feat(container): update image thanos to v12.20.3

[renovate]

This PR contains the following updates:

Package	Update	Change
thanos (source)	minor	12.8.6 -> 12.20.3

---

Configuration

📅 Schedule: Branch creation - "on saturday" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate. View repository job log here.

[github-actions]

--- kubernetes/apps/monitoring/thanos/app Kustomization: flux-system/cluster-apps-thanos HelmRelease: monitoring/thanos

+++ kubernetes/apps/monitoring/thanos/app Kustomization: flux-system/cluster-apps-thanos HelmRelease: monitoring/thanos

@@ -14,13 +14,13 @@

     spec:
       chart: thanos
       sourceRef:
         kind: HelmRepository
         name: bitnami
         namespace: flux-system
-      version: 12.8.6
+      version: 12.20.3
   install:
     createNamespace: true
     remediation:
       retries: 3
   interval: 15m
   maxHistory: 3

[github-actions]

--- HelmRelease: monitoring/thanos ServiceAccount: monitoring/thanos-bucketweb

+++ HelmRelease: monitoring/thanos ServiceAccount: monitoring/thanos-bucketweb

@@ -2,12 +2,12 @@

 apiVersion: v1
 kind: ServiceAccount
 metadata:
   name: thanos-bucketweb
   namespace: monitoring
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: bucketweb
 automountServiceAccountToken: true
 
--- HelmRelease: monitoring/thanos ServiceAccount: monitoring/thanos-compactor

+++ HelmRelease: monitoring/thanos ServiceAccount: monitoring/thanos-compactor

@@ -2,12 +2,12 @@

 apiVersion: v1
 kind: ServiceAccount
 metadata:
   name: thanos-compactor
   namespace: monitoring
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: compactor
 automountServiceAccountToken: true
 
--- HelmRelease: monitoring/thanos ServiceAccount: monitoring/thanos-query-frontend

+++ HelmRelease: monitoring/thanos ServiceAccount: monitoring/thanos-query-frontend

@@ -2,12 +2,12 @@

 apiVersion: v1
 kind: ServiceAccount
 metadata:
   name: thanos-query-frontend
   namespace: monitoring
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: query-frontend
 automountServiceAccountToken: true
 
--- HelmRelease: monitoring/thanos ServiceAccount: monitoring/thanos-query

+++ HelmRelease: monitoring/thanos ServiceAccount: monitoring/thanos-query

@@ -2,12 +2,12 @@

 apiVersion: v1
 kind: ServiceAccount
 metadata:
   name: thanos-query
   namespace: monitoring
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: query
 automountServiceAccountToken: true
 
--- HelmRelease: monitoring/thanos ServiceAccount: monitoring/thanos-ruler

+++ HelmRelease: monitoring/thanos ServiceAccount: monitoring/thanos-ruler

@@ -2,12 +2,12 @@

 apiVersion: v1
 kind: ServiceAccount
 metadata:
   name: thanos-ruler
   namespace: monitoring
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: ruler
 automountServiceAccountToken: true
 
--- HelmRelease: monitoring/thanos ServiceAccount: monitoring/thanos-storegateway

+++ HelmRelease: monitoring/thanos ServiceAccount: monitoring/thanos-storegateway

@@ -2,12 +2,12 @@

 apiVersion: v1
 kind: ServiceAccount
 metadata:
   name: thanos-storegateway
   namespace: monitoring
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: storegateway
 automountServiceAccountToken: true
 
--- HelmRelease: monitoring/thanos ConfigMap: monitoring/thanos-query-frontend-configmap

+++ HelmRelease: monitoring/thanos ConfigMap: monitoring/thanos-query-frontend-configmap

@@ -2,15 +2,15 @@

 apiVersion: v1
 kind: ConfigMap
 metadata:
   name: thanos-query-frontend-configmap
   namespace: monitoring
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: query-frontend
 data:
   config.yml: |-
     type: IN-MEMORY
     config:
       max_size: 1GB
--- HelmRelease: monitoring/thanos ConfigMap: monitoring/thanos-ruler-configmap

+++ HelmRelease: monitoring/thanos ConfigMap: monitoring/thanos-ruler-configmap

@@ -2,15 +2,15 @@

 apiVersion: v1
 kind: ConfigMap
 metadata:
   name: thanos-ruler-configmap
   namespace: monitoring
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: ruler
 data:
   ruler.yml: |-
     groups:
       - name: "PrometheusWatcher"
         rules:
--- HelmRelease: monitoring/thanos PersistentVolumeClaim: monitoring/thanos-compactor

