Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

feat(charts)!: Update Helm release thanos to 15.9.2 #2440

Open
wants to merge 1 commit into
base: main
Choose a base branch
from
Open

feat(charts)!: Update Helm release thanos to 15.9.2 #2440

wants to merge 1 commit into from

Conversation

renovate[bot]
Copy link
Contributor

@renovate renovate bot commented Apr 2, 2024 •
edited
Loading

This PR contains the following updates:

Package Update Change
thanos (source) major 11.5.5 -> 15.9.2

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

Release Notes

bitnami/charts (thanos)

v15.9.2

  • [bitnami/thanos] Add concurrency value to compactor (#​30722)

v15.9.1

  • [bitnami/thanos] Release 15.9.1 (#​30983)

v15.9.0

v15.8.5

v15.8.4

  • [bitnami/thanos] Release 15.8.4 (#​30783)

v15.8.3

v15.8.2

  • [bitnami/thanos] Release 15.8.2 (#​30626)

v15.8.1

  • [bitnami/thanos] Release 15.8.1 (#​30293)

v15.8.0

  • [bitnami/thanos] Add compactor dataDir setting (#​29856)

v15.7.29

  • [bitnami/thanos] Add customAutoScaling flag (#​29849)

v15.7.28

v15.7.27

v15.7.26

v15.7.25

v15.7.24

v15.7.23

v15.7.22

v15.7.21

v15.7.20

v15.7.19

v15.7.18

v15.7.17

v15.7.16

v15.7.15

v15.7.14

v15.7.13

v15.7.12

v15.7.11

v15.7.10

v15.7.9

v15.7.8

v15.7.7

v15.7.6

v15.7.5

v15.7.4

v15.7.3

v15.7.2

v15.7.1

v15.7.0

v15.6.2

v15.6.1

v15.6.0

  • [bitnami/thanos] Receive, ruler & storegateway statefulsets persistentVolumeClaimRetentionPolicy sup (c955b0e), closes #​25676

v15.5.1

v15.5.0

v15.4.7

v15.4.6

v15.4.4

v15.4.3

v15.4.2

v15.4.1

v15.4.0

v15.3.0

v15.2.2

v15.2.1

v15.2.0

v15.1.3

v15.1.2

v15.1.1

v15.1.0

v15.0.5

v15.0.4

v15.0.3

v15.0.2

v15.0.1

v15.0.0

v14.0.2

v14.0.1

v14.0.0

v13.4.1

v13.4.0

  • [bitnami/thanos] feat: ✨ 🔒 Add automatic adaptation for Openshift restricted-v2 SCC (# (8583f41), closes #​24161

v13.3.0

v13.2.2

v13.2.1

v13.1.0

v13.0.0

v12.23.2

v12.23.1

v12.23.0

v12.22.1

v12.22.0

v12.21.1

v12.21.0

  • [bitnami/thanos] fix: 🔒 Improve podSecurityContext and containerSecurityContext with essential (c6fc750), closes #​22195

v12.20.4

v12.20.3

v12.20.2

v12.20.1

  • [bitnami/thanos]: Removing replicas in storegateway in sharded mode when autoscaling is enabled (#​21 (fcb2dbb), closes #​21515

v12.20.0

v12.19.1

v12.19.0

v12.18.0

v12.17.0

v12.16.2

v12.16.1

v12.16.0

  • [bitnami/*] Remove relative links to non-README sections, add verification for that and update TL;DR (1103633), closes #​20967
  • [bitnami/thanos] feat: add generic ephemeral volume option for compactor (#​21030) (5f9344f), closes #​21030

v12.15.0

  • [bitnami/thanos] Automatically apply query-frontend's ingress hostname to alert.queryURL (#​20795) (fe05d92), closes #​20795

v12.14.2

v12.14.1

v12.14.0

v12.13.13

v12.13.12

v12.13.11

v12.13.10

v12.13.9

v12.13.8

v12.13.7

v12.13.6

v12.13.5

v12.13.4

v12.13.3

v12.13.2

v12.13.1

v12.13.0

v12.12.1

v12.12.0

v12.11.4

  • [bitnami/thanos] thanos/receive/ingress.yaml: support custom portName on extraHosts (#​17173) (d81bc2c), closes #​17173

v12.11.3

  • [bitnami/thanos] Release 12.11.3 ([#​1882

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate bot requested a review from dfroberg as a code owner April 2, 2024 13:37
@github-actions GitHub Actions
Copy link

github-actions bot commented Apr 2, 2024

Path: cluster/core/monitoring/thanos/helm-release.yaml
Version: 11.5.5 -> 15.0.0

@@ -1,71 +1,266 @@
+# Source: thanos/templates/bucketweb/networkpolicy.yaml
+kind: NetworkPolicy
+apiVersion: networking.k8s.io/v1
+metadata:
+  name: thanos-bucketweb
+  namespace: "default"
+  labels:
+    app.kubernetes.io/instance: thanos
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
+    app.kubernetes.io/component: bucketweb
+spec:
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/instance: thanos
+      app.kubernetes.io/name: thanos
+      app.kubernetes.io/component: bucketweb
+  policyTypes:
+    - Ingress
+    - Egress
+  egress:
+    - {}
+  ingress:
+    - ports:
+        - port: 8080
+        - port: 8080
+---
+# Source: thanos/templates/compactor/networkpolicy.yaml
+kind: NetworkPolicy
+apiVersion: networking.k8s.io/v1
+metadata:
+  name: thanos-compactor
+  namespace: "default"
+  labels:
+    app.kubernetes.io/instance: thanos
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
+    app.kubernetes.io/component: compactor
+spec:
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/instance: thanos
+      app.kubernetes.io/name: thanos
+      app.kubernetes.io/component: compactor
+  policyTypes:
+    - Ingress
+    - Egress
+  egress:
+    - {}
+  ingress:
+    - ports:
+        - port: 10902
+        - port: 9090
+---
+# Source: thanos/templates/query-frontend/networkpolicy.yaml
+kind: NetworkPolicy
+apiVersion: networking.k8s.io/v1
+metadata:
+  name: thanos-query-frontend
+  namespace: "default"
+  labels:
+    app.kubernetes.io/instance: thanos
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
+    app.kubernetes.io/component: query-frontend
+spec:
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/instance: thanos
+      app.kubernetes.io/name: thanos
+      app.kubernetes.io/component: query-frontend
+  policyTypes:
+    - Ingress
+    - Egress
+  egress:
+    - {}
+  ingress:
+    - ports:
+        - port: 9090
+        - port: 9090
+---
+# Source: thanos/templates/query/networkpolicy.yaml
+kind: NetworkPolicy
+apiVersion: networking.k8s.io/v1
+metadata:
+  name: thanos-query
+  namespace: "default"
+  labels:
+    app.kubernetes.io/instance: thanos
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
+    app.kubernetes.io/component: query
+spec:
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/instance: thanos
+      app.kubernetes.io/name: thanos
+      app.kubernetes.io/component: query
+  policyTypes:
+    - Ingress
+    - Egress
+  egress:
+    - {}
+  ingress:
+    - ports:
+        - port: 10902
+        - port: 10901
+        - port: 9090
+        - port: 10901
+---
+# Source: thanos/templates/receive/networkpolicy.yaml
+kind: NetworkPolicy
+apiVersion: networking.k8s.io/v1
+metadata:
+  name: thanos-receive
+  namespace: "default"
+  labels:
+    app.kubernetes.io/instance: thanos
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
+    app.kubernetes.io/component: receive
+spec:
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/instance: thanos
+      app.kubernetes.io/name: thanos
+      app.kubernetes.io/component: receive
+  policyTypes:
+    - Ingress
+    - Egress
+  egress:
+    - {}
+  ingress:
+    - ports:
+        - port: 10902
+        - port: 10902
+        - port: 10901
+        - port: 10901
+        - port: 19291
+        - port: 19291
+---
+# Source: thanos/templates/ruler/networkpolicy.yaml
+kind: NetworkPolicy
+apiVersion: networking.k8s.io/v1
+metadata:
+  name: thanos-ruler
+  namespace: "default"
+  labels:
+    app.kubernetes.io/instance: thanos
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
+    app.kubernetes.io/component: ruler
+spec:
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/instance: thanos
+      app.kubernetes.io/name: thanos
+      app.kubernetes.io/component: ruler
+  policyTypes:
+    - Ingress
+    - Egress
+  egress:
+    - {}
+  ingress:
+    - ports:
+        - port: 10902
+        - port: 9090
+        - port: 10901
+        - port: 10901
+---
+# Source: thanos/templates/storegateway/networkpolicy.yaml
+kind: NetworkPolicy
+apiVersion: networking.k8s.io/v1
+metadata:
+  name: thanos-storegateway
+  namespace: "default"
+  labels:
+    app.kubernetes.io/instance: thanos
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
+    app.kubernetes.io/component: storegateway
+spec:
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/instance: thanos
+      app.kubernetes.io/name: thanos
+      app.kubernetes.io/component: storegateway
+  policyTypes:
+    - Ingress
+    - Egress
+  egress:
+    - {}
+  ingress:
+    - ports:
+        - port: 10902
+        - port: 9090
+        - port: 10901
+        - port: 10901
+---
 # Source: thanos/templates/bucketweb/serviceaccount.yaml
 apiVersion: v1
 kind: ServiceAccount
 metadata:
   name: thanos-bucketweb
-  namespace: "default"
+  namespace: default
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: bucketweb
-  annotations:
-automountServiceAccountToken: true
+automountServiceAccountToken: false
 ---
 # Source: thanos/templates/compactor/serviceaccount.yaml
 apiVersion: v1
 kind: ServiceAccount
 metadata:
   name: thanos-compactor
-  namespace: "default"
+  namespace: default
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: compactor
-  annotations:
-automountServiceAccountToken: true
+automountServiceAccountToken: false
 ---
 # Source: thanos/templates/query/serviceaccount.yaml
 apiVersion: v1
 kind: ServiceAccount
 metadata:
   name: thanos-query
-  namespace: "default"
+  namespace: default
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: query
-  annotations:
-automountServiceAccountToken: true
+automountServiceAccountToken: false
 ---
 # Source: thanos/templates/storegateway/serviceaccount.yaml
 apiVersion: v1
 kind: ServiceAccount
 metadata:
   name: thanos-storegateway
-  namespace: "default"
+  namespace: default
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: storegateway
-  annotations:
-automountServiceAccountToken: true
+automountServiceAccountToken: false
 ---
 # Source: thanos/templates/bucketweb/service.yaml
 apiVersion: v1
 kind: Service
 metadata:
   name: thanos-bucketweb
-  namespace: "default"
+  namespace: default
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: bucketweb
-  annotations:
+    prometheus-operator/monitor: 'true'
 spec:
   type: ClusterIP
   ports:
@@ -75,8 +270,8 @@
       name: http
       nodePort: null
   selector:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: bucketweb
 ---
 # Source: thanos/templates/compactor/service.yaml
@@ -84,13 +279,13 @@
 kind: Service
 metadata:
   name: thanos-compactor
-  namespace: "default"
+  namespace: default
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: compactor
-  annotations:
+    prometheus-operator/monitor: 'true'
 spec:
   type: ClusterIP
   ports:
@@ -100,8 +295,8 @@
       name: http
       nodePort: null
   selector:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: compactor
 ---
 # Source: thanos/templates/query/service-grpc.yaml
@@ -109,13 +304,12 @@
 kind: Service
 metadata:
   name: thanos-query-grpc
-  namespace: "default"
+  namespace: default
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: query
-  annotations:
 spec:
   type: ClusterIP
   ports:
@@ -125,8 +319,8 @@
       name: grpc
       nodePort: null
   selector:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: query
 ---
 # Source: thanos/templates/query/service.yaml
@@ -134,13 +328,13 @@
 kind: Service
 metadata:
   name: thanos-query
-  namespace: "default"
+  namespace: default
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: query
-  annotations:
+    prometheus-operator/monitor: 'true'
 spec:
   type: ClusterIP
   ports:
@@ -150,8 +344,8 @@
       name: http
       nodePort: null
   selector:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: query
 ---
 # Source: thanos/templates/storegateway/service.yaml
@@ -159,14 +353,13 @@
 kind: Service
 metadata:
   name: thanos-storegateway
-  namespace: "default"
+  namespace: default
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: storegateway
     prometheus-operator/monitor: 'true'
-  annotations:
 spec:
   type: ClusterIP
   ports:
@@ -181,8 +374,8 @@
       name: grpc
       nodePort: null
   selector:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: storegateway
 ---
 # Source: thanos/templates/bucketweb/deployment.yaml
@@ -190,32 +383,32 @@
 kind: Deployment
 metadata:
   name: thanos-bucketweb
-  namespace: "default"
+  namespace: default
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: bucketweb
 spec:
   replicas: 1
+  revisionHistoryLimit: 10
   strategy:
     type: RollingUpdate
   selector:
     matchLabels:
-      app.kubernetes.io/name: thanos
       app.kubernetes.io/instance: thanos
