thanos.yaml

---
apiVersion: helm.toolkit.fluxcd.io/v2beta1
kind: HelmRelease
metadata:
  name: thanos
  namespace: monitoring
spec:
  interval: 15m
  timeout: 15m
  chart:
    spec:
      # renovate: registryUrl=https://charts.bitnami.com/bitnami
      chart: thanos
      version: 15.9.2
      sourceRef:
        kind: HelmRepository
        name: bitnami-charts
        namespace: flux-system
  maxHistory: 3
  install:
    createNamespace: true
    remediation:
      retries: 3
  upgrade:
    cleanupOnFail: true
    remediation:
      retries: 3
  uninstall:
    keepHistory: false
  values:
    objstoreConfig:
      type: s3
      config:
        insecure: true
        bucket: "thanos"
        endpoint: "minio.kube-system.svc:9000"
        region: ""
        access_key: "${SECRET_THANOS_S3_ACCESS_KEY}"
        secret_key: "${SECRET_THANOS_S3_SECRET_KEY}"
    queryFrontend:
      enabled: false
    query:
      enabled: true
      replicaCount: 3
      podAntiAffinityPreset: hard
      replicaLabels:
        - replica
      dnsDiscovery:
        sidecarsService: kube-prometheus-stack-thanos-discovery
        sidecarsNamespace: monitoring
      ingress:
        enabled: true
        hostname: "thanos.k.${SECRET_DOMAIN}"
        annotations:
          kubernetes.io/ingress.class: "nginx-internal"
          nginx.ingress.kubernetes.io/whitelist-source-range: "10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16"
          nginx.ingress.kubernetes.io/auth-signin: "https://auth.${SECRET_DOMAIN}"
          nginx.ingress.kubernetes.io/auth-url: "https://auth.${SECRET_DOMAIN}/api/authz/auth-request"
        tls: true
    bucketweb:
      enabled: true
      replicaCount: 3
      podAntiAffinityPreset: hard
      tolerations:
      - key: "arm"
        operator: "Exists"
    compactor:
      enabled: true
      concurrency: 4
      retentionResolutionRaw: 7d
      retentionResolution5m: 14d
      retentionResolution1h: 30d
      persistence:
        enabled: true
        storageClass: rook-ceph-block
        size: 100Gi
      ingress:
        enabled: true
        hostname: "thanos-compactor.k.${SECRET_DOMAIN}"
        annotations:
          kubernetes.io/ingress.class: "nginx-internal"
          nginx.ingress.kubernetes.io/whitelist-source-range: "10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16"
          nginx.ingress.kubernetes.io/auth-signin: "https://auth.${SECRET_DOMAIN}"
          nginx.ingress.kubernetes.io/auth-url: "https://auth.${SECRET_DOMAIN}/api/authz/auth-request"
        tls: true
    storegateway:
      enabled: true
      replicaCount: 3
      podAntiAffinityPreset: hard
      tolerations:
      - key: "arm"
        operator: "Exists"
      persistence:
        enabled: true
        storageClass: rook-ceph-block
        size: 20Gi
    ruler:
      enabled: true
      replicaCount: 3
      podAntiAffinityPreset: hard
      tolerations:
      - key: "arm"
        operator: "Exists"
      dnsDiscovery:
        enabled: true
      alertmanagers: ["http://kube-prometheus-stack-alertmanager.monitoring:9093"]
      # Breaks any metric that has an existing "cluster" label on a metric
      # clusterName: home # must match with kube-prometheus-stack value `.prometheus.prometheusSpec.externalLabels.cluster`
      extraFlags: ["--web.prefix-header=X-Forwarded-Prefix"]
      config: |-
        groups:
          - name: "PrometheusWatcher"
            rules:
              - alert: "PrometheusDown"
                expr: absent(up{job="kube-prometheus-stack-prometheus"})
      ingress:
        enabled: true
        hostname: "thanos-ruler.k.${SECRET_DOMAIN}"
        annotations:
          kubernetes.io/ingress.class: "nginx-internal"
          nginx.ingress.kubernetes.io/whitelist-source-range: "10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16"
          nginx.ingress.kubernetes.io/auth-signin: "https://auth.${SECRET_DOMAIN}"
          nginx.ingress.kubernetes.io/auth-url: "https://auth.${SECRET_DOMAIN}/api/authz/auth-request"
        tls: true
      persistence:
        enabled: true
        storageClass: rook-ceph-block
        size: 20Gi
    metrics:
      enabled: true
      serviceMonitor:
        enabled: true