apiVersion: monitoring.coreos.com/v1
kind: Alertmanager
metadata:
  labels:
    alertmanager: main
  name: main
  namespace: openshift-monitoring
spec:
  affinity:
    podAntiAffinity:
      preferredDuringSchedulingIgnoredDuringExecution:
      - podAffinityTerm:
          labelSelector:
            matchExpressions:
            - key: alertmanager
              operator: In
              values:
              - main
          namespaces:
          - openshift-monitoring
          topologyKey: kubernetes.io/hostname
        weight: 100
  containers:
  - args:
    - -provider=openshift
    - -https-address=:9095
    - -http-address=
    - -email-domain=*
    - -upstream=http://localhost:9093
    - '-openshift-sar={"resource": "namespaces", "verb": "get"}'
    - '-openshift-delegate-urls={"/": {"resource": "namespaces", "verb": "get"}}'
    - -tls-cert=/etc/tls/private/tls.crt
    - -tls-key=/etc/tls/private/tls.key
    - -client-secret-file=/var/run/secrets/kubernetes.io/serviceaccount/token
    - -cookie-secret-file=/etc/proxy/secrets/session_secret
    - -openshift-service-account=alertmanager-main
    - -openshift-ca=/etc/pki/tls/cert.pem
    - -openshift-ca=/var/run/secrets/kubernetes.io/serviceaccount/ca.crt
    - -skip-auth-regex=^/metrics
    env:
    - name: HTTP_PROXY
      value: ""
    - name: HTTPS_PROXY
      value: ""
    - name: NO_PROXY
      value: ""
    image: quay.io/openshift/oauth-proxy:latest
    name: alertmanager-proxy
    ports:
    - containerPort: 9095
      name: web
    resources:
      requests:
        cpu: 1m
        memory: 20Mi
    terminationMessagePolicy: FallbackToLogsOnError
    volumeMounts:
    - mountPath: /etc/tls/private
      name: secret-alertmanager-main-tls
    - mountPath: /etc/proxy/secrets
      name: secret-alertmanager-main-proxy
  - args:
    - --secure-listen-address=0.0.0.0:9092
    - --upstream=http://127.0.0.1:9096
    - --config-file=/etc/kube-rbac-proxy/config.yaml
    - --tls-cert-file=/etc/tls/private/tls.crt
    - --tls-private-key-file=/etc/tls/private/tls.key
    - --tls-cipher-suites=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305
    - --logtostderr=true
    - --v=10
    image: quay.io/coreos/kube-rbac-proxy:v0.8.0
    name: kube-rbac-proxy
    ports:
    - containerPort: 9092
      name: tenancy
    resources:
      requests:
        cpu: 1m
        memory: 20Mi
    terminationMessagePolicy: FallbackToLogsOnError
    volumeMounts:
    - mountPath: /etc/kube-rbac-proxy
      name: secret-alertmanager-kube-rbac-proxy
    - mountPath: /etc/tls/private
      name: secret-alertmanager-main-tls
  - args:
    - --insecure-listen-address=127.0.0.1:9096
    - --upstream=http://127.0.0.1:9093
    - --label=namespace
    image: quay.io/coreos/prom-label-proxy:v0.2.0
    name: prom-label-proxy
    resources:
      requests:
        cpu: 1m
        memory: 20Mi
    terminationMessagePolicy: FallbackToLogsOnError
  - name: config-reloader
    resources:
      requests:
        cpu: 1m
        memory: 10Mi
  image: openshift/prometheus-alertmanager:v0.21.0
  listenLocal: true
  nodeSelector:
    kubernetes.io/os: linux
  priorityClassName: system-cluster-critical
  replicas: 3
  resources:
    requests:
      cpu: 4m
  secrets:
  - alertmanager-main-tls
  - alertmanager-main-proxy
  - alertmanager-kube-rbac-proxy
  securityContext:
    fsGroup: 65534
    runAsNonRoot: true
    runAsUser: 65534
  serviceAccountName: alertmanager-main
  version: v0.21.0
