[kube-prometheus-stack] Add AlertmanagerConfig v1beta1 CRD

charts/kube-prometheus-stack/Chart.yaml

@@ -23,7 +23,7 @@ name: kube-prometheus-stack
 sources:
   - https://github.com/prometheus-community/helm-charts
   - https://github.com/prometheus-operator/kube-prometheus
-version: 58.4.0
+version: 58.5.0
 appVersion: v0.73.2
 kubeVersion: ">=1.19.0-0"
 home: https://github.com/prometheus-operator/kube-prometheus

charts/kube-prometheus-stack/charts/crds/crds/crd-alertmanagers.yaml

@@ -1,11 +1,10 @@
-# https://raw.githubusercontent.com/prometheus-operator/prometheus-operator/v0.73.2/example/prometheus-operator-crd/monitoring.coreos.com_alertmanagers.yaml
+# https://raw.githubusercontent.com/prometheus-operator/prometheus-operator/v0.73.2/example/prometheus-operator-crd-full/monitoring.coreos.com_alertmanagers.yaml
 ---
 apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
     controller-gen.kubebuilder.io/version: v0.13.0
-    operator.prometheus.io/version: 0.73.2
   name: alertmanagers.monitoring.coreos.com
 spec:
   group: monitoring.coreos.com

charts/kube-prometheus-stack/charts/crds/crds/crd-podmonitors.yaml

@@ -1,11 +1,10 @@
-# https://raw.githubusercontent.com/prometheus-operator/prometheus-operator/v0.73.2/example/prometheus-operator-crd/monitoring.coreos.com_podmonitors.yaml
+# https://raw.githubusercontent.com/prometheus-operator/prometheus-operator/v0.73.2/example/prometheus-operator-crd-full/monitoring.coreos.com_podmonitors.yaml
 ---
 apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
     controller-gen.kubebuilder.io/version: v0.13.0
-    operator.prometheus.io/version: 0.73.2
   name: podmonitors.monitoring.coreos.com
 spec:
   group: monitoring.coreos.com

charts/kube-prometheus-stack/charts/crds/crds/crd-probes.yaml

@@ -1,11 +1,10 @@
-# https://raw.githubusercontent.com/prometheus-operator/prometheus-operator/v0.73.2/example/prometheus-operator-crd/monitoring.coreos.com_probes.yaml
+# https://raw.githubusercontent.com/prometheus-operator/prometheus-operator/v0.73.2/example/prometheus-operator-crd-full/monitoring.coreos.com_probes.yaml
 ---
 apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
     controller-gen.kubebuilder.io/version: v0.13.0
-    operator.prometheus.io/version: 0.73.2
   name: probes.monitoring.coreos.com
 spec:
   group: monitoring.coreos.com

charts/kube-prometheus-stack/charts/crds/crds/crd-prometheusagents.yaml

@@ -1,11 +1,10 @@
-# https://raw.githubusercontent.com/prometheus-operator/prometheus-operator/v0.73.2/example/prometheus-operator-crd/monitoring.coreos.com_prometheusagents.yaml
+# https://raw.githubusercontent.com/prometheus-operator/prometheus-operator/v0.73.2/example/prometheus-operator-crd-full/monitoring.coreos.com_prometheusagents.yaml
 ---
 apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
     controller-gen.kubebuilder.io/version: v0.13.0
-    operator.prometheus.io/version: 0.73.2
   name: prometheusagents.monitoring.coreos.com
 spec:
   group: monitoring.coreos.com

charts/kube-prometheus-stack/charts/crds/crds/crd-prometheuses.yaml

@@ -1,11 +1,10 @@
-# https://raw.githubusercontent.com/prometheus-operator/prometheus-operator/v0.73.2/example/prometheus-operator-crd/monitoring.coreos.com_prometheuses.yaml
+# https://raw.githubusercontent.com/prometheus-operator/prometheus-operator/v0.73.2/example/prometheus-operator-crd-full/monitoring.coreos.com_prometheuses.yaml
 ---
 apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
     controller-gen.kubebuilder.io/version: v0.13.0
-    operator.prometheus.io/version: 0.73.2
   name: prometheuses.monitoring.coreos.com
 spec:
   group: monitoring.coreos.com

charts/kube-prometheus-stack/charts/crds/crds/crd-prometheusrules.yaml

@@ -1,11 +1,10 @@
-# https://raw.githubusercontent.com/prometheus-operator/prometheus-operator/v0.73.2/example/prometheus-operator-crd/monitoring.coreos.com_prometheusrules.yaml
+# https://raw.githubusercontent.com/prometheus-operator/prometheus-operator/v0.73.2/example/prometheus-operator-crd-full/monitoring.coreos.com_prometheusrules.yaml
 ---
 apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
     controller-gen.kubebuilder.io/version: v0.13.0
-    operator.prometheus.io/version: 0.73.2
   name: prometheusrules.monitoring.coreos.com
 spec:
   group: monitoring.coreos.com