+      app.kubernetes.io/name: thanos
       app.kubernetes.io/component: bucketweb
   template:
     metadata:
       labels:
-        app.kubernetes.io/name: thanos
         app.kubernetes.io/instance: thanos
         app.kubernetes.io/managed-by: Helm
+        app.kubernetes.io/name: thanos
         app.kubernetes.io/component: bucketweb
       annotations:
-        checksum/objstore-configuration: 01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b
     spec:
-      serviceAccount: thanos-bucketweb
+      serviceAccountName: thanos-bucketweb
       automountServiceAccountToken: true
       affinity:
         podAffinity:
@@ -224,25 +417,34 @@
             - podAffinityTerm:
                 labelSelector:
                   matchLabels:
-                    app.kubernetes.io/name: thanos
                     app.kubernetes.io/instance: thanos
+                    app.kubernetes.io/name: thanos
                     app.kubernetes.io/component: bucketweb
-                namespaces:
-                  - "default"
                 topologyKey: kubernetes.io/hostname
               weight: 1
         nodeAffinity:
       securityContext:
         fsGroup: 1001
+        fsGroupChangePolicy: Always
+        supplementalGroups: []
+        sysctls: []
       containers:
         - name: bucketweb
-          image: public.ecr.aws/bitnami/thanos:0.28.1-scratch-r0
+          image: public.ecr.aws/bitnami/thanos:0.34.1-debian-12-r1
           imagePullPolicy: "IfNotPresent"
           securityContext:
             allowPrivilegeEscalation: false
+            capabilities:
+              drop:
+                - ALL
+            privileged: false
             readOnlyRootFilesystem: true
+            runAsGroup: 1001
             runAsNonRoot: true
             runAsUser: 1001
+            seLinuxOptions: {}
+            seccompProfile:
+              type: RuntimeDefault
           args:
             - tools
             - bucket
@@ -297,32 +499,32 @@
 kind: Deployment
 metadata:
   name: thanos-compactor
-  namespace: "default"
+  namespace: default
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: compactor
 spec:
   replicas: 1
+  revisionHistoryLimit: 10
   strategy:
     type: Recreate
   selector:
     matchLabels:
-      app.kubernetes.io/name: thanos
       app.kubernetes.io/instance: thanos
+      app.kubernetes.io/name: thanos
       app.kubernetes.io/component: compactor
   template:
     metadata:
       labels:
-        app.kubernetes.io/name: thanos
         app.kubernetes.io/instance: thanos
         app.kubernetes.io/managed-by: Helm
+        app.kubernetes.io/name: thanos
         app.kubernetes.io/component: compactor
       annotations:
-        checksum/objstore-configuration: 01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b
     spec:
-      serviceAccount: thanos-compactor
+      serviceAccountName: thanos-compactor
       automountServiceAccountToken: true
       affinity:
         podAffinity:
@@ -331,25 +533,34 @@
             - podAffinityTerm:
                 labelSelector:
                   matchLabels:
-                    app.kubernetes.io/name: thanos
                     app.kubernetes.io/instance: thanos
+                    app.kubernetes.io/name: thanos
                     app.kubernetes.io/component: compactor
-                namespaces:
-                  - "default"
                 topologyKey: kubernetes.io/hostname
               weight: 1
         nodeAffinity:
       securityContext:
         fsGroup: 1001
+        fsGroupChangePolicy: Always
+        supplementalGroups: []
+        sysctls: []
       containers:
         - name: compactor
-          image: public.ecr.aws/bitnami/thanos:0.28.1-scratch-r0
+          image: public.ecr.aws/bitnami/thanos:0.34.1-debian-12-r1
           imagePullPolicy: "IfNotPresent"
           securityContext:
             allowPrivilegeEscalation: false
+            capabilities:
+              drop:
+                - ALL
+            privileged: false
             readOnlyRootFilesystem: true
+            runAsGroup: 1001
             runAsNonRoot: true
             runAsUser: 1001
+            seLinuxOptions: {}
+            seccompProfile:
+              type: RuntimeDefault
           args:
             - compact
             - --log.level=info
@@ -410,30 +621,31 @@
 kind: Deployment
 metadata:
   name: thanos-query
-  namespace: "default"
+  namespace: default
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: query
 spec:
   replicas: 1
+  revisionHistoryLimit: 10
   strategy:
     type: RollingUpdate
   selector:
     matchLabels:
-      app.kubernetes.io/name: thanos
       app.kubernetes.io/instance: thanos
+      app.kubernetes.io/name: thanos
       app.kubernetes.io/component: query
   template:
     metadata:
       labels:
-        app.kubernetes.io/name: thanos
         app.kubernetes.io/instance: thanos
         app.kubernetes.io/managed-by: Helm
+        app.kubernetes.io/name: thanos
         app.kubernetes.io/component: query
     spec:
-      serviceAccount: thanos-query
+      serviceAccountName: thanos-query
       automountServiceAccountToken: true
       affinity:
         podAffinity:
@@ -442,25 +654,34 @@
             - podAffinityTerm:
                 labelSelector:
                   matchLabels:
-                    app.kubernetes.io/name: thanos
                     app.kubernetes.io/instance: thanos
+                    app.kubernetes.io/name: thanos
                     app.kubernetes.io/component: query
-                namespaces:
-                  - "default"
                 topologyKey: kubernetes.io/hostname
               weight: 1
         nodeAffinity:
       securityContext:
         fsGroup: 1001
+        fsGroupChangePolicy: Always
+        supplementalGroups: []
+        sysctls: []
       containers:
         - name: query
-          image: public.ecr.aws/bitnami/thanos:0.28.1-scratch-r0
+          image: public.ecr.aws/bitnami/thanos:0.34.1-debian-12-r1
           imagePullPolicy: "IfNotPresent"
           securityContext:
             allowPrivilegeEscalation: false
+            capabilities:
+              drop:
+                - ALL
+            privileged: false
             readOnlyRootFilesystem: true
+            runAsGroup: 1001
             runAsNonRoot: true
             runAsUser: 1001
+            seLinuxOptions: {}
+            seccompProfile:
+              type: RuntimeDefault
           args:
             - query
             - --log.level=info
@@ -498,8 +719,14 @@
               port: http
               scheme: HTTP
           resources:
-            limits: {}
-            requests: {}
+            limits:
+              cpu: 150m
+              ephemeral-storage: 1024Mi
+              memory: 192Mi
+            requests:
+              cpu: 100m
+              ephemeral-storage: 50Mi
+              memory: 128Mi
           volumeMounts:
       volumes:
 ---
@@ -508,34 +735,34 @@
 kind: StatefulSet
 metadata:
   name: thanos-storegateway
-  namespace: "default"
+  namespace: default
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: storegateway
 spec:
   replicas: 1
+  revisionHistoryLimit: 10
   podManagementPolicy: OrderedReady
   serviceName: thanos-storegateway-headless
   updateStrategy:
     type: RollingUpdate
   selector:
     matchLabels:
-      app.kubernetes.io/name: thanos
       app.kubernetes.io/instance: thanos
+      app.kubernetes.io/name: thanos
       app.kubernetes.io/component: storegateway
   template:
     metadata:
       labels:
-        app.kubernetes.io/name: thanos
         app.kubernetes.io/instance: thanos
         app.kubernetes.io/managed-by: Helm
+        app.kubernetes.io/name: thanos
         app.kubernetes.io/component: storegateway
       annotations:
-        checksum/objstore-configuration: 01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b
     spec:
-      serviceAccount: thanos-storegateway
+      serviceAccountName: thanos-storegateway
       automountServiceAccountToken: true
       affinity:
         podAffinity:
@@ -544,25 +771,34 @@
             - podAffinityTerm:
                 labelSelector:
                   matchLabels:
-                    app.kubernetes.io/name: thanos
                     app.kubernetes.io/instance: thanos
+                    app.kubernetes.io/name: thanos
                     app.kubernetes.io/component: storegateway
-                namespaces:
-                  - "default"
                 topologyKey: kubernetes.io/hostname
               weight: 1
         nodeAffinity:
       securityContext:
         fsGroup: 1001
+        fsGroupChangePolicy: Always
+        supplementalGroups: []
+        sysctls: []
       containers:
         - name: storegateway
-          image: public.ecr.aws/bitnami/thanos:0.28.1-scratch-r0
+          image: public.ecr.aws/bitnami/thanos:0.34.1-debian-12-r1
           imagePullPolicy: "IfNotPresent"
           securityContext:
             allowPrivilegeEscalation: false
+            capabilities:
+              drop:
+                - ALL
+            privileged: false
             readOnlyRootFilesystem: true
+            runAsGroup: 1001
             runAsNonRoot: true
             runAsUser: 1001
+            seLinuxOptions: {}
+            seccompProfile:
+              type: RuntimeDefault
           args:
             - store
             - --log.level=info
@@ -599,8 +835,14 @@
               port: http
               scheme: HTTP
           resources:
-            limits: {}
-            requests: {}
+            limits:
+              cpu: 150m
+              ephemeral-storage: 1024Mi
+              memory: 192Mi
+            requests:
+              cpu: 100m
+              ephemeral-storage: 50Mi
+              memory: 128Mi
           volumeMounts:
             - name: objstore-config
               mountPath: /conf
@@ -625,11 +867,11 @@
 kind: Ingress
 metadata:
   name: thanos-query
-  namespace: "default"
+  namespace: default
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: query
   annotations:
     app: thanos
@@ -655,9 +897,9 @@
   name: thanos-bucketweb
   namespace: "default"
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: bucketweb
 spec:
   endpoints:
@@ -667,9 +909,10 @@
       - "default"
   selector:
     matchLabels:
-      app.kubernetes.io/name: thanos
       app.kubernetes.io/instance: thanos
+      app.kubernetes.io/name: thanos
       app.kubernetes.io/component: bucketweb
+      prometheus-operator/monitor: 'true'
 ---
 # Source: thanos/templates/compactor/servicemonitor.yaml
 apiVersion: monitoring.coreos.com/v1
@@ -678,9 +921,9 @@
   name: thanos-compactor
   namespace: "default"
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: compactor
 spec:
   endpoints:
@@ -690,9 +933,10 @@
       - "default"
   selector:
     matchLabels:
-      app.kubernetes.io/name: thanos
       app.kubernetes.io/instance: thanos
+      app.kubernetes.io/name: thanos
       app.kubernetes.io/component: compactor
+      prometheus-operator/monitor: 'true'
 ---
 # Source: thanos/templates/query/servicemonitor.yaml
 apiVersion: monitoring.coreos.com/v1
@@ -701,9 +945,9 @@
   name: thanos-query
   namespace: "default"
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: query
 spec:
   endpoints:
@@ -713,9 +957,10 @@
       - "default"
   selector:
     matchLabels:
-      app.kubernetes.io/name: thanos
       app.kubernetes.io/instance: thanos
+      app.kubernetes.io/name: thanos
       app.kubernetes.io/component: query
+      prometheus-operator/monitor: 'true'
 ---
 # Source: thanos/templates/storegateway/servicemonitor.yaml
 apiVersion: monitoring.coreos.com/v1
@@ -724,9 +969,9 @@
   name: thanos-storegateway
   namespace: "default"
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: storegateway
 spec:
   endpoints:
@@ -736,6 +981,7 @@
       - "default"
   selector:
     matchLabels:
-      app.kubernetes.io/name: thanos
       app.kubernetes.io/instance: thanos
+      app.kubernetes.io/name: thanos
       app.kubernetes.io/component: storegateway
+      prometheus-operator/monitor: 'true'

