apiVersion: v1
kind: Template
metadata:
  name: prometheus-telemeter
objects:
- apiVersion: rbac.authorization.k8s.io/v1
  kind: ClusterRole
  metadata:
    name: prometheus-telemeter-${NAMESPACE}
  rules:
  - nonResourceURLs:
    - /metrics
    verbs:
    - get
  - apiGroups:
    - authentication.k8s.io
    resources:
    - tokenreviews
    verbs:
    - create
  - apiGroups:
    - authorization.k8s.io
    resources:
    - subjectaccessreviews
    verbs:
    - create
  - apiGroups:
    - ""
    resourceNames:
    - ${NAMESPACE}
    resources:
    - namespaces
    verbs:
    - get
- apiVersion: rbac.authorization.k8s.io/v1
  kind: ClusterRoleBinding
  metadata:
    name: prometheus-telemeter-${NAMESPACE}
  roleRef:
    apiGroup: rbac.authorization.k8s.io
    kind: ClusterRole
    name: prometheus-telemeter-${NAMESPACE}
  subjects:
  - kind: ServiceAccount
    name: prometheus-telemeter
    namespace: ${NAMESPACE}
- apiVersion: monitoring.coreos.com/v1
  kind: Prometheus
  metadata:
    labels:
      prometheus: telemeter
    name: telemeter
    namespace: ${NAMESPACE}
  spec:
    baseImage: ${PROMETHEUS_IMAGE}
    containers:
    - args:
      - -provider=openshift
      - -https-address=:9091
      - -http-address=
      - -email-domain=*
      - -upstream=http://localhost:9090
      - -openshift-service-account=prometheus-telemeter
      - '-openshift-sar={"resource": "namespaces", "verb": "get", "name": "${NAMESPACE}",
        "namespace": "${NAMESPACE}"}'
      - '-openshift-delegate-urls={"/": {"resource": "namespaces", "verb": "get",
        "name": "${NAMESPACE}", "namespace": "${NAMESPACE}"}}'
      - -tls-cert=/etc/tls/private/tls.crt
      - -tls-key=/etc/tls/private/tls.key
      - -client-secret-file=/var/run/secrets/kubernetes.io/serviceaccount/token
      - -cookie-secret-file=/etc/proxy/secrets/session_secret
      - -openshift-ca=/etc/pki/tls/cert.pem
      - -openshift-ca=/var/run/secrets/kubernetes.io/serviceaccount/ca.crt
      - -skip-auth-regex=^/metrics
      image: ${PROXY_IMAGE}:${PROXY_IMAGE_TAG}
      name: prometheus-proxy
      ports:
      - containerPort: 9091
        name: https
      resources: {}
      volumeMounts:
      - mountPath: /etc/tls/private
        name: secret-prometheus-telemeter-tls
      - mountPath: /etc/proxy/secrets
        name: secret-prometheus-telemeter-proxy
    listenLocal: true
    nodeSelector:
      beta.kubernetes.io/os: linux
    replicas: 2
    resources:
      limits:
        cpu: ${PROMETHEUS_CPU_LIMIT}
        memory: ${PROMETHEUS_MEMORY_LIMIT}
      requests:
        cpu: ${PROMETHEUS_CPU_REQUEST}
        memory: ${PROMETHEUS_MEMORY_REQUEST}
    retention: 15d
    ruleSelector:
      matchLabels:
        prometheus: telemeter
        role: alert-rules
    secrets:
    - prometheus-telemeter-tls
    - prometheus-telemeter-proxy
    securityContext: {}
    serviceAccountName: prometheus-telemeter
    serviceMonitorSelector:
      matchLabels:
        endpoint: federate
        k8s-app: telemeter-server
    storage:
      volumeClaimTemplate:
        apiVersion: v1
        kind: PersistentVolumeClaim
        spec:
          accessModes:
          - ReadWriteOnce
          resources:
            requests:
              storage: 500Gi
          storageClassName: gp2-encrypted
    version: ${PROMETHEUS_IMAGE_TAG}
- apiVersion: v1
  data:
    session_secret: ""
  kind: Secret
  metadata:
    labels:
      k8s-app: prometheus-telemeter
    name: prometheus-telemeter-proxy
    namespace: ${NAMESPACE}
  type: Opaque
- apiVersion: rbac.authorization.k8s.io/v1
