diff --git a/.github/actions/publish-reports/action.yml b/.github/actions/publish-reports/action.yml new file mode 100644 index 000000000..449b65fa8 --- /dev/null +++ b/.github/actions/publish-reports/action.yml @@ -0,0 +1,11 @@ +name: Publish Reports +description: Publish JUnit test report + +runs: + using: composite + steps: + - name: Publish Test Report + if: success() || failure() + uses: mikepenz/action-junit-report@3a81627bfac62268172037048872e8ebd4207e6d # v6.4.1 + with: + report_paths: 'report.xml' diff --git a/.github/actions/save-go-cache/action.yml b/.github/actions/save-go-cache/action.yml new file mode 100644 index 000000000..4539302ed --- /dev/null +++ b/.github/actions/save-go-cache/action.yml @@ -0,0 +1,19 @@ +name: Save Go Cache +description: Trim old entries and persist Go module and build cache + +runs: + using: composite + steps: + - name: Trim Go cache + shell: bash + run: find ~/.cache/go-build -type f -mmin +90 -delete + - name: Set Go cache date + shell: bash + run: echo "GO_CACHE_DATE=$(date +%Y-%m-%d)" >> $GITHUB_ENV + - name: Save Go cache + uses: actions/cache/save@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5 + with: + path: | + ~/go/pkg/mod + ~/.cache/go-build + key: "release-0.68-${{ runner.os }}-go-${{ hashFiles('go.mod') }}-${{ env.GO_CACHE_DATE }}" diff --git a/.github/actions/setup-build-env/action.yml b/.github/actions/setup-build-env/action.yml new file mode 100644 index 000000000..be1b86fc6 --- /dev/null +++ b/.github/actions/setup-build-env/action.yml @@ -0,0 +1,80 @@ +name: Setup Build Environment +description: Checkout code, setup Go with caching, apt packages, and Docker image caching + +outputs: + image-tag: + description: Short SHA image tag (first 7 chars of GITHUB_SHA) + value: ${{ steps.vars.outputs.IMAGE_TAG }} + +runs: + using: composite + steps: + - name: Free space + shell: bash + run: | + formatByteCount() { echo $(numfmt --to=iec-i --suffix=B --padding=7 $1'000'); } + getAvailableSpace() { echo $(df -a $1 | awk 'NR > 1 {avail+=$4} END {print avail}'); } + BEFORE=$(getAvailableSpace) + sudo rm -rf /usr/local/lib/android & + sudo rm -rf /usr/share/dotnet & + sudo rm -rf /opt/ghc & + sudo rm -rf /usr/local/.ghcup & + wait + AFTER=$(getAvailableSpace) + SAVED=$((AFTER-BEFORE)) + echo "Saved $(formatByteCount $SAVED)" + - name: Prepare binary cache + uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5 + with: + path: ./bin + key: binary + - name: Setup Go + id: go + uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0 + with: + go-version-file: "go.mod" + check-latest: true + cache: false + - name: Restore Go cache + uses: actions/cache/restore@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5 + with: + path: | + ~/go/pkg/mod + ~/.cache/go-build + key: nonexistent + restore-keys: | + release-0.68-${{ runner.os }}-go-${{ hashFiles('go.mod') }}- + - name: Download Go modules + shell: bash + run: go mod download + - name: Cache apt packages + uses: awalsh128/cache-apt-pkgs-action@acb598e5ddbc6f68a970c5da0688d2f3a9f04d05 # v1.6.0 + with: + packages: libgpgme-dev + version: "1.0" + - name: Get Golang Docker image version + id: golang-version + shell: bash + run: | + echo "version=$(grep '^FROM golang:' Dockerfile | cut -d: -f2 | cut -d' ' -f1)" >> $GITHUB_OUTPUT + - name: Cache Golang Docker image + id: golang-docker-cache + uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5 + with: + path: /tmp/golang-docker.tar + key: golang-docker-${{ steps.golang-version.outputs.version }} + - name: Load Golang Docker image from cache + if: steps.golang-docker-cache.outputs.cache-hit == 'true' + shell: bash + run: docker load -i /tmp/golang-docker.tar + - name: Pull and cache Golang Docker image + if: steps.golang-docker-cache.outputs.cache-hit != 'true' + shell: bash + run: | + docker pull golang:${{ steps.golang-version.outputs.version }} + docker save golang:${{ steps.golang-version.outputs.version }} -o /tmp/golang-docker.tar + - name: Set output variables + id: vars + shell: bash + run: | + echo "IMAGE_TAG=${GITHUB_SHA:0:7}" >> $GITHUB_OUTPUT diff --git a/.github/workflows/main.yaml b/.github/workflows/main.yaml index 2cc4e4ad9..31ca31a07 100644 --- a/.github/workflows/main.yaml +++ b/.github/workflows/main.yaml @@ -3,16 +3,7 @@ name: Build and Test on: push: branches: - - master - paths: - - '**' - - '!docs/**' - - '!*.md' - - '!.github/**' - - '.github/workflows/docs.yaml' - - '!codespell/**' - - 'LICENSE' - - 'PROJECT' + - release-* pull_request: branches: - master @@ -23,18 +14,12 @@ on: - synchronize - ready_for_review - converted_to_draft - paths: - - '**' - - '!docs/**' - - '!*.md' - - '!.github/**' - - '.github/workflows/docs.yaml' - - '!codespell/**' - - 'LICENSE' - - 'PROJECT' concurrency: group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }} cancel-in-progress: true + +permissions: {} + jobs: build: name: Build and Test @@ -44,38 +29,20 @@ jobs: contents: read security-events: write checks: write + outputs: + run_e2e: ${{ steps.changes.outputs.src }} steps: - - name: Free space - run: | - # cleanup up space to free additional ~20GiB of memory - # which are lacking for multiplaform images build - formatByteCount() { echo $(numfmt --to=iec-i --suffix=B --padding=7 $1'000'); } - getAvailableSpace() { echo $(df -a $1 | awk 'NR > 1 {avail+=$4} END {print avail}'); } - BEFORE=$(getAvailableSpace) - sudo rm -rf /usr/local/lib/android || true - sudo rm -rf /usr/share/dotnet || true - sudo rm -rf /opt/ghc || true - sudo rm -rf /usr/local/.ghcup || true - AFTER=$(getAvailableSpace) - SAVED=$((AFTER-BEFORE)) - echo "Saved $(formatByteCount $SAVED)" - name: Checkout code - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - - name: Prepare binary cache - uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4 - with: - path: ./bin - key: binary - - name: Setup Go - uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0 + uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 with: - go-version-file: "go.mod" - check-latest: true - cache: true - id: go + persist-credentials: false + + - name: Setup build environment + id: setup + uses: ./.github/actions/setup-build-env - name: Run Trivy vulnerability scanner in repo mode - uses: aquasecurity/trivy-action@57a97c7e7821a5776cebc9bb87c984fa69cba8f1 # v0.35.0 + uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0 with: scan-type: "fs" ignore-unfixed: true @@ -83,32 +50,13 @@ jobs: output: "trivy-results.sarif" - name: Upload Trivy scan results to GitHub Security tab - uses: github/codeql-action/upload-sarif@c6f931105cb2c34c8f901cc885ba1e2e259cf745 # v4.34.0 + uses: github/codeql-action/upload-sarif@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2 with: sarif_file: "trivy-results.sarif" - - name: Set output variables - id: vars - run: | - IMAGE_TAG=${GITHUB_SHA:0:7} - echo "IMAGE_TAG=$IMAGE_TAG" >> $GITHUB_OUTPUT - - name: Install mirrord - run: | - curl -o ./mirrord_linux_x86_64.zip -fsSL https://github.com/metalbear-co/mirrord/releases/download/3.188.1/mirrord_linux_x86_64.zip - curl -o ./mirrord_linux_x86_64.shasum256 -fsSL https://github.com/metalbear-co/mirrord/releases/download/3.188.1/mirrord_linux_x86_64.shasum256 - sha256sum -c mirrord_linux_x86_64.shasum256 - unzip mirrord_linux_x86_64.zip - sudo mv ./mirrord /usr/bin/mirrord - sudo chmod +x /usr/bin/mirrord - name: Lint, Test and Build if: github.event.pull_request.draft == false - env: - DOCKER_BUILD_ARGS: --cache-from=type=gha --cache-to=type=gha,mode=max - TAG: ${{ steps.vars.outputs.IMAGE_TAG }} - LICENSE_KEY: ${{ secrets.ENTERPRISE_COMPONENTS_LICENSE_KEY }} run: | - sudo apt update - sudo apt install -y libgpgme-dev make lint make manifests make api-gen @@ -116,19 +64,59 @@ jobs: # check for uncommited changes to crds, docs or API git diff --exit-code make test - git fetch origin ${{ github.base_ref || 'master' }} - BASE_REF=origin/${{ github.base_ref || 'master' }} TAG=${TAG} make test-e2e - - name: Publish Test Report - uses: mikepenz/action-junit-report@49b2ca06f62aa7ef83ae6769a2179271e160d8e4 # v6.3.1 - if: success() || failure() - with: - report_paths: 'report.xml' - - name: Generate Allure Report - if: github.event.pull_request.draft == false && failure() - run: make allure-report - - name: Archive Allure report - if: github.event.pull_request.draft == false && failure() - uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0 + + - name: Save Go cache + if: ${{ github.ref == 'refs/heads/release-0.68' }} + uses: ./.github/actions/save-go-cache + + - name: Check changed files + uses: dorny/paths-filter@fbd0ab8f3e69293af611ebaee6363fc25e6d187d # v4.0.1 + id: changes with: - name: allure-report - path: ./allure-report + filters: | + src: + - '**' + - '!Makefile' + - '!docs/**' + - '!*.md' + - '!.github/**' + - '.github/workflows/main.yaml' + - '!codespell/**' + - 'LICENSE' + - 'PROJECT' + + e2e: + name: E2E / ${{ matrix.name }} + needs: build + if: github.event.pull_request.draft == false && needs.build.outputs.run_e2e == 'true' + runs-on: vm-runner + permissions: + actions: read + contents: read + checks: write + strategy: + fail-fast: false + matrix: + include: + - name: main + e2e_target: ./test/e2e/ + - name: upgrade + e2e_target: ./test/e2e/upgrade/... + steps: + - name: Checkout code + uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + - name: Setup build environment + id: setup + uses: ./.github/actions/setup-build-env + - name: E2E Tests + env: + DOCKER_BUILD_ARGS: --cache-from=type=gha --cache-to=type=gha,mode=max + LICENSE_KEY: ${{ secrets.ENTERPRISE_COMPONENTS_LICENSE_KEY }} + E2E_TARGET: ${{ matrix.e2e_target }} + run: | + TAG=${GITHUB_SHA:0:7} BASE_REF=origin/${{ github.base_ref || 'release-0.68' }} make test-e2e + - name: Save Go cache + if: ${{ github.ref == 'refs/heads/release-0.68' }} + uses: ./.github/actions/save-go-cache + - name: Publish reports + uses: ./.github/actions/publish-reports diff --git a/Makefile b/Makefile index 6fb9ba378..839d392a5 100644 --- a/Makefile +++ b/Makefile @@ -14,8 +14,6 @@ VERSION ?= $(if $(findstring $(TAG),$(TAG:v%=%)),0.0.0,$(TAG:v%=%)) DATEINFO_TAG ?= $(shell date -u +'%Y%m%d-%H%M%S') NAMESPACE ?= vm OVERLAY ?= config/manager -E2E_TESTS_CONCURRENCY ?= $(shell getconf _NPROCESSORS_ONLN) -E2E_TARGET ?= ./test/e2e/... FIPS_VERSION=v1.0.0 BASEIMAGE ?=scratch @@ -59,6 +57,7 @@ export FLAGS_HEADER include docs/Makefile include codespell/Makefile +include test/Makefile .PHONY: all all: build @@ -160,21 +159,6 @@ test: manifests generate fmt vet envtest ## Run tests. KUBEBUILDER_ASSETS="$(shell $(ENVTEST) use $(ENVTEST_K8S_VERSION) --bin-dir $(LOCALBIN) -p path)" go test $$(go list ./... | grep -v /e2e) -coverprofile cover.out cd api/ && go test ./operator/... -# Utilize Kind or modify the e2e tests to load the image locally, enabling compatibility with other vendors. -.PHONY: test-e2e # Run the e2e tests against a Kind k8s instance that is spun up. -test-e2e: load-kind ginkgo crust-gather mirrord - env CGO_ENABLED=1 OPERATOR_IMAGE=$(OPERATOR_IMAGE) CONFIG_RELOADER_IMAGE=$(CONFIG_RELOADER_IMAGE) REPORTS_DIR=$(shell pwd) CRUST_GATHER_BIN=$(CRUST_GATHER_BIN) $(MIRRORD_BIN) exec -f ./mirrord.json -- $(GINKGO_BIN) \ - -ldflags="-linkmode=external" \ - --output-interceptor-mode=none \ - -procs=$(E2E_TESTS_CONCURRENCY) \ - -randomize-all \ - -timeout=60m \ - -junit-report=report.xml $(E2E_TARGET) - -.PHONY: test-e2e-upgrade # Run only the e2e upgrade tests against a Kind k8s instance that is spun up. -test-e2e-upgrade: E2E_TARGET=./test/e2e/upgrade/... -test-e2e-upgrade: test-e2e - .PHONY: lint lint: golangci-lint ## Run golangci-lint linter cd api && $(GOLANGCI_LINT) run operator/... @@ -322,26 +306,6 @@ deploy: manifests kustomize ## Deploy controller to the K8s cluster specified in undeploy: kustomize ## Undeploy controller from the K8s cluster specified in ~/.kube/config. Call with ignore-not-found=true to ignore resource not found errors during deletion. $(KUSTOMIZE) build $(OVERLAY) | $(KUBECTL) delete $(if $(NAMESPACE),-n $(NAMESPACE),) --ignore-not-found=$(ignore-not-found) -f - -# builds image and loads it into kind. -ensure-kind-cluster: kind - if [ "`$(KIND) get clusters`" != "kind" ]; then \ - $(KIND) create cluster --config=./kind.yaml; \ - else \ - $(KUBECTL) cluster-info --context kind-kind; \ - fi - -load-kind: docker-build docker-build-config-reloader ensure-kind-cluster - if [ "$(CONTAINER_TOOL)" != "podman" ]; then \ - $(KIND) load docker-image $(REGISTRY)/$(ORG)/$(REPO):$(TAG); \ - $(KIND) load docker-image $(CONFIG_RELOADER_IMAGE); \ - fi - -deploy-kind: OVERLAY=config/base-with-webhook -deploy-kind: load-kind deploy - -undeploy-kind: OVERLAY=config/kind -undeploy-kind: load-kind undeploy - ## Location to install dependencies to LOCALBIN ?= $(shell pwd)/bin $(LOCALBIN): @@ -356,29 +320,23 @@ GOLANGCI_LINT = $(LOCALBIN)/golangci-lint-$(GOLANGCI_LINT_VERSION) CLIENT_GEN = $(LOCALBIN)/client-gen-$(CODEGENERATOR_VERSION) LISTER_GEN = $(LOCALBIN)/lister-gen-$(CODEGENERATOR_VERSION) INFORMER_GEN = $(LOCALBIN)/informer-gen-$(CODEGENERATOR_VERSION) -KIND = $(LOCALBIN)/kind-$(KIND_VERSION) OPERATOR_SDK = $(LOCALBIN)/operator-sdk-$(OPERATOR_SDK_VERSION) OPM = $(LOCALBIN)/opm-$(OPM_VERSION) YQ = $(LOCALBIN)/yq-$(YQ_VERSION) CRD_REF_DOCS = $(LOCALBIN)/crd-ref-docs-$(CRD_REF_DOCS_VERSION) -GINKGO_BIN ?= $(LOCALBIN)/ginkgo-$(GINKGO_VERSION) -CRUST_GATHER_BIN ?= $(LOCALBIN)/crust-gather-$(CRUST_GATHER_VERSION) -MIRRORD_BIN ?= $(LOCALBIN)/mirrord-$(MIRRORD_VERSION) +COSIGN_BIN ?= $(LOCALBIN)/cosign-$(COSIGN_VERSION) ## Tool Versions KUSTOMIZE_VERSION ?= v5.8.0 CONTROLLER_TOOLS_VERSION ?= v0.20.0 ENVTEST_VERSION ?= release-0.23 -GOLANGCI_LINT_VERSION ?= v2.10.1 +GOLANGCI_LINT_VERSION ?= v2.12.2 CODEGENERATOR_VERSION ?= v0.35.1 -KIND_VERSION ?= v0.31.0 -OLM_VERSION ?= 0.40.0 -OPERATOR_SDK_VERSION ?= v1.42.0 -OPM_VERSION ?= v1.62.0 -YQ_VERSION ?= v4.50.1 -GINKGO_VERSION ?= v2.28.1 -CRUST_GATHER_VERSION ?= v0.12.1 -MIRRORD_VERSION ?= 3.199.0 +OLM_VERSION ?= 0.45.0 +OPERATOR_SDK_VERSION ?= v1.42.2 +OPM_VERSION ?= v1.72.0 +YQ_VERSION ?= v4.53.3 +COSIGN_VERSION ?= v3.1.1 CRD_REF_DOCS_VERSION ?= 4deb8b1eb0169ac22ac5d777feaeb26a00e38a33 @@ -393,7 +351,7 @@ $(CONTROLLER_GEN): $(LOCALBIN) $(call go-install-tool,$(CONTROLLER_GEN),sigs.k8s.io/controller-tools/cmd/controller-gen,$(CONTROLLER_TOOLS_VERSION)) .PHONY: install-tools -install-tools: crd-ref-docs client-gen lister-gen informer-gen controller-gen kustomize envtest ginkgo +install-tools: crd-ref-docs client-gen lister-gen informer-gen controller-gen kustomize envtest .PHONY: crd-ref-docs crd-ref-docs: $(CRD_REF_DOCS) @@ -406,10 +364,6 @@ client-gen: $(CLIENT_GEN) $(CLIENT_GEN): $(LOCALBIN) $(call go-install-tool,$(CLIENT_GEN),k8s.io/code-generator/cmd/client-gen,$(CODEGENERATOR_VERSION)) -.PHONY: ginkgo -ginkgo: - $(call go-install-tool,$(GINKGO_BIN),github.com/onsi/ginkgo/v2/ginkgo,$(GINKGO_VERSION)) - .PHONY: lister-gen lister-gen: $(LISTER_GEN) $(LISTER_GEN): $(LOCALBIN) @@ -441,11 +395,6 @@ $(GOLANGCI_LINT): $(LOCALBIN) $(call go-install-tool,$(GOLANGCI_LINT),github.com/golangci/golangci-lint/v2/cmd/golangci-lint,$(GOLANGCI_LINT_VERSION)) $(call go-install-tool,$(GOLANGCI_LINT),github.com/golangci/golangci-lint/v2/cmd/golangci-lint,$(GOLANGCI_LINT_VERSION)) -.PHONY: kind -kind: $(KIND) -$(KIND): $(LOCALBIN) - $(call go-install-tool,$(KIND),sigs.k8s.io/kind,$(KIND_VERSION)) - .PHONY: yq yq: $(YQ) $(YQ): $(LOCALBIN) @@ -454,21 +403,6 @@ $(YQ): $(LOCALBIN) UNAME_S=$(shell uname -s 2>/dev/null) OS=$(shell echo $(UNAME_S) | tr A-Z a-z) ARCH=$(if $(filter x86_64,$(shell uname -m 2>/dev/null)),amd64,arm64) -MIRRORD_OS=$(if $(filter darwin,$(OS)),mac,linux) -MIRRORD_ARCH=$(if $(filter mac,$(MIRRORD_OS)),universal,$(if $(filter x86_64,$(shell uname -m 2>/dev/null)),x86_64,aarch64)) -.PHONY: crust-gather -crust-gather: $(CRUST_GATHER_BIN) -$(CRUST_GATHER_BIN): $(LOCALBIN) - $(call download-github-release,$(CRUST_GATHER_BIN),crust-gather/crust-gather,$(CRUST_GATHER_VERSION),kubectl-crust-gather_$(CRUST_GATHER_VERSION)_$(OS)_$(ARCH).tar.gz,kubectl-crust-gather) - -.PHONY: mirrord -mirrord: $(MIRRORD_BIN) -$(MIRRORD_BIN): $(LOCALBIN) - $(call download-github-release,$(MIRRORD_BIN),metalbear-co/mirrord,$(MIRRORD_VERSION),mirrord_$(MIRRORD_OS)_$(MIRRORD_ARCH).zip,mirrord) - -.PHONY: allure-report -allure-report: - @[ -d ./allure-results ] && npx allure awesome --single-file ./allure-results -o ./allure-report || echo "allure-results dir not found, skipping report generation" # go-install-tool will 'go install' any package with custom target and name of binary, if it doesn't exist # $1 - target path with name of binary (ideally with version) diff --git a/api/operator/v1beta1/common_scrapeparams.go b/api/operator/v1beta1/common_scrapeparams.go index f2405cdca..b5aa95f56 100644 --- a/api/operator/v1beta1/common_scrapeparams.go +++ b/api/operator/v1beta1/common_scrapeparams.go @@ -92,16 +92,16 @@ type OAuth2 struct { EndpointParams map[string]string `json:"endpoint_params,omitempty" yaml:"endpoint_params"` // The proxy URL for token_url connection - // ( available from v0.55.0). // Is only supported by Scrape objects family // +optional + // +notes={available_from: "v0.55.0"} ProxyURL string `json:"proxy_url,omitempty"` // TLSConfig for token_url connection - // ( available from v0.55.0). // Is only supported by Scrape objects family // +optional // +kubebuilder:validation:Schemaless // +kubebuilder:pruning:PreserveUnknownFields + // +notes={available_from: "v0.55.0"} TLSConfig *TLSConfig `json:"tls_config,omitempty"` } @@ -528,7 +528,7 @@ type CommonScrapeParams struct { // VMAgentExternalLabelName Name of vmAgent external label used to denote vmAgent instance // name. Defaults to the value of `prometheus`. External label will // _not_ be added when value is set to empty string (`""`). - // +deprecated={deprecated_in: "v0.67.0", removed_in: "v0.69.0", replacements: {externalLabelName}} + // +notes={deprecated_in: "v0.67.0", removed_in: "v0.69.0", replacements: {externalLabelName}} // +optional VMAgentExternalLabelName *string `json:"vmAgentExternalLabelName,omitempty"` // ExternalLabelName Name of external label used to denote scraping agent instance diff --git a/api/operator/v1beta1/vmagent_types.go b/api/operator/v1beta1/vmagent_types.go index b2f82fb80..18870d281 100644 --- a/api/operator/v1beta1/vmagent_types.go +++ b/api/operator/v1beta1/vmagent_types.go @@ -80,9 +80,9 @@ type VMAgentSpec struct { PodDisruptionBudget *EmbeddedPodDisruptionBudgetSpec `json:"podDisruptionBudget,omitempty"` // DaemonSetMode enables DaemonSet deployment mode instead of Deployment. // Supports only VMPodScrape - // (available from v0.55.0). // Cannot be used with statefulMode // +optional + // +notes={available_from: "v0.55.0"} DaemonSetMode bool `json:"daemonSetMode,omitempty"` // StatefulMode enables StatefulSet for `VMAgent` instead of Deployment // it allows using persistent storage for vmagent's persistentQueue diff --git a/api/operator/v1beta1/vmalertmanagerconfig_types.go b/api/operator/v1beta1/vmalertmanagerconfig_types.go index f55a8dfe0..bb4a59628 100644 --- a/api/operator/v1beta1/vmalertmanagerconfig_types.go +++ b/api/operator/v1beta1/vmalertmanagerconfig_types.go @@ -365,12 +365,16 @@ type Receiver struct { // +optional WebexConfigs []WebexConfig `json:"webex_configs,omitempty" yaml:"webex_configs,omitempty"` // +optional + // +notes={available_from: "v0.55.0"} JiraConfigs []JiraConfig `json:"jira_configs,omitempty" yaml:"jira_configs,omitempty"` // +optional - IncidentIOConfigs []IncidentIOConfig `json:"incidentio_configs,omitempty" yaml:"incidentio_configs,omitempty"` + // +notes={available_from: "v0.66.0"} + IncidentIOConfigs []IncidentioConfig `json:"incidentio_configs,omitempty" yaml:"incidentio_configs,omitempty"` // +optional + // +notes={available_from: "v0.55.0"} RocketchatConfigs []RocketchatConfig `json:"rocketchat_configs,omitempty" yaml:"rocketchat_configs,omitempty"` // +optional + // +notes={available_from: "v0.55.0"} MSTeamsV2Configs []MSTeamsV2Config `json:"msteamsv2_configs,omitempty" yaml:"msteamsv2_configs,omitempty"` } @@ -903,17 +907,20 @@ type DiscordConfig struct { // +optional HTTPConfig *HTTPConfig `json:"http_config,omitempty" yaml:"http_config,omitempty"` // Content defines message content template - // Available from operator v0.55.0 and alertmanager v0.28.0 + // Available from alertmanager v0.28.0 // +kubebuilder:validation:MaxLength:=2000 // +optional + // +notes={available_from: "v0.55.0"} Content string `json:"content,omitempty"` // Username defines message username - // Available from operator v0.55.0 and alertmanager v0.28.0 + // Available from alertmanager v0.28.0 // +optional + // +notes={available_from: "v0.55.0"} Username string `json:"username,omitempty" yaml:"username"` // AvatarURL defines message avatar URL - // Available from operator v0.55.0 and alertmanager v0.28.0 + // Available from alertmanager v0.28.0 // +optional + // +notes={available_from: "v0.55.0"} AvatarURL string `json:"avatar_url,omitempty" yaml:"avatar_url,omitempty"` } @@ -992,8 +999,7 @@ type WebexConfig struct { // JiraConfig represent alertmanager's jira_config entry // https://prometheus.io/docs/alerting/latest/configuration/#jira_config -// available from v0.55.0 operator version -// and v0.28.0 alertmanager version +// Available from v0.28.0 alertmanager version type JiraConfig struct { // SendResolved controls notify about resolved alerts. // +optional @@ -1053,9 +1059,8 @@ type JiraConfig struct { // IncidentIOConfig configures notifications via incident.io. // https://prometheus.io/docs/alerting/latest/configuration/#incidentio_config -// available from v0.66.0 operator version -// and v0.29.0 alertmanager version -type IncidentIOConfig struct { +// Available from v0.29.0 alertmanager version +type IncidentioConfig struct { // SendResolved controls notify about resolved alerts. // +optional SendResolved *bool `json:"send_resolved,omitempty" yaml:"send_resolved,omitempty"` @@ -1079,8 +1084,7 @@ type IncidentIOConfig struct { // RocketchatConfig configures notifications via Rocketchat. // https://prometheus.io/docs/alerting/latest/configuration/#rocketchat_config -// available from v0.55.0 operator version -// and v0.28.0 alertmanager version +// Available from v0.28.0 alertmanager version type RocketchatConfig struct { // SendResolved controls notify about resolved alerts. // +optional @@ -1154,8 +1158,7 @@ type RocketchatAttachmentAction struct { // MSTeamsV2Config sends notifications using the new message format with adaptive cards as required by flows. // https://support.microsoft.com/en-gb/office/create-incoming-webhooks-with-workflows-for-microsoft-teams-8ae491c7-0394-4861-ba59-055e33f75498 -// available from v0.55.0 operator version -// and v0.28.0 alertmanager version +// Available from v0.28.0 alertmanager version type MSTeamsV2Config struct { // SendResolved controls notify about resolved alerts. // +optional diff --git a/api/operator/v1beta1/vmauth_types.go b/api/operator/v1beta1/vmauth_types.go index cfae5d1de..d7b570d53 100644 --- a/api/operator/v1beta1/vmauth_types.go +++ b/api/operator/v1beta1/vmauth_types.go @@ -71,12 +71,12 @@ type VMAuthSpec struct { // UnauthorizedAccessConfig configures access for un authorized users // +kubebuilder:validation:Schemaless // +kubebuilder:pruning:PreserveUnknownFields - // +deprecated={deprecated_in: "v0.51.0", removed_in: "v1.0.0", replacements: {unauthorizedUserAccessSpec}} + // +notes={deprecated_in: "v0.51.0", removed_in: "v1.0.0", replacements: {unauthorizedUserAccessSpec}} UnauthorizedAccessConfig []UnauthorizedAccessConfigURLMap `json:"unauthorizedAccessConfig,omitempty" yaml:"unauthorizedAccessConfig,omitempty"` // VMUserConfigOptions applies configurations to above UnauthorizedAccessConfig // +kubebuilder:validation:Schemaless // +kubebuilder:pruning:PreserveUnknownFields - // +deprecated={deprecated_in: "v0.51.0", removed_in: "v1.0.0", replacements: {unauthorizedUserAccessSpec}} + // +notes={deprecated_in: "v0.51.0", removed_in: "v1.0.0", replacements: {unauthorizedUserAccessSpec}} VMUserConfigOptions `json:",inline" yaml:",inline"` // UnauthorizedUserAccessSpec defines unauthorized_user config section of vmauth config @@ -99,7 +99,7 @@ type VMAuthSpec struct { // configuration must be inside secret key: config.yaml. // It must be created and managed manually. // If it's defined, configuration for vmauth becomes unmanaged and operator'll not create any related secrets/config-reloaders - // +deprecated={deprecated_in: "v0.49.0", removed_in: "v0.69.0", replacements: {externalConfig}} + // +notes={deprecated_in: "v0.49.0", removed_in: "v0.69.0", replacements: {externalConfig}} ConfigSecret string `json:"configSecret,omitempty" yaml:"configSecret,omitempty"` // ExternalConfig defines a source of external VMAuth configuration. // If it's defined, configuration for vmauth becomes unmanaged and operator'll not create any related secrets/config-reloaders @@ -113,10 +113,10 @@ type VMAuthSpec struct { CommonConfigReloaderParams `json:",inline,omitempty" yaml:",inline"` CommonAppsParams `json:",inline,omitempty" yaml:",inline"` // InternalListenPort instructs vmauth to serve internal routes at given port - // available from v0.56.0 operator - // and v1.111.0 vmauth version + // available from v1.111.0 vmauth version // related doc https://docs.victoriametrics.com/victoriametrics/vmauth/#security // +optional + // +notes={available_from: "v0.56.0"} InternalListenPort string `json:"internalListenPort,omitempty"` // UseProxyProtocol enables proxy protocol for vmauth @@ -124,13 +124,13 @@ type VMAuthSpec struct { UseProxyProtocol bool `json:"useProxyProtocol,omitempty"` // UpdateStrategy - overrides default update strategy. - // Available from operator v0.64.0 // +kubebuilder:validation:Enum=Recreate;RollingUpdate // +optional + // +notes={available_from: "v0.64.0"} UpdateStrategy *appsv1.DeploymentStrategyType `json:"updateStrategy,omitempty"` // RollingUpdate - overrides deployment update params. - // Available from operator v0.64.0 // +optional + // +notes={available_from: "v0.64.0"} RollingUpdate *appsv1.RollingUpdateDeployment `json:"rollingUpdate,omitempty"` // Configures horizontal pod autoscaling. // +optional @@ -145,10 +145,10 @@ type VMAuthUnauthorizedUserAccessSpec struct { // URLPrefix defines url prefix for destination // +kubebuilder:validation:Schemaless // +kubebuilder:pruning:PreserveUnknownFields - // +deprecated={deprecated_in: "v0.67.0", removed_in: "v0.69.0", replacements: {targetRefs}} + // +notes={deprecated_in: "v0.67.0", removed_in: "v0.69.0", replacements: {targetRefs}} URLPrefix StringOrArray `json:"url_prefix,omitempty" yaml:"url_prefix,omitempty"` // URLMap defines url map for destination - // +deprecated={deprecated_in: "v0.67.0", removed_in: "v0.69.0", replacements: {targetRefs}} + // +notes={deprecated_in: "v0.67.0", removed_in: "v0.69.0", replacements: {targetRefs}} URLMap []UnauthorizedAccessConfigURLMap `json:"url_map,omitempty" yaml:"url_map,omitempty"` // TargetRefs - reference to endpoints, which user may access. diff --git a/api/operator/v1beta1/vmcluster_types.go b/api/operator/v1beta1/vmcluster_types.go index f404f15a5..ba0bce219 100644 --- a/api/operator/v1beta1/vmcluster_types.go +++ b/api/operator/v1beta1/vmcluster_types.go @@ -499,7 +499,7 @@ type VMBackup struct { // AcceptEULA accepts enterprise feature usage, must be set to true. // otherwise backupmanager cannot be added to single/cluster version. // https://victoriametrics.com/legal/esa/ - // +deprecated={deprecated_in: "v0.61.0", removed_in: "v0.69.0", replacements: {VMClusterSpec.license}} + // +notes={deprecated_in: "v0.61.0", removed_in: "v0.69.0", replacements: {VMClusterSpec.license}} // +optional AcceptEULA bool `json:"acceptEULA"` // SnapshotCreateURL overwrites url for snapshot create @@ -1001,13 +1001,13 @@ type VMAuthLoadBalancerSpec struct { PodDisruptionBudget *EmbeddedPodDisruptionBudgetSpec `json:"podDisruptionBudget,omitempty"` // UpdateStrategy - overrides default update strategy. - // Available from operator v0.64.0 // +kubebuilder:validation:Enum=Recreate;RollingUpdate // +optional + // +notes={available_from: "v0.64.0"} UpdateStrategy *appsv1.DeploymentStrategyType `json:"updateStrategy,omitempty"` // RollingUpdate - overrides deployment update params. - // Available from operator v0.64.0 // +optional + // +notes={available_from: "v0.64.0"} RollingUpdate *appsv1.RollingUpdateDeployment `json:"rollingUpdate,omitempty"` // License configures enterprise features license key // +optional diff --git a/api/operator/v1beta1/vmextra_types.go b/api/operator/v1beta1/vmextra_types.go index 92c0599ff..69f04931c 100644 --- a/api/operator/v1beta1/vmextra_types.go +++ b/api/operator/v1beta1/vmextra_types.go @@ -412,9 +412,9 @@ type EmbeddedPodDisruptionBudgetSpec struct { // Valid policies are IfHealthyBudget and AlwaysAllow. // If no policy is specified, the default behavior will be used, // which corresponds to the IfHealthyBudget policy. - // Available from operator v0.64.0 // +optional // +kubebuilder:validation:Enum=IfHealthyBudget;AlwaysAllow + // +notes={available_from: "v0.64.0"} UnhealthyPodEvictionPolicy string `json:"unhealthyPodEvictionPolicy,omitempty"` } @@ -530,8 +530,9 @@ type StreamAggrConfig struct { // IgnoreOldSamples instructs to ignore samples with old timestamps outside the current aggregation interval. // +optional IgnoreOldSamples bool `json:"ignoreOldSamples,omitempty"` - // EnableWindows enables aggregating data in separate windows ( available from v0.54.0). + // EnableWindows enables aggregating data in separate windows. // +optional + // +notes={available_from: "v0.54.0"} EnableWindows bool `json:"enableWindows,omitempty"` } @@ -1134,7 +1135,7 @@ type CommonConfigReloaderParams struct { // +optional UseVMConfigReloader *bool `json:"useVMConfigReloader,omitempty"` // ConfigReloaderImageTag defines image:tag for config-reloader container - // +deprecated={deprecated_in: "v0.67.0", removed_in: "v0.69.0", replacements: {configReloaderImage}} + // +notes={deprecated_in: "v0.67.0", removed_in: "v0.69.0", replacements: {configReloaderImage}} // +optional ConfigReloaderImageTag string `json:"configReloaderImageTag,omitempty"` // ConfigReloaderImage defines image:tag for config-reloader container @@ -1254,7 +1255,7 @@ type CommonAppsParams struct { ConfigMaps []string `json:"configMaps,omitempty"` // Volumes allows configuration of additional volumes on the output Deployment/StatefulSet definition. // Volumes specified will be appended to other volumes that are generated. - /// +optional + // +optional Volumes []corev1.Volume `json:"volumes,omitempty"` // VolumeMounts allows configuration of additional VolumeMounts on the output Deployment/StatefulSet definition. // VolumeMounts specified will be appended to other VolumeMounts in the Application container @@ -1271,12 +1272,13 @@ type CommonAppsParams struct { // going to be performed, except for delete actions. // +optional Paused bool `json:"paused,omitempty"` - // DisableAutomountServiceAccountToken whether to disable serviceAccount auto mount by Kubernetes (available from v0.54.0). + // DisableAutomountServiceAccountToken whether to disable serviceAccount auto mount by Kubernetes // Operator will conditionally create volumes and volumeMounts for containers if it requires k8s API access. // For example, vmagent and vm-config-reloader requires k8s API access. // Operator creates volumes with name: "kube-api-access", which can be used as volumeMount for extraContainers if needed. // And also adds VolumeMounts at /var/run/secrets/kubernetes.io/serviceaccount. // +optional + // +notes={available_from: "v0.54.0"} DisableAutomountServiceAccountToken bool `json:"disableAutomountServiceAccountToken,omitempty"` // ExtraEnvsFrom defines source of env variables for the application container diff --git a/api/operator/v1beta1/vmprobe_types.go b/api/operator/v1beta1/vmprobe_types.go index f458102e5..c2477ea5a 100644 --- a/api/operator/v1beta1/vmprobe_types.go +++ b/api/operator/v1beta1/vmprobe_types.go @@ -54,7 +54,7 @@ type VMProbeSpec struct { // +k8s:openapi-gen=true type VMProbeTargets struct { // StaticConfig defines static targets which are considers for probing. - // +deprecated={deprecated_in: "v0.68.0", removed_in: "v0.71.0", replacements: {static}} + // +notes={deprecated_in: "v0.68.0", removed_in: "v0.71.0", replacements: {static}} // +optional StaticConfig *VMProbeTargetStatic `json:"staticConfig,omitempty"` // Static defines static targets which are considers for probing. @@ -64,7 +64,7 @@ type VMProbeTargets struct { // +optional Kubernetes []*VMProbeTargetKubernetes `json:"kubernetes,omitempty"` // Ingress defines the set of dynamically discovered Ingress objects which hosts are considered for probing. - // +deprecated={deprecated_in: "v0.68.0", removed_in: "v0.71.0", replacements: {kubernetes}} + // +notes={deprecated_in: "v0.68.0", removed_in: "v0.71.0", replacements: {kubernetes}} // +optional Ingress *VMProbeTargetKubernetes `json:"ingress,omitempty"` } diff --git a/api/operator/v1beta1/vmsingle_types.go b/api/operator/v1beta1/vmsingle_types.go index 437bdfdbc..d27a05eb0 100644 --- a/api/operator/v1beta1/vmsingle_types.go +++ b/api/operator/v1beta1/vmsingle_types.go @@ -281,6 +281,10 @@ func (cr *VMSingle) IsOwnsServiceAccount() bool { return cr.Spec.ServiceAccountName == "" } +func (cr *VMSingle) GetRBACName() string { + return fmt.Sprintf("monitoring:%s:%s", cr.Namespace, cr.PrefixedName()) +} + func (cr *VMSingle) AsURL() string { port := cr.Spec.Port if port == "" { diff --git a/api/operator/v1beta1/zz_generated.deepcopy.go b/api/operator/v1beta1/zz_generated.deepcopy.go index 06aef6da8..eccca0044 100644 --- a/api/operator/v1beta1/zz_generated.deepcopy.go +++ b/api/operator/v1beta1/zz_generated.deepcopy.go @@ -1796,7 +1796,7 @@ func (in *ImageConfig) DeepCopy() *ImageConfig { } // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. -func (in *IncidentIOConfig) DeepCopyInto(out *IncidentIOConfig) { +func (in *IncidentioConfig) DeepCopyInto(out *IncidentioConfig) { *out = *in if in.SendResolved != nil { in, out := &in.SendResolved, &out.SendResolved @@ -1815,12 +1815,12 @@ func (in *IncidentIOConfig) DeepCopyInto(out *IncidentIOConfig) { } } -// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new IncidentIOConfig. -func (in *IncidentIOConfig) DeepCopy() *IncidentIOConfig { +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new IncidentioConfig. +func (in *IncidentioConfig) DeepCopy() *IncidentioConfig { if in == nil { return nil } - out := new(IncidentIOConfig) + out := new(IncidentioConfig) in.DeepCopyInto(out) return out } @@ -2721,7 +2721,7 @@ func (in *Receiver) DeepCopyInto(out *Receiver) { } if in.IncidentIOConfigs != nil { in, out := &in.IncidentIOConfigs, &out.IncidentIOConfigs - *out = make([]IncidentIOConfig, len(*in)) + *out = make([]IncidentioConfig, len(*in)) for i := range *in { (*in)[i].DeepCopyInto(&(*out)[i]) } diff --git a/config/crd/overlay/crd.yaml b/config/crd/overlay/crd.yaml index f4f00fd4e..721b78c3f 100644 --- a/config/crd/overlay/crd.yaml +++ b/config/crd/overlay/crd.yaml @@ -487,7 +487,7 @@ spec: type: array disableAutomountServiceAccountToken: description: |- - DisableAutomountServiceAccountToken whether to disable serviceAccount auto mount by Kubernetes (available from v0.54.0). + DisableAutomountServiceAccountToken whether to disable serviceAccount auto mount by Kubernetes Operator will conditionally create volumes and volumeMounts for containers if it requires k8s API access. For example, vmagent and vm-config-reloader requires k8s API access. Operator creates volumes with name: "kube-api-access", which can be used as volumeMount for extraContainers if needed. @@ -978,7 +978,6 @@ spec: Valid policies are IfHealthyBudget and AlwaysAllow. If no policy is specified, the default behavior will be used, which corresponds to the IfHealthyBudget policy. - Available from operator v0.64.0 enum: - IfHealthyBudget - AlwaysAllow @@ -2241,7 +2240,6 @@ spec: description: |- Volumes allows configuration of additional volumes on the output Deployment/StatefulSet definition. Volumes specified will be appended to other volumes that are generated. - / +optional items: description: Volume represents a named volume in a pod that may be accessed by any container in the pod. @@ -2574,7 +2572,7 @@ spec: type: array disableAutomountServiceAccountToken: description: |- - DisableAutomountServiceAccountToken whether to disable serviceAccount auto mount by Kubernetes (available from v0.54.0). + DisableAutomountServiceAccountToken whether to disable serviceAccount auto mount by Kubernetes Operator will conditionally create volumes and volumeMounts for containers if it requires k8s API access. For example, vmagent and vm-config-reloader requires k8s API access. Operator creates volumes with name: "kube-api-access", which can be used as volumeMount for extraContainers if needed. @@ -2904,7 +2902,6 @@ spec: Valid policies are IfHealthyBudget and AlwaysAllow. If no policy is specified, the default behavior will be used, which corresponds to the IfHealthyBudget policy. - Available from operator v0.64.0 enum: - IfHealthyBudget - AlwaysAllow @@ -3460,7 +3457,6 @@ spec: description: |- Volumes allows configuration of additional volumes on the output Deployment/StatefulSet definition. Volumes specified will be appended to other volumes that are generated. - / +optional items: description: Volume represents a named volume in a pod that may be accessed by any container in the pod. @@ -3644,7 +3640,7 @@ spec: type: array disableAutomountServiceAccountToken: description: |- - DisableAutomountServiceAccountToken whether to disable serviceAccount auto mount by Kubernetes (available from v0.54.0). + DisableAutomountServiceAccountToken whether to disable serviceAccount auto mount by Kubernetes Operator will conditionally create volumes and volumeMounts for containers if it requires k8s API access. For example, vmagent and vm-config-reloader requires k8s API access. Operator creates volumes with name: "kube-api-access", which can be used as volumeMount for extraContainers if needed. @@ -3988,7 +3984,6 @@ spec: Valid policies are IfHealthyBudget and AlwaysAllow. If no policy is specified, the default behavior will be used, which corresponds to the IfHealthyBudget policy. - Available from operator v0.64.0 enum: - IfHealthyBudget - AlwaysAllow @@ -4391,7 +4386,6 @@ spec: description: |- Volumes allows configuration of additional volumes on the output Deployment/StatefulSet definition. Volumes specified will be appended to other volumes that are generated. - / +optional items: description: Volume represents a named volume in a pod that may be accessed by any container in the pod. @@ -4584,7 +4578,7 @@ spec: type: array disableAutomountServiceAccountToken: description: |- - DisableAutomountServiceAccountToken whether to disable serviceAccount auto mount by Kubernetes (available from v0.54.0). + DisableAutomountServiceAccountToken whether to disable serviceAccount auto mount by Kubernetes Operator will conditionally create volumes and volumeMounts for containers if it requires k8s API access. For example, vmagent and vm-config-reloader requires k8s API access. Operator creates volumes with name: "kube-api-access", which can be used as volumeMount for extraContainers if needed. @@ -5593,7 +5587,6 @@ spec: Valid policies are IfHealthyBudget and AlwaysAllow. If no policy is specified, the default behavior will be used, which corresponds to the IfHealthyBudget policy. - Available from operator v0.64.0 enum: - IfHealthyBudget - AlwaysAllow @@ -6025,7 +6018,6 @@ spec: description: |- Volumes allows configuration of additional volumes on the output Deployment/StatefulSet definition. Volumes specified will be appended to other volumes that are generated. - / +optional items: description: Volume represents a named volume in a pod that may be accessed by any container in the pod. @@ -6481,7 +6473,7 @@ spec: type: array disableAutomountServiceAccountToken: description: |- - DisableAutomountServiceAccountToken whether to disable serviceAccount auto mount by Kubernetes (available from v0.54.0). + DisableAutomountServiceAccountToken whether to disable serviceAccount auto mount by Kubernetes Operator will conditionally create volumes and volumeMounts for containers if it requires k8s API access. For example, vmagent and vm-config-reloader requires k8s API access. Operator creates volumes with name: "kube-api-access", which can be used as volumeMount for extraContainers if needed. @@ -7603,7 +7595,6 @@ spec: description: |- Volumes allows configuration of additional volumes on the output Deployment/StatefulSet definition. Volumes specified will be appended to other volumes that are generated. - / +optional items: description: Volume represents a named volume in a pod that may be accessed by any container in the pod. @@ -8603,12 +8594,11 @@ spec: description: |- DaemonSetMode enables DaemonSet deployment mode instead of Deployment. Supports only VMPodScrape - (available from v0.55.0). Cannot be used with statefulMode type: boolean disableAutomountServiceAccountToken: description: |- - DisableAutomountServiceAccountToken whether to disable serviceAccount auto mount by Kubernetes (available from v0.54.0). + DisableAutomountServiceAccountToken whether to disable serviceAccount auto mount by Kubernetes Operator will conditionally create volumes and volumeMounts for containers if it requires k8s API access. For example, vmagent and vm-config-reloader requires k8s API access. Operator creates volumes with name: "kube-api-access", which can be used as volumeMount for extraContainers if needed. @@ -9518,7 +9508,6 @@ spec: Valid policies are IfHealthyBudget and AlwaysAllow. If no policy is specified, the default behavior will be used, which corresponds to the IfHealthyBudget policy. - Available from operator v0.64.0 enum: - IfHealthyBudget - AlwaysAllow @@ -10281,7 +10270,6 @@ spec: proxy_url: description: |- The proxy URL for token_url connection - ( available from v0.55.0). Is only supported by Scrape objects family type: string scopes: @@ -10292,7 +10280,6 @@ spec: tls_config: description: |- TLSConfig for token_url connection - ( available from v0.55.0). Is only supported by Scrape objects family x-kubernetes-preserve-unknown-fields: true token_url: @@ -10355,7 +10342,7 @@ spec: type: array enableWindows: description: EnableWindows enables aggregating data in separate - windows ( available from v0.54.0). + windows. type: boolean ignoreFirstIntervals: description: IgnoreFirstIntervals instructs to ignore first @@ -11329,7 +11316,6 @@ spec: proxy_url: description: |- The proxy URL for token_url connection - ( available from v0.55.0). Is only supported by Scrape objects family type: string scopes: @@ -11340,7 +11326,6 @@ spec: tls_config: description: |- TLSConfig for token_url connection - ( available from v0.55.0). Is only supported by Scrape objects family x-kubernetes-preserve-unknown-fields: true token_url: @@ -12757,7 +12742,7 @@ spec: type: array enableWindows: description: EnableWindows enables aggregating data in separate - windows ( available from v0.54.0). + windows. type: boolean ignoreFirstIntervals: description: IgnoreFirstIntervals instructs to ignore first interval @@ -13208,7 +13193,6 @@ spec: description: |- Volumes allows configuration of additional volumes on the output Deployment/StatefulSet definition. Volumes specified will be appended to other volumes that are generated. - / +optional items: description: Volume represents a named volume in a pod that may be accessed by any container in the pod. @@ -13419,12 +13403,12 @@ spec: avatar_url: description: |- AvatarURL defines message avatar URL - Available from operator v0.55.0 and alertmanager v0.28.0 + Available from alertmanager v0.28.0 type: string content: description: |- Content defines message content template - Available from operator v0.55.0 and alertmanager v0.28.0 + Available from alertmanager v0.28.0 maxLength: 2000 type: string http_config: @@ -13656,7 +13640,6 @@ spec: proxy_url: description: |- The proxy URL for token_url connection - ( available from v0.55.0). Is only supported by Scrape objects family type: string scopes: @@ -13668,7 +13651,6 @@ spec: tls_config: description: |- TLSConfig for token_url connection - ( available from v0.55.0). Is only supported by Scrape objects family x-kubernetes-preserve-unknown-fields: true token_url: @@ -13854,7 +13836,7 @@ spec: username: description: |- Username defines message username - Available from operator v0.55.0 and alertmanager v0.28.0 + Available from alertmanager v0.28.0 type: string webhook_url: description: |- @@ -14152,8 +14134,7 @@ spec: description: |- IncidentIOConfig configures notifications via incident.io. https://prometheus.io/docs/alerting/latest/configuration/#incidentio_config - available from v0.66.0 operator version - and v0.29.0 alertmanager version + Available from v0.29.0 alertmanager version properties: alert_source_token: description: AlertSourceToken is used to authenticate @@ -14206,8 +14187,7 @@ spec: description: |- JiraConfig represent alertmanager's jira_config entry https://prometheus.io/docs/alerting/latest/configuration/#jira_config - available from v0.55.0 operator version - and v0.28.0 alertmanager version + Available from v0.28.0 alertmanager version properties: api_url: description: |- @@ -14510,7 +14490,6 @@ spec: proxy_url: description: |- The proxy URL for token_url connection - ( available from v0.55.0). Is only supported by Scrape objects family type: string scopes: @@ -14522,7 +14501,6 @@ spec: tls_config: description: |- TLSConfig for token_url connection - ( available from v0.55.0). Is only supported by Scrape objects family x-kubernetes-preserve-unknown-fields: true token_url: @@ -14744,8 +14722,7 @@ spec: description: |- MSTeamsV2Config sends notifications using the new message format with adaptive cards as required by flows. https://support.microsoft.com/en-gb/office/create-incoming-webhooks-with-workflows-for-microsoft-teams-8ae491c7-0394-4861-ba59-055e33f75498 - available from v0.55.0 operator version - and v0.28.0 alertmanager version + Available from v0.28.0 alertmanager version properties: http_config: x-kubernetes-preserve-unknown-fields: true @@ -15157,8 +15134,7 @@ spec: description: |- RocketchatConfig configures notifications via Rocketchat. https://prometheus.io/docs/alerting/latest/configuration/#rocketchat_config - available from v0.55.0 operator version - and v0.28.0 alertmanager version + Available from v0.28.0 alertmanager version properties: actions: items: @@ -15666,7 +15642,6 @@ spec: proxy_url: description: |- The proxy URL for token_url connection - ( available from v0.55.0). Is only supported by Scrape objects family type: string scopes: @@ -15678,7 +15653,6 @@ spec: tls_config: description: |- TLSConfig for token_url connection - ( available from v0.55.0). Is only supported by Scrape objects family x-kubernetes-preserve-unknown-fields: true token_url: @@ -16293,7 +16267,6 @@ spec: proxy_url: description: |- The proxy URL for token_url connection - ( available from v0.55.0). Is only supported by Scrape objects family type: string scopes: @@ -16305,7 +16278,6 @@ spec: tls_config: description: |- TLSConfig for token_url connection - ( available from v0.55.0). Is only supported by Scrape objects family x-kubernetes-preserve-unknown-fields: true token_url: @@ -16738,7 +16710,6 @@ spec: proxy_url: description: |- The proxy URL for token_url connection - ( available from v0.55.0). Is only supported by Scrape objects family type: string scopes: @@ -16750,7 +16721,6 @@ spec: tls_config: description: |- TLSConfig for token_url connection - ( available from v0.55.0). Is only supported by Scrape objects family x-kubernetes-preserve-unknown-fields: true token_url: @@ -17274,7 +17244,6 @@ spec: proxy_url: description: |- The proxy URL for token_url connection - ( available from v0.55.0). Is only supported by Scrape objects family type: string scopes: @@ -17286,7 +17255,6 @@ spec: tls_config: description: |- TLSConfig for token_url connection - ( available from v0.55.0). Is only supported by Scrape objects family x-kubernetes-preserve-unknown-fields: true token_url: @@ -18429,7 +18397,7 @@ spec: type: array disableAutomountServiceAccountToken: description: |- - DisableAutomountServiceAccountToken whether to disable serviceAccount auto mount by Kubernetes (available from v0.54.0). + DisableAutomountServiceAccountToken whether to disable serviceAccount auto mount by Kubernetes Operator will conditionally create volumes and volumeMounts for containers if it requires k8s API access. For example, vmagent and vm-config-reloader requires k8s API access. Operator creates volumes with name: "kube-api-access", which can be used as volumeMount for extraContainers if needed. @@ -19088,7 +19056,6 @@ spec: Valid policies are IfHealthyBudget and AlwaysAllow. If no policy is specified, the default behavior will be used, which corresponds to the IfHealthyBudget policy. - Available from operator v0.64.0 enum: - IfHealthyBudget - AlwaysAllow @@ -20118,7 +20085,6 @@ spec: description: |- Volumes allows configuration of additional volumes on the output Deployment/StatefulSet definition. Volumes specified will be appended to other volumes that are generated. - / +optional items: description: Volume represents a named volume in a pod that may be accessed by any container in the pod. @@ -20693,7 +20659,7 @@ spec: type: object disableAutomountServiceAccountToken: description: |- - DisableAutomountServiceAccountToken whether to disable serviceAccount auto mount by Kubernetes (available from v0.54.0). + DisableAutomountServiceAccountToken whether to disable serviceAccount auto mount by Kubernetes Operator will conditionally create volumes and volumeMounts for containers if it requires k8s API access. For example, vmagent and vm-config-reloader requires k8s API access. Operator creates volumes with name: "kube-api-access", which can be used as volumeMount for extraContainers if needed. @@ -21515,7 +21481,6 @@ spec: Valid policies are IfHealthyBudget and AlwaysAllow. If no policy is specified, the default behavior will be used, which corresponds to the IfHealthyBudget policy. - Available from operator v0.64.0 enum: - IfHealthyBudget - AlwaysAllow @@ -22321,7 +22286,6 @@ spec: description: |- Volumes allows configuration of additional volumes on the output Deployment/StatefulSet definition. Volumes specified will be appended to other volumes that are generated. - / +optional items: description: Volume represents a named volume in a pod that may be accessed by any container in the pod. @@ -22941,7 +22905,7 @@ spec: type: array disableAutomountServiceAccountToken: description: |- - DisableAutomountServiceAccountToken whether to disable serviceAccount auto mount by Kubernetes (available from v0.54.0). + DisableAutomountServiceAccountToken whether to disable serviceAccount auto mount by Kubernetes Operator will conditionally create volumes and volumeMounts for containers if it requires k8s API access. For example, vmagent and vm-config-reloader requires k8s API access. Operator creates volumes with name: "kube-api-access", which can be used as volumeMount for extraContainers if needed. @@ -23645,7 +23609,6 @@ spec: Valid policies are IfHealthyBudget and AlwaysAllow. If no policy is specified, the default behavior will be used, which corresponds to the IfHealthyBudget policy. - Available from operator v0.64.0 enum: - IfHealthyBudget - AlwaysAllow @@ -24773,7 +24736,6 @@ spec: description: |- Volumes allows configuration of additional volumes on the output Deployment/StatefulSet definition. Volumes specified will be appended to other volumes that are generated. - / +optional items: description: Volume represents a named volume in a pod that may be accessed by any container in the pod. @@ -25366,7 +25328,7 @@ spec: type: array disableAutomountServiceAccountToken: description: |- - DisableAutomountServiceAccountToken whether to disable serviceAccount auto mount by Kubernetes (available from v0.54.0). + DisableAutomountServiceAccountToken whether to disable serviceAccount auto mount by Kubernetes Operator will conditionally create volumes and volumeMounts for containers if it requires k8s API access. For example, vmagent and vm-config-reloader requires k8s API access. Operator creates volumes with name: "kube-api-access", which can be used as volumeMount for extraContainers if needed. @@ -26731,8 +26693,7 @@ spec: internalListenPort: description: |- InternalListenPort instructs vmauth to serve internal routes at given port - available from v0.56.0 operator - and v1.111.0 vmauth version + available from v1.111.0 vmauth version related doc https://docs.victoriametrics.com/victoriametrics/vmauth/#security type: string license: @@ -26877,7 +26838,6 @@ spec: Valid policies are IfHealthyBudget and AlwaysAllow. If no policy is specified, the default behavior will be used, which corresponds to the IfHealthyBudget policy. - Available from operator v0.64.0 enum: - IfHealthyBudget - AlwaysAllow @@ -27012,9 +26972,7 @@ spec: format: int32 type: integer rollingUpdate: - description: |- - RollingUpdate - overrides deployment update params. - Available from operator v0.64.0 + description: RollingUpdate - overrides deployment update params. properties: maxSurge: anyOf: @@ -27760,9 +27718,7 @@ spec: x-kubernetes-preserve-unknown-fields: true type: object updateStrategy: - description: |- - UpdateStrategy - overrides default update strategy. - Available from operator v0.64.0 + description: UpdateStrategy - overrides default update strategy. enum: - Recreate - RollingUpdate @@ -27962,7 +27918,6 @@ spec: description: |- Volumes allows configuration of additional volumes on the output Deployment/StatefulSet definition. Volumes specified will be appended to other volumes that are generated. - / +optional items: description: Volume represents a named volume in a pod that may be accessed by any container in the pod. @@ -28447,7 +28402,7 @@ spec: type: array disableAutomountServiceAccountToken: description: |- - DisableAutomountServiceAccountToken whether to disable serviceAccount auto mount by Kubernetes (available from v0.54.0). + DisableAutomountServiceAccountToken whether to disable serviceAccount auto mount by Kubernetes Operator will conditionally create volumes and volumeMounts for containers if it requires k8s API access. For example, vmagent and vm-config-reloader requires k8s API access. Operator creates volumes with name: "kube-api-access", which can be used as volumeMount for extraContainers if needed. @@ -28794,7 +28749,6 @@ spec: Valid policies are IfHealthyBudget and AlwaysAllow. If no policy is specified, the default behavior will be used, which corresponds to the IfHealthyBudget policy. - Available from operator v0.64.0 enum: - IfHealthyBudget - AlwaysAllow @@ -29197,7 +29151,6 @@ spec: description: |- Volumes allows configuration of additional volumes on the output Deployment/StatefulSet definition. Volumes specified will be appended to other volumes that are generated. - / +optional items: description: Volume represents a named volume in a pod that may be accessed by any container in the pod. @@ -29399,7 +29352,7 @@ spec: type: array disableAutomountServiceAccountToken: description: |- - DisableAutomountServiceAccountToken whether to disable serviceAccount auto mount by Kubernetes (available from v0.54.0). + DisableAutomountServiceAccountToken whether to disable serviceAccount auto mount by Kubernetes Operator will conditionally create volumes and volumeMounts for containers if it requires k8s API access. For example, vmagent and vm-config-reloader requires k8s API access. Operator creates volumes with name: "kube-api-access", which can be used as volumeMount for extraContainers if needed. @@ -29751,7 +29704,6 @@ spec: Valid policies are IfHealthyBudget and AlwaysAllow. If no policy is specified, the default behavior will be used, which corresponds to the IfHealthyBudget policy. - Available from operator v0.64.0 enum: - IfHealthyBudget - AlwaysAllow @@ -30610,7 +30562,6 @@ spec: description: |- Volumes allows configuration of additional volumes on the output Deployment/StatefulSet definition. Volumes specified will be appended to other volumes that are generated. - / +optional items: description: Volume represents a named volume in a pod that may be accessed by any container in the pod. @@ -30801,7 +30752,7 @@ spec: type: array disableAutomountServiceAccountToken: description: |- - DisableAutomountServiceAccountToken whether to disable serviceAccount auto mount by Kubernetes (available from v0.54.0). + DisableAutomountServiceAccountToken whether to disable serviceAccount auto mount by Kubernetes Operator will conditionally create volumes and volumeMounts for containers if it requires k8s API access. For example, vmagent and vm-config-reloader requires k8s API access. Operator creates volumes with name: "kube-api-access", which can be used as volumeMount for extraContainers if needed. @@ -31795,7 +31746,6 @@ spec: Valid policies are IfHealthyBudget and AlwaysAllow. If no policy is specified, the default behavior will be used, which corresponds to the IfHealthyBudget policy. - Available from operator v0.64.0 enum: - IfHealthyBudget - AlwaysAllow @@ -32685,7 +32635,6 @@ spec: description: |- Volumes allows configuration of additional volumes on the output Deployment/StatefulSet definition. Volumes specified will be appended to other volumes that are generated. - / +optional items: description: Volume represents a named volume in a pod that may be accessed by any container in the pod. @@ -35625,7 +35574,7 @@ spec: type: array disableAutomountServiceAccountToken: description: |- - DisableAutomountServiceAccountToken whether to disable serviceAccount auto mount by Kubernetes (available from v0.54.0). + DisableAutomountServiceAccountToken whether to disable serviceAccount auto mount by Kubernetes Operator will conditionally create volumes and volumeMounts for containers if it requires k8s API access. For example, vmagent and vm-config-reloader requires k8s API access. Operator creates volumes with name: "kube-api-access", which can be used as volumeMount for extraContainers if needed. @@ -38669,8 +38618,7 @@ spec: internalListenPort: description: |- InternalListenPort instructs vmauth to serve internal routes at given port - available from v0.56.0 operator - and v1.111.0 vmauth version + available from v1.111.0 vmauth version related doc https://docs.victoriametrics.com/victoriametrics/vmauth/#security type: string license: @@ -38967,7 +38915,6 @@ spec: Valid policies are IfHealthyBudget and AlwaysAllow. If no policy is specified, the default behavior will be used, which corresponds to the IfHealthyBudget policy. - Available from operator v0.64.0 enum: - IfHealthyBudget - AlwaysAllow @@ -39253,9 +39200,7 @@ spec: format: int32 type: integer rollingUpdate: - description: |- - RollingUpdate - overrides deployment update params. - Available from operator v0.64.0 + description: RollingUpdate - overrides deployment update params. properties: maxSurge: anyOf: @@ -39984,7 +39929,6 @@ spec: proxy_url: description: |- The proxy URL for token_url connection - ( available from v0.55.0). Is only supported by Scrape objects family type: string scopes: @@ -39996,7 +39940,6 @@ spec: tls_config: description: |- TLSConfig for token_url connection - ( available from v0.55.0). Is only supported by Scrape objects family x-kubernetes-preserve-unknown-fields: true token_url: @@ -41847,9 +41790,7 @@ spec: x-kubernetes-preserve-unknown-fields: true type: object updateStrategy: - description: |- - UpdateStrategy - overrides default update strategy. - Available from operator v0.64.0 + description: UpdateStrategy - overrides default update strategy. enum: - Recreate - RollingUpdate @@ -42049,7 +41990,6 @@ spec: description: |- Volumes allows configuration of additional volumes on the output Deployment/StatefulSet definition. Volumes specified will be appended to other volumes that are generated. - / +optional items: description: Volume represents a named volume in a pod that may be accessed by any container in the pod. @@ -47044,7 +46984,7 @@ spec: type: array disableAutomountServiceAccountToken: description: |- - DisableAutomountServiceAccountToken whether to disable serviceAccount auto mount by Kubernetes (available from v0.54.0). + DisableAutomountServiceAccountToken whether to disable serviceAccount auto mount by Kubernetes Operator will conditionally create volumes and volumeMounts for containers if it requires k8s API access. For example, vmagent and vm-config-reloader requires k8s API access. Operator creates volumes with name: "kube-api-access", which can be used as volumeMount for extraContainers if needed. @@ -49279,7 +49219,6 @@ spec: Valid policies are IfHealthyBudget and AlwaysAllow. If no policy is specified, the default behavior will be used, which corresponds to the IfHealthyBudget policy. - Available from operator v0.64.0 enum: - IfHealthyBudget - AlwaysAllow @@ -50942,7 +50881,6 @@ spec: description: |- Volumes allows configuration of additional volumes on the output Deployment/StatefulSet definition. Volumes specified will be appended to other volumes that are generated. - / +optional items: description: Volume represents a named volume in a pod that may be accessed by any container in the pod. @@ -55840,7 +55778,7 @@ spec: type: array disableAutomountServiceAccountToken: description: |- - DisableAutomountServiceAccountToken whether to disable serviceAccount auto mount by Kubernetes (available from v0.54.0). + DisableAutomountServiceAccountToken whether to disable serviceAccount auto mount by Kubernetes Operator will conditionally create volumes and volumeMounts for containers if it requires k8s API access. For example, vmagent and vm-config-reloader requires k8s API access. Operator creates volumes with name: "kube-api-access", which can be used as volumeMount for extraContainers if needed. @@ -58084,7 +58022,6 @@ spec: Valid policies are IfHealthyBudget and AlwaysAllow. If no policy is specified, the default behavior will be used, which corresponds to the IfHealthyBudget policy. - Available from operator v0.64.0 enum: - IfHealthyBudget - AlwaysAllow @@ -59756,7 +59693,6 @@ spec: description: |- Volumes allows configuration of additional volumes on the output Deployment/StatefulSet definition. Volumes specified will be appended to other volumes that are generated. - / +optional items: description: Volume represents a named volume in a pod that may be accessed by any container in the @@ -62155,7 +62091,6 @@ spec: proxy_url: description: |- The proxy URL for token_url connection - ( available from v0.55.0). Is only supported by Scrape objects family type: string scopes: @@ -62166,7 +62101,6 @@ spec: tls_config: description: |- TLSConfig for token_url connection - ( available from v0.55.0). Is only supported by Scrape objects family x-kubernetes-preserve-unknown-fields: true token_url: @@ -63140,7 +63074,6 @@ spec: proxy_url: description: |- The proxy URL for token_url connection - ( available from v0.55.0). Is only supported by Scrape objects family type: string scopes: @@ -63151,7 +63084,6 @@ spec: tls_config: description: |- TLSConfig for token_url connection - ( available from v0.55.0). Is only supported by Scrape objects family x-kubernetes-preserve-unknown-fields: true token_url: @@ -64105,7 +64037,6 @@ spec: proxy_url: description: |- The proxy URL for token_url connection - ( available from v0.55.0). Is only supported by Scrape objects family type: string scopes: @@ -64116,7 +64047,6 @@ spec: tls_config: description: |- TLSConfig for token_url connection - ( available from v0.55.0). Is only supported by Scrape objects family x-kubernetes-preserve-unknown-fields: true token_url: @@ -65815,7 +65745,6 @@ spec: proxy_url: description: |- The proxy URL for token_url connection - ( available from v0.55.0). Is only supported by Scrape objects family type: string scopes: @@ -65826,7 +65755,6 @@ spec: tls_config: description: |- TLSConfig for token_url connection - ( available from v0.55.0). Is only supported by Scrape objects family x-kubernetes-preserve-unknown-fields: true token_url: @@ -66291,7 +66219,6 @@ spec: proxy_url: description: |- The proxy URL for token_url connection - ( available from v0.55.0). Is only supported by Scrape objects family type: string scopes: @@ -66302,7 +66229,6 @@ spec: tls_config: description: |- TLSConfig for token_url connection - ( available from v0.55.0). Is only supported by Scrape objects family x-kubernetes-preserve-unknown-fields: true token_url: @@ -67371,7 +67297,6 @@ spec: proxy_url: description: |- The proxy URL for token_url connection - ( available from v0.55.0). Is only supported by Scrape objects family type: string scopes: @@ -67382,7 +67307,6 @@ spec: tls_config: description: |- TLSConfig for token_url connection - ( available from v0.55.0). Is only supported by Scrape objects family x-kubernetes-preserve-unknown-fields: true token_url: @@ -67973,7 +67897,6 @@ spec: proxy_url: description: |- The proxy URL for token_url connection - ( available from v0.55.0). Is only supported by Scrape objects family type: string scopes: @@ -67984,7 +67907,6 @@ spec: tls_config: description: |- TLSConfig for token_url connection - ( available from v0.55.0). Is only supported by Scrape objects family x-kubernetes-preserve-unknown-fields: true token_url: @@ -68355,7 +68277,6 @@ spec: proxy_url: description: |- The proxy URL for token_url connection - ( available from v0.55.0). Is only supported by Scrape objects family type: string scopes: @@ -68366,7 +68287,6 @@ spec: tls_config: description: |- TLSConfig for token_url connection - ( available from v0.55.0). Is only supported by Scrape objects family x-kubernetes-preserve-unknown-fields: true token_url: @@ -69589,7 +69509,6 @@ spec: proxy_url: description: |- The proxy URL for token_url connection - ( available from v0.55.0). Is only supported by Scrape objects family type: string scopes: @@ -69600,7 +69519,6 @@ spec: tls_config: description: |- TLSConfig for token_url connection - ( available from v0.55.0). Is only supported by Scrape objects family x-kubernetes-preserve-unknown-fields: true token_url: @@ -70276,7 +70194,7 @@ spec: type: array disableAutomountServiceAccountToken: description: |- - DisableAutomountServiceAccountToken whether to disable serviceAccount auto mount by Kubernetes (available from v0.54.0). + DisableAutomountServiceAccountToken whether to disable serviceAccount auto mount by Kubernetes Operator will conditionally create volumes and volumeMounts for containers if it requires k8s API access. For example, vmagent and vm-config-reloader requires k8s API access. Operator creates volumes with name: "kube-api-access", which can be used as volumeMount for extraContainers if needed. @@ -71152,7 +71070,7 @@ spec: type: array enableWindows: description: EnableWindows enables aggregating data in separate - windows ( available from v0.54.0). + windows. type: boolean ignoreFirstIntervals: description: IgnoreFirstIntervals instructs to ignore first interval @@ -72041,7 +71959,6 @@ spec: description: |- Volumes allows configuration of additional volumes on the output Deployment/StatefulSet definition. Volumes specified will be appended to other volumes that are generated. - / +optional items: description: Volume represents a named volume in a pod that may be accessed by any container in the pod. @@ -72525,7 +72442,6 @@ spec: proxy_url: description: |- The proxy URL for token_url connection - ( available from v0.55.0). Is only supported by Scrape objects family type: string scopes: @@ -72536,7 +72452,6 @@ spec: tls_config: description: |- TLSConfig for token_url connection - ( available from v0.55.0). Is only supported by Scrape objects family x-kubernetes-preserve-unknown-fields: true token_url: @@ -73854,7 +73769,7 @@ spec: type: array disableAutomountServiceAccountToken: description: |- - DisableAutomountServiceAccountToken whether to disable serviceAccount auto mount by Kubernetes (available from v0.54.0). + DisableAutomountServiceAccountToken whether to disable serviceAccount auto mount by Kubernetes Operator will conditionally create volumes and volumeMounts for containers if it requires k8s API access. For example, vmagent and vm-config-reloader requires k8s API access. Operator creates volumes with name: "kube-api-access", which can be used as volumeMount for extraContainers if needed. @@ -74184,7 +74099,6 @@ spec: Valid policies are IfHealthyBudget and AlwaysAllow. If no policy is specified, the default behavior will be used, which corresponds to the IfHealthyBudget policy. - Available from operator v0.64.0 enum: - IfHealthyBudget - AlwaysAllow @@ -74587,7 +74501,6 @@ spec: description: |- Volumes allows configuration of additional volumes on the output Deployment/StatefulSet definition. Volumes specified will be appended to other volumes that are generated. - / +optional items: description: Volume represents a named volume in a pod that may be accessed by any container in the pod. @@ -74818,7 +74731,7 @@ spec: type: array disableAutomountServiceAccountToken: description: |- - DisableAutomountServiceAccountToken whether to disable serviceAccount auto mount by Kubernetes (available from v0.54.0). + DisableAutomountServiceAccountToken whether to disable serviceAccount auto mount by Kubernetes Operator will conditionally create volumes and volumeMounts for containers if it requires k8s API access. For example, vmagent and vm-config-reloader requires k8s API access. Operator creates volumes with name: "kube-api-access", which can be used as volumeMount for extraContainers if needed. @@ -75162,7 +75075,6 @@ spec: Valid policies are IfHealthyBudget and AlwaysAllow. If no policy is specified, the default behavior will be used, which corresponds to the IfHealthyBudget policy. - Available from operator v0.64.0 enum: - IfHealthyBudget - AlwaysAllow @@ -75565,7 +75477,6 @@ spec: description: |- Volumes allows configuration of additional volumes on the output Deployment/StatefulSet definition. Volumes specified will be appended to other volumes that are generated. - / +optional items: description: Volume represents a named volume in a pod that may be accessed by any container in the pod. @@ -75763,7 +75674,7 @@ spec: type: array disableAutomountServiceAccountToken: description: |- - DisableAutomountServiceAccountToken whether to disable serviceAccount auto mount by Kubernetes (available from v0.54.0). + DisableAutomountServiceAccountToken whether to disable serviceAccount auto mount by Kubernetes Operator will conditionally create volumes and volumeMounts for containers if it requires k8s API access. For example, vmagent and vm-config-reloader requires k8s API access. Operator creates volumes with name: "kube-api-access", which can be used as volumeMount for extraContainers if needed. @@ -76774,7 +76685,6 @@ spec: Valid policies are IfHealthyBudget and AlwaysAllow. If no policy is specified, the default behavior will be used, which corresponds to the IfHealthyBudget policy. - Available from operator v0.64.0 enum: - IfHealthyBudget - AlwaysAllow @@ -77206,7 +77116,6 @@ spec: description: |- Volumes allows configuration of additional volumes on the output Deployment/StatefulSet definition. Volumes specified will be appended to other volumes that are generated. - / +optional items: description: Volume represents a named volume in a pod that may be accessed by any container in the pod. @@ -77529,7 +77438,7 @@ spec: type: array disableAutomountServiceAccountToken: description: |- - DisableAutomountServiceAccountToken whether to disable serviceAccount auto mount by Kubernetes (available from v0.54.0). + DisableAutomountServiceAccountToken whether to disable serviceAccount auto mount by Kubernetes Operator will conditionally create volumes and volumeMounts for containers if it requires k8s API access. For example, vmagent and vm-config-reloader requires k8s API access. Operator creates volumes with name: "kube-api-access", which can be used as volumeMount for extraContainers if needed. @@ -78459,7 +78368,6 @@ spec: description: |- Volumes allows configuration of additional volumes on the output Deployment/StatefulSet definition. Volumes specified will be appended to other volumes that are generated. - / +optional items: description: Volume represents a named volume in a pod that may be accessed by any container in the pod. diff --git a/docs/CHANGELOG.md b/docs/CHANGELOG.md index d33c4d819..a1eb5c256 100644 --- a/docs/CHANGELOG.md +++ b/docs/CHANGELOG.md @@ -13,6 +13,20 @@ aliases: ## tip +## [v0.68.7](https://github.com/VictoriaMetrics/operator/releases/tag/v0.68.7) +**Release date:** 27 July 2026 + +* Dependency: [vmoperator](https://docs.victoriametrics.com/operator/): Updated default versions for VM apps to [v1.147.0](https://github.com/VictoriaMetrics/VictoriaMetrics/releases/tag/v1.147.0) version +* Dependency: [vmoperator](https://docs.victoriametrics.com/operator/): Updated default versions for VT apps to [v0.9.4](https://github.com/VictoriaMetrics/VictoriaTraces/releases/tag/v0.9.4) version. +* Dependency: [vmoperator](https://docs.victoriametrics.com/operator/): Updated default versions for VMAnomaly to [v1.28.7](https://docs.victoriametrics.com/anomaly-detection/changelog/#v1287) version + +* SECURITY: [vmagent](https://docs.victoriametrics.com/operator/resources/vmagent/), [vmsingle](https://docs.victoriametrics.com/operator/resources/vmsingle/): remove cluster-wide `secrets` and `configmaps` permissions from the operator-managed `ClusterRole`. Secret access for the config-reloader is now granted via a namespace-scoped `Role` limited to the single operator-managed config secret. For `vmsingle` in ingest-only mode (the default), no secret or configmap permissions are granted at all. + +* BUGFIX: [vmanomaly](https://docs.victoriametrics.com/operator/resources/vmanomaly/): add missing `scatter_infer_jobs` field to the periodic scheduler config struct. See [#2328](https://github.com/VictoriaMetrics/operator/issues/2328). +* BUGFIX: [vmanomaly](https://docs.victoriametrics.com/operator/resources/vmanomaly/): preserve insertion order of keys in `ProphetModel` `seasonalities`, `tz_seasonalities`, `compression`, and `args` fields; previously the operator re-emitted them with keys sorted alphabetically, which broke round-trips for configs that specified keys in a non-alphabetical order. Also renamed the singular `seasonality`/`tz_seasonality` YAML keys (deprecated) to the plural `seasonalities`/`tz_seasonalities` to match the vmanomaly configuration format. See [#2356](https://github.com/VictoriaMetrics/operator/issues/2356). +* BUGFIX: [vmagent](https://docs.victoriametrics.com/operator/resources/vmagent/), [vmsingle](https://docs.victoriametrics.com/operator/resources/vmsingle/): create a `Role` and `RoleBinding` in each namespace listed in `WATCH_NAMESPACES` so that vmagent/vmsingle can perform service discovery in all watched namespaces, not only its own. Previously, in namespaced mode, vmagent/vmsingle could only scrape targets from its own namespace due to missing RBAC in other watched namespaces. +* BUGFIX: [vmagent](https://docs.victoriametrics.com/operator/resources/vmagent/): fix missing credential secret and config-reloader setup in `ingestOnlyMode` when remote write entries carry authentication secrets (`basicAuth.password`, `bearerTokenSecret`, or `oauth2.clientSecret`). Previously the operator-managed secret containing the credential files was never created in ingest-only mode, causing vmagent to start with dangling file references. The secret is now reconciled and the config-reloader is configured to watch it for credential rotation. + ## [v0.68.6](https://github.com/VictoriaMetrics/operator/releases/tag/v0.68.6) **Release date:** 25 June 2026 diff --git a/docs/api.md b/docs/api.md index 2d63f04c6..10047269f 100644 --- a/docs/api.md +++ b/docs/api.md @@ -210,7 +210,7 @@ Appears in: [VLAgent](#vlagent) | claimTemplates#
_[PersistentVolumeClaim](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.35/#persistentvolumeclaim-v1-core) array_ | _(Required)_
ClaimTemplates allows adding additional VolumeClaimTemplates for VLAgent in Mode: StatefulSet | | configMaps#
_string array_ | _(Optional)_
ConfigMaps is a list of ConfigMaps in the same namespace as the Application
object, which shall be mounted into the Application container
at /etc/vm/configs/CONFIGMAP_NAME folder | | containers#
_[Container](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.35/#container-v1-core) array_ | _(Optional)_
Containers property allows to inject additions sidecars or to patch existing containers.
It can be useful for proxies, backup, etc. | -| disableAutomountServiceAccountToken#
_boolean_ | _(Optional)_
DisableAutomountServiceAccountToken whether to disable serviceAccount auto mount by Kubernetes (available from v0.54.0).
Operator will conditionally create volumes and volumeMounts for containers if it requires k8s API access.
For example, vmagent and vm-config-reloader requires k8s API access.
Operator creates volumes with name: "kube-api-access", which can be used as volumeMount for extraContainers if needed.
And also adds VolumeMounts at /var/run/secrets/kubernetes.io/serviceaccount. | +| disableAutomountServiceAccountToken#
_boolean_ | _(Optional)_
DisableAutomountServiceAccountToken whether to disable serviceAccount auto mount by Kubernetes
Operator will conditionally create volumes and volumeMounts for containers if it requires k8s API access.
For example, vmagent and vm-config-reloader requires k8s API access.
Operator creates volumes with name: "kube-api-access", which can be used as volumeMount for extraContainers if needed.
And also adds VolumeMounts at /var/run/secrets/kubernetes.io/serviceaccount.
Available from: v0.54.0 | | disableSelfServiceScrape#
_boolean_ | _(Optional)_
DisableSelfServiceScrape controls creation of VMServiceScrape by operator
for the application.
Has priority over `VM_DISABLESELFSERVICESCRAPECREATION` operator env variable | | dnsConfig#
_[PodDNSConfig](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.35/#poddnsconfig-v1-core)_ | _(Optional)_
Specifies the DNS parameters of a pod.
Parameters specified here will be merged to the generated DNS
configuration based on DNSPolicy. | | dnsPolicy#
_[DNSPolicy](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.35/#dnspolicy-v1-core)_ | _(Optional)_
DNSPolicy sets DNS policy for the pod | @@ -262,7 +262,7 @@ Appears in: [VLAgent](#vlagent) | useDefaultResources#
_boolean_ | _(Optional)_
UseDefaultResources controls resource settings
By default, operator sets built-in resource requirements | | useStrictSecurity#
_boolean_ | _(Optional)_
UseStrictSecurity enables strict security mode for component
it restricts disk writes access
uses non-root user out of the box
drops not needed security permissions | | volumeMounts#
_[VolumeMount](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.35/#volumemount-v1-core) array_ | _(Optional)_
VolumeMounts allows configuration of additional VolumeMounts on the output Deployment/StatefulSet definition.
VolumeMounts specified will be appended to other VolumeMounts in the Application container | -| volumes#
_[Volume](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.35/#volume-v1-core) array_ | _(Required)_
Volumes allows configuration of additional volumes on the output Deployment/StatefulSet definition.
Volumes specified will be appended to other volumes that are generated.
/ +optional | +| volumes#
_[Volume](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.35/#volume-v1-core) array_ | _(Optional)_
Volumes allows configuration of additional volumes on the output Deployment/StatefulSet definition.
Volumes specified will be appended to other volumes that are generated. | #### VLCluster @@ -307,7 +307,7 @@ Appears in: [VLClusterSpec](#vlclusterspec) | affinity#
_[Affinity](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.35/#affinity-v1-core)_ | _(Optional)_
Affinity If specified, the pod's scheduling constraints. | | configMaps#
_string array_ | _(Optional)_
ConfigMaps is a list of ConfigMaps in the same namespace as the Application
object, which shall be mounted into the Application container
at /etc/vm/configs/CONFIGMAP_NAME folder | | containers#
_[Container](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.35/#container-v1-core) array_ | _(Optional)_
Containers property allows to inject additions sidecars or to patch existing containers.
It can be useful for proxies, backup, etc. | -| disableAutomountServiceAccountToken#
_boolean_ | _(Optional)_
DisableAutomountServiceAccountToken whether to disable serviceAccount auto mount by Kubernetes (available from v0.54.0).
Operator will conditionally create volumes and volumeMounts for containers if it requires k8s API access.
For example, vmagent and vm-config-reloader requires k8s API access.
Operator creates volumes with name: "kube-api-access", which can be used as volumeMount for extraContainers if needed.
And also adds VolumeMounts at /var/run/secrets/kubernetes.io/serviceaccount. | +| disableAutomountServiceAccountToken#
_boolean_ | _(Optional)_
DisableAutomountServiceAccountToken whether to disable serviceAccount auto mount by Kubernetes
Operator will conditionally create volumes and volumeMounts for containers if it requires k8s API access.
For example, vmagent and vm-config-reloader requires k8s API access.
Operator creates volumes with name: "kube-api-access", which can be used as volumeMount for extraContainers if needed.
And also adds VolumeMounts at /var/run/secrets/kubernetes.io/serviceaccount.
Available from: v0.54.0 | | disableSelfServiceScrape#
_boolean_ | _(Optional)_
DisableSelfServiceScrape controls creation of VMServiceScrape by operator
for the application.
Has priority over `VM_DISABLESELFSERVICESCRAPECREATION` operator env variable | | dnsConfig#
_[PodDNSConfig](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.35/#poddnsconfig-v1-core)_ | _(Optional)_
Specifies the DNS parameters of a pod.
Parameters specified here will be merged to the generated DNS
configuration based on DNSPolicy. | | dnsPolicy#
_[DNSPolicy](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.35/#dnspolicy-v1-core)_ | _(Optional)_
DNSPolicy sets DNS policy for the pod | @@ -352,7 +352,7 @@ Appears in: [VLClusterSpec](#vlclusterspec) | useDefaultResources#
_boolean_ | _(Optional)_
UseDefaultResources controls resource settings
By default, operator sets built-in resource requirements | | useStrictSecurity#
_boolean_ | _(Optional)_
UseStrictSecurity enables strict security mode for component
it restricts disk writes access
uses non-root user out of the box
drops not needed security permissions | | volumeMounts#
_[VolumeMount](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.35/#volumemount-v1-core) array_ | _(Optional)_
VolumeMounts allows configuration of additional VolumeMounts on the output Deployment/StatefulSet definition.
VolumeMounts specified will be appended to other VolumeMounts in the Application container | -| volumes#
_[Volume](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.35/#volume-v1-core) array_ | _(Required)_
Volumes allows configuration of additional volumes on the output Deployment/StatefulSet definition.
Volumes specified will be appended to other volumes that are generated.
/ +optional | +| volumes#
_[Volume](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.35/#volume-v1-core) array_ | _(Optional)_
Volumes allows configuration of additional volumes on the output Deployment/StatefulSet definition.
Volumes specified will be appended to other volumes that are generated. | | vpa#
_[EmbeddedVPA](#embeddedvpa)_ | _(Optional)_
Configures vertical pod autoscaling. | #### VLSelect @@ -366,7 +366,7 @@ Appears in: [VLClusterSpec](#vlclusterspec) | affinity#
_[Affinity](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.35/#affinity-v1-core)_ | _(Optional)_
Affinity If specified, the pod's scheduling constraints. | | configMaps#
_string array_ | _(Optional)_
ConfigMaps is a list of ConfigMaps in the same namespace as the Application
object, which shall be mounted into the Application container
at /etc/vm/configs/CONFIGMAP_NAME folder | | containers#
_[Container](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.35/#container-v1-core) array_ | _(Optional)_
Containers property allows to inject additions sidecars or to patch existing containers.
It can be useful for proxies, backup, etc. | -| disableAutomountServiceAccountToken#
_boolean_ | _(Optional)_
DisableAutomountServiceAccountToken whether to disable serviceAccount auto mount by Kubernetes (available from v0.54.0).
Operator will conditionally create volumes and volumeMounts for containers if it requires k8s API access.
For example, vmagent and vm-config-reloader requires k8s API access.
Operator creates volumes with name: "kube-api-access", which can be used as volumeMount for extraContainers if needed.
And also adds VolumeMounts at /var/run/secrets/kubernetes.io/serviceaccount. | +| disableAutomountServiceAccountToken#
_boolean_ | _(Optional)_
DisableAutomountServiceAccountToken whether to disable serviceAccount auto mount by Kubernetes
Operator will conditionally create volumes and volumeMounts for containers if it requires k8s API access.
For example, vmagent and vm-config-reloader requires k8s API access.
Operator creates volumes with name: "kube-api-access", which can be used as volumeMount for extraContainers if needed.
And also adds VolumeMounts at /var/run/secrets/kubernetes.io/serviceaccount.
Available from: v0.54.0 | | disableSelfServiceScrape#
_boolean_ | _(Optional)_
DisableSelfServiceScrape controls creation of VMServiceScrape by operator
for the application.
Has priority over `VM_DISABLESELFSERVICESCRAPECREATION` operator env variable | | dnsConfig#
_[PodDNSConfig](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.35/#poddnsconfig-v1-core)_ | _(Optional)_
Specifies the DNS parameters of a pod.
Parameters specified here will be merged to the generated DNS
configuration based on DNSPolicy. | | dnsPolicy#
_[DNSPolicy](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.35/#dnspolicy-v1-core)_ | _(Optional)_
DNSPolicy sets DNS policy for the pod | @@ -411,7 +411,7 @@ Appears in: [VLClusterSpec](#vlclusterspec) | useDefaultResources#
_boolean_ | _(Optional)_
UseDefaultResources controls resource settings
By default, operator sets built-in resource requirements | | useStrictSecurity#
_boolean_ | _(Optional)_
UseStrictSecurity enables strict security mode for component
it restricts disk writes access
uses non-root user out of the box
drops not needed security permissions | | volumeMounts#
_[VolumeMount](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.35/#volumemount-v1-core) array_ | _(Optional)_
VolumeMounts allows configuration of additional VolumeMounts on the output Deployment/StatefulSet definition.
VolumeMounts specified will be appended to other VolumeMounts in the Application container | -| volumes#
_[Volume](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.35/#volume-v1-core) array_ | _(Required)_
Volumes allows configuration of additional volumes on the output Deployment/StatefulSet definition.
Volumes specified will be appended to other volumes that are generated.
/ +optional | +| volumes#
_[Volume](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.35/#volume-v1-core) array_ | _(Optional)_
Volumes allows configuration of additional volumes on the output Deployment/StatefulSet definition.
Volumes specified will be appended to other volumes that are generated. | | vpa#
_[EmbeddedVPA](#embeddedvpa)_ | _(Optional)_
Configures vertical pod autoscaling. | #### VLSingle @@ -437,7 +437,7 @@ Appears in: [VLSingle](#vlsingle) | affinity#
_[Affinity](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.35/#affinity-v1-core)_ | _(Optional)_
Affinity If specified, the pod's scheduling constraints. | | configMaps#
_string array_ | _(Optional)_
ConfigMaps is a list of ConfigMaps in the same namespace as the Application
object, which shall be mounted into the Application container
at /etc/vm/configs/CONFIGMAP_NAME folder | | containers#
_[Container](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.35/#container-v1-core) array_ | _(Optional)_
Containers property allows to inject additions sidecars or to patch existing containers.
It can be useful for proxies, backup, etc. | -| disableAutomountServiceAccountToken#
_boolean_ | _(Optional)_
DisableAutomountServiceAccountToken whether to disable serviceAccount auto mount by Kubernetes (available from v0.54.0).
Operator will conditionally create volumes and volumeMounts for containers if it requires k8s API access.
For example, vmagent and vm-config-reloader requires k8s API access.
Operator creates volumes with name: "kube-api-access", which can be used as volumeMount for extraContainers if needed.
And also adds VolumeMounts at /var/run/secrets/kubernetes.io/serviceaccount. | +| disableAutomountServiceAccountToken#
_boolean_ | _(Optional)_
DisableAutomountServiceAccountToken whether to disable serviceAccount auto mount by Kubernetes
Operator will conditionally create volumes and volumeMounts for containers if it requires k8s API access.
For example, vmagent and vm-config-reloader requires k8s API access.
Operator creates volumes with name: "kube-api-access", which can be used as volumeMount for extraContainers if needed.
And also adds VolumeMounts at /var/run/secrets/kubernetes.io/serviceaccount.
Available from: v0.54.0 | | disableSelfServiceScrape#
_boolean_ | _(Optional)_
DisableSelfServiceScrape controls creation of VMServiceScrape by operator
for the application.
Has priority over `VM_DISABLESELFSERVICESCRAPECREATION` operator env variable | | dnsConfig#
_[PodDNSConfig](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.35/#poddnsconfig-v1-core)_ | _(Optional)_
Specifies the DNS parameters of a pod.
Parameters specified here will be merged to the generated DNS
configuration based on DNSPolicy. | | dnsPolicy#
_[DNSPolicy](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.35/#dnspolicy-v1-core)_ | _(Optional)_
DNSPolicy sets DNS policy for the pod | @@ -489,7 +489,7 @@ Appears in: [VLSingle](#vlsingle) | useDefaultResources#
_boolean_ | _(Optional)_
UseDefaultResources controls resource settings
By default, operator sets built-in resource requirements | | useStrictSecurity#
_boolean_ | _(Optional)_
UseStrictSecurity enables strict security mode for component
it restricts disk writes access
uses non-root user out of the box
drops not needed security permissions | | volumeMounts#
_[VolumeMount](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.35/#volumemount-v1-core) array_ | _(Optional)_
VolumeMounts allows configuration of additional VolumeMounts on the output Deployment/StatefulSet definition.
VolumeMounts specified will be appended to other VolumeMounts in the Application container | -| volumes#
_[Volume](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.35/#volume-v1-core) array_ | _(Required)_
Volumes allows configuration of additional volumes on the output Deployment/StatefulSet definition.
Volumes specified will be appended to other volumes that are generated.
/ +optional | +| volumes#
_[Volume](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.35/#volume-v1-core) array_ | _(Optional)_
Volumes allows configuration of additional volumes on the output Deployment/StatefulSet definition.
Volumes specified will be appended to other volumes that are generated. | #### VLStorage @@ -503,7 +503,7 @@ Appears in: [VLClusterSpec](#vlclusterspec) | claimTemplates#
_[PersistentVolumeClaim](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.35/#persistentvolumeclaim-v1-core) array_ | _(Required)_
ClaimTemplates allows adding additional VolumeClaimTemplates for StatefulSet | | configMaps#
_string array_ | _(Optional)_
ConfigMaps is a list of ConfigMaps in the same namespace as the Application
object, which shall be mounted into the Application container
at /etc/vm/configs/CONFIGMAP_NAME folder | | containers#
_[Container](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.35/#container-v1-core) array_ | _(Optional)_
Containers property allows to inject additions sidecars or to patch existing containers.
It can be useful for proxies, backup, etc. | -| disableAutomountServiceAccountToken#
_boolean_ | _(Optional)_
DisableAutomountServiceAccountToken whether to disable serviceAccount auto mount by Kubernetes (available from v0.54.0).
Operator will conditionally create volumes and volumeMounts for containers if it requires k8s API access.
For example, vmagent and vm-config-reloader requires k8s API access.
Operator creates volumes with name: "kube-api-access", which can be used as volumeMount for extraContainers if needed.
And also adds VolumeMounts at /var/run/secrets/kubernetes.io/serviceaccount. | +| disableAutomountServiceAccountToken#
_boolean_ | _(Optional)_
DisableAutomountServiceAccountToken whether to disable serviceAccount auto mount by Kubernetes
Operator will conditionally create volumes and volumeMounts for containers if it requires k8s API access.
For example, vmagent and vm-config-reloader requires k8s API access.
Operator creates volumes with name: "kube-api-access", which can be used as volumeMount for extraContainers if needed.
And also adds VolumeMounts at /var/run/secrets/kubernetes.io/serviceaccount.
Available from: v0.54.0 | | disableSelfServiceScrape#
_boolean_ | _(Optional)_
DisableSelfServiceScrape controls creation of VMServiceScrape by operator
for the application.
Has priority over `VM_DISABLESELFSERVICESCRAPECREATION` operator env variable | | dnsConfig#
_[PodDNSConfig](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.35/#poddnsconfig-v1-core)_ | _(Optional)_
Specifies the DNS parameters of a pod.
Parameters specified here will be merged to the generated DNS
configuration based on DNSPolicy. | | dnsPolicy#
_[DNSPolicy](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.35/#dnspolicy-v1-core)_ | _(Optional)_
DNSPolicy sets DNS policy for the pod | @@ -557,7 +557,7 @@ Appears in: [VLClusterSpec](#vlclusterspec) | useDefaultResources#
_boolean_ | _(Optional)_
UseDefaultResources controls resource settings
By default, operator sets built-in resource requirements | | useStrictSecurity#
_boolean_ | _(Optional)_
UseStrictSecurity enables strict security mode for component
it restricts disk writes access
uses non-root user out of the box
drops not needed security permissions | | volumeMounts#
_[VolumeMount](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.35/#volumemount-v1-core) array_ | _(Optional)_
VolumeMounts allows configuration of additional VolumeMounts on the output Deployment/StatefulSet definition.
