Ref #32619: update kube-prometheus

Author: LEDfan

bases/monitoring/kustomization.yaml

@@ -7,11 +7,14 @@ resources:
  - manifests/setup/0podmonitorCustomResourceDefinition.yaml
  - manifests/setup/0probeCustomResourceDefinition.yaml
  - manifests/setup/0prometheusCustomResourceDefinition.yaml
+ - manifests/setup/0prometheusagentCustomResourceDefinition.yaml
  - manifests/setup/0prometheusruleCustomResourceDefinition.yaml
+ - manifests/setup/0scrapeconfigCustomResourceDefinition.yaml
  - manifests/setup/0servicemonitorCustomResourceDefinition.yaml
  - manifests/setup/0thanosrulerCustomResourceDefinition.yaml
  - manifests/setup/namespace.yaml
  - manifests/alertmanager-alertmanager.yaml
+ - manifests/alertmanager-networkPolicy.yaml
  - manifests/alertmanager-podDisruptionBudget.yaml
  - manifests/alertmanager-prometheusRule.yaml
  - manifests/alertmanager-secret.yaml
@@ -22,6 +25,7 @@ resources:
  - manifests/blackboxExporter-clusterRoleBinding.yaml
  - manifests/blackboxExporter-configuration.yaml
  - manifests/blackboxExporter-deployment.yaml
+ - manifests/blackboxExporter-networkPolicy.yaml
  - manifests/blackboxExporter-service.yaml
  - manifests/blackboxExporter-serviceAccount.yaml
  - manifests/blackboxExporter-serviceMonitor.yaml
@@ -30,13 +34,16 @@ resources:
  - manifests/grafana-dashboardDefinitions.yaml
  - manifests/grafana-dashboardSources.yaml
  - manifests/grafana-deployment.yaml
+ - manifests/grafana-networkPolicy.yaml
+ - manifests/grafana-prometheusRule.yaml
  - manifests/grafana-service.yaml
  - manifests/grafana-serviceAccount.yaml
  - manifests/grafana-serviceMonitor.yaml
  - manifests/kubePrometheus-prometheusRule.yaml
  - manifests/kubeStateMetrics-clusterRole.yaml
  - manifests/kubeStateMetrics-clusterRoleBinding.yaml
  - manifests/kubeStateMetrics-deployment.yaml
+ - manifests/kubeStateMetrics-networkPolicy.yaml
  - manifests/kubeStateMetrics-prometheusRule.yaml
  - manifests/kubeStateMetrics-service.yaml
  - manifests/kubeStateMetrics-serviceAccount.yaml
@@ -50,12 +57,14 @@ resources:
  - manifests/nodeExporter-clusterRole.yaml
  - manifests/nodeExporter-clusterRoleBinding.yaml
  - manifests/nodeExporter-daemonset.yaml
+ - manifests/nodeExporter-networkPolicy.yaml
  - manifests/nodeExporter-prometheusRule.yaml
  - manifests/nodeExporter-service.yaml
  - manifests/nodeExporter-serviceAccount.yaml
  - manifests/nodeExporter-serviceMonitor.yaml
  - manifests/prometheus-clusterRole.yaml
  - manifests/prometheus-clusterRoleBinding.yaml
+ - manifests/prometheus-networkPolicy.yaml
  - manifests/prometheus-podDisruptionBudget.yaml
  - manifests/prometheus-prometheus.yaml
  - manifests/prometheus-prometheusRule.yaml
@@ -74,6 +83,7 @@ resources:
  - manifests/prometheusAdapter-clusterRoleServerResources.yaml
  - manifests/prometheusAdapter-configMap.yaml
  - manifests/prometheusAdapter-deployment.yaml
+ - manifests/prometheusAdapter-networkPolicy.yaml
  - manifests/prometheusAdapter-podDisruptionBudget.yaml
  - manifests/prometheusAdapter-roleBindingAuthReader.yaml
  - manifests/prometheusAdapter-service.yaml
@@ -82,6 +92,7 @@ resources:
  - manifests/prometheusOperator-clusterRole.yaml
  - manifests/prometheusOperator-clusterRoleBinding.yaml
  - manifests/prometheusOperator-deployment.yaml
+ - manifests/prometheusOperator-networkPolicy.yaml
  - manifests/prometheusOperator-prometheusRule.yaml
  - manifests/prometheusOperator-service.yaml
  - manifests/prometheusOperator-serviceAccount.yaml

