os.name is windows. type: string seLinuxOptions: description: |- The SELinux context to be applied to all containers. If unspecified, the container runtime will allocate a random SELinux context for each container. May also be set in SecurityContext. If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence for that container. Note that this field cannot be set when spec.os.name is windows. properties: level: description: Level is SELinux level label that applies to the container. type: string role: description: Role is a SELinux role label that applies to the container. type: string type: description: Type is a SELinux type label that applies to the container. type: string user: description: User is a SELinux user label that applies to the container. type: string type: object seccompProfile: description: |- The seccomp options to use by the containers in this pod. Note that this field cannot be set when spec.os.name is windows. properties: localhostProfile: description: |- localhostProfile indicates a profile defined in a file on the node should be used. The profile must be preconfigured on the node to work. Must be a descending path, relative to the kubelet's configured seccomp profile location. Must be set if type is "Localhost". Must NOT be set for any other type. type: string type: description: |- type indicates which kind of seccomp profile will be applied. Valid options are: Localhost - a profile defined in a file on the node should be used. RuntimeDefault - the container runtime default profile should be used. Unconfined - no profile should be applied. type: string required: - type type: object supplementalGroups: description: |- A list of groups applied to the first process run in each container, in addition to the container's primary GID and fsGroup (if specified). If the SupplementalGroupsPolicy feature is enabled, the supplementalGroupsPolicy field determines whether these are in addition to or instead of any group memberships defined in the container image. If unspecified, no additional groups are added, though group memberships defined in the container image may still be used, depending on the supplementalGroupsPolicy field. Note that this field cannot be set when spec.os.name is windows. items: format: int64 type: integer type: array x-kubernetes-list-type: atomic supplementalGroupsPolicy: description: |- Defines how supplemental groups of the first container processes are calculated. Valid values are "Merge" and "Strict". If not specified, "Merge" is used. (Alpha) Using the field requires the SupplementalGroupsPolicy feature gate to be enabled and the container runtime must implement support for this feature. Note that this field cannot be set when spec.os.name is windows. type: string sysctls: description: |- Sysctls hold a list of namespaced sysctls used for the pod. Pods with unsupported sysctls (by the container runtime) might fail to launch. Note that this field cannot be set when spec.os.name is windows. items: description: Sysctl defines a kernel parameter to be set properties: name: description: Name of a property to set type: string value: description: Value of a property to set type: string required: - name - value type: object type: array x-kubernetes-list-type: atomic windowsOptions: description: |- The Windows specific settings applied to all containers. If unspecified, the options within a container's SecurityContext will be used. If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence. Note that this field cannot be set when spec.os.name is linux. properties: gmsaCredentialSpec: description: |- GMSACredentialSpec is where the GMSA admission webhook (https://github.com/kubernetes-sigs/windows-gmsa) inlines the contents of the GMSA credential spec named by the GMSACredentialSpecName field. type: string gmsaCredentialSpecName: description: GMSACredentialSpecName is the name of the GMSA credential spec to use. type: string hostProcess: description: |- HostProcess determines if a container should be run as a 'Host Process' container. All of a Pod's containers must have the same effective HostProcess value (it is not allowed to have a mix of HostProcess containers and non-HostProcess containers). In addition, if HostProcess is true then HostNetwork must also be set to true. type: boolean runAsUserName: description: |- The UserName in Windows to run the entrypoint of the container process. Defaults to the user specified in image metadata if unspecified. May also be set in PodSecurityContext. If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence. type: string type: object type: object type: object serviceAccount: description: Settings for the serviceaccount the renovate pod should use properties: automountServiceAccountToken: type: boolean name: type: string type: object skipForks: description: If true, forked repositories discovered during autodiscovery will be excluded by querying the platform API type: boolean skipPendingDeletion: description: If true, repositories marked for delayed deletion (pending deletion) will be excluded by querying the platform API. Only GitLab exposes this state. type: boolean tolerations: description: Tolerations for scheduling the resulting pod items: description: |- The pod this Toleration is attached to tolerates any taint that matches the triple <key,value,effect> using the matching operator <operator>. properties: effect: description: |- Effect indicates the taint effect to match. Empty means match all taint effects. When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute. type: string key: description: |- Key is the taint key that the toleration applies to. Empty means match all taint keys. If the key is empty, operator must be Exists; this combination means to match all values and all keys. type: string operator: description: |- Operator represents a key's relationship to the value. Valid operators are Exists, Equal, Lt, and Gt. Defaults to Equal. Exists is equivalent to wildcard for value, so that a pod can tolerate all taints of a particular category. Lt and Gt perform numeric comparisons (requires feature gate TaintTolerationComparisonOperators). type: string tolerationSeconds: description: |- TolerationSeconds represents the period of time the toleration (which must be of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default, it is not set, which means tolerate the taint forever (do not evict). Zero and negative values will be treated as 0 (evict immediately) by the system. format: int64 type: integer value: description: |- Value is the taint value the toleration matches to. If the operator is Exists, the value should be empty, otherwise just a regular string. type: string type: object type: array topologySpreadConstraints: description: Topology spread constraints for scheduling the resulting pod items: description: TopologySpreadConstraint specifies how to spread matching pods among the given topology. properties: labelSelector: description: |- LabelSelector is used to find matching pods. Pods that match this label selector are counted to determine the number of pods in their corresponding topology domain. properties: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. items: description: |- A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. properties: key: description: key is the label key that the selector applies to. type: string operator: description: |- operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. type: string values: description: |- values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. items: type: string type: array x-kubernetes-list-type: atomic required: - key - operator type: object type: array x-kubernetes-list-type: atomic matchLabels: additionalProperties: type: string description: |- matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. type: object type: object x-kubernetes-map-type: atomic matchLabelKeys: description: |- MatchLabelKeys is a set of pod label keys to select the pods over which spreading will be calculated. The keys are used to lookup values from the incoming pod labels, those key-value labels are ANDed with labelSelector to select the group of existing pods over which spreading will be calculated for the incoming pod. The same key is forbidden to exist in both MatchLabelKeys and LabelSelector. MatchLabelKeys cannot be set when LabelSelector isn't set. Keys that don't exist in the incoming pod labels will be ignored. A null or empty list means only match against labelSelector. This is a beta field and requires the MatchLabelKeysInPodTopologySpread feature gate to be enabled (enabled by default). items: type: string type: array x-kubernetes-list-type: atomic maxSkew: description: |- MaxSkew describes the degree to which pods may be unevenly distributed. When `whenUnsatisfiable=DoNotSchedule`, it is the maximum permitted difference between the number of matching pods in the target topology and the global minimum. The global minimum is the minimum number of matching pods in an eligible domain or zero if the number of eligible domains is less than MinDomains. For example, in a 3-zone cluster, MaxSkew is set to 1, and pods with the same labelSelector spread as 2/2/1: In this case, the global minimum is 1. | zone1 | zone2 | zone3 | | P P | P P | P | - if MaxSkew is 1, incoming pod can only be scheduled to zone3 to become 2/2/2; scheduling it onto zone1(zone2) would make the ActualSkew(3-1) on zone1(zone2) violate MaxSkew(1). - if MaxSkew is 2, incoming pod can be scheduled onto any zone. When `whenUnsatisfiable=ScheduleAnyway`, it is used to give higher precedence to topologies that satisfy it. It's a required field. Default value is 1 and 0 is not allowed. format: int32 type: integer minDomains: description: |- MinDomains indicates a minimum number of eligible domains. When the number of eligible domains with matching topology keys is less than minDomains, Pod Topology Spread treats "global minimum" as 0, and then the calculation of Skew is performed. And when the number of eligible domains with matching topology keys equals or greater than minDomains, this value has no effect on scheduling. As a result, when the number of eligible domains is less than minDomains, scheduler won't schedule more than maxSkew Pods to those domains. If value is nil, the constraint behaves as if MinDomains is equal to 1. Valid values are integers greater than 0. When value is not nil, WhenUnsatisfiable must be DoNotSchedule. For example, in a 3-zone cluster, MaxSkew is set to 2, MinDomains is set to 5 and pods with the same labelSelector spread as 2/2/2: | zone1 | zone2 | zone3 | | P P | P P | P P | The number of domains is less than 5(MinDomains), so "global minimum" is treated as 0. In this situation, new pod with the same labelSelector cannot be scheduled, because computed skew will be 3(3 - 0) if new Pod is scheduled to any of the three zones, it will violate MaxSkew. format: int32 type: integer nodeAffinityPolicy: description: |- NodeAffinityPolicy indicates how we will treat Pod's nodeAffinity/nodeSelector when calculating pod topology spread skew. Options are: - Honor: only nodes matching nodeAffinity/nodeSelector are included in the calculations. - Ignore: nodeAffinity/nodeSelector are ignored. All nodes are included in the calculations. If this value is nil, the behavior is equivalent to the Honor policy. type: string nodeTaintsPolicy: description: |- NodeTaintsPolicy indicates how we will treat node taints when calculating pod topology spread skew. Options are: - Honor: nodes without taints, along with tainted nodes for which the incoming pod has a toleration, are included. - Ignore: node taints are ignored. All nodes are included. If this value is nil, the behavior is equivalent to the Ignore policy. type: string topologyKey: description: |- TopologyKey is the key of node labels. Nodes that have a label with this key and identical values are considered to be in the same topology. We consider each <key, value> as a "bucket", and try to put balanced number of pods into each bucket. We define a domain as a particular instance of a topology. Also, we define an eligible domain as a domain whose nodes meet the requirements of nodeAffinityPolicy and nodeTaintsPolicy. e.g. If TopologyKey is "kubernetes.io/hostname", each Node is a domain of that topology. And, if TopologyKey is "topology.kubernetes.io/zone", each zone is a domain of that topology. It's a required field. type: string whenUnsatisfiable: description: |- WhenUnsatisfiable indicates how to deal with a pod if it doesn't satisfy the spread constraint. - DoNotSchedule (default) tells the scheduler not to schedule it. - ScheduleAnyway tells the scheduler to schedule the pod in any location, but giving higher precedence to topologies that would help reduce the skew. A constraint is considered "Unsatisfiable" for an incoming pod if and only if every possible node assignment for that pod would violate "MaxSkew" on some topology. For example, in a 3-zone cluster, MaxSkew is set to 1, and pods with the same labelSelector spread as 3/1/1: | zone1 | zone2 | zone3 | | P P P | P | P | If WhenUnsatisfiable is set to DoNotSchedule, incoming pod can only be scheduled to zone2(zone3) to become 3/2/1(3/1/2) as ActualSkew(2-1) on zone2(zone3) satisfies MaxSkew(1). In other words, the cluster can still be imbalanced, but scheduler won't make it *more* imbalanced. It's a required field. type: string required: - maxSkew - topologyKey - whenUnsatisfiable type: object type: array webhook: description: Configuration for webhooks to trigger renovate runs properties: authentication: description: authentication configuration for webhooks properties: enabled: type: boolean secretRef: description: reference to a secret and key properties: key: type: string name: type: string type: object required: - enabled type: object enabled: type: boolean sync: description: |- configuration for syncing webhooks onto the repositories discovered for this job. properties: enabled: description: Flag to enable the automatic repo webhook sync type: boolean secretRef: description: |- Optional reference to a secret key holding the platform token used for webhook management. When not set, the job's platform token (spec.secretRef or spec.githubAppReference) is used. If key is empty, the common Renovate token key names are tried. properties: key: type: string name: type: string type: object required: - enabled type: object required: - enabled type: object required: - image - parallelism - provider - schedule type: object status: description: RenovateJobStatus defines the observed state of RenovateJob properties: executionOptions: properties: debug: description: If true, the renovate job will be executed with RENOVATE_LOG_LEVEL=debug type: boolean type: object projects: items: description: Status of a single project within a RenovateJob properties: duration: type: string lastRun: format: date-time type: string logIssues: description: LogIssues contains aggregate counts and individual issue messages from a Renovate run. properties: errorCount: type: integer issues: items: description: LogIssue represents a single warning or error from Renovate logs. properties: level: type: integer message: type: string required: - level - message type: object type: array truncated: type: boolean warnCount: type: integer required: - errorCount - warnCount type: object name: type: string prActivity: description: PRActivity contains aggregate counts and individual details of PR activity from a run. properties: automerged: type: integer created: type: integer needsApproval: type: integer prs: items: description: PRDetail represents a single PR found in Renovate logs. properties: action: description: PRAction represents what happened to a PR in a Renovate run. type: string branch: type: string number: type: integer title: type: string required: - action - branch type: object type: array truncated: type: boolean unchanged: type: integer updated: type: integer required: - automerged - created - needsApproval - unchanged - updated type: object priority: format: int32 type: integer renovateResultStatus: type: string status: type: string required: - lastRun - name - status type: object type: array type: object type: object served: true storage: true subresources: status: {} (root level) + one document added: apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: name: renovate-operator-renovate-operator-crd-hook annotations: helm.sh/hook: "pre-install,pre-upgrade" helm.sh/hook-delete-policy: "before-hook-creation,hook-succeeded" helm.sh/hook-weight: "-5" rules: - resources: - customresourcedefinitions apiGroups: - apiextensions.k8s.io verbs: - get - create - update - patch (root level) + one document added: apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding metadata: name: renovate-operator-renovate-operator-crd-hook annotations: helm.sh/hook: "pre-install,pre-upgrade" helm.sh/hook-delete-policy: "before-hook-creation,hook-succeeded" helm.sh/hook-weight: "-5" roleRef: name: renovate-operator-renovate-operator-crd-hook apiGroup: rbac.authorization.k8s.io kind: ClusterRole subjects: - name: renovate-operator-renovate-operator-crd-hook kind: ServiceAccount namespace: apps-renovate (root level) + one document added: apiVersion: batch/v1 kind: Job metadata: name: renovate-operator-renovate-operator-crd-install namespace: apps-renovate annotations: helm.sh/hook: "pre-install,pre-upgrade" helm.sh/hook-delete-policy: "before-hook-creation,hook-succeeded" helm.sh/hook-weight: "0" spec: backoffLimit: 3 template: spec: containers: - name: kubectl image: "registry.k8s.io/kubectl:v1.36.2" imagePullPolicy: IfNotPresent command: - kubectl - apply - "--server-side" - "--force-conflicts" - "-f" - /crd/renovatejob.yaml volumeMounts: - name: crd mountPath: /crd securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL privileged: false readOnlyRootFilesystem: true runAsGroup: 1000 runAsNonRoot: true runAsUser: 1000 seccompProfile: type: RuntimeDefault restartPolicy: OnFailure securityContext: fsGroup: 1000 runAsGroup: 1000 runAsNonRoot: true runAsUser: 1000 seccompProfile: type: RuntimeDefault serviceAccountName: renovate-operator-renovate-operator-crd-hook volumes: - name: crd configMap: name: renovate-operator-renovate-operator-crd (root level) + one document added: apiVersion: networking.k8s.io/v1 kind: NetworkPolicy metadata: name: renovate-operator-valkey namespace: apps-renovate labels: app.kubernetes.io/instance: renovate-operator-valkey app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: valkey app.kubernetes.io/part-of: valkey helm.toolkit.fluxcd.io/name: renovate-operator-valkey helm.toolkit.fluxcd.io/namespace: flux-system spec: egress: - ingress: - ports: - port: 6379 podSelector: matchLabels: app.kubernetes.io/instance: renovate-operator-valkey app.kubernetes.io/name: valkey policyTypes: - Ingress - Egress (root level) + one document added: apiVersion: policy/v1 kind: PodDisruptionBudget metadata: name: renovate-operator-valkey-primary namespace: apps-renovate labels: app.kubernetes.io/component: primary app.kubernetes.io/instance: renovate-operator-valkey app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: valkey helm.toolkit.fluxcd.io/name: renovate-operator-valkey helm.toolkit.fluxcd.io/namespace: flux-system spec: maxUnavailable: 1 selector: matchLabels: app.kubernetes.io/component: primary app.kubernetes.io/instance: renovate-operator-valkey app.kubernetes.io/name: valkey (root level) + one document added: apiVersion: v1 kind: ServiceAccount metadata: name: renovate-operator-valkey-primary namespace: apps-renovate labels: app.kubernetes.io/instance: renovate-operator-valkey app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: valkey app.kubernetes.io/part-of: valkey helm.toolkit.fluxcd.io/name: renovate-operator-valkey helm.toolkit.fluxcd.io/namespace: flux-system automountServiceAccountToken: false (root level) + one document added: apiVersion: v1 kind: ConfigMap metadata: name: renovate-operator-valkey-configuration namespace: apps-renovate labels: app.kubernetes.io/instance: renovate-operator-valkey app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: valkey app.kubernetes.io/part-of: valkey helm.toolkit.fluxcd.io/name: renovate-operator-valkey helm.toolkit.fluxcd.io/namespace: flux-system data: primary.conf: | dir /data # User-supplied primary configuration: rename-command FLUSHDB "" rename-command FLUSHALL "" # End of primary configuration replica.conf: | dir /data # User-supplied replica configuration: rename-command FLUSHDB "" rename-command FLUSHALL "" # End of replica configuration valkey.conf: | # User-supplied common configuration: # Enable AOF https://valkey.io/docs/topics/persistence.html appendonly yes # Disable RDB persistence, AOF persistence already enabled. save "" # End of common configuration (root level) + one document added: apiVersion: v1 kind: ConfigMap metadata: name: renovate-operator-valkey-health namespace: apps-renovate labels: app.kubernetes.io/instance: renovate-operator-valkey app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: valkey helm.toolkit.fluxcd.io/name: renovate-operator-valkey helm.toolkit.fluxcd.io/namespace: flux-system data: ping_liveness_local.sh: | #!/bin/bash [[ -f $VALKEY_PASSWORD_FILE ]] && export VALKEY_PASSWORD="$(< "${VALKEY_PASSWORD_FILE}")" [[ -n "$VALKEY_PASSWORD" ]] && export REDISCLI_AUTH="$VALKEY_PASSWORD" response=$( timeout -s 15 $1 \ valkey-cli \ -h localhost \ -p $VALKEY_PORT \ ping ) if [ "$?" -eq "124" ]; then echo "Timed out" exit 1 fi responseFirstWord=$(echo $response | head -n1 | awk '{print $1;}') if [ "$response" != "PONG" ] && [ "$responseFirstWord" != "LOADING" ] && [ "$responseFirstWord" != "MASTERDOWN" ]; then echo "$response" exit 1 fi ping_liveness_local_and_primary.sh: | script_dir="$(dirname "$0")" exit_status=0 "$script_dir/ping_liveness_local.sh" $1 || exit_status=$? "$script_dir/ping_liveness_primary.sh" $1 || exit_status=$? exit $exit_status ping_liveness_primary.sh: | #!/bin/bash [[ -f $VALKEY_PRIMARY_PASSWORD_FILE ]] && export VALKEY_PRIMARY_PASSWORD="$(< "${VALKEY_PRIMARY_PASSWORD_FILE}")" [[ -n "$VALKEY_PRIMARY_PASSWORD" ]] && export REDISCLI_AUTH="$VALKEY_PRIMARY_PASSWORD" response=$( timeout -s 15 $1 \ valkey-cli \ -h $VALKEY_PRIMARY_HOST \ -p $VALKEY_PRIMARY_PORT_NUMBER \ ping ) if [ "$?" -eq "124" ]; then echo "Timed out" exit 1 fi responseFirstWord=$(echo $response | head -n1 | awk '{print $1;}') if [ "$response" != "PONG" ] && [ "$responseFirstWord" != "LOADING" ]; then echo "$response" exit 1 fi ping_readiness_local.sh: | #!/bin/bash [[ -f $VALKEY_PASSWORD_FILE ]] && export VALKEY_PASSWORD="$(< "${VALKEY_PASSWORD_FILE}")" [[ -n "$VALKEY_PASSWORD" ]] && export REDISCLI_AUTH="$VALKEY_PASSWORD" response=$( timeout -s 15 $1 \ valkey-cli \ -h localhost \ -p $VALKEY_PORT \ ping ) if [ "$?" -eq "124" ]; then echo "Timed out" exit 1 fi if [ "$response" != "PONG" ]; then echo "$response" exit 1 fi ping_readiness_local_and_primary.sh: | script_dir="$(dirname "$0")" exit_status=0 "$script_dir/ping_readiness_local.sh" $1 || exit_status=$? "$script_dir/ping_readiness_primary.sh" $1 || exit_status=$? exit $exit_status ping_readiness_primary.sh: | #!/bin/bash [[ -f $VALKEY_PRIMARY_PASSWORD_FILE ]] && export VALKEY_PRIMARY_PASSWORD="$(< "${VALKEY_PRIMARY_PASSWORD_FILE}")" [[ -n "$VALKEY_PRIMARY_PASSWORD" ]] && export REDISCLI_AUTH="$VALKEY_PRIMARY_PASSWORD" response=$( timeout -s 15 $1 \ valkey-cli \ -h $VALKEY_PRIMARY_HOST \ -p $VALKEY_PRIMARY_PORT_NUMBER \ ping ) if [ "$?" -eq "124" ]; then echo "Timed out" exit 1 fi if [ "$response" != "PONG" ]; then echo "$response" exit 1 fi (root level) + one document added: apiVersion: v1 kind: ConfigMap metadata: name: renovate-operator-valkey-scripts namespace: apps-renovate labels: app.kubernetes.io/instance: renovate-operator-valkey app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: valkey app.kubernetes.io/part-of: valkey helm.toolkit.fluxcd.io/name: renovate-operator-valkey helm.toolkit.fluxcd.io/namespace: flux-system data: start-primary.sh: | #!/bin/bash [[ -f $VALKEY_PASSWORD_FILE ]] && export VALKEY_PASSWORD="$(< "${VALKEY_PASSWORD_FILE}")" if [[ -f /opt/bitnami/valkey/mounted-etc/primary.conf ]];then cp /opt/bitnami/valkey/mounted-etc/primary.conf /opt/bitnami/valkey/etc/primary.conf fi if [[ -f /opt/bitnami/valkey/mounted-etc/valkey.conf ]];then cp /opt/bitnami/valkey/mounted-etc/valkey.conf /opt/bitnami/valkey/etc/valkey.conf fi ARGS=("--port" "${VALKEY_PORT}") ARGS+=("--protected-mode" "no") ARGS+=("--include" "/opt/bitnami/valkey/etc/valkey.conf") ARGS+=("--include" "/opt/bitnami/valkey/etc/primary.conf") exec valkey-server "${ARGS[@]}" (root level) + one document added: apiVersion: v1 kind: Service metadata: name: renovate-operator-valkey-headless namespace: apps-renovate labels: app.kubernetes.io/instance: renovate-operator-valkey app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: valkey app.kubernetes.io/part-of: valkey helm.toolkit.fluxcd.io/name: renovate-operator-valkey helm.toolkit.fluxcd.io/namespace: flux-system spec: type: ClusterIP clusterIP: None selector: app.kubernetes.io/instance: renovate-operator-valkey app.kubernetes.io/name: valkey ports: - name: tcp-redis port: 6379 targetPort: redis (root level) + one document added: apiVersion: v1 kind: Service metadata: name: renovate-operator-valkey-primary namespace: apps-renovate labels: app.kubernetes.io/component: primary app.kubernetes.io/instance: renovate-operator-valkey app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: valkey app.kubernetes.io/part-of: valkey helm.toolkit.fluxcd.io/name: renovate-operator-valkey helm.toolkit.fluxcd.io/namespace: flux-system spec: type: ClusterIP internalTrafficPolicy: Cluster selector: app.kubernetes.io/component: primary app.kubernetes.io/instance: renovate-operator-valkey app.kubernetes.io/name: valkey ports: - name: tcp-redis nodePort: null port: 6379 targetPort: redis (root level) + one document added: apiVersion: apps/v1 kind: StatefulSet metadata: name: renovate-operator-valkey-primary namespace: apps-renovate labels: app.kubernetes.io/component: primary app.kubernetes.io/instance: renovate-operator-valkey app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: valkey app.kubernetes.io/part-of: valkey helm.toolkit.fluxcd.io/name: renovate-operator-valkey helm.toolkit.fluxcd.io/namespace: flux-system spec: replicas: 1 selector: matchLabels: app.kubernetes.io/component: primary app.kubernetes.io/instance: renovate-operator-valkey app.kubernetes.io/name: valkey serviceName: renovate-operator-valkey-headless template: metadata: labels: app.kubernetes.io/component: primary app.kubernetes.io/instance: renovate-operator-valkey app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: valkey spec: affinity: nodeAffinity: null podAffinity: null podAntiAffinity: preferredDuringSchedulingIgnoredDuringExecution: - podAffinityTerm: labelSelector: matchLabels: app.kubernetes.io/component: primary app.kubernetes.io/instance: renovate-operator-valkey app.kubernetes.io/name: valkey topologyKey: kubernetes.io/hostname weight: 1 automountServiceAccountToken: false containers: - name: valkey image: "registry-1.docker.io/bitnami/valkey:latest" imagePullPolicy: IfNotPresent args: - "-c" - /opt/bitnami/scripts/start-scripts/start-primary.sh command: - /bin/bash env: - name: BITNAMI_DEBUG value: "false" - name: VALKEY_REPLICATION_MODE value: primary - name: ALLOW_EMPTY_PASSWORD value: yes - name: OPENSSL_FIPS value: yes - name: VALKEY_TLS_ENABLED value: no - name: VALKEY_PORT value: "6379" ports: - name: redis containerPort: 6379 resources: limits: cpu: 150m ephemeral-storage: 2Gi memory: 192Mi requests: cpu: 100m ephemeral-storage: 50Mi memory: 128Mi volumeMounts: - name: start-scripts mountPath: /opt/bitnami/scripts/start-scripts - name: health mountPath: /health - name: valkey-data mountPath: /data - name: config mountPath: /opt/bitnami/valkey/mounted-etc - name: empty-dir mountPath: /opt/bitnami/valkey/etc/ subPath: app-conf-dir - name: empty-dir mountPath: /tmp subPath: tmp-dir livenessProbe: exec: command: - sh - "-c" - "/health/ping_liveness_local.sh 5" failureThreshold: 5 initialDelaySeconds: 20 periodSeconds: 5 successThreshold: 1 timeoutSeconds: 6 readinessProbe: exec: command: - sh - "-c" - "/health/ping_readiness_local.sh 1" failureThreshold: 5 initialDelaySeconds: 20 periodSeconds: 5 successThreshold: 1 timeoutSeconds: 2 securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL readOnlyRootFilesystem: true runAsGroup: 1001 runAsNonRoot: true runAsUser: 1001 seLinuxOptions: {} seccompProfile: type: RuntimeDefault enableServiceLinks: true securityContext: fsGroup: 1001 fsGroupChangePolicy: Always supplementalGroups: [] sysctls: [] serviceAccountName: renovate-operator-valkey-primary terminationGracePeriodSeconds: 30 volumes: - name: start-scripts configMap: name: renovate-operator-valkey-scripts defaultMode: 493 - name: health configMap: name: renovate-operator-valkey-health defaultMode: 493 - name: config configMap: name: renovate-operator-valkey-configuration - name: empty-dir emptyDir: {} updateStrategy: type: RollingUpdate volumeClaimTemplates: - apiVersion: v1 kind: PersistentVolumeClaim metadata: name: valkey-data labels: app.kubernetes.io/component: primary app.kubernetes.io/instance: renovate-operator-valkey app.kubernetes.io/name: valkey spec: resources: requests: storage: 8Gi storageClassName: longhorn accessModes: - ReadWriteOnce (root level) + one document added: apiVersion: networking.k8s.io/v1 kind: NetworkPolicy metadata: name: romm-valkey namespace: apps-romm labels: app.kubernetes.io/instance: romm-valkey app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: valkey app.kubernetes.io/part-of: valkey helm.toolkit.fluxcd.io/name: romm-valkey helm.toolkit.fluxcd.io/namespace: flux-system spec: egress: - ingress: - ports: - port: 6379 podSelector: matchLabels: app.kubernetes.io/instance: romm-valkey app.kubernetes.io/name: valkey policyTypes: - Ingress - Egress (root level) + one document added: apiVersion: policy/v1 kind: PodDisruptionBudget metadata: name: romm-valkey-primary namespace: apps-romm labels: app.kubernetes.io/component: primary app.kubernetes.io/instance: romm-valkey app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: valkey helm.toolkit.fluxcd.io/name: romm-valkey helm.toolkit.fluxcd.io/namespace: flux-system spec: maxUnavailable: 1 selector: matchLabels: app.kubernetes.io/component: primary app.kubernetes.io/instance: romm-valkey app.kubernetes.io/name: valkey (root level) + one document added: apiVersion: v1 kind: ServiceAccount metadata: name: romm-valkey-primary namespace: apps-romm labels: app.kubernetes.io/instance: romm-valkey app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: valkey app.kubernetes.io/part-of: valkey helm.toolkit.fluxcd.io/name: romm-valkey helm.toolkit.fluxcd.io/namespace: flux-system automountServiceAccountToken: false (root level) + one document added: apiVersion: v1 kind: ConfigMap metadata: name: romm-valkey-configuration namespace: apps-romm labels: app.kubernetes.io/instance: romm-valkey app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: valkey app.kubernetes.io/part-of: valkey helm.toolkit.fluxcd.io/name: romm-valkey helm.toolkit.fluxcd.io/namespace: flux-system data: primary.conf: | dir /data # User-supplied primary configuration: rename-command FLUSHDB "" rename-command FLUSHALL "" # End of primary configuration replica.conf: | dir /data # User-supplied replica configuration: rename-command FLUSHDB "" rename-command FLUSHALL "" # End of replica configuration valkey.conf: | # User-supplied common configuration: # Enable AOF https://valkey.io/docs/topics/persistence.html appendonly yes # Disable RDB persistence, AOF persistence already enabled. save "" # End of common configuration (root level) + one document added: apiVersion: v1 kind: ConfigMap metadata: name: romm-valkey-health namespace: apps-romm labels: app.kubernetes.io/instance: romm-valkey app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: valkey helm.toolkit.fluxcd.io/name: romm-valkey helm.toolkit.fluxcd.io/namespace: flux-system data: ping_liveness_local.sh: | #!