Specification of the desired behavior of the Alertmanager cluster. More info: https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#spec-and-status

Most recent observed status of the Alertmanager cluster. Read-only. More info: https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#spec-and-status

Specification of desired Pod selection for target discovery by Prometheus.

Specification of desired Ingress selection for target discovery by Prometheus.

Specification of the desired behavior of the Prometheus cluster. More info: https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#spec-and-status

Most recent observed status of the Prometheus cluster. Read-only. More info: https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#spec-and-status

Specification of desired alerting rule definitions for Prometheus.

Specification of desired Service selection for target discovery by Prometheus.

Specification of the desired behavior of the ThanosRuler cluster. More info: https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#spec-and-status

Most recent observed status of the ThanosRuler cluster. Read-only. More info: https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#spec-and-status

Kubernetes API address consisting of a hostname or IP address followed by an optional port number.

BasicAuth configuration for the API server.

Cannot be set at the same time as authorization, bearerToken, or bearerTokenFile.

File to read bearer token for accessing apiserver.

Cannot be set at the same time as basicAuth, authorization, or bearerToken.

Deprecated: this will be removed in a future release. Prefer using authorization.

TLS Config to use for the API server.

Authorization section for the API server.

Cannot be set at the same time as basicAuth, bearerToken, or bearerTokenFile.

Warning: this field shouldn’t be used because the token value appears in clear-text. Prefer using authorization.

Deprecated: this will be removed in a future release.

"OnResource"

Automatically add a label selector that will select all pods matching the same Prometheus/PrometheusAgent resource (irrespective of their shards).

"OnShard"

Automatically add a label selector that will select all pods matching the same shard.

Alertmanager endpoints where Prometheus should send alerts to.

AlertmanagerConfigMatcherStrategyType defines the strategy used by AlertmanagerConfig objects to match alerts in the routes and inhibition rules.

The default value is OnNamespace.

"None"

With None, the route and inhbition rules of an AlertmanagerConfig object process all incoming alerts.

"OnNamespace"

With OnNamespace, the route and inhibition rules of an AlertmanagerConfig object only process alerts that have a namespace label equal to the namespace of the object.

The name of the AlertmanagerConfig resource which is used to generate the Alertmanager configuration. It must be defined in the same namespace as the Alertmanager object. The operator will not enforce a namespace label for routes and inhibition rules.

Defines the global parameters of the Alertmanager configuration.

Custom notification templates.

Namespace of the Endpoints object.

If not set, the object will be discovered in the namespace of the Prometheus object.

Name of the Endpoints object in the namespace.

Port on which the Alertmanager API is exposed.

Scheme to use when firing alerts.

Prefix for the HTTP path alerts are pushed to.

TLS Config to use for Alertmanager.

BasicAuth configuration for Alertmanager.

Cannot be set at the same time as bearerTokenFile, authorization or sigv4.

File to read bearer token for Alertmanager.

Cannot be set at the same time as basicAuth, authorization, or sigv4.

Deprecated: this will be removed in a future release. Prefer using authorization.

Authorization section for Alertmanager.

Cannot be set at the same time as basicAuth, bearerTokenFile or sigv4.

Sigv4 allows to configures AWS’s Signature Verification 4 for the URL.

It requires Prometheus >= v2.48.0.

Cannot be set at the same time as basicAuth, bearerTokenFile or authorization.

Version of the Alertmanager API that Prometheus uses to send alerts. It can be “v1” or “v2”. The field has no effect for Prometheus >= v3.0.0 because only the v2 API is supported.

Timeout is a per-target Alertmanager timeout when pushing alerts.

Whether to enable HTTP2.

Relabel configuration applied to the discovered Alertmanagers.

Relabeling configs applied before sending alerts to a specific Alertmanager. It requires Prometheus >= v2.51.0.

Configures global SMTP parameters.

ResolveTimeout is the default value used by alertmanager if the alert does not include EndsAt, after this time passes it can declare the alert as resolved if it has not been updated. This has no impact on alerts from Prometheus, as they always include EndsAt.

HTTP client configuration.

The default Slack API URL.

The default OpsGenie API URL.

The default OpsGenie API Key.

The default Pagerduty URL.

PodMetadata configures labels and annotations which are propagated to the Alertmanager pods.

The following items are reserved and cannot be overridden: * “alertmanager” label, set to the name of the Alertmanager instance. * “app.kubernetes.io/instance” label, set to the name of the Alertmanager instance. * “app.kubernetes.io/managed-by” label, set to “prometheus-operator”. * “app.kubernetes.io/name” label, set to “alertmanager”. * “app.kubernetes.io/version” label, set to the Alertmanager version. * “kubectl.kubernetes.io/default-container” annotation, set to “alertmanager”.

Image if specified has precedence over baseImage, tag and sha combinations. Specifying the version is still necessary to ensure the Prometheus Operator knows what version of Alertmanager is being configured.

Image pull policy for the ‘alertmanager’, ‘init-config-reloader’ and ‘config-reloader’ containers. See https://kubernetes.io/docs/concepts/containers/images/#image-pull-policy for more details.

Version the cluster should be on.

Tag of Alertmanager container image to be deployed. Defaults to the value of version. Version is ignored if Tag is set. Deprecated: use ‘image’ instead. The image tag can be specified as part of the image URL.

SHA of Alertmanager container image to be deployed. Defaults to the value of version. Similar to a tag, but the SHA explicitly deploys an immutable container image. Version and Tag are ignored if SHA is set. Deprecated: use ‘image’ instead. The image digest can be specified as part of the image URL.

Base image that is used to deploy pods, without tag. Deprecated: use ‘image’ instead.

An optional list of references to secrets in the same namespace to use for pulling prometheus and alertmanager images from registries see http://kubernetes.io/docs/user-guide/images#specifying-imagepullsecrets-on-a-pod

Secrets is a list of Secrets in the same namespace as the Alertmanager object, which shall be mounted into the Alertmanager Pods. Each Secret is added to the StatefulSet definition as a volume named secret-<secret-name>. The Secrets are mounted into /etc/alertmanager/secrets/<secret-name> in the ‘alertmanager’ container.

ConfigMaps is a list of ConfigMaps in the same namespace as the Alertmanager object, which shall be mounted into the Alertmanager Pods. Each ConfigMap is added to the StatefulSet definition as a volume named configmap-<configmap-name>. The ConfigMaps are mounted into /etc/alertmanager/configmaps/<configmap-name> in the ‘alertmanager’ container.

ConfigSecret is the name of a Kubernetes Secret in the same namespace as the Alertmanager object, which contains the configuration for this Alertmanager instance. If empty, it defaults to alertmanager-<alertmanager-name>.

The Alertmanager configuration should be available under the alertmanager.yaml key. Additional keys from the original secret are copied to the generated secret and mounted into the /etc/alertmanager/config directory in the alertmanager container.

If either the secret or the alertmanager.yaml key is missing, the operator provisions a minimal Alertmanager configuration with one empty receiver (effectively dropping alert notifications).

Log level for Alertmanager to be configured with.

Log format for Alertmanager to be configured with.

Size is the expected size of the alertmanager cluster. The controller will eventually make the size of the running cluster equal to the expected size.

Time duration Alertmanager shall retain data for. Default is ‘120h’, and must match the regular expression [0-9]+(ms|s|m|h) (milliseconds seconds minutes hours).

Storage is the definition of how storage will be used by the Alertmanager instances.

Volumes allows configuration of additional volumes on the output StatefulSet definition. Volumes specified will be appended to other volumes that are generated as a result of StorageSpec objects.

VolumeMounts allows configuration of additional VolumeMounts on the output StatefulSet definition. VolumeMounts specified will be appended to other VolumeMounts in the alertmanager container, that are generated as a result of StorageSpec objects.

The external URL the Alertmanager instances will be available under. This is necessary to generate correct URLs. This is necessary if Alertmanager is not served from root of a DNS name.

The route prefix Alertmanager registers HTTP handlers for. This is useful, if using ExternalURL and a proxy is rewriting HTTP routes of a request, and the actual ExternalURL is still true, but the server serves requests under a different route prefix. For example for use with kubectl proxy.

If set to true all actions on the underlying managed objects are not goint to be performed, except for delete actions.

Define which Nodes the Pods are scheduled on.

Define resources requests and limits for single Pods.

If specified, the pod’s scheduling constraints.

If specified, the pod’s tolerations.

If specified, the pod’s topology spread constraints.

SecurityContext holds pod-level security attributes and common container settings. This defaults to the default PodSecurityContext.

Defines the DNS policy for the pods.

Defines the DNS configuration for the pods.

ServiceAccountName is the name of the ServiceAccount to use to run the Prometheus Pods.

ListenLocal makes the Alertmanager server listen on loopback, so that it does not bind against the Pod IP. Note this is only for the Alertmanager UI, not the gossip communication.

Containers allows injecting additional containers. This is meant to allow adding an authentication proxy to an Alertmanager pod. Containers described here modify an operator generated container if they share the same name and modifications are done via a strategic merge patch. The current container names are: alertmanager and config-reloader. Overriding containers is entirely outside the scope of what the maintainers will support and by doing so, you accept that this behaviour may break at any time without notice.