@renovate renovate bot force-pushed the renovate/thanos-15.x branch from b91cdc0 to 13c2903 Compare April 3, 2024 10:06
@renovate renovate bot changed the title feat(charts)!: Update Helm release thanos to 15.0.0 feat(charts)!: Update Helm release thanos to 15.0.2 Apr 3, 2024
@github-actions GitHub Actions
Copy link

github-actions bot commented Apr 3, 2024

Path: cluster/core/monitoring/thanos/helm-release.yaml
Version: 11.5.5 -> 15.0.2

@@ -1,71 +1,266 @@
+# Source: thanos/templates/bucketweb/networkpolicy.yaml
+kind: NetworkPolicy
+apiVersion: networking.k8s.io/v1
+metadata:
+  name: thanos-bucketweb
+  namespace: "default"
+  labels:
+    app.kubernetes.io/instance: thanos
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
+    app.kubernetes.io/component: bucketweb
+spec:
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/instance: thanos
+      app.kubernetes.io/name: thanos
+      app.kubernetes.io/component: bucketweb
+  policyTypes:
+    - Ingress
+    - Egress
+  egress:
+    - {}
+  ingress:
+    - ports:
+        - port: 8080
+        - port: 8080
+---
+# Source: thanos/templates/compactor/networkpolicy.yaml
+kind: NetworkPolicy
+apiVersion: networking.k8s.io/v1
+metadata:
+  name: thanos-compactor
+  namespace: "default"
+  labels:
+    app.kubernetes.io/instance: thanos
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
+    app.kubernetes.io/component: compactor
+spec:
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/instance: thanos
+      app.kubernetes.io/name: thanos
+      app.kubernetes.io/component: compactor
+  policyTypes:
+    - Ingress
+    - Egress
+  egress:
+    - {}
+  ingress:
+    - ports:
+        - port: 10902
+        - port: 9090
+---
+# Source: thanos/templates/query-frontend/networkpolicy.yaml
+kind: NetworkPolicy
+apiVersion: networking.k8s.io/v1
+metadata:
+  name: thanos-query-frontend
+  namespace: "default"
+  labels:
+    app.kubernetes.io/instance: thanos
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
+    app.kubernetes.io/component: query-frontend
+spec:
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/instance: thanos
+      app.kubernetes.io/name: thanos
+      app.kubernetes.io/component: query-frontend
+  policyTypes:
+    - Ingress
+    - Egress
+  egress:
+    - {}
+  ingress:
+    - ports:
+        - port: 9090
+        - port: 9090
+---
+# Source: thanos/templates/query/networkpolicy.yaml
+kind: NetworkPolicy
+apiVersion: networking.k8s.io/v1
+metadata:
+  name: thanos-query
+  namespace: "default"
+  labels:
+    app.kubernetes.io/instance: thanos
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
+    app.kubernetes.io/component: query
+spec:
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/instance: thanos
+      app.kubernetes.io/name: thanos
+      app.kubernetes.io/component: query
+  policyTypes:
+    - Ingress
+    - Egress
+  egress:
+    - {}
+  ingress:
+    - ports:
+        - port: 10902
+        - port: 10901
+        - port: 9090
+        - port: 10901
+---
+# Source: thanos/templates/receive/networkpolicy.yaml
+kind: NetworkPolicy
+apiVersion: networking.k8s.io/v1
+metadata:
+  name: thanos-receive
+  namespace: "default"
+  labels:
+    app.kubernetes.io/instance: thanos
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
+    app.kubernetes.io/component: receive
+spec:
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/instance: thanos
+      app.kubernetes.io/name: thanos
+      app.kubernetes.io/component: receive
+  policyTypes:
+    - Ingress
+    - Egress
+  egress:
+    - {}
+  ingress:
+    - ports:
+        - port: 10902
+        - port: 10902
+        - port: 10901
+        - port: 10901
+        - port: 19291
+        - port: 19291
+---
+# Source: thanos/templates/ruler/networkpolicy.yaml
+kind: NetworkPolicy
+apiVersion: networking.k8s.io/v1
+metadata:
+  name: thanos-ruler
+  namespace: "default"
+  labels:
+    app.kubernetes.io/instance: thanos
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
+    app.kubernetes.io/component: ruler
+spec:
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/instance: thanos
+      app.kubernetes.io/name: thanos
+      app.kubernetes.io/component: ruler
+  policyTypes:
+    - Ingress
+    - Egress
+  egress:
+    - {}
+  ingress:
+    - ports:
+        - port: 10902
+        - port: 9090
+        - port: 10901
+        - port: 10901
+---
+# Source: thanos/templates/storegateway/networkpolicy.yaml
+kind: NetworkPolicy
+apiVersion: networking.k8s.io/v1
+metadata:
+  name: thanos-storegateway
+  namespace: "default"
+  labels:
+    app.kubernetes.io/instance: thanos
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
+    app.kubernetes.io/component: storegateway
+spec:
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/instance: thanos
+      app.kubernetes.io/name: thanos
+      app.kubernetes.io/component: storegateway
+  policyTypes:
+    - Ingress
+    - Egress
+  egress:
+    - {}
+  ingress:
+    - ports:
+        - port: 10902
+        - port: 9090
+        - port: 10901
+        - port: 10901
+---
 # Source: thanos/templates/bucketweb/serviceaccount.yaml
 apiVersion: v1
 kind: ServiceAccount
 metadata:
   name: thanos-bucketweb
-  namespace: "default"
+  namespace: default
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: bucketweb
-  annotations:
-automountServiceAccountToken: true
+automountServiceAccountToken: false
 ---
 # Source: thanos/templates/compactor/serviceaccount.yaml
 apiVersion: v1
 kind: ServiceAccount
 metadata:
   name: thanos-compactor
-  namespace: "default"
+  namespace: default
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: compactor
-  annotations:
-automountServiceAccountToken: true
+automountServiceAccountToken: false
 ---
 # Source: thanos/templates/query/serviceaccount.yaml
 apiVersion: v1
 kind: ServiceAccount
 metadata:
   name: thanos-query
-  namespace: "default"
+  namespace: default
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: query
-  annotations:
-automountServiceAccountToken: true
+automountServiceAccountToken: false
 ---
 # Source: thanos/templates/storegateway/serviceaccount.yaml
 apiVersion: v1
 kind: ServiceAccount
 metadata:
   name: thanos-storegateway
-  namespace: "default"
+  namespace: default
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: storegateway
-  annotations:
-automountServiceAccountToken: true
+automountServiceAccountToken: false
 ---
 # Source: thanos/templates/bucketweb/service.yaml
 apiVersion: v1
 kind: Service
 metadata:
   name: thanos-bucketweb
-  namespace: "default"
+  namespace: default
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: bucketweb
-  annotations:
+    prometheus-operator/monitor: 'true'
 spec:
   type: ClusterIP
   ports:
@@ -75,8 +270,8 @@
       name: http
       nodePort: null
   selector:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: bucketweb
 ---
 # Source: thanos/templates/compactor/service.yaml
@@ -84,13 +279,13 @@
 kind: Service
 metadata:
   name: thanos-compactor
-  namespace: "default"
+  namespace: default
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: compactor
-  annotations:
+    prometheus-operator/monitor: 'true'
 spec:
   type: ClusterIP
   ports:
@@ -100,8 +295,8 @@
       name: http
       nodePort: null
   selector:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: compactor
 ---
 # Source: thanos/templates/query/service-grpc.yaml
@@ -109,13 +304,12 @@
 kind: Service
 metadata:
   name: thanos-query-grpc
-  namespace: "default"
+  namespace: default
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: query
-  annotations:
 spec:
   type: ClusterIP
   ports:
@@ -125,8 +319,8 @@
       name: grpc
       nodePort: null
   selector:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: query
 ---
 # Source: thanos/templates/query/service.yaml
@@ -134,13 +328,13 @@
 kind: Service
 metadata:
   name: thanos-query
-  namespace: "default"
+  namespace: default
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: query
-  annotations:
+    prometheus-operator/monitor: 'true'
 spec:
   type: ClusterIP
   ports:
@@ -150,8 +344,8 @@
       name: http
       nodePort: null
   selector:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: query
 ---
 # Source: thanos/templates/storegateway/service.yaml
@@ -159,14 +353,13 @@
 kind: Service
 metadata:
   name: thanos-storegateway
-  namespace: "default"
+  namespace: default
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: storegateway
     prometheus-operator/monitor: 'true'
-  annotations:
 spec:
   type: ClusterIP
   ports:
@@ -181,8 +374,8 @@
       name: grpc
       nodePort: null
   selector:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: storegateway
 ---
 # Source: thanos/templates/bucketweb/deployment.yaml
@@ -190,32 +383,32 @@
 kind: Deployment
 metadata:
   name: thanos-bucketweb
-  namespace: "default"
+  namespace: default
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: bucketweb
 spec:
   replicas: 1
+  revisionHistoryLimit: 10
   strategy:
     type: RollingUpdate
   selector:
     matchLabels:
-      app.kubernetes.io/name: thanos
       app.kubernetes.io/instance: thanos
+      app.kubernetes.io/name: thanos
       app.kubernetes.io/component: bucketweb
   template:
     metadata:
       labels:
-        app.kubernetes.io/name: thanos
         app.kubernetes.io/instance: thanos
         app.kubernetes.io/managed-by: Helm
+        app.kubernetes.io/name: thanos
         app.kubernetes.io/component: bucketweb
       annotations:
-        checksum/objstore-configuration: 01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b
     spec:
-      serviceAccount: thanos-bucketweb
+      serviceAccountName: thanos-bucketweb
       automountServiceAccountToken: true
       affinity:
         podAffinity:
@@ -224,25 +417,34 @@
             - podAffinityTerm:
                 labelSelector:
                   matchLabels:
-                    app.kubernetes.io/name: thanos
                     app.kubernetes.io/instance: thanos
+                    app.kubernetes.io/name: thanos
                     app.kubernetes.io/component: bucketweb
-                namespaces:
-                  - "default"
                 topologyKey: kubernetes.io/hostname
               weight: 1
         nodeAffinity:
       securityContext:
         fsGroup: 1001
+        fsGroupChangePolicy: Always
+        supplementalGroups: []
+        sysctls: []
       containers:
         - name: bucketweb
-          image: public.ecr.aws/bitnami/thanos:0.28.1-scratch-r0
+          image: public.ecr.aws/bitnami/thanos:0.34.1-debian-12-r1
           imagePullPolicy: "IfNotPresent"
           securityContext:
             allowPrivilegeEscalation: false
+            capabilities:
+              drop:
+                - ALL
+            privileged: false
             readOnlyRootFilesystem: true
+            runAsGroup: 1001
             runAsNonRoot: true
             runAsUser: 1001
+            seLinuxOptions: {}
+            seccompProfile:
+              type: RuntimeDefault
           args:
             - tools
             - bucket
@@ -297,32 +499,32 @@
 kind: Deployment
 metadata:
   name: thanos-compactor
-  namespace: "default"
+  namespace: default
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: compactor
 spec:
   replicas: 1
+  revisionHistoryLimit: 10
   strategy:
     type: Recreate
   selector:
     matchLabels:
-      app.kubernetes.io/name: thanos
       app.kubernetes.io/instance: thanos
+      app.kubernetes.io/name: thanos
       app.kubernetes.io/component: compactor
   template:
     metadata:
       labels:
-        app.kubernetes.io/name: thanos
         app.kubernetes.io/instance: thanos
         app.kubernetes.io/managed-by: Helm
+        app.kubernetes.io/name: thanos
         app.kubernetes.io/component: compactor
       annotations:
-        checksum/objstore-configuration: 01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b
     spec:
-      serviceAccount: thanos-compactor
+      serviceAccountName: thanos-compactor
       automountServiceAccountToken: true
       affinity:
         podAffinity:
@@ -331,25 +533,34 @@
             - podAffinityTerm:
                 labelSelector:
                   matchLabels:
-                    app.kubernetes.io/name: thanos
                     app.kubernetes.io/instance: thanos
+                    app.kubernetes.io/name: thanos
                     app.kubernetes.io/component: compactor
-                namespaces:
-                  - "default"
                 topologyKey: kubernetes.io/hostname
               weight: 1
         nodeAffinity:
       securityContext:
         fsGroup: 1001
+        fsGroupChangePolicy: Always
+        supplementalGroups: []
+        sysctls: []
       containers:
         - name: compactor
-          image: public.ecr.aws/bitnami/thanos:0.28.1-scratch-r0
+          image: public.ecr.aws/bitnami/thanos:0.34.1-debian-12-r1
           imagePullPolicy: "IfNotPresent"
           securityContext:
             allowPrivilegeEscalation: false
+            capabilities:
+              drop:
+                - ALL
+            privileged: false
             readOnlyRootFilesystem: true
+            runAsGroup: 1001
             runAsNonRoot: true
             runAsUser: 1001
+            seLinuxOptions: {}
+            seccompProfile:
+              type: RuntimeDefault
           args:
             - compact
             - --log.level=info
@@ -410,30 +621,31 @@
 kind: Deployment
 metadata:
   name: thanos-query
-  namespace: "default"
+  namespace: default
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: query
 spec:
   replicas: 1
+  revisionHistoryLimit: 10
   strategy:
     type: RollingUpdate
   selector:
     matchLabels:
-      app.kubernetes.io/name: thanos
       app.kubernetes.io/instance: thanos
+      app.kubernetes.io/name: thanos
       app.kubernetes.io/component: query
   template:
     metadata:
       labels:
-        app.kubernetes.io/name: thanos
         app.kubernetes.io/instance: thanos
         app.kubernetes.io/managed-by: Helm
+        app.kubernetes.io/name: thanos
         app.kubernetes.io/component: query
     spec:
-      serviceAccount: thanos-query
+      serviceAccountName: thanos-query
       automountServiceAccountToken: true
       affinity:
         podAffinity:
@@ -442,25 +654,34 @@
             - podAffinityTerm:
                 labelSelector:
                   matchLabels:
-                    app.kubernetes.io/name: thanos
                     app.kubernetes.io/instance: thanos
+                    app.kubernetes.io/name: thanos
                     app.kubernetes.io/component: query
-                namespaces:
-                  - "default"
                 topologyKey: kubernetes.io/hostname
               weight: 1
         nodeAffinity:
       securityContext:
         fsGroup: 1001
+        fsGroupChangePolicy: Always
+        supplementalGroups: []
+        sysctls: []
       containers:
         - name: query
-          image: public.ecr.aws/bitnami/thanos:0.28.1-scratch-r0
+          image: public.ecr.aws/bitnami/thanos:0.34.1-debian-12-r1
           imagePullPolicy: "IfNotPresent"
           securityContext:
             allowPrivilegeEscalation: false
+            capabilities:
+              drop:
+                - ALL
+            privileged: false
             readOnlyRootFilesystem: true
+            runAsGroup: 1001
             runAsNonRoot: true
             runAsUser: 1001
+            seLinuxOptions: {}
+            seccompProfile:
+              type: RuntimeDefault
           args:
             - query
             - --log.level=info
@@ -470,6 +691,7 @@
             - --query.replica-label=replica
             - --endpoint=dnssrv+_grpc._tcp.prometheus-thanos-discovery.monitoring.svc.cluster.local
             - --endpoint=dnssrv+_grpc._tcp.thanos-storegateway.default.svc.cluster.local
+            - --alert.query-url=http://thanos-query.default.svc.cluster.local:9090
           ports:
             - name: http
               containerPort: 10902
@@ -498,8 +720,14 @@
               port: http
               scheme: HTTP
           resources:
-            limits: {}
-            requests: {}
+            limits:
+              cpu: 150m
+              ephemeral-storage: 1024Mi
+              memory: 192Mi
+            requests:
+              cpu: 100m
+              ephemeral-storage: 50Mi
+              memory: 128Mi
           volumeMounts:
       volumes:
 ---
@@ -508,34 +736,34 @@
 kind: StatefulSet
 metadata:
   name: thanos-storegateway
-  namespace: "default"
+  namespace: default
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: storegateway
 spec:
   replicas: 1
+  revisionHistoryLimit: 10
   podManagementPolicy: OrderedReady
   serviceName: thanos-storegateway-headless
   updateStrategy:
     type: RollingUpdate
   selector:
     matchLabels:
-      app.kubernetes.io/name: thanos
       app.kubernetes.io/instance: thanos
+      app.kubernetes.io/name: thanos
       app.kubernetes.io/component: storegateway
   template:
     metadata:
       labels:
-        app.kubernetes.io/name: thanos
         app.kubernetes.io/instance: thanos
         app.kubernetes.io/managed-by: Helm
+        app.kubernetes.io/name: thanos
         app.kubernetes.io/component: storegateway
       annotations:
-        checksum/objstore-configuration: 01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b
     spec:
-      serviceAccount: thanos-storegateway
+      serviceAccountName: thanos-storegateway
       automountServiceAccountToken: true
       affinity:
         podAffinity:
@@ -544,25 +772,34 @@
             - podAffinityTerm:
                 labelSelector:
                   matchLabels:
-                    app.kubernetes.io/name: thanos
                     app.kubernetes.io/instance: thanos
+                    app.kubernetes.io/name: thanos
                     app.kubernetes.io/component: storegateway
-                namespaces:
-                  - "default"
                 topologyKey: kubernetes.io/hostname
               weight: 1
         nodeAffinity:
       securityContext:
         fsGroup: 1001
+        fsGroupChangePolicy: Always
+        supplementalGroups: []
+        sysctls: []
       containers:
         - name: storegateway
-          image: public.ecr.aws/bitnami/thanos:0.28.1-scratch-r0
+          image: public.ecr.aws/bitnami/thanos:0.34.1-debian-12-r1
           imagePullPolicy: "IfNotPresent"
           securityContext:
             allowPrivilegeEscalation: false
+            capabilities:
+              drop:
+                - ALL
+            privileged: false
             readOnlyRootFilesystem: true
+            runAsGroup: 1001
             runAsNonRoot: true
             runAsUser: 1001
+            seLinuxOptions: {}
+            seccompProfile:
+              type: RuntimeDefault
           args:
             - store
             - --log.level=info
@@ -599,8 +836,14 @@
               port: http
               scheme: HTTP
           resources:
-            limits: {}
-            requests: {}
+            limits:
+              cpu: 150m
+              ephemeral-storage: 1024Mi
+              memory: 192Mi
+            requests:
+              cpu: 100m
+              ephemeral-storage: 50Mi
+              memory: 128Mi
           volumeMounts:
             - name: objstore-config
               mountPath: /conf
@@ -625,11 +868,11 @@
 kind: Ingress
 metadata:
   name: thanos-query
-  namespace: "default"
+  namespace: default
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: query
   annotations:
     app: thanos
@@ -655,9 +898,9 @@
   name: thanos-bucketweb
   namespace: "default"
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: bucketweb
 spec:
   endpoints:
@@ -667,9 +910,10 @@
       - "default"
   selector:
     matchLabels:
-      app.kubernetes.io/name: thanos
       app.kubernetes.io/instance: thanos
+      app.kubernetes.io/name: thanos
       app.kubernetes.io/component: bucketweb
+      prometheus-operator/monitor: 'true'
 ---
 # Source: thanos/templates/compactor/servicemonitor.yaml
 apiVersion: monitoring.coreos.com/v1
@@ -678,9 +922,9 @@
   name: thanos-compactor
   namespace: "default"
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: compactor
 spec:
   endpoints:
@@ -690,9 +934,10 @@
       - "default"
   selector:
     matchLabels:
-      app.kubernetes.io/name: thanos
       app.kubernetes.io/instance: thanos
+      app.kubernetes.io/name: thanos
       app.kubernetes.io/component: compactor
+      prometheus-operator/monitor: 'true'
 ---
 # Source: thanos/templates/query/servicemonitor.yaml
 apiVersion: monitoring.coreos.com/v1
@@ -701,9 +946,9 @@
   name: thanos-query
   namespace: "default"
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: query
 spec:
   endpoints:
@@ -713,9 +958,10 @@
       - "default"
   selector:
     matchLabels:
-      app.kubernetes.io/name: thanos
       app.kubernetes.io/instance: thanos
+      app.kubernetes.io/name: thanos
       app.kubernetes.io/component: query
+      prometheus-operator/monitor: 'true'
 ---
 # Source: thanos/templates/storegateway/servicemonitor.yaml
 apiVersion: monitoring.coreos.com/v1
@@ -724,9 +970,9 @@
   name: thanos-storegateway
   namespace: "default"
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: storegateway
 spec:
   endpoints:
@@ -736,6 +982,7 @@
       - "default"
   selector:
     matchLabels:
-      app.kubernetes.io/name: thanos
       app.kubernetes.io/instance: thanos
+      app.kubernetes.io/name: thanos
       app.kubernetes.io/component: storegateway
+      prometheus-operator/monitor: 'true'

@renovate renovate bot force-pushed the renovate/thanos-15.x branch from 13c2903 to 6039f33 Compare April 5, 2024 01:30
@renovate renovate bot changed the title feat(charts)!: Update Helm release thanos to 15.0.2 feat(charts)!: Update Helm release thanos to 15.0.3 Apr 5, 2024
@github-actions GitHub Actions
Copy link