VolumeMounts specified will be appended to other VolumeMounts in the Application container | -| volumes#
_[Volume](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.35/#volume-v1-core) array_ | _(Required)_
Volumes allows configuration of additional volumes on the output Deployment/StatefulSet definition.
Volumes specified will be appended to other volumes that are generated.
/ +optional | +| volumes#
_[Volume](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.35/#volume-v1-core) array_ | _(Optional)_
Volumes allows configuration of additional volumes on the output Deployment/StatefulSet definition.
Volumes specified will be appended to other volumes that are generated. | | vpa#
_[EmbeddedVPA](#embeddedvpa)_ | _(Optional)_
Configures vertical pod autoscaling. | #### VLStorageNode @@ -694,7 +694,7 @@ Appears in: [VMAnomaly](#vmanomaly) | configRawYaml#
_string_ | _(Optional)_
ConfigRawYaml - raw configuration for anomaly,
it helps it to start without secret.
priority -> hardcoded ConfigRaw -> ConfigRaw, provided by user -> ConfigSecret. | | configSecret#
_[SecretKeySelector](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.35/#secretkeyselector-v1-core)_ | _(Optional)_
ConfigSecret is the name of a Kubernetes Secret in the same namespace as the
VMAnomaly object, which contains configuration for this VMAnomaly,
configuration must be inside secret key: anomaly.yaml.
It must be created by user.
instance. Defaults to 'vmanomaly-'
The secret is mounted into /etc/anomaly/config. | | containers#
_[Container](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.35/#container-v1-core) array_ | _(Optional)_
Containers property allows to inject additions sidecars or to patch existing containers.
It can be useful for proxies, backup, etc. | -| disableAutomountServiceAccountToken#
_boolean_ | _(Optional)_
DisableAutomountServiceAccountToken whether to disable serviceAccount auto mount by Kubernetes (available from v0.54.0).
Operator will conditionally create volumes and volumeMounts for containers if it requires k8s API access.
For example, vmagent and vm-config-reloader requires k8s API access.
Operator creates volumes with name: "kube-api-access", which can be used as volumeMount for extraContainers if needed.
And also adds VolumeMounts at /var/run/secrets/kubernetes.io/serviceaccount. | +| disableAutomountServiceAccountToken#
_boolean_ | _(Optional)_
DisableAutomountServiceAccountToken whether to disable serviceAccount auto mount by Kubernetes
Operator will conditionally create volumes and volumeMounts for containers if it requires k8s API access.
For example, vmagent and vm-config-reloader requires k8s API access.
Operator creates volumes with name: "kube-api-access", which can be used as volumeMount for extraContainers if needed.
And also adds VolumeMounts at /var/run/secrets/kubernetes.io/serviceaccount.
Available from: v0.54.0 | | disableSelfServiceScrape#
_boolean_ | _(Optional)_
DisableSelfServiceScrape controls creation of VMServiceScrape by operator
for the application.
Has priority over `VM_DISABLESELFSERVICESCRAPECREATION` operator env variable | | dnsConfig#
_[PodDNSConfig](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.35/#poddnsconfig-v1-core)_ | _(Optional)_
Specifies the DNS parameters of a pod.
Parameters specified here will be merged to the generated DNS
configuration based on DNSPolicy. | | dnsPolicy#
_[DNSPolicy](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.35/#dnspolicy-v1-core)_ | _(Optional)_
DNSPolicy sets DNS policy for the pod | @@ -743,7 +743,7 @@ Appears in: [VMAnomaly](#vmanomaly) | useDefaultResources#
_boolean_ | _(Optional)_
UseDefaultResources controls resource settings
By default, operator sets built-in resource requirements | | useStrictSecurity#
_boolean_ | _(Optional)_
UseStrictSecurity enables strict security mode for component
it restricts disk writes access
uses non-root user out of the box
drops not needed security permissions | | volumeMounts#
_[VolumeMount](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.35/#volumemount-v1-core) array_ | _(Optional)_
VolumeMounts allows configuration of additional VolumeMounts on the output Deployment/StatefulSet definition.
VolumeMounts specified will be appended to other VolumeMounts in the Application container | -| volumes#
_[Volume](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.35/#volume-v1-core) array_ | _(Required)_
Volumes allows configuration of additional volumes on the output Deployment/StatefulSet definition.
Volumes specified will be appended to other volumes that are generated.
/ +optional | +| volumes#
_[Volume](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.35/#volume-v1-core) array_ | _(Optional)_
Volumes allows configuration of additional volumes on the output Deployment/StatefulSet definition.
Volumes specified will be appended to other volumes that are generated. | | writer#
_[VMAnomalyWritersSpec](#vmanomalywritersspec)_ | _(Required)_
Metrics destination for VMAnomaly
See https://docs.victoriametrics.com/anomaly-detection/components/writer/ | #### VMAnomalyVMWriterMetricFormatSpec @@ -818,7 +818,7 @@ Appears in: [VTClusterSpec](#vtclusterspec) | affinity#
_[Affinity](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.35/#affinity-v1-core)_ | _(Optional)_
Affinity If specified, the pod's scheduling constraints. | | configMaps#
_string array_ | _(Optional)_
ConfigMaps is a list of ConfigMaps in the same namespace as the Application
object, which shall be mounted into the Application container
at /etc/vm/configs/CONFIGMAP_NAME folder | | containers#
_[Container](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.35/#container-v1-core) array_ | _(Optional)_
Containers property allows to inject additions sidecars or to patch existing containers.
It can be useful for proxies, backup, etc. | -| disableAutomountServiceAccountToken#
_boolean_ | _(Optional)_
DisableAutomountServiceAccountToken whether to disable serviceAccount auto mount by Kubernetes (available from v0.54.0).
Operator will conditionally create volumes and volumeMounts for containers if it requires k8s API access.
For example, vmagent and vm-config-reloader requires k8s API access.
Operator creates volumes with name: "kube-api-access", which can be used as volumeMount for extraContainers if needed.
And also adds VolumeMounts at /var/run/secrets/kubernetes.io/serviceaccount. | +| disableAutomountServiceAccountToken#
_boolean_ | _(Optional)_
DisableAutomountServiceAccountToken whether to disable serviceAccount auto mount by Kubernetes
Operator will conditionally create volumes and volumeMounts for containers if it requires k8s API access.
For example, vmagent and vm-config-reloader requires k8s API access.
Operator creates volumes with name: "kube-api-access", which can be used as volumeMount for extraContainers if needed.
And also adds VolumeMounts at /var/run/secrets/kubernetes.io/serviceaccount.
Available from: v0.54.0 | | disableSelfServiceScrape#
_boolean_ | _(Optional)_
DisableSelfServiceScrape controls creation of VMServiceScrape by operator
for the application.
Has priority over `VM_DISABLESELFSERVICESCRAPECREATION` operator env variable | | dnsConfig#
_[PodDNSConfig](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.35/#poddnsconfig-v1-core)_ | _(Optional)_
Specifies the DNS parameters of a pod.
Parameters specified here will be merged to the generated DNS
configuration based on DNSPolicy. | | dnsPolicy#
_[DNSPolicy](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.35/#dnspolicy-v1-core)_ | _(Optional)_
DNSPolicy sets DNS policy for the pod | @@ -862,7 +862,7 @@ Appears in: [VTClusterSpec](#vtclusterspec) | useDefaultResources#
_boolean_ | _(Optional)_
UseDefaultResources controls resource settings
By default, operator sets built-in resource requirements | | useStrictSecurity#
_boolean_ | _(Optional)_
UseStrictSecurity enables strict security mode for component
it restricts disk writes access
uses non-root user out of the box
drops not needed security permissions | | volumeMounts#
_[VolumeMount](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.35/#volumemount-v1-core) array_ | _(Optional)_
VolumeMounts allows configuration of additional VolumeMounts on the output Deployment/StatefulSet definition.
VolumeMounts specified will be appended to other VolumeMounts in the Application container | -| volumes#
_[Volume](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.35/#volume-v1-core) array_ | _(Required)_
Volumes allows configuration of additional volumes on the output Deployment/StatefulSet definition.
Volumes specified will be appended to other volumes that are generated.
/ +optional | +| volumes#
_[Volume](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.35/#volume-v1-core) array_ | _(Optional)_
Volumes allows configuration of additional volumes on the output Deployment/StatefulSet definition.
Volumes specified will be appended to other volumes that are generated. | | vpa#
_[EmbeddedVPA](#embeddedvpa)_ | _(Optional)_
Configures vertical pod autoscaling. | #### VTSelect @@ -876,7 +876,7 @@ Appears in: [VTClusterSpec](#vtclusterspec) | affinity#
_[Affinity](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.35/#affinity-v1-core)_ | _(Optional)_
Affinity If specified, the pod's scheduling constraints. | | configMaps#
_string array_ | _(Optional)_
ConfigMaps is a list of ConfigMaps in the same namespace as the Application
object, which shall be mounted into the Application container
at /etc/vm/configs/CONFIGMAP_NAME folder | | containers#
_[Container](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.35/#container-v1-core) array_ | _(Optional)_
Containers property allows to inject additions sidecars or to patch existing containers.
It can be useful for proxies, backup, etc. | -| disableAutomountServiceAccountToken#
_boolean_ | _(Optional)_
DisableAutomountServiceAccountToken whether to disable serviceAccount auto mount by Kubernetes (available from v0.54.0).
Operator will conditionally create volumes and volumeMounts for containers if it requires k8s API access.
For example, vmagent and vm-config-reloader requires k8s API access.
Operator creates volumes with name: "kube-api-access", which can be used as volumeMount for extraContainers if needed.
And also adds VolumeMounts at /var/run/secrets/kubernetes.io/serviceaccount. | +| disableAutomountServiceAccountToken#
_boolean_ | _(Optional)_
DisableAutomountServiceAccountToken whether to disable serviceAccount auto mount by Kubernetes
Operator will conditionally create volumes and volumeMounts for containers if it requires k8s API access.
For example, vmagent and vm-config-reloader requires k8s API access.
Operator creates volumes with name: "kube-api-access", which can be used as volumeMount for extraContainers if needed.
And also adds VolumeMounts at /var/run/secrets/kubernetes.io/serviceaccount.
Available from: v0.54.0 | | disableSelfServiceScrape#
_boolean_ | _(Optional)_
DisableSelfServiceScrape controls creation of VMServiceScrape by operator
for the application.
Has priority over `VM_DISABLESELFSERVICESCRAPECREATION` operator env variable | | dnsConfig#
_[PodDNSConfig](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.35/#poddnsconfig-v1-core)_ | _(Optional)_
Specifies the DNS parameters of a pod.
Parameters specified here will be merged to the generated DNS
configuration based on DNSPolicy. | | dnsPolicy#
_[DNSPolicy](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.35/#dnspolicy-v1-core)_ | _(Optional)_
DNSPolicy sets DNS policy for the pod | @@ -921,7 +921,7 @@ Appears in: [VTClusterSpec](#vtclusterspec) | useDefaultResources#
_boolean_ | _(Optional)_
UseDefaultResources controls resource settings
By default, operator sets built-in resource requirements | | useStrictSecurity#
_boolean_ | _(Optional)_
UseStrictSecurity enables strict security mode for component
it restricts disk writes access
uses non-root user out of the box
drops not needed security permissions | | volumeMounts#
_[VolumeMount](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.35/#volumemount-v1-core) array_ | _(Optional)_
VolumeMounts allows configuration of additional VolumeMounts on the output Deployment/StatefulSet definition.
VolumeMounts specified will be appended to other VolumeMounts in the Application container | -| volumes#
_[Volume](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.35/#volume-v1-core) array_ | _(Required)_
Volumes allows configuration of additional volumes on the output Deployment/StatefulSet definition.
Volumes specified will be appended to other volumes that are generated.
/ +optional | +| volumes#
_[Volume](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.35/#volume-v1-core) array_ | _(Optional)_
Volumes allows configuration of additional volumes on the output Deployment/StatefulSet definition.
Volumes specified will be appended to other volumes that are generated. | | vpa#
_[EmbeddedVPA](#embeddedvpa)_ | _(Optional)_
Configures vertical pod autoscaling. | #### VTSingle @@ -947,7 +947,7 @@ Appears in: [VTSingle](#vtsingle) | affinity#
_[Affinity](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.35/#affinity-v1-core)_ | _(Optional)_
Affinity If specified, the pod's scheduling constraints. | | configMaps#
_string array_ | _(Optional)_
ConfigMaps is a list of ConfigMaps in the same namespace as the Application
object, which shall be mounted into the Application container
at /etc/vm/configs/CONFIGMAP_NAME folder | | containers#
_[Container](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.35/#container-v1-core) array_ | _(Optional)_
Containers property allows to inject additions sidecars or to patch existing containers.
It can be useful for proxies, backup, etc. | -| disableAutomountServiceAccountToken#
_boolean_ | _(Optional)_
DisableAutomountServiceAccountToken whether to disable serviceAccount auto mount by Kubernetes (available from v0.54.0).
Operator will conditionally create volumes and volumeMounts for containers if it requires k8s API access.
For example, vmagent and vm-config-reloader requires k8s API access.
Operator creates volumes with name: "kube-api-access", which can be used as volumeMount for extraContainers if needed.
And also adds VolumeMounts at /var/run/secrets/kubernetes.io/serviceaccount. | +| disableAutomountServiceAccountToken#
_boolean_ | _(Optional)_
DisableAutomountServiceAccountToken whether to disable serviceAccount auto mount by Kubernetes
Operator will conditionally create volumes and volumeMounts for containers if it requires k8s API access.
For example, vmagent and vm-config-reloader requires k8s API access.
Operator creates volumes with name: "kube-api-access", which can be used as volumeMount for extraContainers if needed.
And also adds VolumeMounts at /var/run/secrets/kubernetes.io/serviceaccount.
Available from: v0.54.0 | | disableSelfServiceScrape#
_boolean_ | _(Optional)_
DisableSelfServiceScrape controls creation of VMServiceScrape by operator
for the application.
Has priority over `VM_DISABLESELFSERVICESCRAPECREATION` operator env variable | | dnsConfig#
_[PodDNSConfig](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.35/#poddnsconfig-v1-core)_ | _(Optional)_
Specifies the DNS parameters of a pod.
Parameters specified here will be merged to the generated DNS
configuration based on DNSPolicy. | | dnsPolicy#
_[DNSPolicy](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.35/#dnspolicy-v1-core)_ | _(Optional)_
DNSPolicy sets DNS policy for the pod | @@ -997,7 +997,7 @@ Appears in: [VTSingle](#vtsingle) | useDefaultResources#
_boolean_ | _(Optional)_
UseDefaultResources controls resource settings
By default, operator sets built-in resource requirements | | useStrictSecurity#
_boolean_ | _(Optional)_
UseStrictSecurity enables strict security mode for component
it restricts disk writes access
uses non-root user out of the box
drops not needed security permissions | | volumeMounts#
_[VolumeMount](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.35/#volumemount-v1-core) array_ | _(Optional)_
VolumeMounts allows configuration of additional VolumeMounts on the output Deployment/StatefulSet definition.
VolumeMounts specified will be appended to other VolumeMounts in the Application container | -| volumes#
_[Volume](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.35/#volume-v1-core) array_ | _(Required)_
Volumes allows configuration of additional volumes on the output Deployment/StatefulSet definition.
Volumes specified will be appended to other volumes that are generated.
/ +optional | +| volumes#
_[Volume](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.35/#volume-v1-core) array_ | _(Optional)_
Volumes allows configuration of additional volumes on the output Deployment/StatefulSet definition.
Volumes specified will be appended to other volumes that are generated. | #### VTStorage @@ -1011,7 +1011,7 @@ Appears in: [VTClusterSpec](#vtclusterspec) | claimTemplates#
_[PersistentVolumeClaim](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.35/#persistentvolumeclaim-v1-core) array_ | _(Required)_
ClaimTemplates allows adding additional VolumeClaimTemplates for StatefulSet | | configMaps#
_string array_ | _(Optional)_
ConfigMaps is a list of ConfigMaps in the same namespace as the Application
object, which shall be mounted into the Application container
at /etc/vm/configs/CONFIGMAP_NAME folder | | containers#
_[Container](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.35/#container-v1-core) array_ | _(Optional)_
Containers property allows to inject additions sidecars or to patch existing containers.
It can be useful for proxies, backup, etc. | -| disableAutomountServiceAccountToken#
_boolean_ | _(Optional)_
DisableAutomountServiceAccountToken whether to disable serviceAccount auto mount by Kubernetes (available from v0.54.0).
Operator will conditionally create volumes and volumeMounts for containers if it requires k8s API access.
For example, vmagent and vm-config-reloader requires k8s API access.
Operator creates volumes with name: "kube-api-access", which can be used as volumeMount for extraContainers if needed.
And also adds VolumeMounts at /var/run/secrets/kubernetes.io/serviceaccount. | +| disableAutomountServiceAccountToken#
_boolean_ | _(Optional)_
DisableAutomountServiceAccountToken whether to disable serviceAccount auto mount by Kubernetes
Operator will conditionally create volumes and volumeMounts for containers if it requires k8s API access.
For example, vmagent and vm-config-reloader requires k8s API access.
Operator creates volumes with name: "kube-api-access", which can be used as volumeMount for extraContainers if needed.
And also adds VolumeMounts at /var/run/secrets/kubernetes.io/serviceaccount.
Available from: v0.54.0 | | disableSelfServiceScrape#
_boolean_ | _(Optional)_
DisableSelfServiceScrape controls creation of VMServiceScrape by operator
for the application.
Has priority over `VM_DISABLESELFSERVICESCRAPECREATION` operator env variable | | dnsConfig#
_[PodDNSConfig](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.35/#poddnsconfig-v1-core)_ | _(Optional)_
Specifies the DNS parameters of a pod.
Parameters specified here will be merged to the generated DNS
configuration based on DNSPolicy. | | dnsPolicy#
_[DNSPolicy](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.35/#dnspolicy-v1-core)_ | _(Optional)_
DNSPolicy sets DNS policy for the pod | @@ -1065,7 +1065,7 @@ Appears in: [VTClusterSpec](#vtclusterspec) | useDefaultResources#
_boolean_ | _(Optional)_
UseDefaultResources controls resource settings
By default, operator sets built-in resource requirements | | useStrictSecurity#
_boolean_ | _(Optional)_
UseStrictSecurity enables strict security mode for component
it restricts disk writes access
uses non-root user out of the box
drops not needed security permissions | | volumeMounts#
_[VolumeMount](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.35/#volumemount-v1-core) array_ | _(Optional)_
VolumeMounts allows configuration of additional VolumeMounts on the output Deployment/StatefulSet definition.
VolumeMounts specified will be appended to other VolumeMounts in the Application container | -| volumes#
_[Volume](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.35/#volume-v1-core) array_ | _(Required)_
Volumes allows configuration of additional volumes on the output Deployment/StatefulSet definition.
Volumes specified will be appended to other volumes that are generated.
/ +optional | +| volumes#
_[Volume](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.35/#volume-v1-core) array_ | _(Optional)_
Volumes allows configuration of additional volumes on the output Deployment/StatefulSet definition.
Volumes specified will be appended to other volumes that are generated. | | vpa#
_[EmbeddedVPA](#embeddedvpa)_ | _(Optional)_
Configures vertical pod autoscaling. | #### VTStorageNode @@ -1160,7 +1160,7 @@ Appears in: [VMDistributedZoneAgent](#vmdistributedzoneagent) | claimTemplates#
_[PersistentVolumeClaim](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.35/#persistentvolumeclaim-v1-core) array_ | _(Required)_
ClaimTemplates allows adding additional VolumeClaimTemplates for VMAgent in StatefulMode | | configMaps#
_string array_ | _(Optional)_
ConfigMaps is a list of ConfigMaps in the same namespace as the Application
object, which shall be mounted into the Application container
at /etc/vm/configs/CONFIGMAP_NAME folder | | containers#
_[Container](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.35/#container-v1-core) array_ | _(Optional)_
Containers property allows to inject additions sidecars or to patch existing containers.
It can be useful for proxies, backup, etc. | -| disableAutomountServiceAccountToken#
_boolean_ | _(Optional)_
DisableAutomountServiceAccountToken whether to disable serviceAccount auto mount by Kubernetes (available from v0.54.0).
Operator will conditionally create volumes and volumeMounts for containers if it requires k8s API access.
For example, vmagent and vm-config-reloader requires k8s API access.
Operator creates volumes with name: "kube-api-access", which can be used as volumeMount for extraContainers if needed.
And also adds VolumeMounts at /var/run/secrets/kubernetes.io/serviceaccount. | +| disableAutomountServiceAccountToken#
_boolean_ | _(Optional)_
DisableAutomountServiceAccountToken whether to disable serviceAccount auto mount by Kubernetes
Operator will conditionally create volumes and volumeMounts for containers if it requires k8s API access.
For example, vmagent and vm-config-reloader requires k8s API access.
Operator creates volumes with name: "kube-api-access", which can be used as volumeMount for extraContainers if needed.
And also adds VolumeMounts at /var/run/secrets/kubernetes.io/serviceaccount.
Available from: v0.54.0 | | disableSelfServiceScrape#
_boolean_ | _(Optional)_
DisableSelfServiceScrape controls creation of VMServiceScrape by operator
for the application.
Has priority over `VM_DISABLESELFSERVICESCRAPECREATION` operator env variable | | dnsConfig#
_[PodDNSConfig](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.35/#poddnsconfig-v1-core)_ | _(Optional)_
Specifies the DNS parameters of a pod.
Parameters specified here will be merged to the generated DNS
configuration based on DNSPolicy. | | dnsPolicy#
_[DNSPolicy](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.35/#dnspolicy-v1-core)_ | _(Optional)_
DNSPolicy sets DNS policy for the pod | @@ -1210,7 +1210,7 @@ Appears in: [VMDistributedZoneAgent](#vmdistributedzoneagent) | useDefaultResources#
_boolean_ | _(Optional)_
UseDefaultResources controls resource settings
By default, operator sets built-in resource requirements | | useStrictSecurity#
_boolean_ | _(Optional)_
UseStrictSecurity enables strict security mode for component
it restricts disk writes access
uses non-root user out of the box
drops not needed security permissions | | volumeMounts#
_[VolumeMount](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.35/#volumemount-v1-core) array_ | _(Optional)_
VolumeMounts allows configuration of additional VolumeMounts on the output Deployment/StatefulSet definition.
VolumeMounts specified will be appended to other VolumeMounts in the Application container | -| volumes#
_[Volume](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.35/#volume-v1-core) array_ | _(Required)_
Volumes allows configuration of additional volumes on the output Deployment/StatefulSet definition.
Volumes specified will be appended to other volumes that are generated.
/ +optional | +| volumes#
_[Volume](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.35/#volume-v1-core) array_ | _(Optional)_
Volumes allows configuration of additional volumes on the output Deployment/StatefulSet definition.
Volumes specified will be appended to other volumes that are generated. | #### VMDistributedZoneCluster @@ -1452,7 +1452,7 @@ Appears in: [VLAgentSpec](#vlagentspec), [VLInsert](#vlinsert), [VLSelect](#vlse | affinity#
_[Affinity](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.35/#affinity-v1-core)_ | _(Optional)_
Affinity If specified, the pod's scheduling constraints. | | configMaps#
_string array_ | _(Optional)_
ConfigMaps is a list of ConfigMaps in the same namespace as the Application
object, which shall be mounted into the Application container
at /etc/vm/configs/CONFIGMAP_NAME folder | | containers#
_[Container](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.35/#container-v1-core) array_ | _(Optional)_
Containers property allows to inject additions sidecars or to patch existing containers.
It can be useful for proxies, backup, etc. | -| disableAutomountServiceAccountToken#
_boolean_ | _(Optional)_
DisableAutomountServiceAccountToken whether to disable serviceAccount auto mount by Kubernetes (available from v0.54.0).
Operator will conditionally create volumes and volumeMounts for containers if it requires k8s API access.
For example, vmagent and vm-config-reloader requires k8s API access.
Operator creates volumes with name: "kube-api-access", which can be used as volumeMount for extraContainers if needed.
And also adds VolumeMounts at /var/run/secrets/kubernetes.io/serviceaccount. | +| disableAutomountServiceAccountToken#
_boolean_ | _(Optional)_
DisableAutomountServiceAccountToken whether to disable serviceAccount auto mount by Kubernetes
Operator will conditionally create volumes and volumeMounts for containers if it requires k8s API access.
For example, vmagent and vm-config-reloader requires k8s API access.
Operator creates volumes with name: "kube-api-access", which can be used as volumeMount for extraContainers if needed.
And also adds VolumeMounts at /var/run/secrets/kubernetes.io/serviceaccount.
Available from: v0.54.0 | | disableSelfServiceScrape#
_boolean_ | _(Optional)_
DisableSelfServiceScrape controls creation of VMServiceScrape by operator
for the application.
Has priority over `VM_DISABLESELFSERVICESCRAPECREATION` operator env variable | | dnsConfig#
_[PodDNSConfig](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.35/#poddnsconfig-v1-core)_ | _(Optional)_
Specifies the DNS parameters of a pod.
Parameters specified here will be merged to the generated DNS
configuration based on DNSPolicy. | | dnsPolicy#
_[DNSPolicy](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.35/#dnspolicy-v1-core)_ | _(Optional)_
DNSPolicy sets DNS policy for the pod | @@ -1487,7 +1487,7 @@ Appears in: [VLAgentSpec](#vlagentspec), [VLInsert](#vlinsert), [VLSelect](#vlse | useDefaultResources#
_boolean_ | _(Optional)_
UseDefaultResources controls resource settings
By default, operator sets built-in resource requirements | | useStrictSecurity#
_boolean_ | _(Optional)_
UseStrictSecurity enables strict security mode for component
it restricts disk writes access
uses non-root user out of the box
drops not needed security permissions | | volumeMounts#
_[VolumeMount](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.35/#volumemount-v1-core) array_ | _(Optional)_
VolumeMounts allows configuration of additional VolumeMounts on the output Deployment/StatefulSet definition.
VolumeMounts specified will be appended to other VolumeMounts in the Application container | -| volumes#
_[Volume](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.35/#volume-v1-core) array_ | _(Required)_
Volumes allows configuration of additional volumes on the output Deployment/StatefulSet definition.
Volumes specified will be appended to other volumes that are generated.
/ +optional | +| volumes#
_[Volume](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.35/#volume-v1-core) array_ | _(Optional)_
Volumes allows configuration of additional volumes on the output Deployment/StatefulSet definition.
Volumes specified will be appended to other volumes that are generated. | #### CommonConfigReloaderParams @@ -1665,13 +1665,13 @@ Appears in: [Receiver](#receiver) | Field | Description | | --- | --- | -| avatar_url#
_string_ | _(Optional)_
AvatarURL defines message avatar URL
Available from operator v0.55.0 and alertmanager v0.28.0 | -| content#
_string_ | _(Optional)_
Content defines message content template
Available from operator v0.55.0 and alertmanager v0.28.0 | +| avatar_url#
_string_ | _(Optional)_
AvatarURL defines message avatar URL
Available from alertmanager v0.28.0
Available from: v0.55.0 | +| content#
_string_ | _(Optional)_
Content defines message content template
Available from alertmanager v0.28.0
Available from: v0.55.0 | | http_config#
_[HTTPConfig](#httpconfig)_ | _(Optional)_
HTTP client configuration. | | message#
_string_ | _(Optional)_
The message body template | | send_resolved#
_boolean_ | _(Optional)_
SendResolved controls notify about resolved alerts. | | title#
_string_ | _(Optional)_
The message title template | -| username#
_string_ | _(Optional)_
Username defines message username
Available from operator v0.55.0 and alertmanager v0.28.0 | +| username#
_string_ | _(Optional)_
Username defines message username
Available from alertmanager v0.28.0
Available from: v0.55.0 | | webhook_url#
_string_ | _(Optional)_
The discord webhook URL
one of `urlSecret` and `url` must be defined. | | webhook_url_secret#
_[SecretKeySelector](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.35/#secretkeyselector-v1-core)_ | _(Optional)_
URLSecret defines secret name and key at the CRD namespace.
It must contain the webhook URL.
one of `urlSecret` and `url` must be defined. | @@ -1823,7 +1823,7 @@ Appears in: [VLAgentSpec](#vlagentspec), [VLInsert](#vlinsert), [VLSelect](#vlse | maxUnavailable#
_[IntOrString](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.35/#intorstring-intstr-util)_ | _(Optional)_
An eviction is allowed if at most "maxUnavailable" pods selected by
"selector" are unavailable after the eviction, i.e. even in absence of
the evicted pod. For example, one can prevent all voluntary evictions
by specifying 0. This is a mutually exclusive setting with "minAvailable". | | minAvailable#
_[IntOrString](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.35/#intorstring-intstr-util)_ | _(Optional)_
An eviction is allowed if at least "minAvailable" pods selected by
"selector" will still be available after the eviction, i.e. even in the
absence of the evicted pod. So for example you can prevent all voluntary
evictions by specifying "100%". | | selectorLabels#
_object (keys:string, values:string)_ | _(Optional)_
replaces default labels selector generated by operator
it's useful when you need to create custom budget | -| unhealthyPodEvictionPolicy#
_string_ | _(Optional)_
UnhealthyPodEvictionPolicy defines the criteria for when unhealthy pods
Valid policies are IfHealthyBudget and AlwaysAllow.
If no policy is specified, the default behavior will be used,
which corresponds to the IfHealthyBudget policy.
Available from operator v0.64.0 | +| unhealthyPodEvictionPolicy#
_string_ | _(Optional)_
UnhealthyPodEvictionPolicy defines the criteria for when unhealthy pods
Valid policies are IfHealthyBudget and AlwaysAllow.
If no policy is specified, the default behavior will be used,
which corresponds to the IfHealthyBudget policy.
Available from: v0.64.0 | #### EmbeddedVPA @@ -1982,7 +1982,7 @@ Appears in: [VMAlertDatasourceSpec](#vmalertdatasourcespec), [VMAlertNotifierSpe HTTPConfig defines a client HTTP configuration for VMAlertmanagerConfig objects See https://prometheus.io/docs/alerting/latest/configuration/#http_config -Appears in: [DiscordConfig](#discordconfig), [IncidentIOConfig](#incidentioconfig), [JiraConfig](#jiraconfig), [MSTeamsConfig](#msteamsconfig), [MSTeamsV2Config](#msteamsv2config), [OpsGenieConfig](#opsgenieconfig), [PagerDutyConfig](#pagerdutyconfig), [PushoverConfig](#pushoverconfig), [RocketchatConfig](#rocketchatconfig), [SlackConfig](#slackconfig), [SnsConfig](#snsconfig), [TelegramConfig](#telegramconfig), [VictorOpsConfig](#victoropsconfig), [WeChatConfig](#wechatconfig), [WebexConfig](#webexconfig), [WebhookConfig](#webhookconfig) +Appears in: [DiscordConfig](#discordconfig), [IncidentioConfig](#incidentioconfig), [JiraConfig](#jiraconfig), [MSTeamsConfig](#msteamsconfig), [MSTeamsV2Config](#msteamsv2config), [OpsGenieConfig](#opsgenieconfig), [PagerDutyConfig](#pagerdutyconfig), [PushoverConfig](#pushoverconfig), [RocketchatConfig](#rocketchatconfig), [SlackConfig](#slackconfig), [SnsConfig](#snsconfig), [TelegramConfig](#telegramconfig), [VictorOpsConfig](#victoropsconfig), [WeChatConfig](#wechatconfig), [WebexConfig](#webexconfig), [WebhookConfig](#webhookconfig) | Field | Description | | --- | --- | @@ -2036,12 +2036,11 @@ Appears in: [PagerDutyConfig](#pagerdutyconfig) | href#
_string_ | _(Optional)_
| | source#
_string_ | _(Required)_
| -#### IncidentIOConfig +#### IncidentioConfig IncidentIOConfig configures notifications via incident.io. https://prometheus.io/docs/alerting/latest/configuration/#incidentio_config -available from v0.66.0 operator version -and v0.29.0 alertmanager version +Available from v0.29.0 alertmanager version Appears in: [Receiver](#receiver) @@ -2084,8 +2083,7 @@ Appears in: [VMAgentSpec](#vmagentspec), [VMInsert](#vminsert), [VMSingleSpec](# JiraConfig represent alertmanager's jira_config entry https://prometheus.io/docs/alerting/latest/configuration/#jira_config -available from v0.55.0 operator version -and v0.28.0 alertmanager version +Available from v0.28.0 alertmanager version Appears in: [Receiver](#receiver) @@ -2185,8 +2183,7 @@ Appears in: [Receiver](#receiver) MSTeamsV2Config sends notifications using the new message format with adaptive cards as required by flows. https://support.microsoft.com/en-gb/office/create-incoming-webhooks-with-workflows-for-microsoft-teams-8ae491c7-0394-4861-ba59-055e33f75498 -available from v0.55.0 operator version -and v0.28.0 alertmanager version +Available from v0.28.0 alertmanager version Appears in: [Receiver](#receiver) @@ -2268,9 +2265,9 @@ Appears in: [ConsulSDConfig](#consulsdconfig), [DigitalOceanSDConfig](#digitaloc | client_secret#
_[SecretKeySelector](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.35/#secretkeyselector-v1-core)_ | _(Optional)_
The secret containing the OAuth2 client secret | | client_secret_file#
_string_ | _(Optional)_
ClientSecretFile defines path for client secret file. | | endpoint_params#
_object (keys:string, values:string)_ | _(Optional)_
Parameters to append to the token URL | -| proxy_url#
_string_ | _(Optional)_
The proxy URL for token_url connection
( available from v0.55.0).