bases/monitoring/manifests/alertmanager-alertmanager.yaml

@@ -6,11 +6,11 @@ metadata:
     app.kubernetes.io/instance: main
     app.kubernetes.io/name: alertmanager
     app.kubernetes.io/part-of: kube-prometheus
-    app.kubernetes.io/version: 0.23.0
+    app.kubernetes.io/version: 0.26.0
   name: main
   namespace: monitoring
 spec:
-  image: quay.io/prometheus/alertmanager:v0.23.0
+  image: quay.io/prometheus/alertmanager:v0.26.0
   nodeSelector:
     kubernetes.io/os: linux
   podMetadata:
@@ -19,7 +19,7 @@ spec:
       app.kubernetes.io/instance: main
       app.kubernetes.io/name: alertmanager
       app.kubernetes.io/part-of: kube-prometheus
-      app.kubernetes.io/version: 0.23.0
+      app.kubernetes.io/version: 0.26.0
   replicas: 3
   resources:
     limits:
@@ -33,4 +33,4 @@ spec:
     runAsNonRoot: true
     runAsUser: 1000
   serviceAccountName: alertmanager-main
-  version: 0.23.0
+  version: 0.26.0

bases/monitoring/manifests/alertmanager-networkPolicy.yaml

@@ -0,0 +1,42 @@
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  labels:
+    app.kubernetes.io/component: alert-router
+    app.kubernetes.io/instance: main
+    app.kubernetes.io/name: alertmanager
+    app.kubernetes.io/part-of: kube-prometheus
+    app.kubernetes.io/version: 0.26.0
+  name: alertmanager-main
+  namespace: monitoring
+spec:
+  egress:
+  - {}
+  ingress:
+  - from:
+    - podSelector:
+        matchLabels:
+          app.kubernetes.io/name: prometheus
+    ports:
+    - port: 9093
+      protocol: TCP
+    - port: 8080
+      protocol: TCP
+  - from:
+    - podSelector:
+        matchLabels:
+          app.kubernetes.io/name: alertmanager
+    ports:
+    - port: 9094
+      protocol: TCP
+    - port: 9094
+      protocol: UDP
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/component: alert-router
+      app.kubernetes.io/instance: main
+      app.kubernetes.io/name: alertmanager
+      app.kubernetes.io/part-of: kube-prometheus
+  policyTypes:
+  - Egress
+  - Ingress

bases/monitoring/manifests/alertmanager-podDisruptionBudget.yaml

@@ -6,7 +6,7 @@ metadata:
     app.kubernetes.io/instance: main
     app.kubernetes.io/name: alertmanager
     app.kubernetes.io/part-of: kube-prometheus
-    app.kubernetes.io/version: 0.23.0
+    app.kubernetes.io/version: 0.26.0
   name: alertmanager-main
   namespace: monitoring
 spec:

bases/monitoring/manifests/alertmanager-prometheusRule.yaml

@@ -6,7 +6,7 @@ metadata:
     app.kubernetes.io/instance: main
     app.kubernetes.io/name: alertmanager
     app.kubernetes.io/part-of: kube-prometheus
-    app.kubernetes.io/version: 0.23.0
+    app.kubernetes.io/version: 0.26.0
     prometheus: k8s
     role: alert-rules
   name: alertmanager-main-rules
@@ -17,8 +17,7 @@ spec:
     rules:
     - alert: AlertmanagerFailedReload
       annotations:
-        description: Configuration has failed to load for {{ $labels.namespace }}/{{
-          $labels.pod}}.
+        description: Configuration has failed to load for {{ $labels.namespace }}/{{ $labels.pod}}.
         runbook_url: https://runbooks.prometheus-operator.dev/runbooks/alertmanager/alertmanagerfailedreload
         summary: Reloading an Alertmanager configuration has failed.
       expr: |
@@ -30,11 +29,9 @@ spec:
         severity: critical
     - alert: AlertmanagerMembersInconsistent
       annotations:
-        description: Alertmanager {{ $labels.namespace }}/{{ $labels.pod}} has only
-          found {{ $value }} members of the {{$labels.job}} cluster.
+        description: Alertmanager {{ $labels.namespace }}/{{ $labels.pod}} has only found {{ $value }} members of the {{$labels.job}} cluster.
         runbook_url: https://runbooks.prometheus-operator.dev/runbooks/alertmanager/alertmanagermembersinconsistent
-        summary: A member of an Alertmanager cluster has not found all other cluster
-          members.
+        summary: A member of an Alertmanager cluster has not found all other cluster members.
       expr: |
         # Without max_over_time, failed scrapes could create false negatives, see
         # https://www.robustperception.io/alerting-on-gauges-in-prometheus-2-0 for details.
@@ -46,9 +43,7 @@ spec:
         severity: critical
     - alert: AlertmanagerFailedToSendAlerts
       annotations:
-        description: Alertmanager {{ $labels.namespace }}/{{ $labels.pod}} failed
-          to send {{ $value | humanizePercentage }} of notifications to {{ $labels.integration
-          }}.
+        description: Alertmanager {{ $labels.namespace }}/{{ $labels.pod}} failed to send {{ $value | humanizePercentage }} of notifications to {{ $labels.integration }}.
         runbook_url: https://runbooks.prometheus-operator.dev/runbooks/alertmanager/alertmanagerfailedtosendalerts
         summary: An Alertmanager instance failed to send notifications.
       expr: |
@@ -63,12 +58,9 @@ spec:
         severity: warning
     - alert: AlertmanagerClusterFailedToSendAlerts
       annotations:
-        description: The minimum notification failure rate to {{ $labels.integration
-          }} sent from any instance in the {{$labels.job}} cluster is {{ $value |
-          humanizePercentage }}.
+        description: The minimum notification failure rate to {{ $labels.integration }} sent from any instance in the {{$labels.job}} cluster is {{ $value | humanizePercentage }}.
         runbook_url: https://runbooks.prometheus-operator.dev/runbooks/alertmanager/alertmanagerclusterfailedtosendalerts
-        summary: All Alertmanager instances in a cluster failed to send notifications
-          to a critical integration.
+        summary: All Alertmanager instances in a cluster failed to send notifications to a critical integration.
       expr: |
         min by (namespace,service, integration) (
           rate(alertmanager_notifications_failed_total{job="alertmanager-main",namespace="monitoring", integration=~`.*`}[5m])
@@ -81,12 +73,9 @@ spec:
         severity: critical
     - alert: AlertmanagerClusterFailedToSendAlerts
       annotations:
-        description: The minimum notification failure rate to {{ $labels.integration
-          }} sent from any instance in the {{$labels.job}} cluster is {{ $value |
-          humanizePercentage }}.
+        description: The minimum notification failure rate to {{ $labels.integration }} sent from any instance in the {{$labels.job}} cluster is {{ $value | humanizePercentage }}.
         runbook_url: https://runbooks.prometheus-operator.dev/runbooks/alertmanager/alertmanagerclusterfailedtosendalerts
-        summary: All Alertmanager instances in a cluster failed to send notifications
-          to a non-critical integration.
+        summary: All Alertmanager instances in a cluster failed to send notifications to a non-critical integration.
       expr: |
         min by (namespace,service, integration) (
           rate(alertmanager_notifications_failed_total{job="alertmanager-main",namespace="monitoring", integration!~`.*`}[5m])
@@ -99,8 +88,7 @@ spec:
         severity: warning
     - alert: AlertmanagerConfigInconsistent
       annotations:
-        description: Alertmanager instances within the {{$labels.job}} cluster have
-          different configurations.
+        description: Alertmanager instances within the {{$labels.job}} cluster have different configurations.
         runbook_url: https://runbooks.prometheus-operator.dev/runbooks/alertmanager/alertmanagerconfiginconsistent
         summary: Alertmanager instances within the same cluster have different configurations.
       expr: |
@@ -113,12 +101,9 @@ spec:
         severity: critical
     - alert: AlertmanagerClusterDown
       annotations:
-        description: '{{ $value | humanizePercentage }} of Alertmanager instances
-          within the {{$labels.job}} cluster have been up for less than half of the
-          last 5m.'
+        description: '{{ $value | humanizePercentage }} of Alertmanager instances within the {{$labels.job}} cluster have been up for less than half of the last 5m.'
         runbook_url: https://runbooks.prometheus-operator.dev/runbooks/alertmanager/alertmanagerclusterdown
-        summary: Half or more of the Alertmanager instances within the same cluster
-          are down.
+        summary: Half or more of the Alertmanager instances within the same cluster are down.
       expr: |
         (
           count by (namespace,service) (
@@ -135,12 +120,9 @@ spec:
         severity: critical
     - alert: AlertmanagerClusterCrashlooping
       annotations:
-        description: '{{ $value | humanizePercentage }} of Alertmanager instances
-          within the {{$labels.job}} cluster have restarted at least 5 times in the
-          last 10m.'
+        description: '{{ $value | humanizePercentage }} of Alertmanager instances within the {{$labels.job}} cluster have restarted at least 5 times in the last 10m.'
         runbook_url: https://runbooks.prometheus-operator.dev/runbooks/alertmanager/alertmanagerclustercrashlooping
-        summary: Half or more of the Alertmanager instances within the same cluster
-          are crashlooping.
+        summary: Half or more of the Alertmanager instances within the same cluster are crashlooping.
       expr: |
         (
           count by (namespace,service) (