/bin/bash [[ -f $VALKEY_PASSWORD_FILE ]] && export VALKEY_PASSWORD="$(< "${VALKEY_PASSWORD_FILE}")" [[ -n "$VALKEY_PASSWORD" ]] && export REDISCLI_AUTH="$VALKEY_PASSWORD" response=$( timeout -s 15 $1 \ valkey-cli \ -h localhost \ -p $VALKEY_PORT \ ping ) if [ "$?" -eq "124" ]; then echo "Timed out" exit 1 fi responseFirstWord=$(echo $response | head -n1 | awk '{print $1;}') if [ "$response" != "PONG" ] && [ "$responseFirstWord" != "LOADING" ] && [ "$responseFirstWord" != "MASTERDOWN" ]; then echo "$response" exit 1 fi ping_liveness_local_and_primary.sh: | script_dir="$(dirname "$0")" exit_status=0 "$script_dir/ping_liveness_local.sh" $1 || exit_status=$? "$script_dir/ping_liveness_primary.sh" $1 || exit_status=$? exit $exit_status ping_liveness_primary.sh: | #!/bin/bash [[ -f $VALKEY_PRIMARY_PASSWORD_FILE ]] && export VALKEY_PRIMARY_PASSWORD="$(< "${VALKEY_PRIMARY_PASSWORD_FILE}")" [[ -n "$VALKEY_PRIMARY_PASSWORD" ]] && export REDISCLI_AUTH="$VALKEY_PRIMARY_PASSWORD" response=$( timeout -s 15 $1 \ valkey-cli \ -h $VALKEY_PRIMARY_HOST \ -p $VALKEY_PRIMARY_PORT_NUMBER \ ping ) if [ "$?" -eq "124" ]; then echo "Timed out" exit 1 fi responseFirstWord=$(echo $response | head -n1 | awk '{print $1;}') if [ "$response" != "PONG" ] && [ "$responseFirstWord" != "LOADING" ]; then echo "$response" exit 1 fi ping_readiness_local.sh: | #!/bin/bash [[ -f $VALKEY_PASSWORD_FILE ]] && export VALKEY_PASSWORD="$(< "${VALKEY_PASSWORD_FILE}")" [[ -n "$VALKEY_PASSWORD" ]] && export REDISCLI_AUTH="$VALKEY_PASSWORD" response=$( timeout -s 15 $1 \ valkey-cli \ -h localhost \ -p $VALKEY_PORT \ ping ) if [ "$?" -eq "124" ]; then echo "Timed out" exit 1 fi if [ "$response" != "PONG" ]; then echo "$response" exit 1 fi ping_readiness_local_and_primary.sh: | script_dir="$(dirname "$0")" exit_status=0 "$script_dir/ping_readiness_local.sh" $1 || exit_status=$? "$script_dir/ping_readiness_primary.sh" $1 || exit_status=$? exit $exit_status ping_readiness_primary.sh: | #!/bin/bash [[ -f $VALKEY_PRIMARY_PASSWORD_FILE ]] && export VALKEY_PRIMARY_PASSWORD="$(< "${VALKEY_PRIMARY_PASSWORD_FILE}")" [[ -n "$VALKEY_PRIMARY_PASSWORD" ]] && export REDISCLI_AUTH="$VALKEY_PRIMARY_PASSWORD" response=$( timeout -s 15 $1 \ valkey-cli \ -h $VALKEY_PRIMARY_HOST \ -p $VALKEY_PRIMARY_PORT_NUMBER \ ping ) if [ "$?" -eq "124" ]; then echo "Timed out" exit 1 fi if [ "$response" != "PONG" ]; then echo "$response" exit 1 fi (root level) + one document added: apiVersion: v1 kind: ConfigMap metadata: name: romm-valkey-scripts namespace: apps-romm labels: app.kubernetes.io/instance: romm-valkey app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: valkey app.kubernetes.io/part-of: valkey helm.toolkit.fluxcd.io/name: romm-valkey helm.toolkit.fluxcd.io/namespace: flux-system data: start-primary.sh: | #!/bin/bash [[ -f $VALKEY_PASSWORD_FILE ]] && export VALKEY_PASSWORD="$(< "${VALKEY_PASSWORD_FILE}")" if [[ -f /opt/bitnami/valkey/mounted-etc/primary.conf ]];then cp /opt/bitnami/valkey/mounted-etc/primary.conf /opt/bitnami/valkey/etc/primary.conf fi if [[ -f /opt/bitnami/valkey/mounted-etc/valkey.conf ]];then cp /opt/bitnami/valkey/mounted-etc/valkey.conf /opt/bitnami/valkey/etc/valkey.conf fi ARGS=("--port" "${VALKEY_PORT}") ARGS+=("--requirepass" "${VALKEY_PASSWORD}") ARGS+=("--primaryauth" "${VALKEY_PASSWORD}") ARGS+=("--include" "/opt/bitnami/valkey/etc/valkey.conf") ARGS+=("--include" "/opt/bitnami/valkey/etc/primary.conf") exec valkey-server "${ARGS[@]}" (root level) + one document added: apiVersion: v1 kind: Service metadata: name: romm-valkey-headless namespace: apps-romm labels: app.kubernetes.io/instance: romm-valkey app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: valkey app.kubernetes.io/part-of: valkey helm.toolkit.fluxcd.io/name: romm-valkey helm.toolkit.fluxcd.io/namespace: flux-system spec: type: ClusterIP clusterIP: None selector: app.kubernetes.io/instance: romm-valkey app.kubernetes.io/name: valkey ports: - name: tcp-redis port: 6379 targetPort: redis (root level) + one document added: apiVersion: v1 kind: Service metadata: name: romm-valkey-primary namespace: apps-romm labels: app.kubernetes.io/component: primary app.kubernetes.io/instance: romm-valkey app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: valkey app.kubernetes.io/part-of: valkey helm.toolkit.fluxcd.io/name: romm-valkey helm.toolkit.fluxcd.io/namespace: flux-system spec: type: ClusterIP internalTrafficPolicy: Cluster selector: app.kubernetes.io/component: primary app.kubernetes.io/instance: romm-valkey app.kubernetes.io/name: valkey ports: - name: tcp-redis nodePort: null port: 6379 targetPort: redis (root level) + one document added: apiVersion: apps/v1 kind: StatefulSet metadata: name: romm-valkey-primary namespace: apps-romm labels: app.kubernetes.io/component: primary app.kubernetes.io/instance: romm-valkey app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: valkey app.kubernetes.io/part-of: valkey helm.toolkit.fluxcd.io/name: romm-valkey helm.toolkit.fluxcd.io/namespace: flux-system spec: replicas: 1 selector: matchLabels: app.kubernetes.io/component: primary app.kubernetes.io/instance: romm-valkey app.kubernetes.io/name: valkey serviceName: romm-valkey-headless template: metadata: labels: app.kubernetes.io/component: primary app.kubernetes.io/instance: romm-valkey app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: valkey spec: affinity: nodeAffinity: null podAffinity: null podAntiAffinity: preferredDuringSchedulingIgnoredDuringExecution: - podAffinityTerm: labelSelector: matchLabels: app.kubernetes.io/component: primary app.kubernetes.io/instance: romm-valkey app.kubernetes.io/name: valkey topologyKey: kubernetes.io/hostname weight: 1 automountServiceAccountToken: false containers: - name: valkey image: "registry-1.docker.io/bitnami/valkey:latest" imagePullPolicy: IfNotPresent args: - "-c" - /opt/bitnami/scripts/start-scripts/start-primary.sh command: - /bin/bash env: - name: BITNAMI_DEBUG value: "false" - name: VALKEY_REPLICATION_MODE value: primary - name: ALLOW_EMPTY_PASSWORD value: no - name: VALKEY_PASSWORD_FILE value: /opt/bitnami/valkey/secrets/valkey-password - name: OPENSSL_FIPS value: yes - name: VALKEY_TLS_ENABLED value: no - name: VALKEY_PORT value: "6379" ports: - name: redis containerPort: 6379 resources: limits: cpu: 150m ephemeral-storage: 2Gi memory: 192Mi requests: cpu: 100m ephemeral-storage: 50Mi memory: 128Mi volumeMounts: - name: start-scripts mountPath: /opt/bitnami/scripts/start-scripts - name: health mountPath: /health - name: valkey-password mountPath: /opt/bitnami/valkey/secrets/ - name: valkey-data mountPath: /data - name: config mountPath: /opt/bitnami/valkey/mounted-etc - name: empty-dir mountPath: /opt/bitnami/valkey/etc/ subPath: app-conf-dir - name: empty-dir mountPath: /tmp subPath: tmp-dir livenessProbe: exec: command: - sh - "-c" - "/health/ping_liveness_local.sh 5" failureThreshold: 5 initialDelaySeconds: 20 periodSeconds: 5 successThreshold: 1 timeoutSeconds: 6 readinessProbe: exec: command: - sh - "-c" - "/health/ping_readiness_local.sh 1" failureThreshold: 5 initialDelaySeconds: 20 periodSeconds: 5 successThreshold: 1 timeoutSeconds: 2 securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL readOnlyRootFilesystem: true runAsGroup: 1001 runAsNonRoot: true runAsUser: 1001 seLinuxOptions: {} seccompProfile: type: RuntimeDefault enableServiceLinks: true securityContext: fsGroup: 1001 fsGroupChangePolicy: Always supplementalGroups: [] sysctls: [] serviceAccountName: romm-valkey-primary terminationGracePeriodSeconds: 30 volumes: - name: start-scripts configMap: name: romm-valkey-scripts defaultMode: 493 - name: health configMap: name: romm-valkey-health defaultMode: 493 - name: valkey-password secret: items: - key: password path: valkey-password secretName: romm-valkey-auth - name: config configMap: name: romm-valkey-configuration - name: empty-dir emptyDir: {} updateStrategy: type: RollingUpdate volumeClaimTemplates: - apiVersion: v1 kind: PersistentVolumeClaim metadata: name: valkey-data labels: app.kubernetes.io/component: primary app.kubernetes.io/instance: romm-valkey app.kubernetes.io/name: valkey spec: resources: requests: storage: 8Gi storageClassName: longhorn accessModes: - ReadWriteOnce (root level) + one document added: apiVersion: networking.k8s.io/v1 kind: NetworkPolicy metadata: name: searxng-valkey namespace: apps-searxng labels: app.kubernetes.io/instance: searxng-valkey app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: valkey app.kubernetes.io/part-of: valkey helm.toolkit.fluxcd.io/name: searxng-valkey helm.toolkit.fluxcd.io/namespace: flux-system spec: egress: - ingress: - ports: - port: 6379 podSelector: matchLabels: app.kubernetes.io/instance: searxng-valkey app.kubernetes.io/name: valkey policyTypes: - Ingress - Egress (root level) + one document added: apiVersion: policy/v1 kind: PodDisruptionBudget metadata: name: searxng-valkey-primary namespace: apps-searxng labels: app.kubernetes.io/component: primary app.kubernetes.io/instance: searxng-valkey app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: valkey helm.toolkit.fluxcd.io/name: searxng-valkey helm.toolkit.fluxcd.io/namespace: flux-system spec: maxUnavailable: 1 selector: matchLabels: app.kubernetes.io/component: primary app.kubernetes.io/instance: searxng-valkey app.kubernetes.io/name: valkey (root level) + one document added: apiVersion: v1 kind: ServiceAccount metadata: name: searxng-valkey-primary namespace: apps-searxng labels: app.kubernetes.io/instance: searxng-valkey app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: valkey app.kubernetes.io/part-of: valkey helm.toolkit.fluxcd.io/name: searxng-valkey helm.toolkit.fluxcd.io/namespace: flux-system automountServiceAccountToken: false (root level) + one document added: apiVersion: v1 kind: ConfigMap metadata: name: searxng-valkey-configuration namespace: apps-searxng labels: app.kubernetes.io/instance: searxng-valkey app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: valkey app.kubernetes.io/part-of: valkey helm.toolkit.fluxcd.io/name: searxng-valkey helm.toolkit.fluxcd.io/namespace: flux-system data: primary.conf: | dir /data # User-supplied primary configuration: rename-command FLUSHDB "" rename-command FLUSHALL "" # End of primary configuration replica.conf: | dir /data # User-supplied replica configuration: rename-command FLUSHDB "" rename-command FLUSHALL "" # End of replica configuration valkey.conf: | # User-supplied common configuration: # Enable AOF https://valkey.io/docs/topics/persistence.html appendonly yes # Disable RDB persistence, AOF persistence already enabled. save "" # End of common configuration (root level) + one document added: apiVersion: v1 kind: ConfigMap metadata: name: searxng-valkey-health namespace: apps-searxng labels: app.kubernetes.io/instance: searxng-valkey app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: valkey helm.toolkit.fluxcd.io/name: searxng-valkey helm.toolkit.fluxcd.io/namespace: flux-system data: ping_liveness_local.sh: | #!/bin/bash [[ -f $VALKEY_PASSWORD_FILE ]] && export VALKEY_PASSWORD="$(< "${VALKEY_PASSWORD_FILE}")" [[ -n "$VALKEY_PASSWORD" ]] && export REDISCLI_AUTH="$VALKEY_PASSWORD" response=$( timeout -s 15 $1 \ valkey-cli \ -h localhost \ -p $VALKEY_PORT \ ping ) if [ "$?" -eq "124" ]; then echo "Timed out" exit 1 fi responseFirstWord=$(echo $response | head -n1 | awk '{print $1;}') if [ "$response" != "PONG" ] && [ "$responseFirstWord" != "LOADING" ] && [ "$responseFirstWord" != "MASTERDOWN" ]; then echo "$response" exit 1 fi ping_liveness_local_and_primary.sh: | script_dir="$(dirname "$0")" exit_status=0 "$script_dir/ping_liveness_local.sh" $1 || exit_status=$? "$script_dir/ping_liveness_primary.sh" $1 || exit_status=$? exit $exit_status ping_liveness_primary.sh: | #!/bin/bash [[ -f $VALKEY_PRIMARY_PASSWORD_FILE ]] && export VALKEY_PRIMARY_PASSWORD="$(< "${VALKEY_PRIMARY_PASSWORD_FILE}")" [[ -n "$VALKEY_PRIMARY_PASSWORD" ]] && export REDISCLI_AUTH="$VALKEY_PRIMARY_PASSWORD" response=$( timeout -s 15 $1 \ valkey-cli \ -h $VALKEY_PRIMARY_HOST \ -p $VALKEY_PRIMARY_PORT_NUMBER \ ping ) if [ "$?" -eq "124" ]; then echo "Timed out" exit 1 fi responseFirstWord=$(echo $response | head -n1 | awk '{print $1;}') if [ "$response" != "PONG" ] && [ "$responseFirstWord" != "LOADING" ]; then echo "$response" exit 1 fi ping_readiness_local.sh: | #!/bin/bash [[ -f $VALKEY_PASSWORD_FILE ]] && export VALKEY_PASSWORD="$(< "${VALKEY_PASSWORD_FILE}")" [[ -n "$VALKEY_PASSWORD" ]] && export REDISCLI_AUTH="$VALKEY_PASSWORD" response=$( timeout -s 15 $1 \ valkey-cli \ -h localhost \ -p $VALKEY_PORT \ ping ) if [ "$?" -eq "124" ]; then echo "Timed out" exit 1 fi if [ "$response" != "PONG" ]; then echo "$response" exit 1 fi ping_readiness_local_and_primary.sh: | script_dir="$(dirname "$0")" exit_status=0 "$script_dir/ping_readiness_local.sh" $1 || exit_status=$? "$script_dir/ping_readiness_primary.sh" $1 || exit_status=$? exit $exit_status ping_readiness_primary.sh: | #!/bin/bash [[ -f $VALKEY_PRIMARY_PASSWORD_FILE ]] && export VALKEY_PRIMARY_PASSWORD="$(< "${VALKEY_PRIMARY_PASSWORD_FILE}")" [[ -n "$VALKEY_PRIMARY_PASSWORD" ]] && export REDISCLI_AUTH="$VALKEY_PRIMARY_PASSWORD" response=$( timeout -s 15 $1 \ valkey-cli \ -h $VALKEY_PRIMARY_HOST \ -p $VALKEY_PRIMARY_PORT_NUMBER \ ping ) if [ "$?" -eq "124" ]; then echo "Timed out" exit 1 fi if [ "$response" != "PONG" ]; then echo "$response" exit 1 fi (root level) + one document added: apiVersion: v1 kind: ConfigMap metadata: name: searxng-valkey-scripts namespace: apps-searxng labels: app.kubernetes.io/instance: searxng-valkey app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: valkey app.kubernetes.io/part-of: valkey helm.toolkit.fluxcd.io/name: searxng-valkey helm.toolkit.fluxcd.io/namespace: flux-system data: start-primary.sh: | #!/bin/bash [[ -f $VALKEY_PASSWORD_FILE ]] && export VALKEY_PASSWORD="$(< "${VALKEY_PASSWORD_FILE}")" if [[ -f /opt/bitnami/valkey/mounted-etc/primary.conf ]];then cp /opt/bitnami/valkey/mounted-etc/primary.conf /opt/bitnami/valkey/etc/primary.conf fi if [[ -f /opt/bitnami/valkey/mounted-etc/valkey.conf ]];then cp /opt/bitnami/valkey/mounted-etc/valkey.conf /opt/bitnami/valkey/etc/valkey.conf fi ARGS=("--port" "${VALKEY_PORT}") ARGS+=("--protected-mode" "no") ARGS+=("--include" "/opt/bitnami/valkey/etc/valkey.conf") ARGS+=("--include" "/opt/bitnami/valkey/etc/primary.conf") exec valkey-server "${ARGS[@]}" (root level) + one document added: apiVersion: v1 kind: Service metadata: name: searxng-valkey-headless namespace: apps-searxng labels: app.kubernetes.io/instance: searxng-valkey app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: valkey app.kubernetes.io/part-of: valkey helm.toolkit.fluxcd.io/name: searxng-valkey helm.toolkit.fluxcd.io/namespace: flux-system spec: type: ClusterIP clusterIP: None selector: app.kubernetes.io/instance: searxng-valkey app.kubernetes.io/name: valkey ports: - name: tcp-redis port: 6379 targetPort: redis (root level) + one document added: apiVersion: v1 kind: Service metadata: name: searxng-valkey-primary namespace: apps-searxng labels: app.kubernetes.io/component: primary app.kubernetes.io/instance: searxng-valkey app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: valkey app.kubernetes.io/part-of: valkey helm.toolkit.fluxcd.io/name: searxng-valkey helm.toolkit.fluxcd.io/namespace: flux-system spec: type: ClusterIP internalTrafficPolicy: Cluster selector: app.kubernetes.io/component: primary app.kubernetes.io/instance: searxng-valkey app.kubernetes.io/name: valkey ports: - name: tcp-redis nodePort: null port: 6379 targetPort: redis (root level) + one document added: apiVersion: apps/v1 kind: StatefulSet metadata: name: searxng-valkey-primary namespace: apps-searxng labels: app.kubernetes.io/component: primary app.kubernetes.io/instance: searxng-valkey app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: valkey app.kubernetes.io/part-of: valkey helm.toolkit.fluxcd.io/name: searxng-valkey helm.toolkit.fluxcd.io/namespace: flux-system spec: replicas: 1 selector: matchLabels: app.kubernetes.io/component: primary app.kubernetes.io/instance: searxng-valkey app.kubernetes.io/name: valkey serviceName: searxng-valkey-headless template: metadata: labels: app.kubernetes.io/component: primary app.kubernetes.io/instance: searxng-valkey app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: valkey spec: affinity: nodeAffinity: null podAffinity: null podAntiAffinity: preferredDuringSchedulingIgnoredDuringExecution: - podAffinityTerm: labelSelector: matchLabels: app.kubernetes.io/component: primary app.kubernetes.io/instance: searxng-valkey app.kubernetes.io/name: valkey topologyKey: kubernetes.io/hostname weight: 1 automountServiceAccountToken: false containers: - name: valkey image: "registry-1.docker.io/bitnami/valkey:latest" imagePullPolicy: IfNotPresent args: - "-c" - /opt/bitnami/scripts/start-scripts/start-primary.sh command: - /bin/bash env: - name: BITNAMI_DEBUG value: "false" - name: VALKEY_REPLICATION_MODE value: primary - name: ALLOW_EMPTY_PASSWORD value: yes - name: OPENSSL_FIPS value: yes - name: VALKEY_TLS_ENABLED value: no - name: VALKEY_PORT value: "6379" ports: - name: redis containerPort: 6379 resources: limits: cpu: 150m ephemeral-storage: 2Gi memory: 192Mi requests: cpu: 100m ephemeral-storage: 50Mi memory: 128Mi volumeMounts: - name: start-scripts mountPath: /opt/bitnami/scripts/start-scripts - name: health mountPath: /health - name: valkey-data mountPath: /data - name: config mountPath: /opt/bitnami/valkey/mounted-etc - name: empty-dir mountPath: /opt/bitnami/valkey/etc/ subPath: app-conf-dir - name: empty-dir mountPath: /tmp subPath: tmp-dir livenessProbe: exec: command: - sh - "-c" - "/health/ping_liveness_local.sh 5" failureThreshold: 5 initialDelaySeconds: 20 periodSeconds: 5 successThreshold: 1 timeoutSeconds: 6 readinessProbe: exec: command: - sh - "-c" - "/health/ping_readiness_local.sh 1" failureThreshold: 5 initialDelaySeconds: 20 periodSeconds: 5 successThreshold: 1 timeoutSeconds: 2 securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL readOnlyRootFilesystem: true runAsGroup: 1001 runAsNonRoot: true runAsUser: 1001 seLinuxOptions: {} seccompProfile: type: RuntimeDefault enableServiceLinks: true securityContext: fsGroup: 1001 fsGroupChangePolicy: Always supplementalGroups: [] sysctls: [] serviceAccountName: searxng-valkey-primary terminationGracePeriodSeconds: 30 volumes: - name: start-scripts configMap: name: searxng-valkey-scripts defaultMode: 493 - name: health configMap: name: searxng-valkey-health defaultMode: 493 - name: config configMap: name: searxng-valkey-configuration - name: empty-dir emptyDir: {} updateStrategy: type: RollingUpdate volumeClaimTemplates: - apiVersion: v1 kind: PersistentVolumeClaim metadata: name: valkey-data labels: app.kubernetes.io/component: primary app.kubernetes.io/instance: searxng-valkey app.kubernetes.io/name: valkey spec: resources: requests: storage: 8Gi storageClassName: longhorn accessModes: - ReadWriteOnce (root level) + one document added: apiVersion: v1 kind: ServiceAccount metadata: name: vmcp-oauth-valkey namespace: mcp-servers labels: app.kubernetes.io/instance: vmcp-oauth-valkey app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: valkey helm.toolkit.fluxcd.io/name: vmcp-oauth-valkey helm.toolkit.fluxcd.io/namespace: flux-system automountServiceAccountToken: false (root level) + one document added: apiVersion: v1 kind: ConfigMap metadata: name: vmcp-oauth-valkey-init-scripts namespace: mcp-servers labels: app.kubernetes.io/instance: vmcp-oauth-valkey app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: valkey helm.toolkit.fluxcd.io/name: vmcp-oauth-valkey helm.toolkit.fluxcd.io/namespace: flux-system data: init.sh: | #!/bin/sh set -eu # Default config paths VALKEY_CONFIG=${VALKEY_CONFIG_PATH:-/data/conf/valkey.conf} LOGFILE="/data/init.log" DATA_DIR="/data/conf" # Logging function (outputs to stderr and file) log() { echo "$(date) $1" | tee -a "$LOGFILE" >&2 } # Function to get password for a user # Usage: get_user_password <username> [password_key] # Returns: password via stdout, exits with error if not found get_user_password() { username="$1" password_key="${2:-$username}" password="" # Try to get password from existing secret first (priority) if [ -f "/valkey-users-secret/$password_key" ]; then password=$(cat "/valkey-users-secret/$password_key") log "Using password from existing secret for user $username" elif [ -f "/valkey-auth-secret/${username}-password" ]; then # Fallback to inline password password=$(cat "/valkey-auth-secret/${username}-password") log "Using inline password for user $username" else log "ERROR: No password found for user $username" return 1 fi echo "$password" } # Clean old log if requested if [ "${KEEP_OLD_LOGS:-false}" != "true" ]; then rm -f "$LOGFILE" fi if [ -f "$LOGFILE" ]; then log "Detected restart of this instance ($HOSTNAME)" fi log "Creating configuration in $DATA_DIR..." mkdir -p "$DATA_DIR" rm -f "$VALKEY_CONFIG" # Base valkey.conf log "Generating base valkey.conf" { echo "port 6379" echo "protected-mode no" echo "bind * -::*" echo "dir /data" } >>"$VALKEY_CONFIG" # Create secure directory for ACL file log "Creating /etc/valkey directory for ACL file" mkdir -p /etc/valkey # Set aclfile path in valkey.conf echo "aclfile /etc/valkey/users.acl" >>"$VALKEY_CONFIG" # Remove or reset existing ACL file if present (it may be read-only from previous run) log "Preparing ACL file at /etc/valkey/users.acl" if [ -f /etc/valkey/users.acl ]; then log "Removing existing read-only users.acl file" chmod 0600 /etc/valkey/users.acl rm -f /etc/valkey/users.acl fi # Create ACL file with secure permissions touch /etc/valkey/users.acl chmod 0600 /etc/valkey/users.acl # Generate ACL entries for each user log "Generating ACL entries for users" # User: default PASSWORD=$(get_user_password "default" "default-password") || exit 1 # Hash the password and write ACL entry PASSHASH=$(echo -n "$PASSWORD" | sha256sum | cut -f 1 -d " ") echo "user default on #$PASSHASH ~vmcp-oauth-sessions:* &* +@all -@dangerous" >> /etc/valkey/users.acl # User: thv-auth PASSWORD=$(get_user_password "thv-auth" "thv-auth-password") || exit 1 # Hash the password and write ACL entry PASSHASH=$(echo -n "$PASSWORD" | sha256sum | cut -f 1 -d " ") echo "user thv-auth on #$PASSHASH +@read +@write +@keyspace +@scripting +@transaction +@connection ~thv:auth:* &*" >> /etc/valkey/users.acl # Set final permissions chmod 0400 /etc/valkey/users.acl log "ACL file created with 0400 permissions" # Append extra configs if present if [ -f /usr/local/etc/valkey/valkey.conf ]; then log "Appending /usr/local/etc/valkey/valkey.conf" cat /usr/local/etc/valkey/valkey.conf >>"$VALKEY_CONFIG" fi if [ -d /extravalkeyconfigs ]; then log "Appending files in /extravalkeyconfigs/" cat /extravalkeyconfigs/* >>"$VALKEY_CONFIG" fi (root level) + one document added: apiVersion: v1 kind: PersistentVolumeClaim metadata: name: vmcp-oauth-valkey namespace: mcp-servers labels: app.kubernetes.io/instance: vmcp-oauth-valkey app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: valkey helm.toolkit.fluxcd.io/name: vmcp-oauth-valkey helm.toolkit.fluxcd.io/namespace: flux-system spec: resources: requests: storage: 8Gi storageClassName: longhorn volumeMode: Filesystem accessModes: - ReadWriteOnce (root level) + one document added: apiVersion: v1 kind: Service metadata: name: vmcp-oauth-valkey namespace: mcp-servers labels: app.kubernetes.io/component: primary app.kubernetes.io/instance: vmcp-oauth-valkey app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: valkey helm.toolkit.fluxcd.io/name: vmcp-oauth-valkey helm.toolkit.fluxcd.io/namespace: flux-system spec: type: ClusterIP selector: app.kubernetes.io/instance: vmcp-oauth-valkey app.kubernetes.io/name: valkey ports: - name: tcp port: 6379 protocol: TCP targetPort: tcp (root level) + one document added: apiVersion: apps/v1 kind: Deployment metadata: name: vmcp-oauth-valkey namespace: mcp-servers labels: app.kubernetes.io/instance: vmcp-oauth-valkey app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: valkey helm.toolkit.fluxcd.io/name: vmcp-oauth-valkey helm.toolkit.fluxcd.io/namespace: flux-system spec: replicas: 1 selector: matchLabels: app.kubernetes.io/instance: vmcp-oauth-valkey app.kubernetes.io/name: valkey strategy: type: RollingUpdate template: metadata: labels: app.kubernetes.io/instance: vmcp-oauth-valkey app.kubernetes.io/name: valkey spec: automountServiceAccountToken: false containers: - name: vmcp-oauth-valkey image: "docker.io/valkey/valkey:9.0.1" imagePullPolicy: IfNotPresent resources: {} args: - /data/conf/valkey.conf command: - valkey-server env: - name: VALKEY_LOGLEVEL value: notice ports: - name: tcp containerPort: 6379 protocol: TCP volumeMounts: - name: valkey-data mountPath: /data - name: valkey-acl mountPath: /etc/valkey livenessProbe: exec: command: - sh - "-c" - "valkey-cli ping" securityContext: capabilities: drop: - ALL readOnlyRootFilesystem: true runAsNonRoot: true runAsUser: 1000 startupProbe: exec: command: - sh - "-c" - "valkey-cli ping" initContainers: - name: vmcp-oauth-valkey-init image: "docker.io/valkey/valkey:9.0.1" imagePullPolicy: IfNotPresent command: - /scripts/init.sh volumeMounts: - name: valkey-data mountPath: /data - name: scripts mountPath: /scripts - name: valkey-acl mountPath: /etc/valkey - name: valkey-users-secret mountPath: /valkey-users-secret readOnly: true securityContext: capabilities: drop: - ALL readOnlyRootFilesystem: true runAsNonRoot: true runAsUser: 1000 securityContext: fsGroup: 1000 runAsGroup: 1000 runAsUser: 1000 serviceAccountName: vmcp-oauth-valkey volumes: - name: scripts configMap: name: vmcp-oauth-valkey-init-scripts defaultMode: 365 - name: valkey-acl emptyDir: medium: Memory - name: valkey-users-secret secret: defaultMode: 256 secretName: vmcp-oauth-valkey-acl-passwords - name: valkey-data persistentVolumeClaim: claimName: vmcp-oauth-valkey ``` [Pipeline](https://ci.aether.earth/repos/4/pipeline/445)