charts/kube-prometheus-stack/charts/crds/crds/crd-scrapeconfigs.yaml

@@ -1,11 +1,10 @@
-# https://raw.githubusercontent.com/prometheus-operator/prometheus-operator/v0.73.2/example/prometheus-operator-crd/monitoring.coreos.com_scrapeconfigs.yaml
+# https://raw.githubusercontent.com/prometheus-operator/prometheus-operator/v0.73.2/example/prometheus-operator-crd-full/monitoring.coreos.com_scrapeconfigs.yaml
 ---
 apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
     controller-gen.kubebuilder.io/version: v0.13.0
-    operator.prometheus.io/version: 0.73.2
   name: scrapeconfigs.monitoring.coreos.com
 spec:
   group: monitoring.coreos.com

charts/kube-prometheus-stack/charts/crds/crds/crd-servicemonitors.yaml

@@ -1,11 +1,10 @@
-# https://raw.githubusercontent.com/prometheus-operator/prometheus-operator/v0.73.2/example/prometheus-operator-crd/monitoring.coreos.com_servicemonitors.yaml
+# https://raw.githubusercontent.com/prometheus-operator/prometheus-operator/v0.73.2/example/prometheus-operator-crd-full/monitoring.coreos.com_servicemonitors.yaml
 ---
 apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
     controller-gen.kubebuilder.io/version: v0.13.0
-    operator.prometheus.io/version: 0.73.2
   name: servicemonitors.monitoring.coreos.com
 spec:
   group: monitoring.coreos.com

charts/kube-prometheus-stack/charts/crds/crds/crd-thanosrulers.yaml

@@ -1,11 +1,10 @@
-# https://raw.githubusercontent.com/prometheus-operator/prometheus-operator/v0.73.2/example/prometheus-operator-crd/monitoring.coreos.com_thanosrulers.yaml
+# https://raw.githubusercontent.com/prometheus-operator/prometheus-operator/v0.73.2/example/prometheus-operator-crd-full/monitoring.coreos.com_thanosrulers.yaml
 ---
 apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
     controller-gen.kubebuilder.io/version: v0.13.0
-    operator.prometheus.io/version: 0.73.2
   name: thanosrulers.monitoring.coreos.com
 spec:
   group: monitoring.coreos.com

charts/kube-prometheus-stack/hack/update_crds.sh

@@ -25,7 +25,7 @@ for line in "${FILES[@]}"; do
     DESTINATION=$(echo "${line%%:*}" | xargs)
     SOURCE=$(echo "${line##*:}" | xargs)
 
-    URL="https://raw.githubusercontent.com/prometheus-operator/prometheus-operator/$VERSION/example/prometheus-operator-crd/$SOURCE"
+    URL="https://raw.githubusercontent.com/prometheus-operator/prometheus-operator/$VERSION/example/prometheus-operator-crd-full/$SOURCE"
 
     echo -e "Downloading Prometheus Operator CRD with Version ${VERSION}:\n${URL}\n"
 
@@ -36,3 +36,16 @@ for line in "${FILES[@]}"; do
       exit 1
     fi
 done
+
+if ! curl --silent --retry-all-errors --fail --location "https://raw.githubusercontent.com/prometheus-operator/prometheus-operator/$VERSION/example/alertmanager-crd-conversion/patch.json" >> "${SCRIPT_DIR}/../charts/crds/crds/patch.json"; then
+  echo -e "Failed to download ${URL}!"
+  exit 1
+fi
+
+{
+  head -n1 "${SCRIPT_DIR}/../charts/crds/crds/crd-alertmanagerconfigs.yaml";
+  kubectl patch --local=true -f "${SCRIPT_DIR}/../charts/crds/crds/crd-alertmanagerconfigs.yaml" --patch-file="${SCRIPT_DIR}/../charts/crds/crds/patch.json" --type=merge --dry-run=client -o yaml
+} >"${SCRIPT_DIR}/../charts/crds/crds/crd-alertmanagerconfigs.patched.yaml"
+
+rm "${SCRIPT_DIR}/../charts/crds/crds/patch.json"
+mv "${SCRIPT_DIR}/../charts/crds/crds/crd-alertmanagerconfigs.patched.yaml" "${SCRIPT_DIR}/../charts/crds/crds/crd-alertmanagerconfigs.yaml"

charts/kube-prometheus-stack/templates/prometheus-operator/admission-webhooks/validatingWebhookConfiguration.yaml

