feat: Add support for alertmanager silence operator (#839)

* Add support for alertmanager silence operator

Seems to be one of the few ways to feasibly manage alertmanager silences around.  Can also integrate into the console.

* Move silence operator to separate chart

* Fix gitlab wildcard cert

we needed to explicitly name the cert for the kas ingress

gitlab/helm/gitlab/values.yaml

@@ -83,6 +83,11 @@ gitlab:
         cpu: 10m
         memory: 64Mi
   gitlab:
+    kas:
+      ingress:
+        tls:
+          secretName: gitlab-kas-tls
+          enabled: true
     webservice:
       minReplicas: 1
       ingress:

monitoring/helm/monitoring/Chart.lock

@@ -14,5 +14,5 @@ dependencies:
 - name: vpa
   repository: https://charts.fairwinds.com/stable
   version: 0.4.2
-digest: sha256:9b84774630023f82f5c08f274f2f36d5197e1b8108542d40d9d143802fb5fd14
-generated: "2022-09-13T17:50:46.461204+02:00"
+digest: sha256:787edb7415961eb351e0626cd804052182504834a0fc11b68fd8af44ce10c10b
+generated: "2023-09-06T13:54:58.679085-04:00"

monitoring/helm/monitoring/Chart.yaml

@@ -2,7 +2,7 @@ apiVersion: v2
 name: monitoring
 description: A Helm chart for Kubernetes
 type: application
-version: 0.2.27
+version: 0.2.28
 appVersion: "0.1.0"
 dependencies:
 - name: kube-prometheus-stack
@@ -22,4 +22,4 @@ dependencies:
   condition: opentelemetry-operator.enabled
 - name: vpa
   version: 0.4.2
-  repository: https://charts.fairwinds.com/stable
+  repository: https://charts.fairwinds.com/stable

monitoring/helm/silence-operator/.helmignore

@@ -0,0 +1,23 @@
+# Patterns to ignore when building packages.
+# This supports shell glob matching, relative path matching, and
+# negation (prefixed with !). Only one pattern per line.
+.DS_Store
+# Common VCS dirs
+.git/
+.gitignore
+.bzr/
+.bzrignore
+.hg/
+.hgignore
+.svn/
+# Common backup files
+*.swp
+*.bak
+*.tmp
+*.orig
+*~
+# Various IDEs
+.project
+.idea/
+*.tmproj
+.vscode/

monitoring/helm/silence-operator/Chart.lock

@@ -0,0 +1,6 @@
+dependencies:
+- name: silence-operator
+  repository: https://wiremind.github.io/wiremind-helm-charts
+  version: 0.0.6
+digest: sha256:95128fe4e6765a00cb3d655dfe5d9720711740bccc9c933381743add2e71c739
+generated: "2023-09-06T13:55:17.876963-04:00"

monitoring/helm/silence-operator/Chart.yaml

@@ -0,0 +1,10 @@
+apiVersion: v2
+name: silence-operator
+description: A Helm chart for Kubernetes
+type: application
+version: 0.0.6
+appVersion: "1.16.0"
+dependencies:
+- name: silence-operator
+  version: 0.0.6
+  repository: https://wiremind.github.io/wiremind-helm-charts

monitoring/helm/silence-operator/README.md

@@ -0,0 +1,13 @@
+# silence-operator
+
+Deploys the alertmanager silence operator to allow for CRD managed alert silences.  You can specify any silences you might want to add using in your installations `values.yaml` file:
+
+```yaml
+silence-operator:
+  silences:
+    <name>:
+        matchers:
+        - name: alertname
+          value: <Alertname>
+          regex: false
+```