Is only supported by Scrape objects family | +| proxy_url#
_string_ | _(Optional)_
The proxy URL for token_url connection
Is only supported by Scrape objects family
Available from: v0.55.0 | | scopes#
_string array_ | _(Optional)_
OAuth2 scopes used for the token request | -| tls_config#
_[TLSConfig](#tlsconfig)_ | _(Optional)_
TLSConfig for token_url connection
( available from v0.55.0).
Is only supported by Scrape objects family | +| tls_config#
_[TLSConfig](#tlsconfig)_ | _(Optional)_
TLSConfig for token_url connection
Is only supported by Scrape objects family
Available from: v0.55.0 | | token_url#
_string_ | _(Required)_
The URL to fetch the token from | #### OpenStackSDConfig @@ -2459,15 +2456,15 @@ Appears in: [VMAlertmanagerConfigSpec](#vmalertmanagerconfigspec) | --- | --- | | discord_configs#
_[DiscordConfig](#discordconfig) array_ | _(Optional)_
| | email_configs#
_[EmailConfig](#emailconfig) array_ | _(Optional)_
EmailConfigs defines email notification configurations. | -| incidentio_configs#
_[IncidentIOConfig](#incidentioconfig) array_ | _(Optional)_
| -| jira_configs#
_[JiraConfig](#jiraconfig) array_ | _(Optional)_
| +| incidentio_configs#
_[IncidentioConfig](#incidentioconfig) array_ | _(Optional)_

Available from: v0.66.0 | +| jira_configs#
_[JiraConfig](#jiraconfig) array_ | _(Optional)_

Available from: v0.55.0 | | msteams_configs#
_[MSTeamsConfig](#msteamsconfig) array_ | _(Optional)_
| -| msteamsv2_configs#
_[MSTeamsV2Config](#msteamsv2config) array_ | _(Optional)_
| +| msteamsv2_configs#
_[MSTeamsV2Config](#msteamsv2config) array_ | _(Optional)_

Available from: v0.55.0 | | name#
_string_ | _(Required)_
Name of the receiver. Must be unique across all items from the list. | | opsgenie_configs#
_[OpsGenieConfig](#opsgenieconfig) array_ | _(Optional)_
OpsGenieConfigs defines ops genie notification configurations. | | pagerduty_configs#
_[PagerDutyConfig](#pagerdutyconfig) array_ | _(Optional)_
PagerDutyConfigs defines pager duty notification configurations. | | pushover_configs#
_[PushoverConfig](#pushoverconfig) array_ | _(Optional)_
PushoverConfigs defines push over notification configurations. | -| rocketchat_configs#
_[RocketchatConfig](#rocketchatconfig) array_ | _(Optional)_
| +| rocketchat_configs#
_[RocketchatConfig](#rocketchatconfig) array_ | _(Optional)_

Available from: v0.55.0 | | slack_configs#
_[SlackConfig](#slackconfig) array_ | _(Optional)_
SlackConfigs defines slack notification configurations. | | sns_configs#
_[SnsConfig](#snsconfig) array_ | _(Optional)_
| | telegram_configs#
_[TelegramConfig](#telegramconfig) array_ | _(Optional)_
| @@ -2529,8 +2526,7 @@ Appears in: [RocketchatConfig](#rocketchatconfig) RocketchatConfig configures notifications via Rocketchat. https://prometheus.io/docs/alerting/latest/configuration/#rocketchat_config -available from v0.55.0 operator version -and v0.28.0 alertmanager version +Available from v0.28.0 alertmanager version Appears in: [Receiver](#receiver) @@ -2819,7 +2815,7 @@ Appears in: [VMAgentRemoteWriteSpec](#vmagentremotewritespec), [VMAgentSpec](#vm | dedupInterval#
_string_ | _(Optional)_
Allows setting different de-duplication intervals per each configured remote storage | | dropInput#
_boolean_ | _(Optional)_
Allow drop all the input samples after the aggregation | | dropInputLabels#
_string array_ | _(Optional)_
labels to drop from samples for aggregator before stream de-duplication and aggregation | -| enableWindows#
_boolean_ | _(Optional)_
EnableWindows enables aggregating data in separate windows ( available from v0.54.0). | +| enableWindows#
_boolean_ | _(Optional)_
EnableWindows enables aggregating data in separate windows.
Available from: v0.54.0 | | ignoreFirstIntervals#
_integer_ | _(Optional)_
IgnoreFirstIntervals instructs to ignore first interval | | ignoreFirstSampleInterval#
_string_ | _(Required)_
IgnoreFirstSampleInterval sets interval for total and prometheus_total during which first samples will be ignored | | ignoreOldSamples#
_boolean_ | _(Optional)_
IgnoreOldSamples instructs to ignore samples with old timestamps outside the current aggregation interval. | @@ -3090,7 +3086,7 @@ Appears in: [VLogs](#vlogs) | affinity#
_[Affinity](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.35/#affinity-v1-core)_ | _(Optional)_
Affinity If specified, the pod's scheduling constraints. | | configMaps#
_string array_ | _(Optional)_
ConfigMaps is a list of ConfigMaps in the same namespace as the Application
object, which shall be mounted into the Application container
at /etc/vm/configs/CONFIGMAP_NAME folder | | containers#
_[Container](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.35/#container-v1-core) array_ | _(Optional)_
Containers property allows to inject additions sidecars or to patch existing containers.
It can be useful for proxies, backup, etc. | -| disableAutomountServiceAccountToken#
_boolean_ | _(Optional)_
DisableAutomountServiceAccountToken whether to disable serviceAccount auto mount by Kubernetes (available from v0.54.0).
Operator will conditionally create volumes and volumeMounts for containers if it requires k8s API access.
For example, vmagent and vm-config-reloader requires k8s API access.
Operator creates volumes with name: "kube-api-access", which can be used as volumeMount for extraContainers if needed.
And also adds VolumeMounts at /var/run/secrets/kubernetes.io/serviceaccount. | +| disableAutomountServiceAccountToken#
_boolean_ | _(Optional)_
DisableAutomountServiceAccountToken whether to disable serviceAccount auto mount by Kubernetes
Operator will conditionally create volumes and volumeMounts for containers if it requires k8s API access.
For example, vmagent and vm-config-reloader requires k8s API access.
Operator creates volumes with name: "kube-api-access", which can be used as volumeMount for extraContainers if needed.
And also adds VolumeMounts at /var/run/secrets/kubernetes.io/serviceaccount.
Available from: v0.54.0 | | disableSelfServiceScrape#
_boolean_ | _(Optional)_
DisableSelfServiceScrape controls creation of VMServiceScrape by operator
for the application.
Has priority over `VM_DISABLESELFSERVICESCRAPECREATION` operator env variable | | dnsConfig#
_[PodDNSConfig](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.35/#poddnsconfig-v1-core)_ | _(Optional)_
Specifies the DNS parameters of a pod.
Parameters specified here will be merged to the generated DNS
configuration based on DNSPolicy. | | dnsPolicy#
_[DNSPolicy](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.35/#dnspolicy-v1-core)_ | _(Optional)_
DNSPolicy sets DNS policy for the pod | @@ -3140,7 +3136,7 @@ Appears in: [VLogs](#vlogs) | useDefaultResources#
_boolean_ | _(Optional)_
UseDefaultResources controls resource settings
By default, operator sets built-in resource requirements | | useStrictSecurity#
_boolean_ | _(Optional)_
UseStrictSecurity enables strict security mode for component
it restricts disk writes access
uses non-root user out of the box
drops not needed security permissions | | volumeMounts#
_[VolumeMount](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.35/#volumemount-v1-core) array_ | _(Optional)_
VolumeMounts allows configuration of additional VolumeMounts on the output Deployment/StatefulSet definition.
VolumeMounts specified will be appended to other VolumeMounts in the Application container | -| volumes#
_[Volume](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.35/#volume-v1-core) array_ | _(Required)_
Volumes allows configuration of additional volumes on the output Deployment/StatefulSet definition.
Volumes specified will be appended to other volumes that are generated.
/ +optional | +| volumes#
_[Volume](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.35/#volume-v1-core) array_ | _(Optional)_
Volumes allows configuration of additional volumes on the output Deployment/StatefulSet definition.
Volumes specified will be appended to other volumes that are generated. | #### VMAgent @@ -3214,8 +3210,8 @@ Appears in: [VMAgent](#vmagent) | configReloaderImageTag#
_string_ | _(Optional)_
ConfigReloaderImageTag defines image:tag for config-reloader container
Deprecated: since version v0.67.0 will be removed in v0.69.0 use configReloaderImage instead
| | configReloaderResources#
_[ResourceRequirements](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.35/#resourcerequirements-v1-core)_ | _(Optional)_
ConfigReloaderResources config-reloader container resource request and limits, https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
if not defined default resources from operator config will be used | | containers#
_[Container](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.35/#container-v1-core) array_ | _(Optional)_
Containers property allows to inject additions sidecars or to patch existing containers.
It can be useful for proxies, backup, etc. | -| daemonSetMode#
_boolean_ | _(Optional)_
DaemonSetMode enables DaemonSet deployment mode instead of Deployment.
Supports only VMPodScrape
(available from v0.55.0).
Cannot be used with statefulMode | -| disableAutomountServiceAccountToken#
_boolean_ | _(Optional)_
DisableAutomountServiceAccountToken whether to disable serviceAccount auto mount by Kubernetes (available from v0.54.0).
Operator will conditionally create volumes and volumeMounts for containers if it requires k8s API access.
For example, vmagent and vm-config-reloader requires k8s API access.
Operator creates volumes with name: "kube-api-access", which can be used as volumeMount for extraContainers if needed.
And also adds VolumeMounts at /var/run/secrets/kubernetes.io/serviceaccount. | +| daemonSetMode#
_boolean_ | _(Optional)_
DaemonSetMode enables DaemonSet deployment mode instead of Deployment.
Supports only VMPodScrape
Cannot be used with statefulMode
Available from: v0.55.0 | +| disableAutomountServiceAccountToken#
_boolean_ | _(Optional)_
DisableAutomountServiceAccountToken whether to disable serviceAccount auto mount by Kubernetes
Operator will conditionally create volumes and volumeMounts for containers if it requires k8s API access.
For example, vmagent and vm-config-reloader requires k8s API access.
Operator creates volumes with name: "kube-api-access", which can be used as volumeMount for extraContainers if needed.
And also adds VolumeMounts at /var/run/secrets/kubernetes.io/serviceaccount.
Available from: v0.54.0 | | disableSelfServiceScrape#
_boolean_ | _(Optional)_
DisableSelfServiceScrape controls creation of VMServiceScrape by operator
for the application.
Has priority over `VM_DISABLESELFSERVICESCRAPECREATION` operator env variable | | dnsConfig#
_[PodDNSConfig](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.35/#poddnsconfig-v1-core)_ | _(Optional)_
Specifies the DNS parameters of a pod.
Parameters specified here will be merged to the generated DNS
configuration based on DNSPolicy. | | dnsPolicy#
_[DNSPolicy](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.35/#dnspolicy-v1-core)_ | _(Optional)_
DNSPolicy sets DNS policy for the pod | @@ -3311,7 +3307,7 @@ Appears in: [VMAgent](#vmagent) | useVMConfigReloader#
_boolean_ | _(Optional)_
UseVMConfigReloader replaces prometheus-like config-reloader
with vm one. It uses secrets watch instead of file watch
which greatly increases speed of config updates
Removed since v0.67.0: this property is ignored and no longer needed | | vmAgentExternalLabelName#
_string_ | _(Optional)_
VMAgentExternalLabelName Name of vmAgent external label used to denote vmAgent instance
name. Defaults to the value of `prometheus`. External label will
_not_ be added when value is set to empty string (`""`).
Deprecated: since version v0.67.0 will be removed in v0.69.0 use externalLabelName instead
| | volumeMounts#
_[VolumeMount](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.35/#volumemount-v1-core) array_ | _(Optional)_
VolumeMounts allows configuration of additional VolumeMounts on the output Deployment/StatefulSet definition.
VolumeMounts specified will be appended to other VolumeMounts in the Application container | -| volumes#
_[Volume](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.35/#volume-v1-core) array_ | _(Required)_
Volumes allows configuration of additional volumes on the output Deployment/StatefulSet definition.
Volumes specified will be appended to other volumes that are generated.
/ +optional | +| volumes#
_[Volume](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.35/#volume-v1-core) array_ | _(Optional)_
Volumes allows configuration of additional volumes on the output Deployment/StatefulSet definition.
Volumes specified will be appended to other volumes that are generated. | #### VMAlert @@ -3403,7 +3399,7 @@ Appears in: [VMAlert](#vmalert) | configReloaderResources#
_[ResourceRequirements](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.35/#resourcerequirements-v1-core)_ | _(Optional)_
ConfigReloaderResources config-reloader container resource request and limits, https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
if not defined default resources from operator config will be used | | containers#
_[Container](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.35/#container-v1-core) array_ | _(Optional)_
Containers property allows to inject additions sidecars or to patch existing containers.
It can be useful for proxies, backup, etc. | | datasource#
_[VMAlertDatasourceSpec](#vmalertdatasourcespec)_ | _(Required)_
Datasource Victoria Metrics or VMSelect url. Required parameter. e.g. http://127.0.0.1:8428 | -| disableAutomountServiceAccountToken#
_boolean_ | _(Optional)_
DisableAutomountServiceAccountToken whether to disable serviceAccount auto mount by Kubernetes (available from v0.54.0).
Operator will conditionally create volumes and volumeMounts for containers if it requires k8s API access.
For example, vmagent and vm-config-reloader requires k8s API access.
Operator creates volumes with name: "kube-api-access", which can be used as volumeMount for extraContainers if needed.
And also adds VolumeMounts at /var/run/secrets/kubernetes.io/serviceaccount. | +| disableAutomountServiceAccountToken#
_boolean_ | _(Optional)_
DisableAutomountServiceAccountToken whether to disable serviceAccount auto mount by Kubernetes
Operator will conditionally create volumes and volumeMounts for containers if it requires k8s API access.
For example, vmagent and vm-config-reloader requires k8s API access.
Operator creates volumes with name: "kube-api-access", which can be used as volumeMount for extraContainers if needed.
And also adds VolumeMounts at /var/run/secrets/kubernetes.io/serviceaccount.
Available from: v0.54.0 | | disableSelfServiceScrape#
_boolean_ | _(Optional)_
DisableSelfServiceScrape controls creation of VMServiceScrape by operator
for the application.
Has priority over `VM_DISABLESELFSERVICESCRAPECREATION` operator env variable | | dnsConfig#
_[PodDNSConfig](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.35/#poddnsconfig-v1-core)_ | _(Optional)_
Specifies the DNS parameters of a pod.
Parameters specified here will be merged to the generated DNS
configuration based on DNSPolicy. | | dnsPolicy#
_[DNSPolicy](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.35/#dnspolicy-v1-core)_ | _(Optional)_
DNSPolicy sets DNS policy for the pod | @@ -3462,7 +3458,7 @@ Appears in: [VMAlert](#vmalert) | useStrictSecurity#
_boolean_ | _(Optional)_
UseStrictSecurity enables strict security mode for component
it restricts disk writes access
uses non-root user out of the box
drops not needed security permissions | | useVMConfigReloader#
_boolean_ | _(Optional)_
UseVMConfigReloader replaces prometheus-like config-reloader
with vm one. It uses secrets watch instead of file watch
which greatly increases speed of config updates
Removed since v0.67.0: this property is ignored and no longer needed | | volumeMounts#
_[VolumeMount](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.35/#volumemount-v1-core) array_ | _(Optional)_
VolumeMounts allows configuration of additional VolumeMounts on the output Deployment/StatefulSet definition.
VolumeMounts specified will be appended to other VolumeMounts in the Application container | -| volumes#
_[Volume](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.35/#volume-v1-core) array_ | _(Required)_
Volumes allows configuration of additional volumes on the output Deployment/StatefulSet definition.
Volumes specified will be appended to other volumes that are generated.
/ +optional | +| volumes#
_[Volume](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.35/#volume-v1-core) array_ | _(Optional)_
Volumes allows configuration of additional volumes on the output Deployment/StatefulSet definition.
Volumes specified will be appended to other volumes that are generated. | #### VMAlertmanager @@ -3547,7 +3543,7 @@ Appears in: [VMAlertmanager](#vmalertmanager) | configSecret#
_string_ | _(Optional)_
ConfigSecret is the name of a Kubernetes Secret in the same namespace as the
VMAlertmanager object, which contains configuration for this VMAlertmanager,
configuration must be inside secret key: alertmanager.yaml.
It must be created by user.
instance. Defaults to 'vmalertmanager-'
The secret is mounted into /etc/alertmanager/config. | | configSelector#
_[LabelSelector](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.35/#labelselector-v1-meta)_ | _(Optional)_
ConfigSelector defines selector for VMAlertmanagerConfig, result config will be merged with with Raw or Secret config.
Works in combination with NamespaceSelector.
NamespaceSelector nil - only objects at VMAlertmanager namespace.
Selector nil - only objects at NamespaceSelector namespaces.
If both nil - behaviour controlled by selectAllByDefault | | containers#
_[Container](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.35/#container-v1-core) array_ | _(Optional)_
Containers property allows to inject additions sidecars or to patch existing containers.
It can be useful for proxies, backup, etc. | -| disableAutomountServiceAccountToken#
_boolean_ | _(Optional)_
DisableAutomountServiceAccountToken whether to disable serviceAccount auto mount by Kubernetes (available from v0.54.0).
Operator will conditionally create volumes and volumeMounts for containers if it requires k8s API access.
For example, vmagent and vm-config-reloader requires k8s API access.
Operator creates volumes with name: "kube-api-access", which can be used as volumeMount for extraContainers if needed.
And also adds VolumeMounts at /var/run/secrets/kubernetes.io/serviceaccount. | +| disableAutomountServiceAccountToken#
_boolean_ | _(Optional)_
DisableAutomountServiceAccountToken whether to disable serviceAccount auto mount by Kubernetes
Operator will conditionally create volumes and volumeMounts for containers if it requires k8s API access.
For example, vmagent and vm-config-reloader requires k8s API access.
Operator creates volumes with name: "kube-api-access", which can be used as volumeMount for extraContainers if needed.
And also adds VolumeMounts at /var/run/secrets/kubernetes.io/serviceaccount.
Available from: v0.54.0 | | disableNamespaceMatcher#
_boolean_ | _(Optional)_
DisableNamespaceMatcher disables adding top route label matcher "namespace = " for VMAlertmanagerConfig
It may be useful if alert doesn't have namespace label for some reason | | disableRouteContinueEnforce#
_boolean_ | _(Optional)_
DisableRouteContinueEnforce cancel the behavior for VMAlertmanagerConfig that always enforce first-level route continue to true | | disableSelfServiceScrape#
_boolean_ | _(Optional)_
DisableSelfServiceScrape controls creation of VMServiceScrape by operator
for the application.
Has priority over `VM_DISABLESELFSERVICESCRAPECREATION` operator env variable | @@ -3607,7 +3603,7 @@ Appears in: [VMAlertmanager](#vmalertmanager) | useStrictSecurity#
_boolean_ | _(Optional)_
UseStrictSecurity enables strict security mode for component
it restricts disk writes access
uses non-root user out of the box
drops not needed security permissions | | useVMConfigReloader#
_boolean_ | _(Optional)_
UseVMConfigReloader replaces prometheus-like config-reloader
with vm one. It uses secrets watch instead of file watch
which greatly increases speed of config updates
Removed since v0.67.0: this property is ignored and no longer needed | | volumeMounts#
_[VolumeMount](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.35/#volumemount-v1-core) array_ | _(Optional)_
VolumeMounts allows configuration of additional VolumeMounts on the output Deployment/StatefulSet definition.
VolumeMounts specified will be appended to other VolumeMounts in the Application container | -| volumes#
_[Volume](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.35/#volume-v1-core) array_ | _(Required)_
Volumes allows configuration of additional volumes on the output Deployment/StatefulSet definition.
Volumes specified will be appended to other volumes that are generated.
/ +optional | +| volumes#
_[Volume](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.35/#volume-v1-core) array_ | _(Optional)_
Volumes allows configuration of additional volumes on the output Deployment/StatefulSet definition.
Volumes specified will be appended to other volumes that are generated. | | webConfig#
_[VMAlertmanagerWebConfig](#vmalertmanagerwebconfig)_ | _(Optional)_
WebConfig defines configuration for webserver
https://github.com/prometheus/alertmanager/blob/main/docs/https.md | #### VMAlertmanagerTracingConfig @@ -3676,7 +3672,7 @@ Appears in: [VMAuthLoadBalancer](#vmauthloadbalancer) | affinity#
_[Affinity](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.35/#affinity-v1-core)_ | _(Optional)_
Affinity If specified, the pod's scheduling constraints. | | configMaps#
_string array_ | _(Optional)_
ConfigMaps is a list of ConfigMaps in the same namespace as the Application
object, which shall be mounted into the Application container
at /etc/vm/configs/CONFIGMAP_NAME folder | | containers#
_[Container](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.35/#container-v1-core) array_ | _(Optional)_
Containers property allows to inject additions sidecars or to patch existing containers.
It can be useful for proxies, backup, etc. | -| disableAutomountServiceAccountToken#
_boolean_ | _(Optional)_
DisableAutomountServiceAccountToken whether to disable serviceAccount auto mount by Kubernetes (available from v0.54.0).
Operator will conditionally create volumes and volumeMounts for containers if it requires k8s API access.
For example, vmagent and vm-config-reloader requires k8s API access.
Operator creates volumes with name: "kube-api-access", which can be used as volumeMount for extraContainers if needed.
And also adds VolumeMounts at /var/run/secrets/kubernetes.io/serviceaccount. | +| disableAutomountServiceAccountToken#
_boolean_ | _(Optional)_
DisableAutomountServiceAccountToken whether to disable serviceAccount auto mount by Kubernetes
Operator will conditionally create volumes and volumeMounts for containers if it requires k8s API access.
For example, vmagent and vm-config-reloader requires k8s API access.
Operator creates volumes with name: "kube-api-access", which can be used as volumeMount for extraContainers if needed.
And also adds VolumeMounts at /var/run/secrets/kubernetes.io/serviceaccount.
Available from: v0.54.0 | | disableSelfServiceScrape#
_boolean_ | _(Optional)_
DisableSelfServiceScrape controls creation of VMServiceScrape by operator
for the application.
Has priority over `VM_DISABLESELFSERVICESCRAPECREATION` operator env variable | | dnsConfig#
_[PodDNSConfig](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.35/#poddnsconfig-v1-core)_ | _(Optional)_
Specifies the DNS parameters of a pod.
Parameters specified here will be merged to the generated DNS
configuration based on DNSPolicy. | | dnsPolicy#
_[DNSPolicy](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.35/#dnspolicy-v1-core)_ | _(Optional)_
DNSPolicy sets DNS policy for the pod | @@ -3705,7 +3701,7 @@ Appears in: [VMAuthLoadBalancer](#vmauthloadbalancer) | replicaCount#
_integer_ | _(Optional)_
ReplicaCount is the expected size of the Application. | | resources#
_[ResourceRequirements](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.35/#resourcerequirements-v1-core)_ | _(Optional)_
Resources container resource request and limits, https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
if not defined default resources from operator config will be used | | revisionHistoryLimitCount#
_integer_ | _(Optional)_
The number of old ReplicaSets to retain to allow rollback in deployment or
maximum number of revisions that will be maintained in the Deployment revision history.
Has no effect at StatefulSets
Defaults to 10. | -| rollingUpdate#
_[RollingUpdateDeployment](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.35/#rollingupdatedeployment-v1-apps)_ | _(Optional)_
RollingUpdate - overrides deployment update params.
Available from operator v0.64.0 | +| rollingUpdate#
_[RollingUpdateDeployment](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.35/#rollingupdatedeployment-v1-apps)_ | _(Optional)_
RollingUpdate - overrides deployment update params.
Available from: v0.64.0 | | runtimeClassName#
_string_ | _(Optional)_
RuntimeClassName - defines runtime class for kubernetes pod.
https://kubernetes.io/docs/concepts/containers/runtime-class/ | | schedulerName#
_string_ | _(Optional)_
SchedulerName - defines kubernetes scheduler name | | secrets#
_string array_ | _(Optional)_
Secrets is a list of Secrets in the same namespace as the Application
object, which shall be mounted into the Application container
at /etc/vm/secrets/SECRET_NAME folder | @@ -3716,11 +3712,11 @@ Appears in: [VMAuthLoadBalancer](#vmauthloadbalancer) | terminationGracePeriodSeconds#
_integer_ | _(Optional)_
TerminationGracePeriodSeconds period for container graceful termination | | tolerations#
_[Toleration](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.35/#toleration-v1-core) array_ | _(Optional)_
Tolerations If specified, the pod's tolerations. | | topologySpreadConstraints#
_[TopologySpreadConstraint](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.35/#topologyspreadconstraint-v1-core) array_ | _(Optional)_
TopologySpreadConstraints embedded kubernetes pod configuration option,
controls how pods are spread across your cluster among failure-domains
such as regions, zones, nodes, and other user-defined topology domains
https://kubernetes.io/docs/concepts/workloads/pods/pod-topology-spread-constraints/ | -| updateStrategy#
_[DeploymentStrategyType](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.35/#deploymentstrategytype-v1-apps)_ | _(Optional)_
UpdateStrategy - overrides default update strategy.
Available from operator v0.64.0 | +| updateStrategy#
_[DeploymentStrategyType](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.35/#deploymentstrategytype-v1-apps)_ | _(Optional)_
UpdateStrategy - overrides default update strategy.
Available from: v0.64.0 | | useDefaultResources#
_boolean_ | _(Optional)_
UseDefaultResources controls resource settings
By default, operator sets built-in resource requirements | | useStrictSecurity#
_boolean_ | _(Optional)_
UseStrictSecurity enables strict security mode for component
it restricts disk writes access
uses non-root user out of the box
drops not needed security permissions | | volumeMounts#
_[VolumeMount](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.35/#volumemount-v1-core) array_ | _(Optional)_
VolumeMounts allows configuration of additional VolumeMounts on the output Deployment/StatefulSet definition.
VolumeMounts specified will be appended to other VolumeMounts in the Application container | -| volumes#
_[Volume](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.35/#volume-v1-core) array_ | _(Required)_
Volumes allows configuration of additional volumes on the output Deployment/StatefulSet definition.
Volumes specified will be appended to other volumes that are generated.
/ +optional | +| volumes#
_[Volume](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.35/#volume-v1-core) array_ | _(Optional)_
Volumes allows configuration of additional volumes on the output Deployment/StatefulSet definition.
Volumes specified will be appended to other volumes that are generated. | #### VMAuthSpec @@ -3740,7 +3736,7 @@ Appears in: [VMAuth](#vmauth), [VMDistributedAuth](#vmdistributedauth) | configSecret#
_string_ | _(Required)_
ConfigSecret is the name of a Kubernetes Secret in the same namespace as the
VMAuth object, which contains auth configuration for vmauth,
configuration must be inside secret key: config.yaml.
It must be created and managed manually.
If it's defined, configuration for vmauth becomes unmanaged and operator'll not create any related secrets/config-reloaders
Deprecated: since version v0.49.0 will be removed in v0.69.0 use externalConfig instead
| | containers#
_[Container](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.35/#container-v1-core) array_ | _(Optional)_
Containers property allows to inject additions sidecars or to patch existing containers.
It can be useful for proxies, backup, etc. | | default_url#
_string array_ | _(Required)_
DefaultURLs backend url for non-matching paths filter
usually used for default backend with error message | -| disableAutomountServiceAccountToken#
_boolean_ | _(Optional)_
DisableAutomountServiceAccountToken whether to disable serviceAccount auto mount by Kubernetes (available from v0.54.0).
Operator will conditionally create volumes and volumeMounts for containers if it requires k8s API access.
For example, vmagent and vm-config-reloader requires k8s API access.
Operator creates volumes with name: "kube-api-access", which can be used as volumeMount for extraContainers if needed.
And also adds VolumeMounts at /var/run/secrets/kubernetes.io/serviceaccount. | +| disableAutomountServiceAccountToken#
_boolean_ | _(Optional)_
DisableAutomountServiceAccountToken whether to disable serviceAccount auto mount by Kubernetes
Operator will conditionally create volumes and volumeMounts for containers if it requires k8s API access.
For example, vmagent and vm-config-reloader requires k8s API access.
Operator creates volumes with name: "kube-api-access", which can be used as volumeMount for extraContainers if needed.
And also adds VolumeMounts at /var/run/secrets/kubernetes.io/serviceaccount.
Available from: v0.54.0 | | disableSelfServiceScrape#
_boolean_ | _(Optional)_
DisableSelfServiceScrape controls creation of VMServiceScrape by operator
for the application.
Has priority over `VM_DISABLESELFSERVICESCRAPECREATION` operator env variable | | discover_backend_ips#
_boolean_ | _(Required)_
DiscoverBackendIPs instructs discovering URLPrefix backend IPs via DNS. | | dnsConfig#
_[PodDNSConfig](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.35/#poddnsconfig-v1-core)_ | _(Optional)_
Specifies the DNS parameters of a pod.
Parameters specified here will be merged to the generated DNS
configuration based on DNSPolicy. | @@ -3761,7 +3757,7 @@ Appears in: [VMAuth](#vmauth), [VMDistributedAuth](#vmdistributedauth) | imagePullSecrets#
_[LocalObjectReference](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.35/#localobjectreference-v1-core) array_ | _(Optional)_
ImagePullSecrets An optional list of references to secrets in the same namespace
to use for pulling images from registries
see https://kubernetes.io/docs/concepts/containers/images/#referring-to-an-imagepullsecrets-on-a-pod | | ingress#
_[EmbeddedIngress](#embeddedingress)_ | _(Required)_
Ingress enables ingress configuration for VMAuth. | | initContainers#
_[Container](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.35/#container-v1-core) array_ | _(Optional)_
InitContainers allows adding initContainers to the pod definition.
Any errors during the execution of an initContainer will lead to a restart of the Pod.
More info: https://kubernetes.io/docs/concepts/workloads/pods/init-containers/ | -| internalListenPort#
_string_ | _(Optional)_
InternalListenPort instructs vmauth to serve internal routes at given port
available from v0.56.0 operator
and v1.111.0 vmauth version
related doc https://docs.victoriametrics.com/victoriametrics/vmauth/#security | +| internalListenPort#
_string_ | _(Optional)_
InternalListenPort instructs vmauth to serve internal routes at given port
available from v1.111.0 vmauth version
related doc https://docs.victoriametrics.com/victoriametrics/vmauth/#security
Available from: v0.56.0 | | ip_filters#
_[VMUserIPFilters](#vmuseripfilters)_ | _(Optional)_
IPFilters defines per target src ip filters
supported only with enterprise version of [vmauth](https://docs.victoriametrics.com/victoriametrics/vmauth/#ip-filters) | | license#
_[License](#license)_ | _(Optional)_
License allows to configure license key to be used for enterprise features.