InitContainers allows adding initContainers to the pod definition. Those can be used to e.g. fetch secrets for injection into the Alertmanager configuration from external sources. Any errors during the execution of an initContainer will lead to a restart of the Pod. More info: https://kubernetes.io/docs/concepts/workloads/pods/init-containers/ InitContainers described here modify an operator generated init containers if they share the same name and modifications are done via a strategic merge patch. The current init container name is: init-config-reloader. Overriding init containers is entirely outside the scope of what the maintainers will support and by doing so, you accept that this behaviour may break at any time without notice.

Priority class assigned to the Pods

AdditionalPeers allows injecting a set of additional Alertmanagers to peer with to form a highly available cluster.

ClusterAdvertiseAddress is the explicit address to advertise in cluster. Needs to be provided for non RFC1918 1 addresses. [1] RFC1918: https://tools.ietf.org/html/rfc1918

Interval between gossip attempts.

Defines the identifier that uniquely identifies the Alertmanager cluster. You should only set it when the Alertmanager cluster includes Alertmanager instances which are external to this Alertmanager resource. In practice, the addresses of the external instances are provided via the .spec.additionalPeers field.

Interval between pushpull attempts.

Timeout for cluster peering.

Port name used for the pods and governing service. Defaults to web.

ForceEnableClusterMode ensures Alertmanager does not deactivate the cluster mode when running with a single replica. Use case is e.g. spanning an Alertmanager cluster across Kubernetes clusters with a single replica in each.

AlertmanagerConfigs to be selected for to merge and configure Alertmanager with.

Namespaces to be selected for AlertmanagerConfig discovery. If nil, only check own namespace.

AlertmanagerConfigMatcherStrategy defines how AlertmanagerConfig objects process incoming alerts.

Minimum number of seconds for which a newly created pod should be ready without any of its container crashing for it to be considered available. Defaults to 0 (pod will be considered available as soon as it is ready) This is an alpha field from kubernetes 1.22 until 1.24 which requires enabling the StatefulSetMinReadySeconds feature gate.

Pods’ hostAliases configuration

Defines the web command line flags when starting Alertmanager.

alertmanagerConfiguration specifies the configuration of Alertmanager.

If defined, it takes precedence over the configSecret field.

This is an experimental feature, it may change in any upcoming release in a breaking way.

AutomountServiceAccountToken indicates whether a service account token should be automatically mounted in the pod. If the service account has automountServiceAccountToken: true, set the field to false to opt out of automounting API credentials.

Enable access to Alertmanager feature flags. By default, no features are enabled. Enabling features which are disabled by default is entirely outside the scope of what the maintainers will support and by doing so, you accept that this behaviour may break at any time without notice.

It requires Alertmanager >= 0.27.0.

Represents whether any actions on the underlying managed objects are being performed. Only delete actions will be performed.

Total number of non-terminated pods targeted by this Alertmanager object (their labels match the selector).

Total number of non-terminated pods targeted by this Alertmanager object that have the desired version spec.

Total number of available pods (ready for at least minReadySeconds) targeted by this Alertmanager cluster.

Total number of unavailable pods targeted by this Alertmanager object.

The selector used to match the pods targeted by this Alertmanager object.

The current state of the Alertmanager object.

Defines the TLS parameters for HTTPS.

Defines HTTP parameters for web server.

Maximum number of GET requests processed concurrently. This corresponds to the Alertmanager’s --web.get-concurrency flag.

Timeout for HTTP requests. This corresponds to the Alertmanager’s --web.timeout flag.

Name of the argument, e.g. “scrape.discovery-reload-interval”.

Argument value, e.g. 30s. Can be empty for name-only arguments (e.g. –storage.tsdb.no-lockfile)

When set to true, Prometheus attaches node metadata to the discovered targets.

The Prometheus service account must have the list and watch permissions on the Nodes objects.

Defines the authentication type. The value is case-insensitive.

“Basic” is not a supported value.

Default: “Bearer”

Selects a key of a Secret in the namespace that contains the credentials for authentication.

File to read a secret from, mutually exclusive with credentials.

The Azure Cloud. Options are ‘AzurePublic’, ‘AzureChina’, or ‘AzureGovernment’.

ManagedIdentity defines the Azure User-assigned Managed identity. Cannot be set at the same time as oauth or sdk.

OAuth defines the oauth config that is being used to authenticate. Cannot be set at the same time as managedIdentity or sdk.

It requires Prometheus >= v2.48.0.

SDK defines the Azure SDK config that is being used to authenticate. See https://learn.microsoft.com/en-us/azure/developer/go/azure-sdk-authentication Cannot be set at the same time as oauth or managedIdentity.

It requires Prometheus >= 2.52.0.

clientID is the clientId of the Azure Active Directory application that is being used to authenticate.

clientSecret specifies a key of a Secret containing the client secret of the Azure Active Directory application that is being used to authenticate.

tenantId is the tenant ID of the Azure Active Directory application that is being used to authenticate.

tenantId is the tenant ID of the azure active directory application that is being used to authenticate.

username specifies a key of a Secret containing the username for authentication.

password specifies a key of a Secret containing the password for authentication.

PodMetadata configures labels and annotations which are propagated to the Prometheus pods.

The following items are reserved and cannot be overridden: * “prometheus” label, set to the name of the Prometheus object. * “app.kubernetes.io/instance” label, set to the name of the Prometheus object. * “app.kubernetes.io/managed-by” label, set to “prometheus-operator”. * “app.kubernetes.io/name” label, set to “prometheus”. * “app.kubernetes.io/version” label, set to the Prometheus version. * “operator.prometheus.io/name” label, set to the name of the Prometheus object. * “operator.prometheus.io/shard” label, set to the shard number of the Prometheus object. * “kubectl.kubernetes.io/default-container” annotation, set to “prometheus”.

ServiceMonitors to be selected for target discovery. An empty label selector matches all objects. A null label selector matches no objects.

If spec.serviceMonitorSelector, spec.podMonitorSelector, spec.probeSelector and spec.scrapeConfigSelector are null, the Prometheus configuration is unmanaged. The Prometheus operator will ensure that the Prometheus configuration’s Secret exists, but it is the responsibility of the user to provide the raw gzipped Prometheus configuration under the prometheus.yaml.gz key. This behavior is deprecated and will be removed in the next major version of the custom resource definition. It is recommended to use spec.additionalScrapeConfigs instead.

Namespaces to match for ServicedMonitors discovery. An empty label selector matches all namespaces. A null label selector (default value) matches the current namespace only.

PodMonitors to be selected for target discovery. An empty label selector matches all objects. A null label selector matches no objects.

If spec.serviceMonitorSelector, spec.podMonitorSelector, spec.probeSelector and spec.scrapeConfigSelector are null, the Prometheus configuration is unmanaged. The Prometheus operator will ensure that the Prometheus configuration’s Secret exists, but it is the responsibility of the user to provide the raw gzipped Prometheus configuration under the prometheus.yaml.gz key. This behavior is deprecated and will be removed in the next major version of the custom resource definition. It is recommended to use spec.additionalScrapeConfigs instead.

Namespaces to match for PodMonitors discovery. An empty label selector matches all namespaces. A null label selector (default value) matches the current namespace only.

Probes to be selected for target discovery. An empty label selector matches all objects. A null label selector matches no objects.

If spec.serviceMonitorSelector, spec.podMonitorSelector, spec.probeSelector and spec.scrapeConfigSelector are null, the Prometheus configuration is unmanaged. The Prometheus operator will ensure that the Prometheus configuration’s Secret exists, but it is the responsibility of the user to provide the raw gzipped Prometheus configuration under the prometheus.yaml.gz key. This behavior is deprecated and will be removed in the next major version of the custom resource definition. It is recommended to use spec.additionalScrapeConfigs instead.

Namespaces to match for Probe discovery. An empty label selector matches all namespaces. A null label selector matches the current namespace only.

ScrapeConfigs to be selected for target discovery. An empty label selector matches all objects. A null label selector matches no objects.

If spec.serviceMonitorSelector, spec.podMonitorSelector, spec.probeSelector and spec.scrapeConfigSelector are null, the Prometheus configuration is unmanaged. The Prometheus operator will ensure that the Prometheus configuration’s Secret exists, but it is the responsibility of the user to provide the raw gzipped Prometheus configuration under the prometheus.yaml.gz key. This behavior is deprecated and will be removed in the next major version of the custom resource definition. It is recommended to use spec.additionalScrapeConfigs instead.

Note that the ScrapeConfig custom resource definition is currently at Alpha level.

Namespaces to match for ScrapeConfig discovery. An empty label selector matches all namespaces. A null label selector matches the current namespace only.

Note that the ScrapeConfig custom resource definition is currently at Alpha level.

Version of Prometheus being deployed. The operator uses this information to generate the Prometheus StatefulSet + configuration files.

If not specified, the operator assumes the latest upstream version of Prometheus available at the time when the version of the operator was released.