@@ -74,4 +74,66 @@ webhooks:
         {{- end }}
       {{- end }}
     {{- end }}
+  - name: alertmanagerconfigsvalidate.monitoring.coreos.com
+    {{- if eq .Values.prometheusOperator.admissionWebhooks.failurePolicy "IgnoreOnInstallOnly" }}
+    failurePolicy: {{ .Release.IsInstall | ternary "Ignore" "Fail" }}
+    {{- else if .Values.prometheusOperator.admissionWebhooks.failurePolicy  }}
+    failurePolicy: {{ .Values.prometheusOperator.admissionWebhooks.failurePolicy }}
+    {{- else if .Values.prometheusOperator.admissionWebhooks.patch.enabled }}
+    failurePolicy: Ignore
+    {{- else }}
+    failurePolicy: Fail
+    {{- end }}
+    rules:
+      - apiGroups:
+          - monitoring.coreos.com
+        apiVersions:
+          - "*"
+        resources:
+          - alertmanagerconfigs
+        operations:
+          - CREATE
+          - UPDATE
+    clientConfig:
+      service:
+        namespace: {{ template "kube-prometheus-stack.namespace" . }}
+        name: {{ template "kube-prometheus-stack.operator.fullname" $ }}{{ if .Values.prometheusOperator.admissionWebhooks.deployment.enabled }}-webhook{{ end }}
+        path: /admission-alertmanagerconfigs/validate
+      {{- if and .Values.prometheusOperator.admissionWebhooks.caBundle (not .Values.prometheusOperator.admissionWebhooks.patch.enabled) (not .Values.prometheusOperator.admissionWebhooks.certManager.enabled) }}
+      caBundle: {{ .Values.prometheusOperator.admissionWebhooks.caBundle }}
+      {{- end }}
+    timeoutSeconds: {{ .Values.prometheusOperator.admissionWebhooks.timeoutSeconds }}
+    admissionReviewVersions: ["v1", "v1beta1"]
+    sideEffects: None
+    {{- if or .Values.prometheusOperator.denyNamespaces .Values.prometheusOperator.namespaces .Values.prometheusOperator.admissionWebhooks.namespaceSelector }}
+    namespaceSelector:
+      {{- with (omit .Values.prometheusOperator.admissionWebhooks.namespaceSelector "matchExpressions") }}
+      {{- toYaml . | nindent 6 }}
+      {{- end }}
+      {{- if or .Values.prometheusOperator.denyNamespaces .Values.prometheusOperator.namespaces .Values.prometheusOperator.admissionWebhooks.namespaceSelector.matchExpressions }}
+      matchExpressions:
+        {{- with (.Values.prometheusOperator.admissionWebhooks.namespaceSelector.matchExpressions) }}
+        {{- toYaml . | nindent 8 }}
+        {{- end }}
+        {{- if .Values.prometheusOperator.denyNamespaces }}
+        - key: kubernetes.io/metadata.name
+          operator: NotIn
+          values:
+        {{- range $namespace := mustUniq .Values.prometheusOperator.denyNamespaces }}
+            - {{ $namespace }}
+        {{- end }}
+        {{- else if and .Values.prometheusOperator.namespaces .Values.prometheusOperator.namespaces.additional }}
+        - key: kubernetes.io/metadata.name
+          operator: In
+          values:
+        {{- if and .Values.prometheusOperator.namespaces.releaseNamespace (default .Values.prometheusOperator.namespaces.releaseNamespace true) }}
+        {{- $namespace := printf "%s" (include "kube-prometheus-stack.namespace" .) }}
+            - {{ $namespace }}
+        {{- end }}
+        {{- range $namespace := mustUniq .Values.prometheusOperator.namespaces.additional }}
+            - {{ $namespace }}
+        {{- end }}
+        {{- end }}
+      {{- end }}
+    {{- end }}
 {{- end }}