monitoring/helm/silence-operator/crds/monitoring.giantswarm.io_silences.yaml

@@ -0,0 +1,96 @@
+
+---
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  annotations:
+    controller-gen.kubebuilder.io/version: v0.7.0
+  creationTimestamp: null
+  name: silences.monitoring.giantswarm.io
+spec:
+  group: monitoring.giantswarm.io
+  names:
+    categories:
+    - common
+    - giantswarm
+    kind: Silence
+    listKind: SilenceList
+    plural: silences
+    singular: silence
+  scope: Cluster
+  versions:
+  - name: v1alpha1
+    schema:
+      openAPIV3Schema:
+        description: Silence represents schema for managed silences in Alertmanager.
+          Reconciled by silence-operator.
+        properties:
+          apiVersion:
+            description: 'APIVersion defines the versioned schema of this representation
+              of an object. Servers should convert recognized schemas to the latest
+              internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
+            type: string
+          kind:
+            description: 'Kind is a string value representing the REST resource this
+              object represents. Servers may infer this from the endpoint the client
+              submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
+            type: string
+          metadata:
+            type: object
+          spec:
+            properties:
+              issue_url:
+                description: IssueURL is a link to a GitHub issue describing the problem.
+                type: string
+              matchers:
+                items:
+                  properties:
+                    isEqual:
+                      type: boolean
+                    isRegex:
+                      type: boolean
+                    name:
+                      type: string
+                    value:
+                      type: string
+                  required:
+                  - isRegex
+                  - name
+                  - value
+                  type: object
+                type: array
+              owner:
+                description: Owner is GitHub username of a person who created and/or
+                  owns the silence.
+                type: string
+              postmortem_url:
+                description: 'PostmortemURL is a link to a document describing the
+                  problem. Deprecated: Use IssueURL instead.'
+                type: string
+              targetTags:
+                items:
+                  properties:
+                    name:
+                      type: string
+                    value:
+                      type: string
+                  required:
+                  - name
+                  - value
+                  type: object
+                type: array
+            required:
+            - matchers
+            type: object
+        required:
+        - metadata
+        - spec
+        type: object
+    served: true
+    storage: true
+status:
+  acceptedNames:
+    kind: ""
+    plural: ""
+  conditions: []
+  storedVersions: []

monitoring/helm/silence-operator/deps.yaml

@@ -0,0 +1,10 @@
+apiVersion: plural.sh/v1alpha1
+kind: Dependencies
+metadata:
+  description: Deploys silence operator
+spec:
+  dependencies:
+  - type: helm
+    name: bootstrap
+    repo: bootstrap
+    version: '>= 0.5.1'

monitoring/helm/silence-operator/templates/_helpers.tpl

@@ -0,0 +1,62 @@
+{{/*
+Expand the name of the chart.
+*/}}
+{{- define "silence-operator-plural.name" -}}
+{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
+{{- end }}
+
+{{/*
+Create a default fully qualified app name.
+We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
+If release name contains chart name it will be used as a full name.
+*/}}
+{{- define "silence-operator-plural.fullname" -}}
+{{- if .Values.fullnameOverride }}
+{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }}
+{{- else }}
+{{- $name := default .Chart.Name .Values.nameOverride }}
+{{- if contains $name .Release.Name }}
+{{- .Release.Name | trunc 63 | trimSuffix "-" }}
+{{- else }}
+{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }}
+{{- end }}
+{{- end }}
+{{- end }}
+
+{{/*
+Create chart name and version as used by the chart label.
+*/}}
+{{- define "silence-operator.chart" -}}
+{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
+{{- end }}
+
+{{/*
+Common labels
+*/}}
+{{- define "silence-operator-plural.labels" -}}
+helm.sh/chart: {{ include "silence-operator.chart" . }}
+{{ include "silence-operator.selectorLabels" . }}
+{{- if .Chart.AppVersion }}
+app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
+{{- end }}
+app.kubernetes.io/managed-by: {{ .Release.Service }}
+{{- end }}
+
+{{/*
+Selector labels
+*/}}
+{{- define "silence-operator-plural.selectorLabels" -}}
+app.kubernetes.io/name: {{ include "silence-operator.name" . }}
+app.kubernetes.io/instance: {{ .Release.Name }}
+{{- end }}
+
+{{/*
+Create the name of the service account to use
+*/}}
+{{- define "silence-operator-plural.serviceAccountName" -}}
+{{- if .Values.serviceAccount.create }}
+{{- default (include "silence-operator.fullname" .) .Values.serviceAccount.name }}
+{{- else }}
+{{- default "default" .Values.serviceAccount.name }}
+{{- end }}
+{{- end }}

monitoring/helm/silence-operator/templates/silences.yaml

@@ -0,0 +1,8 @@
+{{- range $name, $spec := .Values.silences -}}
+apiVersion: monitoring.giantswarm.io/v1alpha1
+kind: Silence
+metadata:
+  name: {{ $name }}
+spec:
+{{ $spec | toYaml | nindent 2 }}
+{{- end -}}

monitoring/helm/silence-operator/values.yaml

@@ -0,0 +1,18 @@
+silences: {}
+
+silence-operator:
+  sync:
+    enabled: true
+    init:
+      method:
+        kubernetes:
+          enabled: true
+          image:
+            name: ghcr.io/pluralsh/containers/kubectl
+            tag: 1.27-plural1.0.0
+  rbac:
+    create: true
+  operator:
+    alertmanager:
+      service:
+        address: "http://monitoring-alertmanager.monitoring:9093"