+++ HelmRelease: monitoring/thanos PersistentVolumeClaim: monitoring/thanos-compactor

@@ -2,15 +2,15 @@

 kind: PersistentVolumeClaim
 apiVersion: v1
 metadata:
   name: thanos-compactor
   namespace: monitoring
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: compactor
 spec:
   accessModes:
   - ReadWriteOnce
   resources:
     requests:
--- HelmRelease: monitoring/thanos Service: monitoring/thanos-bucketweb

+++ HelmRelease: monitoring/thanos Service: monitoring/thanos-bucketweb

@@ -2,24 +2,24 @@

 apiVersion: v1
 kind: Service
 metadata:
   name: thanos-bucketweb
   namespace: monitoring
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: bucketweb
     prometheus-operator/monitor: 'true'
 spec:
   type: ClusterIP
   ports:
   - port: 8080
     targetPort: http
     protocol: TCP
     name: http
     nodePort: null
   selector:
+    app.kubernetes.io/instance: thanos
     app.kubernetes.io/name: thanos
-    app.kubernetes.io/instance: thanos
     app.kubernetes.io/component: bucketweb
 
--- HelmRelease: monitoring/thanos Service: monitoring/thanos-compactor

+++ HelmRelease: monitoring/thanos Service: monitoring/thanos-compactor

@@ -2,24 +2,24 @@

 apiVersion: v1
 kind: Service
 metadata:
   name: thanos-compactor
   namespace: monitoring
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: compactor
     prometheus-operator/monitor: 'true'
 spec:
   type: ClusterIP
   ports:
   - port: 9090
     targetPort: http
     protocol: TCP
     name: http
     nodePort: null
   selector:
+    app.kubernetes.io/instance: thanos
     app.kubernetes.io/name: thanos
-    app.kubernetes.io/instance: thanos
     app.kubernetes.io/component: compactor
 
--- HelmRelease: monitoring/thanos Service: monitoring/thanos-query-frontend

+++ HelmRelease: monitoring/thanos Service: monitoring/thanos-query-frontend

@@ -2,24 +2,24 @@

 apiVersion: v1
 kind: Service
 metadata:
   name: thanos-query-frontend
   namespace: monitoring
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: query-frontend
     prometheus-operator/monitor: 'true'
 spec:
   type: ClusterIP
   ports:
   - port: 9090
     targetPort: http
     protocol: TCP
     name: http
     nodePort: null
   selector:
+    app.kubernetes.io/instance: thanos
     app.kubernetes.io/name: thanos
-    app.kubernetes.io/instance: thanos
     app.kubernetes.io/component: query-frontend
 
--- HelmRelease: monitoring/thanos Service: monitoring/thanos-query-grpc

+++ HelmRelease: monitoring/thanos Service: monitoring/thanos-query-grpc

@@ -2,23 +2,23 @@

 apiVersion: v1
 kind: Service
 metadata:
   name: thanos-query-grpc
   namespace: monitoring
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: query
 spec:
   type: ClusterIP
   ports:
   - port: 10901
     targetPort: grpc
     protocol: TCP
     name: grpc
     nodePort: null
   selector:
+    app.kubernetes.io/instance: thanos
     app.kubernetes.io/name: thanos
-    app.kubernetes.io/instance: thanos
     app.kubernetes.io/component: query
 
--- HelmRelease: monitoring/thanos Service: monitoring/thanos-query

+++ HelmRelease: monitoring/thanos Service: monitoring/thanos-query

@@ -2,24 +2,24 @@

 apiVersion: v1
 kind: Service
 metadata:
   name: thanos-query
   namespace: monitoring
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: query
     prometheus-operator/monitor: 'true'
 spec:
   type: ClusterIP
   ports:
   - port: 9090
     targetPort: http
     protocol: TCP
     name: http
     nodePort: null
   selector:
+    app.kubernetes.io/instance: thanos
     app.kubernetes.io/name: thanos
-    app.kubernetes.io/instance: thanos
     app.kubernetes.io/component: query
 
--- HelmRelease: monitoring/thanos Service: monitoring/thanos-ruler

+++ HelmRelease: monitoring/thanos Service: monitoring/thanos-ruler

@@ -2,15 +2,15 @@

 apiVersion: v1
 kind: Service
 metadata:
   name: thanos-ruler
   namespace: monitoring
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: ruler
     prometheus-operator/monitor: 'true'
 spec:
   type: ClusterIP
   ports:
   - port: 9090
@@ -21,10 +21,10 @@