Using license key is supported starting from VictoriaMetrics v1.94.0.
See [here](https://docs.victoriametrics.com/victoriametrics/enterprise/) | | livenessProbe#
_[Probe](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.35/#probe-v1-core)_ | _(Optional)_
LivenessProbe that will be added to CR pod | @@ -3784,7 +3780,7 @@ Appears in: [VMAuth](#vmauth), [VMDistributedAuth](#vmdistributedauth) | response_headers#
_string array_ | _(Optional)_
ResponseHeaders represent additional http headers, that vmauth adds for request response
in form of ["header_key: header_value"]
multiple values for header key:
["header_key: value1,value2"]
it's available since 1.93.0 version of vmauth | | retry_status_codes#
_integer array_ | _(Optional)_
RetryStatusCodes defines http status codes in numeric format for request retries
e.g. [429,503] | | revisionHistoryLimitCount#
_integer_ | _(Optional)_
The number of old ReplicaSets to retain to allow rollback in deployment or
maximum number of revisions that will be maintained in the Deployment revision history.
Has no effect at StatefulSets
Defaults to 10. | -| rollingUpdate#
_[RollingUpdateDeployment](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.35/#rollingupdatedeployment-v1-apps)_ | _(Optional)_
RollingUpdate - overrides deployment update params.
Available from operator v0.64.0 | +| rollingUpdate#
_[RollingUpdateDeployment](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.35/#rollingupdatedeployment-v1-apps)_ | _(Optional)_
RollingUpdate - overrides deployment update params.
Available from: v0.64.0 | | runtimeClassName#
_string_ | _(Optional)_
RuntimeClassName - defines runtime class for kubernetes pod.
https://kubernetes.io/docs/concepts/containers/runtime-class/ | | schedulerName#
_string_ | _(Optional)_
SchedulerName - defines kubernetes scheduler name | | secrets#
_string array_ | _(Optional)_
Secrets is a list of Secrets in the same namespace as the Application
object, which shall be mounted into the Application container
at /etc/vm/secrets/SECRET_NAME folder | @@ -3798,9 +3794,9 @@ Appears in: [VMAuth](#vmauth), [VMDistributedAuth](#vmdistributedauth) | tlsConfig#
_[TLSConfig](#tlsconfig)_ | _(Optional)_
TLSConfig defines tls configuration for the backend connection | | tolerations#
_[Toleration](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.35/#toleration-v1-core) array_ | _(Optional)_
Tolerations If specified, the pod's tolerations. | | topologySpreadConstraints#
_[TopologySpreadConstraint](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.35/#topologyspreadconstraint-v1-core) array_ | _(Optional)_
TopologySpreadConstraints embedded kubernetes pod configuration option,
controls how pods are spread across your cluster among failure-domains
such as regions, zones, nodes, and other user-defined topology domains
https://kubernetes.io/docs/concepts/workloads/pods/pod-topology-spread-constraints/ | -| unauthorizedAccessConfig#
_[UnauthorizedAccessConfigURLMap](#unauthorizedaccessconfigurlmap) array_ | _(Required)_
UnauthorizedAccessConfig configures access for un authorized users
Deprecated: since version v0.51.0 will be removed in v1.0.0 use unauthorizedUserAccessSpec instead
| +| unauthorizedAccessConfig#
_[UnauthorizedAccessConfigURLMap](#unauthorizedaccessconfigurlmap) array_ | _(Required)_
UnauthorizedAccessConfig configures access for un authorized users
Deprecated: since version v0.51.0 will be removed in v1.0.0 use unauthorizedUserAccessSpec instead
| | unauthorizedUserAccessSpec#
_[VMAuthUnauthorizedUserAccessSpec](#vmauthunauthorizeduseraccessspec)_ | _(Optional)_
UnauthorizedUserAccessSpec defines unauthorized_user config section of vmauth config | -| updateStrategy#
_[DeploymentStrategyType](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.35/#deploymentstrategytype-v1-apps)_ | _(Optional)_
UpdateStrategy - overrides default update strategy.
Available from operator v0.64.0 | +| updateStrategy#
_[DeploymentStrategyType](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.35/#deploymentstrategytype-v1-apps)_ | _(Optional)_
UpdateStrategy - overrides default update strategy.
Available from: v0.64.0 | | useDefaultResources#
_boolean_ | _(Optional)_
UseDefaultResources controls resource settings
By default, operator sets built-in resource requirements | | useProxyProtocol#
_boolean_ | _(Required)_
UseProxyProtocol enables proxy protocol for vmauth
https://www.haproxy.org/download/2.3/doc/proxy-protocol.txt | | useStrictSecurity#
_boolean_ | _(Optional)_
UseStrictSecurity enables strict security mode for component
it restricts disk writes access
uses non-root user out of the box
drops not needed security permissions | @@ -3808,7 +3804,7 @@ Appears in: [VMAuth](#vmauth), [VMDistributedAuth](#vmdistributedauth) | userNamespaceSelector#
_[LabelSelector](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.35/#labelselector-v1-meta)_ | _(Optional)_
UserNamespaceSelector Namespaces to be selected for VMAuth discovery.
Works in combination with Selector.
NamespaceSelector nil - only objects at VMAuth namespace.
Selector nil - only objects at NamespaceSelector namespaces.
If both nil - behaviour controlled by selectAllByDefault | | userSelector#
_[LabelSelector](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.35/#labelselector-v1-meta)_ | _(Optional)_
UserSelector defines VMUser to be selected for config file generation.
Works in combination with NamespaceSelector.
NamespaceSelector nil - only objects at VMAuth namespace.
If both nil - behaviour controlled by selectAllByDefault | | volumeMounts#
_[VolumeMount](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.35/#volumemount-v1-core) array_ | _(Optional)_
VolumeMounts allows configuration of additional VolumeMounts on the output Deployment/StatefulSet definition.
VolumeMounts specified will be appended to other VolumeMounts in the Application container | -| volumes#
_[Volume](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.35/#volume-v1-core) array_ | _(Required)_
Volumes allows configuration of additional volumes on the output Deployment/StatefulSet definition.
Volumes specified will be appended to other volumes that are generated.
/ +optional | +| volumes#
_[Volume](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.35/#volume-v1-core) array_ | _(Optional)_
Volumes allows configuration of additional volumes on the output Deployment/StatefulSet definition.
Volumes specified will be appended to other volumes that are generated. | | vpa#
_[EmbeddedVPA](#embeddedvpa)_ | _(Optional)_
Configures vertical pod autoscaling. | #### VMAuthUnauthorizedUserAccessSpec @@ -3909,7 +3905,7 @@ Appears in: [VMClusterSpec](#vmclusterspec) | clusterNativeListenPort#
_string_ | _(Optional)_
ClusterNativePort for multi-level cluster setup.
More [details](https://docs.victoriametrics.com/victoriametrics/cluster-victoriametrics/#multi-level-cluster-setup) | | configMaps#
_string array_ | _(Optional)_
ConfigMaps is a list of ConfigMaps in the same namespace as the Application
object, which shall be mounted into the Application container
at /etc/vm/configs/CONFIGMAP_NAME folder | | containers#
_[Container](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.35/#container-v1-core) array_ | _(Optional)_
Containers property allows to inject additions sidecars or to patch existing containers.
It can be useful for proxies, backup, etc. | -| disableAutomountServiceAccountToken#
_boolean_ | _(Optional)_
DisableAutomountServiceAccountToken whether to disable serviceAccount auto mount by Kubernetes (available from v0.54.0).
Operator will conditionally create volumes and volumeMounts for containers if it requires k8s API access.
For example, vmagent and vm-config-reloader requires k8s API access.
Operator creates volumes with name: "kube-api-access", which can be used as volumeMount for extraContainers if needed.
And also adds VolumeMounts at /var/run/secrets/kubernetes.io/serviceaccount. | +| disableAutomountServiceAccountToken#
_boolean_ | _(Optional)_
DisableAutomountServiceAccountToken whether to disable serviceAccount auto mount by Kubernetes
Operator will conditionally create volumes and volumeMounts for containers if it requires k8s API access.
For example, vmagent and vm-config-reloader requires k8s API access.
Operator creates volumes with name: "kube-api-access", which can be used as volumeMount for extraContainers if needed.
And also adds VolumeMounts at /var/run/secrets/kubernetes.io/serviceaccount.
Available from: v0.54.0 | | disableSelfServiceScrape#
_boolean_ | _(Optional)_
DisableSelfServiceScrape controls creation of VMServiceScrape by operator
for the application.
Has priority over `VM_DISABLESELFSERVICESCRAPECREATION` operator env variable | | dnsConfig#
_[PodDNSConfig](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.35/#poddnsconfig-v1-core)_ | _(Optional)_
Specifies the DNS parameters of a pod.
Parameters specified here will be merged to the generated DNS
configuration based on DNSPolicy. | | dnsPolicy#
_[DNSPolicy](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.35/#dnspolicy-v1-core)_ | _(Optional)_
DNSPolicy sets DNS policy for the pod | @@ -3954,7 +3950,7 @@ Appears in: [VMClusterSpec](#vmclusterspec) | useDefaultResources#
_boolean_ | _(Optional)_
UseDefaultResources controls resource settings
By default, operator sets built-in resource requirements | | useStrictSecurity#
_boolean_ | _(Optional)_
UseStrictSecurity enables strict security mode for component
it restricts disk writes access
uses non-root user out of the box
drops not needed security permissions | | volumeMounts#
_[VolumeMount](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.35/#volumemount-v1-core) array_ | _(Optional)_
VolumeMounts allows configuration of additional VolumeMounts on the output Deployment/StatefulSet definition.
VolumeMounts specified will be appended to other VolumeMounts in the Application container | -| volumes#
_[Volume](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.35/#volume-v1-core) array_ | _(Required)_
Volumes allows configuration of additional volumes on the output Deployment/StatefulSet definition.
Volumes specified will be appended to other volumes that are generated.
/ +optional | +| volumes#
_[Volume](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.35/#volume-v1-core) array_ | _(Optional)_
Volumes allows configuration of additional volumes on the output Deployment/StatefulSet definition.
Volumes specified will be appended to other volumes that are generated. | | vpa#
_[EmbeddedVPA](#embeddedvpa)_ | _(Optional)_
Configures vertical pod autoscaling. | #### VMNodeScrape @@ -4263,7 +4259,7 @@ Appears in: [VMClusterSpec](#vmclusterspec) | clusterNativeListenPort#
_string_ | _(Optional)_
ClusterNativePort for multi-level cluster setup.
More [details](https://docs.victoriametrics.com/victoriametrics/cluster-victoriametrics/#multi-level-cluster-setup) | | configMaps#
_string array_ | _(Optional)_
ConfigMaps is a list of ConfigMaps in the same namespace as the Application
object, which shall be mounted into the Application container
at /etc/vm/configs/CONFIGMAP_NAME folder | | containers#
_[Container](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.35/#container-v1-core) array_ | _(Optional)_
Containers property allows to inject additions sidecars or to patch existing containers.
It can be useful for proxies, backup, etc. | -| disableAutomountServiceAccountToken#
_boolean_ | _(Optional)_
DisableAutomountServiceAccountToken whether to disable serviceAccount auto mount by Kubernetes (available from v0.54.0).
Operator will conditionally create volumes and volumeMounts for containers if it requires k8s API access.
For example, vmagent and vm-config-reloader requires k8s API access.
Operator creates volumes with name: "kube-api-access", which can be used as volumeMount for extraContainers if needed.
And also adds VolumeMounts at /var/run/secrets/kubernetes.io/serviceaccount. | +| disableAutomountServiceAccountToken#
_boolean_ | _(Optional)_
DisableAutomountServiceAccountToken whether to disable serviceAccount auto mount by Kubernetes
Operator will conditionally create volumes and volumeMounts for containers if it requires k8s API access.
For example, vmagent and vm-config-reloader requires k8s API access.
Operator creates volumes with name: "kube-api-access", which can be used as volumeMount for extraContainers if needed.
And also adds VolumeMounts at /var/run/secrets/kubernetes.io/serviceaccount.
Available from: v0.54.0 | | disableSelfServiceScrape#
_boolean_ | _(Optional)_
DisableSelfServiceScrape controls creation of VMServiceScrape by operator
for the application.
Has priority over `VM_DISABLESELFSERVICESCRAPECREATION` operator env variable | | dnsConfig#
_[PodDNSConfig](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.35/#poddnsconfig-v1-core)_ | _(Optional)_
Specifies the DNS parameters of a pod.
Parameters specified here will be merged to the generated DNS
configuration based on DNSPolicy. | | dnsPolicy#
_[DNSPolicy](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.35/#dnspolicy-v1-core)_ | _(Optional)_
DNSPolicy sets DNS policy for the pod | @@ -4309,7 +4305,7 @@ Appears in: [VMClusterSpec](#vmclusterspec) | useDefaultResources#
_boolean_ | _(Optional)_
UseDefaultResources controls resource settings
By default, operator sets built-in resource requirements | | useStrictSecurity#
_boolean_ | _(Optional)_
UseStrictSecurity enables strict security mode for component
it restricts disk writes access
uses non-root user out of the box
drops not needed security permissions | | volumeMounts#
_[VolumeMount](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.35/#volumemount-v1-core) array_ | _(Optional)_
VolumeMounts allows configuration of additional VolumeMounts on the output Deployment/StatefulSet definition.
VolumeMounts specified will be appended to other VolumeMounts in the Application container | -| volumes#
_[Volume](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.35/#volume-v1-core) array_ | _(Required)_
Volumes allows configuration of additional volumes on the output Deployment/StatefulSet definition.
Volumes specified will be appended to other volumes that are generated.
/ +optional | +| volumes#
_[Volume](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.35/#volume-v1-core) array_ | _(Optional)_
Volumes allows configuration of additional volumes on the output Deployment/StatefulSet definition.
Volumes specified will be appended to other volumes that are generated. | | vpa#
_[EmbeddedVPA](#embeddedvpa)_ | _(Optional)_
Configures vertical pod autoscaling. | #### VMServiceScrape @@ -4368,7 +4364,7 @@ Appears in: [VMSingle](#vmsingle) | affinity#
_[Affinity](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.35/#affinity-v1-core)_ | _(Optional)_
Affinity If specified, the pod's scheduling constraints. | | configMaps#
_string array_ | _(Optional)_
ConfigMaps is a list of ConfigMaps in the same namespace as the Application
object, which shall be mounted into the Application container
at /etc/vm/configs/CONFIGMAP_NAME folder | | containers#
_[Container](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.35/#container-v1-core) array_ | _(Optional)_
Containers property allows to inject additions sidecars or to patch existing containers.
It can be useful for proxies, backup, etc. | -| disableAutomountServiceAccountToken#
_boolean_ | _(Optional)_
DisableAutomountServiceAccountToken whether to disable serviceAccount auto mount by Kubernetes (available from v0.54.0).
Operator will conditionally create volumes and volumeMounts for containers if it requires k8s API access.
For example, vmagent and vm-config-reloader requires k8s API access.
Operator creates volumes with name: "kube-api-access", which can be used as volumeMount for extraContainers if needed.
And also adds VolumeMounts at /var/run/secrets/kubernetes.io/serviceaccount. | +| disableAutomountServiceAccountToken#
_boolean_ | _(Optional)_
DisableAutomountServiceAccountToken whether to disable serviceAccount auto mount by Kubernetes
Operator will conditionally create volumes and volumeMounts for containers if it requires k8s API access.
For example, vmagent and vm-config-reloader requires k8s API access.
Operator creates volumes with name: "kube-api-access", which can be used as volumeMount for extraContainers if needed.
And also adds VolumeMounts at /var/run/secrets/kubernetes.io/serviceaccount.
Available from: v0.54.0 | | disableSelfServiceScrape#
_boolean_ | _(Optional)_
DisableSelfServiceScrape controls creation of VMServiceScrape by operator
for the application.
Has priority over `VM_DISABLESELFSERVICESCRAPECREATION` operator env variable | | dnsConfig#
_[PodDNSConfig](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.35/#poddnsconfig-v1-core)_ | _(Optional)_
Specifies the DNS parameters of a pod.
Parameters specified here will be merged to the generated DNS
configuration based on DNSPolicy. | | dnsPolicy#
_[DNSPolicy](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.35/#dnspolicy-v1-core)_ | _(Optional)_
DNSPolicy sets DNS policy for the pod | @@ -4419,7 +4415,7 @@ Appears in: [VMSingle](#vmsingle) | useStrictSecurity#
_boolean_ | _(Optional)_
UseStrictSecurity enables strict security mode for component
it restricts disk writes access
uses non-root user out of the box
drops not needed security permissions | | vmBackup#
_[VMBackup](#vmbackup)_ | _(Optional)_
VMBackup configuration for backup | | volumeMounts#
_[VolumeMount](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.35/#volumemount-v1-core) array_ | _(Optional)_
VolumeMounts allows configuration of additional VolumeMounts on the output Deployment/StatefulSet definition.
VolumeMounts specified will be appended to other VolumeMounts in the Application container | -| volumes#
_[Volume](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.35/#volume-v1-core) array_ | _(Required)_
Volumes allows configuration of additional volumes on the output Deployment/StatefulSet definition.
Volumes specified will be appended to other volumes that are generated.
/ +optional | +| volumes#
_[Volume](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.35/#volume-v1-core) array_ | _(Optional)_
Volumes allows configuration of additional volumes on the output Deployment/StatefulSet definition.
Volumes specified will be appended to other volumes that are generated. | #### VMStaticScrape @@ -4456,7 +4452,7 @@ Appears in: [VMClusterSpec](#vmclusterspec) | claimTemplates#
_[PersistentVolumeClaim](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.35/#persistentvolumeclaim-v1-core) array_ | _(Required)_
ClaimTemplates allows adding additional VolumeClaimTemplates for StatefulSet | | configMaps#
_string array_ | _(Optional)_
ConfigMaps is a list of ConfigMaps in the same namespace as the Application
object, which shall be mounted into the Application container
at /etc/vm/configs/CONFIGMAP_NAME folder | | containers#
_[Container](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.35/#container-v1-core) array_ | _(Optional)_
Containers property allows to inject additions sidecars or to patch existing containers.
It can be useful for proxies, backup, etc. | -| disableAutomountServiceAccountToken#
_boolean_ | _(Optional)_
DisableAutomountServiceAccountToken whether to disable serviceAccount auto mount by Kubernetes (available from v0.54.0).
Operator will conditionally create volumes and volumeMounts for containers if it requires k8s API access.
For example, vmagent and vm-config-reloader requires k8s API access.
Operator creates volumes with name: "kube-api-access", which can be used as volumeMount for extraContainers if needed.
And also adds VolumeMounts at /var/run/secrets/kubernetes.io/serviceaccount. | +| disableAutomountServiceAccountToken#
_boolean_ | _(Optional)_
DisableAutomountServiceAccountToken whether to disable serviceAccount auto mount by Kubernetes
Operator will conditionally create volumes and volumeMounts for containers if it requires k8s API access.
For example, vmagent and vm-config-reloader requires k8s API access.
Operator creates volumes with name: "kube-api-access", which can be used as volumeMount for extraContainers if needed.
And also adds VolumeMounts at /var/run/secrets/kubernetes.io/serviceaccount.
Available from: v0.54.0 | | disableSelfServiceScrape#
_boolean_ | _(Optional)_
DisableSelfServiceScrape controls creation of VMServiceScrape by operator
for the application.
Has priority over `VM_DISABLESELFSERVICESCRAPECREATION` operator env variable | | dnsConfig#
_[PodDNSConfig](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.35/#poddnsconfig-v1-core)_ | _(Optional)_
Specifies the DNS parameters of a pod.
Parameters specified here will be merged to the generated DNS
configuration based on DNSPolicy. | | dnsPolicy#
_[DNSPolicy](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.35/#dnspolicy-v1-core)_ | _(Optional)_
DNSPolicy sets DNS policy for the pod | @@ -4508,7 +4504,7 @@ Appears in: [VMClusterSpec](#vmclusterspec) | vmInsertPort#
_string_ | _(Optional)_
VMInsertPort for VMInsert connections | | vmSelectPort#
_string_ | _(Optional)_
VMSelectPort for VMSelect connections | | volumeMounts#
_[VolumeMount](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.35/#volumemount-v1-core) array_ | _(Optional)_
VolumeMounts allows configuration of additional VolumeMounts on the output Deployment/StatefulSet definition.
VolumeMounts specified will be appended to other VolumeMounts in the Application container | -| volumes#
_[Volume](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.35/#volume-v1-core) array_ | _(Required)_
Volumes allows configuration of additional volumes on the output Deployment/StatefulSet definition.
Volumes specified will be appended to other volumes that are generated.
/ +optional | +| volumes#
_[Volume](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.35/#volume-v1-core) array_ | _(Optional)_
Volumes allows configuration of additional volumes on the output Deployment/StatefulSet definition.
Volumes specified will be appended to other volumes that are generated. | | vpa#
_[EmbeddedVPA](#embeddedvpa)_ | _(Optional)_
Configures vertical pod autoscaling. | #### VMUser diff --git a/docs/config.yaml b/docs/config.yaml index 4dae48628..445a5aa4b 100644 --- a/docs/config.yaml +++ b/docs/config.yaml @@ -11,6 +11,6 @@ processor: - "status$" - "TypeMeta$" customMarkers: - - name: deprecated + - name: notes target: field hasValue: true diff --git a/docs/env.md b/docs/env.md index 1db604d37..1c1f42c85 100644 --- a/docs/env.md +++ b/docs/env.md @@ -1,10 +1,10 @@ | Environment variables | | --- | -| VM_METRICS_VERSION: `v1.146.0` # | +| VM_METRICS_VERSION: `v1.147.0` # | | VM_LOGS_VERSION: `v1.51.0` # | -| VM_ANOMALY_VERSION: `v1.29.6` # | -| VM_TRACES_VERSION: `v0.9.3` # | -| VM_OPERATOR_VERSION: `v0.68.3` # | +| VM_ANOMALY_VERSION: `v1.29.7` # | +| VM_TRACES_VERSION: `v0.9.4` # | +| VM_OPERATOR_VERSION: `v0.68.6` # | | VM_GATEWAY_API_ENABLED: `false` # | | VM_VPA_API_ENABLED: `false` # | | WATCH_NAMESPACE: `-` #
Defines a list of namespaces to be watched by operator. Operator don't perform any cluster wide API calls if namespaces not empty. In case of empty list it performs only clusterwide api calls. | diff --git a/docs/templates/api/type.tpl b/docs/templates/api/type.tpl index 421072fd3..f01d2113e 100644 --- a/docs/templates/api/type.tpl +++ b/docs/templates/api/type.tpl @@ -1,20 +1,24 @@ -{{- define "deprecated" -}} +{{- define "notes" -}} {{- $member := .member }} {{- $type := .type }} - {{- $deprecated := default dict }} - {{- range $member.Markers.deprecated }} - {{- $deprecated = mergeOverwrite $deprecated .Value }} + {{- $notes := default dict }} + {{- range $member.Markers.notes }} + {{- $notes = mergeOverwrite $notes .Value }} {{- end }} {{- $parts := list }} - {{- with $deprecated.deprecated_in }} + {{- with $notes.deprecated_in }} {{- $id := . | replace "." "" }} {{- $parts = append $parts (printf "since version %s" $id .) }} {{- end }} - {{- with $deprecated.removed_in }} - {{- $id := . | replace "." "" }} - {{- $parts = append $parts (printf "will be removed in %s" $id .) }} + {{- with $notes.removed_in }} + {{- if eq . "v1.0.0" }} + {{- $parts = append $parts (printf "will be removed in %s" .) }} + {{- else }} + {{- $id := . | replace "." "" }} + {{- $parts = append $parts (printf "will be removed in %s" $id .) }} + {{- end }} {{- end }} - {{- with $deprecated.replacements }} + {{- with $notes.replacements }} {{- $links := list }} {{- range . }} {{- $id := lower (ternary (replace "." "-" .) (printf "%s-%s" $type .) (contains "." .)) }} @@ -22,6 +26,10 @@ {{- end }} {{- $parts = append $parts (printf "use %s instead" (join ", " $links)) }} {{- end }} + {{- with $notes.available_from }} + {{- $id := . | replace "." "" -}} +
Available from: {{ printf "%s" $id . }} + {{- end }} {{- with $parts }}
Deprecated: {{ join " " . }}
{{ end }} {{- end -}} @@ -66,7 +74,7 @@ Appears in: {{ range $i, $ref := $type.SortedReferences }}{{ if $i }}, {{ end }} {{- range $memberKeys }} {{- $member := index $members . }} {{- $id := lower (printf "%s-%s" $type.Name $member.Name) }} -| {{ $member.Name }}#
_{{ markdownRenderType $member.Type }}_ | {{ if $member.Markers.optional }}_(Optional)_
{{else}}_(Required)_
{{ end }}{{ template "type_members" $member }}{{ template "deprecated" (dict "member" $member "type" $type.Name) }} | +| {{ $member.Name }}#
_{{ markdownRenderType $member.Type }}_ | {{ if $member.Markers.optional }}_(Optional)_
{{else}}_(Required)_