github-actions bot commented Apr 5, 2024

Path: cluster/core/monitoring/thanos/helm-release.yaml
Version: 11.5.5 -> 15.0.3

@@ -1,71 +1,266 @@
+# Source: thanos/templates/bucketweb/networkpolicy.yaml
+kind: NetworkPolicy
+apiVersion: networking.k8s.io/v1
+metadata:
+  name: thanos-bucketweb
+  namespace: "default"
+  labels:
+    app.kubernetes.io/instance: thanos
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
+    app.kubernetes.io/component: bucketweb
+spec:
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/instance: thanos
+      app.kubernetes.io/name: thanos
+      app.kubernetes.io/component: bucketweb
+  policyTypes:
+    - Ingress
+    - Egress
+  egress:
+    - {}
+  ingress:
+    - ports:
+        - port: 8080
+        - port: 8080
+---
+# Source: thanos/templates/compactor/networkpolicy.yaml
+kind: NetworkPolicy
+apiVersion: networking.k8s.io/v1
+metadata:
+  name: thanos-compactor
+  namespace: "default"
+  labels:
+    app.kubernetes.io/instance: thanos
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
+    app.kubernetes.io/component: compactor
+spec:
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/instance: thanos
+      app.kubernetes.io/name: thanos
+      app.kubernetes.io/component: compactor
+  policyTypes:
+    - Ingress
+    - Egress
+  egress:
+    - {}
+  ingress:
+    - ports:
+        - port: 10902
+        - port: 9090
+---
+# Source: thanos/templates/query-frontend/networkpolicy.yaml
+kind: NetworkPolicy
+apiVersion: networking.k8s.io/v1
+metadata:
+  name: thanos-query-frontend
+  namespace: "default"
+  labels:
+    app.kubernetes.io/instance: thanos
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
+    app.kubernetes.io/component: query-frontend
+spec:
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/instance: thanos
+      app.kubernetes.io/name: thanos
+      app.kubernetes.io/component: query-frontend
+  policyTypes:
+    - Ingress
+    - Egress
+  egress:
+    - {}
+  ingress:
+    - ports:
+        - port: 9090
+        - port: 9090
+---
+# Source: thanos/templates/query/networkpolicy.yaml
+kind: NetworkPolicy
+apiVersion: networking.k8s.io/v1
+metadata:
+  name: thanos-query
+  namespace: "default"
+  labels:
+    app.kubernetes.io/instance: thanos
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
+    app.kubernetes.io/component: query
+spec:
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/instance: thanos
+      app.kubernetes.io/name: thanos
+      app.kubernetes.io/component: query
+  policyTypes:
+    - Ingress
+    - Egress
+  egress:
+    - {}
+  ingress:
+    - ports:
+        - port: 10902
+        - port: 10901
+        - port: 9090
+        - port: 10901
+---
+# Source: thanos/templates/receive/networkpolicy.yaml
+kind: NetworkPolicy
+apiVersion: networking.k8s.io/v1
+metadata:
+  name: thanos-receive
+  namespace: "default"
+  labels:
+    app.kubernetes.io/instance: thanos
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
+    app.kubernetes.io/component: receive
+spec:
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/instance: thanos
+      app.kubernetes.io/name: thanos
+      app.kubernetes.io/component: receive
+  policyTypes:
+    - Ingress
+    - Egress
+  egress:
+    - {}
+  ingress:
+    - ports:
+        - port: 10902
+        - port: 10902
+        - port: 10901
+        - port: 10901
+        - port: 19291
+        - port: 19291
+---
+# Source: thanos/templates/ruler/networkpolicy.yaml
+kind: NetworkPolicy
+apiVersion: networking.k8s.io/v1
+metadata:
+  name: thanos-ruler
+  namespace: "default"
+  labels:
+    app.kubernetes.io/instance: thanos
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
+    app.kubernetes.io/component: ruler
+spec:
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/instance: thanos
+      app.kubernetes.io/name: thanos
+      app.kubernetes.io/component: ruler
+  policyTypes:
+    - Ingress
+    - Egress
+  egress:
+    - {}
+  ingress:
+    - ports:
+        - port: 10902
+        - port: 9090
+        - port: 10901
+        - port: 10901
+---
+# Source: thanos/templates/storegateway/networkpolicy.yaml
+kind: NetworkPolicy
+apiVersion: networking.k8s.io/v1
+metadata:
+  name: thanos-storegateway
+  namespace: "default"
+  labels:
+    app.kubernetes.io/instance: thanos
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
+    app.kubernetes.io/component: storegateway
+spec:
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/instance: thanos
+      app.kubernetes.io/name: thanos
+      app.kubernetes.io/component: storegateway
+  policyTypes:
+    - Ingress
+    - Egress
+  egress:
+    - {}
+  ingress:
+    - ports:
+        - port: 10902
+        - port: 9090
+        - port: 10901
+        - port: 10901
+---
 # Source: thanos/templates/bucketweb/serviceaccount.yaml
 apiVersion: v1
 kind: ServiceAccount
 metadata:
   name: thanos-bucketweb
-  namespace: "default"
+  namespace: default
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: bucketweb
-  annotations:
-automountServiceAccountToken: true
+automountServiceAccountToken: false
 ---
 # Source: thanos/templates/compactor/serviceaccount.yaml
 apiVersion: v1
 kind: ServiceAccount
 metadata:
   name: thanos-compactor
-  namespace: "default"
+  namespace: default
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: compactor
-  annotations:
-automountServiceAccountToken: true
+automountServiceAccountToken: false
 ---
 # Source: thanos/templates/query/serviceaccount.yaml
 apiVersion: v1
 kind: ServiceAccount
 metadata:
   name: thanos-query
-  namespace: "default"
+  namespace: default
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: query
-  annotations:
-automountServiceAccountToken: true
+automountServiceAccountToken: false
 ---
 # Source: thanos/templates/storegateway/serviceaccount.yaml
 apiVersion: v1
 kind: ServiceAccount
 metadata:
   name: thanos-storegateway
-  namespace: "default"
+  namespace: default
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: storegateway
-  annotations:
-automountServiceAccountToken: true
+automountServiceAccountToken: false
 ---
 # Source: thanos/templates/bucketweb/service.yaml
 apiVersion: v1
 kind: Service
 metadata:
   name: thanos-bucketweb
-  namespace: "default"
+  namespace: default
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: bucketweb
-  annotations:
+    prometheus-operator/monitor: 'true'
 spec:
   type: ClusterIP
   ports:
@@ -75,8 +270,8 @@
       name: http
       nodePort: null
   selector:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: bucketweb
 ---
 # Source: thanos/templates/compactor/service.yaml
@@ -84,13 +279,13 @@
 kind: Service
 metadata:
   name: thanos-compactor
-  namespace: "default"
+  namespace: default
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: compactor
-  annotations:
+    prometheus-operator/monitor: 'true'
 spec:
   type: ClusterIP
   ports:
@@ -100,8 +295,8 @@
       name: http
       nodePort: null
   selector:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: compactor
 ---
 # Source: thanos/templates/query/service-grpc.yaml
@@ -109,13 +304,12 @@
 kind: Service
 metadata:
   name: thanos-query-grpc
-  namespace: "default"
+  namespace: default
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: query
-  annotations:
 spec:
   type: ClusterIP
   ports:
@@ -125,8 +319,8 @@
       name: grpc
       nodePort: null
   selector:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: query
 ---
 # Source: thanos/templates/query/service.yaml
@@ -134,13 +328,13 @@
 kind: Service
 metadata:
   name: thanos-query
-  namespace: "default"
+  namespace: default
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: query
-  annotations:
+    prometheus-operator/monitor: 'true'
 spec:
   type: ClusterIP
   ports:
@@ -150,8 +344,8 @@
       name: http
       nodePort: null
   selector:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: query
 ---
 # Source: thanos/templates/storegateway/service.yaml
@@ -159,14 +353,13 @@
 kind: Service
 metadata:
   name: thanos-storegateway
-  namespace: "default"
+  namespace: default
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: storegateway
     prometheus-operator/monitor: 'true'
-  annotations:
 spec:
   type: ClusterIP
   ports:
@@ -181,8 +374,8 @@
       name: grpc
       nodePort: null
   selector:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: storegateway
 ---
 # Source: thanos/templates/bucketweb/deployment.yaml
@@ -190,32 +383,32 @@
 kind: Deployment
 metadata:
   name: thanos-bucketweb
-  namespace: "default"
+  namespace: default
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: bucketweb
 spec:
   replicas: 1
+  revisionHistoryLimit: 10
   strategy:
     type: RollingUpdate
   selector:
     matchLabels:
-      app.kubernetes.io/name: thanos
       app.kubernetes.io/instance: thanos
+      app.kubernetes.io/name: thanos
       app.kubernetes.io/component: bucketweb
   template:
     metadata:
       labels:
-        app.kubernetes.io/name: thanos
         app.kubernetes.io/instance: thanos
         app.kubernetes.io/managed-by: Helm
+        app.kubernetes.io/name: thanos
         app.kubernetes.io/component: bucketweb
       annotations:
-        checksum/objstore-configuration: 01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b
     spec:
-      serviceAccount: thanos-bucketweb
+      serviceAccountName: thanos-bucketweb
       automountServiceAccountToken: true
       affinity:
         podAffinity:
@@ -224,25 +417,34 @@
             - podAffinityTerm:
                 labelSelector:
                   matchLabels:
-                    app.kubernetes.io/name: thanos
                     app.kubernetes.io/instance: thanos
+                    app.kubernetes.io/name: thanos
                     app.kubernetes.io/component: bucketweb
-                namespaces:
-                  - "default"
                 topologyKey: kubernetes.io/hostname
               weight: 1
         nodeAffinity:
       securityContext:
         fsGroup: 1001
+        fsGroupChangePolicy: Always
+        supplementalGroups: []
+        sysctls: []
       containers:
         - name: bucketweb
-          image: public.ecr.aws/bitnami/thanos:0.28.1-scratch-r0
+          image: public.ecr.aws/bitnami/thanos:0.34.1-debian-12-r2
           imagePullPolicy: "IfNotPresent"
           securityContext:
             allowPrivilegeEscalation: false
+            capabilities:
+              drop:
+                - ALL
+            privileged: false
             readOnlyRootFilesystem: true
+            runAsGroup: 1001
             runAsNonRoot: true
             runAsUser: 1001
+            seLinuxOptions: {}
+            seccompProfile:
+              type: RuntimeDefault
           args:
             - tools
             - bucket
@@ -297,32 +499,32 @@
 kind: Deployment
 metadata:
   name: thanos-compactor
-  namespace: "default"
+  namespace: default
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: compactor
 spec:
   replicas: 1
+  revisionHistoryLimit: 10
   strategy:
     type: Recreate
   selector:
     matchLabels:
-      app.kubernetes.io/name: thanos
       app.kubernetes.io/instance: thanos
+      app.kubernetes.io/name: thanos
       app.kubernetes.io/component: compactor
   template:
     metadata:
       labels:
-        app.kubernetes.io/name: thanos
         app.kubernetes.io/instance: thanos
         app.kubernetes.io/managed-by: Helm
+        app.kubernetes.io/name: thanos
         app.kubernetes.io/component: compactor
       annotations:
-        checksum/objstore-configuration: 01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b
     spec:
-      serviceAccount: thanos-compactor
+      serviceAccountName: thanos-compactor
       automountServiceAccountToken: true
       affinity:
         podAffinity:
@@ -331,25 +533,34 @@
             - podAffinityTerm:
                 labelSelector:
                   matchLabels:
-                    app.kubernetes.io/name: thanos
                     app.kubernetes.io/instance: thanos
+                    app.kubernetes.io/name: thanos
                     app.kubernetes.io/component: compactor
-                namespaces:
-                  - "default"
                 topologyKey: kubernetes.io/hostname
               weight: 1
         nodeAffinity:
       securityContext:
         fsGroup: 1001
+        fsGroupChangePolicy: Always
+        supplementalGroups: []
+        sysctls: []
       containers:
         - name: compactor
-          image: public.ecr.aws/bitnami/thanos:0.28.1-scratch-r0
+          image: public.ecr.aws/bitnami/thanos:0.34.1-debian-12-r2
           imagePullPolicy: "IfNotPresent"
           securityContext:
             allowPrivilegeEscalation: false
+            capabilities:
+              drop:
+                - ALL
+            privileged: false
             readOnlyRootFilesystem: true
+            runAsGroup: 1001
             runAsNonRoot: true
             runAsUser: 1001
+            seLinuxOptions: {}
+            seccompProfile:
+              type: RuntimeDefault
           args:
             - compact
             - --log.level=info
@@ -410,30 +621,31 @@
 kind: Deployment
 metadata:
   name: thanos-query
-  namespace: "default"
+  namespace: default
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: query
 spec:
   replicas: 1
+  revisionHistoryLimit: 10
   strategy:
     type: RollingUpdate
   selector:
     matchLabels:
-      app.kubernetes.io/name: thanos
       app.kubernetes.io/instance: thanos
+      app.kubernetes.io/name: thanos
       app.kubernetes.io/component: query
   template:
     metadata:
       labels:
-        app.kubernetes.io/name: thanos
         app.kubernetes.io/instance: thanos
         app.kubernetes.io/managed-by: Helm
+        app.kubernetes.io/name: thanos
         app.kubernetes.io/component: query
     spec:
-      serviceAccount: thanos-query
+      serviceAccountName: thanos-query
       automountServiceAccountToken: true
       affinity:
         podAffinity:
@@ -442,25 +654,34 @@
             - podAffinityTerm:
                 labelSelector:
                   matchLabels:
-                    app.kubernetes.io/name: thanos
                     app.kubernetes.io/instance: thanos
+                    app.kubernetes.io/name: thanos
                     app.kubernetes.io/component: query
-                namespaces:
-                  - "default"
                 topologyKey: kubernetes.io/hostname
               weight: 1
         nodeAffinity:
       securityContext:
         fsGroup: 1001
+        fsGroupChangePolicy: Always
+        supplementalGroups: []
+        sysctls: []
       containers:
         - name: query
-          image: public.ecr.aws/bitnami/thanos:0.28.1-scratch-r0
+          image: public.ecr.aws/bitnami/thanos:0.34.1-debian-12-r2
           imagePullPolicy: "IfNotPresent"
           securityContext:
             allowPrivilegeEscalation: false
+            capabilities:
+              drop:
+                - ALL
+            privileged: false
             readOnlyRootFilesystem: true
+            runAsGroup: 1001
             runAsNonRoot: true
             runAsUser: 1001
+            seLinuxOptions: {}
+            seccompProfile:
+              type: RuntimeDefault
           args:
             - query
             - --log.level=info
@@ -470,6 +691,7 @@
             - --query.replica-label=replica
             - --endpoint=dnssrv+_grpc._tcp.prometheus-thanos-discovery.monitoring.svc.cluster.local
             - --endpoint=dnssrv+_grpc._tcp.thanos-storegateway.default.svc.cluster.local
+            - --alert.query-url=http://thanos-query.default.svc.cluster.local:9090
           ports:
             - name: http
               containerPort: 10902
@@ -498,8 +720,14 @@
               port: http
               scheme: HTTP
           resources:
-            limits: {}
-            requests: {}
+            limits:
+              cpu: 150m
+              ephemeral-storage: 1024Mi
+              memory: 192Mi
+            requests:
+              cpu: 100m
+              ephemeral-storage: 50Mi
+              memory: 128Mi
           volumeMounts:
       volumes:
 ---
@@ -508,34 +736,34 @@
 kind: StatefulSet
 metadata:
   name: thanos-storegateway
-  namespace: "default"
+  namespace: default
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: storegateway
 spec:
   replicas: 1
+  revisionHistoryLimit: 10
   podManagementPolicy: OrderedReady
   serviceName: thanos-storegateway-headless
   updateStrategy:
     type: RollingUpdate
   selector:
     matchLabels:
-      app.kubernetes.io/name: thanos
       app.kubernetes.io/instance: thanos
+      app.kubernetes.io/name: thanos
       app.kubernetes.io/component: storegateway
   template:
     metadata:
       labels:
-        app.kubernetes.io/name: thanos
         app.kubernetes.io/instance: thanos
         app.kubernetes.io/managed-by: Helm
+        app.kubernetes.io/name: thanos
         app.kubernetes.io/component: storegateway
       annotations:
-        checksum/objstore-configuration: 01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b
     spec:
-      serviceAccount: thanos-storegateway
+      serviceAccountName: thanos-storegateway
       automountServiceAccountToken: true
       affinity:
         podAffinity:
@@ -544,25 +772,34 @@
             - podAffinityTerm:
                 labelSelector:
                   matchLabels:
-                    app.kubernetes.io/name: thanos
                     app.kubernetes.io/instance: thanos
+                    app.kubernetes.io/name: thanos
                     app.kubernetes.io/component: storegateway
-                namespaces:
-                  - "default"
                 topologyKey: kubernetes.io/hostname
               weight: 1
         nodeAffinity:
       securityContext:
         fsGroup: 1001
+        fsGroupChangePolicy: Always
+        supplementalGroups: []
+        sysctls: []
       containers:
         - name: storegateway
-          image: public.ecr.aws/bitnami/thanos:0.28.1-scratch-r0
+          image: public.ecr.aws/bitnami/thanos:0.34.1-debian-12-r2
           imagePullPolicy: "IfNotPresent"
           securityContext:
             allowPrivilegeEscalation: false
+            capabilities:
+              drop:
+                - ALL
+            privileged: false
             readOnlyRootFilesystem: true
+            runAsGroup: 1001
             runAsNonRoot: true
             runAsUser: 1001
+            seLinuxOptions: {}
+            seccompProfile:
+              type: RuntimeDefault
           args:
             - store
             - --log.level=info
@@ -599,8 +836,14 @@
               port: http
               scheme: HTTP
           resources:
-            limits: {}
-            requests: {}
+            limits:
+              cpu: 150m
+              ephemeral-storage: 1024Mi
+              memory: 192Mi
+            requests:
+              cpu: 100m
+              ephemeral-storage: 50Mi
+              memory: 128Mi
           volumeMounts:
             - name: objstore-config
               mountPath: /conf
@@ -625,11 +868,11 @@
 kind: Ingress
 metadata:
   name: thanos-query
-  namespace: "default"
+  namespace: default
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: query
   annotations:
     app: thanos
@@ -655,9 +898,9 @@
   name: thanos-bucketweb
   namespace: "default"
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: bucketweb
 spec:
   endpoints:
@@ -667,9 +910,10 @@
       - "default"
   selector:
     matchLabels:
-      app.kubernetes.io/name: thanos
       app.kubernetes.io/instance: thanos
+      app.kubernetes.io/name: thanos
       app.kubernetes.io/component: bucketweb
+      prometheus-operator/monitor: 'true'
 ---
 # Source: thanos/templates/compactor/servicemonitor.yaml
 apiVersion: monitoring.coreos.com/v1
@@ -678,9 +922,9 @@
   name: thanos-compactor
   namespace: "default"
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: compactor
 spec:
   endpoints:
@@ -690,9 +934,10 @@
       - "default"
   selector:
     matchLabels:
-      app.kubernetes.io/name: thanos
       app.kubernetes.io/instance: thanos
+      app.kubernetes.io/name: thanos
       app.kubernetes.io/component: compactor
+      prometheus-operator/monitor: 'true'
 ---
 # Source: thanos/templates/query/servicemonitor.yaml
 apiVersion: monitoring.coreos.com/v1
@@ -701,9 +946,9 @@
   name: thanos-query
   namespace: "default"
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: query
 spec:
   endpoints:
@@ -713,9 +958,10 @@
       - "default"
   selector:
     matchLabels:
-      app.kubernetes.io/name: thanos
       app.kubernetes.io/instance: thanos
+      app.kubernetes.io/name: thanos
       app.kubernetes.io/component: query
+      prometheus-operator/monitor: 'true'
 ---
 # Source: thanos/templates/storegateway/servicemonitor.yaml
 apiVersion: monitoring.coreos.com/v1
@@ -724,9 +970,9 @@
   name: thanos-storegateway
   namespace: "default"
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: storegateway
 spec:
   endpoints:
@@ -736,6 +982,7 @@
       - "default"
   selector:
     matchLabels:
-      app.kubernetes.io/name: thanos
       app.kubernetes.io/instance: thanos
+      app.kubernetes.io/name: thanos
       app.kubernetes.io/component: storegateway
+      prometheus-operator/monitor: 'true'