   - port: 10901
     targetPort: grpc
     protocol: TCP
     name: grpc
     nodePort: null
   selector:
+    app.kubernetes.io/instance: thanos
     app.kubernetes.io/name: thanos
-    app.kubernetes.io/instance: thanos
     app.kubernetes.io/component: ruler
 
--- HelmRelease: monitoring/thanos Service: monitoring/thanos-storegateway

+++ HelmRelease: monitoring/thanos Service: monitoring/thanos-storegateway

@@ -2,15 +2,15 @@

 apiVersion: v1
 kind: Service
 metadata:
   name: thanos-storegateway
   namespace: monitoring
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: storegateway
     prometheus-operator/monitor: 'true'
 spec:
   type: ClusterIP
   ports:
   - port: 9090
@@ -21,10 +21,10 @@

   - port: 10901
     targetPort: grpc
     protocol: TCP
     name: grpc
     nodePort: null
   selector:
+    app.kubernetes.io/instance: thanos
     app.kubernetes.io/name: thanos
-    app.kubernetes.io/instance: thanos
     app.kubernetes.io/component: storegateway
 
--- HelmRelease: monitoring/thanos Deployment: monitoring/thanos-bucketweb

+++ HelmRelease: monitoring/thanos Deployment: monitoring/thanos-bucketweb

@@ -2,59 +2,65 @@

 apiVersion: apps/v1
 kind: Deployment
 metadata:
   name: thanos-bucketweb
   namespace: monitoring
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: bucketweb
 spec:
   replicas: 1
   strategy:
     type: RollingUpdate
   selector:
     matchLabels:
+      app.kubernetes.io/instance: thanos
       app.kubernetes.io/name: thanos
-      app.kubernetes.io/instance: thanos
       app.kubernetes.io/component: bucketweb
   template:
     metadata:
       labels:
-        app.kubernetes.io/name: thanos
         app.kubernetes.io/instance: thanos
         app.kubernetes.io/managed-by: Helm
+        app.kubernetes.io/name: thanos
         app.kubernetes.io/component: bucketweb
       annotations:
-        checksum/objstore-configuration: bbcc3341caa8a68484441f78da2f3deb128366481d08498a821918c0606935fd
+        checksum/objstore-configuration: a1017233f2efea99a6798127840be03b42b441374e8436ff4448d0b8e84c0054
     spec:
       serviceAccountName: thanos-bucketweb
       automountServiceAccountToken: true
       affinity:
         podAffinity: null
         podAntiAffinity:
           requiredDuringSchedulingIgnoredDuringExecution:
           - labelSelector:
               matchLabels:
+                app.kubernetes.io/instance: thanos
                 app.kubernetes.io/name: thanos
-                app.kubernetes.io/instance: thanos
                 app.kubernetes.io/component: bucketweb
             topologyKey: kubernetes.io/hostname
         nodeAffinity: null
       securityContext:
         fsGroup: 1001
       containers:
       - name: bucketweb
         image: quay.io/thanos/thanos:v0.33.0
         imagePullPolicy: IfNotPresent
         securityContext:
           allowPrivilegeEscalation: false
+          capabilities:
+            drop:
+            - ALL
+          privileged: false
           readOnlyRootFilesystem: true
           runAsNonRoot: true
           runAsUser: 1001
+          seccompProfile:
+            type: RuntimeDefault
         args:
         - tools
         - bucket
         - web
         - --http-address=0.0.0.0:8080
         - --log.level=info
--- HelmRelease: monitoring/thanos Deployment: monitoring/thanos-compactor