renovate-bot force-pushed renovate/ghcr.io-scanopy-scanopy-server-0.x from 808a13fd07

ci/crow/pr/dns-test Pipeline was successful

Details

ci/crow/push/dns-test Pipeline was successful

Details

ci/crow/pr/tanka-test Pipeline was successful

Details

ci/crow/push/tanka-test Pipeline was successful

Details

ci/crow/pr/tanka-diff Pipeline was successful

Details

to 450a19b3ad

ci/crow/push/dns-test Pipeline was successful

Details

ci/crow/pr/dns-test Pipeline was successful

Details

ci/crow/pr/tanka-test Pipeline was successful

Details

ci/crow/push/tanka-test Pipeline was successful

Details

ci/crow/pr/tanka-diff Pipeline was successful

Details

2026-10-02 15:05:55 +00:00

Compare

renovate-bot changed title from ~~chore(deps): update ghcr.io/scanopy/scanopy/server docker tag to v0.17.18~~ to chore(deps): update ghcr.io/scanopy/scanopy/server docker tag to v0.17.19

2026-10-02 15:05:59 +00:00

ci-bot commented

2026-10-02 15:08:32 +00:00

Member

flate diff

No differences detected.

Pipeline

## flate diff No differences detected. [Pipeline](https://ci.aether.earth/repos/4/pipeline/461)

renovate-bot force-pushed renovate/ghcr.io-scanopy-scanopy-server-0.x from 450a19b3ad

ci/crow/push/dns-test Pipeline was successful

Details

ci/crow/pr/dns-test Pipeline was successful

Details

ci/crow/pr/tanka-test Pipeline was successful

Details

ci/crow/push/tanka-test Pipeline was successful

Details

ci/crow/pr/tanka-diff Pipeline was successful

Details

to 9fa8efce6a

ci/crow/push/dns-test Pipeline was successful

Details

ci/crow/pr/dns-test Pipeline was successful

Details

ci/crow/push/tanka-test Pipeline was successful

Details

ci/crow/pr/tanka-test Pipeline was successful

Details

ci/crow/pr/tanka-diff Pipeline was successful

Details

2026-10-03 05:05:52 +00:00

Compare

renovate-bot changed title from ~~chore(deps): update ghcr.io/scanopy/scanopy/server docker tag to v0.17.19~~ to chore(deps): update ghcr.io/scanopy/scanopy/server docker tag to v0.17.20

2026-10-03 05:05:58 +00:00

ci-bot commented

2026-10-03 05:08:23 +00:00

Member

flate diff

rules  (rbac.authorization.k8s.io/v1/ClusterRole/kube-prometheus-stack-operator)
  - six list entries removed:           + three list entries added:
    - resources:                          - resources:
      - alertmanagers                       - alertmanagers
      - prometheusagents                    - alertmanagers/finalizers
      - prometheuses                        - alertmanagers/status
      - thanosrulers                        - alertmanagerconfigs
      apiGroups:                            - prometheuses
      - monitoring.coreos.com               - prometheuses/finalizers
      verbs:                                - prometheuses/status
      - patch                               - prometheusagents
    - resources:                            - prometheusagents/finalizers
      - alertmanagers/status                - prometheusagents/status
      - podmonitors/status                  - thanosrulers
      - probes/status                       - thanosrulers/finalizers
      - prometheuses/status                 - thanosrulers/status
      - prometheusagents/status             - scrapeconfigs
      - prometheusrules/status              - scrapeconfigs/status
      - scrapeconfigs/status                - servicemonitors
      - servicemonitors/status              - servicemonitors/status
      - thanosrulers/status                 - podmonitors
      apiGroups:                            - podmonitors/status
      - monitoring.coreos.com               - probes
      verbs:                                - probes/status
      - create                              - prometheusrules
      - update                              - prometheusrules/status
      - patch                               apiGroups:
      - delete                              - monitoring.coreos.com
    - resources:                            verbs:
      - alertmanagers/finalizers            - "*"
      - prometheusagents/finalizers       - resources:
      - prometheuses/finalizers             - statefulsets
      - thanosrulers/finalizers             apiGroups:
      apiGroups:                            - apps
      - monitoring.coreos.com               verbs:
      verbs:                                - "*"
      - update                            - resources:
    - resources:                            - configmaps
      - alertmanagers                       - secrets
      - alertmanagerconfigs                 apiGroups:
      - podmonitors                         -
      - probes                              verbs:
      - prometheusagents                    - "*"
      - prometheuses
      - prometheusrules
      - servicemonitors
      - scrapeconfigs
      - thanosrulers
      apiGroups:
      - monitoring.coreos.com
      verbs:
      - get
      - list
      - watch
    - resources:
      - statefulsets
      apiGroups:
      - apps
      verbs:
      - get
      - list
      - watch
      - create
      - update
      - patch
      - delete
    - resources:
      - configmaps
      - secrets
      apiGroups:
      -
      verbs:
      - get
      - list
      - watch
      - create
      - update
      - delete

metadata  (v1/Service/kube-privileged/node-exporter)
  + one map entry added:
    annotations:
      prometheus.io/scrape: "true"

spec.template.spec.containers.kube-state-metrics.image  (apps/v1/Deployment/monitoring/kube-state-metrics)
  ± value change
    - registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.20.0
    + registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.19.1

spec.template.spec.containers.kube-prometheus-stack.args  (apps/v1/Deployment/monitoring/kube-prometheus-stack-operator)
  - three list entries removed:
    - "--prometheus-config-reloader=quay.io/prometheus-operator/prometheus-config-reloader:v0.94.1"
    - "--thanos-default-base-image=quay.io/thanos/thanos:v0.42.4"
    - "--secret-field-selector=type!=kubernetes.io/dockercfg,type!=helm.sh/release.v1"
    
  
  + three list entries added:
    - "--prometheus-config-reloader=quay.io/prometheus-operator/prometheus-config-reloader:v0.92.1"
    - "--thanos-default-base-image=quay.io/thanos/thanos:v0.42.2"
    - "--secret-field-selector=type!=kubernetes.io/dockercfg,type!=kubernetes.io/service-account-token,type!=helm.sh/release.v1"
    
  

spec.template.spec.containers.kube-prometheus-stack.image  (apps/v1/Deployment/monitoring/kube-prometheus-stack-operator)
  ± value change
    - quay.io/prometheus-operator/prometheus-operator:v0.94.1
    + quay.io/prometheus-operator/prometheus-operator:v0.92.1

spec  (monitoring.coreos.com/v1/Alertmanager/monitoring/kube-prometheus-stack)
  + one map entry added:
    hostNetwork: false

spec.image  (monitoring.coreos.com/v1/Alertmanager/monitoring/kube-prometheus-stack)
  ± value change
    - quay.io/prometheus/alertmanager:v0.34.1
    + quay.io/prometheus/alertmanager:v0.33.1

spec.version  (monitoring.coreos.com/v1/Alertmanager/monitoring/kube-prometheus-stack)
  ± value change
    - v0.34.1
    + v0.33.1

spec.image  (monitoring.coreos.com/v1/Prometheus/monitoring/kube-prometheus-stack)
  ± value change
    - quay.io/prometheus/prometheus:v3.15.0-distroless
    + quay.io/prometheus/prometheus:v3.13.1-distroless

spec.version  (monitoring.coreos.com/v1/Prometheus/monitoring/kube-prometheus-stack)
  ± value change
    - v3.15.0-distroless
    + v3.13.1-distroless

spec.groups.kube-apiserver-burnrate.rules.rules  (monitoring.coreos.com/v1/PrometheusRule/monitoring/kube-prometheus-stack-kube-apiserver-burnrate.rules)
  - eleven list entries removed:
    - expr: |
        (
          (
            # too slow
            sum by (cluster) (rate(apiserver_request_sli_duration_seconds_count{job="apiserver",verb=~"LIST|GET",subresource!~"proxy|attach|log|exec|portforward"}[5m]))
            -
            (
              (
                sum by (cluster) (rate(apiserver_request_sli_duration_seconds_bucket{job="apiserver",verb=~"LIST|GET",subresource!~"proxy|attach|log|exec|portforward",scope=~"resource|",le=~"1(\\.0)?"}[5m]))
                or
                vector(0)
              )
              +
              sum by (cluster) (rate(apiserver_request_sli_duration_seconds_bucket{job="apiserver",verb=~"LIST|GET",subresource!~"proxy|attach|log|exec|portforward",scope="namespace",le=~"5(\\.0)?"}[5m]))
              +
              sum by (cluster) (rate(apiserver_request_sli_duration_seconds_bucket{job="apiserver",verb=~"LIST|GET",subresource!~"proxy|attach|log|exec|portforward",scope="cluster",le=~"30(\\.0)?"}[5m]))
            )
          )
          +
          # errors
          sum by (cluster) (rate(apiserver_request_total{job="apiserver",verb=~"LIST|GET",code=~"5.."}[5m]))
        )
      labels:
        verb: read
      record: "cluster_verb:apiserver_request_sli_bad_events:rate5m"
    - expr: |
        (
          (
            # too slow
            sum by (cluster) (rate(apiserver_request_sli_duration_seconds_count{job="apiserver",verb=~"POST|PUT|PATCH|DELETE",subresource!~"proxy|attach|log|exec|portforward"}[5m]))
            -
            sum by (cluster) (rate(apiserver_request_sli_duration_seconds_bucket{job="apiserver",verb=~"POST|PUT|PATCH|DELETE",subresource!~"proxy|attach|log|exec|portforward",le=~"1(\\.0)?"}[5m]))
          )
          +
          # errors
          sum by (cluster) (rate(apiserver_request_total{job="apiserver",verb=~"POST|PUT|PATCH|DELETE",code=~"5.."}[5m]))
        )
      labels:
        verb: write
      record: "cluster_verb:apiserver_request_sli_bad_events:rate5m"
    - expr: "sum by (cluster) (rate(apiserver_request_total{job=\"apiserver\",verb=~\"LIST|GET\"}[5m]))"
      labels:
        verb: read
      record: "cluster_verb:apiserver_request_sli_events:rate5m"
    - expr: "sum by (cluster) (rate(apiserver_request_total{job=\"apiserver\",verb=~\"POST|PUT|PATCH|DELETE\"}[5m]))"
      labels:
        verb: write
      record: "cluster_verb:apiserver_request_sli_events:rate5m"
    - expr: |
        cluster_verb:apiserver_request_sli_bad_events:rate5m
        /
        cluster_verb:apiserver_request_sli_events:rate5m
      record: "apiserver_request:burnrate5m"
    - expr: |
        (
          (
            # too slow
            sum by (cluster) (rate(apiserver_request_sli_duration_seconds_count{job="apiserver",verb=~"POST|PUT|PATCH|DELETE",subresource!~"proxy|attach|log|exec|portforward"}[1h]))
            -
            sum by (cluster) (rate(apiserver_request_sli_duration_seconds_bucket{job="apiserver",verb=~"POST|PUT|PATCH|DELETE",subresource!~"proxy|attach|log|exec|portforward",le=~"1(\\.0)?"}[1h]))
          )
          +
          # errors
          sum by (cluster) (rate(apiserver_request_total{job="apiserver",verb=~"POST|PUT|PATCH|DELETE",code=~"5.."}[1h]))
        )
        /
        sum by (cluster) (rate(apiserver_request_total{job="apiserver",verb=~"POST|PUT|PATCH|DELETE"}[1h]))
      labels:
        verb: write
      record: "apiserver_request:burnrate1h"
    - expr: |
        (
          (
            # too slow
            sum by (cluster) (rate(apiserver_request_sli_duration_seconds_count{job="apiserver",verb=~"POST|PUT|PATCH|DELETE",subresource!~"proxy|attach|log|exec|portforward"}[2h]))
            -
            sum by (cluster) (rate(apiserver_request_sli_duration_seconds_bucket{job="apiserver",verb=~"POST|PUT|PATCH|DELETE",subresource!~"proxy|attach|log|exec|portforward",le=~"1(\\.0)?"}[2h]))
          )
          +
          # errors
          sum by (cluster) (rate(apiserver_request_total{job="apiserver",verb=~"POST|PUT|PATCH|DELETE",code=~"5.."}[2h]))
        )
        /
        sum by (cluster) (rate(apiserver_request_total{job="apiserver",verb=~"POST|PUT|PATCH|DELETE"}[2h]))
      labels:
        verb: write
      record: "apiserver_request:burnrate2h"
    - expr: |
        (
          (
            # too slow
            sum by (cluster) (rate(apiserver_request_sli_duration_seconds_count{job="apiserver",verb=~"POST|PUT|PATCH|DELETE",subresource!~"proxy|attach|log|exec|portforward"}[30m]))
            -
            sum by (cluster) (rate(apiserver_request_sli_duration_seconds_bucket{job="apiserver",verb=~"POST|PUT|PATCH|DELETE",subresource!~"proxy|attach|log|exec|portforward",le=~"1(\\.0)?"}[30m]))
          )
          +
          # errors
          sum by (cluster) (rate(apiserver_request_total{job="apiserver",verb=~"POST|PUT|PATCH|DELETE",code=~"5.."}[30m]))
        )
        /
        sum by (cluster) (rate(apiserver_request_total{job="apiserver",verb=~"POST|PUT|PATCH|DELETE"}[30m]))
      labels:
        verb: write
      record: "apiserver_request:burnrate30m"
    - expr: |
        (
          (
            # too slow
            sum by (cluster) (rate(apiserver_request_sli_duration_seconds_count{job="apiserver",verb=~"POST|PUT|PATCH|DELETE",subresource!~"proxy|attach|log|exec|portforward"}[6h]))
            -
            sum by (cluster) (rate(apiserver_request_sli_duration_seconds_bucket{job="apiserver",verb=~"POST|PUT|PATCH|DELETE",subresource!~"proxy|attach|log|exec|portforward",le=~"1(\\.0)?"}[6h]))
          )
          +
          # errors
          sum by (cluster) (rate(apiserver_request_total{job="apiserver",verb=~"POST|PUT|PATCH|DELETE",code=~"5.."}[6h]))
        )
        /
        sum by (cluster) (rate(apiserver_request_total{job="apiserver",verb=~"POST|PUT|PATCH|DELETE"}[6h]))
      labels:
        verb: write
      record: "apiserver_request:burnrate6h"
    - expr: |
        avg_over_time(cluster_verb:apiserver_request_sli_bad_events:rate5m[1d])
        /
        avg_over_time(cluster_verb:apiserver_request_sli_events:rate5m[1d])
      record: "apiserver_request:burnrate1d"
    - expr: |
        avg_over_time(cluster_verb:apiserver_request_sli_bad_events:rate5m[3d])
        /
        avg_over_time(cluster_verb:apiserver_request_sli_events:rate5m[3d])
      record: "apiserver_request:burnrate3d"
    