{{ end }}{{ template "type_members" $member }}{{ template "notes" (dict "member" $member "type" $type.Name) }} | {{- end }} {{- end }} {{- end }} diff --git a/internal/config/config.go b/internal/config/config.go index c9e0bc484..82d3b72d3 100644 --- a/internal/config/config.go +++ b/internal/config/config.go @@ -35,11 +35,11 @@ var ( initConf sync.Once defaultEnvs = map[string]string{ - "VM_METRICS_VERSION": "v1.146.0", + "VM_METRICS_VERSION": "v1.147.0", "VM_LOGS_VERSION": "v1.51.0", - "VM_ANOMALY_VERSION": "v1.29.6", - "VM_TRACES_VERSION": "v0.9.3", - "VM_OPERATOR_VERSION": getVersion("v0.68.3"), + "VM_ANOMALY_VERSION": "v1.29.7", + "VM_TRACES_VERSION": "v0.9.4", + "VM_OPERATOR_VERSION": getVersion("v0.68.6"), } ) diff --git a/internal/controller/operator/factory/finalize/vmagent.go b/internal/controller/operator/factory/finalize/vmagent.go index 5ab44cea9..fd18e6b63 100644 --- a/internal/controller/operator/factory/finalize/vmagent.go +++ b/internal/controller/operator/factory/finalize/vmagent.go @@ -27,7 +27,8 @@ func OnVMAgentDelete(ctx context.Context, rclient client.Client, cr *vmv1beta1.V return err } ns := cr.GetNamespace() - if config.IsClusterWideAccessAllowed() { + cfg := config.MustGetBaseConfig() + if len(cfg.WatchNamespaces) == 0 { objMeta := metav1.ObjectMeta{ Name: cr.GetRBACName(), } @@ -64,14 +65,6 @@ func OnVMAgentDelete(ctx context.Context, rclient client.Client, cr *vmv1beta1.V Name: build.ResourceName(build.StreamAggrConfigResourceKind, cr), Namespace: ns, }}, - &rbacv1.Role{ObjectMeta: metav1.ObjectMeta{ - Name: cr.GetRBACName(), - Namespace: ns, - }}, - &rbacv1.RoleBinding{ObjectMeta: metav1.ObjectMeta{ - Name: cr.GetRBACName(), - Namespace: ns, - }}, } if cr.Spec.ServiceSpec != nil { objsToRemove = append(objsToRemove, &corev1.Service{ObjectMeta: metav1.ObjectMeta{ @@ -93,6 +86,16 @@ func OnVMAgentDelete(ctx context.Context, rclient client.Client, cr *vmv1beta1.V }}) } } + namespaces := cfg.WatchNamespaces + if len(namespaces) == 0 { + namespaces = []string{cr.Namespace} + } + for _, watchedNS := range namespaces { + objsToRemove = append(objsToRemove, + &rbacv1.Role{ObjectMeta: metav1.ObjectMeta{Name: cr.GetRBACName(), Namespace: watchedNS}}, + &rbacv1.RoleBinding{ObjectMeta: metav1.ObjectMeta{Name: cr.GetRBACName(), Namespace: watchedNS}}, + ) + } objsToRemove = append(objsToRemove, cr) deleteOwnerReferences := make([]bool, len(objsToRemove)) return removeFinalizers(ctx, rclient, objsToRemove, deleteOwnerReferences, cr) diff --git a/internal/controller/operator/factory/finalize/vmsingle.go b/internal/controller/operator/factory/finalize/vmsingle.go index 041bad8f8..24b9adf20 100644 --- a/internal/controller/operator/factory/finalize/vmsingle.go +++ b/internal/controller/operator/factory/finalize/vmsingle.go @@ -5,16 +5,31 @@ import ( appsv1 "k8s.io/api/apps/v1" corev1 "k8s.io/api/core/v1" + rbacv1 "k8s.io/api/rbac/v1" metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" "sigs.k8s.io/controller-runtime/pkg/client" vmv1beta1 "github.com/VictoriaMetrics/operator/api/operator/v1beta1" + "github.com/VictoriaMetrics/operator/internal/config" "github.com/VictoriaMetrics/operator/internal/controller/operator/factory/build" ) // OnVMSingleDelete deletes all vmsingle related resources func OnVMSingleDelete(ctx context.Context, rclient client.Client, cr *vmv1beta1.VMSingle) error { ns := cr.GetNamespace() + cfg := config.MustGetBaseConfig() + if len(cfg.WatchNamespaces) == 0 { + objMeta := metav1.ObjectMeta{ + Name: cr.GetRBACName(), + } + objsToRemove := []client.Object{ + &rbacv1.ClusterRoleBinding{ObjectMeta: objMeta}, + &rbacv1.ClusterRole{ObjectMeta: objMeta}, + } + if err := SafeDeleteWithFinalizer(ctx, rclient, objsToRemove, cr); err != nil { + return err + } + } objMeta := metav1.ObjectMeta{ Namespace: ns, Name: cr.PrefixedName(), @@ -40,6 +55,16 @@ func OnVMSingleDelete(ctx context.Context, rclient client.Client, cr *vmv1beta1. Namespace: ns, }}, } + namespaces := cfg.WatchNamespaces + if len(namespaces) == 0 { + namespaces = []string{cr.Namespace} + } + for _, watchedNS := range namespaces { + objsToRemove = append(objsToRemove, + &rbacv1.Role{ObjectMeta: metav1.ObjectMeta{Name: cr.GetRBACName(), Namespace: watchedNS}}, + &rbacv1.RoleBinding{ObjectMeta: metav1.ObjectMeta{Name: cr.GetRBACName(), Namespace: watchedNS}}, + ) + } if cr.Spec.ServiceSpec != nil { objsToRemove = append(objsToRemove, &corev1.Service{ObjectMeta: metav1.ObjectMeta{ Name: cr.Spec.ServiceSpec.NameOrDefault(cr.PrefixedName()), diff --git a/internal/controller/operator/factory/reconcile/diff.go b/internal/controller/operator/factory/reconcile/diff.go index b77db2096..efa5461a8 100644 --- a/internal/controller/operator/factory/reconcile/diff.go +++ b/internal/controller/operator/factory/reconcile/diff.go @@ -58,7 +58,7 @@ func (r *fieldDiffRecorder) Report(rs cmp.Result) { name := v.Name() if i > 0 { parentType := r.path[i-1].Type() - if parentType.Kind() == reflect.Ptr { + if parentType.Kind() == reflect.Pointer { parentType = parentType.Elem() } if parentType.Kind() == reflect.Struct { @@ -104,7 +104,7 @@ func (r *fieldDiffRecorder) Report(rs cmp.Result) { func toInterface(v reflect.Value) any { if v.IsValid() && v.CanInterface() { switch v.Kind() { - case reflect.Ptr, reflect.Interface, reflect.Map, reflect.Slice: + case reflect.Pointer, reflect.Interface, reflect.Map, reflect.Slice: if v.IsNil() { return nil } diff --git a/internal/controller/operator/factory/vlagent/rbac.go b/internal/controller/operator/factory/vlagent/rbac.go index 9917c54b1..b8f171720 100644 --- a/internal/controller/operator/factory/vlagent/rbac.go +++ b/internal/controller/operator/factory/vlagent/rbac.go @@ -14,22 +14,6 @@ import ( "github.com/VictoriaMetrics/operator/internal/controller/operator/factory/reconcile" ) -var ( - policyRules = []rbacv1.PolicyRule{{ - APIGroups: []string{""}, - Verbs: []string{ - "get", - "list", - "watch", - }, - Resources: []string{ - "pods", - "namespaces", - "nodes", - }, - }} -) - // createK8sAPIAccess - creates RBAC access rules for vlagent func createK8sAPIAccess(ctx context.Context, rclient client.Client, cr, prevCR *vmv1.VLAgent) error { if !config.IsClusterWideAccessAllowed() { @@ -88,6 +72,10 @@ func buildCR(cr *vmv1.VLAgent) *rbacv1.ClusterRole { Labels: cr.FinalLabels(), Annotations: cr.FinalAnnotations(), }, - Rules: policyRules, + Rules: []rbacv1.PolicyRule{{ + APIGroups: []string{""}, + Verbs: []string{"get", "list", "watch"}, + Resources: []string{"nodes", "pods", "namespaces"}, + }}, } } diff --git a/internal/controller/operator/factory/vlagent/rbac_test.go b/internal/controller/operator/factory/vlagent/rbac_test.go index 903d499c9..522a4f443 100644 --- a/internal/controller/operator/factory/vlagent/rbac_test.go +++ b/internal/controller/operator/factory/vlagent/rbac_test.go @@ -9,6 +9,7 @@ import ( rbacv1 "k8s.io/api/rbac/v1" metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" "k8s.io/apimachinery/pkg/runtime" + "k8s.io/apimachinery/pkg/types" vmv1 "github.com/VictoriaMetrics/operator/api/operator/v1" "github.com/VictoriaMetrics/operator/internal/controller/operator/factory/k8stools" @@ -75,4 +76,29 @@ func TestCreateVLAgentClusterAccess(t *testing.T) { }, }, }) + + checkRules := func(cr *vmv1.VLAgent, wantNodes bool) { + t.Helper() + fclient := k8stools.GetTestClientWithObjects(nil) + assert.NoError(t, createK8sAPIAccess(context.TODO(), fclient, cr, nil)) + var got rbacv1.ClusterRole + assert.NoError(t, fclient.Get(context.TODO(), types.NamespacedName{Name: cr.GetRBACName()}, &got)) + hasNodes := false + for _, rule := range got.Rules { + for _, res := range rule.Resources { + if res == "nodes" { + hasNodes = true + } + } + } + assert.Equal(t, wantNodes, hasNodes, "unexpected nodes permission in ClusterRole rules") + } + + // nodes permission is always present when k8sCollector is enabled + checkRules(&vmv1.VLAgent{ + ObjectMeta: metav1.ObjectMeta{Namespace: "default", Name: "default-config"}, + Spec: vmv1.VLAgentSpec{ + K8sCollector: vmv1.VLAgentK8sCollector{Enabled: true}, + }, + }, true) } diff --git a/internal/controller/operator/factory/vmagent/rbac.go b/internal/controller/operator/factory/vmagent/rbac.go index 983590392..20039cf32 100644 --- a/internal/controller/operator/factory/vmagent/rbac.go +++ b/internal/controller/operator/factory/vmagent/rbac.go @@ -13,96 +13,108 @@ import ( "github.com/VictoriaMetrics/operator/internal/controller/operator/factory/reconcile" ) -func getSingleNamespaceRules(cr *vmv1beta1.VMAgent) []rbacv1.PolicyRule { - var rules []rbacv1.PolicyRule - if !ptr.Deref(cr.Spec.IngestOnlyMode, false) || cr.HasAnyRelabellingConfigs() || cr.HasAnyStreamAggrRule() { - rules = append(rules, rbacv1.PolicyRule{ +// getScrapeDiscoveryRules returns the K8s service-discovery rules needed in every watched namespace. +func getScrapeDiscoveryRules() []rbacv1.PolicyRule { + return []rbacv1.PolicyRule{ + { + APIGroups: []string{"discovery.k8s.io"}, + Verbs: []string{"get", "list", "watch"}, + Resources: []string{"endpointslices"}, + }, + { APIGroups: []string{""}, Verbs: []string{"get", "list", "watch"}, - Resources: []string{"configmaps", "secrets"}, - }) + Resources: []string{"services", "endpoints", "pods"}, + }, + { + APIGroups: []string{"networking.k8s.io", "extensions"}, + Verbs: []string{"get", "list", "watch"}, + Resources: []string{"ingresses"}, + }, } - if !ptr.Deref(cr.Spec.IngestOnlyMode, false) { - rules = append(rules, []rbacv1.PolicyRule{ - { - APIGroups: []string{"discovery.k8s.io"}, - Verbs: []string{"get", "list", "watch"}, - Resources: []string{"endpointslices"}, - }, - { - APIGroups: []string{""}, - Verbs: []string{"get", "list", "watch"}, - Resources: []string{"services", "endpoints", "pods"}, - }, - { - APIGroups: []string{"networking.k8s.io", "extensions"}, - Verbs: []string{"get", "list", "watch"}, - Resources: []string{"ingresses"}, - }, - }...) +} + +// getSingleNamespaceRules returns rules for the Role that lives in cr's own namespace. +// It includes a scoped secrets rule for the config-reloader plus the SD discovery rules. +func getSingleNamespaceRules(cr *vmv1beta1.VMAgent) []rbacv1.PolicyRule { + ingestOnly := ptr.Deref(cr.Spec.IngestOnlyMode, false) + if ingestOnly && !hasRemoteWriteSecrets(cr) { + return nil + } + secretsRule := rbacv1.PolicyRule{ + APIGroups: []string{""}, + Verbs: []string{"get", "watch", "list"}, + Resources: []string{"secrets"}, + ResourceNames: []string{cr.PrefixedName()}, + } + if ingestOnly { + return []rbacv1.PolicyRule{secretsRule} } - return rules + return append([]rbacv1.PolicyRule{secretsRule}, getScrapeDiscoveryRules()...) } func getClusterWideRules(cr *vmv1beta1.VMAgent) []rbacv1.PolicyRule { - var rules []rbacv1.PolicyRule - if !ptr.Deref(cr.Spec.IngestOnlyMode, false) || cr.HasAnyRelabellingConfigs() || cr.HasAnyStreamAggrRule() { - rules = append(rules, rbacv1.PolicyRule{ + if ptr.Deref(cr.Spec.IngestOnlyMode, false) { + return nil + } + return []rbacv1.PolicyRule{ + { + APIGroups: []string{"discovery.k8s.io"}, + Verbs: []string{"get", "list", "watch"}, + Resources: []string{"endpointslices"}, + }, + { APIGroups: []string{""}, Verbs: []string{"get", "list", "watch"}, - Resources: []string{"configmaps", "secrets"}, - }) - } - if !ptr.Deref(cr.Spec.IngestOnlyMode, false) { - rules = append(rules, []rbacv1.PolicyRule{ - { - APIGroups: []string{"discovery.k8s.io"}, - Verbs: []string{"get", "list", "watch"}, - Resources: []string{"endpointslices"}, - }, - { - APIGroups: []string{""}, - Verbs: []string{"get", "list", "watch"}, - Resources: []string{"nodes", "nodes/metrics", "services", "endpoints", "pods", "namespaces"}, - }, - { - APIGroups: []string{"networking.k8s.io", "extensions"}, - Verbs: []string{"get", "list", "watch"}, - Resources: []string{"ingresses"}, - }, - { - NonResourceURLs: []string{"/metrics", "/metrics/resources", "/metrics/slis"}, - Verbs: []string{"get", "list", "watch"}, - }, - { - APIGroups: []string{"route.openshift.io", "image.openshift.io"}, - Verbs: []string{"get"}, - Resources: []string{"routers/metrics", "registry/metrics"}, - }, - }...) + Resources: []string{"nodes", "nodes/metrics", "services", "endpoints", "pods", "namespaces"}, + }, + { + APIGroups: []string{"networking.k8s.io", "extensions"}, + Verbs: []string{"get", "list", "watch"}, + Resources: []string{"ingresses"}, + }, + { + NonResourceURLs: []string{"/metrics", "/metrics/resources", "/metrics/slis"}, + Verbs: []string{"get"}, + }, + { + APIGroups: []string{"route.openshift.io", "image.openshift.io"}, + Verbs: []string{"get"}, + Resources: []string{"routers/metrics", "registry/metrics"}, + }, } - return rules } -// createK8sAPIAccess - creates RBAC access rules for vmagent -func createK8sAPIAccess(ctx context.Context, rclient client.Client, cr, prevCR *vmv1beta1.VMAgent, clusterWide bool) error { - if clusterWide { +// createK8sAPIAccess creates RBAC access rules for vmagent. +// namespaces is the list of watched namespaces; an empty slice means cluster-wide access. +func createK8sAPIAccess(ctx context.Context, rclient client.Client, cr, prevCR *vmv1beta1.VMAgent, namespaces []string) error { + if len(namespaces) == 0 { if err := ensureCRExist(ctx, rclient, cr, prevCR); err != nil { return fmt.Errorf("cannot ensure state of vmagent's cluster role: %w", err) } if err := ensureCRBExist(ctx, rclient, cr, prevCR); err != nil { return fmt.Errorf("cannot ensure state of vmagent's cluster role binding: %w", err) } + + // Secrets access must be namespace-scoped even in cluster-wide mode to prevent + // reading credentials from namespaces other than the vmagent's own namespace. + if err := ensureRoleExist(ctx, rclient, cr, prevCR, cr.Namespace); err != nil { + return fmt.Errorf("cannot ensure state of vmagent's role: %w", err) + } + if err := ensureRBExist(ctx, rclient, cr, prevCR, cr.Namespace); err != nil { + return fmt.Errorf("cannot ensure state of vmagent's role binding: %w", err) + } return nil } - if err := ensureRoleExist(ctx, rclient, cr, prevCR); err != nil { - return fmt.Errorf("cannot ensure state of vmagent's cluster role: %w", err) - } - if err := ensureRBExist(ctx, rclient, cr, prevCR); err != nil { - return fmt.Errorf("cannot ensure state of vmagent's role binding: %w", err) + for _, ns := range namespaces { + if err := ensureRoleExist(ctx, rclient, cr, prevCR, ns); err != nil { + return fmt.Errorf("cannot ensure state of vmagent's role for namespace %s: %w", ns, err) + } + if err := ensureRBExist(ctx, rclient, cr, prevCR, ns); err != nil { + return fmt.Errorf("cannot ensure state of vmagent's role binding for namespace %s: %w", ns, err) + } } - return nil } @@ -155,47 +167,66 @@ func buildCR(cr *vmv1beta1.VMAgent) *rbacv1.ClusterRole { } } -func ensureRoleExist(ctx context.Context, rclient client.Client, cr, prevCR *vmv1beta1.VMAgent) error { - nr := buildRole(cr) +func ensureRoleExist(ctx context.Context, rclient client.Client, cr, prevCR *vmv1beta1.VMAgent, ns string) error { + nr := buildRole(cr, ns) var prevRole *rbacv1.Role if prevCR != nil { - prevRole = buildRole(prevCR) + prevRole = buildRole(prevCR, ns) + } + var owner *metav1.OwnerReference + if ns == cr.Namespace { + o := cr.AsOwner() + owner = &o } - owner := cr.AsOwner() - return reconcile.Role(ctx, rclient, nr, prevRole, &owner) + return reconcile.Role(ctx, rclient, nr, prevRole, owner) } -func ensureRBExist(ctx context.Context, rclient client.Client, cr, prevCR *vmv1beta1.VMAgent) error { - rb := buildRB(cr) +func ensureRBExist(ctx context.Context, rclient client.Client, cr, prevCR *vmv1beta1.VMAgent, ns string) error { + rb := buildRB(cr, ns) var prevRB *rbacv1.RoleBinding if prevCR != nil { - prevRB = buildRB(prevCR) + prevRB = buildRB(prevCR, ns) } - owner := cr.AsOwner() - return reconcile.RoleBinding(ctx, rclient, rb, prevRB, &owner) + var owner *metav1.OwnerReference + if ns == cr.Namespace { + o := cr.AsOwner() + owner = &o + } + return reconcile.RoleBinding(ctx, rclient, rb, prevRB, owner) } -func buildRole(cr *vmv1beta1.VMAgent) *rbacv1.Role { - return &rbacv1.Role{ +// buildRole builds the Role for ns. +// In cr's own namespace: includes the scoped secrets rule (for config-reloader) plus SD rules, +// with an owner reference so K8s GC cleans it up. +// In any other watched namespace: SD rules only, no owner reference. +func buildRole(cr *vmv1beta1.VMAgent, ns string) *rbacv1.Role { + r := &rbacv1.Role{ ObjectMeta: metav1.ObjectMeta{ - Name: cr.GetRBACName(), - Namespace: cr.GetNamespace(), - Labels: cr.FinalLabels(), - Annotations: cr.FinalAnnotations(), - OwnerReferences: []metav1.OwnerReference{cr.AsOwner()}, + Name: cr.GetRBACName(), + Namespace: ns, + Labels: cr.FinalLabels(), + Annotations: cr.FinalAnnotations(), }, - Rules: getSingleNamespaceRules(cr), } + if ns == cr.Namespace { + r.OwnerReferences = []metav1.OwnerReference{cr.AsOwner()} + r.Rules = getSingleNamespaceRules(cr) + } else if !ptr.Deref(cr.Spec.IngestOnlyMode, false) { + r.Rules = getScrapeDiscoveryRules() + } + return r } -func buildRB(cr *vmv1beta1.VMAgent) *rbacv1.RoleBinding { - return &rbacv1.RoleBinding{ +// buildRB builds the RoleBinding for ns. +// The subject always points to the vmagent service account in cr.Namespace. +// An owner reference is set only in cr's own namespace. +func buildRB(cr *vmv1beta1.VMAgent, ns string) *rbacv1.RoleBinding { + rb := &rbacv1.RoleBinding{ ObjectMeta: metav1.ObjectMeta{ - Name: cr.GetRBACName(), - Namespace: cr.GetNamespace(), - Labels: cr.FinalLabels(), - Annotations: cr.FinalAnnotations(), - OwnerReferences: []metav1.OwnerReference{cr.AsOwner()}, + Name: cr.GetRBACName(), + Namespace: ns, + Labels: cr.FinalLabels(), + Annotations: cr.FinalAnnotations(), }, Subjects: []rbacv1.Subject{ { @@ -210,4 +241,8 @@ func buildRB(cr *vmv1beta1.VMAgent) *rbacv1.RoleBinding { Kind: "Role", }, } + if ns == cr.Namespace { + rb.OwnerReferences = []metav1.OwnerReference{cr.AsOwner()} + } + return rb } diff --git a/internal/controller/operator/factory/vmagent/rbac_test.go b/internal/controller/operator/factory/vmagent/rbac_test.go index 1e550d184..0193e6067 100644 --- a/internal/controller/operator/factory/vmagent/rbac_test.go +++ b/internal/controller/operator/factory/vmagent/rbac_test.go @@ -21,20 +21,21 @@ func TestCreateVMAgentRBAC(t *testing.T) { type opts struct { cr *vmv1beta1.VMAgent validate func(ctx context.Context, rclient client.Client, cr *vmv1beta1.VMAgent) - clusterWide bool + namespaces []string predefinedObjects []runtime.Object } f := func(o opts) { t.Helper() fclient := k8stools.GetTestClientWithObjects(o.predefinedObjects) ctx := context.TODO() - assert.NoError(t, createK8sAPIAccess(ctx, fclient, o.cr, nil, o.clusterWide)) + assert.NoError(t, createK8sAPIAccess(ctx, fclient, o.cr, nil, o.namespaces)) if o.validate != nil { o.validate(ctx, fclient, o.cr) } } - // create default cluster-wide rbac + // create default cluster-wide rbac: ClusterRole has SD rules only (no secrets); + // a namespace-scoped Role in cr.Namespace carries the secrets rule. f(opts{ cr: &vmv1beta1.VMAgent{ ObjectMeta: metav1.ObjectMeta{ @@ -43,18 +44,23 @@ func TestCreateVMAgentRBAC(t *testing.T) { }, Spec: vmv1beta1.VMAgentSpec{}, }, - clusterWide: true, + namespaces: nil, validate: func(ctx context.Context, rclient client.Client, cr *vmv1beta1.VMAgent) { - var got rbacv1.ClusterRole - nsn := types.NamespacedName{ - Name: cr.GetRBACName(), + var cr1 rbacv1.ClusterRole + assert.NoError(t, rclient.Get(ctx, types.NamespacedName{Name: cr.GetRBACName()}, &cr1)) + assert.Len(t, cr1.Rules, 5) + for _, rule := range cr1.Rules { + for _, res := range rule.Resources { + assert.NotEqual(t, "secrets", res, "ClusterRole must not include secrets") + } } - assert.NoError(t, rclient.Get(ctx, nsn, &got)) - assert.Len(t, got.Rules, 6) + var role rbacv1.Role + assert.NoError(t, rclient.Get(ctx, types.NamespacedName{Name: cr.GetRBACName(), Namespace: cr.Namespace}, &role)) + assert.Len(t, role.Rules, 4) }, }) - // create namespaced rbac + // create namespaced rbac (single watched namespace == cr.Namespace) f(opts{ cr: &vmv1beta1.VMAgent{ ObjectMeta: metav1.ObjectMeta{ @@ -63,7 +69,7 @@ func TestCreateVMAgentRBAC(t *testing.T) { }, Spec: vmv1beta1.VMAgentSpec{}, }, - clusterWide: false, + namespaces: []string{"default"}, validate: func(ctx context.Context, rclient client.Client, cr *vmv1beta1.VMAgent) { var got rbacv1.Role nsn := types.NamespacedName{ @@ -75,7 +81,34 @@ func TestCreateVMAgentRBAC(t *testing.T) { }, }) - // create cluster-wide rbac for relabeling + // multi-namespace: primary namespace gets secrets+SD rules; other namespace gets SD rules only + f(opts{ + cr: &vmv1beta1.VMAgent{ + ObjectMeta: metav1.ObjectMeta{ + Namespace: "default", + Name: "rbac-test", + }, + Spec: vmv1beta1.VMAgentSpec{}, + }, + namespaces: []string{"default", "other-ns"}, + validate: func(ctx context.Context, rclient client.Client, cr *vmv1beta1.VMAgent) { + var primary rbacv1.Role + assert.NoError(t, rclient.Get(ctx, types.NamespacedName{Name: cr.GetRBACName(), Namespace: "default"}, &primary)) + assert.Len(t, primary.Rules, 4) + + var other rbacv1.Role + assert.NoError(t, rclient.Get(ctx, types.NamespacedName{Name: cr.GetRBACName(), Namespace: "other-ns"}, &other)) + assert.Len(t, other.Rules, 3) + for _, rule := range other.Rules { + assert.Empty(t, rule.ResourceNames, "other-ns role must not restrict by resourceNames") + for _, res := range rule.Resources { + assert.NotEqual(t, "secrets", res, "other-ns role must not include secrets") + } + } + }, + }) + + // cluster-wide rbac for ingest-only with relabeling: no K8s SD → no rules f(opts{ cr: &vmv1beta1.VMAgent{ ObjectMeta: metav1.ObjectMeta{ @@ -96,18 +129,18 @@ func TestCreateVMAgentRBAC(t *testing.T) { }, }, }, - clusterWide: true, + namespaces: nil, validate: func(ctx context.Context, rclient client.Client, cr *vmv1beta1.VMAgent) { var got rbacv1.ClusterRole nsn := types.NamespacedName{ Name: cr.GetRBACName(), } assert.NoError(t, rclient.Get(ctx, nsn, &got)) - assert.Len(t, got.Rules, 1) + assert.Empty(t, got.Rules) }, }) - // create namespaced rbac for relabeling + // namespaced rbac for ingest-only with relabeling: no K8s SD → no rules f(opts{ cr: &vmv1beta1.VMAgent{ ObjectMeta: metav1.ObjectMeta{ @@ -128,7 +161,7 @@ func TestCreateVMAgentRBAC(t *testing.T) { }, }, }, - clusterWide: false, + namespaces: []string{"default"}, validate: func(ctx context.Context, rclient client.Client, cr *vmv1beta1.VMAgent) { var got rbacv1.Role nsn := types.NamespacedName{ @@ -136,7 +169,7 @@ func TestCreateVMAgentRBAC(t *testing.T) { Namespace: cr.Namespace, } assert.NoError(t, rclient.Get(ctx, nsn, &got)) - assert.Len(t, got.Rules, 1) + assert.Empty(t, got.Rules) }, }) @@ -153,7 +186,7 @@ func TestCreateVMAgentRBAC(t *testing.T) { }, }, }, - clusterWide: true, + namespaces: nil, validate: func(ctx context.Context, rclient client.Client, cr *vmv1beta1.VMAgent) { var got rbacv1.ClusterRole nsn := types.NamespacedName{ @@ -164,7 +197,7 @@ func TestCreateVMAgentRBAC(t *testing.T) { }, }) - // no namespaced rbac + // namespaced rbac for ingest-only: no rules f(opts{ cr: &vmv1beta1.VMAgent{ ObjectMeta: metav1.ObjectMeta{ @@ -177,7 +210,7 @@ func TestCreateVMAgentRBAC(t *testing.T) { }, }, }, - clusterWide: false, + namespaces: []string{"default"}, validate: func(ctx context.Context, rclient client.Client, cr *vmv1beta1.VMAgent) { var got rbacv1.Role nsn := types.NamespacedName{ @@ -189,6 +222,77 @@ func TestCreateVMAgentRBAC(t *testing.T) { }, }) + // cluster-wide ingest-only with bearer token secret: Role in cr.Namespace has secrets rule only + f(opts{ + cr: &vmv1beta1.VMAgent{ + ObjectMeta: metav1.ObjectMeta{ + Namespace: "default", + Name: "rbac-test", + }, + Spec: vmv1beta1.VMAgentSpec{ + RemoteWrite: []vmv1beta1.VMAgentRemoteWriteSpec{{ + URL: "http://remote:8428", + BearerTokenSecret: &corev1.SecretKeySelector{ + LocalObjectReference: corev1.LocalObjectReference{Name: "my-token"}, + Key: "token", + }, + }}, + CommonScrapeParams: vmv1beta1.CommonScrapeParams{ + IngestOnlyMode: ptr.To(true), + }, + }, + }, + namespaces: nil, + validate: func(ctx context.Context, rclient client.Client, cr *vmv1beta1.VMAgent) { + var clusterRole rbacv1.ClusterRole + assert.NoError(t, rclient.Get(ctx, types.NamespacedName{Name: cr.GetRBACName()}, &clusterRole)) + assert.Empty(t, clusterRole.Rules, "ClusterRole must have no rules in ingest-only mode") + + var role rbacv1.Role + assert.NoError(t, rclient.Get(ctx, types.NamespacedName{Name: cr.GetRBACName(), Namespace: cr.Namespace}, &role)) + assert.Len(t, role.Rules, 1, "Role must have secrets rule only") + assert.Equal(t, []string{"secrets"}, role.Rules[0].Resources) + assert.Equal(t, []string{cr.PrefixedName()}, role.Rules[0].ResourceNames) + }, + }) + + // namespaced ingest-only with basic auth secret: Role has secrets rule only (no SD rules) + f(opts{ + cr: &vmv1beta1.VMAgent{ + ObjectMeta: metav1.ObjectMeta{ + Namespace: "default", + Name: "rbac-test", + }, + Spec: vmv1beta1.VMAgentSpec{ + RemoteWrite: []vmv1beta1.VMAgentRemoteWriteSpec{{ + URL: "http://remote:8428", + BasicAuth: &vmv1beta1.BasicAuth{ + Password: corev1.SecretKeySelector{ + LocalObjectReference: corev1.LocalObjectReference{Name: "my-secret"}, + Key: "password", + }, + }, + }}, + CommonScrapeParams: vmv1beta1.CommonScrapeParams{ + IngestOnlyMode: ptr.To(true), + }, + }, + }, + namespaces: []string{"default"}, + validate: func(ctx context.Context, rclient client.Client, cr *vmv1beta1.VMAgent) { + var role rbacv1.Role + assert.NoError(t, rclient.Get(ctx, types.NamespacedName{Name: cr.GetRBACName(), Namespace: cr.Namespace}, &role)) + assert.Len(t, role.Rules, 1, "Role must have secrets rule only") + assert.Equal(t, []string{"secrets"}, role.Rules[0].Resources) + assert.Equal(t, []string{cr.PrefixedName()}, role.Rules[0].ResourceNames) + for _, rule := range role.Rules { + for _, res := range rule.Resources { + assert.NotEqual(t, "services", res, "ingest-only role must not include SD resources") + } + } + }, + }) + // ok with exist rbac f(opts{ cr: &vmv1beta1.VMAgent{ diff --git a/internal/controller/operator/factory/vmagent/vmagent.go b/internal/controller/operator/factory/vmagent/vmagent.go index 4f01e2c8e..4796d95c3 100644 --- a/internal/controller/operator/factory/vmagent/vmagent.go +++ b/internal/controller/operator/factory/vmagent/vmagent.go @@ -127,6 +127,7 @@ func CreateOrUpdate(ctx context.Context, cr *vmv1beta1.VMAgent, rclient client.C } } owner := cr.AsOwner() + cfg := config.MustGetBaseConfig() if cr.IsOwnsServiceAccount() { var prevSA *corev1.ServiceAccount if prevCR != nil { @@ -135,8 +136,8 @@ func CreateOrUpdate(ctx context.Context, cr *vmv1beta1.VMAgent, rclient client.C if err := reconcile.ServiceAccount(ctx, rclient, build.ServiceAccount(cr), prevSA, &owner); err != nil { return fmt.Errorf("failed create service account: %w", err) } - if !ptr.Deref(cr.Spec.IngestOnlyMode, false) || cr.HasAnyRelabellingConfigs() || cr.HasAnyStreamAggrRule() { - if err := createK8sAPIAccess(ctx, rclient, cr, prevCR, config.IsClusterWideAccessAllowed()); err != nil { + if !ptr.Deref(cr.Spec.IngestOnlyMode, false) || hasRemoteWriteSecrets(cr) { + if err := createK8sAPIAccess(ctx, rclient, cr, prevCR, cfg.WatchNamespaces); err != nil { return fmt.Errorf("cannot create vmagent role and binding for it, err: %w", err) } } @@ -893,6 +894,24 @@ func sortMap(m map[string]string) []item { return kv } +func hasRemoteWriteSecrets(cr *vmv1beta1.VMAgent) bool { + for _, rw := range cr.Spec.RemoteWrite { + if rw.BasicAuth != nil && len(rw.BasicAuth.Password.Name) > 0 { + return true + } + if rw.BearerTokenSecret != nil && rw.BearerTokenSecret.Name != "" { + return true + } + if rw.OAuth2 != nil && rw.OAuth2.ClientSecret != nil { + return true + } + if rw.TLSConfig != nil && (rw.TLSConfig.CA.Secret != nil || rw.TLSConfig.Cert.Secret != nil || rw.TLSConfig.KeySecret != nil) { + return true + } + } + return false +} + func buildRemoteWriteArgs(cr *vmv1beta1.VMAgent, ac *build.AssetsCache) ([]string, error) { maxDiskUsage := defaultMaxDiskUsage if cr.Spec.RemoteWriteSettings != nil && cr.Spec.RemoteWriteSettings.MaxDiskUsagePerURL != nil { @@ -1157,18 +1176,20 @@ func deleteOrphaned(ctx context.Context, rclient client.Client, cr *vmv1beta1.VM } if !cr.IsOwnsServiceAccount() { objsToRemove = append(objsToRemove, &corev1.ServiceAccount{ObjectMeta: objMeta}) - rbacMeta := metav1.ObjectMeta{Name: cr.GetRBACName()} - if config.IsClusterWideAccessAllowed() { + rbacName := cr.GetRBACName() + watchNamespaces := config.MustGetBaseConfig().WatchNamespaces + if len(watchNamespaces) == 0 { objsToRemove = append(objsToRemove, - &rbacv1.ClusterRoleBinding{ObjectMeta: rbacMeta}, - &rbacv1.ClusterRole{ObjectMeta: rbacMeta}, + &rbacv1.ClusterRoleBinding{ObjectMeta: metav1.ObjectMeta{Name: rbacName}}, + &rbacv1.ClusterRole{ObjectMeta: metav1.ObjectMeta{Name: rbacName}}, ) } else { - rbacMeta.Namespace = cr.Namespace - objsToRemove = append(objsToRemove, - &rbacv1.RoleBinding{ObjectMeta: rbacMeta}, - &rbacv1.Role{ObjectMeta: rbacMeta}, - ) + for _, ns := range watchNamespaces { + objsToRemove = append(objsToRemove, + &rbacv1.RoleBinding{ObjectMeta: metav1.ObjectMeta{Name: rbacName, Namespace: ns}}, + &rbacv1.Role{ObjectMeta: metav1.ObjectMeta{Name: rbacName, Namespace: ns}}, + ) + } } } return finalize.SafeDeleteWithFinalizer(ctx, rclient, objsToRemove, cr) diff --git a/internal/controller/operator/factory/vmagent/vmagent_reconcile_test.go b/internal/controller/operator/factory/vmagent/vmagent_reconcile_test.go index d54b41d41..bcd5e1e5a 100644 --- a/internal/controller/operator/factory/vmagent/vmagent_reconcile_test.go +++ b/internal/controller/operator/factory/vmagent/vmagent_reconcile_test.go @@ -26,6 +26,7 @@ func Test_CreateOrUpdate_Actions(t *testing.T) { vmagentName := types.NamespacedName{Namespace: "default", Name: "vmagent-vmagent"} clusterRoleName := types.NamespacedName{Name: "monitoring:default:vmagent-vmagent"} + roleName := types.NamespacedName{Namespace: "default", Name: "monitoring:default:vmagent-vmagent"} tlsAssetsName := types.NamespacedName{Namespace: "default", Name: "tls-assets-vmagent-vmagent"} defaultCR := &vmv1beta1.VMAgent{ @@ -118,6 +119,10 @@ func