+++ HelmRelease: monitoring/thanos Deployment: monitoring/thanos-compactor

@@ -2,61 +2,67 @@

 apiVersion: apps/v1
 kind: Deployment
 metadata:
   name: thanos-compactor
   namespace: monitoring
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: compactor
 spec:
   replicas: 1
   strategy:
     type: Recreate
   selector:
     matchLabels:
+      app.kubernetes.io/instance: thanos
       app.kubernetes.io/name: thanos
-      app.kubernetes.io/instance: thanos
       app.kubernetes.io/component: compactor
   template:
     metadata:
       labels:
-        app.kubernetes.io/name: thanos
         app.kubernetes.io/instance: thanos
         app.kubernetes.io/managed-by: Helm
+        app.kubernetes.io/name: thanos
         app.kubernetes.io/component: compactor
       annotations:
-        checksum/objstore-configuration: bbcc3341caa8a68484441f78da2f3deb128366481d08498a821918c0606935fd
+        checksum/objstore-configuration: a1017233f2efea99a6798127840be03b42b441374e8436ff4448d0b8e84c0054
     spec:
       serviceAccountName: thanos-compactor
       automountServiceAccountToken: true
       affinity:
         podAffinity: null
         podAntiAffinity:
           preferredDuringSchedulingIgnoredDuringExecution:
           - podAffinityTerm:
               labelSelector:
                 matchLabels:
+                  app.kubernetes.io/instance: thanos
                   app.kubernetes.io/name: thanos
-                  app.kubernetes.io/instance: thanos
                   app.kubernetes.io/component: compactor
               topologyKey: kubernetes.io/hostname
             weight: 1
         nodeAffinity: null
       securityContext:
         fsGroup: 1001
       containers:
       - name: compactor
         image: quay.io/thanos/thanos:v0.33.0
         imagePullPolicy: IfNotPresent
         securityContext:
           allowPrivilegeEscalation: false
+          capabilities:
+            drop:
+            - ALL
+          privileged: false
           readOnlyRootFilesystem: true
           runAsNonRoot: true
           runAsUser: 1001
+          seccompProfile:
+            type: RuntimeDefault
         args:
         - compact
         - --log.level=info
         - --log.format=logfmt
         - --http-address=0.0.0.0:10902
         - --data-dir=/data
--- HelmRelease: monitoring/thanos Deployment: monitoring/thanos-query-frontend

+++ HelmRelease: monitoring/thanos Deployment: monitoring/thanos-query-frontend

@@ -2,61 +2,67 @@

 apiVersion: apps/v1
 kind: Deployment
 metadata:
   name: thanos-query-frontend
   namespace: monitoring
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: query-frontend
 spec:
   replicas: 1
   strategy:
     type: RollingUpdate
   selector:
     matchLabels:
+      app.kubernetes.io/instance: thanos
       app.kubernetes.io/name: thanos
-      app.kubernetes.io/instance: thanos
       app.kubernetes.io/component: query-frontend
   template:
     metadata:
       labels:
-        app.kubernetes.io/name: thanos
         app.kubernetes.io/instance: thanos
         app.kubernetes.io/managed-by: Helm
+        app.kubernetes.io/name: thanos
         app.kubernetes.io/component: query-frontend
       annotations:
-        checksum/query-frontend-configuration: 3465b2cffb8f5256c7e98a802f931dc1ae81a49606637036b29450e0f624c389
+        checksum/query-frontend-configuration: f5f447996d07c4b62f1813f9f13b89f420426b8619376cf27862dd60c44b6c8f
     spec:
       serviceAccountName: thanos-query-frontend
       automountServiceAccountToken: true
       affinity:
         podAffinity: null
         podAntiAffinity:
           preferredDuringSchedulingIgnoredDuringExecution:
           - podAffinityTerm:
               labelSelector:
                 matchLabels:
+                  app.kubernetes.io/instance: thanos
                   app.kubernetes.io/name: thanos
-                  app.kubernetes.io/instance: thanos
                   app.kubernetes.io/component: query-frontend
               topologyKey: kubernetes.io/hostname
             weight: 1
         nodeAffinity: null
       securityContext:
         fsGroup: 1001
       containers:
       - name: query-frontend
         image: quay.io/thanos/thanos:v0.33.0
         imagePullPolicy: IfNotPresent
         securityContext:
           allowPrivilegeEscalation: false
+          capabilities:
+            drop:
+            - ALL
+          privileged: false
           readOnlyRootFilesystem: true
           runAsNonRoot: true
           runAsUser: 1001
+          seccompProfile:
+            type: RuntimeDefault
         args:
         - query-frontend
         - --log.level=info
         - --log.format=logfmt
         - --http-address=0.0.0.0:10902
         - --query-frontend.downstream-url=http://thanos-query:9090
--- HelmRelease: monitoring/thanos Deployment: monitoring/thanos-query