@renovate renovate bot force-pushed the renovate/thanos-15.x branch from 6039f33 to 61a326b Compare April 7, 2024 05:42
@renovate renovate bot changed the title feat(charts)!: Update Helm release thanos to 15.0.3 feat(charts)!: Update Helm release thanos to 15.0.4 Apr 7, 2024
@github-actions GitHub Actions
Copy link

github-actions bot commented Apr 7, 2024

Path: cluster/core/monitoring/thanos/helm-release.yaml
Version: 11.5.5 -> 15.0.4

@@ -1,71 +1,266 @@
+# Source: thanos/templates/bucketweb/networkpolicy.yaml
+kind: NetworkPolicy
+apiVersion: networking.k8s.io/v1
+metadata:
+  name: thanos-bucketweb
+  namespace: "default"
+  labels:
+    app.kubernetes.io/instance: thanos
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
+    app.kubernetes.io/component: bucketweb
+spec:
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/instance: thanos
+      app.kubernetes.io/name: thanos
+      app.kubernetes.io/component: bucketweb
+  policyTypes:
+    - Ingress
+    - Egress
+  egress:
+    - {}
+  ingress:
+    - ports:
+        - port: 8080
+        - port: 8080
+---
+# Source: thanos/templates/compactor/networkpolicy.yaml
+kind: NetworkPolicy
+apiVersion: networking.k8s.io/v1
+metadata:
+  name: thanos-compactor
+  namespace: "default"
+  labels:
+    app.kubernetes.io/instance: thanos
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
+    app.kubernetes.io/component: compactor
+spec:
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/instance: thanos
+      app.kubernetes.io/name: thanos
+      app.kubernetes.io/component: compactor
+  policyTypes:
+    - Ingress
+    - Egress
+  egress:
+    - {}
+  ingress:
+    - ports:
+        - port: 10902
+        - port: 9090
+---
+# Source: thanos/templates/query-frontend/networkpolicy.yaml
+kind: NetworkPolicy
+apiVersion: networking.k8s.io/v1
+metadata:
+  name: thanos-query-frontend
+  namespace: "default"
+  labels:
+    app.kubernetes.io/instance: thanos
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
+    app.kubernetes.io/component: query-frontend
+spec:
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/instance: thanos
+      app.kubernetes.io/name: thanos
+      app.kubernetes.io/component: query-frontend
+  policyTypes:
+    - Ingress
+    - Egress
+  egress:
+    - {}
+  ingress:
+    - ports:
+        - port: 9090
+        - port: 9090
+---
+# Source: thanos/templates/query/networkpolicy.yaml
+kind: NetworkPolicy
+apiVersion: networking.k8s.io/v1
+metadata:
+  name: thanos-query
+  namespace: "default"
+  labels:
+    app.kubernetes.io/instance: thanos
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
+    app.kubernetes.io/component: query
+spec:
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/instance: thanos
+      app.kubernetes.io/name: thanos
+      app.kubernetes.io/component: query
+  policyTypes:
+    - Ingress
+    - Egress
+  egress:
+    - {}
+  ingress:
+    - ports:
+        - port: 10902
+        - port: 10901
+        - port: 9090
+        - port: 10901
+---
+# Source: thanos/templates/receive/networkpolicy.yaml
+kind: NetworkPolicy
+apiVersion: networking.k8s.io/v1
+metadata:
+  name: thanos-receive
+  namespace: "default"
+  labels:
+    app.kubernetes.io/instance: thanos
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
+    app.kubernetes.io/component: receive
+spec:
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/instance: thanos
+      app.kubernetes.io/name: thanos
+      app.kubernetes.io/component: receive
+  policyTypes:
+    - Ingress
+    - Egress
+  egress:
+    - {}
+  ingress:
+    - ports:
+        - port: 10902
+        - port: 10902
+        - port: 10901
+        - port: 10901
+        - port: 19291
+        - port: 19291
+---
+# Source: thanos/templates/ruler/networkpolicy.yaml
+kind: NetworkPolicy
+apiVersion: networking.k8s.io/v1
+metadata:
+  name: thanos-ruler
+  namespace: "default"
+  labels:
+    app.kubernetes.io/instance: thanos
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
+    app.kubernetes.io/component: ruler
+spec:
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/instance: thanos
+      app.kubernetes.io/name: thanos
+      app.kubernetes.io/component: ruler
+  policyTypes:
+    - Ingress
+    - Egress
+  egress:
+    - {}
+  ingress:
+    - ports:
+        - port: 10902
+        - port: 9090
+        - port: 10901
+        - port: 10901
+---
+# Source: thanos/templates/storegateway/networkpolicy.yaml
+kind: NetworkPolicy
+apiVersion: networking.k8s.io/v1
+metadata:
+  name: thanos-storegateway
+  namespace: "default"
+  labels:
+    app.kubernetes.io/instance: thanos
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
+    app.kubernetes.io/component: storegateway
+spec:
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/instance: thanos
+      app.kubernetes.io/name: thanos
+      app.kubernetes.io/component: storegateway
+  policyTypes:
+    - Ingress
+    - Egress
+  egress:
+    - {}
+  ingress:
+    - ports:
+        - port: 10902
+        - port: 9090
+        - port: 10901
+        - port: 10901
+---
 # Source: thanos/templates/bucketweb/serviceaccount.yaml
 apiVersion: v1
 kind: ServiceAccount
 metadata:
   name: thanos-bucketweb
-  namespace: "default"
+  namespace: default
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: bucketweb
-  annotations:
-automountServiceAccountToken: true
+automountServiceAccountToken: false
 ---
 # Source: thanos/templates/compactor/serviceaccount.yaml
 apiVersion: v1
 kind: ServiceAccount
 metadata:
   name: thanos-compactor
-  namespace: "default"
+  namespace: default
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: compactor
-  annotations:
-automountServiceAccountToken: true
+automountServiceAccountToken: false
 ---
 # Source: thanos/templates/query/serviceaccount.yaml
 apiVersion: v1
 kind: ServiceAccount
 metadata:
   name: thanos-query
-  namespace: "default"
+  namespace: default
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: query
-  annotations:
-automountServiceAccountToken: true
+automountServiceAccountToken: false
 ---
 # Source: thanos/templates/storegateway/serviceaccount.yaml
 apiVersion: v1
 kind: ServiceAccount
 metadata:
   name: thanos-storegateway
-  namespace: "default"
+  namespace: default
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: storegateway
-  annotations:
-automountServiceAccountToken: true
+automountServiceAccountToken: false
 ---
 # Source: thanos/templates/bucketweb/service.yaml
 apiVersion: v1
 kind: Service
 metadata:
   name: thanos-bucketweb
-  namespace: "default"
+  namespace: default
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: bucketweb
-  annotations:
+    prometheus-operator/monitor: 'true'
 spec:
   type: ClusterIP
   ports:
@@ -75,8 +270,8 @@
       name: http
       nodePort: null
   selector:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: bucketweb
 ---
 # Source: thanos/templates/compactor/service.yaml
@@ -84,13 +279,13 @@
 kind: Service
 metadata:
   name: thanos-compactor
-  namespace: "default"
+  namespace: default
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: compactor
-  annotations:
+    prometheus-operator/monitor: 'true'
 spec:
   type: ClusterIP
   ports:
@@ -100,8 +295,8 @@
       name: http
       nodePort: null
   selector:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: compactor
 ---
 # Source: thanos/templates/query/service-grpc.yaml
@@ -109,13 +304,12 @@
 kind: Service
 metadata:
   name: thanos-query-grpc
-  namespace: "default"
+  namespace: default
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: query
-  annotations:
 spec:
   type: ClusterIP
   ports:
@@ -125,8 +319,8 @@
       name: grpc
       nodePort: null
   selector:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: query
 ---
 # Source: thanos/templates/query/service.yaml
@@ -134,13 +328,13 @@
 kind: Service
 metadata:
   name: thanos-query
-  namespace: "default"
+  namespace: default
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: query
-  annotations:
+    prometheus-operator/monitor: 'true'
 spec:
   type: ClusterIP
   ports:
@@ -150,8 +344,8 @@
       name: http
       nodePort: null
   selector:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: query
 ---
 # Source: thanos/templates/storegateway/service.yaml
@@ -159,14 +353,13 @@
 kind: Service
 metadata:
   name: thanos-storegateway
-  namespace: "default"
+  namespace: default
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: storegateway
     prometheus-operator/monitor: 'true'
-  annotations:
 spec:
   type: ClusterIP
   ports:
@@ -181,8 +374,8 @@
       name: grpc
       nodePort: null
   selector:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: storegateway
 ---
 # Source: thanos/templates/bucketweb/deployment.yaml
@@ -190,32 +383,32 @@
 kind: Deployment
 metadata:
   name: thanos-bucketweb
-  namespace: "default"
+  namespace: default
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: bucketweb
 spec:
   replicas: 1
+  revisionHistoryLimit: 10
   strategy:
     type: RollingUpdate
   selector:
     matchLabels:
-      app.kubernetes.io/name: thanos
       app.kubernetes.io/instance: thanos
+      app.kubernetes.io/name: thanos
       app.kubernetes.io/component: bucketweb
   template:
     metadata:
       labels:
-        app.kubernetes.io/name: thanos
         app.kubernetes.io/instance: thanos
         app.kubernetes.io/managed-by: Helm
+        app.kubernetes.io/name: thanos
         app.kubernetes.io/component: bucketweb
       annotations:
-        checksum/objstore-configuration: 01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b
     spec:
-      serviceAccount: thanos-bucketweb
+      serviceAccountName: thanos-bucketweb
       automountServiceAccountToken: true
       affinity:
         podAffinity:
@@ -224,25 +417,34 @@
             - podAffinityTerm:
                 labelSelector:
                   matchLabels:
-                    app.kubernetes.io/name: thanos
                     app.kubernetes.io/instance: thanos
+                    app.kubernetes.io/name: thanos
                     app.kubernetes.io/component: bucketweb
-                namespaces:
-                  - "default"
                 topologyKey: kubernetes.io/hostname
               weight: 1
         nodeAffinity:
       securityContext:
         fsGroup: 1001
+        fsGroupChangePolicy: Always
+        supplementalGroups: []
+        sysctls: []
       containers:
         - name: bucketweb
-          image: public.ecr.aws/bitnami/thanos:0.28.1-scratch-r0
+          image: public.ecr.aws/bitnami/thanos:0.34.1-debian-12-r3
           imagePullPolicy: "IfNotPresent"
           securityContext:
             allowPrivilegeEscalation: false
+            capabilities:
+              drop:
+                - ALL
+            privileged: false
             readOnlyRootFilesystem: true
+            runAsGroup: 1001
             runAsNonRoot: true
             runAsUser: 1001
+            seLinuxOptions: {}
+            seccompProfile:
+              type: RuntimeDefault
           args:
             - tools
             - bucket
@@ -297,32 +499,32 @@
 kind: Deployment
 metadata:
   name: thanos-compactor
-  namespace: "default"
+  namespace: default
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: compactor
 spec:
   replicas: 1
+  revisionHistoryLimit: 10
   strategy:
     type: Recreate
   selector:
     matchLabels:
-      app.kubernetes.io/name: thanos
       app.kubernetes.io/instance: thanos
+      app.kubernetes.io/name: thanos
       app.kubernetes.io/component: compactor
   template:
     metadata:
       labels:
-        app.kubernetes.io/name: thanos
         app.kubernetes.io/instance: thanos
         app.kubernetes.io/managed-by: Helm
+        app.kubernetes.io/name: thanos
         app.kubernetes.io/component: compactor
       annotations:
-        checksum/objstore-configuration: 01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b
     spec:
-      serviceAccount: thanos-compactor
+      serviceAccountName: thanos-compactor
       automountServiceAccountToken: true
       affinity:
         podAffinity:
@@ -331,25 +533,34 @@
             - podAffinityTerm:
                 labelSelector:
                   matchLabels:
-                    app.kubernetes.io/name: thanos
                     app.kubernetes.io/instance: thanos
+                    app.kubernetes.io/name: thanos
                     app.kubernetes.io/component: compactor
-                namespaces:
-                  - "default"
                 topologyKey: kubernetes.io/hostname
               weight: 1
         nodeAffinity:
       securityContext:
         fsGroup: 1001
+        fsGroupChangePolicy: Always
+        supplementalGroups: []
+        sysctls: []
       containers:
         - name: compactor
-          image: public.ecr.aws/bitnami/thanos:0.28.1-scratch-r0
+          image: public.ecr.aws/bitnami/thanos:0.34.1-debian-12-r3
           imagePullPolicy: "IfNotPresent"
           securityContext:
             allowPrivilegeEscalation: false
+            capabilities:
+              drop:
+                - ALL
+            privileged: false
             readOnlyRootFilesystem: true
+            runAsGroup: 1001
             runAsNonRoot: true
             runAsUser: 1001
+            seLinuxOptions: {}
+            seccompProfile:
+              type: RuntimeDefault
           args:
             - compact
             - --log.level=info
@@ -410,30 +621,31 @@
 kind: Deployment
 metadata:
   name: thanos-query
-  namespace: "default"
+  namespace: default
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: query
 spec:
   replicas: 1
+  revisionHistoryLimit: 10
   strategy:
     type: RollingUpdate
   selector:
     matchLabels:
-      app.kubernetes.io/name: thanos
       app.kubernetes.io/instance: thanos
+      app.kubernetes.io/name: thanos
       app.kubernetes.io/component: query
   template:
     metadata:
       labels:
-        app.kubernetes.io/name: thanos
         app.kubernetes.io/instance: thanos
         app.kubernetes.io/managed-by: Helm
+        app.kubernetes.io/name: thanos
         app.kubernetes.io/component: query
     spec:
-      serviceAccount: thanos-query
+      serviceAccountName: thanos-query
       automountServiceAccountToken: true
       affinity:
         podAffinity:
@@ -442,25 +654,34 @@
             - podAffinityTerm:
                 labelSelector:
                   matchLabels:
-                    app.kubernetes.io/name: thanos
                     app.kubernetes.io/instance: thanos
+                    app.kubernetes.io/name: thanos
                     app.kubernetes.io/component: query
-                namespaces:
-                  - "default"
                 topologyKey: kubernetes.io/hostname
               weight: 1
         nodeAffinity:
       securityContext:
         fsGroup: 1001
+        fsGroupChangePolicy: Always
+        supplementalGroups: []
+        sysctls: []
       containers:
         - name: query
-          image: public.ecr.aws/bitnami/thanos:0.28.1-scratch-r0
+          image: public.ecr.aws/bitnami/thanos:0.34.1-debian-12-r3
           imagePullPolicy: "IfNotPresent"
           securityContext:
             allowPrivilegeEscalation: false
+            capabilities:
+              drop:
+                - ALL
+            privileged: false
             readOnlyRootFilesystem: true
+            runAsGroup: 1001
             runAsNonRoot: true
             runAsUser: 1001
+            seLinuxOptions: {}
+            seccompProfile:
+              type: RuntimeDefault
           args:
             - query
             - --log.level=info
@@ -470,6 +691,7 @@
             - --query.replica-label=replica
             - --endpoint=dnssrv+_grpc._tcp.prometheus-thanos-discovery.monitoring.svc.cluster.local
             - --endpoint=dnssrv+_grpc._tcp.thanos-storegateway.default.svc.cluster.local
+            - --alert.query-url=http://thanos-query.default.svc.cluster.local:9090
           ports:
             - name: http
               containerPort: 10902
@@ -498,8 +720,14 @@
               port: http
               scheme: HTTP
           resources:
-            limits: {}
-            requests: {}
+            limits:
+              cpu: 150m
+              ephemeral-storage: 1024Mi
+              memory: 192Mi
+            requests:
+              cpu: 100m
+              ephemeral-storage: 50Mi
+              memory: 128Mi
           volumeMounts:
       volumes:
 ---
@@ -508,34 +736,34 @@
 kind: StatefulSet
 metadata:
   name: thanos-storegateway
-  namespace: "default"
+  namespace: default
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: storegateway
 spec:
   replicas: 1
+  revisionHistoryLimit: 10
   podManagementPolicy: OrderedReady
   serviceName: thanos-storegateway-headless
   updateStrategy:
     type: RollingUpdate
   selector:
     matchLabels:
-      app.kubernetes.io/name: thanos
       app.kubernetes.io/instance: thanos
+      app.kubernetes.io/name: thanos
       app.kubernetes.io/component: storegateway
   template:
     metadata:
       labels:
-        app.kubernetes.io/name: thanos
         app.kubernetes.io/instance: thanos
         app.kubernetes.io/managed-by: Helm
+        app.kubernetes.io/name: thanos
         app.kubernetes.io/component: storegateway
       annotations:
-        checksum/objstore-configuration: 01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b
     spec:
-      serviceAccount: thanos-storegateway
+      serviceAccountName: thanos-storegateway
       automountServiceAccountToken: true
       affinity:
         podAffinity:
@@ -544,25 +772,34 @@
             - podAffinityTerm:
                 labelSelector:
                   matchLabels:
-                    app.kubernetes.io/name: thanos
                     app.kubernetes.io/instance: thanos
+                    app.kubernetes.io/name: thanos
                     app.kubernetes.io/component: storegateway
-                namespaces:
-                  - "default"
                 topologyKey: kubernetes.io/hostname
               weight: 1
         nodeAffinity:
       securityContext:
         fsGroup: 1001
+        fsGroupChangePolicy: Always
+        supplementalGroups: []
+        sysctls: []
       containers:
         - name: storegateway
-          image: public.ecr.aws/bitnami/thanos:0.28.1-scratch-r0
+          image: public.ecr.aws/bitnami/thanos:0.34.1-debian-12-r3
           imagePullPolicy: "IfNotPresent"
           securityContext:
             allowPrivilegeEscalation: false
+            capabilities:
+              drop:
+                - ALL
+            privileged: false
             readOnlyRootFilesystem: true
+            runAsGroup: 1001
             runAsNonRoot: true
             runAsUser: 1001
+            seLinuxOptions: {}
+            seccompProfile:
+              type: RuntimeDefault
           args:
             - store
             - --log.level=info
@@ -599,8 +836,14 @@
               port: http
               scheme: HTTP
           resources:
-            limits: {}
-            requests: {}
+            limits:
+              cpu: 150m
+              ephemeral-storage: 1024Mi
+              memory: 192Mi
+            requests:
+              cpu: 100m
+              ephemeral-storage: 50Mi
+              memory: 128Mi
           volumeMounts:
             - name: objstore-config
               mountPath: /conf
@@ -625,11 +868,11 @@
 kind: Ingress
 metadata:
   name: thanos-query
-  namespace: "default"
+  namespace: default
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: query
   annotations:
     app: thanos
@@ -655,9 +898,9 @@
   name: thanos-bucketweb
   namespace: "default"
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: bucketweb
 spec:
   endpoints:
@@ -667,9 +910,10 @@
       - "default"
   selector:
     matchLabels:
-      app.kubernetes.io/name: thanos
       app.kubernetes.io/instance: thanos
+      app.kubernetes.io/name: thanos
       app.kubernetes.io/component: bucketweb
+      prometheus-operator/monitor: 'true'
 ---
 # Source: thanos/templates/compactor/servicemonitor.yaml
 apiVersion: monitoring.coreos.com/v1
@@ -678,9 +922,9 @@
   name: thanos-compactor
   namespace: "default"
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: compactor
 spec:
   endpoints:
@@ -690,9 +934,10 @@
       - "default"
   selector:
     matchLabels:
-      app.kubernetes.io/name: thanos
       app.kubernetes.io/instance: thanos
+      app.kubernetes.io/name: thanos
       app.kubernetes.io/component: compactor
+      prometheus-operator/monitor: 'true'
 ---
 # Source: thanos/templates/query/servicemonitor.yaml
 apiVersion: monitoring.coreos.com/v1
@@ -701,9 +946,9 @@
   name: thanos-query
   namespace: "default"
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: query
 spec:
   endpoints:
@@ -713,9 +958,10 @@
       - "default"
   selector:
     matchLabels:
-      app.kubernetes.io/name: thanos
       app.kubernetes.io/instance: thanos
+      app.kubernetes.io/name: thanos
       app.kubernetes.io/component: query
+      prometheus-operator/monitor: 'true'
 ---
 # Source: thanos/templates/storegateway/servicemonitor.yaml
 apiVersion: monitoring.coreos.com/v1
@@ -724,9 +970,9 @@
   name: thanos-storegateway
   namespace: "default"
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: storegateway
 spec:
   endpoints:
@@ -736,6 +982,7 @@
       - "default"
   selector:
     matchLabels:
-      app.kubernetes.io/name: thanos
       app.kubernetes.io/instance: thanos
+      app.kubernetes.io/name: thanos
       app.kubernetes.io/component: storegateway
+      prometheus-operator/monitor: 'true'