When a Prometheus deployment is paused, no actions except for deletion will be performed on the underlying objects.

Container image name for Prometheus. If specified, it takes precedence over the spec.baseImage, spec.tag and spec.sha fields.

Specifying spec.version is still necessary to ensure the Prometheus Operator knows which version of Prometheus is being configured.

If neither spec.image nor spec.baseImage are defined, the operator will use the latest upstream version of Prometheus available at the time when the operator was released.

Image pull policy for the ‘prometheus’, ‘init-config-reloader’ and ‘config-reloader’ containers. See https://kubernetes.io/docs/concepts/containers/images/#image-pull-policy for more details.

An optional list of references to Secrets in the same namespace to use for pulling images from registries. See http://kubernetes.io/docs/user-guide/images#specifying-imagepullsecrets-on-a-pod

Number of replicas of each shard to deploy for a Prometheus deployment. spec.replicas multiplied by spec.shards is the total number of Pods created.

Default: 1

Number of shards to distribute scraped targets onto.

spec.replicas multiplied by spec.shards is the total number of Pods being created.

When not defined, the operator assumes only one shard.

Note that scaling down shards will not reshard data onto the remaining instances, it must be manually moved. Increasing shards will not reshard data either but it will continue to be available from the same instances. To query globally, use Thanos sidecar and Thanos querier or remote write data to a central location. Alerting and recording rules

By default, the sharding is performed on: * The __address__ target’s metadata label for PodMonitor, ServiceMonitor and ScrapeConfig resources. * The __param_target__ label for Probe resources.

Users can define their own sharding implementation by setting the __tmp_hash label during the target discovery with relabeling configuration (either in the monitoring resources or via scrape class).

Name of Prometheus external label used to denote the replica name. The external label will not be added when the field is set to the empty string ("").

Default: “prometheus_replica”

Name of Prometheus external label used to denote the Prometheus instance name. The external label will not be added when the field is set to the empty string ("").

Default: “prometheus”

Log level for Prometheus and the config-reloader sidecar.

Log format for Log level for Prometheus and the config-reloader sidecar.

Interval between consecutive scrapes.

Default: “30s”

Number of seconds to wait until a scrape request times out.

The protocols to negotiate during a scrape. It tells clients the protocols supported by Prometheus in order of preference (from most to least preferred).

If unset, Prometheus uses its default value.

It requires Prometheus >= v2.49.0.

PrometheusText1.0.0 requires Prometheus >= v3.0.0.

The protocol to use if a scrape returns blank, unparseable, or otherwise invalid Content-Type.

It requires Prometheus >= v3.0.0.

The labels to add to any time series or alerts when communicating with external systems (federation, remote storage, Alertmanager). Labels defined by spec.replicaExternalLabelName and spec.prometheusExternalLabelName take precedence over this list.

Enable Prometheus to be used as a receiver for the Prometheus remote write protocol.

WARNING: This is not considered an efficient way of ingesting samples. Use it with caution for specific low-volume use cases. It is not suitable for replacing the ingestion via scraping and turning Prometheus into a push-based metrics collection system. For more information see https://prometheus.io/docs/prometheus/latest/querying/api/#remote-write-receiver

It requires Prometheus >= v2.33.0.

Enable Prometheus to be used as a receiver for the OTLP Metrics protocol.

Note that the OTLP receiver endpoint is automatically enabled if .spec.otlpConfig is defined.

It requires Prometheus >= v2.47.0.

List of the protobuf message versions to accept when receiving the remote writes.

It requires Prometheus >= v2.54.0.

Enable access to Prometheus feature flags. By default, no features are enabled.

Enabling features which are disabled by default is entirely outside the scope of what the maintainers will support and by doing so, you accept that this behaviour may break at any time without notice.

For more information see https://prometheus.io/docs/prometheus/latest/feature_flags/

The external URL under which the Prometheus service is externally available. This is necessary to generate correct URLs (for instance if Prometheus is accessible behind an Ingress resource).

The route prefix Prometheus registers HTTP handlers for.

This is useful when using spec.externalURL, and a proxy is rewriting HTTP routes of a request, and the actual ExternalURL is still true, but the server serves requests under a different route prefix. For example for use with kubectl proxy.

Storage defines the storage used by Prometheus.

Volumes allows the configuration of additional volumes on the output StatefulSet definition. Volumes specified will be appended to other volumes that are generated as a result of StorageSpec objects.

VolumeMounts allows the configuration of additional VolumeMounts.

VolumeMounts will be appended to other VolumeMounts in the ‘prometheus’ container, that are generated as a result of StorageSpec objects.

The field controls if and how PVCs are deleted during the lifecycle of a StatefulSet. The default behavior is all PVCs are retained. This is an alpha field from kubernetes 1.23 until 1.26 and a beta field from 1.26. It requires enabling the StatefulSetAutoDeletePVC feature gate.

Defines the configuration of the Prometheus web server.

Defines the resources requests and limits of the ‘prometheus’ container.

Defines on which Nodes the Pods are scheduled.

ServiceAccountName is the name of the ServiceAccount to use to run the Prometheus Pods.

AutomountServiceAccountToken indicates whether a service account token should be automatically mounted in the pod. If the field isn’t set, the operator mounts the service account token by default.

Warning: be aware that by default, Prometheus requires the service account token for Kubernetes service discovery. It is possible to use strategic merge patch to project the service account token into the ‘prometheus’ container.

Secrets is a list of Secrets in the same namespace as the Prometheus object, which shall be mounted into the Prometheus Pods. Each Secret is added to the StatefulSet definition as a volume named secret-<secret-name>. The Secrets are mounted into /etc/prometheus/secrets/ in the ‘prometheus’ container.

ConfigMaps is a list of ConfigMaps in the same namespace as the Prometheus object, which shall be mounted into the Prometheus Pods. Each ConfigMap is added to the StatefulSet definition as a volume named configmap-<configmap-name>. The ConfigMaps are mounted into /etc/prometheus/configmaps/ in the ‘prometheus’ container.

Defines the Pods’ affinity scheduling rules if specified.

Defines the Pods’ tolerations if specified.

Defines the pod’s topology spread constraints if specified.

Defines the list of remote write configurations.

Settings related to the OTLP receiver feature. It requires Prometheus >= v2.55.0.

SecurityContext holds pod-level security attributes and common container settings. This defaults to the default PodSecurityContext.

Defines the DNS policy for the pods.

Defines the DNS configuration for the pods.

When true, the Prometheus server listens on the loopback address instead of the Pod IP’s address.

Containers allows injecting additional containers or modifying operator generated containers. This can be used to allow adding an authentication proxy to the Pods or to change the behavior of an operator generated container. Containers described here modify an operator generated container if they share the same name and modifications are done via a strategic merge patch.

The names of containers managed by the operator are: * prometheus * config-reloader * thanos-sidecar

Overriding containers is entirely outside the scope of what the maintainers will support and by doing so, you accept that this behaviour may break at any time without notice.

InitContainers allows injecting initContainers to the Pod definition. Those can be used to e.g. fetch secrets for injection into the Prometheus configuration from external sources. Any errors during the execution of an initContainer will lead to a restart of the Pod. More info: https://kubernetes.io/docs/concepts/workloads/pods/init-containers/ InitContainers described here modify an operator generated init containers if they share the same name and modifications are done via a strategic merge patch.

The names of init container name managed by the operator are: * init-config-reloader.

Overriding init containers is entirely outside the scope of what the maintainers will support and by doing so, you accept that this behaviour may break at any time without notice.

AdditionalScrapeConfigs allows specifying a key of a Secret containing additional Prometheus scrape configurations. Scrape configurations specified are appended to the configurations generated by the Prometheus Operator. Job configurations specified must have the form as specified in the official Prometheus documentation: https://prometheus.io/docs/prometheus/latest/configuration/configuration/#scrape_config. As scrape configs are appended, the user is responsible to make sure it is valid. Note that using this feature may expose the possibility to break upgrades of Prometheus. It is advised to review Prometheus release notes to ensure that no incompatible scrape configs are going to break Prometheus after the upgrade.

APIServerConfig allows specifying a host and auth methods to access the Kuberntees API server. If null, Prometheus is assumed to run inside of the cluster: it will discover the API servers automatically and use the Pod’s CA certificate and bearer token file at /var/run/secrets/kubernetes.io/serviceaccount/.

Priority class assigned to the Pods.

Port name used for the pods and governing service. Default: “web”

When true, ServiceMonitor, PodMonitor and Probe object are forbidden to reference arbitrary files on the file system of the ‘prometheus’ container. When a ServiceMonitor’s endpoint specifies a bearerTokenFile value (e.g. ‘/var/run/secrets/kubernetes.io/serviceaccount/token’), a malicious target can get access to the Prometheus service account’s token in the Prometheus’ scrape request. Setting spec.arbitraryFSAccessThroughSM to ‘true’ would prevent the attack. Users should instead provide the credentials using the spec.bearerTokenSecret field.