+++ HelmRelease: monitoring/thanos Deployment: monitoring/thanos-query

@@ -2,67 +2,74 @@

 apiVersion: apps/v1
 kind: Deployment
 metadata:
   name: thanos-query
   namespace: monitoring
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: query
 spec:
   replicas: 1
   strategy:
     type: RollingUpdate
   selector:
     matchLabels:
+      app.kubernetes.io/instance: thanos
       app.kubernetes.io/name: thanos
-      app.kubernetes.io/instance: thanos
       app.kubernetes.io/component: query
   template:
     metadata:
       labels:
-        app.kubernetes.io/name: thanos
         app.kubernetes.io/instance: thanos
         app.kubernetes.io/managed-by: Helm
+        app.kubernetes.io/name: thanos
         app.kubernetes.io/component: query
     spec:
       serviceAccountName: thanos-query
       automountServiceAccountToken: true
       affinity:
         podAffinity: null
         podAntiAffinity:
           requiredDuringSchedulingIgnoredDuringExecution:
           - labelSelector:
               matchLabels:
+                app.kubernetes.io/instance: thanos
                 app.kubernetes.io/name: thanos
-                app.kubernetes.io/instance: thanos
                 app.kubernetes.io/component: query
             topologyKey: kubernetes.io/hostname
         nodeAffinity: null
       securityContext:
         fsGroup: 1001
       containers:
       - name: query
         image: quay.io/thanos/thanos:v0.33.0
         imagePullPolicy: IfNotPresent
         securityContext:
           allowPrivilegeEscalation: false
+          capabilities:
+            drop:
+            - ALL
+          privileged: false
           readOnlyRootFilesystem: true
           runAsNonRoot: true
           runAsUser: 1001
+          seccompProfile:
+            type: RuntimeDefault
         args:
         - query
         - --log.level=info
         - --log.format=logfmt
         - --grpc-address=0.0.0.0:10901
         - --http-address=0.0.0.0:10902
         - --query.replica-label=__replica__
         - --endpoint=dnssrv+_grpc._tcp.kube-prometheus-stack-thanos-discovery.monitoring.svc.cluster.local
         - --endpoint=dnssrv+_grpc._tcp.thanos-storegateway.monitoring.svc.cluster.local
         - --endpoint=dnssrv+_grpc._tcp.thanos-ruler.monitoring.svc.cluster.local
+        - --alert.query-url=http://thanos.${SECRET_DOMAIN}
         - --query.auto-downsampling
         ports:
         - name: http
           containerPort: 10902
           protocol: TCP
         - name: grpc
--- HelmRelease: monitoring/thanos StatefulSet: monitoring/thanos-ruler

+++ HelmRelease: monitoring/thanos StatefulSet: monitoring/thanos-ruler

@@ -2,73 +2,79 @@

 apiVersion: apps/v1
 kind: StatefulSet
 metadata:
   name: thanos-ruler
   namespace: monitoring
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: ruler
 spec:
   replicas: 1
   podManagementPolicy: OrderedReady
   serviceName: thanos-ruler-headless
   updateStrategy:
     type: RollingUpdate
   selector:
     matchLabels:
+      app.kubernetes.io/instance: thanos
       app.kubernetes.io/name: thanos
-      app.kubernetes.io/instance: thanos
       app.kubernetes.io/component: ruler
   template:
     metadata:
       labels:
-        app.kubernetes.io/name: thanos
         app.kubernetes.io/instance: thanos
         app.kubernetes.io/managed-by: Helm
+        app.kubernetes.io/name: thanos
         app.kubernetes.io/component: ruler
       annotations:
-        checksum/objstore-configuration: bbcc3341caa8a68484441f78da2f3deb128366481d08498a821918c0606935fd
-        checksum/ruler-configuration: 021be2123178e57bd00e72f72cfba0ed415b8cfe5c2940cba0c470781ffa39c2
+        checksum/objstore-configuration: a1017233f2efea99a6798127840be03b42b441374e8436ff4448d0b8e84c0054
+        checksum/ruler-configuration: af2227ce8475e68d60b3b1def30f7e4c1dce50d9841bf9daa5d171f309d3e115
     spec:
       serviceAccountName: thanos-ruler
       automountServiceAccountToken: true
       affinity:
         podAffinity: null
         podAntiAffinity:
           requiredDuringSchedulingIgnoredDuringExecution:
           - labelSelector:
               matchLabels:
+                app.kubernetes.io/instance: thanos
                 app.kubernetes.io/name: thanos
-                app.kubernetes.io/instance: thanos
                 app.kubernetes.io/component: ruler
             topologyKey: kubernetes.io/hostname
         nodeAffinity: null
       securityContext:
         fsGroup: 1001
       containers:
       - name: ruler
         image: quay.io/thanos/thanos:v0.33.0
         imagePullPolicy: IfNotPresent
         securityContext:
           allowPrivilegeEscalation: false
+          capabilities:
+            drop:
+            - ALL
+          privileged: false
           readOnlyRootFilesystem: true
           runAsNonRoot: true
           runAsUser: 1001
+          seccompProfile:
+            type: RuntimeDefault
         args:
         - rule
         - --log.level=info
         - --log.format=logfmt
         - --grpc-address=0.0.0.0:10901
         - --http-address=0.0.0.0:10902
         - --data-dir=/data
         - --eval-interval=1m
         - --alertmanagers.url=http://kube-prometheus-stack-alertmanager.monitoring:9093
         - --query=dnssrv+_http._tcp.thanos-query.monitoring.svc.cluster.local
-        - --alert.query-url=http://thanos-query.monitoring.svc.cluster.local:9090
+        - --alert.query-url=http://thanos.${SECRET_DOMAIN}
         - --label=replica="$(POD_NAME)"
         - --label=ruler_cluster=""
         - --alert.label-drop=replica
         - --objstore.config-file=/conf/objstore/objstore.yml
         - --rule-file=/conf/rules/*.yml
         - --web.prefix-header=X-Forwarded-Prefix
--- HelmRelease: monitoring/thanos StatefulSet: monitoring/thanos-storegateway