  
  + ten list entries added:
    - expr: |
        (
          (
            # too slow
            sum by (cluster) (rate(apiserver_request_sli_duration_seconds_count{job="apiserver",verb=~"LIST|GET",subresource!~"proxy|attach|log|exec|portforward"}[1d]))
            -
            (
              (
                sum by (cluster) (rate(apiserver_request_sli_duration_seconds_bucket{job="apiserver",verb=~"LIST|GET",subresource!~"proxy|attach|log|exec|portforward",scope=~"resource|",le=~"1(\\.0)?"}[1d]))
                or
                vector(0)
              )
              +
              sum by (cluster) (rate(apiserver_request_sli_duration_seconds_bucket{job="apiserver",verb=~"LIST|GET",subresource!~"proxy|attach|log|exec|portforward",scope="namespace",le=~"5(\\.0)?"}[1d]))
              +
              sum by (cluster) (rate(apiserver_request_sli_duration_seconds_bucket{job="apiserver",verb=~"LIST|GET",subresource!~"proxy|attach|log|exec|portforward",scope="cluster",le=~"30(\\.0)?"}[1d]))
            )
          )
          +
          # errors
          sum by (cluster) (rate(apiserver_request_total{job="apiserver",verb=~"LIST|GET",code=~"5.."}[1d]))
        )
        /
        sum by (cluster) (rate(apiserver_request_total{job="apiserver",verb=~"LIST|GET"}[1d]))
      labels:
        verb: read
      record: "apiserver_request:burnrate1d"
    - expr: |
        (
          (
            # too slow
            sum by (cluster) (rate(apiserver_request_sli_duration_seconds_count{job="apiserver",verb=~"LIST|GET",subresource!~"proxy|attach|log|exec|portforward"}[3d]))
            -
            (
              (
                sum by (cluster) (rate(apiserver_request_sli_duration_seconds_bucket{job="apiserver",verb=~"LIST|GET",subresource!~"proxy|attach|log|exec|portforward",scope=~"resource|",le=~"1(\\.0)?"}[3d]))
                or
                vector(0)
              )
              +
              sum by (cluster) (rate(apiserver_request_sli_duration_seconds_bucket{job="apiserver",verb=~"LIST|GET",subresource!~"proxy|attach|log|exec|portforward",scope="namespace",le=~"5(\\.0)?"}[3d]))
              +
              sum by (cluster) (rate(apiserver_request_sli_duration_seconds_bucket{job="apiserver",verb=~"LIST|GET",subresource!~"proxy|attach|log|exec|portforward",scope="cluster",le=~"30(\\.0)?"}[3d]))
            )
          )
          +
          # errors
          sum by (cluster) (rate(apiserver_request_total{job="apiserver",verb=~"LIST|GET",code=~"5.."}[3d]))
        )
        /
        sum by (cluster) (rate(apiserver_request_total{job="apiserver",verb=~"LIST|GET"}[3d]))
      labels:
        verb: read
      record: "apiserver_request:burnrate3d"
    - expr: |
        (
          (
            # too slow
            sum by (cluster) (rate(apiserver_request_sli_duration_seconds_count{job="apiserver",verb=~"LIST|GET",subresource!~"proxy|attach|log|exec|portforward"}[5m]))
            -
            (
              (
                sum by (cluster) (rate(apiserver_request_sli_duration_seconds_bucket{job="apiserver",verb=~"LIST|GET",subresource!~"proxy|attach|log|exec|portforward",scope=~"resource|",le=~"1(\\.0)?"}[5m]))
                or
                vector(0)
              )
              +
              sum by (cluster) (rate(apiserver_request_sli_duration_seconds_bucket{job="apiserver",verb=~"LIST|GET",subresource!~"proxy|attach|log|exec|portforward",scope="namespace",le=~"5(\\.0)?"}[5m]))
              +
              sum by (cluster) (rate(apiserver_request_sli_duration_seconds_bucket{job="apiserver",verb=~"LIST|GET",subresource!~"proxy|attach|log|exec|portforward",scope="cluster",le=~"30(\\.0)?"}[5m]))
            )
          )
          +
          # errors
          sum by (cluster) (rate(apiserver_request_total{job="apiserver",verb=~"LIST|GET",code=~"5.."}[5m]))
        )
        /
        sum by (cluster) (rate(apiserver_request_total{job="apiserver",verb=~"LIST|GET"}[5m]))
      labels:
        verb: read
      record: "apiserver_request:burnrate5m"
    - expr: |
        (
          (
            # too slow
            sum by (cluster) (rate(apiserver_request_sli_duration_seconds_count{job="apiserver",verb=~"POST|PUT|PATCH|DELETE",subresource!~"proxy|attach|log|exec|portforward"}[1d]))
            -
            sum by (cluster) (rate(apiserver_request_sli_duration_seconds_bucket{job="apiserver",verb=~"POST|PUT|PATCH|DELETE",subresource!~"proxy|attach|log|exec|portforward",le=~"1(\\.0)?"}[1d]))
          )
          +
          sum by (cluster) (rate(apiserver_request_total{job="apiserver",verb=~"POST|PUT|PATCH|DELETE",code=~"5.."}[1d]))
        )
        /
        sum by (cluster) (rate(apiserver_request_total{job="apiserver",verb=~"POST|PUT|PATCH|DELETE"}[1d]))
      labels:
        verb: write
      record: "apiserver_request:burnrate1d"
    - expr: |
        (
          (
            # too slow
            sum by (cluster) (rate(apiserver_request_sli_duration_seconds_count{job="apiserver",verb=~"POST|PUT|PATCH|DELETE",subresource!~"proxy|attach|log|exec|portforward"}[1h]))
            -
            sum by (cluster) (rate(apiserver_request_sli_duration_seconds_bucket{job="apiserver",verb=~"POST|PUT|PATCH|DELETE",subresource!~"proxy|attach|log|exec|portforward",le=~"1(\\.0)?"}[1h]))
          )
          +
          sum by (cluster) (rate(apiserver_request_total{job="apiserver",verb=~"POST|PUT|PATCH|DELETE",code=~"5.."}[1h]))
        )
        /
        sum by (cluster) (rate(apiserver_request_total{job="apiserver",verb=~"POST|PUT|PATCH|DELETE"}[1h]))
      labels:
        verb: write
      record: "apiserver_request:burnrate1h"
    - expr: |
        (
          (
            # too slow
            sum by (cluster) (rate(apiserver_request_sli_duration_seconds_count{job="apiserver",verb=~"POST|PUT|PATCH|DELETE",subresource!~"proxy|attach|log|exec|portforward"}[2h]))
            -
            sum by (cluster) (rate(apiserver_request_sli_duration_seconds_bucket{job="apiserver",verb=~"POST|PUT|PATCH|DELETE",subresource!~"proxy|attach|log|exec|portforward",le=~"1(\\.0)?"}[2h]))
          )
          +
          sum by (cluster) (rate(apiserver_request_total{job="apiserver",verb=~"POST|PUT|PATCH|DELETE",code=~"5.."}[2h]))
        )
        /
        sum by (cluster) (rate(apiserver_request_total{job="apiserver",verb=~"POST|PUT|PATCH|DELETE"}[2h]))
      labels:
        verb: write
      record: "apiserver_request:burnrate2h"
    - expr: |
        (
          (
            # too slow
            sum by (cluster) (rate(apiserver_request_sli_duration_seconds_count{job="apiserver",verb=~"POST|PUT|PATCH|DELETE",subresource!~"proxy|attach|log|exec|portforward"}[30m]))
            -
            sum by (cluster) (rate(apiserver_request_sli_duration_seconds_bucket{job="apiserver",verb=~"POST|PUT|PATCH|DELETE",subresource!~"proxy|attach|log|exec|portforward",le=~"1(\\.0)?"}[30m]))
          )
          +
          sum by (cluster) (rate(apiserver_request_total{job="apiserver",verb=~"POST|PUT|PATCH|DELETE",code=~"5.."}[30m]))
        )
        /
        sum by (cluster) (rate(apiserver_request_total{job="apiserver",verb=~"POST|PUT|PATCH|DELETE"}[30m]))
      labels:
        verb: write
      record: "apiserver_request:burnrate30m"
    - expr: |
        (
          (
            # too slow
            sum by (cluster) (rate(apiserver_request_sli_duration_seconds_count{job="apiserver",verb=~"POST|PUT|PATCH|DELETE",subresource!~"proxy|attach|log|exec|portforward"}[3d]))
            -
            sum by (cluster) (rate(apiserver_request_sli_duration_seconds_bucket{job="apiserver",verb=~"POST|PUT|PATCH|DELETE",subresource!~"proxy|attach|log|exec|portforward",le=~"1(\\.0)?"}[3d]))
          )
          +
          sum by (cluster) (rate(apiserver_request_total{job="apiserver",verb=~"POST|PUT|PATCH|DELETE",code=~"5.."}[3d]))
        )
        /
        sum by (cluster) (rate(apiserver_request_total{job="apiserver",verb=~"POST|PUT|PATCH|DELETE"}[3d]))
      labels:
        verb: write
      record: "apiserver_request:burnrate3d"
    - expr: |
        (
          (
            # too slow
            sum by (cluster) (rate(apiserver_request_sli_duration_seconds_count{job="apiserver",verb=~"POST|PUT|PATCH|DELETE",subresource!~"proxy|attach|log|exec|portforward"}[5m]))
            -
            sum by (cluster) (rate(apiserver_request_sli_duration_seconds_bucket{job="apiserver",verb=~"POST|PUT|PATCH|DELETE",subresource!~"proxy|attach|log|exec|portforward",le=~"1(\\.0)?"}[5m]))
          )
          +
          sum by (cluster) (rate(apiserver_request_total{job="apiserver",verb=~"POST|PUT|PATCH|DELETE",code=~"5.."}[5m]))
        )
        /
        sum by (cluster) (rate(apiserver_request_total{job="apiserver",verb=~"POST|PUT|PATCH|DELETE"}[5m]))
      labels:
        verb: write
      record: "apiserver_request:burnrate5m"
    - expr: |
        (
          (
            # too slow
            sum by (cluster) (rate(apiserver_request_sli_duration_seconds_count{job="apiserver",verb=~"POST|PUT|PATCH|DELETE",subresource!~"proxy|attach|log|exec|portforward"}[6h]))
            -
            sum by (cluster) (rate(apiserver_request_sli_duration_seconds_bucket{job="apiserver",verb=~"POST|PUT|PATCH|DELETE",subresource!~"proxy|attach|log|exec|portforward",le=~"1(\\.0)?"}[6h]))
          )
          +
          sum by (cluster) (rate(apiserver_request_total{job="apiserver",verb=~"POST|PUT|PATCH|DELETE",code=~"5.."}[6h]))
        )
        /
        sum by (cluster) (rate(apiserver_request_total{job="apiserver",verb=~"POST|PUT|PATCH|DELETE"}[6h]))
      labels:
        verb: write
      record: "apiserver_request:burnrate6h"
    
  

spec.groups.kubernetes-apps.rules.KubeJobNotCompleted.expr  (monitoring.coreos.com/v1/PrometheusRule/monitoring/kube-prometheus-stack-kubernetes-apps)
  ± value change in multiline text (one insert, one deletion)
      time() - max by (namespace, job_name, cluster) (kube_job_status_start_time{job="kube-state-metrics", namespace=~".*"}
        and
    - kube_job_status_active{job="kube-state-metrics", namespace=~".*"} > 0) > 43200
    -   unless on (namespace, job_name, cluster)
    - max by (namespace, job_name, cluster) (kube_job_labels{job="kube-state-metrics", namespace=~".*",label_excluded_from_alerts="true"} == 1)
    + kube_job_status_active{job="kube-state-metrics", namespace=~".*"} > 0) > 43200
  
  

spec.groups.kubernetes-apps.rules.KubePdbNotEnoughHealthyPods.expr  (monitoring.coreos.com/v1/PrometheusRule/monitoring/kube-prometheus-stack-kubernetes-apps)
  ± value change in multiline text (no inserts, one deletion)
      (
        kube_poddisruptionbudget_status_desired_healthy{job="kube-state-metrics", namespace=~".*"}
        -
        kube_poddisruptionbudget_status_current_healthy{job="kube-state-metrics", namespace=~".*"}
      )
    - > 0
    - and
    - kube_poddisruptionbudget_status_expected_pods{job="kube-state-metrics", namespace=~".*"}
      > 0
  
  

spec.endpoints.0  (monitoring.coreos.com/v1/ServiceMonitor/monitoring/kube-prometheus-stack-coredns)
  - one map entry removed:
    authorization:
      type: Bearer
      credentials:
        name: kube-prometheus-stack-prometheus-token
        key: token
  
  + one map entry added:
    bearerTokenFile: /var/run/secrets/kubernetes.io/serviceaccount/token
  

spec.endpoints.0  (monitoring.coreos.com/v1/ServiceMonitor/monitoring/kube-prometheus-stack-apiserver)
  - one map entry removed:
    authorization:
      type: Bearer
      credentials:
        name: kube-prometheus-stack-prometheus-token
        key: token
  
  + one map entry added:
    bearerTokenFile: /var/run/secrets/kubernetes.io/serviceaccount/token
  

spec.endpoints.0.tlsConfig  (monitoring.coreos.com/v1/ServiceMonitor/monitoring/kube-prometheus-stack-apiserver)
  - one map entry removed:
    ca:
      configMap:
        name: kube-root-ca.crt
        key: ca.crt
  
  + one map entry added:
    caFile: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
  

spec.endpoints.0  (monitoring.coreos.com/v1/ServiceMonitor/monitoring/kube-prometheus-stack-kube-controller-manager)
  - one map entry removed:
    authorization:
      type: Bearer
      credentials:
        name: kube-prometheus-stack-prometheus-token
        key: token
  
  + one map entry added:
    bearerTokenFile: /var/run/secrets/kubernetes.io/serviceaccount/token
  

spec.endpoints.0.tlsConfig  (monitoring.coreos.com/v1/ServiceMonitor/monitoring/kube-prometheus-stack-kube-controller-manager)
  - one map entry removed:
    ca:
      configMap:
        name: kube-root-ca.crt
        key: ca.crt
  
  + one map entry added:
    caFile: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
  

spec.endpoints.0  (monitoring.coreos.com/v1/ServiceMonitor/monitoring/kube-prometheus-stack-kube-etcd)
  - one map entry removed:
    authorization:
      type: Bearer
      credentials:
        name: kube-prometheus-stack-prometheus-token
        key: token
  
  + one map entry added:
    bearerTokenFile: /var/run/secrets/kubernetes.io/serviceaccount/token
  

spec.endpoints.0  (monitoring.coreos.com/v1/ServiceMonitor/monitoring/kube-prometheus-stack-kube-scheduler)
  - one map entry removed:
    authorization:
      type: Bearer
      credentials:
        name: kube-prometheus-stack-prometheus-token
        key: token
  
  + one map entry added:
    bearerTokenFile: /var/run/secrets/kubernetes.io/serviceaccount/token
  

spec.endpoints.0.tlsConfig  (monitoring.coreos.com/v1/ServiceMonitor/monitoring/kube-prometheus-stack-kube-scheduler)
  - one map entry removed:
    ca:
      configMap:
        name: kube-root-ca.crt
        key: ca.crt
  
  + one map entry added:
    caFile: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
  

spec.endpoints  (monitoring.coreos.com/v1/ServiceMonitor/monitoring/kube-prometheus-stack-kubelet)
  - three list entries removed:
    - authorization:
        type: Bearer
        credentials:
          name: kube-prometheus-stack-prometheus-token
          key: token
      honorLabels: true
      honorTimestamps: true
      metricRelabelings:
      - action: drop
        regex: (csi_operations|storage_operation_duration)_seconds_bucket;(0.25|2.5|15|25|120|600)(\.0)?
        sourceLabels:
        - __name__
        - le
      port: https-metrics
      relabelings:
      - action: replace
        sourceLabels:
        - __metrics_path__
        targetLabel: metrics_path
      scheme: https
      tlsConfig:
        ca:
          configMap:
            name: kube-root-ca.crt
            key: ca.crt
        insecureSkipVerify: true
    - authorization:
        type: Bearer
        credentials:
          name: kube-prometheus-stack-prometheus-token
          key: token
      honorLabels: true
      honorTimestamps: true
      interval: 10s
      metricRelabelings:
      - action: drop
        regex: container_cpu_(cfs_throttled_seconds_total|load_average_10s|system_seconds_total|user_seconds_total)
        sourceLabels:
        - __name__
      - action: drop
        regex: container_fs_(io_current|io_time_seconds_total|io_time_weighted_seconds_total|reads_merged_total|sector_reads_total|sector_writes_total|writes_merged_total)
        sourceLabels:
        - __name__
      - action: drop
        regex: container_memory_(mapped_file|swap)
        sourceLabels:
        - __name__
      - action: drop
        regex: container_(file_descriptors|tasks_state|threads_max)
        sourceLabels:
        - __name__
      - action: drop
        regex: container_memory_failures_total;hierarchy
        sourceLabels:
        - __name__
        - scope
      - action: drop
        regex: "container_network_.*;(cali|cilium|cni|lxc|nodelocaldns|tunl).*"
        sourceLabels:
        - __name__
        - interface
      - action: drop
        regex: "container_spec.*"
        sourceLabels:
        - __name__
      - action: drop
        regex: .+;
        sourceLabels:
        - id
        - pod
      path: /metrics/cadvisor
      port: https-metrics
      relabelings:
      - action: replace
        sourceLabels:
        - __metrics_path__
        targetLabel: metrics_path
      scheme: https
      tlsConfig:
        ca:
          configMap:
            name: kube-root-ca.crt
            key: ca.crt
        insecureSkipVerify: true
      trackTimestampsStaleness: true
    - authorization:
        type: Bearer
        credentials:
          name: kube-prometheus-stack-prometheus-token
          key: token
      honorLabels: true
      honorTimestamps: true
      path: /metrics/probes
      port: https-metrics
      relabelings:
      - action: replace
        sourceLabels:
        - __metrics_path__
        targetLabel: metrics_path
      scheme: https
      tlsConfig:
        ca:
          configMap:
            name: kube-root-ca.crt
            key: ca.crt
        insecureSkipVerify: true
    
  
  + three list entries added:
    - bearerTokenFile: /var/run/secrets/kubernetes.io/serviceaccount/token
      honorLabels: true
      honorTimestamps: true
      metricRelabelings:
      - action: drop
        regex: (csi_operations|storage_operation_duration)_seconds_bucket;(0.25|2.5|15|25|120|600)(\.0)?
        sourceLabels:
        - __name__
        - le
      port: https-metrics
      relabelings:
      - action: replace
        sourceLabels:
        - __metrics_path__
        targetLabel: metrics_path
      scheme: https
      tlsConfig:
        caFile: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
        insecureSkipVerify: true
    - bearerTokenFile: /var/run/secrets/kubernetes.io/serviceaccount/token
      honorLabels: true
      honorTimestamps: true
      interval: 10s
      metricRelabelings:
      - action: drop
        regex: container_cpu_(cfs_throttled_seconds_total|load_average_10s|system_seconds_total|user_seconds_total)
        sourceLabels:
        - __name__
      - action: drop
        regex: container_fs_(io_current|io_time_seconds_total|io_time_weighted_seconds_total|reads_merged_total|sector_reads_total|sector_writes_total|writes_merged_total)
        sourceLabels:
        - __name__
      - action: drop
        regex: container_memory_(mapped_file|swap)
        sourceLabels:
        - __name__
      - action: drop
        regex: container_(file_descriptors|tasks_state|threads_max)
        sourceLabels:
        - __name__
      - action: drop
        regex: container_memory_failures_total;hierarchy
        sourceLabels:
        - __name__
        - scope
      - action: drop
        regex: "container_network_.*;(cali|cilium|cni|lxc|nodelocaldns|tunl).*"
        sourceLabels:
        - __name__
        - interface
      - action: drop
        regex: "container_spec.*"
        sourceLabels:
        - __name__
      - action: drop
        regex: .+;
        sourceLabels:
        - id
        - pod
      path: /metrics/cadvisor
      port: https-metrics
      relabelings:
      - action: replace
        sourceLabels:
        - __metrics_path__
        targetLabel: metrics_path
      scheme: https
      tlsConfig:
        caFile: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
        insecureSkipVerify: true
      trackTimestampsStaleness: true
    - bearerTokenFile: /var/run/secrets/kubernetes.io/serviceaccount/token
      honorLabels: true
      honorTimestamps: true
      path: /metrics/probes
      port: https-metrics
      relabelings:
      - action: replace
        sourceLabels:
        - __metrics_path__
        targetLabel: metrics_path
      scheme: https
      tlsConfig:
        caFile: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
        insecureSkipVerify: true
    
  

spec.template.spec.containers.create.image  (batch/v1/Job/monitoring/kube-prometheus-stack-admission-create)
  ± value change
    - ghcr.io/jkroepke/kube-webhook-certgen:1.8.9
    + ghcr.io/jkroepke/kube-webhook-certgen:1.8.4

spec.template.spec.containers.patch.image  (batch/v1/Job/monitoring/kube-prometheus-stack-admission-patch)
  ± value change
    - ghcr.io/jkroepke/kube-webhook-certgen:1.8.9
    + ghcr.io/jkroepke/kube-webhook-certgen:1.8.4