When true, Prometheus resolves label conflicts by renaming the labels in the scraped data to “exported_” for all targets created from ServiceMonitor, PodMonitor and ScrapeConfig objects. Otherwise the HonorLabels field of the service or pod monitor applies. In practice,overrideHonorLaels:true enforces honorLabels:false for all ServiceMonitor, PodMonitor and ScrapeConfig objects.

When true, Prometheus ignores the timestamps for all the targets created from service and pod monitors. Otherwise the HonorTimestamps field of the service or pod monitor applies.

When true, spec.namespaceSelector from all PodMonitor, ServiceMonitor and Probe objects will be ignored. They will only discover targets within the namespace of the PodMonitor, ServiceMonitor and Probe object.

When not empty, a label will be added to:

1. All metrics scraped from ServiceMonitor, PodMonitor, Probe and ScrapeConfig objects.
2. All metrics generated from recording rules defined in PrometheusRule objects.
3. All alerts generated from alerting rules defined in PrometheusRule objects.
4. All vector selectors of PromQL expressions defined in PrometheusRule objects.

The label will not added for objects referenced in spec.excludedFromEnforcement.

The label’s name is this field’s value. The label’s value is the namespace of the ServiceMonitor, PodMonitor, Probe, PrometheusRule or ScrapeConfig object.

When defined, enforcedSampleLimit specifies a global limit on the number of scraped samples that will be accepted. This overrides any spec.sampleLimit set by ServiceMonitor, PodMonitor, Probe objects unless spec.sampleLimit is greater than zero and less than spec.enforcedSampleLimit.

It is meant to be used by admins to keep the overall number of samples/series under a desired limit.

When both enforcedSampleLimit and sampleLimit are defined and greater than zero, the following rules apply: * Scrape objects without a defined sampleLimit value will inherit the global sampleLimit value (Prometheus >= 2.45.0) or the enforcedSampleLimit value (Prometheus < v2.45.0). If Prometheus version is >= 2.45.0 and the enforcedSampleLimit is greater than the sampleLimit, the sampleLimit will be set to enforcedSampleLimit. * Scrape objects with a sampleLimit value less than or equal to enforcedSampleLimit keep their specific value. * Scrape objects with a sampleLimit value greater than enforcedSampleLimit are set to enforcedSampleLimit.

When defined, enforcedTargetLimit specifies a global limit on the number of scraped targets. The value overrides any spec.targetLimit set by ServiceMonitor, PodMonitor, Probe objects unless spec.targetLimit is greater than zero and less than spec.enforcedTargetLimit.

It is meant to be used by admins to to keep the overall number of targets under a desired limit.

When both enforcedTargetLimit and targetLimit are defined and greater than zero, the following rules apply: * Scrape objects without a defined targetLimit value will inherit the global targetLimit value (Prometheus >= 2.45.0) or the enforcedTargetLimit value (Prometheus < v2.45.0). If Prometheus version is >= 2.45.0 and the enforcedTargetLimit is greater than the targetLimit, the targetLimit will be set to enforcedTargetLimit. * Scrape objects with a targetLimit value less than or equal to enforcedTargetLimit keep their specific value. * Scrape objects with a targetLimit value greater than enforcedTargetLimit are set to enforcedTargetLimit.

When defined, enforcedLabelLimit specifies a global limit on the number of labels per sample. The value overrides any spec.labelLimit set by ServiceMonitor, PodMonitor, Probe objects unless spec.labelLimit is greater than zero and less than spec.enforcedLabelLimit.

It requires Prometheus >= v2.27.0.

When both enforcedLabelLimit and labelLimit are defined and greater than zero, the following rules apply: * Scrape objects without a defined labelLimit value will inherit the global labelLimit value (Prometheus >= 2.45.0) or the enforcedLabelLimit value (Prometheus < v2.45.0). If Prometheus version is >= 2.45.0 and the enforcedLabelLimit is greater than the labelLimit, the labelLimit will be set to enforcedLabelLimit. * Scrape objects with a labelLimit value less than or equal to enforcedLabelLimit keep their specific value. * Scrape objects with a labelLimit value greater than enforcedLabelLimit are set to enforcedLabelLimit.

When defined, enforcedLabelNameLengthLimit specifies a global limit on the length of labels name per sample. The value overrides any spec.labelNameLengthLimit set by ServiceMonitor, PodMonitor, Probe objects unless spec.labelNameLengthLimit is greater than zero and less than spec.enforcedLabelNameLengthLimit.

It requires Prometheus >= v2.27.0.

When both enforcedLabelNameLengthLimit and labelNameLengthLimit are defined and greater than zero, the following rules apply: * Scrape objects without a defined labelNameLengthLimit value will inherit the global labelNameLengthLimit value (Prometheus >= 2.45.0) or the enforcedLabelNameLengthLimit value (Prometheus < v2.45.0). If Prometheus version is >= 2.45.0 and the enforcedLabelNameLengthLimit is greater than the labelNameLengthLimit, the labelNameLengthLimit will be set to enforcedLabelNameLengthLimit. * Scrape objects with a labelNameLengthLimit value less than or equal to enforcedLabelNameLengthLimit keep their specific value. * Scrape objects with a labelNameLengthLimit value greater than enforcedLabelNameLengthLimit are set to enforcedLabelNameLengthLimit.

When not null, enforcedLabelValueLengthLimit defines a global limit on the length of labels value per sample. The value overrides any spec.labelValueLengthLimit set by ServiceMonitor, PodMonitor, Probe objects unless spec.labelValueLengthLimit is greater than zero and less than spec.enforcedLabelValueLengthLimit.

It requires Prometheus >= v2.27.0.

When both enforcedLabelValueLengthLimit and labelValueLengthLimit are defined and greater than zero, the following rules apply: * Scrape objects without a defined labelValueLengthLimit value will inherit the global labelValueLengthLimit value (Prometheus >= 2.45.0) or the enforcedLabelValueLengthLimit value (Prometheus < v2.45.0). If Prometheus version is >= 2.45.0 and the enforcedLabelValueLengthLimit is greater than the labelValueLengthLimit, the labelValueLengthLimit will be set to enforcedLabelValueLengthLimit. * Scrape objects with a labelValueLengthLimit value less than or equal to enforcedLabelValueLengthLimit keep their specific value. * Scrape objects with a labelValueLengthLimit value greater than enforcedLabelValueLengthLimit are set to enforcedLabelValueLengthLimit.

When defined, enforcedKeepDroppedTargets specifies a global limit on the number of targets dropped by relabeling that will be kept in memory. The value overrides any spec.keepDroppedTargets set by ServiceMonitor, PodMonitor, Probe objects unless spec.keepDroppedTargets is greater than zero and less than spec.enforcedKeepDroppedTargets.

It requires Prometheus >= v2.47.0.

When both enforcedKeepDroppedTargets and keepDroppedTargets are defined and greater than zero, the following rules apply: * Scrape objects without a defined keepDroppedTargets value will inherit the global keepDroppedTargets value (Prometheus >= 2.45.0) or the enforcedKeepDroppedTargets value (Prometheus < v2.45.0). If Prometheus version is >= 2.45.0 and the enforcedKeepDroppedTargets is greater than the keepDroppedTargets, the keepDroppedTargets will be set to enforcedKeepDroppedTargets. * Scrape objects with a keepDroppedTargets value less than or equal to enforcedKeepDroppedTargets keep their specific value. * Scrape objects with a keepDroppedTargets value greater than enforcedKeepDroppedTargets are set to enforcedKeepDroppedTargets.

When defined, enforcedBodySizeLimit specifies a global limit on the size of uncompressed response body that will be accepted by Prometheus. Targets responding with a body larger than this many bytes will cause the scrape to fail.

It requires Prometheus >= v2.28.0.

When both enforcedBodySizeLimit and bodySizeLimit are defined and greater than zero, the following rules apply: * Scrape objects without a defined bodySizeLimit value will inherit the global bodySizeLimit value (Prometheus >= 2.45.0) or the enforcedBodySizeLimit value (Prometheus < v2.45.0). If Prometheus version is >= 2.45.0 and the enforcedBodySizeLimit is greater than the bodySizeLimit, the bodySizeLimit will be set to enforcedBodySizeLimit. * Scrape objects with a bodySizeLimit value less than or equal to enforcedBodySizeLimit keep their specific value. * Scrape objects with a bodySizeLimit value greater than enforcedBodySizeLimit are set to enforcedBodySizeLimit.

Specifies the validation scheme for metric and label names.

Minimum number of seconds for which a newly created Pod should be ready without any of its container crashing for it to be considered available. Defaults to 0 (pod will be considered available as soon as it is ready)

This is an alpha field from kubernetes 1.22 until 1.24 which requires enabling the StatefulSetMinReadySeconds feature gate.

Optional list of hosts and IPs that will be injected into the Pod’s hosts file if specified.

AdditionalArgs allows setting additional arguments for the ‘prometheus’ container.

It is intended for e.g. activating hidden flags which are not supported by the dedicated configuration options yet. The arguments are passed as-is to the Prometheus container which may cause issues if they are invalid or not supported by the given Prometheus version.

In case of an argument conflict (e.g. an argument which is already set by the operator itself) or when providing an invalid argument, the reconciliation will fail and an error will be logged.