Test_CreateOrUpdate_Actions(t *testing.T) { {Verb: "Create", Kind: "ClusterRole", Resource: clusterRoleName}, {Verb: "Get", Kind: "ClusterRoleBinding", Resource: clusterRoleName}, {Verb: "Create", Kind: "ClusterRoleBinding", Resource: clusterRoleName}, + {Verb: "Get", Kind: "Role", Resource: roleName}, + {Verb: "Create", Kind: "Role", Resource: roleName}, + {Verb: "Get", Kind: "RoleBinding", Resource: roleName}, + {Verb: "Create", Kind: "RoleBinding", Resource: roleName}, {Verb: "Get", Kind: "Service", Resource: vmagentName}, {Verb: "Create", Kind: "Service", Resource: vmagentName}, {Verb: "Get", Kind: "VMServiceScrape", Resource: vmagentName}, @@ -142,6 +147,8 @@ func Test_CreateOrUpdate_Actions(t *testing.T) { {Verb: "Get", Kind: "ServiceAccount", Resource: vmagentName}, {Verb: "Get", Kind: "ClusterRole", Resource: clusterRoleName}, {Verb: "Get", Kind: "ClusterRoleBinding", Resource: clusterRoleName}, + {Verb: "Get", Kind: "Role", Resource: roleName}, + {Verb: "Get", Kind: "RoleBinding", Resource: roleName}, {Verb: "Get", Kind: "Service", Resource: vmagentName}, {Verb: "Get", Kind: "VMServiceScrape", Resource: vmagentName}, {Verb: "Get", Kind: "Secret", Resource: vmagentName}, @@ -166,6 +173,8 @@ func Test_CreateOrUpdate_Actions(t *testing.T) { {Verb: "Get", Kind: "ServiceAccount", Resource: vmagentName}, {Verb: "Get", Kind: "ClusterRole", Resource: clusterRoleName}, {Verb: "Get", Kind: "ClusterRoleBinding", Resource: clusterRoleName}, + {Verb: "Get", Kind: "Role", Resource: roleName}, + {Verb: "Get", Kind: "RoleBinding", Resource: roleName}, {Verb: "Get", Kind: "Service", Resource: vmagentName}, {Verb: "Get", Kind: "VMServiceScrape", Resource: vmagentName}, {Verb: "Get", Kind: "Secret", Resource: vmagentName}, @@ -198,6 +207,10 @@ func Test_CreateOrUpdate_Actions(t *testing.T) { {Verb: "Create", Kind: "ClusterRole", Resource: clusterRoleName}, {Verb: "Get", Kind: "ClusterRoleBinding", Resource: clusterRoleName}, {Verb: "Create", Kind: "ClusterRoleBinding", Resource: clusterRoleName}, + {Verb: "Get", Kind: "Role", Resource: roleName}, + {Verb: "Create", Kind: "Role", Resource: roleName}, + {Verb: "Get", Kind: "RoleBinding", Resource: roleName}, + {Verb: "Create", Kind: "RoleBinding", Resource: roleName}, {Verb: "Get", Kind: "Service", Resource: vmagentName}, {Verb: "Create", Kind: "Service", Resource: vmagentName}, {Verb: "Get", Kind: "VMPodScrape", Resource: vmagentName}, diff --git a/internal/controller/operator/factory/vmalertmanager/config.go b/internal/controller/operator/factory/vmalertmanager/config.go index 2abea3ea9..3a1619e15 100644 --- a/internal/controller/operator/factory/vmalertmanager/config.go +++ b/internal/controller/operator/factory/vmalertmanager/config.go @@ -755,7 +755,7 @@ func (cb *configBuilder) buildJira(jira vmv1beta1.JiraConfig) error { return nil } -func (cb *configBuilder) buildIncidentIO(rc vmv1beta1.IncidentIOConfig) error { +func (cb *configBuilder) buildIncidentIO(rc vmv1beta1.IncidentioConfig) error { var temp yaml.MapSlice if rc.HTTPConfig != nil { c, err := cb.buildHTTPConfig(rc.HTTPConfig) diff --git a/internal/controller/operator/factory/vmalertmanager/config_test.go b/internal/controller/operator/factory/vmalertmanager/config_test.go index 25fa59207..efc1d704f 100644 --- a/internal/controller/operator/factory/vmalertmanager/config_test.go +++ b/internal/controller/operator/factory/vmalertmanager/config_test.go @@ -1324,7 +1324,7 @@ templates: [] Receivers: []vmv1beta1.Receiver{ { Name: "incidentio", - IncidentIOConfigs: []vmv1beta1.IncidentIOConfig{ + IncidentIOConfigs: []vmv1beta1.IncidentioConfig{ { URL: "http://example.com/", AlertSourceToken: &corev1.SecretKeySelector{ diff --git a/internal/controller/operator/factory/vmanomaly/config/config_test.go b/internal/controller/operator/factory/vmanomaly/config/config_test.go index 2fff9f8d5..cdcd39f50 100644 --- a/internal/controller/operator/factory/vmanomaly/config/config_test.go +++ b/internal/controller/operator/factory/vmanomaly/config/config_test.go @@ -774,6 +774,407 @@ server: `, }) + // prophet model with seasonalities (plural slice, not singular pointer) + f(opts{ + cr: &vmv1.VMAnomaly{ + ObjectMeta: metav1.ObjectMeta{ + Name: "test-anomaly", + Namespace: "monitoring", + }, + Spec: vmv1.VMAnomalySpec{ + License: &vmv1beta1.License{ + Key: ptr.To("test"), + }, + ConfigRawYaml: ` +models: + prophet_model: + class: 'prophet' + queries: ['test_query'] + seasonalities: + - name: daily + period: 1 + fourier_order: 5 + - name: weekly + period: 7 + tz_seasonalities: + - name: business_hours + period: 0.5 + prior_scale: 10 +schedulers: + scheduler_1m: + class: "scheduler.periodic.PeriodicScheduler" + infer_every: 1m + fit_every: 2m + fit_window: 3h +reader: + queries: + test_query: + expr: vm_metric +writer: + datasource_url: "http://test.com" +`, + Reader: &vmv1.VMAnomalyReadersSpec{ + DatasourceURL: "http://reader.test", + SamplingPeriod: "30s", + }, + Writer: &vmv1.VMAnomalyWritersSpec{ + DatasourceURL: "http://writer.test", + }, + }, + }, + expected: ` +models: + prophet_model: + class: prophet + queries: + - test_query + seasonalities: + - name: daily + period: 1 + fourier_order: 5 + - name: weekly + period: 7 + tz_seasonalities: + - name: business_hours + period: 0.5 + prior_scale: 10 +schedulers: + scheduler_1m: + class: scheduler.periodic.PeriodicScheduler + fit_every: 2m + fit_window: 3h + infer_every: 1m +reader: + class: vm + datasource_url: http://reader.test + sampling_period: 30s + queries: + test_query: + expr: vm_metric +writer: + class: vm + datasource_url: http://writer.test +monitoring: + pull: + port: "8080" +server: + port: "8490" +`, + }) + + // prophet: tz_seasonalities as list of strings — regression test for #2356 + f(opts{ + cr: &vmv1.VMAnomaly{ + ObjectMeta: metav1.ObjectMeta{ + Name: "test-anomaly", + Namespace: "monitoring", + }, + Spec: vmv1.VMAnomalySpec{ + License: &vmv1beta1.License{Key: ptr.To("test")}, + ConfigRawYaml: ` +models: + prophet_model: + class: 'prophet' + queries: ['test_query'] + tz_aware: true + tz_seasonalities: + - dow + - hod +schedulers: + s1: + class: periodic + infer_every: 1m + fit_window: 1h +reader: + queries: + test_query: + expr: up +writer: {} +`, + Reader: &vmv1.VMAnomalyReadersSpec{ + DatasourceURL: "http://reader.test", + SamplingPeriod: "30s", + }, + Writer: &vmv1.VMAnomalyWritersSpec{ + DatasourceURL: "http://writer.test", + }, + }, + }, + expected: ` +models: + prophet_model: + class: prophet + queries: + - test_query + tz_seasonalities: + - dow + - hod + tz_aware: true +schedulers: + s1: + class: periodic + fit_window: 1h + infer_every: 1m +reader: + class: vm + datasource_url: http://reader.test + sampling_period: 30s + queries: + test_query: + expr: up +writer: + class: vm + datasource_url: http://writer.test +monitoring: + pull: + port: "8080" +server: + port: "8490" +`, + }) + + // prophet: tz_seasonalities as list of objects with optional mode/prior_scale — regression test for #2356 + f(opts{ + cr: &vmv1.VMAnomaly{ + ObjectMeta: metav1.ObjectMeta{ + Name: "test-anomaly", + Namespace: "monitoring", + }, + Spec: vmv1.VMAnomalySpec{ + License: &vmv1beta1.License{Key: ptr.To("test")}, + ConfigRawYaml: ` +models: + prophet_model: + class: 'prophet' + queries: ['test_query'] + tz_aware: true + tz_seasonalities: + - name: hod + fourier_order: 5 + mode: additive + - name: dow + fourier_order: 3 + prior_scale: 10 +schedulers: + s1: + class: periodic + infer_every: 1m + fit_window: 1h +reader: + queries: + test_query: + expr: up +writer: {} +`, + Reader: &vmv1.VMAnomalyReadersSpec{ + DatasourceURL: "http://reader.test", + SamplingPeriod: "30s", + }, + Writer: &vmv1.VMAnomalyWritersSpec{ + DatasourceURL: "http://writer.test", + }, + }, + }, + expected: ` +models: + prophet_model: + class: prophet + queries: + - test_query + tz_seasonalities: + - name: hod + fourier_order: 5 + mode: additive + - name: dow + fourier_order: 3 + prior_scale: 10 + tz_aware: true +schedulers: + s1: + class: periodic + fit_window: 1h + infer_every: 1m +reader: + class: vm + datasource_url: http://reader.test + sampling_period: 30s + queries: + test_query: + expr: up +writer: + class: vm + datasource_url: http://writer.test +monitoring: + pull: + port: "8080" +server: + port: "8490" +`, + }) + + // prophet: compression config is preserved — regression test for #2356 + f(opts{ + cr: &vmv1.VMAnomaly{ + ObjectMeta: metav1.ObjectMeta{ + Name: "test-anomaly", + Namespace: "monitoring", + }, + Spec: vmv1.VMAnomalySpec{ + License: &vmv1beta1.License{Key: ptr.To("test")}, + ConfigRawYaml: ` +models: + prophet_model: + class: 'prophet' + queries: ['test_query'] + compression: + window: 10m + agg_method: mean + adjust_boundaries: true +schedulers: + s1: + class: periodic + infer_every: 1m + fit_window: 1h +reader: + queries: + test_query: + expr: up +writer: {} +`, + Reader: &vmv1.VMAnomalyReadersSpec{ + DatasourceURL: "http://reader.test", + SamplingPeriod: "30s", + }, + Writer: &vmv1.VMAnomalyWritersSpec{ + DatasourceURL: "http://writer.test", + }, + }, + }, + expected: ` +models: + prophet_model: + class: prophet + queries: + - test_query + compression: + window: 10m + agg_method: mean + adjust_boundaries: true +schedulers: + s1: + class: periodic + fit_window: 1h + infer_every: 1m +reader: + class: vm + datasource_url: http://reader.test + sampling_period: 30s + queries: + test_query: + expr: up +writer: + class: vm + datasource_url: http://writer.test +monitoring: + pull: + port: "8080" +server: + port: "8490" +`, + }) + + // prophet: exact failing config from issue #2356 — multiple seasonalities with args and clip_predictions + f(opts{ + cr: &vmv1.VMAnomaly{ + ObjectMeta: metav1.ObjectMeta{ + Name: "test-anomaly", + Namespace: "monitoring", + }, + Spec: vmv1.VMAnomalySpec{ + License: &vmv1beta1.License{Key: ptr.To("test")}, + ConfigRawYaml: ` +models: + prophet_load_above_expected: + class: 'prophet' + queries: ['query1'] + schedulers: ['periodic_online'] + detection_direction: 'above_expected' + seasonalities: + - name: daily + period: 1 + fourier_order: 15 + - name: weekly + period: 7 + fourier_order: 5 + args: + interval_width: 0.95 + seasonality_mode: additive + clip_predictions: true +schedulers: + periodic_online: + class: periodic + infer_every: 1m + fit_every: 24h + fit_window: 30d +reader: + queries: + query1: + expr: up +writer: {} +`, + Reader: &vmv1.VMAnomalyReadersSpec{ + DatasourceURL: "http://reader.test", + SamplingPeriod: "30s", + }, + Writer: &vmv1.VMAnomalyWritersSpec{ + DatasourceURL: "http://writer.test", + }, + }, + }, + expected: ` +models: + prophet_load_above_expected: + class: prophet + queries: + - query1 + schedulers: + - periodic_online + detection_direction: above_expected + clip_predictions: true + seasonalities: + - name: daily + period: 1 + fourier_order: 15 + - name: weekly + period: 7 + fourier_order: 5 + args: + interval_width: 0.95 + seasonality_mode: additive +schedulers: + periodic_online: + class: periodic + fit_every: 24h + fit_window: 30d + infer_every: 1m +reader: + class: vm + datasource_url: http://reader.test + sampling_period: 30s + queries: + query1: + expr: up +writer: + class: vm + datasource_url: http://writer.test +monitoring: + pull: + port: "8080" +server: + port: "8490" +`, + }) + // online quantile model with scale field f(opts{ cr: &vmv1.VMAnomaly{ @@ -1197,4 +1598,72 @@ server: `, }) + // periodic scheduler with scatter_infer_jobs — regression test for #2328 + f(opts{ + cr: &vmv1.VMAnomaly{ + ObjectMeta: metav1.ObjectMeta{ + Name: "test-anomaly", + Namespace: "default", + }, + Spec: vmv1.VMAnomalySpec{ + License: &vmv1beta1.License{ + Key: ptr.To("test"), + }, + ConfigRawYaml: ` +models: + zscore: + class: zscore + queries: [q1] +schedulers: + periodic_online: + class: periodic + infer_every: 5m + scatter_infer_jobs: true + fit_every: 10000d + fit_window: 3d +reader: + queries: + q1: + expr: up +`, + Reader: &vmv1.VMAnomalyReadersSpec{ + DatasourceURL: "http://vm:8428", + SamplingPeriod: "1m", + }, + Writer: &vmv1.VMAnomalyWritersSpec{ + DatasourceURL: "http://vm:8428", + }, + }, + }, + expected: ` +models: + zscore: + class: zscore + queries: + - q1 +schedulers: + periodic_online: + class: periodic + fit_every: 10000d + fit_window: 3d + infer_every: 5m + scatter_infer_jobs: true +reader: + class: vm + datasource_url: http://vm:8428 + sampling_period: 1m + queries: + q1: + expr: up +writer: + class: vm + datasource_url: http://vm:8428 +monitoring: + pull: + port: "8080" +server: + port: "8490" +`, + }) + } diff --git a/internal/controller/operator/factory/vmanomaly/config/models.go b/internal/controller/operator/factory/vmanomaly/config/models.go index 8d49c9362..c5c53d77b 100644 --- a/internal/controller/operator/factory/vmanomaly/config/models.go +++ b/internal/controller/operator/factory/vmanomaly/config/models.go @@ -165,10 +165,10 @@ type autoTunedOptimizationParams struct { type holtWintersModel struct { commonModelParams `yaml:",inline"` - Frequency *duration `yaml:"frequency,omitempty"` - Seasonality *duration `yaml:"seasonality"` - Threshold float64 `yaml:"z_threshold,omitempty"` - Args map[string]any `yaml:"args,omitempty"` + Frequency *duration `yaml:"frequency,omitempty"` + Seasonality *duration `yaml:"seasonality"` + Threshold float64 `yaml:"z_threshold,omitempty"` + Args yaml.MapSlice `yaml:"args,omitempty"` } func (m *holtWintersModel) validate() error { @@ -178,9 +178,9 @@ func (m *holtWintersModel) validate() error { type isolationForestModel struct { commonModelParams `yaml:",inline"` // Contamination is a float (e.g. 0.01) or the string "auto"; vmanomaly accepts both. - Contamination any `yaml:"contamination,omitempty"` - SeasonalFeatures []string `yaml:"seasonal_features,omitempty"` - Args map[string]any `yaml:"args,omitempty"` + Contamination any `yaml:"contamination,omitempty"` + SeasonalFeatures []string `yaml:"seasonal_features,omitempty"` + Args yaml.MapSlice `yaml:"args,omitempty"` } func (m *isolationForestModel) validate() error { @@ -190,9 +190,9 @@ func (m *isolationForestModel) validate() error { type isolationForestMultivariateModel struct { commonModelParams `yaml:",inline"` // Contamination is a float (e.g. 0.01) or the string "auto"; vmanomaly accepts both. - Contamination any `yaml:"contamination,omitempty"` - SeasonalFeatures []string `yaml:"seasonal_features,omitempty"` - Args map[string]any `yaml:"args,omitempty"` + Contamination any `yaml:"contamination,omitempty"` + SeasonalFeatures []string `yaml:"seasonal_features,omitempty"` + Args yaml.MapSlice `yaml:"args,omitempty"` } func (m *isolationForestMultivariateModel) validate() error { @@ -269,22 +269,46 @@ func (m *zScoreModel) validate() error { type prophetModel struct { commonModelParams `yaml:",inline"` - Seasonalities *prophetModelSeasonality `yaml:"seasonality,omitempty"` - TZSeasonalities *prophetModelSeasonality `yaml:"tz_seasonality,omitempty"` - TZAware bool `yaml:"tz_aware,omitempty"` - TZUseCyclicalEncoding bool `yaml:"tz_use_cyclical_encoding,omitempty"` - Args map[string]any `yaml:"args,omitempty"` + Seasonalities []yaml.MapSlice `yaml:"seasonalities,omitempty"` + TZSeasonalities []tzSeasonality `yaml:"tz_seasonalities,omitempty"` + TZAware bool `yaml:"tz_aware,omitempty"` + TZUseCyclicalEncoding bool `yaml:"tz_use_cyclical_encoding,omitempty"` + Compression yaml.MapSlice `yaml:"compression,omitempty"` + Args yaml.MapSlice `yaml:"args,omitempty"` } func (m *prophetModel) validate() error { return nil } -type prophetModelSeasonality struct { - Name string `yaml:"name"` - Period float64 `yaml:"period"` - FourierOrder int `yaml:"fourier_order,omitempty"` - PriorScale int `yaml:"prior_scale,omitempty"` +// tzSeasonality is a single vmanomaly tz_seasonality entry, which may be either +// a plain string name (e.g. "dow") or an object with keys like name, fourier_order, +// mode, etc. Both forms are valid in vmanomaly. +type tzSeasonality struct { + val any // string or yaml.MapSlice +} + +var ( + _ yaml.Marshaler = tzSeasonality{} + _ yaml.Unmarshaler = (*tzSeasonality)(nil) +) + +func (t *tzSeasonality) UnmarshalYAML(unmarshal func(any) error) error { + var ms yaml.MapSlice + if err := unmarshal(&ms); err == nil { + t.val = ms + return nil + } + var s string + if err := unmarshal(&s); err != nil { + return err + } + t.val = s + return nil +} + +func (t tzSeasonality) MarshalYAML() (any, error) { + return t.val, nil } type rollingQuantileModel struct { diff --git a/internal/controller/operator/factory/vmanomaly/config/schedulers.go b/internal/controller/operator/factory/vmanomaly/config/schedulers.go index d2b7a5a03..314293a9e 100644 --- a/internal/controller/operator/factory/vmanomaly/config/schedulers.go +++ b/internal/controller/operator/factory/vmanomaly/config/schedulers.go @@ -89,6 +89,7 @@ type periodicScheduler struct { InferEvery *duration `yaml:"infer_every"` StartFrom time.Time `yaml:"start_from,omitempty"` Timezone string `yaml:"tz,omitempty"` + ScatterInferJobs bool `yaml:"scatter_infer_jobs,omitempty"` } func (s *periodicScheduler) validate() error { diff --git a/internal/controller/operator/factory/vmauth/vmauth_test.go b/internal/controller/operator/factory/vmauth/vmauth_test.go index c54a46c19..53c9606ba 100644 --- a/internal/controller/operator/factory/vmauth/vmauth_test.go +++ b/internal/controller/operator/factory/vmauth/vmauth_test.go @@ -561,7 +561,7 @@ volumes: emptydir: {} initcontainers: - name: config-init - image: victoriametrics/operator:config-reloader-v0.68.3 + image: victoriametrics/operator:config-reloader-v0.68.6 args: - --config-envsubst-file=/opt/vmauth/config.yaml - --config-secret-key=config.yaml.gz @@ -610,7 +610,7 @@ containers: failurethreshold: 10 terminationmessagepolicy: FallbackToLogsOnError - name: config-reloader - image: victoriametrics/operator:config-reloader-v0.68.3 + image: victoriametrics/operator:config-reloader-v0.68.6 args: - --config-envsubst-file=/opt/vmauth/config.yaml - --config-secret-key=config.yaml.gz diff --git a/internal/controller/operator/factory/vmsingle/vmsingle.go b/internal/controller/operator/factory/vmsingle/vmsingle.go index ebf5c4e2a..07d067e74 100644 --- a/internal/controller/operator/factory/vmsingle/vmsingle.go +++ b/internal/controller/operator/factory/vmsingle/vmsingle.go @@ -9,6 +9,7 @@ import ( "gopkg.in/yaml.v2" appsv1 "k8s.io/api/apps/v1" corev1 "k8s.io/api/core/v1" + rbacv1 "k8s.io/api/rbac/v1" metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" "k8s.io/apimachinery/pkg/labels" "k8s.io/apimachinery/pkg/util/intstr" @@ -453,10 +454,25 @@ func deleteOrphaned(ctx context.Context, rclient client.Client, cr *vmv1beta1.VM return fmt.Errorf("cannot remove serviceScrapes: %w", err) } + cfg := config.MustGetBaseConfig() objMeta := metav1.ObjectMeta{Name: cr.PrefixedName(), Namespace: cr.Namespace} var objsToRemove []client.Object if !cr.IsOwnsServiceAccount() { objsToRemove = append(objsToRemove, &corev1.ServiceAccount{ObjectMeta: objMeta}) + rbacName := cr.GetRBACName() + if len(cfg.WatchNamespaces) == 0 { + objsToRemove = append(objsToRemove, + &rbacv1.ClusterRoleBinding{ObjectMeta: metav1.ObjectMeta{Name: rbacName}}, + &rbacv1.ClusterRole{ObjectMeta: metav1.ObjectMeta{Name: rbacName}}, + ) + } else { + for _, ns := range cfg.WatchNamespaces { + objsToRemove = append(objsToRemove, + &rbacv1.RoleBinding{ObjectMeta: metav1.ObjectMeta{Name: rbacName, Namespace: ns}}, + &rbacv1.Role{ObjectMeta: metav1.ObjectMeta{Name: rbacName, Namespace: ns}}, + ) + } + } } return finalize.SafeDeleteWithFinalizer(ctx, rclient, objsToRemove, cr) } diff --git a/test/Makefile b/test/Makefile new file mode 100644 index 000000000..9cb0286ba --- /dev/null +++ b/test/Makefile @@ -0,0 +1,85 @@ +##@ E2E testing +# Targets here require docker, a Kind cluster, or e2e test tooling. +# Kept in a separate file so changes to e2e tool versions do not retrigger +# the full CI workflow for ordinary source-code changes. +# This file is included by the root Makefile. + +E2E_TESTS_CONCURRENCY ?= $(shell getconf _NPROCESSORS_ONLN) +E2E_TARGET ?= ./test/e2e/... + +## Tool Binaries +KIND = $(LOCALBIN)/kind-$(KIND_VERSION) +GINKGO_BIN ?= $(LOCALBIN)/ginkgo-$(GINKGO_VERSION) +CRUST_GATHER_BIN ?= $(LOCALBIN)/crust-gather-$(CRUST_GATHER_VERSION) +MIRRORD_BIN ?= $(LOCALBIN)/mirrord-$(MIRRORD_VERSION) + +## Tool Versions +KIND_VERSION ?= v0.32.0 +GINKGO_VERSION ?= v2.31.0 +CRUST_GATHER_VERSION ?= v0.15.2 +MIRRORD_VERSION ?= 3.217.1 + +MIRRORD_OS=$(if $(filter darwin,$(OS)),mac,linux) +MIRRORD_ARCH=$(if $(filter mac,$(MIRRORD_OS)),universal,$(if $(filter x86_64,$(shell uname -m 2>/dev/null)),x86_64,aarch64)) + +# Utilize Kind or modify the e2e tests to load the image locally, enabling compatibility with other vendors. +.PHONY: test-e2e # Run the e2e tests against a Kind k8s instance that is spun up. +test-e2e: load-kind ginkgo crust-gather mirrord + env CGO_ENABLED=1 OPERATOR_IMAGE=$(OPERATOR_IMAGE) CONFIG_RELOADER_IMAGE=$(CONFIG_RELOADER_IMAGE) REPORTS_DIR=$(shell pwd) CRUST_GATHER_BIN=$(CRUST_GATHER_BIN) $(MIRRORD_BIN) exec -f ./mirrord.json -- $(GINKGO_BIN) \ + -ldflags="-linkmode=external" \ + --output-interceptor-mode=none \ + -procs=$(E2E_TESTS_CONCURRENCY) \ + -randomize-all \ + -timeout=60m \ + -junit-report=report.xml $(E2E_TARGET) + +.PHONY: test-e2e-upgrade # Run only the e2e upgrade tests against a Kind k8s instance that is spun up. +test-e2e-upgrade: E2E_TARGET=./test/e2e/upgrade/... +test-e2e-upgrade: test-e2e + +# builds image and loads it into kind. +ensure-kind-cluster: kind + if [ "`$(KIND) get clusters`" != "kind" ]; then \ + $(KIND) create cluster --config=./kind.yaml; \ + else \ + $(KUBECTL) cluster-info --context kind-kind; \ + fi + +load-kind: docker-build docker-build-config-reloader ensure-kind-cluster + if [ "$(CONTAINER_TOOL)" != "podman" ]; then \ + $(KIND) load docker-image $(REGISTRY)/$(ORG)/$(REPO):$(TAG); \ + $(KIND) load docker-image $(CONFIG_RELOADER_IMAGE); \ + fi + +deploy-kind: OVERLAY=config/base-with-webhook +deploy-kind: load-kind deploy + +# deploy-kind-no-build skips docker-build/load — use when image is already loaded (e.g. from test-e2e's load-kind dep) +deploy-kind-no-build: OVERLAY=config/base-with-webhook +deploy-kind-no-build: ensure-kind-cluster deploy + +undeploy-kind: OVERLAY=config/base-with-webhook-no-crd +undeploy-kind: ensure-kind-cluster undeploy + +.PHONY: allure-report +allure-report: + @[ -d ./allure-results ] && npx allure awesome --single-file ./allure-results -o ./allure-report || echo "allure-results dir not found, skipping report generation" + +.PHONY: ginkgo +ginkgo: + $(call go-install-tool,$(GINKGO_BIN),github.com/onsi/ginkgo/v2/ginkgo,$(GINKGO_VERSION)) + +.PHONY: kind +kind: $(KIND) +$(KIND): $(LOCALBIN) + $(call go-install-tool,$(KIND),sigs.k8s.io/kind,$(KIND_VERSION)) + +.PHONY: crust-gather +crust-gather: $(CRUST_GATHER_BIN) +$(CRUST_GATHER_BIN): $(LOCALBIN) + $(call download-github-release,$(CRUST_GATHER_BIN),crust-gather/crust-gather,$(CRUST_GATHER_VERSION),kubectl-crust-gather_$(CRUST_GATHER_VERSION)_$(OS)_$(ARCH).tar.gz,kubectl-crust-gather) + +.PHONY: mirrord +mirrord: $(MIRRORD_BIN) +$(MIRRORD_BIN): $(LOCALBIN) + $(call download-github-release,$(MIRRORD_BIN),metalbear-co/mirrord,$(MIRRORD_VERSION),mirrord_$(MIRRORD_OS)_$(MIRRORD_ARCH).zip,mirrord) diff --git a/test/e2e/upgrade/upgrade_test.go b/test/e2e/upgrade/upgrade_test.go index 6a70ff7f5..9c3cc566e 100644 --- a/test/e2e/upgrade/upgrade_test.go +++ b/test/e2e/upgrade/upgrade_test.go @@ -696,6 +696,15 @@ var _ = Describe("operator upgrade", Label("upgrade"), func() { })}, {version: "v0.68.5", cr: with(vlagent)}, {version: "v0.68.5", cr: vlagentK8sCollector}, + {version: "v0.68.6", cr: with(vmagent)}, + {version: "v0.68.6", cr: with(vmagent, func(cr *vmv1beta1.VMAgent) { + cr.Spec.DaemonSetMode = true + })}, + {version: "v0.68.6", cr: with(vmagent, func(cr *vmv1beta1.VMAgent) { + cr.Spec.StatefulMode = true + })}, + {version: "v0.68.6", cr: with(vlagent)}, + {version: "v0.68.6", cr: vlagentK8sCollector}, }, }, // nolint:dupl @@ -728,6 +737,9 @@ var _ = Describe("operator upgrade", Label("upgrade"), func() { {version: "v0.68.5", cr: with(vmalert)}, {version: "v0.68.5", cr: with(vmauth)}, {version: "v0.68.5", cr: with(vmalertmanager)}, + {version: "v0.68.6", cr: with(vmalert)}, + {version: "v0.68.6", cr: with(vmauth)}, + {version: "v0.68.6", cr: with(vmalertmanager)}, }, }, // nolint:dupl @@ -758,6 +770,9 @@ var _ = Describe("operator upgrade", Label("upgrade"), func() { {version: "v0.68.5", cr: with(vmsingle)}, {version: "v0.68.5", cr: with(vtsingle)}, {version: "v0.68.5", cr: with(vlsingle)}, + {version: "v0.68.6", cr: with(vmsingle)}, + {version: "v0.68.6", cr: with(vtsingle)}, + {version: "v0.68.6", cr: with(vlsingle)}, }, }, // nolint:dupl @@ -796,6 +811,10 @@ var _ = Describe("operator upgrade", Label("upgrade"), func() { {version: "v0.68.5", cr: with(vlcluster, func(cr *vmv1.VLCluster) { cr.Spec.RequestsLoadBalancer.Enabled = true })}, + {version: "v0.68.6", cr: with(vlcluster)}, + {version: "v0.68.6", cr: with(vlcluster, func(cr *vmv1.VLCluster) { + cr.Spec.RequestsLoadBalancer.Enabled = true + })}, }, }, // nolint:dupl @@ -834,6 +853,10 @@ var _ = Describe("operator upgrade", Label("upgrade"), func() { {version: "v0.68.5", cr: with(vtcluster, func(cr *vmv1.VTCluster) { cr.Spec.RequestsLoadBalancer.Enabled = true })}, + {version: "v0.68.6", cr: with(vtcluster)}, + {version: "v0.68.6", cr: with(vtcluster, func(cr *vmv1.VTCluster) { + cr.Spec.RequestsLoadBalancer.Enabled = true + })}, }, }, // nolint:dupl @@ -848,6 +871,7 @@ var _ = Describe("operator upgrade", Label("upgrade"), func() { {version: "v0.68.3", cr: with(vmcluster)}, {version: "v0.68.4", cr: with(vmcluster)}, {version: "v0.68.5", cr: with(vmcluster)}, + {version: "v0.68.6", cr: with(vmcluster)}, }, }, // nolint:dupl @@ -969,6 +993,29 @@ var _ = Describe("operator upgrade", Label("upgrade"), func() { }, } })}, + {version: "v0.68.6", isEnterprise: true, cr: with(vmcluster, func(cr *vmv1beta1.VMCluster) { + cr.Spec.RequestsLoadBalancer.Enabled = true + cr.Spec.VMStorage.Image.Tag = "v1.136.0-enterprise-cluster" + cr.Spec.VMSelect.Image.Tag = "v1.136.0-enterprise-cluster" + cr.Spec.VMInsert.Image.Tag = "v1.136.0-enterprise-cluster" + cr.Spec.RequestsLoadBalancer.Spec.Image.Tag = "v1.136.0-enterprise" + cr.Spec.VMStorage.VMBackup = &vmv1beta1.VMBackup{ + Destination: "fs:///tmp", + DestinationDisableSuffixAdd: true, + Image: vmv1beta1.Image{ + Tag: "v1.136.0-enterprise", + }, + AcceptEULA: true, + } + cr.Spec.License = &vmv1beta1.License{ + KeyRef: &corev1.SecretKeySelector{ + LocalObjectReference: corev1.LocalObjectReference{ + Name: "license", + }, + Key: "key", + }, + } + })}, }, envs: map[string]string{ "VM_LOOPBACK": "localhost", @@ -979,6 +1026,7 @@ var _ = Describe("operator upgrade", Label("upgrade"), func() { name: "VMDistributed", pairs: []crVersionPair{ {version: "v0.68.5", cr: with(vmdistributed)}, + {version: "v0.68.6", cr: with(vmdistributed)}, }, }, })) diff --git a/test/e2e/watchnamespace/utils_test.go b/test/e2e/watchnamespace/utils_test.go index 1e2a6eb33..8281eea20 100644 --- a/test/e2e/watchnamespace/utils_test.go +++ b/test/e2e/watchnamespace/utils_test.go @@ -89,7 +89,7 @@ func ConsistentlyShouldNotHaveFinalizer(namespace string, listProtos ...client.O func GetListObjectType(list client.ObjectList) reflect.Type { objType := reflect.ValueOf(list).Elem().FieldByName("Items").Type().Elem() - if objType.Kind() == reflect.Ptr { + if objType.Kind() == reflect.Pointer { objType = objType.Elem() } @@ -104,7 +104,7 @@ func listObjectsByListProto(namespace string, listProto client.ObjectList) []cli itemsValue := reflect.ValueOf(list).Elem().FieldByName("Items") for i := 0; i < itemsValue.Len(); i++ { itemValue := itemsValue.Index(i) - if itemValue.Kind() != reflect.Ptr { + if itemValue.Kind() != reflect.Pointer { itemValue = itemValue.Addr() }