+++ HelmRelease: monitoring/thanos StatefulSet: monitoring/thanos-storegateway

@@ -2,61 +2,67 @@

 apiVersion: apps/v1
 kind: StatefulSet
 metadata:
   name: thanos-storegateway
   namespace: monitoring
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: storegateway
 spec:
   replicas: 1
   podManagementPolicy: OrderedReady
   serviceName: thanos-storegateway-headless
   updateStrategy:
     type: RollingUpdate
   selector:
     matchLabels:
+      app.kubernetes.io/instance: thanos
       app.kubernetes.io/name: thanos
-      app.kubernetes.io/instance: thanos
       app.kubernetes.io/component: storegateway
   template:
     metadata:
       labels:
-        app.kubernetes.io/name: thanos
         app.kubernetes.io/instance: thanos
         app.kubernetes.io/managed-by: Helm
+        app.kubernetes.io/name: thanos
         app.kubernetes.io/component: storegateway
       annotations:
-        checksum/objstore-configuration: bbcc3341caa8a68484441f78da2f3deb128366481d08498a821918c0606935fd
+        checksum/objstore-configuration: a1017233f2efea99a6798127840be03b42b441374e8436ff4448d0b8e84c0054
     spec:
       serviceAccountName: thanos-storegateway
       automountServiceAccountToken: true
       affinity:
         podAffinity: null
         podAntiAffinity:
           requiredDuringSchedulingIgnoredDuringExecution:
           - labelSelector:
               matchLabels:
+                app.kubernetes.io/instance: thanos
                 app.kubernetes.io/name: thanos
-                app.kubernetes.io/instance: thanos
                 app.kubernetes.io/component: storegateway
             topologyKey: kubernetes.io/hostname
         nodeAffinity: null
       securityContext:
         fsGroup: 1001
       containers:
       - name: storegateway
         image: quay.io/thanos/thanos:v0.33.0
         imagePullPolicy: IfNotPresent
         securityContext:
           allowPrivilegeEscalation: false
+          capabilities:
+            drop:
+            - ALL
+          privileged: false
           readOnlyRootFilesystem: true
           runAsNonRoot: true
           runAsUser: 1001
+          seccompProfile:
+            type: RuntimeDefault
         args:
         - store
         - --log.level=info
         - --log.format=logfmt
         - --grpc-address=0.0.0.0:10901
         - --http-address=0.0.0.0:10902
--- HelmRelease: monitoring/thanos Ingress: monitoring/thanos-bucketweb

+++ HelmRelease: monitoring/thanos Ingress: monitoring/thanos-bucketweb

@@ -2,20 +2,19 @@

 apiVersion: networking.k8s.io/v1
 kind: Ingress
 metadata:
   name: thanos-bucketweb
   namespace: monitoring
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: bucketweb
   annotations:
     hajimari.io/enable: 'false'
-    nginx.ingress.kubernetes.io/whitelist-source-range: |
-      10.0.0.0/8,172.16.0.0/12,192.168.0.0/16
+    nginx.ingress.kubernetes.io/whitelist-source-range: 10.0.0.0/8,172.16.0.0/12,192.168.0.0/16
 spec:
   ingressClassName: internal
   rules:
   - host: thanos-bucketweb.${SECRET_DOMAIN}
     http:
       paths:
--- HelmRelease: monitoring/thanos Ingress: monitoring/thanos-compactor