Configures compression of the write-ahead log (WAL) using Snappy.

WAL compression is enabled by default for Prometheus >= 2.20.0

Requires Prometheus v2.11.0 and above.

List of references to PodMonitor, ServiceMonitor, Probe and PrometheusRule objects to be excluded from enforcing a namespace label of origin.

It is only applicable if spec.enforcedNamespaceLabel set to true.

Use the host’s network namespace if true.

Make sure to understand the security implications if you want to enable it (https://kubernetes.io/docs/concepts/configuration/overview/).

When hostNetwork is enabled, this will set the DNS policy to ClusterFirstWithHostNet automatically (unless .spec.DNSPolicy is set to a different value).

PodTargetLabels are appended to the spec.podTargetLabels field of all PodMonitor and ServiceMonitor objects.

TracingConfig configures tracing in Prometheus.

This is an experimental feature, it may change in any upcoming release in a breaking way.

BodySizeLimit defines per-scrape on response body size. Only valid in Prometheus versions 2.45.0 and newer.

Note that the global limit only applies to scrape objects that don’t specify an explicit limit value. If you want to enforce a maximum limit for all scrape objects, refer to enforcedBodySizeLimit.

SampleLimit defines per-scrape limit on number of scraped samples that will be accepted. Only valid in Prometheus versions 2.45.0 and newer.

Note that the global limit only applies to scrape objects that don’t specify an explicit limit value. If you want to enforce a maximum limit for all scrape objects, refer to enforcedSampleLimit.

TargetLimit defines a limit on the number of scraped targets that will be accepted. Only valid in Prometheus versions 2.45.0 and newer.

Note that the global limit only applies to scrape objects that don’t specify an explicit limit value. If you want to enforce a maximum limit for all scrape objects, refer to enforcedTargetLimit.

Per-scrape limit on number of labels that will be accepted for a sample. Only valid in Prometheus versions 2.45.0 and newer.

Note that the global limit only applies to scrape objects that don’t specify an explicit limit value. If you want to enforce a maximum limit for all scrape objects, refer to enforcedLabelLimit.

Per-scrape limit on length of labels name that will be accepted for a sample. Only valid in Prometheus versions 2.45.0 and newer.

Note that the global limit only applies to scrape objects that don’t specify an explicit limit value. If you want to enforce a maximum limit for all scrape objects, refer to enforcedLabelNameLengthLimit.

Per-scrape limit on length of labels value that will be accepted for a sample. Only valid in Prometheus versions 2.45.0 and newer.

Note that the global limit only applies to scrape objects that don’t specify an explicit limit value. If you want to enforce a maximum limit for all scrape objects, refer to enforcedLabelValueLengthLimit.

Per-scrape limit on the number of targets dropped by relabeling that will be kept in memory. 0 means no limit.

It requires Prometheus >= v2.47.0.

Note that the global limit only applies to scrape objects that don’t specify an explicit limit value. If you want to enforce a maximum limit for all scrape objects, refer to enforcedKeepDroppedTargets.

Defines the strategy used to reload the Prometheus configuration. If not specified, the configuration is reloaded using the /-/reload HTTP endpoint.

Defines the maximum time that the prometheus container’s startup probe will wait before being considered failed. The startup probe will return success after the WAL replay is complete. If set, the value should be greater than 60 (seconds). Otherwise it will be equal to 600 seconds (15 minutes).

List of scrape classes to expose to scraping objects such as PodMonitors, ServiceMonitors, Probes and ScrapeConfigs.

This is an experimental feature, it may change in any upcoming release in a breaking way.

Defines the service discovery role used to discover targets from ServiceMonitor objects and Alertmanager endpoints.

If set, the value should be either “Endpoints” or “EndpointSlice”. If unset, the operator assumes the “Endpoints” role.

Defines the runtime reloadable configuration of the timeseries database(TSDB). It requires Prometheus >= v2.39.0 or PrometheusAgent >= v2.54.0.

RuntimeConfig configures the values for the Prometheus process behavior

Type of the condition being reported.

Status of the condition.

lastTransitionTime is the time of the last update to the current status property.

Reason for the condition’s last transition.

Human-readable message indicating details for the condition’s last transition.

ObservedGeneration represents the .metadata.generation that the condition was set based upon. For instance, if .metadata.generation is currently 12, but the .status.conditions[].observedGeneration is 9, the condition is out of date with respect to the current state of the instance.

"Degraded"

"False"

"True"

"Unknown"

"Available"

Available indicates whether enough pods are ready to provide the service. The possible status values for this condition type are: - True: all pods are running and ready, the service is fully available. - Degraded: some pods aren’t ready, the service is partially available. - False: no pods are running, the service is totally unavailable. - Unknown: the operator couldn’t determine the condition status.

"Reconciled"

Reconciled indicates whether the operator has reconciled the state of the underlying resources with the object’s spec. The possible status values for this condition type are: - True: the reconciliation was successful. - False: the reconciliation failed. - Unknown: the operator couldn’t determine the condition status.

MaxSkew describes the degree to which pods may be unevenly distributed. When whenUnsatisfiable=DoNotSchedule, it is the maximum permitted difference between the number of matching pods in the target topology and the global minimum. The global minimum is the minimum number of matching pods in an eligible domain or zero if the number of eligible domains is less than MinDomains. For example, in a 3-zone cluster, MaxSkew is set to 1, and pods with the same labelSelector spread as 2/2/1: In this case, the global minimum is 1. | zone1 | zone2 | zone3 | | P P | P P | P | - if MaxSkew is 1, incoming pod can only be scheduled to zone3 to become 2/2/2; scheduling it onto zone1(zone2) would make the ActualSkew(3-1) on zone1(zone2) violate MaxSkew(1). - if MaxSkew is 2, incoming pod can be scheduled onto any zone. When whenUnsatisfiable=ScheduleAnyway, it is used to give higher precedence to topologies that satisfy it. It’s a required field. Default value is 1 and 0 is not allowed.

TopologyKey is the key of node labels. Nodes that have a label with this key and identical values are considered to be in the same topology. We consider each as a “bucket”, and try to put balanced number of pods into each bucket. We define a domain as a particular instance of a topology. Also, we define an eligible domain as a domain whose nodes meet the requirements of nodeAffinityPolicy and nodeTaintsPolicy. e.g. If TopologyKey is “kubernetes.io/hostname”, each Node is a domain of that topology. And, if TopologyKey is “topology.kubernetes.io/zone”, each zone is a domain of that topology. It’s a required field.

WhenUnsatisfiable indicates how to deal with a pod if it doesn’t satisfy the spread constraint. - DoNotSchedule (default) tells the scheduler not to schedule it. - ScheduleAnyway tells the scheduler to schedule the pod in any location, but giving higher precedence to topologies that would help reduce the skew. A constraint is considered “Unsatisfiable” for an incoming pod if and only if every possible node assignment for that pod would violate “MaxSkew” on some topology. For example, in a 3-zone cluster, MaxSkew is set to 1, and pods with the same labelSelector spread as 3/1/1: | zone1 | zone2 | zone3 | | P P P | P | P | If WhenUnsatisfiable is set to DoNotSchedule, incoming pod can only be scheduled to zone2(zone3) to become 3/2/1(3/1/2) as ActualSkew(2-1) on zone2(zone3) satisfies MaxSkew(1). In other words, the cluster can still be imbalanced, but scheduler won’t make it more imbalanced. It’s a required field.

LabelSelector is used to find matching pods. Pods that match this label selector are counted to determine the number of pods in their corresponding topology domain.

MinDomains indicates a minimum number of eligible domains. When the number of eligible domains with matching topology keys is less than minDomains, Pod Topology Spread treats “global minimum” as 0, and then the calculation of Skew is performed. And when the number of eligible domains with matching topology keys equals or greater than minDomains, this value has no effect on scheduling. As a result, when the number of eligible domains is less than minDomains, scheduler won’t schedule more than maxSkew Pods to those domains. If value is nil, the constraint behaves as if MinDomains is equal to 1. Valid values are integers greater than 0. When value is not nil, WhenUnsatisfiable must be DoNotSchedule.

For example, in a 3-zone cluster, MaxSkew is set to 2, MinDomains is set to 5 and pods with the same labelSelector spread as 2/2/2: | zone1 | zone2 | zone3 | | P P | P P | P P | The number of domains is less than 5(MinDomains), so “global minimum” is treated as 0. In this situation, new pod with the same labelSelector cannot be scheduled, because computed skew will be 3(3 - 0) if new Pod is scheduled to any of the three zones, it will violate MaxSkew.

NodeAffinityPolicy indicates how we will treat Pod’s nodeAffinity/nodeSelector when calculating pod topology spread skew. Options are: - Honor: only nodes matching nodeAffinity/nodeSelector are included in the calculations. - Ignore: nodeAffinity/nodeSelector are ignored. All nodes are included in the calculations.

If this value is nil, the behavior is equivalent to the Honor policy. This is a beta-level feature default enabled by the NodeInclusionPolicyInPodTopologySpread feature flag.