charts/kube-prometheus-stack/templates/prometheus-operator/service.yaml

@@ -2,41 +2,39 @@
 apiVersion: v1
 kind: Service
 metadata:
+  {{- if .Values.prometheusOperator.service.annotations }}
+  annotations:
+    {{- toYaml .Values.prometheusOperator.service.annotations | nindent 4 }}
+  {{- end }}
   name: {{ template "kube-prometheus-stack.operator.fullname" . }}
   namespace: {{ template "kube-prometheus-stack.namespace" . }}
   labels:
     {{- include "kube-prometheus-stack.prometheus-operator.labels" . | nindent 4 }}
-{{- if .Values.prometheusOperator.service.labels }}
-{{ toYaml .Values.prometheusOperator.service.labels | indent 4 }}
-{{- end }}
-{{- if .Values.prometheusOperator.service.annotations }}
-  annotations:
-{{ toYaml .Values.prometheusOperator.service.annotations | indent 4 }}
-{{- end }}
+    {{- with .Values.prometheusOperator.service.labels }}
+    {{- toYaml . | nindent 4 }}
+    {{- end }}
 spec:
-{{- if .Values.prometheusOperator.service.clusterIP }}
-  clusterIP: {{ .Values.prometheusOperator.service.clusterIP }}
-{{- end }}
-{{- if .Values.prometheusOperator.service.ipDualStack.enabled }}
+  {{- with .Values.prometheusOperator.service.clusterIP }}
+  clusterIP: {{ . }}
+  {{- end }}
+  {{- if .Values.prometheusOperator.service.ipDualStack.enabled }}
   ipFamilies: {{ toYaml .Values.prometheusOperator.service.ipDualStack.ipFamilies | nindent 4 }}
   ipFamilyPolicy: {{ .Values.prometheusOperator.service.ipDualStack.ipFamilyPolicy }}
-{{- end }}
-{{- if .Values.prometheusOperator.service.externalIPs }}
+  {{- end }}
+  {{- with .Values.prometheusOperator.service.externalIPs }}
   externalIPs:
-{{ toYaml .Values.prometheusOperator.service.externalIPs | indent 4 }}
-{{- end }}
-{{- if .Values.prometheusOperator.service.loadBalancerIP }}
-  loadBalancerIP: {{ .Values.prometheusOperator.service.loadBalancerIP }}
-{{- end }}
-{{- if .Values.prometheusOperator.service.loadBalancerSourceRanges }}
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+  {{- with .Values.prometheusOperator.service.loadBalancerIP }}
+  loadBalancerIP: {{ . }}
+  {{- end }}
+  {{- with .Values.prometheusOperator.service.loadBalancerSourceRanges }}
   loadBalancerSourceRanges:
-  {{- range $cidr := .Values.prometheusOperator.service.loadBalancerSourceRanges }}
-    - {{ $cidr }}
+    {{- toYaml . | nindent 4 }}
   {{- end }}
-{{- end }}
-{{- if ne .Values.prometheusOperator.service.type "ClusterIP" }}
+  {{- if ne .Values.prometheusOperator.service.type "ClusterIP" }}
   externalTrafficPolicy: {{ .Values.prometheusOperator.service.externalTrafficPolicy }}
-{{- end }}
+  {{- end }}
   ports:
   {{- if not .Values.prometheusOperator.tls.enabled }}
   - name: http
@@ -58,4 +56,35 @@ spec:
     app: {{ template "kube-prometheus-stack.name" . }}-operator
     release: {{ $.Release.Name | quote }}
   type: "{{ .Values.prometheusOperator.service.type }}"
+---
+apiVersion: v1
+kind: Service
+metadata:
+  {{- with .Values.prometheusOperator.conversionWebhookService.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+  name: prometheus-operator-admission-webhook
+  namespace: {{ template "kube-prometheus-stack.namespace" . }}
+  labels:
+    {{- include "kube-prometheus-stack.prometheus-operator.labels" . | nindent 4 }}
+  {{- with .Values.prometheusOperator.conversionWebhookService.labels }}
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+spec:
+  {{- with .Values.prometheusOperator.conversionWebhookService.clusterIP }}
+  clusterIP: {{ . }}
+  {{- end }}
+  {{- if .Values.prometheusOperator.conversionWebhookService.ipDualStack.enabled }}
+  ipFamilies: {{ toYaml .Values.prometheusOperator.conversionWebhookService.ipDualStack.ipFamilies | nindent 4 }}
+  ipFamilyPolicy: {{ .Values.prometheusOperator.conversionWebhookService.ipDualStack.ipFamilyPolicy }}
+  {{- end }}
+  ports:
+    - name: https
+      port: 8443
+      targetPort: https
+  selector:
+    app: {{ template "kube-prometheus-stack.name" . }}-operator{{ if .Values.prometheusOperator.admissionWebhooks.deployment.enabled }}-webhook{{ end }}
+    release: {{ $.Release.Name | quote }}
+  type: ClusterIP
 {{- end }}

charts/kube-prometheus-stack/values.yaml

@@ -2482,7 +2482,7 @@ prometheusOperator:
           drop:
           - ALL
 
-      # Security context for patch job container
+    # Security context for patch job container
     patchWebhookJob:
       securityContext:
         allowPrivilegeEscalation: false
@@ -2503,6 +2503,15 @@ prometheusOperator:
       #   name: "issuer"
       #   kind: "ClusterIssuer"
 
+  conversionWebhookService:
+    annotations: {}
+    labels: {}
+    clusterIP: ""
+    ipDualStack:
+      enabled: false
+      ipFamilies: ["IPv6", "IPv4"]
+      ipFamilyPolicy: "PreferDualStack"
+
   ## Namespaces to scope the interaction of the Prometheus Operator and the apiserver (allow list).
   ## This is mutually exclusive with denyNamespaces. Setting this to an empty object will disable the configuration
   ##