+++ HelmRelease: monitoring/thanos Ingress: monitoring/thanos-compactor

@@ -2,20 +2,19 @@

 apiVersion: networking.k8s.io/v1
 kind: Ingress
 metadata:
   name: thanos-compactor
   namespace: monitoring
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: compactor
   annotations:
     hajimari.io/enable: 'false'
-    nginx.ingress.kubernetes.io/whitelist-source-range: |
-      10.0.0.0/8,172.16.0.0/12,192.168.0.0/16
+    nginx.ingress.kubernetes.io/whitelist-source-range: 10.0.0.0/8,172.16.0.0/12,192.168.0.0/16
 spec:
   ingressClassName: internal
   rules:
   - host: thanos-compactor.${SECRET_DOMAIN}
     http:
       paths:
--- HelmRelease: monitoring/thanos Ingress: monitoring/thanos-query-frontend

+++ HelmRelease: monitoring/thanos Ingress: monitoring/thanos-query-frontend

@@ -2,20 +2,19 @@

 apiVersion: networking.k8s.io/v1
 kind: Ingress
 metadata:
   name: thanos-query-frontend
   namespace: monitoring
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: query-frontend
   annotations:
     hajimari.io/enable: 'false'
-    nginx.ingress.kubernetes.io/whitelist-source-range: |
-      10.0.0.0/8,172.16.0.0/12,192.168.0.0/16
+    nginx.ingress.kubernetes.io/whitelist-source-range: 10.0.0.0/8,172.16.0.0/12,192.168.0.0/16
 spec:
   ingressClassName: internal
   rules:
   - host: thanos.${SECRET_DOMAIN}
     http:
       paths:
--- HelmRelease: monitoring/thanos Ingress: monitoring/thanos-query

+++ HelmRelease: monitoring/thanos Ingress: monitoring/thanos-query

@@ -2,20 +2,19 @@

 apiVersion: networking.k8s.io/v1
 kind: Ingress
 metadata:
   name: thanos-query
   namespace: monitoring
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: query
   annotations:
     hajimari.io/enable: 'false'
-    nginx.ingress.kubernetes.io/whitelist-source-range: |
-      10.0.0.0/8,172.16.0.0/12,192.168.0.0/16
+    nginx.ingress.kubernetes.io/whitelist-source-range: 10.0.0.0/8,172.16.0.0/12,192.168.0.0/16
 spec:
   ingressClassName: internal
   rules:
   - host: thanos-query.${SECRET_DOMAIN}
     http:
       paths:
--- HelmRelease: monitoring/thanos Ingress: monitoring/thanos-ruler

+++ HelmRelease: monitoring/thanos Ingress: monitoring/thanos-ruler

@@ -2,20 +2,19 @@

 apiVersion: networking.k8s.io/v1
 kind: Ingress
 metadata:
   name: thanos-ruler
   namespace: monitoring
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: ruler
   annotations:
     hajimari.io/enable: 'false'
-    nginx.ingress.kubernetes.io/whitelist-source-range: |
-      10.0.0.0/8,172.16.0.0/12,192.168.0.0/16
+    nginx.ingress.kubernetes.io/whitelist-source-range: 10.0.0.0/8,172.16.0.0/12,192.168.0.0/16
 spec:
   ingressClassName: internal
   rules:
   - host: thanos-ruler.${SECRET_DOMAIN}
     http:
       paths:
--- HelmRelease: monitoring/thanos Ingress: monitoring/thanos-storegateway

+++ HelmRelease: monitoring/thanos Ingress: monitoring/thanos-storegateway

@@ -2,20 +2,19 @@

 apiVersion: networking.k8s.io/v1
 kind: Ingress
 metadata:
   name: thanos-storegateway
   namespace: monitoring
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: storegateway
   annotations:
     hajimari.io/enable: 'false'
-    nginx.ingress.kubernetes.io/whitelist-source-range: |
-      10.0.0.0/8,172.16.0.0/12,192.168.0.0/16
+    nginx.ingress.kubernetes.io/whitelist-source-range: 10.0.0.0/8,172.16.0.0/12,192.168.0.0/16
 spec:
   ingressClassName: internal
   rules:
   - host: thanos-storegateway.${SECRET_DOMAIN}
     http:
       paths:
--- HelmRelease: monitoring/thanos ServiceMonitor: monitoring/thanos-bucketweb