bases/monitoring/manifests/alertmanager-secret.yaml

@@ -6,7 +6,7 @@ metadata:
     app.kubernetes.io/instance: main
     app.kubernetes.io/name: alertmanager
     app.kubernetes.io/part-of: kube-prometheus
-    app.kubernetes.io/version: 0.23.0
+    app.kubernetes.io/version: 0.26.0
   name: alertmanager-main
   namespace: monitoring
 stringData:
@@ -28,10 +28,17 @@ stringData:
       - "severity = warning"
       "target_matchers":
       - "severity = info"
+    - "equal":
+      - "namespace"
+      "source_matchers":
+      - "alertname = InfoInhibitor"
+      "target_matchers":
+      - "severity = info"
     "receivers":
     - "name": "Default"
     - "name": "Watchdog"
     - "name": "Critical"
+    - "name": "null"
     "route":
       "group_by":
       - "namespace"
@@ -43,6 +50,9 @@ stringData:
       - "matchers":
         - "alertname = Watchdog"
         "receiver": "Watchdog"
+      - "matchers":
+        - "alertname = InfoInhibitor"
+        "receiver": "null"
       - "matchers":
         - "severity = critical"
         "receiver": "Critical"

bases/monitoring/manifests/alertmanager-service.yaml

@@ -6,7 +6,7 @@ metadata:
     app.kubernetes.io/instance: main
     app.kubernetes.io/name: alertmanager
     app.kubernetes.io/part-of: kube-prometheus
-    app.kubernetes.io/version: 0.23.0
+    app.kubernetes.io/version: 0.26.0
   name: alertmanager-main
   namespace: monitoring
 spec:

bases/monitoring/manifests/alertmanager-serviceAccount.yaml

@@ -1,11 +1,12 @@
 apiVersion: v1
+automountServiceAccountToken: false
 kind: ServiceAccount
 metadata:
   labels:
     app.kubernetes.io/component: alert-router
     app.kubernetes.io/instance: main
     app.kubernetes.io/name: alertmanager
     app.kubernetes.io/part-of: kube-prometheus
-    app.kubernetes.io/version: 0.23.0
+    app.kubernetes.io/version: 0.26.0
   name: alertmanager-main
   namespace: monitoring

bases/monitoring/manifests/alertmanager-serviceMonitor.yaml

@@ -6,7 +6,7 @@ metadata:
     app.kubernetes.io/instance: main
     app.kubernetes.io/name: alertmanager
     app.kubernetes.io/part-of: kube-prometheus
-    app.kubernetes.io/version: 0.23.0
+    app.kubernetes.io/version: 0.26.0
   name: alertmanager-main
   namespace: monitoring
 spec:

bases/monitoring/manifests/blackboxExporter-clusterRoleBinding.yaml

@@ -5,9 +5,8 @@ metadata:
     app.kubernetes.io/component: exporter
     app.kubernetes.io/name: blackbox-exporter
     app.kubernetes.io/part-of: kube-prometheus
-    app.kubernetes.io/version: 0.19.0
+    app.kubernetes.io/version: 0.24.0
   name: blackbox-exporter
-  namespace: monitoring
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: ClusterRole