@renovate renovate bot force-pushed the renovate/thanos-15.x branch from 61a326b to b41ed74 Compare April 11, 2024 10:43
@renovate renovate bot changed the title feat(charts)!: Update Helm release thanos to 15.0.4 feat(charts)!: Update Helm release thanos to 15.0.5 Apr 11, 2024
@github-actions GitHub Actions
Copy link

Path: cluster/core/monitoring/thanos/helm-release.yaml
Version: 11.5.5 -> 15.0.5

@@ -1,71 +1,266 @@
+# Source: thanos/templates/bucketweb/networkpolicy.yaml
+kind: NetworkPolicy
+apiVersion: networking.k8s.io/v1
+metadata:
+  name: thanos-bucketweb
+  namespace: "default"
+  labels:
+    app.kubernetes.io/instance: thanos
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
+    app.kubernetes.io/component: bucketweb
+spec:
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/instance: thanos
+      app.kubernetes.io/name: thanos
+      app.kubernetes.io/component: bucketweb
+  policyTypes:
+    - Ingress
+    - Egress
+  egress:
+    - {}
+  ingress:
+    - ports:
+        - port: 8080
+        - port: 8080
+---
+# Source: thanos/templates/compactor/networkpolicy.yaml
+kind: NetworkPolicy
+apiVersion: networking.k8s.io/v1
+metadata:
+  name: thanos-compactor
+  namespace: "default"
+  labels:
+    app.kubernetes.io/instance: thanos
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
+    app.kubernetes.io/component: compactor
+spec:
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/instance: thanos
+      app.kubernetes.io/name: thanos
+      app.kubernetes.io/component: compactor
+  policyTypes:
+    - Ingress
+    - Egress
+  egress:
+    - {}
+  ingress:
+    - ports:
+        - port: 10902
+        - port: 9090
+---
+# Source: thanos/templates/query-frontend/networkpolicy.yaml
+kind: NetworkPolicy
+apiVersion: networking.k8s.io/v1
+metadata:
+  name: thanos-query-frontend
+  namespace: "default"
+  labels:
+    app.kubernetes.io/instance: thanos
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
+    app.kubernetes.io/component: query-frontend
+spec:
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/instance: thanos
+      app.kubernetes.io/name: thanos
+      app.kubernetes.io/component: query-frontend
+  policyTypes:
+    - Ingress
+    - Egress
+  egress:
+    - {}
+  ingress:
+    - ports:
+        - port: 9090
+        - port: 9090
+---
+# Source: thanos/templates/query/networkpolicy.yaml
+kind: NetworkPolicy
+apiVersion: networking.k8s.io/v1
+metadata:
+  name: thanos-query
+  namespace: "default"
+  labels:
+    app.kubernetes.io/instance: thanos
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
+    app.kubernetes.io/component: query
+spec:
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/instance: thanos
+      app.kubernetes.io/name: thanos
+      app.kubernetes.io/component: query
+  policyTypes:
+    - Ingress
+    - Egress
+  egress:
+    - {}
+  ingress:
+    - ports:
+        - port: 10902
+        - port: 10901
+        - port: 9090
+        - port: 10901
+---
+# Source: thanos/templates/receive/networkpolicy.yaml
+kind: NetworkPolicy
+apiVersion: networking.k8s.io/v1
+metadata:
+  name: thanos-receive
+  namespace: "default"
+  labels:
+    app.kubernetes.io/instance: thanos
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
+    app.kubernetes.io/component: receive
+spec:
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/instance: thanos
+      app.kubernetes.io/name: thanos
+      app.kubernetes.io/component: receive
+  policyTypes:
+    - Ingress
+    - Egress
+  egress:
+    - {}
+  ingress:
+    - ports:
+        - port: 10902
+        - port: 10902
+        - port: 10901
+        - port: 10901
+        - port: 19291
+        - port: 19291
+---
+# Source: thanos/templates/ruler/networkpolicy.yaml
+kind: NetworkPolicy
+apiVersion: networking.k8s.io/v1
+metadata:
+  name: thanos-ruler
+  namespace: "default"
+  labels:
+    app.kubernetes.io/instance: thanos
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
+    app.kubernetes.io/component: ruler
+spec:
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/instance: thanos
+      app.kubernetes.io/name: thanos
+      app.kubernetes.io/component: ruler
+  policyTypes:
+    - Ingress
+    - Egress
+  egress:
+    - {}
+  ingress:
+    - ports:
+        - port: 10902
+        - port: 9090
+        - port: 10901
+        - port: 10901
+---
+# Source: thanos/templates/storegateway/networkpolicy.yaml
+kind: NetworkPolicy
+apiVersion: networking.k8s.io/v1
+metadata:
+  name: thanos-storegateway
+  namespace: "default"
+  labels:
+    app.kubernetes.io/instance: thanos
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
+    app.kubernetes.io/component: storegateway
+spec:
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/instance: thanos
+      app.kubernetes.io/name: thanos
+      app.kubernetes.io/component: storegateway
+  policyTypes:
+    - Ingress
+    - Egress
+  egress:
+    - {}
+  ingress:
+    - ports:
+        - port: 10902
+        - port: 9090
+        - port: 10901
+        - port: 10901
+---
 # Source: thanos/templates/bucketweb/serviceaccount.yaml
 apiVersion: v1
 kind: ServiceAccount
 metadata:
   name: thanos-bucketweb
-  namespace: "default"
+  namespace: default
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: bucketweb
-  annotations:
-automountServiceAccountToken: true
+automountServiceAccountToken: false
 ---
 # Source: thanos/templates/compactor/serviceaccount.yaml
 apiVersion: v1
 kind: ServiceAccount
 metadata:
   name: thanos-compactor
-  namespace: "default"
+  namespace: default
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: compactor
-  annotations:
-automountServiceAccountToken: true
+automountServiceAccountToken: false
 ---
 # Source: thanos/templates/query/serviceaccount.yaml
 apiVersion: v1
 kind: ServiceAccount
 metadata:
   name: thanos-query
-  namespace: "default"
+  namespace: default
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: query
-  annotations:
-automountServiceAccountToken: true
+automountServiceAccountToken: false
 ---
 # Source: thanos/templates/storegateway/serviceaccount.yaml
 apiVersion: v1
 kind: ServiceAccount
 metadata:
   name: thanos-storegateway
-  namespace: "default"
+  namespace: default
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: storegateway
-  annotations:
-automountServiceAccountToken: true
+automountServiceAccountToken: false
 ---
 # Source: thanos/templates/bucketweb/service.yaml
 apiVersion: v1
 kind: Service
 metadata:
   name: thanos-bucketweb
-  namespace: "default"
+  namespace: default
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: bucketweb
-  annotations:
+    prometheus-operator/monitor: 'true'
 spec:
   type: ClusterIP
   ports:
@@ -75,8 +270,8 @@
       name: http
       nodePort: null
   selector:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: bucketweb
 ---
 # Source: thanos/templates/compactor/service.yaml
@@ -84,13 +279,13 @@
 kind: Service
 metadata:
   name: thanos-compactor
-  namespace: "default"
+  namespace: default
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: compactor
-  annotations:
+    prometheus-operator/monitor: 'true'
 spec:
   type: ClusterIP
   ports:
@@ -100,8 +295,8 @@
       name: http
       nodePort: null
   selector:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: compactor
 ---
 # Source: thanos/templates/query/service-grpc.yaml
@@ -109,13 +304,12 @@
 kind: Service
 metadata:
   name: thanos-query-grpc
-  namespace: "default"
+  namespace: default
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: query
-  annotations:
 spec:
   type: ClusterIP
   ports:
@@ -125,8 +319,8 @@
       name: grpc
       nodePort: null
   selector:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: query
 ---
 # Source: thanos/templates/query/service.yaml
@@ -134,13 +328,13 @@
 kind: Service
 metadata:
   name: thanos-query
-  namespace: "default"
+  namespace: default
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: query
-  annotations:
+    prometheus-operator/monitor: 'true'
 spec:
   type: ClusterIP
   ports:
@@ -150,8 +344,8 @@
       name: http
       nodePort: null
   selector:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: query
 ---
 # Source: thanos/templates/storegateway/service.yaml
@@ -159,14 +353,13 @@
 kind: Service
 metadata:
   name: thanos-storegateway
-  namespace: "default"
+  namespace: default
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: storegateway
     prometheus-operator/monitor: 'true'
-  annotations:
 spec:
   type: ClusterIP
   ports:
@@ -181,8 +374,8 @@
       name: grpc
       nodePort: null
   selector:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: storegateway
 ---
 # Source: thanos/templates/bucketweb/deployment.yaml
@@ -190,32 +383,32 @@
 kind: Deployment
 metadata:
   name: thanos-bucketweb
-  namespace: "default"
+  namespace: default
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: bucketweb
 spec:
   replicas: 1
+  revisionHistoryLimit: 10
   strategy:
     type: RollingUpdate
   selector:
     matchLabels:
-      app.kubernetes.io/name: thanos
       app.kubernetes.io/instance: thanos
+      app.kubernetes.io/name: thanos
       app.kubernetes.io/component: bucketweb
   template:
     metadata:
       labels:
-        app.kubernetes.io/name: thanos
         app.kubernetes.io/instance: thanos
         app.kubernetes.io/managed-by: Helm
+        app.kubernetes.io/name: thanos
         app.kubernetes.io/component: bucketweb
       annotations:
-        checksum/objstore-configuration: 01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b
     spec:
-      serviceAccount: thanos-bucketweb
+      serviceAccountName: thanos-bucketweb
       automountServiceAccountToken: true
       affinity:
         podAffinity:
@@ -224,25 +417,34 @@
             - podAffinityTerm:
                 labelSelector:
                   matchLabels:
-                    app.kubernetes.io/name: thanos
                     app.kubernetes.io/instance: thanos
+                    app.kubernetes.io/name: thanos
                     app.kubernetes.io/component: bucketweb
-                namespaces:
-                  - "default"
                 topologyKey: kubernetes.io/hostname
               weight: 1
         nodeAffinity:
       securityContext:
         fsGroup: 1001
+        fsGroupChangePolicy: Always
+        supplementalGroups: []
+        sysctls: []
       containers:
         - name: bucketweb
-          image: public.ecr.aws/bitnami/thanos:0.28.1-scratch-r0
+          image: public.ecr.aws/bitnami/thanos:0.34.1-debian-12-r3
           imagePullPolicy: "IfNotPresent"
           securityContext:
             allowPrivilegeEscalation: false
+            capabilities:
+              drop:
+                - ALL
+            privileged: false
             readOnlyRootFilesystem: true
+            runAsGroup: 1001
             runAsNonRoot: true
             runAsUser: 1001
+            seLinuxOptions: {}
+            seccompProfile:
+              type: RuntimeDefault
           args:
             - tools
             - bucket
@@ -297,32 +499,32 @@
 kind: Deployment
 metadata:
   name: thanos-compactor
-  namespace: "default"
+  namespace: default
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: compactor
 spec:
   replicas: 1
+  revisionHistoryLimit: 10
   strategy:
     type: Recreate
   selector:
     matchLabels:
-      app.kubernetes.io/name: thanos
       app.kubernetes.io/instance: thanos
+      app.kubernetes.io/name: thanos
       app.kubernetes.io/component: compactor
   template:
     metadata:
       labels:
-        app.kubernetes.io/name: thanos
         app.kubernetes.io/instance: thanos
         app.kubernetes.io/managed-by: Helm
+        app.kubernetes.io/name: thanos
         app.kubernetes.io/component: compactor
       annotations:
-        checksum/objstore-configuration: 01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b
     spec:
-      serviceAccount: thanos-compactor
+      serviceAccountName: thanos-compactor
       automountServiceAccountToken: true
       affinity:
         podAffinity:
@@ -331,25 +533,34 @@
             - podAffinityTerm:
                 labelSelector:
                   matchLabels:
-                    app.kubernetes.io/name: thanos
                     app.kubernetes.io/instance: thanos
+                    app.kubernetes.io/name: thanos
                     app.kubernetes.io/component: compactor
-                namespaces:
-                  - "default"
                 topologyKey: kubernetes.io/hostname
               weight: 1
         nodeAffinity:
       securityContext:
         fsGroup: 1001
+        fsGroupChangePolicy: Always
+        supplementalGroups: []
+        sysctls: []
       containers:
         - name: compactor
-          image: public.ecr.aws/bitnami/thanos:0.28.1-scratch-r0
+          image: public.ecr.aws/bitnami/thanos:0.34.1-debian-12-r3
           imagePullPolicy: "IfNotPresent"
           securityContext:
             allowPrivilegeEscalation: false
+            capabilities:
+              drop:
+                - ALL
+            privileged: false
             readOnlyRootFilesystem: true
+            runAsGroup: 1001
             runAsNonRoot: true
             runAsUser: 1001
+            seLinuxOptions: {}
+            seccompProfile:
+              type: RuntimeDefault
           args:
             - compact
             - --log.level=info
@@ -410,30 +621,31 @@
 kind: Deployment
 metadata:
   name: thanos-query
-  namespace: "default"
+  namespace: default
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: query
 spec:
   replicas: 1
+  revisionHistoryLimit: 10
   strategy:
     type: RollingUpdate
   selector:
     matchLabels:
-      app.kubernetes.io/name: thanos
       app.kubernetes.io/instance: thanos
+      app.kubernetes.io/name: thanos
       app.kubernetes.io/component: query
   template:
     metadata:
       labels:
-        app.kubernetes.io/name: thanos
         app.kubernetes.io/instance: thanos
         app.kubernetes.io/managed-by: Helm
+        app.kubernetes.io/name: thanos
         app.kubernetes.io/component: query
     spec:
-      serviceAccount: thanos-query
+      serviceAccountName: thanos-query
       automountServiceAccountToken: true
       affinity:
         podAffinity:
@@ -442,25 +654,34 @@
             - podAffinityTerm:
                 labelSelector:
                   matchLabels:
-                    app.kubernetes.io/name: thanos
                     app.kubernetes.io/instance: thanos
+                    app.kubernetes.io/name: thanos
                     app.kubernetes.io/component: query
-                namespaces:
-                  - "default"
                 topologyKey: kubernetes.io/hostname
               weight: 1
         nodeAffinity:
       securityContext:
         fsGroup: 1001
+        fsGroupChangePolicy: Always
+        supplementalGroups: []
+        sysctls: []
       containers:
         - name: query
-          image: public.ecr.aws/bitnami/thanos:0.28.1-scratch-r0
+          image: public.ecr.aws/bitnami/thanos:0.34.1-debian-12-r3
           imagePullPolicy: "IfNotPresent"
           securityContext:
             allowPrivilegeEscalation: false
+            capabilities:
+              drop:
+                - ALL
+            privileged: false
             readOnlyRootFilesystem: true
+            runAsGroup: 1001
             runAsNonRoot: true
             runAsUser: 1001
+            seLinuxOptions: {}
+            seccompProfile:
+              type: RuntimeDefault
           args:
             - query
             - --log.level=info
@@ -470,6 +691,7 @@
             - --query.replica-label=replica
             - --endpoint=dnssrv+_grpc._tcp.prometheus-thanos-discovery.monitoring.svc.cluster.local
             - --endpoint=dnssrv+_grpc._tcp.thanos-storegateway.default.svc.cluster.local
+            - --alert.query-url=http://thanos-query.default.svc.cluster.local:9090
           ports:
             - name: http
               containerPort: 10902
@@ -498,8 +720,14 @@
               port: http
               scheme: HTTP
           resources:
-            limits: {}
-            requests: {}
+            limits:
+              cpu: 150m
+              ephemeral-storage: 1024Mi
+              memory: 192Mi
+            requests:
+              cpu: 100m
+              ephemeral-storage: 50Mi
+              memory: 128Mi
           volumeMounts:
       volumes:
 ---
@@ -508,34 +736,34 @@
 kind: StatefulSet
 metadata:
   name: thanos-storegateway
-  namespace: "default"
+  namespace: default
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: storegateway
 spec:
   replicas: 1
+  revisionHistoryLimit: 10
   podManagementPolicy: OrderedReady
   serviceName: thanos-storegateway-headless
   updateStrategy:
     type: RollingUpdate
   selector:
     matchLabels:
-      app.kubernetes.io/name: thanos
       app.kubernetes.io/instance: thanos
+      app.kubernetes.io/name: thanos
       app.kubernetes.io/component: storegateway
   template:
     metadata:
       labels:
-        app.kubernetes.io/name: thanos
         app.kubernetes.io/instance: thanos
         app.kubernetes.io/managed-by: Helm
+        app.kubernetes.io/name: thanos
         app.kubernetes.io/component: storegateway
       annotations:
-        checksum/objstore-configuration: 01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b
     spec:
-      serviceAccount: thanos-storegateway
+      serviceAccountName: thanos-storegateway
       automountServiceAccountToken: true
       affinity:
         podAffinity:
@@ -544,25 +772,34 @@
             - podAffinityTerm:
                 labelSelector:
                   matchLabels:
-                    app.kubernetes.io/name: thanos
                     app.kubernetes.io/instance: thanos
+                    app.kubernetes.io/name: thanos
                     app.kubernetes.io/component: storegateway
-                namespaces:
-                  - "default"
                 topologyKey: kubernetes.io/hostname
               weight: 1
         nodeAffinity:
       securityContext:
         fsGroup: 1001
+        fsGroupChangePolicy: Always
+        supplementalGroups: []
+        sysctls: []
       containers:
         - name: storegateway
-          image: public.ecr.aws/bitnami/thanos:0.28.1-scratch-r0
+          image: public.ecr.aws/bitnami/thanos:0.34.1-debian-12-r3
           imagePullPolicy: "IfNotPresent"
           securityContext:
             allowPrivilegeEscalation: false
+            capabilities:
+              drop:
+                - ALL
+            privileged: false
             readOnlyRootFilesystem: true
+            runAsGroup: 1001
             runAsNonRoot: true
             runAsUser: 1001
+            seLinuxOptions: {}
+            seccompProfile:
+              type: RuntimeDefault
           args:
             - store
             - --log.level=info
@@ -599,8 +836,14 @@
               port: http
               scheme: HTTP
           resources:
-            limits: {}
-            requests: {}
+            limits:
+              cpu: 150m
+              ephemeral-storage: 1024Mi
+              memory: 192Mi
+            requests:
+              cpu: 100m
+              ephemeral-storage: 50Mi
+              memory: 128Mi
           volumeMounts:
             - name: objstore-config
               mountPath: /conf
@@ -625,11 +868,11 @@
 kind: Ingress
 metadata:
   name: thanos-query
-  namespace: "default"
+  namespace: default
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: query
   annotations:
     app: thanos
@@ -655,9 +898,9 @@
   name: thanos-bucketweb
   namespace: "default"
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: bucketweb
 spec:
   endpoints:
@@ -667,9 +910,10 @@
       - "default"
   selector:
     matchLabels:
-      app.kubernetes.io/name: thanos
       app.kubernetes.io/instance: thanos
+      app.kubernetes.io/name: thanos
       app.kubernetes.io/component: bucketweb
+      prometheus-operator/monitor: 'true'
 ---
 # Source: thanos/templates/compactor/servicemonitor.yaml
 apiVersion: monitoring.coreos.com/v1
@@ -678,9 +922,9 @@
   name: thanos-compactor
   namespace: "default"
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: compactor
 spec:
   endpoints:
@@ -690,9 +934,10 @@
       - "default"
   selector:
     matchLabels:
-      app.kubernetes.io/name: thanos
       app.kubernetes.io/instance: thanos
+      app.kubernetes.io/name: thanos
       app.kubernetes.io/component: compactor
+      prometheus-operator/monitor: 'true'
 ---
 # Source: thanos/templates/query/servicemonitor.yaml
 apiVersion: monitoring.coreos.com/v1
@@ -701,9 +946,9 @@
   name: thanos-query
   namespace: "default"
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: query
 spec:
   endpoints:
@@ -713,9 +958,10 @@
       - "default"
   selector:
     matchLabels:
-      app.kubernetes.io/name: thanos
       app.kubernetes.io/instance: thanos
+      app.kubernetes.io/name: thanos
       app.kubernetes.io/component: query
+      prometheus-operator/monitor: 'true'
 ---
 # Source: thanos/templates/storegateway/servicemonitor.yaml
 apiVersion: monitoring.coreos.com/v1
@@ -724,9 +970,9 @@
   name: thanos-storegateway
   namespace: "default"
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: storegateway
 spec:
   endpoints:
@@ -736,6 +982,7 @@
       - "default"
   selector:
     matchLabels:
-      app.kubernetes.io/name: thanos
       app.kubernetes.io/instance: thanos
+      app.kubernetes.io/name: thanos
       app.kubernetes.io/component: storegateway
+      prometheus-operator/monitor: 'true'