Pipeline

## flate diff ``` rules (rbac.authorization.k8s.io/v1/ClusterRole/kube-prometheus-stack-operator) - six list entries removed: + three list entries added: - resources: - resources: - alertmanagers - alertmanagers - prometheusagents - alertmanagers/finalizers - prometheuses - alertmanagers/status - thanosrulers - alertmanagerconfigs apiGroups: - prometheuses - monitoring.coreos.com - prometheuses/finalizers verbs: - prometheuses/status - patch - prometheusagents - resources: - prometheusagents/finalizers - alertmanagers/status - prometheusagents/status - podmonitors/status - thanosrulers - probes/status - thanosrulers/finalizers - prometheuses/status - thanosrulers/status - prometheusagents/status - scrapeconfigs - prometheusrules/status - scrapeconfigs/status - scrapeconfigs/status - servicemonitors - servicemonitors/status - servicemonitors/status - thanosrulers/status - podmonitors apiGroups: - podmonitors/status - monitoring.coreos.com - probes verbs: - probes/status - create - prometheusrules - update - prometheusrules/status - patch apiGroups: - delete - monitoring.coreos.com - resources: verbs: - alertmanagers/finalizers - "*" - prometheusagents/finalizers - resources: - prometheuses/finalizers - statefulsets - thanosrulers/finalizers apiGroups: apiGroups: - apps - monitoring.coreos.com verbs: verbs: - "*" - update - resources: - resources: - configmaps - alertmanagers - secrets - alertmanagerconfigs apiGroups: - podmonitors - - probes verbs: - prometheusagents - "*" - prometheuses - prometheusrules - servicemonitors - scrapeconfigs - thanosrulers apiGroups: - monitoring.coreos.com verbs: - get - list - watch - resources: - statefulsets apiGroups: - apps verbs: - get - list - watch - create - update - patch - delete - resources: - configmaps - secrets apiGroups: - verbs: - get - list - watch - create - update - delete metadata (v1/Service/kube-privileged/node-exporter) + one map entry added: annotations: prometheus.io/scrape: "true" spec.template.spec.containers.kube-state-metrics.image (apps/v1/Deployment/monitoring/kube-state-metrics) ± value change - registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.20.0 + registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.19.1 spec.template.spec.containers.kube-prometheus-stack.args (apps/v1/Deployment/monitoring/kube-prometheus-stack-operator) - three list entries removed: - "--prometheus-config-reloader=quay.io/prometheus-operator/prometheus-config-reloader:v0.94.1" - "--thanos-default-base-image=quay.io/thanos/thanos:v0.42.4" - "--secret-field-selector=type!=kubernetes.io/dockercfg,type!=helm.sh/release.v1" + three list entries added: - "--prometheus-config-reloader=quay.io/prometheus-operator/prometheus-config-reloader:v0.92.1" - "--thanos-default-base-image=quay.io/thanos/thanos:v0.42.2" - "--secret-field-selector=type!=kubernetes.io/dockercfg,type!=kubernetes.io/service-account-token,type!=helm.sh/release.v1" spec.template.spec.containers.kube-prometheus-stack.image (apps/v1/Deployment/monitoring/kube-prometheus-stack-operator) ± value change - quay.io/prometheus-operator/prometheus-operator:v0.94.1 + quay.io/prometheus-operator/prometheus-operator:v0.92.1 spec (monitoring.coreos.com/v1/Alertmanager/monitoring/kube-prometheus-stack) + one map entry added: hostNetwork: false spec.image (monitoring.coreos.com/v1/Alertmanager/monitoring/kube-prometheus-stack) ± value change - quay.io/prometheus/alertmanager:v0.34.1 + quay.io/prometheus/alertmanager:v0.33.1 spec.version (monitoring.coreos.com/v1/Alertmanager/monitoring/kube-prometheus-stack) ± value change - v0.34.1 + v0.33.1 spec.image (monitoring.coreos.com/v1/Prometheus/monitoring/kube-prometheus-stack) ± value change - quay.io/prometheus/prometheus:v3.15.0-distroless + quay.io/prometheus/prometheus:v3.13.1-distroless spec.version (monitoring.coreos.com/v1/Prometheus/monitoring/kube-prometheus-stack) ± value change - v3.15.0-distroless + v3.13.1-distroless spec.groups.kube-apiserver-burnrate.rules.rules (monitoring.coreos.com/v1/PrometheusRule/monitoring/kube-prometheus-stack-kube-apiserver-burnrate.rules) - eleven list entries removed: - expr: | ( ( # too slow sum by (cluster) (rate(apiserver_request_sli_duration_seconds_count{job="apiserver",verb=~"LIST|GET",subresource!~"proxy|attach|log|exec|portforward"}[5m])) - ( ( sum by (cluster) (rate(apiserver_request_sli_duration_seconds_bucket{job="apiserver",verb=~"LIST|GET",subresource!~"proxy|attach|log|exec|portforward",scope=~"resource|",le=~"1(\\.0)?"}[5m])) or vector(0) ) + sum by (cluster) (rate(apiserver_request_sli_duration_seconds_bucket{job="apiserver",verb=~"LIST|GET",subresource!~"proxy|attach|log|exec|portforward",scope="namespace",le=~"5(\\.0)?"}[5m])) + sum by (cluster) (rate(apiserver_request_sli_duration_seconds_bucket{job="apiserver",verb=~"LIST|GET",subresource!~"proxy|attach|log|exec|portforward",scope="cluster",le=~"30(\\.0)?"}[5m])) ) ) + # errors sum by (cluster) (rate(apiserver_request_total{job="apiserver",verb=~"LIST|GET",code=~"5.."}[5m])) ) labels: verb: read record: "cluster_verb:apiserver_request_sli_bad_events:rate5m" - expr: | ( ( # too slow sum by (cluster) (rate(apiserver_request_sli_duration_seconds_count{job="apiserver",verb=~"POST|PUT|PATCH|DELETE",subresource!~"proxy|attach|log|exec|portforward"}[5m])) - sum by (cluster) (rate(apiserver_request_sli_duration_seconds_bucket{job="apiserver",verb=~"POST|PUT|PATCH|DELETE",subresource!~"proxy|attach|log|exec|portforward",le=~"1(\\.0)?"}[5m])) ) + # errors sum by (cluster) (rate(apiserver_request_total{job="apiserver",verb=~"POST|PUT|PATCH|DELETE",code=~"5.."}[5m])) ) labels: verb: write record: "cluster_verb:apiserver_request_sli_bad_events:rate5m" - expr: "sum by (cluster) (rate(apiserver_request_total{job=\"apiserver\",verb=~\"LIST|GET\"}[5m]))" labels: verb: read record: "cluster_verb:apiserver_request_sli_events:rate5m" - expr: "sum by (cluster) (rate(apiserver_request_total{job=\"apiserver\",verb=~\"POST|PUT|PATCH|DELETE\"}[5m]))" labels: verb: write record: "cluster_verb:apiserver_request_sli_events:rate5m" - expr: | cluster_verb:apiserver_request_sli_bad_events:rate5m / cluster_verb:apiserver_request_sli_events:rate5m record: "apiserver_request:burnrate5m" - expr: | ( ( # too slow sum by (cluster) (rate(apiserver_request_sli_duration_seconds_count{job="apiserver",verb=~"POST|PUT|PATCH|DELETE",subresource!~"proxy|attach|log|exec|portforward"}[1h])) - sum by (cluster) (rate(apiserver_request_sli_duration_seconds_bucket{job="apiserver",verb=~"POST|PUT|PATCH|DELETE",subresource!~"proxy|attach|log|exec|portforward",le=~"1(\\.0)?"}[1h])) ) + # errors sum by (cluster) (rate(apiserver_request_total{job="apiserver",verb=~"POST|PUT|PATCH|DELETE",code=~"5.."}[1h])) ) / sum by (cluster) (rate(apiserver_request_total{job="apiserver",verb=~"POST|PUT|PATCH|DELETE"}[1h])) labels: verb: write record: "apiserver_request:burnrate1h" - expr: | ( ( # too slow sum by (cluster) (rate(apiserver_request_sli_duration_seconds_count{job="apiserver",verb=~"POST|PUT|PATCH|DELETE",subresource!~"proxy|attach|log|exec|portforward"}[2h])) - sum by (cluster) (rate(apiserver_request_sli_duration_seconds_bucket{job="apiserver",verb=~"POST|PUT|PATCH|DELETE",subresource!~"proxy|attach|log|exec|portforward",le=~"1(\\.0)?"}[2h])) ) + # errors sum by (cluster) (rate(apiserver_request_total{job="apiserver",verb=~"POST|PUT|PATCH|DELETE",code=~"5.."}[2h])) ) / sum by (cluster) (rate(apiserver_request_total{job="apiserver",verb=~"POST|PUT|PATCH|DELETE"}[2h])) labels: verb: write record: "apiserver_request:burnrate2h" - expr: | ( ( # too slow sum by (cluster) (rate(apiserver_request_sli_duration_seconds_count{job="apiserver",verb=~"POST|PUT|PATCH|DELETE",subresource!~"proxy|attach|log|exec|portforward"}[30m])) - sum by (cluster) (rate(apiserver_request_sli_duration_seconds_bucket{job="apiserver",verb=~"POST|PUT|PATCH|DELETE",subresource!~"proxy|attach|log|exec|portforward",le=~"1(\\.0)?"}[30m])) ) + # errors sum by (cluster) (rate(apiserver_request_total{job="apiserver",verb=~"POST|PUT|PATCH|DELETE",code=~"5.."}[30m])) ) / sum by (cluster) (rate(apiserver_request_total{job="apiserver",verb=~"POST|PUT|PATCH|DELETE"}[30m])) labels: verb: write record: "apiserver_request:burnrate30m" - expr: | ( ( # too slow sum by (cluster) (rate(apiserver_request_sli_duration_seconds_count{job="apiserver",verb=~"POST|PUT|PATCH|DELETE",subresource!~"proxy|attach|log|exec|portforward"}[6h])) - sum by (cluster) (rate(apiserver_request_sli_duration_seconds_bucket{job="apiserver",verb=~"POST|PUT|PATCH|DELETE",subresource!~"proxy|attach|log|exec|portforward",le=~"1(\\.0)?"}[6h])) ) + # errors sum by (cluster) (rate(apiserver_request_total{job="apiserver",verb=~"POST|PUT|PATCH|DELETE",code=~"5.."}[6h])) ) / sum by (cluster) (rate(apiserver_request_total{job="apiserver",verb=~"POST|PUT|PATCH|DELETE"}[6h])) labels: verb: write record: "apiserver_request:burnrate6h" - expr: | avg_over_time(cluster_verb:apiserver_request_sli_bad_events:rate5m[1d]) / avg_over_time(cluster_verb:apiserver_request_sli_events:rate5m[1d]) record: "apiserver_request:burnrate1d" - expr: | avg_over_time(cluster_verb:apiserver_request_sli_bad_events:rate5m[3d]) / avg_over_time(cluster_verb:apiserver_request_sli_events:rate5m[3d]) record: "apiserver_request:burnrate3d" + ten list entries added: - expr: | ( ( # too slow sum by (cluster) (rate(apiserver_request_sli_duration_seconds_count{job="apiserver",verb=~"LIST|GET",subresource!~"proxy|attach|log|exec|portforward"}[1d])) - ( ( sum by (cluster) (rate(apiserver_request_sli_duration_seconds_bucket{job="apiserver",verb=~"LIST|GET",subresource!~"proxy|attach|log|exec|portforward",scope=~"resource|",le=~"1(\\.0)?"}[1d])) or vector(0) ) + sum by (cluster) (rate(apiserver_request_sli_duration_seconds_bucket{job="apiserver",verb=~"LIST|GET",subresource!~"proxy|attach|log|exec|portforward",scope="namespace",le=~"5(\\.0)?"}[1d])) + sum by (cluster) (rate(apiserver_request_sli_duration_seconds_bucket{job="apiserver",verb=~"LIST|GET",subresource!~"proxy|attach|log|exec|portforward",scope="cluster",le=~"30(\\.0)?"}[1d])) ) ) + # errors sum by (cluster) (rate(apiserver_request_total{job="apiserver",verb=~"LIST|GET",code=~"5.."}[1d])) ) / sum by (cluster) (rate(apiserver_request_total{job="apiserver",verb=~"LIST|GET"}[1d])) labels: verb: read record: "apiserver_request:burnrate1d" - expr: | ( ( # too slow sum by (cluster) (rate(apiserver_request_sli_duration_seconds_count{job="apiserver",verb=~"LIST|GET",subresource!~"proxy|attach|log|exec|portforward"}[3d])) - ( ( sum by (cluster) (rate(apiserver_request_sli_duration_seconds_bucket{job="apiserver",verb=~"LIST|GET",subresource!~"proxy|attach|log|exec|portforward",scope=~"resource|",le=~"1(\\.0)?"}[3d])) or vector(0) ) + sum by (cluster) (rate(apiserver_request_sli_duration_seconds_bucket{job="apiserver",verb=~"LIST|GET",subresource!~"proxy|attach|log|exec|portforward",scope="namespace",le=~"5(\\.0)?"}[3d])) + sum by (cluster) (rate(apiserver_request_sli_duration_seconds_bucket{job="apiserver",verb=~"LIST|GET",subresource!~"proxy|attach|log|exec|portforward",scope="cluster",le=~"30(\\.0)?"}[3d])) ) ) + # errors sum by (cluster) (rate(apiserver_request_total{job="apiserver",verb=~"LIST|GET",code=~"5.."}[3d])) ) / sum by (cluster) (rate(apiserver_request_total{job="apiserver",verb=~"LIST|GET"}[3d])) labels: verb: read record: "apiserver_request:burnrate3d" - expr: | ( ( # too slow sum by (cluster) (rate(apiserver_request_sli_duration_seconds_count{job="apiserver",verb=~"LIST|GET",subresource!~"proxy|attach|log|exec|portforward"}[5m])) - ( ( sum by (cluster) (rate(apiserver_request_sli_duration_seconds_bucket{job="apiserver",verb=~"LIST|GET",subresource!~"proxy|attach|log|exec|portforward",scope=~"resource|",le=~"1(\\.0)?"}[5m])) or vector(0) ) + sum by (cluster) (rate(apiserver_request_sli_duration_seconds_bucket{job="apiserver",verb=~"LIST|GET",subresource!~"proxy|attach|log|exec|portforward",scope="namespace",le=~"5(\\.0)?"}[5m])) + sum by (cluster) (rate(apiserver_request_sli_duration_seconds_bucket{job="apiserver",verb=~"LIST|GET",subresource!~"proxy|attach|log|exec|portforward",scope="cluster",le=~"30(\\.0)?"}[5m])) ) ) + # errors sum by (cluster) (rate(apiserver_request_total{job="apiserver",verb=~"LIST|GET",code=~"5.."}[5m])) ) / sum by (cluster) (rate(apiserver_request_total{job="apiserver",verb=~"LIST|GET"}[5m])) labels: verb: read record: "apiserver_request:burnrate5m" - expr: | ( ( # too slow sum by (cluster) (rate(apiserver_request_sli_duration_seconds_count{job="apiserver",verb=~"POST|PUT|PATCH|DELETE",subresource!~"proxy|attach|log|exec|portforward"}[1d])) - sum by (cluster) (rate(apiserver_request_sli_duration_seconds_bucket{job="apiserver",verb=~"POST|PUT|PATCH|DELETE",subresource!~"proxy|attach|log|exec|portforward",le=~"1(\\.0)?"}[1d])) ) + sum by (cluster) (rate(apiserver_request_total{job="apiserver",verb=~"POST|PUT|PATCH|DELETE",code=~"5.."}[1d])) ) / sum by (cluster) (rate(apiserver_request_total{job="apiserver",verb=~"POST|PUT|PATCH|DELETE"}[1d])) labels: verb: write record: "apiserver_request:burnrate1d" - expr: | ( ( # too slow sum by (cluster) (rate(apiserver_request_sli_duration_seconds_count{job="apiserver",verb=~"POST|PUT|PATCH|DELETE",subresource!~"proxy|attach|log|exec|portforward"}[1h])) - sum by (cluster) (rate(apiserver_request_sli_duration_seconds_bucket{job="apiserver",verb=~"POST|PUT|PATCH|DELETE",subresource!~"proxy|attach|log|exec|portforward",le=~"1(\\.0)?"}[1h])) ) + sum by (cluster) (rate(apiserver_request_total{job="apiserver",verb=~"POST|PUT|PATCH|DELETE",code=~"5.."}[1h])) ) / sum by (cluster) (rate(apiserver_request_total{job="apiserver",verb=~"POST|PUT|PATCH|DELETE"}[1h])) labels: verb: write record: "apiserver_request:burnrate1h" - expr: | ( ( # too slow sum by (cluster) (rate(apiserver_request_sli_duration_seconds_count{job="apiserver",verb=~"POST|PUT|PATCH|DELETE",subresource!~"proxy|attach|log|exec|portforward"}[2h])) - sum by (cluster) (rate(apiserver_request_sli_duration_seconds_bucket{job="apiserver",verb=~"POST|PUT|PATCH|DELETE",subresource!~"proxy|attach|log|exec|portforward",le=~"1(\\.0)?"}[2h])) ) + sum by (cluster) (rate(apiserver_request_total{job="apiserver",verb=~"POST|PUT|PATCH|DELETE",code=~"5.."}[2h])) ) / sum by (cluster) (rate(apiserver_request_total{job="apiserver",verb=~"POST|PUT|PATCH|DELETE"}[2h])) labels: verb: write record: "apiserver_request:burnrate2h" - expr: | ( ( # too slow sum by (cluster) (rate(apiserver_request_sli_duration_seconds_count{job="apiserver",verb=~"POST|PUT|PATCH|DELETE",subresource!~"proxy|attach|log|exec|portforward"}[30m])) - sum by (cluster) (rate(apiserver_request_sli_duration_seconds_bucket{job="apiserver",verb=~"POST|PUT|PATCH|DELETE",subresource!~"proxy|attach|log|exec|portforward",le=~"1(\\.0)?"}[30m])) ) + sum by (cluster) (rate(apiserver_request_total{job="apiserver",verb=~"POST|PUT|PATCH|DELETE",code=~"5.."}[30m])) ) / sum by (cluster) (rate(apiserver_request_total{job="apiserver",verb=~"POST|PUT|PATCH|DELETE"}[30m])) labels: verb: write record: "apiserver_request:burnrate30m" - expr: | ( ( # too slow sum by (cluster) (rate(apiserver_request_sli_duration_seconds_count{job="apiserver",verb=~"POST|PUT|PATCH|DELETE",subresource!~"proxy|attach|log|exec|portforward"}[3d])) - sum by (cluster) (rate(apiserver_request_sli_duration_seconds_bucket{job="apiserver",verb=~"POST|PUT|PATCH|DELETE",subresource!~"proxy|attach|log|exec|portforward",le=~"1(\\.0)?"}[3d])) ) + sum by (cluster) (rate(apiserver_request_total{job="apiserver",verb=~"POST|PUT|PATCH|DELETE",code=~"5.."}[3d])) ) / sum by (cluster) (rate(apiserver_request_total{job="apiserver",verb=~"POST|PUT|PATCH|DELETE"}[3d])) labels: verb: write record: "apiserver_request:burnrate3d" - expr: | ( ( # too slow sum by (cluster) (rate(apiserver_request_sli_duration_seconds_count{job="apiserver",verb=~"POST|PUT|PATCH|DELETE",subresource!~"proxy|attach|log|exec|portforward"}[5m])) - sum by (cluster) (rate(apiserver_request_sli_duration_seconds_bucket{job="apiserver",verb=~"POST|PUT|PATCH|DELETE",subresource!~"proxy|attach|log|exec|portforward",le=~"1(\\.0)?"}[5m])) ) + sum by (cluster) (rate(apiserver_request_total{job="apiserver",verb=~"POST|PUT|PATCH|DELETE",code=~"5.."}[5m])) ) / sum by (cluster) (rate(apiserver_request_total{job="apiserver",verb=~"POST|PUT|PATCH|DELETE"}[5m])) labels: verb: write record: "apiserver_request:burnrate5m" - expr: | ( ( # too slow sum by (cluster) (rate(apiserver_request_sli_duration_seconds_count{job="apiserver",verb=~"POST|PUT|PATCH|DELETE",subresource!~"proxy|attach|log|exec|portforward"}[6h])) - sum by (cluster) (rate(apiserver_request_sli_duration_seconds_bucket{job="apiserver",verb=~"POST|PUT|PATCH|DELETE",subresource!~"proxy|attach|log|exec|portforward",le=~"1(\\.0)?"}[6h])) ) + sum by (cluster) (rate(apiserver_request_total{job="apiserver",verb=~"POST|PUT|PATCH|DELETE",code=~"5.."}[6h])) ) / sum by (cluster) (rate(apiserver_request_total{job="apiserver",verb=~"POST|PUT|PATCH|DELETE"}[6h])) labels: verb: write record: "apiserver_request:burnrate6h" spec.groups.kubernetes-apps.rules.KubeJobNotCompleted.expr (monitoring.coreos.com/v1/PrometheusRule/monitoring/kube-prometheus-stack-kubernetes-apps) ± value change in multiline text (one insert, one deletion) time() - max by (namespace, job_name, cluster) (kube_job_status_start_time{job="kube-state-metrics", namespace=~".*"} and - kube_job_status_active{job="kube-state-metrics", namespace=~".*"} > 0) > 43200 - unless on (namespace, job_name, cluster) - max by (namespace, job_name, cluster) (kube_job_labels{job="kube-state-metrics", namespace=~".*",label_excluded_from_alerts="true"} == 1) + kube_job_status_active{job="kube-state-metrics", namespace=~".*"} > 0) > 43200 spec.groups.kubernetes-apps.rules.KubePdbNotEnoughHealthyPods.expr (monitoring.coreos.com/v1/PrometheusRule/monitoring/kube-prometheus-stack-kubernetes-apps) ± value change in multiline text (no inserts, one deletion) ( kube_poddisruptionbudget_status_desired_healthy{job="kube-state-metrics", namespace=~".*"} - kube_poddisruptionbudget_status_current_healthy{job="kube-state-metrics", namespace=~".*"} ) - > 0 - and - kube_poddisruptionbudget_status_expected_pods{job="kube-state-metrics", namespace=~".*"} > 0 spec.endpoints.0 (monitoring.coreos.com/v1/ServiceMonitor/monitoring/kube-prometheus-stack-coredns) - one map entry removed: authorization: type: Bearer credentials: name: kube-prometheus-stack-prometheus-token key: token + one map entry added: bearerTokenFile: /var/run/secrets/kubernetes.io/serviceaccount/token spec.endpoints.0 (monitoring.coreos.com/v1/ServiceMonitor/monitoring/kube-prometheus-stack-apiserver) - one map entry removed: authorization: type: Bearer credentials: name: kube-prometheus-stack-prometheus-token key: token + one map entry added: bearerTokenFile: /var/run/secrets/kubernetes.io/serviceaccount/token spec.endpoints.0.tlsConfig (monitoring.coreos.com/v1/ServiceMonitor/monitoring/kube-prometheus-stack-apiserver) - one map entry removed: ca: configMap: name: kube-root-ca.crt key: ca.crt + one map entry added: caFile: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt spec.endpoints.0 (monitoring.coreos.com/v1/ServiceMonitor/monitoring/kube-prometheus-stack-kube-controller-manager) - one map entry removed: authorization: type: Bearer credentials: name: kube-prometheus-stack-prometheus-token key: token + one map entry added: bearerTokenFile: /var/run/secrets/kubernetes.io/serviceaccount/token spec.endpoints.0.tlsConfig (monitoring.coreos.com/v1/ServiceMonitor/monitoring/kube-prometheus-stack-kube-controller-manager) - one map entry removed: ca: configMap: name: kube-root-ca.crt key: ca.crt + one map entry added: caFile: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt spec.endpoints.0 (monitoring.coreos.com/v1/ServiceMonitor/monitoring/kube-prometheus-stack-kube-etcd) - one map entry removed: authorization: type: Bearer credentials: name: kube-prometheus-stack-prometheus-token key: token + one map entry added: bearerTokenFile: /var/run/secrets/kubernetes.io/serviceaccount/token spec.endpoints.0 (monitoring.coreos.com/v1/ServiceMonitor/monitoring/kube-prometheus-stack-kube-scheduler) - one map entry removed: authorization: type: Bearer credentials: name: kube-prometheus-stack-prometheus-token key: token + one map entry added: bearerTokenFile: /var/run/secrets/kubernetes.io/serviceaccount/token spec.endpoints.0.tlsConfig (monitoring.coreos.com/v1/ServiceMonitor/monitoring/kube-prometheus-stack-kube-scheduler) - one map entry removed: ca: configMap: name: kube-root-ca.crt key: ca.crt + one map entry added: caFile: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt spec.endpoints (monitoring.coreos.com/v1/ServiceMonitor/monitoring/kube-prometheus-stack-kubelet) - three list entries removed: - authorization: type: Bearer credentials: name: kube-prometheus-stack-prometheus-token key: token honorLabels: true honorTimestamps: true metricRelabelings: - action: drop regex: (csi_operations|storage_operation_duration)_seconds_bucket;(0.25|2.5|15|25|120|600)(\.0)? sourceLabels: - __name__ - le port: https-metrics relabelings: - action: replace sourceLabels: - __metrics_path__ targetLabel: metrics_path scheme: https tlsConfig: ca: configMap: name: kube-root-ca.crt key: ca.crt insecureSkipVerify: true - authorization: type: Bearer credentials: name: kube-prometheus-stack-prometheus-token key: token honorLabels: true honorTimestamps: true interval: 10s metricRelabelings: - action: drop regex: container_cpu_(cfs_throttled_seconds_total|load_average_10s|system_seconds_total|user_seconds_total) sourceLabels: - __name__ - action: drop regex: container_fs_(io_current|io_time_seconds_total|io_time_weighted_seconds_total|reads_merged_total|sector_reads_total|sector_writes_total|writes_merged_total) sourceLabels: - __name__ - action: drop regex: container_memory_(mapped_file|swap) sourceLabels: - __name__ - action: drop regex: container_(file_descriptors|tasks_state|threads_max) sourceLabels: - __name__ - action: drop regex: container_memory_failures_total;hierarchy sourceLabels: - __name__ - scope - action: drop regex: "container_network_.*;(cali|cilium|cni|lxc|nodelocaldns|tunl).*" sourceLabels: - __name__ - interface - action: drop regex: "container_spec.*" sourceLabels: - __name__ - action: drop regex: .+; sourceLabels: - id - pod path: /metrics/cadvisor port: https-metrics relabelings: - action: replace sourceLabels: - __metrics_path__ targetLabel: metrics_path scheme: https tlsConfig: ca: configMap: name: kube-root-ca.crt key: ca.crt insecureSkipVerify: true trackTimestampsStaleness: true - authorization: type: Bearer credentials: name: kube-prometheus-stack-prometheus-token key: token honorLabels: true honorTimestamps: true path: /metrics/probes port: https-metrics relabelings: - action: replace sourceLabels: - __metrics_path__ targetLabel: metrics_path scheme: https tlsConfig: ca: configMap: name: kube-root-ca.crt key: ca.crt insecureSkipVerify: true + three list entries added: - bearerTokenFile: /var/run/secrets/kubernetes.io/serviceaccount/token honorLabels: true honorTimestamps: true metricRelabelings: - action: drop regex: (csi_operations|storage_operation_duration)_seconds_bucket;(0.25|2.5|15|25|120|600)(\.0)? sourceLabels: - __name__ - le port: https-metrics relabelings: - action: replace sourceLabels: - __metrics_path__ targetLabel: metrics_path scheme: https tlsConfig: caFile: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt insecureSkipVerify: true - bearerTokenFile: /var/run/secrets/kubernetes.io/serviceaccount/token honorLabels: true honorTimestamps: true interval: 10s metricRelabelings: - action: drop regex: container_cpu_(cfs_throttled_seconds_total|load_average_10s|system_seconds_total|user_seconds_total) sourceLabels: - __name__ - action: drop regex: container_fs_(io_current|io_time_seconds_total|io_time_weighted_seconds_total|reads_merged_total|sector_reads_total|sector_writes_total|writes_merged_total) sourceLabels: - __name__ - action: drop regex: container_memory_(mapped_file|swap) sourceLabels: - __name__ - action: drop regex: container_(file_descriptors|tasks_state|threads_max) sourceLabels: - __name__ - action: drop regex: container_memory_failures_total;hierarchy sourceLabels: - __name__ - scope - action: drop regex: "container_network_.*;(cali|cilium|cni|lxc|nodelocaldns|tunl).*" sourceLabels: - __name__ - interface - action: drop regex: "container_spec.*" sourceLabels: - __name__ - action: drop regex: .+; sourceLabels: - id - pod path: /metrics/cadvisor port: https-metrics relabelings: - action: replace sourceLabels: - __metrics_path__ targetLabel: metrics_path scheme: https tlsConfig: caFile: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt insecureSkipVerify: true trackTimestampsStaleness: true - bearerTokenFile: /var/run/secrets/kubernetes.io/serviceaccount/token honorLabels: true honorTimestamps: true path: /metrics/probes port: https-metrics relabelings: - action: replace sourceLabels: - __metrics_path__ targetLabel: metrics_path scheme: https tlsConfig: caFile: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt insecureSkipVerify: true spec.template.spec.containers.create.image (batch/v1/Job/monitoring/kube-prometheus-stack-admission-create) ± value change - ghcr.io/jkroepke/kube-webhook-certgen:1.8.9 + ghcr.io/jkroepke/kube-webhook-certgen:1.8.4 spec.template.spec.containers.patch.image (batch/v1/Job/monitoring/kube-prometheus-stack-admission-patch) ± value change - ghcr.io/jkroepke/kube-webhook-certgen:1.8.9 + ghcr.io/jkroepke/kube-webhook-certgen:1.8.4 ``` [Pipeline](https://ci.aether.earth/repos/4/pipeline/465)

renovate-bot force-pushed renovate/ghcr.io-scanopy-scanopy-server-0.x from 9fa8efce6a

ci/crow/push/dns-test Pipeline was successful

Details

ci/crow/pr/dns-test Pipeline was successful

Details

ci/crow/push/tanka-test Pipeline was successful

Details

ci/crow/pr/tanka-test Pipeline was successful

Details

ci/crow/pr/tanka-diff Pipeline was successful

Details

to 836b60bff9

ci/crow/push/dns-test Pipeline was successful

Details

ci/crow/pr/dns-test Pipeline was successful

Details

ci/crow/push/tanka-test Pipeline was successful

Details

ci/crow/pr/tanka-test Pipeline was successful

Details

ci/crow/pr/tanka-diff Pipeline was successful

Details

2026-10-05 16:06:01 +00:00

Compare

renovate-bot changed title from ~~chore(deps): update ghcr.io/scanopy/scanopy/server docker tag to v0.17.20~~ to chore(deps): update ghcr.io/scanopy/scanopy/server docker tag to v0.17.21

2026-10-05 16:06:05 +00:00

ci-bot commented

2026-10-05 16:08:50 +00:00

Member

flate diff

No differences detected.