NodeTaintsPolicy indicates how we will treat node taints when calculating pod topology spread skew. Options are: - Honor: nodes without taints, along with tainted nodes for which the incoming pod has a toleration, are included. - Ignore: node taints are ignored. All nodes are included.

If this value is nil, the behavior is equivalent to the Ignore policy. This is a beta-level feature default enabled by the NodeInclusionPolicyInPodTopologySpread feature flag.

MatchLabelKeys is a set of pod label keys to select the pods over which spreading will be calculated. The keys are used to lookup values from the incoming pod labels, those key-value labels are ANDed with labelSelector to select the group of existing pods over which spreading will be calculated for the incoming pod. The same key is forbidden to exist in both MatchLabelKeys and LabelSelector. MatchLabelKeys cannot be set when LabelSelector isn’t set. Keys that don’t exist in the incoming pod labels will be ignored. A null or empty list means only match against labelSelector.

This is a beta field and requires the MatchLabelKeysInPodTopologySpread feature gate to be enabled (enabled by default).

"ClusterFirst"

DNSClusterFirst indicates that the pod should use cluster DNS first unless hostNetwork is true, if it is available, then fall back on the default (as determined by kubelet) DNS settings.

"ClusterFirstWithHostNet"

DNSClusterFirstWithHostNet indicates that the pod should use cluster DNS first, if it is available, then fall back on the default (as determined by kubelet) DNS settings.

"Default"

DNSDefault indicates that the pod should use the default (as determined by kubelet) DNS settings.

"None"

DNSNone indicates that the pod should use empty DNS settings. DNS parameters such as nameservers and search paths should be defined via DNSConfig.

Name must be unique within a namespace. Is required when creating resources, although some resources may allow a client to request the generation of an appropriate name automatically. Name is primarily intended for creation idempotence and configuration definition. Cannot be updated. More info: http://kubernetes.io/docs/user-guide/identifiers#names

Map of string keys and values that can be used to organize and categorize (scope and select) objects. May match selectors of replication controllers and services. More info: http://kubernetes.io/docs/user-guide/labels

Annotations is an unstructured key value map stored with a resource that may be set by external tools to store and retrieve arbitrary metadata. They are not queryable and should be preserved when modifying objects. More info: http://kubernetes.io/docs/user-guide/annotations

EmbeddedMetadata contains metadata relevant to an EmbeddedResource.

Defines the desired characteristics of a volume requested by a pod author. More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#persistentvolumeclaims

Deprecated: this field is never set.

Name of the Service port which this endpoint refers to.

It takes precedence over targetPort.

Name or number of the target port of the Pod object behind the Service. The port must be specified with the container’s port property.

HTTP path from which to scrape for metrics.

If empty, Prometheus uses the default value (e.g. /metrics).

HTTP scheme to use for scraping.

http and https are the expected values unless you rewrite the __scheme__ label via relabeling.

If empty, Prometheus uses the default value http.

params define optional HTTP URL parameters.

Interval at which Prometheus scrapes the metrics from the target.

If empty, Prometheus uses the global scrape interval.

Timeout after which Prometheus considers the scrape to be failed.

If empty, Prometheus uses the global scrape timeout unless it is less than the target’s scrape interval value in which the latter is used.

TLS configuration to use when scraping the target.

File to read bearer token for scraping the target.

Deprecated: use authorization instead.

bearerTokenSecret specifies a key of a Secret containing the bearer token for scraping targets. The secret needs to be in the same namespace as the ServiceMonitor object and readable by the Prometheus Operator.

Deprecated: use authorization instead.

authorization configures the Authorization header credentials to use when scraping the target.

Cannot be set at the same time as basicAuth, or oauth2.

When true, honorLabels preserves the metric’s labels when they collide with the target’s labels.

honorTimestamps controls whether Prometheus preserves the timestamps when exposed by the target.

trackTimestampsStaleness defines whether Prometheus tracks staleness of the metrics that have an explicit timestamp present in scraped data. Has no effect if honorTimestamps is false.

It requires Prometheus >= v2.48.0.

basicAuth configures the Basic Authentication credentials to use when scraping the target.

Cannot be set at the same time as authorization, or oauth2.

oauth2 configures the OAuth2 settings to use when scraping the target.

It requires Prometheus >= 2.27.0.

Cannot be set at the same time as authorization, or basicAuth.

metricRelabelings configures the relabeling rules to apply to the samples before ingestion.

relabelings configures the relabeling rules to apply the target’s metadata labels.

The Operator automatically adds relabelings for a few standard Kubernetes fields.

The original scrape job’s name is available via the __tmp_prometheus_job_name label.

More info: https://prometheus.io/docs/prometheus/latest/configuration/configuration/#relabel_config

proxyURL configures the HTTP Proxy URL (e.g. “http://proxyserver:2195”) to go through when scraping the target.

followRedirects defines whether the scrape requests should follow HTTP 3xx redirects.

enableHttp2 can be used to disable HTTP2 when scraping the target.

When true, the pods which are not running (e.g. either in Failed or Succeeded state) are dropped during the target discovery.

If unset, the filtering is enabled.

More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle/#pod-phase

Maximum number of exemplars stored in memory for all series.

exemplar-storage itself must be enabled using the spec.enableFeature option for exemplars to be scraped in the first place.

If not set, Prometheus uses its default value. A value of zero or less than zero disables the storage.

The default SMTP From header field.

The default SMTP smarthost used for sending emails.

The default hostname to identify to the SMTP server.

SMTP Auth using CRAM-MD5, LOGIN and PLAIN. If empty, Alertmanager doesn’t authenticate to the SMTP server.

SMTP Auth using LOGIN and PLAIN.

SMTP Auth using PLAIN

SMTP Auth using CRAM-MD5.

The default SMTP TLS requirement. Note that Go does not support unencrypted connections to remote SMTP endpoints.

Authorization header configuration for the client. This is mutually exclusive with BasicAuth and is only available starting from Alertmanager v0.22+.

BasicAuth for the client. This is mutually exclusive with Authorization. If both are defined, BasicAuth takes precedence.

OAuth2 client credentials used to fetch a token for the targets.

The secret’s key that contains the bearer token to be used by the client for authentication. The secret needs to be in the same namespace as the Alertmanager object and accessible by the Prometheus Operator.

TLS configuration for the client.

proxyURL defines the HTTP proxy server to use.

noProxy is a comma-separated string that can contain IPs, CIDR notation, domain names that should be excluded from proxying. IP and domain names can contain port numbers.

It requires Prometheus >= v2.43.0 or Alertmanager >= 0.25.0.

Whether to use the proxy configuration defined by environment variables (HTTP_PROXY, HTTPS_PROXY, and NO_PROXY).

It requires Prometheus >= v2.43.0 or Alertmanager >= 0.25.0.

ProxyConnectHeader optionally specifies headers to send to proxies during CONNECT requests.

It requires Prometheus >= v2.43.0 or Alertmanager >= 0.25.0.

FollowRedirects specifies whether the client should follow HTTP 3xx redirects.

IP address of the host file entry.

Hostnames for the above IP address.

Defines the host’s address, it can be a DNS name or a literal IP address.

Defines the host’s port, it can be a literal port number or a port name.

The client id

Defines whether metric metadata is sent to the remote storage or not.

Defines how frequently metric metadata is sent to the remote storage.

"Legacy"

"UTF8"

Boolean describing whether all namespaces are selected in contrast to a list restricting them.

List of namespace names to select from.

Whether to scrape a classic histogram that is also exposed as a native histogram. It requires Prometheus >= v2.45.0.

If there are more than this many buckets in a native histogram, buckets will be merged to stay within the limit. It requires Prometheus >= v2.45.0.

If the growth factor of one bucket to the next is smaller than this, buckets will be merged to increase the factor sufficiently. It requires Prometheus >= v2.50.0.

clientId specifies a key of a Secret or ConfigMap containing the OAuth2 client’s ID.

clientSecret specifies a key of a Secret containing the OAuth2 client’s secret.

tokenURL configures the URL to fetch the token from.

scopes defines the OAuth2 scopes used for the token request.

endpointParams configures the HTTP parameters to append to the token URL.

TLS configuration to use when connecting to the OAuth2 server. It requires Prometheus >= v2.43.0.

proxyURL defines the HTTP proxy server to use.

noProxy is a comma-separated string that can contain IPs, CIDR notation, domain names that should be excluded from proxying. IP and domain names can contain port numbers.

It requires Prometheus >= v2.43.0 or Alertmanager >= 0.25.0.

Whether to use the proxy configuration defined by environment variables (HTTP_PROXY, HTTPS_PROXY, and NO_PROXY).

It requires Prometheus >= v2.43.0 or Alertmanager >= 0.25.0.

ProxyConnectHeader optionally specifies headers to send to proxies during CONNECT requests.

It requires Prometheus >= v2.43.0 or Alertmanager >= 0.25.0.

List of OpenTelemetry Attributes that should be promoted to metric labels, defaults to none.

Configures how the OTLP receiver endpoint translates the incoming metrics. If unset, Prometheus uses its default value.

It requires Prometheus >= v3.0.0.