+++ HelmRelease: monitoring/thanos ServiceMonitor: monitoring/thanos-bucketweb

@@ -2,23 +2,23 @@

 apiVersion: monitoring.coreos.com/v1
 kind: ServiceMonitor
 metadata:
   name: thanos-bucketweb
   namespace: monitoring
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: bucketweb
 spec:
   endpoints:
   - port: http
   namespaceSelector:
     matchNames:
     - monitoring
   selector:
     matchLabels:
+      app.kubernetes.io/instance: thanos
       app.kubernetes.io/name: thanos
-      app.kubernetes.io/instance: thanos
       app.kubernetes.io/component: bucketweb
       prometheus-operator/monitor: 'true'
 
--- HelmRelease: monitoring/thanos ServiceMonitor: monitoring/thanos-compactor

+++ HelmRelease: monitoring/thanos ServiceMonitor: monitoring/thanos-compactor

@@ -2,23 +2,23 @@

 apiVersion: monitoring.coreos.com/v1
 kind: ServiceMonitor
 metadata:
   name: thanos-compactor
   namespace: monitoring
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: compactor
 spec:
   endpoints:
   - port: http
   namespaceSelector:
     matchNames:
     - monitoring
   selector:
     matchLabels:
+      app.kubernetes.io/instance: thanos
       app.kubernetes.io/name: thanos
-      app.kubernetes.io/instance: thanos
       app.kubernetes.io/component: compactor
       prometheus-operator/monitor: 'true'
 
--- HelmRelease: monitoring/thanos ServiceMonitor: monitoring/thanos-query-frontend

+++ HelmRelease: monitoring/thanos ServiceMonitor: monitoring/thanos-query-frontend

@@ -2,23 +2,23 @@

 apiVersion: monitoring.coreos.com/v1
 kind: ServiceMonitor
 metadata:
   name: thanos-query-frontend
   namespace: monitoring
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: query-frontend
 spec:
   endpoints:
   - port: http
   namespaceSelector:
     matchNames:
     - monitoring
   selector:
     matchLabels:
+      app.kubernetes.io/instance: thanos
       app.kubernetes.io/name: thanos
-      app.kubernetes.io/instance: thanos
       app.kubernetes.io/component: query-frontend
       prometheus-operator/monitor: 'true'
 
--- HelmRelease: monitoring/thanos ServiceMonitor: monitoring/thanos-query

+++ HelmRelease: monitoring/thanos ServiceMonitor: monitoring/thanos-query

@@ -2,23 +2,23 @@

 apiVersion: monitoring.coreos.com/v1
 kind: ServiceMonitor
 metadata:
   name: thanos-query
   namespace: monitoring
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: query
 spec:
   endpoints:
   - port: http
   namespaceSelector:
     matchNames:
     - monitoring
   selector:
     matchLabels:
+      app.kubernetes.io/instance: thanos
       app.kubernetes.io/name: thanos
-      app.kubernetes.io/instance: thanos
       app.kubernetes.io/component: query
       prometheus-operator/monitor: 'true'
 
--- HelmRelease: monitoring/thanos ServiceMonitor: monitoring/thanos-ruler

+++ HelmRelease: monitoring/thanos ServiceMonitor: monitoring/thanos-ruler

@@ -2,23 +2,23 @@

 apiVersion: monitoring.coreos.com/v1
 kind: ServiceMonitor
 metadata:
   name: thanos-ruler
   namespace: monitoring
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: ruler
 spec:
   endpoints:
   - port: http
   namespaceSelector:
     matchNames:
     - monitoring
   selector:
     matchLabels:
+      app.kubernetes.io/instance: thanos
       app.kubernetes.io/name: thanos
-      app.kubernetes.io/instance: thanos
       app.kubernetes.io/component: ruler
       prometheus-operator/monitor: 'true'
 
--- HelmRelease: monitoring/thanos ServiceMonitor: monitoring/thanos-storegateway

+++ HelmRelease: monitoring/thanos ServiceMonitor: monitoring/thanos-storegateway

@@ -2,23 +2,23 @@

 apiVersion: monitoring.coreos.com/v1
 kind: ServiceMonitor
 metadata:
   name: thanos-storegateway
   namespace: monitoring
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: storegateway
 spec:
   endpoints:
   - port: http
   namespaceSelector:
     matchNames:
     - monitoring
   selector:
     matchLabels:
+      app.kubernetes.io/instance: thanos
       app.kubernetes.io/name: thanos
-      app.kubernetes.io/instance: thanos
       app.kubernetes.io/component: storegateway
       prometheus-operator/monitor: 'true'