Pipeline

## flate diff No differences detected. [Pipeline](https://ci.aether.earth/repos/4/pipeline/473)

renovate-bot force-pushed renovate/ghcr.io-scanopy-scanopy-server-0.x from 836b60bff9

ci/crow/push/dns-test Pipeline was successful

Details

ci/crow/pr/dns-test Pipeline was successful

Details

ci/crow/push/tanka-test Pipeline was successful

Details

ci/crow/pr/tanka-test Pipeline was successful

Details

ci/crow/pr/tanka-diff Pipeline was successful

Details

to 74e57196e7

ci/crow/push/tanka-test Pipeline was successful

Details

ci/crow/pr/dns-test Pipeline was successful

Details

ci/crow/push/dns-test Pipeline was successful

Details

ci/crow/pr/tanka-test Pipeline was successful

Details

ci/crow/pr/tanka-diff Pipeline was successful

Details

2026-10-07 15:05:58 +00:00

Compare

renovate-bot changed title from ~~chore(deps): update ghcr.io/scanopy/scanopy/server docker tag to v0.17.21~~ to chore(deps): update ghcr.io/scanopy/scanopy/server docker tag to v0.17.22

2026-10-07 15:06:01 +00:00

ci-bot commented

2026-10-07 15:08:45 +00:00

Member

flate diff

rules  (rbac.authorization.k8s.io/v1/ClusterRole/kube-prometheus-stack-operator)
  - six list entries removed:           + three list entries added:
    - resources:                          - resources:
      - alertmanagers                       - alertmanagers
      - prometheusagents                    - alertmanagers/finalizers
      - prometheuses                        - alertmanagers/status
      - thanosrulers                        - alertmanagerconfigs
      apiGroups:                            - prometheuses
      - monitoring.coreos.com               - prometheuses/finalizers
      verbs:                                - prometheuses/status
      - patch                               - prometheusagents
    - resources:                            - prometheusagents/finalizers
      - alertmanagers/status                - prometheusagents/status
      - podmonitors/status                  - thanosrulers
      - probes/status                       - thanosrulers/finalizers
      - prometheuses/status                 - thanosrulers/status
      - prometheusagents/status             - scrapeconfigs
      - prometheusrules/status              - scrapeconfigs/status
      - scrapeconfigs/status                - servicemonitors
      - servicemonitors/status              - servicemonitors/status
      - thanosrulers/status                 - podmonitors
      apiGroups:                            - podmonitors/status
      - monitoring.coreos.com               - probes
      verbs:                                - probes/status
      - create                              - prometheusrules
      - update                              - prometheusrules/status
      - patch                               apiGroups:
      - delete                              - monitoring.coreos.com
    - resources:                            verbs:
      - alertmanagers/finalizers            - "*"
      - prometheusagents/finalizers       - resources:
      - prometheuses/finalizers             - statefulsets
      - thanosrulers/finalizers             apiGroups:
      apiGroups:                            - apps
      - monitoring.coreos.com               verbs:
      verbs:                                - "*"
      - update                            - resources:
    - resources:                            - configmaps
      - alertmanagers                       - secrets
      - alertmanagerconfigs                 apiGroups:
      - podmonitors                         -
      - probes                              verbs:
      - prometheusagents                    - "*"
      - prometheuses
      - prometheusrules
      - servicemonitors
      - scrapeconfigs
      - thanosrulers
      apiGroups:
      - monitoring.coreos.com
      verbs:
      - get
      - list
      - watch
    - resources:
      - statefulsets
      apiGroups:
      - apps
      verbs:
      - get
      - list
      - watch
      - create
      - update
      - patch
      - delete
    - resources:
      - configmaps
      - secrets
      apiGroups:
      -
      verbs:
      - get
      - list
      - watch
      - create
      - update
      - delete

metadata  (v1/Service/kube-privileged/node-exporter)
  + one map entry added:
    annotations:
      prometheus.io/scrape: "true"

spec.template.spec.containers.kube-state-metrics.image  (apps/v1/Deployment/monitoring/kube-state-metrics)
  ± value change
    - registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.20.0
    + registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.19.1

spec.template.spec  (apps/v1/Deployment/monitoring/kube-prometheus-stack-operator)
  - one map entry removed:
    nodeSelector:
      kubernetes.io/os: linux

spec.template.spec.containers.kube-prometheus-stack.args  (apps/v1/Deployment/monitoring/kube-prometheus-stack-operator)
  - three list entries removed:
    - "--prometheus-config-reloader=quay.io/prometheus-operator/prometheus-config-reloader:v0.94.1"
    - "--thanos-default-base-image=quay.io/thanos/thanos:v0.42.4"
    - "--secret-field-selector=type!=kubernetes.io/dockercfg,type!=helm.sh/release.v1"
    
  
  + three list entries added:
    - "--prometheus-config-reloader=quay.io/prometheus-operator/prometheus-config-reloader:v0.92.1"
    - "--thanos-default-base-image=quay.io/thanos/thanos:v0.42.2"
    - "--secret-field-selector=type!=kubernetes.io/dockercfg,type!=kubernetes.io/service-account-token,type!=helm.sh/release.v1"
    
  

spec.template.spec.containers.kube-prometheus-stack.image  (apps/v1/Deployment/monitoring/kube-prometheus-stack-operator)
  ± value change
    - quay.io/prometheus-operator/prometheus-operator:v0.94.1
    + quay.io/prometheus-operator/prometheus-operator:v0.92.1

spec  (monitoring.coreos.com/v1/Alertmanager/monitoring/kube-prometheus-stack)
  - one map entry removed:        + one map entry added:
    nodeSelector:                   hostNetwork: false
      kubernetes.io/os: linux

spec.image  (monitoring.coreos.com/v1/Alertmanager/monitoring/kube-prometheus-stack)
  ± value change
    - quay.io/prometheus/alertmanager:v0.34.1
    + quay.io/prometheus/alertmanager:v0.33.1

spec.version  (monitoring.coreos.com/v1/Alertmanager/monitoring/kube-prometheus-stack)
  ± value change
    - v0.34.1
    + v0.33.1

spec  (monitoring.coreos.com/v1/Prometheus/monitoring/kube-prometheus-stack)
  - one map entry removed:
    nodeSelector:
      kubernetes.io/os: linux

spec.image  (monitoring.coreos.com/v1/Prometheus/monitoring/kube-prometheus-stack)
  ± value change
    - quay.io/prometheus/prometheus:v3.15.0-distroless
    + quay.io/prometheus/prometheus:v3.13.1-distroless

spec.version  (monitoring.coreos.com/v1/Prometheus/monitoring/kube-prometheus-stack)
  ± value change
    - v3.15.0-distroless
    + v3.13.1-distroless

spec.groups.kube-apiserver-burnrate.rules.rules  (monitoring.coreos.com/v1/PrometheusRule/monitoring/kube-prometheus-stack-kube-apiserver-burnrate.rules)
  - eleven list entries removed:
    - expr: |
        (
          (
            # too slow
            sum by (cluster) (rate(apiserver_request_sli_duration_seconds_count{job="apiserver",verb=~"LIST|GET",subresource!~"proxy|attach|log|exec|portforward"}[5m]))
            -
            (
              (
                sum by (cluster) (rate(apiserver_request_sli_duration_seconds_bucket{job="apiserver",verb=~"LIST|GET",subresource!~"proxy|attach|log|exec|portforward",scope=~"resource|",le=~"1(\\.0)?"}[5m]))
                or
                vector(0)
              )
              +
              sum by (cluster) (rate(apiserver_request_sli_duration_seconds_bucket{job="apiserver",verb=~"LIST|GET",subresource!~"proxy|attach|log|exec|portforward",scope="namespace",le=~"5(\\.0)?"}[5m]))
              +
              sum by (cluster) (rate(apiserver_request_sli_duration_seconds_bucket{job="apiserver",verb=~"LIST|GET",subresource!~"proxy|attach|log|exec|portforward",scope="cluster",le=~"30(\\.0)?"}[5m]))
            )
          )
          +
          # errors
          sum by (cluster) (rate(apiserver_request_total{job="apiserver",verb=~"LIST|GET",code=~"5.."}[5m]))
        )
      labels:
        verb: read
      record: "cluster_verb:apiserver_request_sli_bad_events:rate5m"
    - expr: |
        (
          (
            # too slow
            sum by (cluster) (rate(apiserver_request_sli_duration_seconds_count{job="apiserver",verb=~"POST|PUT|PATCH|DELETE",subresource!~"proxy|attach|log|exec|portforward"}[5m]))
            -
            sum by (cluster) (rate(apiserver_request_sli_duration_seconds_bucket{job="apiserver",verb=~"POST|PUT|PATCH|DELETE",subresource!~"proxy|attach|log|exec|portforward",le=~"1(\\.0)?"}[5m]))
          )
          +
          # errors
          sum by (cluster) (rate(apiserver_request_total{job="apiserver",verb=~"POST|PUT|PATCH|DELETE",code=~"5.."}[5m]))
        )
      labels:
        verb: write
      record: "cluster_verb:apiserver_request_sli_bad_events:rate5m"
    - expr: "sum by (cluster) (rate(apiserver_request_total{job=\"apiserver\",verb=~\"LIST|GET\"}[5m]))"
      labels:
        verb: read
      record: "cluster_verb:apiserver_request_sli_events:rate5m"
    - expr: "sum by (cluster) (rate(apiserver_request_total{job=\"apiserver\",verb=~\"POST|PUT|PATCH|DELETE\"}[5m]))"
      labels:
        verb: write
      record: "cluster_verb:apiserver_request_sli_events:rate5m"
    - expr: |
        cluster_verb:apiserver_request_sli_bad_events:rate5m
        /
        cluster_verb:apiserver_request_sli_events:rate5m
      record: "apiserver_request:burnrate5m"
    - expr: |
        (
          (
            # too slow
            sum by (cluster) (rate(apiserver_request_sli_duration_seconds_count{job="apiserver",verb=~"POST|PUT|PATCH|DELETE",subresource!~"proxy|attach|log|exec|portforward"}[1h]))
            -
            sum by (cluster) (rate(apiserver_request_sli_duration_seconds_bucket{job="apiserver",verb=~"POST|PUT|PATCH|DELETE",subresource!~"proxy|attach|log|exec|portforward",le=~"1(\\.0)?"}[1h]))
          )
          +
          # errors
          sum by (cluster) (rate(apiserver_request_total{job="apiserver",verb=~"POST|PUT|PATCH|DELETE",code=~"5.."}[1h]))
        )
        /
        sum by (cluster) (rate(apiserver_request_total{job="apiserver",verb=~"POST|PUT|PATCH|DELETE"}[1h]))
      labels:
        verb: write
      record: "apiserver_request:burnrate1h"
    - expr: |
        (
          (
            # too slow
            sum by (cluster) (rate(apiserver_request_sli_duration_seconds_count{job="apiserver",verb=~"POST|PUT|PATCH|DELETE",subresource!~"proxy|attach|log|exec|portforward"}[2h]))
            -
            sum by (cluster) (rate(apiserver_request_sli_duration_seconds_bucket{job="apiserver",verb=~"POST|PUT|PATCH|DELETE",subresource!~"proxy|attach|log|exec|portforward",le=~"1(\\.0)?"}[2h]))
          )
          +
          # errors
          sum by (cluster) (rate(apiserver_request_total{job="apiserver",verb=~"POST|PUT|PATCH|DELETE",code=~"5.."}[2h]))
        )
        /
        sum by (cluster) (rate(apiserver_request_total{job="apiserver",verb=~"POST|PUT|PATCH|DELETE"}[2h]))
      labels:
        verb: write
      record: "apiserver_request:burnrate2h"
    - expr: |
        (
          (
            # too slow
            sum by (cluster) (rate(apiserver_request_sli_duration_seconds_count{job="apiserver",verb=~"POST|PUT|PATCH|DELETE",subresource!~"proxy|attach|log|exec|portforward"}[30m]))
            -
            sum by (cluster) (rate(apiserver_request_sli_duration_seconds_bucket{job="apiserver",verb=~"POST|PUT|PATCH|DELETE",subresource!~"proxy|attach|log|exec|portforward",le=~"1(\\.0)?"}[30m]))
          )
          +
          # errors
          sum by (cluster) (rate(apiserver_request_total{job="apiserver",verb=~"POST|PUT|PATCH|DELETE",code=~"5.."}[30m]))
        )
        /
        sum by (cluster) (rate(apiserver_request_total{job="apiserver",verb=~"POST|PUT|PATCH|DELETE"}[30m]))
      labels:
        verb: write
      record: "apiserver_request:burnrate30m"
    - expr: |
        (
          (
            # too slow
            sum by (cluster) (rate(apiserver_request_sli_duration_seconds_count{job="apiserver",verb=~"POST|PUT|PATCH|DELETE",subresource!~"proxy|attach|log|exec|portforward"}[6h]))
            -
            sum by (cluster) (rate(apiserver_request_sli_duration_seconds_bucket{job="apiserver",verb=~"POST|PUT|PATCH|DELETE",subresource!~"proxy|attach|log|exec|portforward",le=~"1(\\.0)?"}[6h]))
          )
          +
          # errors
          sum by (cluster) (rate(apiserver_request_total{job="apiserver",verb=~"POST|PUT|PATCH|DELETE",code=~"5.."}[6h]))
        )
        /
        sum by (cluster) (rate(apiserver_request_total{job="apiserver",verb=~"POST|PUT|PATCH|DELETE"}[6h]))
      labels:
        verb: write
      record: "apiserver_request:burnrate6h"
    - expr: |
        avg_over_time(cluster_verb:apiserver_request_sli_bad_events:rate5m[1d])
        /
        avg_over_time(cluster_verb:apiserver_request_sli_events:rate5m[1d])
      record: "apiserver_request:burnrate1d"
    - expr: |
        avg_over_time(cluster_verb:apiserver_request_sli_bad_events:rate5m[3d])
        /
        avg_over_time(cluster_verb:apiserver_request_sli_events:rate5m[3d])
      record: "apiserver_request:burnrate3d"
    
  
  + ten list entries added:
    - expr: |
        (
          (
            # too slow
            sum by (cluster) (rate(apiserver_request_sli_duration_seconds_count{job="apiserver",verb=~"LIST|GET",subresource!~"proxy|attach|log|exec|portforward"}[1d]))
            -
            (
              (
                sum by (cluster) (rate(apiserver_request_sli_duration_seconds_bucket{job="apiserver",verb=~"LIST|GET",subresource!~"proxy|attach|log|exec|portforward",scope=~"resource|",le=~"1(\\.0)?"}[1d]))
                or
                vector(0)
              )
              +
              sum by (cluster) (rate(apiserver_request_sli_duration_seconds_bucket{job="apiserver",verb=~"LIST|GET",subresource!~"proxy|attach|log|exec|portforward",scope="namespace",le=~"5(\\.0)?"}[1d]))
              +
              sum by (cluster) (rate(apiserver_request_sli_duration_seconds_bucket{job="apiserver",verb=~"LIST|GET",subresource!~"proxy|attach|log|exec|portforward",scope="cluster",le=~"30(\\.0)?"}[1d]))
            )
          )
          +
          # errors
          sum by (cluster) (rate(apiserver_request_total{job="apiserver",verb=~"LIST|GET",code=~"5.."}[1d]))
        )
        /
        sum by (cluster) (rate(apiserver_request_total{job="apiserver",verb=~"LIST|GET"}[1d]))
      labels:
        verb: read
      record: "apiserver_request:burnrate1d"
    - expr: |
        (
          (
            # too slow
            sum by (cluster) (rate(apiserver_request_sli_duration_seconds_count{job="apiserver",verb=~"LIST|GET",subresource!~"proxy|attach|log|exec|portforward"}[3d]))
            -
            (
              (
                sum by (cluster) (rate(apiserver_request_sli_duration_seconds_bucket{job="apiserver",verb=~"LIST|GET",subresource!~"proxy|attach|log|exec|portforward",scope=~"resource|",le=~"1(\\.0)?"}[3d]))
                or
                vector(0)
              )
              +
              sum by (cluster) (rate(apiserver_request_sli_duration_seconds_bucket{job="apiserver",verb=~"LIST|GET",subresource!~"proxy|attach|log|exec|portforward",scope="namespace",le=~"5(\\.0)?"}[3d]))
              +
              sum by (cluster) (rate(apiserver_request_sli_duration_seconds_bucket{job="apiserver",verb=~"LIST|GET",subresource!~"proxy|attach|log|exec|portforward",scope="cluster",le=~"30(\\.0)?"}[3d]))
            )
          )
          +
          # errors
          sum by (cluster) (rate(apiserver_request_total{job="apiserver",verb=~"LIST|GET",code=~"5.."}[3d]))
        )
        /
        sum by (cluster) (rate(apiserver_request_total{job="apiserver",verb=~"LIST|GET"}[3d]))
      labels:
        verb: read
      record: "apiserver_request:burnrate3d"
    - expr: |
        (
          (
            # too slow
            sum by (cluster) (rate(apiserver_request_sli_duration_seconds_count{job="apiserver",verb=~"LIST|GET",subresource!~"proxy|attach|log|exec|portforward"}[5m]))
            -
            (
              (
                sum by (cluster) (rate(apiserver_request_sli_duration_seconds_bucket{job="apiserver",verb=~"LIST|GET",subresource!~"proxy|attach|log|exec|portforward",scope=~"resource|",le=~"1(\\.0)?"}[5m]))
                or
                vector(0)
              )
              +
              sum by (cluster) (rate(apiserver_request_sli_duration_seconds_bucket{job="apiserver",verb=~"LIST|GET",subresource!~"proxy|attach|log|exec|portforward",scope="namespace",le=~"5(\\.0)?"}[5m]))
              +
              sum by (cluster) (rate(apiserver_request_sli_duration_seconds_bucket{job="apiserver",verb=~"LIST|GET",subresource!~"proxy|attach|log|exec|portforward",scope="cluster",le=~"30(\\.0)?"}[5m]))
            )
          )
          +
          # errors
          sum by (cluster) (rate(apiserver_request_total{job="apiserver",verb=~"LIST|GET",code=~"5.."}[5m]))
        )
        /
        sum by (cluster) (rate(apiserver_request_total{job="apiserver",verb=~"LIST|GET"}[5m]))
      labels:
        verb: read
      record: "apiserver_request:burnrate5m"
    - expr: |
        (
          (
            # too slow
            sum by (cluster) (rate(apiserver_request_sli_duration_seconds_count{job="apiserver",verb=~"POST|PUT|PATCH|DELETE",subresource!~"proxy|attach|log|exec|portforward"}[1d]))
            -
            sum by (cluster) (rate(apiserver_request_sli_duration_seconds_bucket{job="apiserver",verb=~"POST|PUT|PATCH|DELETE",subresource!~"proxy|attach|log|exec|portforward",le=~"1(\\.0)?"}[1d]))
          )
          +
          sum by (cluster) (rate(apiserver_request_total{job="apiserver",verb=~"POST|PUT|PATCH|DELETE",code=~"5.."}[1d]))
        )
        /
        sum by (cluster) (rate(apiserver_request_total{job="apiserver",verb=~"POST|PUT|PATCH|DELETE"}[1d]))
      labels:
        verb: write
      record: "apiserver_request:burnrate1d"
    - expr: |
        (
          (
            # too slow
            sum by (cluster) (rate(apiserver_request_sli_duration_seconds_count{job="apiserver",verb=~"POST|PUT|PATCH|DELETE",subresource!~"proxy|attach|log|exec|portforward"}[1h]))
            -
            sum by (cluster) (rate(apiserver_request_sli_duration_seconds_bucket{job="apiserver",verb=~"POST|PUT|PATCH|DELETE",subresource!~"proxy|attach|log|exec|portforward",le=~"1(\\.0)?"}[1h]))
          )
          +
          sum by (cluster) (rate(apiserver_request_total{job="apiserver",verb=~"POST|PUT|PATCH|DELETE",code=~"5.."}[1h]))
        )
        /
        sum by (cluster) (rate(apiserver_request_total{job="apiserver",verb=~"POST|PUT|PATCH|DELETE"}[1h]))
      labels:
        verb: write
      record: "apiserver_request:burnrate1h"
    - expr: |
        (
          (
            # too slow
            sum by (cluster) (rate(apiserver_request_sli_duration_seconds_count{job="apiserver",verb=~"POST|PUT|PATCH|DELETE",subresource!~"proxy|attach|log|exec|portforward"}[2h]))
            -
            sum by (cluster) (rate(apiserver_request_sli_duration_seconds_bucket{job="apiserver",verb=~"POST|PUT|PATCH|DELETE",subresource!~"proxy|attach|log|exec|portforward",le=~"1(\\.0)?"}[2h]))
          )
          +
          sum by (cluster) (rate(apiserver_request_total{job="apiserver",verb=~"POST|PUT|PATCH|DELETE",code=~"5.."}[2h]))
        )
        /
        sum by (cluster) (rate(apiserver_request_total{job="apiserver",verb=~"POST|PUT|PATCH|DELETE"}[2h]))
      labels:
        verb: write
      record: "apiserver_request:burnrate2h"
    - expr: |
        (
          (
            # too slow
            sum by (cluster) (rate(apiserver_request_sli_duration_seconds_count{job="apiserver",verb=~"POST|PUT|PATCH|DELETE",subresource!~"proxy|attach|log|exec|portforward"}[30m]))
            -
            sum by (cluster) (rate(apiserver_request_sli_duration_seconds_bucket{job="apiserver",verb=~"POST|PUT|PATCH|DELETE",subresource!~"proxy|attach|log|exec|portforward",le=~"1(\\.0)?"}[30m]))
          )
          +
          sum by (cluster) (rate(apiserver_request_total{job="apiserver",verb=~"POST|PUT|PATCH|DELETE",code=~"5.."}[30m]))
        )
        /
        sum by (cluster) (rate(apiserver_request_total{job="apiserver",verb=~"POST|PUT|PATCH|DELETE"}[30m]))
      labels:
        verb: write
      record: "apiserver_request:burnrate30m"
    - expr: |
        (
          (
            # too slow
            sum by (cluster) (rate(apiserver_request_sli_duration_seconds_count{job="apiserver",verb=~"POST|PUT|PATCH|DELETE",subresource!~"proxy|attach|log|exec|portforward"}[3d]))
            -
            sum by (cluster) (rate(apiserver_request_sli_duration_seconds_bucket{job="apiserver",verb=~"POST|PUT|PATCH|DELETE",subresource!~"proxy|attach|log|exec|portforward",le=~"1(\\.0)?"}[3d]))
          )
          +
          sum by (cluster) (rate(apiserver_request_total{job="apiserver",verb=~"POST|PUT|PATCH|DELETE",code=~"5.."}[3d]))
        )
        /
        sum by (cluster) (rate(apiserver_request_total{job="apiserver",verb=~"POST|PUT|PATCH|DELETE"}[3d]))
      labels:
        verb: write
      record: "apiserver_request:burnrate3d"
    - expr: |
        (
          (
            # too slow
            sum by (cluster) (rate(apiserver_request_sli_duration_seconds_count{job="apiserver",verb=~"POST|PUT|PATCH|DELETE",subresource!~"proxy|attach|log|exec|portforward"}[5m]))
            -
            sum by (cluster) (rate(apiserver_request_sli_duration_seconds_bucket{job="apiserver",verb=~"POST|PUT|PATCH|DELETE",subresource!~"proxy|attach|log|exec|portforward",le=~"1(\\.0)?"}[5m]))
          )
          +
          sum by (cluster) (rate(apiserver_request_total{job="apiserver",verb=~"POST|PUT|PATCH|DELETE",code=~"5.."}[5m]))
        )
        /
        sum by (cluster) (rate(apiserver_request_total{job="apiserver",verb=~"POST|PUT|PATCH|DELETE"}[5m]))
      labels:
        verb: write
      record: "apiserver_request:burnrate5m"
    - expr: |
        (
          (
            # too slow
            sum by (cluster) (rate(apiserver_request_sli_duration_seconds_count{job="apiserver",verb=~"POST|PUT|PATCH|DELETE",subresource!~"proxy|attach|log|exec|portforward"}[6h]))
            -
            sum by (cluster) (rate(apiserver_request_sli_duration_seconds_bucket{job="apiserver",verb=~"POST|PUT|PATCH|DELETE",subresource!~"proxy|attach|log|exec|portforward",le=~"1(\\.0)?"}[6h]))
          )
          +
          sum by (cluster) (rate(apiserver_request_total{job="apiserver",verb=~"POST|PUT|PATCH|DELETE",code=~"5.."}[6h]))
        )
        /
        sum by (cluster) (rate(apiserver_request_total{job="apiserver",verb=~"POST|PUT|PATCH|DELETE"}[6h]))
      labels:
        verb: write
      record: "apiserver_request:burnrate6h"
    