Group of the referent. When not specified, it defaults to monitoring.coreos.com

Resource of the referent.

Namespace of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/

Name of the referent. When not set, all resources in the namespace are matched.

A list of DNS name server IP addresses. This will be appended to the base nameservers generated from DNSPolicy.

A list of DNS search domains for host-name lookup. This will be appended to the base search paths generated from DNSPolicy.

A list of DNS resolver options. This will be merged with the base options generated from DNSPolicy. Resolution options given in Options will override those that appear in the base DNSPolicy.

Name is required and must be unique.

Value is optional.

Name of the Pod port which this endpoint refers to.

It takes precedence over targetPort.

Name or number of the target port of the Pod object behind the Service, the port must be specified with container port property.

Deprecated: use ‘port’ instead.

HTTP path from which to scrape for metrics.

If empty, Prometheus uses the default value (e.g. /metrics).

HTTP scheme to use for scraping.

http and https are the expected values unless you rewrite the __scheme__ label via relabeling.

If empty, Prometheus uses the default value http.

params define optional HTTP URL parameters.

Interval at which Prometheus scrapes the metrics from the target.

If empty, Prometheus uses the global scrape interval.

Timeout after which Prometheus considers the scrape to be failed.

If empty, Prometheus uses the global scrape timeout unless it is less than the target’s scrape interval value in which the latter is used.

TLS configuration to use when scraping the target.

bearerTokenSecret specifies a key of a Secret containing the bearer token for scraping targets. The secret needs to be in the same namespace as the PodMonitor object and readable by the Prometheus Operator.

Deprecated: use authorization instead.

When true, honorLabels preserves the metric’s labels when they collide with the target’s labels.

honorTimestamps controls whether Prometheus preserves the timestamps when exposed by the target.

trackTimestampsStaleness defines whether Prometheus tracks staleness of the metrics that have an explicit timestamp present in scraped data. Has no effect if honorTimestamps is false.

It requires Prometheus >= v2.48.0.

basicAuth configures the Basic Authentication credentials to use when scraping the target.

Cannot be set at the same time as authorization, or oauth2.

oauth2 configures the OAuth2 settings to use when scraping the target.

It requires Prometheus >= 2.27.0.

Cannot be set at the same time as authorization, or basicAuth.

authorization configures the Authorization header credentials to use when scraping the target.

Cannot be set at the same time as basicAuth, or oauth2.

metricRelabelings configures the relabeling rules to apply to the samples before ingestion.

relabelings configures the relabeling rules to apply the target’s metadata labels.

The Operator automatically adds relabelings for a few standard Kubernetes fields.

The original scrape job’s name is available via the __tmp_prometheus_job_name label.

More info: https://prometheus.io/docs/prometheus/latest/configuration/configuration/#relabel_config

proxyURL configures the HTTP Proxy URL (e.g. “http://proxyserver:2195”) to go through when scraping the target.

followRedirects defines whether the scrape requests should follow HTTP 3xx redirects.

enableHttp2 can be used to disable HTTP2 when scraping the target.

When true, the pods which are not running (e.g. either in Failed or Succeeded state) are dropped during the target discovery.

If unset, the filtering is enabled.

More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle/#pod-phase

The label to use to retrieve the job name from. jobLabel selects the label from the associated Kubernetes Pod object which will be used as the job label for all metrics.

For example if jobLabel is set to foo and the Kubernetes Pod object is labeled with foo: bar, then Prometheus adds the job="bar" label to all ingested metrics.

If the value of this field is empty, the job label of the metrics defaults to the namespace and name of the PodMonitor object (e.g. <namespace>/<name>).

podTargetLabels defines the labels which are transferred from the associated Kubernetes Pod object onto the ingested metrics.

Defines how to scrape metrics from the selected pods.

Label selector to select the Kubernetes Pod objects to scrape metrics from.

namespaceSelector defines in which namespace(s) Prometheus should discover the pods. By default, the pods are discovered in the same namespace as the PodMonitor object but it is possible to select pods across different/all namespaces.

sampleLimit defines a per-scrape limit on the number of scraped samples that will be accepted.

targetLimit defines a limit on the number of scraped targets that will be accepted.

scrapeProtocols defines the protocols to negotiate during a scrape. It tells clients the protocols supported by Prometheus in order of preference (from most to least preferred).

If unset, Prometheus uses its default value.

It requires Prometheus >= v2.49.0.

The protocol to use if a scrape returns blank, unparseable, or otherwise invalid Content-Type.

It requires Prometheus >= v3.0.0.

Per-scrape limit on number of labels that will be accepted for a sample.

It requires Prometheus >= v2.27.0.

Per-scrape limit on length of labels name that will be accepted for a sample.

It requires Prometheus >= v2.27.0.

Per-scrape limit on length of labels value that will be accepted for a sample.

It requires Prometheus >= v2.27.0.

Whether to scrape a classic histogram that is also exposed as a native histogram. It requires Prometheus >= v2.45.0.

If there are more than this many buckets in a native histogram, buckets will be merged to stay within the limit. It requires Prometheus >= v2.45.0.

If the growth factor of one bucket to the next is smaller than this, buckets will be merged to increase the factor sufficiently. It requires Prometheus >= v2.50.0.

Per-scrape limit on the number of targets dropped by relabeling that will be kept in memory. 0 means no limit.

It requires Prometheus >= v2.47.0.

attachMetadata defines additional metadata which is added to the discovered targets.

It requires Prometheus >= v2.35.0.

The scrape class to apply.

When defined, bodySizeLimit specifies a job level limit on the size of uncompressed response body that will be accepted by Prometheus.

It requires Prometheus >= v2.28.0.

The job name assigned to scraped metrics by default.

Specification for the prober to use for probing targets. The prober.URL parameter is required. Targets cannot be probed if left empty.

The module to use for probing specifying how to probe the target. Example module configuring in the blackbox exporter: https://github.com/prometheus/blackbox_exporter/blob/master/example.yml

Targets defines a set of static or dynamically discovered targets to probe.

Interval at which targets are probed using the configured prober. If not specified Prometheus’ global scrape interval is used.

Timeout for scraping metrics from the Prometheus exporter. If not specified, the Prometheus global scrape timeout is used.

TLS configuration to use when scraping the endpoint.

Secret to mount to read bearer token for scraping targets. The secret needs to be in the same namespace as the probe and accessible by the Prometheus Operator.

BasicAuth allow an endpoint to authenticate over basic authentication. More info: https://prometheus.io/docs/operating/configuration/#endpoint

OAuth2 for the URL. Only valid in Prometheus versions 2.27.0 and newer.

MetricRelabelConfigs to apply to samples before ingestion.

Authorization section for this endpoint

SampleLimit defines per-scrape limit on number of scraped samples that will be accepted.

TargetLimit defines a limit on the number of scraped targets that will be accepted.

scrapeProtocols defines the protocols to negotiate during a scrape. It tells clients the protocols supported by Prometheus in order of preference (from most to least preferred).

If unset, Prometheus uses its default value.

It requires Prometheus >= v2.49.0.

The protocol to use if a scrape returns blank, unparseable, or otherwise invalid Content-Type.

It requires Prometheus >= v3.0.0.

Per-scrape limit on number of labels that will be accepted for a sample. Only valid in Prometheus versions 2.27.0 and newer.

Per-scrape limit on length of labels name that will be accepted for a sample. Only valid in Prometheus versions 2.27.0 and newer.

Per-scrape limit on length of labels value that will be accepted for a sample. Only valid in Prometheus versions 2.27.0 and newer.

Whether to scrape a classic histogram that is also exposed as a native histogram. It requires Prometheus >= v2.45.0.

If there are more than this many buckets in a native histogram, buckets will be merged to stay within the limit. It requires Prometheus >= v2.45.0.

If the growth factor of one bucket to the next is smaller than this, buckets will be merged to increase the factor sufficiently. It requires Prometheus >= v2.50.0.

Per-scrape limit on the number of targets dropped by relabeling that will be kept in memory. 0 means no limit.

It requires Prometheus >= v2.47.0.

The scrape class to apply.

Selector to select the Ingress objects.

From which namespaces to select Ingress objects.

RelabelConfigs to apply to the label set of the target before it gets scraped. The original ingress address is available via the __tmp_prometheus_ingress_address label. It can be used to customize the probed URL. The original scrape job’s name is available via the __tmp_prometheus_job_name label. More info: https://prometheus.io/docs/prometheus/latest/configuration/configuration/#relabel_config

The list of hosts to probe.

Labels assigned to all metrics scraped from the targets.

RelabelConfigs to apply to the label set of the targets before it gets scraped. More info: https://prometheus.io/docs/prometheus/latest/configuration/configuration/#relabel_config

staticConfig defines the static list of targets to probe and the relabeling configuration. If ingress is also defined, staticConfig takes precedence. More info: https://prometheus.io/docs/prometheus/latest/configuration/configuration/#static_config.

ingress defines the Ingress objects to probe and the relabeling configuration. If staticConfig is also defined, staticConfig takes precedence.

Mandatory URL of the prober.