  kind: RoleBinding
  metadata:
    name: prometheus-telemeter-config
    namespace: ${NAMESPACE}
  roleRef:
    apiGroup: rbac.authorization.k8s.io
    kind: Role
    name: prometheus-telemeter-config
  subjects:
  - kind: ServiceAccount
    name: prometheus-telemeter
    namespace: ${NAMESPACE}
- apiVersion: rbac.authorization.k8s.io/v1
  kind: RoleBinding
  metadata:
    name: prometheus-telemeter
    namespace: ${NAMESPACE}
  roleRef:
    apiGroup: rbac.authorization.k8s.io
    kind: Role
    name: prometheus-telemeter
  subjects:
  - kind: ServiceAccount
    name: prometheus-telemeter
    namespace: ${NAMESPACE}
- apiVersion: rbac.authorization.k8s.io/v1
  kind: Role
  metadata:
    name: prometheus-telemeter-config
    namespace: ${NAMESPACE}
  rules:
  - apiGroups:
    - ""
    resources:
    - configmaps
    verbs:
    - get
- apiVersion: rbac.authorization.k8s.io/v1
  kind: Role
  metadata:
    name: prometheus-telemeter
    namespace: ${NAMESPACE}
  rules:
  - apiGroups:
    - ""
    resources:
    - services
    - endpoints
    - pods
    verbs:
    - get
    - list
    - watch
- apiVersion: monitoring.coreos.com/v1
  kind: PrometheusRule
  metadata:
    labels:
      prometheus: telemeter
      role: alert-rules
    name: prometheus-telemeter-rules
    namespace: ${NAMESPACE}
  spec:
    groups: []
- apiVersion: v1
  kind: Service
  metadata:
    annotations:
      service.alpha.openshift.io/serving-cert-secret-name: prometheus-telemeter-tls
    labels:
      prometheus: telemeter
    name: prometheus-telemeter
    namespace: ${NAMESPACE}
  spec:
    ports:
    - name: https
      port: 9091
      targetPort: https
    selector:
      app: prometheus
      prometheus: telemeter
    sessionAffinity: ClientIP
    type: ClusterIP
- apiVersion: v1
  kind: ServiceAccount
  metadata:
    annotations:
      serviceaccounts.openshift.io/oauth-redirectreference.observatorium-thanos-querier: '{"kind":"OAuthRedirectReference","apiVersion":"v1","reference":{"kind":"Route","name":"observatorium-thanos-querier"}}'
      serviceaccounts.openshift.io/oauth-redirectreference.observatorium-thanos-querier-cache: '{"kind":"OAuthRedirectReference","apiVersion":"v1","reference":{"kind":"Route","name":"observatorium-thanos-querier-cache"}}'
      serviceaccounts.openshift.io/oauth-redirectreference.prometheus-k8s: '{"kind":"OAuthRedirectReference","apiVersion":"v1","reference":{"kind":"Route","name":"prometheus-telemeter"}}'
    name: prometheus-telemeter
    namespace: ${NAMESPACE}
- apiVersion: monitoring.coreos.com/v1
  kind: ServiceMonitor
  metadata:
    labels:
      k8s-app: prometheus
    name: prometheus-telemeter
    namespace: ${NAMESPACE}
  spec:
    endpoints:
    - bearerTokenFile: /var/run/secrets/kubernetes.io/serviceaccount/token
      honorLabels: true
      interval: 30s
      port: https
      scheme: https
      tlsConfig:
        caFile: /var/run/secrets/kubernetes.io/serviceaccount/service-ca.crt
        serverName: prometheus-telemeter.${NAMESPACE}.svc
    selector:
      matchLabels:
        prometheus: telemeter
parameters:
- name: IMAGE_TAG
  value: ""
- name: NAMESPACE
  value: telemeter
- name: PROMETHEUS_IMAGE
  value: quay.io/prometheus/prometheus
- name: PROMETHEUS_IMAGE_TAG
  value: v2.3.2
- name: PROXY_IMAGE
  value: openshift/oauth-proxy
- name: PROXY_IMAGE_TAG
  value: v1.1.0
- name: PROMETHEUS_CPU_REQUEST
  value: "0"
- name: PROMETHEUS_CPU_LIMIT
  value: "0"
- name: PROMETHEUS_MEMORY_REQUEST
  value: 400Mi
- name: PROMETHEUS_MEMORY_LIMIT
  value: "0"