  

spec.groups.kubernetes-apps.rules.KubeJobNotCompleted.expr  (monitoring.coreos.com/v1/PrometheusRule/monitoring/kube-prometheus-stack-kubernetes-apps)
  ± value change in multiline text (one insert, one deletion)
      time() - max by (namespace, job_name, cluster) (kube_job_status_start_time{job="kube-state-metrics", namespace=~".*"}
        and
    - kube_job_status_active{job="kube-state-metrics", namespace=~".*"} > 0) > 43200
    -   unless on (namespace, job_name, cluster)
    - max by (namespace, job_name, cluster) (kube_job_labels{job="kube-state-metrics", namespace=~".*",label_excluded_from_alerts="true"} == 1)
    + kube_job_status_active{job="kube-state-metrics", namespace=~".*"} > 0) > 43200
  
  

spec.groups.kubernetes-apps.rules.KubePdbNotEnoughHealthyPods.expr  (monitoring.coreos.com/v1/PrometheusRule/monitoring/kube-prometheus-stack-kubernetes-apps)
  ± value change in multiline text (no inserts, one deletion)
      (
        kube_poddisruptionbudget_status_desired_healthy{job="kube-state-metrics", namespace=~".*"}
        -
        kube_poddisruptionbudget_status_current_healthy{job="kube-state-metrics", namespace=~".*"}
      )
    - > 0
    - and
    - kube_poddisruptionbudget_status_expected_pods{job="kube-state-metrics", namespace=~".*"}
      > 0
  
  

spec.endpoints.0  (monitoring.coreos.com/v1/ServiceMonitor/monitoring/kube-prometheus-stack-coredns)
  - one map entry removed:
    authorization:
      type: Bearer
      credentials:
        name: kube-prometheus-stack-prometheus-token
        key: token
  
  + one map entry added:
    bearerTokenFile: /var/run/secrets/kubernetes.io/serviceaccount/token
  

spec.endpoints.0  (monitoring.coreos.com/v1/ServiceMonitor/monitoring/kube-prometheus-stack-apiserver)
  - one map entry removed:
    authorization:
      type: Bearer
      credentials:
        name: kube-prometheus-stack-prometheus-token
        key: token
  
  + one map entry added:
    bearerTokenFile: /var/run/secrets/kubernetes.io/serviceaccount/token
  

spec.endpoints.0.tlsConfig  (monitoring.coreos.com/v1/ServiceMonitor/monitoring/kube-prometheus-stack-apiserver)
  - one map entry removed:
    ca:
      configMap:
        name: kube-root-ca.crt
        key: ca.crt
  
  + one map entry added:
    caFile: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
  

spec.endpoints.0  (monitoring.coreos.com/v1/ServiceMonitor/monitoring/kube-prometheus-stack-kube-controller-manager)
  - one map entry removed:
    authorization:
      type: Bearer
      credentials:
        name: kube-prometheus-stack-prometheus-token
        key: token
  
  + one map entry added:
    bearerTokenFile: /var/run/secrets/kubernetes.io/serviceaccount/token
  

spec.endpoints.0.tlsConfig  (monitoring.coreos.com/v1/ServiceMonitor/monitoring/kube-prometheus-stack-kube-controller-manager)
  - one map entry removed:
    ca:
      configMap:
        name: kube-root-ca.crt
        key: ca.crt
  
  + one map entry added:
    caFile: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
  

spec.endpoints.0  (monitoring.coreos.com/v1/ServiceMonitor/monitoring/kube-prometheus-stack-kube-etcd)
  - one map entry removed:
    authorization:
      type: Bearer
      credentials:
        name: kube-prometheus-stack-prometheus-token
        key: token
  
  + one map entry added:
    bearerTokenFile: /var/run/secrets/kubernetes.io/serviceaccount/token
  

spec.endpoints.0  (monitoring.coreos.com/v1/ServiceMonitor/monitoring/kube-prometheus-stack-kube-scheduler)
  - one map entry removed:
    authorization:
      type: Bearer
      credentials:
        name: kube-prometheus-stack-prometheus-token
        key: token
  
  + one map entry added:
    bearerTokenFile: /var/run/secrets/kubernetes.io/serviceaccount/token
  

spec.endpoints.0.tlsConfig  (monitoring.coreos.com/v1/ServiceMonitor/monitoring/kube-prometheus-stack-kube-scheduler)
  - one map entry removed:
    ca:
      configMap:
        name: kube-root-ca.crt
        key: ca.crt
  
  + one map entry added:
    caFile: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
  

spec.endpoints  (monitoring.coreos.com/v1/ServiceMonitor/monitoring/kube-prometheus-stack-kubelet)
  - three list entries removed:
    - authorization:
        type: Bearer
        credentials:
          name: kube-prometheus-stack-prometheus-token
          key: token
      honorLabels: true
      honorTimestamps: true
      metricRelabelings:
      - action: drop
        regex: (csi_operations|storage_operation_duration)_seconds_bucket;(0.25|2.5|15|25|120|600)(\.0)?
        sourceLabels:
        - __name__
        - le
      port: https-metrics
      relabelings:
      - action: replace
        sourceLabels:
        - __metrics_path__
        targetLabel: metrics_path
      scheme: https
      tlsConfig:
        ca:
          configMap:
            name: kube-root-ca.crt
            key: ca.crt
        insecureSkipVerify: true
    - authorization:
        type: Bearer
        credentials:
          name: kube-prometheus-stack-prometheus-token
          key: token
      honorLabels: true
      honorTimestamps: true
      interval: 10s
      metricRelabelings:
      - action: drop
        regex: container_cpu_(cfs_throttled_seconds_total|load_average_10s|system_seconds_total|user_seconds_total)
        sourceLabels:
        - __name__
      - action: drop
        regex: container_fs_(io_current|io_time_seconds_total|io_time_weighted_seconds_total|reads_merged_total|sector_reads_total|sector_writes_total|writes_merged_total)
        sourceLabels:
        - __name__
      - action: drop
        regex: container_memory_(mapped_file|swap)
        sourceLabels:
        - __name__
      - action: drop
        regex: container_(file_descriptors|tasks_state|threads_max)
        sourceLabels:
        - __name__
      - action: drop
        regex: container_memory_failures_total;hierarchy
        sourceLabels:
        - __name__
        - scope
      - action: drop
        regex: "container_network_.*;(cali|cilium|cni|lxc|nodelocaldns|tunl).*"
        sourceLabels:
        - __name__
        - interface
      - action: drop
        regex: "container_spec.*"
        sourceLabels:
        - __name__
      - action: drop
        regex: .+;
        sourceLabels:
        - id
        - pod
      path: /metrics/cadvisor
      port: https-metrics
      relabelings:
      - action: replace
        sourceLabels:
        - __metrics_path__
        targetLabel: metrics_path
      scheme: https
      tlsConfig:
        ca:
          configMap:
            name: kube-root-ca.crt
            key: ca.crt
        insecureSkipVerify: true
      trackTimestampsStaleness: true
    - authorization:
        type: Bearer
        credentials:
          name: kube-prometheus-stack-prometheus-token
          key: token
      honorLabels: true
      honorTimestamps: true
      path: /metrics/probes
      port: https-metrics
      relabelings:
      - action: replace
        sourceLabels:
        - __metrics_path__
        targetLabel: metrics_path
      scheme: https
      tlsConfig:
        ca:
          configMap:
            name: kube-root-ca.crt
            key: ca.crt
        insecureSkipVerify: true
    
  
  + three list entries added:
    - bearerTokenFile: /var/run/secrets/kubernetes.io/serviceaccount/token
      honorLabels: true
      honorTimestamps: true
      metricRelabelings:
      - action: drop
        regex: (csi_operations|storage_operation_duration)_seconds_bucket;(0.25|2.5|15|25|120|600)(\.0)?
        sourceLabels:
        - __name__
        - le
      port: https-metrics
      relabelings:
      - action: replace
        sourceLabels:
        - __metrics_path__
        targetLabel: metrics_path
      scheme: https
      tlsConfig:
        caFile: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
        insecureSkipVerify: true
    - bearerTokenFile: /var/run/secrets/kubernetes.io/serviceaccount/token
      honorLabels: true
      honorTimestamps: true
      interval: 10s
      metricRelabelings:
      - action: drop
        regex: container_cpu_(cfs_throttled_seconds_total|load_average_10s|system_seconds_total|user_seconds_total)
        sourceLabels:
        - __name__
      - action: drop
        regex: container_fs_(io_current|io_time_seconds_total|io_time_weighted_seconds_total|reads_merged_total|sector_reads_total|sector_writes_total|writes_merged_total)
        sourceLabels:
        - __name__
      - action: drop
        regex: container_memory_(mapped_file|swap)
        sourceLabels:
        - __name__
      - action: drop
        regex: container_(file_descriptors|tasks_state|threads_max)
        sourceLabels:
        - __name__
      - action: drop
        regex: container_memory_failures_total;hierarchy
        sourceLabels:
        - __name__
        - scope
      - action: drop
        regex: "container_network_.*;(cali|cilium|cni|lxc|nodelocaldns|tunl).*"
        sourceLabels:
        - __name__
        - interface
      - action: drop
        regex: "container_spec.*"
        sourceLabels:
        - __name__
      - action: drop
        regex: .+;
        sourceLabels:
        - id
        - pod
      path: /metrics/cadvisor
      port: https-metrics
      relabelings:
      - action: replace
        sourceLabels:
        - __metrics_path__
        targetLabel: metrics_path
      scheme: https
      tlsConfig:
        caFile: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
        insecureSkipVerify: true
      trackTimestampsStaleness: true
    - bearerTokenFile: /var/run/secrets/kubernetes.io/serviceaccount/token
      honorLabels: true
      honorTimestamps: true
      path: /metrics/probes
      port: https-metrics
      relabelings:
      - action: replace
        sourceLabels:
        - __metrics_path__
        targetLabel: metrics_path
      scheme: https
      tlsConfig:
        caFile: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
        insecureSkipVerify: true
    
  

spec.template.spec  (batch/v1/Job/monitoring/kube-prometheus-stack-admission-create)
  - one map entry removed:
    nodeSelector:
      kubernetes.io/os: linux

spec.template.spec.containers.create.image  (batch/v1/Job/monitoring/kube-prometheus-stack-admission-create)
  ± value change
    - ghcr.io/jkroepke/kube-webhook-certgen:1.8.9
    + ghcr.io/jkroepke/kube-webhook-certgen:1.8.4

spec.template.spec  (batch/v1/Job/monitoring/kube-prometheus-stack-admission-patch)
  - one map entry removed:
    nodeSelector:
      kubernetes.io/os: linux

spec.template.spec.containers.patch.image  (batch/v1/Job/monitoring/kube-prometheus-stack-admission-patch)
  ± value change
    - ghcr.io/jkroepke/kube-webhook-certgen:1.8.9
    + ghcr.io/jkroepke/kube-webhook-certgen:1.8.4