HTTP scheme to use for scraping. http and https are the expected values unless you rewrite the __scheme__ label via relabeling. If empty, Prometheus uses the default value http.

Path to collect metrics from. Defaults to /probe.

Optional ProxyURL.

Namespace of the excluded PrometheusRule object.

Name of the excluded PrometheusRule object.

Content of Prometheus rule file

PodMetadata configures labels and annotations which are propagated to the Prometheus pods.

The following items are reserved and cannot be overridden: * “prometheus” label, set to the name of the Prometheus object. * “app.kubernetes.io/instance” label, set to the name of the Prometheus object. * “app.kubernetes.io/managed-by” label, set to “prometheus-operator”. * “app.kubernetes.io/name” label, set to “prometheus”. * “app.kubernetes.io/version” label, set to the Prometheus version. * “operator.prometheus.io/name” label, set to the name of the Prometheus object. * “operator.prometheus.io/shard” label, set to the shard number of the Prometheus object. * “kubectl.kubernetes.io/default-container” annotation, set to “prometheus”.

ServiceMonitors to be selected for target discovery. An empty label selector matches all objects. A null label selector matches no objects.

If spec.serviceMonitorSelector, spec.podMonitorSelector, spec.probeSelector and spec.scrapeConfigSelector are null, the Prometheus configuration is unmanaged. The Prometheus operator will ensure that the Prometheus configuration’s Secret exists, but it is the responsibility of the user to provide the raw gzipped Prometheus configuration under the prometheus.yaml.gz key. This behavior is deprecated and will be removed in the next major version of the custom resource definition. It is recommended to use spec.additionalScrapeConfigs instead.

Namespaces to match for ServicedMonitors discovery. An empty label selector matches all namespaces. A null label selector (default value) matches the current namespace only.

PodMonitors to be selected for target discovery. An empty label selector matches all objects. A null label selector matches no objects.

If spec.serviceMonitorSelector, spec.podMonitorSelector, spec.probeSelector and spec.scrapeConfigSelector are null, the Prometheus configuration is unmanaged. The Prometheus operator will ensure that the Prometheus configuration’s Secret exists, but it is the responsibility of the user to provide the raw gzipped Prometheus configuration under the prometheus.yaml.gz key. This behavior is deprecated and will be removed in the next major version of the custom resource definition. It is recommended to use spec.additionalScrapeConfigs instead.

Namespaces to match for PodMonitors discovery. An empty label selector matches all namespaces. A null label selector (default value) matches the current namespace only.

Probes to be selected for target discovery. An empty label selector matches all objects. A null label selector matches no objects.

If spec.serviceMonitorSelector, spec.podMonitorSelector, spec.probeSelector and spec.scrapeConfigSelector are null, the Prometheus configuration is unmanaged. The Prometheus operator will ensure that the Prometheus configuration’s Secret exists, but it is the responsibility of the user to provide the raw gzipped Prometheus configuration under the prometheus.yaml.gz key. This behavior is deprecated and will be removed in the next major version of the custom resource definition. It is recommended to use spec.additionalScrapeConfigs instead.

Namespaces to match for Probe discovery. An empty label selector matches all namespaces. A null label selector matches the current namespace only.

ScrapeConfigs to be selected for target discovery. An empty label selector matches all objects. A null label selector matches no objects.

If spec.serviceMonitorSelector, spec.podMonitorSelector, spec.probeSelector and spec.scrapeConfigSelector are null, the Prometheus configuration is unmanaged. The Prometheus operator will ensure that the Prometheus configuration’s Secret exists, but it is the responsibility of the user to provide the raw gzipped Prometheus configuration under the prometheus.yaml.gz key. This behavior is deprecated and will be removed in the next major version of the custom resource definition. It is recommended to use spec.additionalScrapeConfigs instead.

Note that the ScrapeConfig custom resource definition is currently at Alpha level.

Namespaces to match for ScrapeConfig discovery. An empty label selector matches all namespaces. A null label selector matches the current namespace only.

Note that the ScrapeConfig custom resource definition is currently at Alpha level.

Version of Prometheus being deployed. The operator uses this information to generate the Prometheus StatefulSet + configuration files.

If not specified, the operator assumes the latest upstream version of Prometheus available at the time when the version of the operator was released.

When a Prometheus deployment is paused, no actions except for deletion will be performed on the underlying objects.

Container image name for Prometheus. If specified, it takes precedence over the spec.baseImage, spec.tag and spec.sha fields.

Specifying spec.version is still necessary to ensure the Prometheus Operator knows which version of Prometheus is being configured.

If neither spec.image nor spec.baseImage are defined, the operator will use the latest upstream version of Prometheus available at the time when the operator was released.

Image pull policy for the ‘prometheus’, ‘init-config-reloader’ and ‘config-reloader’ containers. See https://kubernetes.io/docs/concepts/containers/images/#image-pull-policy for more details.

An optional list of references to Secrets in the same namespace to use for pulling images from registries. See http://kubernetes.io/docs/user-guide/images#specifying-imagepullsecrets-on-a-pod

Number of replicas of each shard to deploy for a Prometheus deployment. spec.replicas multiplied by spec.shards is the total number of Pods created.

Default: 1

Number of shards to distribute scraped targets onto.

spec.replicas multiplied by spec.shards is the total number of Pods being created.

When not defined, the operator assumes only one shard.

Note that scaling down shards will not reshard data onto the remaining instances, it must be manually moved. Increasing shards will not reshard data either but it will continue to be available from the same instances. To query globally, use Thanos sidecar and Thanos querier or remote write data to a central location. Alerting and recording rules

By default, the sharding is performed on: * The __address__ target’s metadata label for PodMonitor, ServiceMonitor and ScrapeConfig resources. * The __param_target__ label for Probe resources.

Users can define their own sharding implementation by setting the __tmp_hash label during the target discovery with relabeling configuration (either in the monitoring resources or via scrape class).

Name of Prometheus external label used to denote the replica name. The external label will not be added when the field is set to the empty string ("").

Default: “prometheus_replica”

Name of Prometheus external label used to denote the Prometheus instance name. The external label will not be added when the field is set to the empty string ("").

Default: “prometheus”

Log level for Prometheus and the config-reloader sidecar.

Log format for Log level for Prometheus and the config-reloader sidecar.

Interval between consecutive scrapes.

Default: “30s”

Number of seconds to wait until a scrape request times out.

The protocols to negotiate during a scrape. It tells clients the protocols supported by Prometheus in order of preference (from most to least preferred).

If unset, Prometheus uses its default value.

It requires Prometheus >= v2.49.0.

PrometheusText1.0.0 requires Prometheus >= v3.0.0.

The protocol to use if a scrape returns blank, unparseable, or otherwise invalid Content-Type.

It requires Prometheus >= v3.0.0.

The labels to add to any time series or alerts when communicating with external systems (federation, remote storage, Alertmanager). Labels defined by spec.replicaExternalLabelName and spec.prometheusExternalLabelName take precedence over this list.

Enable Prometheus to be used as a receiver for the Prometheus remote write protocol.

WARNING: This is not considered an efficient way of ingesting samples. Use it with caution for specific low-volume use cases. It is not suitable for replacing the ingestion via scraping and turning Prometheus into a push-based metrics collection system. For more information see https://prometheus.io/docs/prometheus/latest/querying/api/#remote-write-receiver

It requires Prometheus >= v2.33.0.

Enable Prometheus to be used as a receiver for the OTLP Metrics protocol.

Note that the OTLP receiver endpoint is automatically enabled if .spec.otlpConfig is defined.

It requires Prometheus >= v2.47.0.

List of the protobuf message versions to accept when receiving the remote writes.

It requires Prometheus >= v2.54.0.

Enable access to Prometheus feature flags. By default, no features are enabled.

Enabling features which are disabled by default is entirely outside the scope of what the maintainers will support and by doing so, you accept that this behaviour may break at any time without notice.

For more information see https://prometheus.io/docs/prometheus/latest/feature_flags/

The external URL under which the Prometheus service is externally available. This is necessary to generate correct URLs (for instance if Prometheus is accessible behind an Ingress resource).

The route prefix Prometheus registers HTTP handlers for.

This is useful when using spec.externalURL, and a proxy is rewriting HTTP routes of a request, and the actual ExternalURL is still true, but the server serves requests under a different route prefix. For example for use with kubectl proxy.

Storage defines the storage used by Prometheus.

Volumes allows the configuration of additional volumes on the output StatefulSet definition. Volumes specified will be appended to other volumes that are generated as a result of StorageSpec objects.

VolumeMounts allows the configuration of additional VolumeMounts.

VolumeMounts will be appended to other VolumeMounts in the ‘prometheus’ container, that are generated as a result of StorageSpec objects.

The field controls if and how PVCs are deleted during the lifecycle of a StatefulSet. The default behavior is all PVCs are retained. This is an alpha field from kubernetes 1.23 until 1.26 and a beta field from 1.26. It requires enabling the StatefulSetAutoDeletePVC feature gate.

Defines the configuration of the Prometheus web server.

Defines the resources requests and limits of the ‘prometheus’ container.