apiVersion: monitoring.coreos.com/v1
kind: ThanosRuler
metadata:
  labels:
    thanosRulerName: user-workload
  name: user-workload
  namespace: openshift-user-workload-monitoring
spec:
  alertmanagersConfig:
    key: alertmanagers.yaml
    name: thanos-ruler-alertmanagers-config
  containers:
  - name: thanos-ruler
    terminationMessagePolicy: FallbackToLogsOnError
    volumeMounts:
    - mountPath: /etc/tls/private
      name: secret-thanos-ruler-tls
    - mountPath: /etc/tls/grpc
      name: secret-grpc-tls
    - mountPath: /etc/prometheus/configmaps/serving-certs-ca-bundle
      name: serving-certs-ca-bundle
  - args:
    - -provider=openshift
    - -https-address=:9091
    - -http-address=
    - -email-domain=*
    - -upstream=http://localhost:10902
    - '-openshift-sar={"resource": "namespaces", "verb": "get"}'
    - '-openshift-delegate-urls={"/": {"resource": "namespaces", "verb": "get"}}'
    - -tls-cert=/etc/tls/private/tls.crt
    - -tls-key=/etc/tls/private/tls.key
    - -client-secret-file=/var/run/secrets/kubernetes.io/serviceaccount/token
    - -cookie-secret-file=/etc/proxy/secrets/session_secret
    - -openshift-service-account=thanos-ruler
    - -openshift-ca=/etc/pki/tls/cert.pem
    - -openshift-ca=/var/run/secrets/kubernetes.io/serviceaccount/ca.crt
    env:
    - name: HTTP_PROXY
      value: ""
    - name: HTTPS_PROXY
      value: ""
    - name: NO_PROXY
      value: ""
    image: quay.io/openshift/oauth-proxy:latest
    name: thanos-ruler-proxy
    ports:
    - containerPort: 9091
      name: web
    resources:
      requests:
        cpu: 1m
        memory: 12Mi
    terminationMessagePolicy: FallbackToLogsOnError
    volumeMounts:
    - mountPath: /etc/tls/private
      name: secret-thanos-ruler-tls
    - mountPath: /etc/proxy/secrets
      name: secret-thanos-ruler-oauth-cookie
  - name: config-reloader
    resources:
      requests:
        cpu: 1m
        memory: 10Mi
  enforcedNamespaceLabel: namespace
  grpcServerTlsConfig:
    caFile: /etc/tls/grpc/ca.crt
    certFile: /etc/tls/grpc/server.crt
    keyFile: /etc/tls/grpc/server.key
  image: quay.io/thanos/thanos:v0.20.2
  listenLocal: true
  podMetadata:
    annotations:
      target.workload.openshift.io/management: '{"effect": "PreferredDuringScheduling"}'
  priorityClassName: openshift-user-critical
  queryConfig:
    key: query.yaml
    name: thanos-ruler-query-config
  replicas: 2
  resources:
    requests:
      cpu: 1m
      memory: 21Mi
  ruleNamespaceSelector:
    matchExpressions:
    - key: openshift.io/cluster-monitoring
      operator: NotIn
      values:
      - "true"
  ruleSelector:
    matchExpressions:
    - key: openshift.io/prometheus-rule-evaluation-scope
      operator: NotIn
      values:
      - leaf-prometheus
  securityContext:
    fsGroup: 65534
    runAsNonRoot: true
    runAsUser: 65534
  serviceAccountName: thanos-ruler
  volumes:
  - configmap:
      name: serving-certs-ca-bundle
    name: serving-certs-ca-bundle
  - name: secret-thanos-ruler-tls
    secret:
      secretName: thanos-ruler-tls
  - name: secret-thanos-ruler-oauth-cookie
    secret:
      secretName: thanos-ruler-oauth-cookie
  - name: secret-thanos-ruler-oauth-htpasswd
    secret:
      secretName: thanos-ruler-oauth-htpasswd