Pipeline

## flate diff ``` rules (rbac.authorization.k8s.io/v1/ClusterRole/kube-prometheus-stack-operator) - six list entries removed: + three list entries added: - resources: - resources: - alertmanagers - alertmanagers - prometheusagents - alertmanagers/finalizers - prometheuses - alertmanagers/status - thanosrulers - alertmanagerconfigs apiGroups: - prometheuses - monitoring.coreos.com - prometheuses/finalizers verbs: - prometheuses/status - patch - prometheusagents - resources: - prometheusagents/finalizers - alertmanagers/status - prometheusagents/status - podmonitors/status - thanosrulers - probes/status - thanosrulers/finalizers - prometheuses/status - thanosrulers/status - prometheusagents/status - scrapeconfigs - prometheusrules/status - scrapeconfigs/status - scrapeconfigs/status - servicemonitors - servicemonitors/status - servicemonitors/status - thanosrulers/status - podmonitors apiGroups: - podmonitors/status - monitoring.coreos.com - probes verbs: - probes/status - create - prometheusrules - update - prometheusrules/status - patch apiGroups: - delete - monitoring.coreos.com - resources: verbs: - alertmanagers/finalizers - "*" - prometheusagents/finalizers - resources: - prometheuses/finalizers - statefulsets - thanosrulers/finalizers apiGroups: apiGroups: - apps - monitoring.coreos.com verbs: verbs: - "*" - update - resources: - resources: - configmaps - alertmanagers - secrets - alertmanagerconfigs apiGroups: - podmonitors - - probes verbs: - prometheusagents - "*" - prometheuses - prometheusrules - servicemonitors - scrapeconfigs - thanosrulers apiGroups: - monitoring.coreos.com verbs: - get - list - watch - resources: - statefulsets apiGroups: - apps verbs: - get - list - watch - create - update - patch - delete - resources: - configmaps - secrets apiGroups: - verbs: - get - list - watch - create - update - delete metadata (v1/Service/kube-privileged/node-exporter) + one map entry added: annotations: prometheus.io/scrape: "true" spec.template.spec.containers.kube-state-metrics.image (apps/v1/Deployment/monitoring/kube-state-metrics) ± value change - registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.20.0 + registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.19.1 spec.template.spec (apps/v1/Deployment/monitoring/kube-prometheus-stack-operator) - one map entry removed: nodeSelector: kubernetes.io/os: linux spec.template.spec.containers.kube-prometheus-stack.args (apps/v1/Deployment/monitoring/kube-prometheus-stack-operator) - three list entries removed: - "--prometheus-config-reloader=quay.io/prometheus-operator/prometheus-config-reloader:v0.94.1" - "--thanos-default-base-image=quay.io/thanos/thanos:v0.42.4" - "--secret-field-selector=type!=kubernetes.io/dockercfg,type!=helm.sh/release.v1" + three list entries added: - "--prometheus-config-reloader=quay.io/prometheus-operator/prometheus-config-reloader:v0.92.1" - "--thanos-default-base-image=quay.io/thanos/thanos:v0.42.2" - "--secret-field-selector=type!=kubernetes.io/dockercfg,type!=kubernetes.io/service-account-token,type!=helm.sh/release.v1" spec.template.spec.containers.kube-prometheus-stack.image (apps/v1/Deployment/monitoring/kube-prometheus-stack-operator) ± value change - quay.io/prometheus-operator/prometheus-operator:v0.94.1 + quay.io/prometheus-operator/prometheus-operator:v0.92.1 spec (monitoring.coreos.com/v1/Alertmanager/monitoring/kube-prometheus-stack) - one map entry removed: + one map entry added: nodeSelector: hostNetwork: false kubernetes.io/os: linux spec.image (monitoring.coreos.com/v1/Alertmanager/monitoring/kube-prometheus-stack) ± value change - quay.io/prometheus/alertmanager:v0.34.1 + quay.io/prometheus/alertmanager:v0.33.1 spec.version (monitoring.coreos.com/v1/Alertmanager/monitoring/kube-prometheus-stack) ± value change - v0.34.1 + v0.33.1 spec (monitoring.coreos.com/v1/Prometheus/monitoring/kube-prometheus-stack) - one map entry removed: nodeSelector: kubernetes.io/os: linux spec.image (monitoring.coreos.com/v1/Prometheus/monitoring/kube-prometheus-stack) ± value change - quay.io/prometheus/prometheus:v3.15.0-distroless + quay.io/prometheus/prometheus:v3.13.1-distroless spec.version (monitoring.coreos.com/v1/Prometheus/monitoring/kube-prometheus-stack) ± value change - v3.15.0-distroless + v3.13.1-distroless spec.groups.kube-apiserver-burnrate.rules.rules (monitoring.coreos.com/v1/PrometheusRule/monitoring/kube-prometheus-stack-kube-apiserver-burnrate.rules) - eleven list entries removed: - expr: | ( ( # too slow sum by (cluster) (rate(apiserver_request_sli_duration_seconds_count{job="apiserver",verb=~"LIST|GET",subresource!~"proxy|attach|log|exec|portforward"}[5m])) - ( ( sum by (cluster) (rate(apiserver_request_sli_duration_seconds_bucket{job="apiserver",verb=~"LIST|GET",subresource!~"proxy|attach|log|exec|portforward",scope=~"resource|",le=~"1(\\.0)?"}[5m])) or vector(0) ) + sum by (cluster) (rate(apiserver_request_sli_duration_seconds_bucket{job="apiserver",verb=~"LIST|GET",subresource!~"proxy|attach|log|exec|portforward",scope="namespace",le=~"5(\\.0)?"}[5m])) + sum by (cluster) (rate(apiserver_request_sli_duration_seconds_bucket{job="apiserver",verb=~"LIST|GET",subresource!~"proxy|attach|log|exec|portforward",scope="cluster",le=~"30(\\.0)?"}[5m])) ) ) + # errors sum by (cluster) (rate(apiserver_request_total{job="apiserver",verb=~"LIST|GET",code=~"5.."}[5m])) ) labels: verb: read record: "cluster_verb:apiserver_request_sli_bad_events:rate5m" - expr: | ( ( # too slow sum by (cluster) (rate(apiserver_request_sli_duration_seconds_count{job="apiserver",verb=~"POST|PUT|PATCH|DELETE",subresource!~"proxy|attach|log|exec|portforward"}[5m])) - sum by (cluster) (rate(apiserver_request_sli_duration_seconds_bucket{job="apiserver",verb=~"POST|PUT|PATCH|DELETE",subresource!~"proxy|attach|log|exec|portforward",le=~"1(\\.0)?"}[5m])) ) + # errors sum by (cluster) (rate(apiserver_request_total{job="apiserver",verb=~"POST|PUT|PATCH|DELETE",code=~"5.."}[5m])) ) labels: verb: write record: "cluster_verb:apiserver_request_sli_bad_events:rate5m" - expr: "sum by (cluster) (rate(apiserver_request_total{job=\"apiserver\",verb=~\"LIST|GET\"}[5m]))" labels: verb: read record: "cluster_verb:apiserver_request_sli_events:rate5m" - expr: "sum by (cluster) (rate(apiserver_request_total{job=\"apiserver\",verb=~\"POST|PUT|PATCH|DELETE\"}[5m]))" labels: verb: write record: "cluster_verb:apiserver_request_sli_events:rate5m" - expr: | cluster_verb:apiserver_request_sli_bad_events:rate5m / cluster_verb:apiserver_request_sli_events:rate5m record: "apiserver_request:burnrate5m" - expr: | ( ( # too slow sum by (cluster) (rate(apiserver_request_sli_duration_seconds_count{job="apiserver",verb=~"POST|PUT|PATCH|DELETE",subresource!~"proxy|attach|log|exec|portforward"}[1h])) - sum by (cluster) (rate(apiserver_request_sli_duration_seconds_bucket{job="apiserver",verb=~"POST|PUT|PATCH|DELETE",subresource!~"proxy|attach|log|exec|portforward",le=~"1(\\.0)?"}[1h])) ) + # errors sum by (cluster) (rate(apiserver_request_total{job="apiserver",verb=~"POST|PUT|PATCH|DELETE",code=~"5.."}[1h])) ) / sum by (cluster) (rate(apiserver_request_total{job="apiserver",verb=~"POST|PUT|PATCH|DELETE"}[1h])) labels: verb: write record: "apiserver_request:burnrate1h" - expr: | ( ( # too slow sum by (cluster) (rate(apiserver_request_sli_duration_seconds_count{job="apiserver",verb=~"POST|PUT|PATCH|DELETE",subresource!~"proxy|attach|log|exec|portforward"}[2h])) - sum by (cluster) (rate(apiserver_request_sli_duration_seconds_bucket{job="apiserver",verb=~"POST|PUT|PATCH|DELETE",subresource!~"proxy|attach|log|exec|portforward",le=~"1(\\.0)?"}[2h])) ) + # errors sum by (cluster) (rate(apiserver_request_total{job="apiserver",verb=~"POST|PUT|PATCH|DELETE",code=~"5.."}[2h])) ) / sum by (cluster) (rate(apiserver_request_total{job="apiserver",verb=~"POST|PUT|PATCH|DELETE"}[2h])) labels: verb: write record: "apiserver_request:burnrate2h" - expr: | ( ( # too slow sum by (cluster) (rate(apiserver_request_sli_duration_seconds_count{job="apiserver",verb=~"POST|PUT|PATCH|DELETE",subresource!~"proxy|attach|log|exec|portforward"}[30m])) - sum by (cluster) (rate(apiserver_request_sli_duration_seconds_bucket{job="apiserver",verb=~"POST|PUT|PATCH|DELETE",subresource!~"proxy|attach|log|exec|portforward",le=~"1(\\.0)?"}[30m])) ) + # errors sum by (cluster) (rate(apiserver_request_total{job="apiserver",verb=~"POST|PUT|PATCH|DELETE",code=~"5.."}[30m])) ) / sum by (cluster) (rate(apiserver_request_total{job="apiserver",verb=~"POST|PUT|PATCH|DELETE"}[30m])) labels: verb: write record: "apiserver_request:burnrate30m" - expr: | ( ( # too slow sum by (cluster) (rate(apiserver_request_sli_duration_seconds_count{job="apiserver",verb=~"POST|PUT|PATCH|DELETE",subresource!~"proxy|attach|log|exec|portforward"}[6h])) - sum by (cluster) (rate(apiserver_request_sli_duration_seconds_bucket{job="apiserver",verb=~"POST|PUT|PATCH|DELETE",subresource!~"proxy|attach|log|exec|portforward",le=~"1(\\.0)?"}[6h])) ) + # errors sum by (cluster) (rate(apiserver_request_total{job="apiserver",verb=~"POST|PUT|PATCH|DELETE",code=~"5.."}[6h])) ) / sum by (cluster) (rate(apiserver_request_total{job="apiserver",verb=~"POST|PUT|PATCH|DELETE"}[6h])) labels: verb: write record: "apiserver_request:burnrate6h" - expr: | avg_over_time(cluster_verb:apiserver_request_sli_bad_events:rate5m[1d]) / avg_over_time(cluster_verb:apiserver_request_sli_events:rate5m[1d]) record: "apiserver_request:burnrate1d" - expr: | avg_over_time(cluster_verb:apiserver_request_sli_bad_events:rate5m[3d]) / avg_over_time(cluster_verb:apiserver_request_sli_events:rate5m[3d]) record: "apiserver_request:burnrate3d" + ten list entries added: - expr: | ( ( # too slow sum by (cluster) (rate(apiserver_request_sli_duration_seconds_count{job="apiserver",verb=~"LIST|GET",subresource!~"proxy|attach|log|exec|portforward"}[1d])) - ( ( sum by (cluster) (rate(apiserver_request_sli_duration_seconds_bucket{job="apiserver",verb=~"LIST|GET",subresource!~"proxy|attach|log|exec|portforward",scope=~"resource|",le=~"1(\\.0)?"}[1d])) or vector(0) ) + sum by (cluster) (rate(apiserver_request_sli_duration_seconds_bucket{job="apiserver",verb=~"LIST|GET",subresource!~"proxy|attach|log|exec|portforward",scope="namespace",le=~"5(\\.0)?"}[1d])) + sum by (cluster) (rate(apiserver_request_sli_duration_seconds_bucket{job="apiserver",verb=~"LIST|GET",subresource!~"proxy|attach|log|exec|portforward",scope="cluster",le=~"30(\\.0)?"}[1d])) ) ) + # errors sum by (cluster) (rate(apiserver_request_total{job="apiserver",verb=~"LIST|GET",code=~"5.."}[1d])) ) / sum by (cluster) (rate(apiserver_request_total{job="apiserver",verb=~"LIST|GET"}[1d])) labels: verb: read record: "apiserver_request:burnrate1d" - expr: | ( ( # too slow sum by (cluster) (rate(apiserver_request_sli_duration_seconds_count{job="apiserver",verb=~"LIST|GET",subresource!~"proxy|attach|log|exec|portforward"}[3d])) - ( ( sum by (cluster) (rate(apiserver_request_sli_duration_seconds_bucket{job="apiserver",verb=~"LIST|GET",subresource!~"proxy|attach|log|exec|portforward",scope=~"resource|",le=~"1(\\.0)?"}[3d])) or vector(0) ) + sum by (cluster) (rate(apiserver_request_sli_duration_seconds_bucket{job="apiserver",verb=~"LIST|GET",subresource!~"proxy|attach|log|exec|portforward",scope="namespace",le=~"5(\\.0)?"}[3d])) + sum by (cluster) (rate(apiserver_request_sli_duration_seconds_bucket{job="apiserver",verb=~"LIST|GET",subresource!~"proxy|attach|log|exec|portforward",scope="cluster",le=~"30(\\.0)?"}[3d])) ) ) + # errors sum by (cluster) (rate(apiserver_request_total{job="apiserver",verb=~"LIST|GET",code=~"5.."}[3d])) ) / sum by (cluster) (rate(apiserver_request_total{job="apiserver",verb=~"LIST|GET"}[3d])) labels: verb: read record: "apiserver_request:burnrate3d" - expr: | ( ( # too slow sum by (cluster) (rate(apiserver_request_sli_duration_seconds_count{job="apiserver",verb=~"LIST|GET",subresource!~"proxy|attach|log|exec|portforward"}[5m])) - ( ( sum by (cluster) (rate(apiserver_request_sli_duration_seconds_bucket{job="apiserver",verb=~"LIST|GET",subresource!~"proxy|attach|log|exec|portforward",scope=~"resource|",le=~"1(\\.0)?"}[5m])) or vector(0) ) + sum by (cluster) (rate(apiserver_request_sli_duration_seconds_bucket{job="apiserver",verb=~"LIST|GET",subresource!~"proxy|attach|log|exec|portforward",scope="namespace",le=~"5(\\.0)?"}[5m])) + sum by (cluster) (rate(apiserver_request_sli_duration_seconds_bucket{job="apiserver",verb=~"LIST|GET",subresource!~"proxy|attach|log|exec|portforward",scope="cluster",le=~"30(\\.0)?"}[5m])) ) ) + # errors sum by (cluster) (rate(apiserver_request_total{job="apiserver",verb=~"LIST|GET",code=~"5.."}[5m])) ) / sum by (cluster) (rate(apiserver_request_total{job="apiserver",verb=~"LIST|GET"}[5m])) labels: verb: read record: "apiserver_request:burnrate5m" - expr: | ( ( # too slow sum by (cluster) (rate(apiserver_request_sli_duration_seconds_count{job="apiserver",verb=~"POST|PUT|PATCH|DELETE",subresource!~"proxy|attach|log|exec|portforward"}[1d])) - sum by (cluster) (rate(apiserver_request_sli_duration_seconds_bucket{job="apiserver",verb=~"POST|PUT|PATCH|DELETE",subresource!~"proxy|attach|log|exec|portforward",le=~"1(\\.0)?"}[1d])) ) + sum by (cluster) (rate(apiserver_request_total{job="apiserver",verb=~"POST|PUT|PATCH|DELETE",code=~"5.."}[1d])) ) / sum by (cluster) (rate(apiserver_request_total{job="apiserver",verb=~"POST|PUT|PATCH|DELETE"}[1d])) labels: verb: write record: "apiserver_request:burnrate1d" - expr: | ( ( # too slow sum by (cluster) (rate(apiserver_request_sli_duration_seconds_count{job="apiserver",verb=~"POST|PUT|PATCH|DELETE",subresource!~"proxy|attach|log|exec|portforward"}[1h])) - sum by (cluster) (rate(apiserver_request_sli_duration_seconds_bucket{job="apiserver",verb=~"POST|PUT|PATCH|DELETE",subresource!~"proxy|attach|log|exec|portforward",le=~"1(\\.0)?"}[1h])) ) + sum by (cluster) (rate(apiserver_request_total{job="apiserver",verb=~"POST|PUT|PATCH|DELETE",code=~"5.."}[1h])) ) / sum by (cluster) (rate(apiserver_request_total{job="apiserver",verb=~"POST|PUT|PATCH|DELETE"}[1h])) labels: verb: write record: "apiserver_request:burnrate1h" - expr: | ( ( # too slow sum by (cluster) (rate(apiserver_request_sli_duration_seconds_count{job="apiserver",verb=~"POST|PUT|PATCH|DELETE",subresource!~"proxy|attach|log|exec|portforward"}[2h])) - sum by (cluster) (rate(apiserver_request_sli_duration_seconds_bucket{job="apiserver",verb=~"POST|PUT|PATCH|DELETE",subresource!~"proxy|attach|log|exec|portforward",le=~"1(\\.0)?"}[2h])) ) + sum by (cluster) (rate(apiserver_request_total{job="apiserver",verb=~"POST|PUT|PATCH|DELETE",code=~"5.."}[2h])) ) / sum by (cluster) (rate(apiserver_request_total{job="apiserver",verb=~"POST|PUT|PATCH|DELETE"}[2h])) labels: verb: write record: "apiserver_request:burnrate2h" - expr: | ( ( # too slow sum by (cluster) (rate(apiserver_request_sli_duration_seconds_count{job="apiserver",verb=~"POST|PUT|PATCH|DELETE",subresource!~"proxy|attach|log|exec|portforward"}[30m])) - sum by (cluster) (rate(apiserver_request_sli_duration_seconds_bucket{job="apiserver",verb=~"POST|PUT|PATCH|DELETE",subresource!~"proxy|attach|log|exec|portforward",le=~"1(\\.0)?"}[30m])) ) + sum by (cluster) (rate(apiserver_request_total{job="apiserver",verb=~"POST|PUT|PATCH|DELETE",code=~"5.."}[30m])) ) / sum by (cluster) (rate(apiserver_request_total{job="apiserver",verb=~"POST|PUT|PATCH|DELETE"}[30m])) labels: verb: write record: "apiserver_request:burnrate30m" - expr: | ( ( # too slow sum by (cluster) (rate(apiserver_request_sli_duration_seconds_count{job="apiserver",verb=~"POST|PUT|PATCH|DELETE",subresource!~"proxy|attach|log|exec|portforward"}[3d])) - sum by (cluster) (rate(apiserver_request_sli_duration_seconds_bucket{job="apiserver",verb=~"POST|PUT|PATCH|DELETE",subresource!~"proxy|attach|log|exec|portforward",le=~"1(\\.0)?"}[3d])) ) + sum by (cluster) (rate(apiserver_request_total{job="apiserver",verb=~"POST|PUT|PATCH|DELETE",code=~"5.."}[3d])) ) / sum by (cluster) (rate(apiserver_request_total{job="apiserver",verb=~"POST|PUT|PATCH|DELETE"}[3d])) labels: verb: write record: "apiserver_request:burnrate3d" - expr: | ( ( # too slow sum by (cluster) (rate(apiserver_request_sli_duration_seconds_count{job="apiserver",verb=~"POST|PUT|PATCH|DELETE",subresource!~"proxy|attach|log|exec|portforward"}[5m])) - sum by (cluster) (rate(apiserver_request_sli_duration_seconds_bucket{job="apiserver",verb=~"POST|PUT|PATCH|DELETE",subresource!~"proxy|attach|log|exec|portforward",le=~"1(\\.0)?"}[5m])) ) + sum by (cluster) (rate(apiserver_request_total{job="apiserver",verb=~"POST|PUT|PATCH|DELETE",code=~"5.."}[5m])) ) / sum by (cluster) (rate(apiserver_request_total{job="apiserver",verb=~"POST|PUT|PATCH|DELETE"}[5m])) labels: verb: write record: "apiserver_request:burnrate5m" - expr: | ( ( # too slow sum by (cluster) (rate(apiserver_request_sli_duration_seconds_count{job="apiserver",verb=~"POST|PUT|PATCH|DELETE",subresource!~"proxy|attach|log|exec|portforward"}[6h])) - sum by (cluster) (rate(apiserver_request_sli_duration_seconds_bucket{job="apiserver",verb=~"POST|PUT|PATCH|DELETE",subresource!~"proxy|attach|log|exec|portforward",le=~"1(\\.0)?"}[6h])) ) + sum by (cluster) (rate(apiserver_request_total{job="apiserver",verb=~"POST|PUT|PATCH|DELETE",code=~"5.."}[6h])) ) / sum by (cluster) (rate(apiserver_request_total{job="apiserver",verb=~"POST|PUT|PATCH|DELETE"}[6h])) labels: verb: write record: "apiserver_request:burnrate6h" spec.groups.kubernetes-apps.rules.KubeJobNotCompleted.expr (monitoring.coreos.com/v1/PrometheusRule/monitoring/kube-prometheus-stack-kubernetes-apps) ± value change in multiline text (one insert, one deletion) time() - max by (namespace, job_name, cluster) (kube_job_status_start_time{job="kube-state-metrics", namespace=~".*"} and - kube_job_status_active{job="kube-state-metrics", namespace=~".*"} > 0) > 43200 - unless on (namespace, job_name, cluster) - max by (namespace, job_name, cluster) (kube_job_labels{job="kube-state-metrics", namespace=~".*",label_excluded_from_alerts="true"} == 1) + kube_job_status_active{job="kube-state-metrics", namespace=~".*"} > 0) > 43200 spec.groups.kubernetes-apps.rules.KubePdbNotEnoughHealthyPods.expr (monitoring.coreos.com/v1/PrometheusRule/monitoring/kube-prometheus-stack-kubernetes-apps) ± value change in multiline text (no inserts, one deletion) ( kube_poddisruptionbudget_status_desired_healthy{job="kube-state-metrics", namespace=~".*"} - kube_poddisruptionbudget_status_current_healthy{job="kube-state-metrics", namespace=~".*"} ) - > 0 - and - kube_poddisruptionbudget_status_expected_pods{job="kube-state-metrics", namespace=~".*"} > 0 spec.endpoints.0 (monitoring.coreos.com/v1/ServiceMonitor/monitoring/kube-prometheus-stack-coredns) - one map entry removed: authorization: type: Bearer credentials: name: kube-prometheus-stack-prometheus-token key: token + one map entry added: bearerTokenFile: /var/run/secrets/kubernetes.io/serviceaccount/token spec.endpoints.0 (monitoring.coreos.com/v1/ServiceMonitor/monitoring/kube-prometheus-stack-apiserver) - one map entry removed: authorization: type: Bearer credentials: name: kube-prometheus-stack-prometheus-token key: token + one map entry added: bearerTokenFile: /var/run/secrets/kubernetes.io/serviceaccount/token spec.endpoints.0.tlsConfig (monitoring.coreos.com/v1/ServiceMonitor/monitoring/kube-prometheus-stack-apiserver) - one map entry removed: ca: configMap: name: kube-root-ca.crt key: ca.crt + one map entry added: caFile: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt spec.endpoints.0 (monitoring.coreos.com/v1/ServiceMonitor/monitoring/kube-prometheus-stack-kube-controller-manager) - one map entry removed: authorization: type: Bearer credentials: name: kube-prometheus-stack-prometheus-token key: token + one map entry added: bearerTokenFile: /var/run/secrets/kubernetes.io/serviceaccount/token spec.endpoints.0.tlsConfig (monitoring.coreos.com/v1/ServiceMonitor/monitoring/kube-prometheus-stack-kube-controller-manager) - one map entry removed: ca: configMap: name: kube-root-ca.crt key: ca.crt + one map entry added: caFile: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt spec.endpoints.0 (monitoring.coreos.com/v1/ServiceMonitor/monitoring/kube-prometheus-stack-kube-etcd) - one map entry removed: authorization: type: Bearer credentials: name: kube-prometheus-stack-prometheus-token key: token + one map entry added: bearerTokenFile: /var/run/secrets/kubernetes.io/serviceaccount/token spec.endpoints.0 (monitoring.coreos.com/v1/ServiceMonitor/monitoring/kube-prometheus-stack-kube-scheduler) - one map entry removed: authorization: type: Bearer credentials: name: kube-prometheus-stack-prometheus-token key: token + one map entry added: bearerTokenFile: /var/run/secrets/kubernetes.io/serviceaccount/token spec.endpoints.0.tlsConfig (monitoring.coreos.com/v1/ServiceMonitor/monitoring/kube-prometheus-stack-kube-scheduler) - one map entry removed: ca: configMap: name: kube-root-ca.crt key: ca.crt + one map entry added: caFile: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt spec.endpoints (monitoring.coreos.com/v1/ServiceMonitor/monitoring/kube-prometheus-stack-kubelet) - three list entries removed: - authorization: type: Bearer credentials: name: kube-prometheus-stack-prometheus-token key: token honorLabels: true honorTimestamps: true metricRelabelings: - action: drop regex: (csi_operations|storage_operation_duration)_seconds_bucket;(0.25|2.5|15|25|120|600)(\.0)? sourceLabels: - __name__ - le port: https-metrics relabelings: - action: replace sourceLabels: - __metrics_path__ targetLabel: metrics_path scheme: https tlsConfig: ca: configMap: name: kube-root-ca.crt key: ca.crt insecureSkipVerify: true - authorization: type: Bearer credentials: name: kube-prometheus-stack-prometheus-token key: token honorLabels: true honorTimestamps: true interval: 10s metricRelabelings: - action: drop regex: container_cpu_(cfs_throttled_seconds_total|load_average_10s|system_seconds_total|user_seconds_total) sourceLabels: - __name__ - action: drop regex: container_fs_(io_current|io_time_seconds_total|io_time_weighted_seconds_total|reads_merged_total|sector_reads_total|sector_writes_total|writes_merged_total) sourceLabels: - __name__ - action: drop regex: container_memory_(mapped_file|swap) sourceLabels: - __name__ - action: drop regex: container_(file_descriptors|tasks_state|threads_max) sourceLabels: - __name__ - action: drop regex: container_memory_failures_total;hierarchy sourceLabels: - __name__ - scope - action: drop regex: "container_network_.*;(cali|cilium|cni|lxc|nodelocaldns|tunl).*" sourceLabels: - __name__ - interface - action: drop regex: "container_spec.*" sourceLabels: - __name__ - action: drop regex: .+; sourceLabels: - id - pod path: /metrics/cadvisor port: https-metrics relabelings: - action: replace sourceLabels: - __metrics_path__ targetLabel: metrics_path scheme: https tlsConfig: ca: configMap: name: kube-root-ca.crt key: ca.crt insecureSkipVerify: true trackTimestampsStaleness: true - authorization: type: Bearer credentials: name: kube-prometheus-stack-prometheus-token key: token honorLabels: true honorTimestamps: true path: /metrics/probes port: https-metrics relabelings: - action: replace sourceLabels: - __metrics_path__ targetLabel: metrics_path scheme: https tlsConfig: ca: configMap: name: kube-root-ca.crt key: ca.crt insecureSkipVerify: true + three list entries added: - bearerTokenFile: /var/run/secrets/kubernetes.io/serviceaccount/token honorLabels: true honorTimestamps: true metricRelabelings: - action: drop regex: (csi_operations|storage_operation_duration)_seconds_bucket;(0.25|2.5|15|25|120|600)(\.0)? sourceLabels: - __name__ - le port: https-metrics relabelings: - action: replace sourceLabels: - __metrics_path__ targetLabel: metrics_path scheme: https tlsConfig: caFile: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt insecureSkipVerify: true - bearerTokenFile: /var/run/secrets/kubernetes.io/serviceaccount/token honorLabels: true honorTimestamps: true interval: 10s metricRelabelings: - action: drop regex: container_cpu_(cfs_throttled_seconds_total|load_average_10s|system_seconds_total|user_seconds_total) sourceLabels: - __name__ - action: drop regex: container_fs_(io_current|io_time_seconds_total|io_time_weighted_seconds_total|reads_merged_total|sector_reads_total|sector_writes_total|writes_merged_total) sourceLabels: - __name__ - action: drop regex: container_memory_(mapped_file|swap) sourceLabels: - __name__ - action: drop regex: container_(file_descriptors|tasks_state|threads_max) sourceLabels: - __name__ - action: drop regex: container_memory_failures_total;hierarchy sourceLabels: - __name__ - scope - action: drop regex: "container_network_.*;(cali|cilium|cni|lxc|nodelocaldns|tunl).*" sourceLabels: - __name__ - interface - action: drop regex: "container_spec.*" sourceLabels: - __name__ - action: drop regex: .+; sourceLabels: - id - pod path: /metrics/cadvisor port: https-metrics relabelings: - action: replace sourceLabels: - __metrics_path__ targetLabel: metrics_path scheme: https tlsConfig: caFile: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt insecureSkipVerify: true trackTimestampsStaleness: true - bearerTokenFile: /var/run/secrets/kubernetes.io/serviceaccount/token honorLabels: true honorTimestamps: true path: /metrics/probes port: https-metrics relabelings: - action: replace sourceLabels: - __metrics_path__ targetLabel: metrics_path scheme: https tlsConfig: caFile: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt insecureSkipVerify: true spec.template.spec (batch/v1/Job/monitoring/kube-prometheus-stack-admission-create) - one map entry removed: nodeSelector: kubernetes.io/os: linux spec.template.spec.containers.create.image (batch/v1/Job/monitoring/kube-prometheus-stack-admission-create) ± value change - ghcr.io/jkroepke/kube-webhook-certgen:1.8.9 + ghcr.io/jkroepke/kube-webhook-certgen:1.8.4 spec.template.spec (batch/v1/Job/monitoring/kube-prometheus-stack-admission-patch) - one map entry removed: nodeSelector: kubernetes.io/os: linux spec.template.spec.containers.patch.image (batch/v1/Job/monitoring/kube-prometheus-stack-admission-patch) ± value change - ghcr.io/jkroepke/kube-webhook-certgen:1.8.9 + ghcr.io/jkroepke/kube-webhook-certgen:1.8.4 ``` [Pipeline](https://ci.aether.earth/repos/4/pipeline/490)

renovate-bot force-pushed renovate/ghcr.io-scanopy-scanopy-server-0.x from 74e57196e7

ci/crow/push/tanka-test Pipeline was successful

Details

ci/crow/pr/dns-test Pipeline was successful

Details

ci/crow/push/dns-test Pipeline was successful

Details

ci/crow/pr/tanka-test Pipeline was successful

Details

ci/crow/pr/tanka-diff Pipeline was successful

Details

to c0bd696480

ci/crow/push/dns-test Pipeline was successful

Details

ci/crow/pr/dns-test Pipeline was successful

Details

ci/crow/push/tanka-test Pipeline was successful

Details

ci/crow/pr/tanka-test Pipeline was successful

Details

ci/crow/pr/tanka-diff Pipeline was successful

Details

2026-10-12 01:10:00 +00:00

Compare

renovate-bot changed title from ~~chore(deps): update ghcr.io/scanopy/scanopy/server docker tag to v0.17.22~~ to chore(deps): update ghcr.io/scanopy/scanopy/server docker tag to v0.18.0

2026-10-12 01:10:05 +00:00

ci-bot commented

2026-10-12 01:12:50 +00:00

Member

flate diff

spec.template.spec.containers.open-webui.image  (apps/v1/Deployment/local-ai/open-webui)
  ± value change
    - ghcr.io/open-webui/open-webui:0.12.0
    + ghcr.io/open-webui/open-webui:0.10.2

spec.template.spec.initContainers.copy-app-data.image  (apps/v1/Deployment/local-ai/open-webui)
  ± value change
    - ghcr.io/open-webui/open-webui:0.12.0
    + ghcr.io/open-webui/open-webui:0.10.2

Pipeline

## flate diff ``` spec.template.spec.containers.open-webui.image (apps/v1/Deployment/local-ai/open-webui) ± value change - ghcr.io/open-webui/open-webui:0.12.0 + ghcr.io/open-webui/open-webui:0.10.2 spec.template.spec.initContainers.copy-app-data.image (apps/v1/Deployment/local-ai/open-webui) ± value change - ghcr.io/open-webui/open-webui:0.12.0 + ghcr.io/open-webui/open-webui:0.10.2 ``` [Pipeline](https://ci.aether.earth/repos/4/pipeline/521)

renovate-bot changed title from ~~chore(deps): update ghcr.io/scanopy/scanopy/server docker tag to v0.18.0~~ to chore(deps): update ghcr.io/scanopy/scanopy/server docker tag to v0.18.2

2026-10-15 03:10:31 +00:00

renovate-bot force-pushed renovate/ghcr.io-scanopy-scanopy-server-0.x from 3970f1f7c2 to ca0869cfcf

ci/crow/pr/dns-test Pipeline was successful

Details

ci/crow/push/dns-test Pipeline was successful

Details

ci/crow/push/tanka-test Pipeline was successful

Details

ci/crow/pr/tanka-test Pipeline was successful

Details

ci/crow/pr/tanka-diff Pipeline was successful

Details

2026-10-23 02:10:14 +00:00

Compare

renovate-bot changed title from ~~chore(deps): update ghcr.io/scanopy/scanopy/server docker tag to v0.18.2~~ to chore(deps): update ghcr.io/scanopy/scanopy/server docker tag to v0.19.0

2026-10-23 02:10:19 +00:00

ci-bot commented

2026-10-23 02:13:19 +00:00

Member

flate diff

No differences detected.

Pipeline

## flate diff No differences detected. [Pipeline](https://ci.aether.earth/repos/4/pipeline/718)

ci/crow/push/tanka-test Pipeline was successful

Details

ci/crow/pr/dns-test Pipeline was successful

Details

ci/crow/push/dns-test Pipeline was successful

Details

ci/crow/pr/tanka-test Pipeline was successful

Details

ci/crow/pr/tanka-diff Pipeline was successful

Details

This pull request can be merged automatically.

You are not authorized to merge this pull request.

View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.

git fetch -u origin renovate/ghcr.io-scanopy-scanopy-server-0.x:renovate/ghcr.io-scanopy-scanopy-server-0.x

git switch renovate/ghcr.io-scanopy-scanopy-server-0.x

Merge

Merge the changes and update on Forgejo.

git switch main

git merge --no-ff renovate/ghcr.io-scanopy-scanopy-server-0.x

git switch renovate/ghcr.io-scanopy-scanopy-server-0.x

git rebase main

git switch main

git merge --ff-only renovate/ghcr.io-scanopy-scanopy-server-0.x

git switch renovate/ghcr.io-scanopy-scanopy-server-0.x

git rebase main

git switch main

git merge --no-ff renovate/ghcr.io-scanopy-scanopy-server-0.x

git switch main

git merge --squash renovate/ghcr.io-scanopy-scanopy-server-0.x

git switch main

git merge --ff-only renovate/ghcr.io-scanopy-scanopy-server-0.x

git switch main

git merge renovate/ghcr.io-scanopy-scanopy-server-0.x

git push origin main

Rows
Columns

chore(deps): update ghcr.io/scanopy/scanopy/server docker tag to v0.19.0 #114

Release Notes

New Features

Topology

Discovery

Improvements

Bug Fixes

New Features

Improvements

New Features

Improvements

Bug Fixes

New Features

Improvements

Bug Fixes

New Features

Improvements

Bug Fixes

New Features

Improvements

Bug Fixes

New Features

Improvements

New Features

Improvements

Bug Fixes

New Features

Improvements

Bug Fixes

New Features

Improvements

Bug Fixes

New Features

Improvements

Bug Fixes

New Features

Improvements

Bug Fixes

New Features

Improvements

Bug Fixes

New Features

Improvements

Bug Fixes

New Features

Improvements

Bug Fixes

New Features

New Features

Improvements

Bug Fixes

New Features

Improvements

Bug Fixes

New Features

Improvements

Bug Fixes

New Features

Improvements

Bug Fixes

New Features

Improvements

Bug Fixes

New Features

Improvements

Bug Fixes

Configuration

flate diff

flate diff

flate diff

flate diff

flate diff

flate diff

flate diff

flate diff

Checkout

Merge