apiVersion: monitoring.coreos.com/v1
kind: Prometheus
metadata:
  labels:
    prometheus: k8s
  name: k8s
  namespace: openshift-monitoring
spec:
  affinity:
    podAntiAffinity:
      preferredDuringSchedulingIgnoredDuringExecution:
      - podAffinityTerm:
          labelSelector:
            matchExpressions:
            - key: prometheus
              operator: In
              values:
              - k8s
          namespaces:
          - openshift-monitoring
          topologyKey: kubernetes.io/hostname
        weight: 100
  alerting:
    alertmanagers:
    - apiVersion: v2
      bearerTokenFile: /var/run/secrets/kubernetes.io/serviceaccount/token
      name: alertmanager-main
      namespace: openshift-monitoring
      port: web
      scheme: https
      tlsConfig:
        caFile: /etc/prometheus/configmaps/serving-certs-ca-bundle/service-ca.crt
        serverName: alertmanager-main
  configMaps:
  - serving-certs-ca-bundle
  - kubelet-serving-ca-bundle
  containers:
  - args:
    - -provider=openshift
    - -https-address=:9091
    - -http-address=
    - -email-domain=*
    - -upstream=http://localhost:9090
    - -htpasswd-file=/etc/proxy/htpasswd/auth
    - -openshift-service-account=prometheus-k8s
    - '-openshift-sar={"resource": "namespaces", "verb": "get"}'
    - '-openshift-delegate-urls={"/": {"resource": "namespaces", "verb": "get"}}'
    - -tls-cert=/etc/tls/private/tls.crt
    - -tls-key=/etc/tls/private/tls.key
    - -client-secret-file=/var/run/secrets/kubernetes.io/serviceaccount/token
    - -cookie-secret-file=/etc/proxy/secrets/session_secret
    - -openshift-ca=/etc/pki/tls/cert.pem
    - -openshift-ca=/var/run/secrets/kubernetes.io/serviceaccount/ca.crt
    - -skip-auth-regex=^/metrics
    env:
    - name: HTTP_PROXY
      value: ""
    - name: HTTPS_PROXY
      value: ""
    - name: NO_PROXY
      value: ""
    image: quay.io/openshift/oauth-proxy:latest
    name: prometheus-proxy
    ports:
    - containerPort: 9091
      name: web
    resources:
      requests:
        cpu: 1m
        memory: 20Mi
    terminationMessagePolicy: FallbackToLogsOnError
    volumeMounts:
    - mountPath: /etc/tls/private
      name: secret-prometheus-k8s-tls
    - mountPath: /etc/proxy/secrets
      name: secret-prometheus-k8s-proxy
    - mountPath: /etc/proxy/htpasswd
      name: secret-prometheus-k8s-htpasswd
  - args:
    - --secure-listen-address=0.0.0.0:9092
    - --upstream=http://127.0.0.1:9095
    - --config-file=/etc/kube-rbac-proxy/config.yaml
    - --tls-cert-file=/etc/tls/private/tls.crt
    - --tls-private-key-file=/etc/tls/private/tls.key
    - --tls-cipher-suites=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305
    - --logtostderr=true
    - --v=10
    image: quay.io/coreos/kube-rbac-proxy:v0.8.0
    name: kube-rbac-proxy
    ports:
    - containerPort: 9092
      name: tenancy
    resources:
      requests:
        cpu: 1m
        memory: 20Mi
    terminationMessagePolicy: FallbackToLogsOnError
    volumeMounts:
    - mountPath: /etc/tls/private
      name: secret-prometheus-k8s-tls
    - mountPath: /etc/kube-rbac-proxy
      name: secret-kube-rbac-proxy
  - args:
    - --insecure-listen-address=127.0.0.1:9095
    - --upstream=http://127.0.0.1:9090
    - --label=namespace
    image: quay.io/coreos/prom-label-proxy:v0.2.0
    name: prom-label-proxy
    resources:
      requests:
        cpu: 1m
        memory: 20Mi
    terminationMessagePolicy: FallbackToLogsOnError
  - args:
    - --secure-listen-address=[$(POD_IP)]:10902
    - --upstream=http://127.0.0.1:10902
    - --tls-cert-file=/etc/tls/private/tls.crt
    - --tls-private-key-file=/etc/tls/private/tls.key
    - --tls-cipher-suites=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305
    - --allow-paths=/metrics
    - --logtostderr=true
    env:
    - name: POD_IP
      valueFrom:
        fieldRef:
          fieldPath: status.podIP
    image: quay.io/coreos/kube-rbac-proxy:v0.8.0
    name: kube-rbac-proxy-thanos
    ports:
    - containerPort: 10902
      name: thanos-proxy
    resources:
      requests:
        cpu: 1m
        memory: 10Mi
    terminationMessagePolicy: FallbackToLogsOnError
    volumeMounts:
    - mountPath: /etc/tls/private
      name: secret-prometheus-k8s-thanos-sidecar-tls
  - args:
    - sidecar
    - --prometheus.url=http://localhost:9090/
    - --tsdb.path=/prometheus
    - --grpc-address=[$(POD_IP)]:10901
    - --http-address=127.0.0.1:10902
    - --grpc-server-tls-cert=/etc/tls/grpc/server.crt
    - --grpc-server-tls-key=/etc/tls/grpc/server.key
    - --grpc-server-tls-client-ca=/etc/tls/grpc/ca.crt
    name: thanos-sidecar
    resources:
      requests:
        cpu: 1m
    volumeMounts:
    - mountPath: /etc/tls/grpc
      name: secret-grpc-tls
  - name: prometheus
  - name: config-reloader
    resources:
      requests:
        cpu: 1m
        memory: 10Mi
  image: openshift/prometheus:v2.23.0
  listenLocal: true
  nodeSelector:
    kubernetes.io/os: linux
  podMonitorNamespaceSelector: {}
  podMonitorSelector: {}
  priorityClassName: system-cluster-critical
  probeNamespaceSelector: {}
  probeSelector: {}
  replicas: 2
  resources:
    requests:
      cpu: 70m
      memory: 1Gi
  ruleNamespaceSelector: {}
  ruleSelector: {}
  secrets:
  - kube-etcd-client-certs
  - prometheus-k8s-tls
  - prometheus-k8s-proxy
  - prometheus-k8s-htpasswd
  - prometheus-k8s-thanos-sidecar-tls
  - kube-rbac-proxy
  securityContext:
    fsGroup: 65534
    runAsNonRoot: true
    runAsUser: 65534
  serviceAccountName: prometheus-k8s
  serviceMonitorNamespaceSelector: {}
  serviceMonitorSelector: {}
  thanos:
    image: quay.io/openshift/origin-thanos:v0.17.2
    resources:
      requests:
        cpu: 1m
        memory: 100Mi
    version: v0.17.2
  version: v2.23.0