@renovate renovate bot force-pushed the renovate/thanos-15.x branch from b41ed74 to 6452aed Compare April 18, 2024 16:44
@renovate renovate bot changed the title feat(charts)!: Update Helm release thanos to 15.0.5 feat(charts)!: Update Helm release thanos to 15.1.0 Apr 18, 2024
@github-actions GitHub Actions
Copy link

Path: cluster/core/monitoring/thanos/helm-release.yaml
Version: 11.5.5 -> 15.1.0

@@ -1,71 +1,266 @@
+# Source: thanos/templates/bucketweb/networkpolicy.yaml
+kind: NetworkPolicy
+apiVersion: networking.k8s.io/v1
+metadata:
+  name: thanos-bucketweb
+  namespace: "default"
+  labels:
+    app.kubernetes.io/instance: thanos
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
+    app.kubernetes.io/component: bucketweb
+spec:
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/instance: thanos
+      app.kubernetes.io/name: thanos
+      app.kubernetes.io/component: bucketweb
+  policyTypes:
+    - Ingress
+    - Egress
+  egress:
+    - {}
+  ingress:
+    - ports:
+        - port: 8080
+        - port: 8080
+---
+# Source: thanos/templates/compactor/networkpolicy.yaml
+kind: NetworkPolicy
+apiVersion: networking.k8s.io/v1
+metadata:
+  name: thanos-compactor
+  namespace: "default"
+  labels:
+    app.kubernetes.io/instance: thanos
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
+    app.kubernetes.io/component: compactor
+spec:
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/instance: thanos
+      app.kubernetes.io/name: thanos
+      app.kubernetes.io/component: compactor
+  policyTypes:
+    - Ingress
+    - Egress
+  egress:
+    - {}
+  ingress:
+    - ports:
+        - port: 10902
+        - port: 9090
+---
+# Source: thanos/templates/query-frontend/networkpolicy.yaml
+kind: NetworkPolicy
+apiVersion: networking.k8s.io/v1
+metadata:
+  name: thanos-query-frontend
+  namespace: "default"
+  labels:
+    app.kubernetes.io/instance: thanos
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
+    app.kubernetes.io/component: query-frontend
+spec:
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/instance: thanos
+      app.kubernetes.io/name: thanos
+      app.kubernetes.io/component: query-frontend
+  policyTypes:
+    - Ingress
+    - Egress
+  egress:
+    - {}
+  ingress:
+    - ports:
+        - port: 9090
+        - port: 9090
+---
+# Source: thanos/templates/query/networkpolicy.yaml
+kind: NetworkPolicy
+apiVersion: networking.k8s.io/v1
+metadata:
+  name: thanos-query
+  namespace: "default"
+  labels:
+    app.kubernetes.io/instance: thanos
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
+    app.kubernetes.io/component: query
+spec:
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/instance: thanos
+      app.kubernetes.io/name: thanos
+      app.kubernetes.io/component: query
+  policyTypes:
+    - Ingress
+    - Egress
+  egress:
+    - {}
+  ingress:
+    - ports:
+        - port: 10902
+        - port: 10901
+        - port: 9090
+        - port: 10901
+---
+# Source: thanos/templates/receive/networkpolicy.yaml
+kind: NetworkPolicy
+apiVersion: networking.k8s.io/v1
+metadata:
+  name: thanos-receive
+  namespace: "default"
+  labels:
+    app.kubernetes.io/instance: thanos
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
+    app.kubernetes.io/component: receive
+spec:
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/instance: thanos
+      app.kubernetes.io/name: thanos
+      app.kubernetes.io/component: receive
+  policyTypes:
+    - Ingress
+    - Egress
+  egress:
+    - {}
+  ingress:
+    - ports:
+        - port: 10902
+        - port: 10902
+        - port: 10901
+        - port: 10901
+        - port: 19291
+        - port: 19291
+---
+# Source: thanos/templates/ruler/networkpolicy.yaml
+kind: NetworkPolicy
+apiVersion: networking.k8s.io/v1
+metadata:
+  name: thanos-ruler
+  namespace: "default"
+  labels:
+    app.kubernetes.io/instance: thanos
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
+    app.kubernetes.io/component: ruler
+spec:
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/instance: thanos
+      app.kubernetes.io/name: thanos
+      app.kubernetes.io/component: ruler
+  policyTypes:
+    - Ingress
+    - Egress
+  egress:
+    - {}
+  ingress:
+    - ports:
+        - port: 10902
+        - port: 9090
+        - port: 10901
+        - port: 10901
+---
+# Source: thanos/templates/storegateway/networkpolicy.yaml
+kind: NetworkPolicy
+apiVersion: networking.k8s.io/v1
+metadata:
+  name: thanos-storegateway
+  namespace: "default"
+  labels:
+    app.kubernetes.io/instance: thanos
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
+    app.kubernetes.io/component: storegateway
+spec:
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/instance: thanos
+      app.kubernetes.io/name: thanos
+      app.kubernetes.io/component: storegateway
+  policyTypes:
+    - Ingress
+    - Egress
+  egress:
+    - {}
+  ingress:
+    - ports:
+        - port: 10902
+        - port: 9090
+        - port: 10901
+        - port: 10901
+---
 # Source: thanos/templates/bucketweb/serviceaccount.yaml
 apiVersion: v1
 kind: ServiceAccount
 metadata:
   name: thanos-bucketweb
-  namespace: "default"
+  namespace: default
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: bucketweb
-  annotations:
-automountServiceAccountToken: true
+automountServiceAccountToken: false
 ---
 # Source: thanos/templates/compactor/serviceaccount.yaml
 apiVersion: v1
 kind: ServiceAccount
 metadata:
   name: thanos-compactor
-  namespace: "default"
+  namespace: default
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: compactor
-  annotations:
-automountServiceAccountToken: true
+automountServiceAccountToken: false
 ---
 # Source: thanos/templates/query/serviceaccount.yaml
 apiVersion: v1
 kind: ServiceAccount
 metadata:
   name: thanos-query
-  namespace: "default"
+  namespace: default
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: query
-  annotations:
-automountServiceAccountToken: true
+automountServiceAccountToken: false
 ---
 # Source: thanos/templates/storegateway/serviceaccount.yaml
 apiVersion: v1
 kind: ServiceAccount
 metadata:
   name: thanos-storegateway
-  namespace: "default"
+  namespace: default
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: storegateway
-  annotations:
-automountServiceAccountToken: true
+automountServiceAccountToken: false
 ---
 # Source: thanos/templates/bucketweb/service.yaml
 apiVersion: v1
 kind: Service
 metadata:
   name: thanos-bucketweb
-  namespace: "default"
+  namespace: default
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: bucketweb
-  annotations:
+    prometheus-operator/monitor: 'true'
 spec:
   type: ClusterIP
   ports:
@@ -75,8 +270,8 @@
       name: http
       nodePort: null
   selector:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: bucketweb
 ---
 # Source: thanos/templates/compactor/service.yaml
@@ -84,13 +279,13 @@
 kind: Service
 metadata:
   name: thanos-compactor
-  namespace: "default"
+  namespace: default
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: compactor
-  annotations:
+    prometheus-operator/monitor: 'true'
 spec:
   type: ClusterIP
   ports:
@@ -100,8 +295,8 @@
       name: http
       nodePort: null
   selector:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: compactor
 ---
 # Source: thanos/templates/query/service-grpc.yaml
@@ -109,13 +304,12 @@
 kind: Service
 metadata:
   name: thanos-query-grpc
-  namespace: "default"
+  namespace: default
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: query
-  annotations:
 spec:
   type: ClusterIP
   ports:
@@ -125,8 +319,8 @@
       name: grpc
       nodePort: null
   selector:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: query
 ---
 # Source: thanos/templates/query/service.yaml
@@ -134,13 +328,13 @@
 kind: Service
 metadata:
   name: thanos-query
-  namespace: "default"
+  namespace: default
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: query
-  annotations:
+    prometheus-operator/monitor: 'true'
 spec:
   type: ClusterIP
   ports:
@@ -150,8 +344,8 @@
       name: http
       nodePort: null
   selector:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: query
 ---
 # Source: thanos/templates/storegateway/service.yaml
@@ -159,14 +353,13 @@
 kind: Service
 metadata:
   name: thanos-storegateway
-  namespace: "default"
+  namespace: default
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: storegateway
     prometheus-operator/monitor: 'true'
-  annotations:
 spec:
   type: ClusterIP
   ports:
@@ -181,8 +374,8 @@
       name: grpc
       nodePort: null
   selector:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: storegateway
 ---
 # Source: thanos/templates/bucketweb/deployment.yaml
@@ -190,32 +383,32 @@
 kind: Deployment
 metadata:
   name: thanos-bucketweb
-  namespace: "default"
+  namespace: default
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: bucketweb
 spec:
   replicas: 1
+  revisionHistoryLimit: 10
   strategy:
     type: RollingUpdate
   selector:
     matchLabels:
-      app.kubernetes.io/name: thanos
       app.kubernetes.io/instance: thanos
+      app.kubernetes.io/name: thanos
       app.kubernetes.io/component: bucketweb
   template:
     metadata:
       labels:
-        app.kubernetes.io/name: thanos
         app.kubernetes.io/instance: thanos
         app.kubernetes.io/managed-by: Helm
+        app.kubernetes.io/name: thanos
         app.kubernetes.io/component: bucketweb
       annotations:
-        checksum/objstore-configuration: 01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b
     spec:
-      serviceAccount: thanos-bucketweb
+      serviceAccountName: thanos-bucketweb
       automountServiceAccountToken: true
       affinity:
         podAffinity:
@@ -224,25 +417,34 @@
             - podAffinityTerm:
                 labelSelector:
                   matchLabels:
-                    app.kubernetes.io/name: thanos
                     app.kubernetes.io/instance: thanos
+                    app.kubernetes.io/name: thanos
                     app.kubernetes.io/component: bucketweb
-                namespaces:
-                  - "default"
                 topologyKey: kubernetes.io/hostname
               weight: 1
         nodeAffinity:
       securityContext:
         fsGroup: 1001
+        fsGroupChangePolicy: Always
+        supplementalGroups: []
+        sysctls: []
       containers:
         - name: bucketweb
-          image: public.ecr.aws/bitnami/thanos:0.28.1-scratch-r0
+          image: public.ecr.aws/bitnami/thanos:0.34.1-debian-12-r3
           imagePullPolicy: "IfNotPresent"
           securityContext:
             allowPrivilegeEscalation: false
+            capabilities:
+              drop:
+                - ALL
+            privileged: false
             readOnlyRootFilesystem: true
+            runAsGroup: 1001
             runAsNonRoot: true
             runAsUser: 1001
+            seLinuxOptions: {}
+            seccompProfile:
+              type: RuntimeDefault
           args:
             - tools
             - bucket
@@ -297,32 +499,32 @@
 kind: Deployment
 metadata:
   name: thanos-compactor
-  namespace: "default"
+  namespace: default
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: compactor
 spec:
   replicas: 1
+  revisionHistoryLimit: 10
   strategy:
     type: Recreate
   selector:
     matchLabels:
-      app.kubernetes.io/name: thanos
       app.kubernetes.io/instance: thanos
+      app.kubernetes.io/name: thanos
       app.kubernetes.io/component: compactor
   template:
     metadata:
       labels:
-        app.kubernetes.io/name: thanos
         app.kubernetes.io/instance: thanos
         app.kubernetes.io/managed-by: Helm
+        app.kubernetes.io/name: thanos
         app.kubernetes.io/component: compactor
       annotations:
-        checksum/objstore-configuration: 01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b
     spec:
-      serviceAccount: thanos-compactor
+      serviceAccountName: thanos-compactor
       automountServiceAccountToken: true
       affinity:
         podAffinity:
@@ -331,25 +533,34 @@
             - podAffinityTerm:
                 labelSelector:
                   matchLabels:
-                    app.kubernetes.io/name: thanos
                     app.kubernetes.io/instance: thanos
+                    app.kubernetes.io/name: thanos
                     app.kubernetes.io/component: compactor
-                namespaces:
-                  - "default"
                 topologyKey: kubernetes.io/hostname
               weight: 1
         nodeAffinity:
       securityContext:
         fsGroup: 1001
+        fsGroupChangePolicy: Always
+        supplementalGroups: []
+        sysctls: []
       containers:
         - name: compactor
-          image: public.ecr.aws/bitnami/thanos:0.28.1-scratch-r0
+          image: public.ecr.aws/bitnami/thanos:0.34.1-debian-12-r3
           imagePullPolicy: "IfNotPresent"
           securityContext:
             allowPrivilegeEscalation: false
+            capabilities:
+              drop:
+                - ALL
+            privileged: false
             readOnlyRootFilesystem: true
+            runAsGroup: 1001
             runAsNonRoot: true
             runAsUser: 1001
+            seLinuxOptions: {}
+            seccompProfile:
+              type: RuntimeDefault
           args:
             - compact
             - --log.level=info
@@ -410,30 +621,31 @@
 kind: Deployment
 metadata:
   name: thanos-query
-  namespace: "default"
+  namespace: default
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: query
 spec:
   replicas: 1
+  revisionHistoryLimit: 10
   strategy:
     type: RollingUpdate
   selector:
     matchLabels:
-      app.kubernetes.io/name: thanos
       app.kubernetes.io/instance: thanos
+      app.kubernetes.io/name: thanos
       app.kubernetes.io/component: query
   template:
     metadata:
       labels:
-        app.kubernetes.io/name: thanos
         app.kubernetes.io/instance: thanos
         app.kubernetes.io/managed-by: Helm
+        app.kubernetes.io/name: thanos
         app.kubernetes.io/component: query
     spec:
-      serviceAccount: thanos-query
+      serviceAccountName: thanos-query
       automountServiceAccountToken: true
       affinity:
         podAffinity:
@@ -442,25 +654,34 @@
             - podAffinityTerm:
                 labelSelector:
                   matchLabels:
-                    app.kubernetes.io/name: thanos
                     app.kubernetes.io/instance: thanos
+                    app.kubernetes.io/name: thanos
                     app.kubernetes.io/component: query
-                namespaces:
-                  - "default"
                 topologyKey: kubernetes.io/hostname
               weight: 1
         nodeAffinity:
       securityContext:
         fsGroup: 1001
+        fsGroupChangePolicy: Always
+        supplementalGroups: []
+        sysctls: []
       containers:
         - name: query
-          image: public.ecr.aws/bitnami/thanos:0.28.1-scratch-r0
+          image: public.ecr.aws/bitnami/thanos:0.34.1-debian-12-r3
           imagePullPolicy: "IfNotPresent"
           securityContext:
             allowPrivilegeEscalation: false
+            capabilities:
+              drop:
+                - ALL
+            privileged: false
             readOnlyRootFilesystem: true
+            runAsGroup: 1001
             runAsNonRoot: true
             runAsUser: 1001
+            seLinuxOptions: {}
+            seccompProfile:
+              type: RuntimeDefault
           args:
             - query
             - --log.level=info
@@ -470,6 +691,7 @@
             - --query.replica-label=replica
             - --endpoint=dnssrv+_grpc._tcp.prometheus-thanos-discovery.monitoring.svc.cluster.local
             - --endpoint=dnssrv+_grpc._tcp.thanos-storegateway.default.svc.cluster.local
+            - --alert.query-url=http://thanos-query.default.svc.cluster.local:9090
           ports:
             - name: http
               containerPort: 10902
@@ -498,8 +720,14 @@
               port: http
               scheme: HTTP
           resources:
-            limits: {}
-            requests: {}
+            limits:
+              cpu: 150m
+              ephemeral-storage: 1024Mi
+              memory: 192Mi
+            requests:
+              cpu: 100m
+              ephemeral-storage: 50Mi
+              memory: 128Mi
           volumeMounts:
       volumes:
 ---
@@ -508,34 +736,34 @@
 kind: StatefulSet
 metadata:
   name: thanos-storegateway
-  namespace: "default"
+  namespace: default
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: storegateway
 spec:
   replicas: 1
+  revisionHistoryLimit: 10
   podManagementPolicy: OrderedReady
   serviceName: thanos-storegateway-headless
   updateStrategy:
     type: RollingUpdate
   selector:
     matchLabels:
-      app.kubernetes.io/name: thanos
       app.kubernetes.io/instance: thanos
+      app.kubernetes.io/name: thanos
       app.kubernetes.io/component: storegateway
   template:
     metadata:
       labels:
-        app.kubernetes.io/name: thanos
         app.kubernetes.io/instance: thanos
         app.kubernetes.io/managed-by: Helm
+        app.kubernetes.io/name: thanos
         app.kubernetes.io/component: storegateway
       annotations:
-        checksum/objstore-configuration: 01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b
     spec:
-      serviceAccount: thanos-storegateway
+      serviceAccountName: thanos-storegateway
       automountServiceAccountToken: true
       affinity:
         podAffinity:
@@ -544,25 +772,34 @@
             - podAffinityTerm:
                 labelSelector:
                   matchLabels:
-                    app.kubernetes.io/name: thanos
                     app.kubernetes.io/instance: thanos
+                    app.kubernetes.io/name: thanos
                     app.kubernetes.io/component: storegateway
-                namespaces:
-                  - "default"
                 topologyKey: kubernetes.io/hostname
               weight: 1
         nodeAffinity:
       securityContext:
         fsGroup: 1001
+        fsGroupChangePolicy: Always
+        supplementalGroups: []
+        sysctls: []
       containers:
         - name: storegateway
-          image: public.ecr.aws/bitnami/thanos:0.28.1-scratch-r0
+          image: public.ecr.aws/bitnami/thanos:0.34.1-debian-12-r3
           imagePullPolicy: "IfNotPresent"
           securityContext:
             allowPrivilegeEscalation: false
+            capabilities:
+              drop:
+                - ALL
+            privileged: false
             readOnlyRootFilesystem: true
+            runAsGroup: 1001
             runAsNonRoot: true
             runAsUser: 1001
+            seLinuxOptions: {}
+            seccompProfile:
+              type: RuntimeDefault
           args:
             - store
             - --log.level=info
@@ -599,8 +836,14 @@
               port: http
               scheme: HTTP
           resources:
-            limits: {}
-            requests: {}
+            limits:
+              cpu: 150m
+              ephemeral-storage: 1024Mi
+              memory: 192Mi
+            requests:
+              cpu: 100m
+              ephemeral-storage: 50Mi
+              memory: 128Mi
           volumeMounts:
             - name: objstore-config
               mountPath: /conf
@@ -625,11 +868,11 @@
 kind: Ingress
 metadata:
   name: thanos-query
-  namespace: "default"
+  namespace: default
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: query
   annotations:
     app: thanos
@@ -655,9 +898,9 @@
   name: thanos-bucketweb
   namespace: "default"
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: bucketweb
 spec:
   endpoints:
@@ -667,9 +910,10 @@
       - "default"
   selector:
     matchLabels:
-      app.kubernetes.io/name: thanos
       app.kubernetes.io/instance: thanos
+      app.kubernetes.io/name: thanos
       app.kubernetes.io/component: bucketweb
+      prometheus-operator/monitor: 'true'
 ---
 # Source: thanos/templates/compactor/servicemonitor.yaml
 apiVersion: monitoring.coreos.com/v1
@@ -678,9 +922,9 @@
   name: thanos-compactor
   namespace: "default"
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: compactor
 spec:
   endpoints:
@@ -690,9 +934,10 @@
       - "default"
   selector:
     matchLabels:
-      app.kubernetes.io/name: thanos
       app.kubernetes.io/instance: thanos
+      app.kubernetes.io/name: thanos
       app.kubernetes.io/component: compactor
+      prometheus-operator/monitor: 'true'
 ---
 # Source: thanos/templates/query/servicemonitor.yaml
 apiVersion: monitoring.coreos.com/v1
@@ -701,9 +946,9 @@
   name: thanos-query
   namespace: "default"
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: query
 spec:
   endpoints:
@@ -713,9 +958,10 @@
       - "default"
   selector:
     matchLabels:
-      app.kubernetes.io/name: thanos
       app.kubernetes.io/instance: thanos
+      app.kubernetes.io/name: thanos
       app.kubernetes.io/component: query
+      prometheus-operator/monitor: 'true'
 ---
 # Source: thanos/templates/storegateway/servicemonitor.yaml
 apiVersion: monitoring.coreos.com/v1
@@ -724,9 +970,9 @@
   name: thanos-storegateway
   namespace: "default"
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: storegateway
 spec:
   endpoints:
@@ -736,6 +982,7 @@
       - "default"
   selector:
     matchLabels:
-      app.kubernetes.io/name: thanos
       app.kubernetes.io/instance: thanos
+      app.kubernetes.io/name: thanos
       app.kubernetes.io/component: storegateway
+      prometheus-operator/monitor: 'true'

@renovate renovate bot force-pushed the renovate/thanos-15.x branch from 6452aed to 3bef2c6 Compare April 22, 2024 13:31
@renovate renovate bot changed the title feat(charts)!: Update Helm release thanos to 15.1.0 feat(charts)!: Update Helm release thanos to 15.1.1 Apr 22, 2024
@github-actions GitHub Actions
Copy link

Path: cluster/core/monitoring/thanos/helm-release.yaml
Version: 11.5.5 -> 15.1.1

@@ -1,71 +1,266 @@
+# Source: thanos/templates/bucketweb/networkpolicy.yaml
+kind: NetworkPolicy
+apiVersion: networking.k8s.io/v1
+metadata:
+  name: thanos-bucketweb
+  namespace: "default"
+  labels:
+    app.kubernetes.io/instance: thanos
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
+    app.kubernetes.io/component: bucketweb
+spec:
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/instance: thanos
+      app.kubernetes.io/name: thanos
+      app.kubernetes.io/component: bucketweb
+  policyTypes:
+    - Ingress
+    - Egress
+  egress:
+    - {}
+  ingress:
+    - ports:
+        - port: 8080
+        - port: 8080
+---
+# Source: thanos/templates/compactor/networkpolicy.yaml
+kind: NetworkPolicy
+apiVersion: networking.k8s.io/v1
+metadata:
+  name: thanos-compactor
+  namespace: "default"
+  labels:
+    app.kubernetes.io/instance: thanos
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
+    app.kubernetes.io/component: compactor
+spec:
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/instance: thanos
+      app.kubernetes.io/name: thanos
+      app.kubernetes.io/component: compactor
+  policyTypes:
+    - Ingress
+    - Egress
+  egress:
+    - {}
+  ingress:
+    - ports:
+        - port: 10902
+        - port: 9090
+---
+# Source: thanos/templates/query-frontend/networkpolicy.yaml
+kind: NetworkPolicy
+apiVersion: networking.k8s.io/v1
+metadata:
+  name: thanos-query-frontend
+  namespace: "default"
+  labels:
+    app.kubernetes.io/instance: thanos
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
+    app.kubernetes.io/component: query-frontend
+spec:
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/instance: thanos
+      app.kubernetes.io/name: thanos
+      app.kubernetes.io/component: query-frontend
+  policyTypes:
+    - Ingress
+    - Egress
+  egress:
+    - {}
+  ingress:
+    - ports:
+        - port: 9090
+        - port: 9090
+---
+# Source: thanos/templates/query/networkpolicy.yaml
+kind: NetworkPolicy
+apiVersion: networking.k8s.io/v1
+metadata:
+  name: thanos-query
+  namespace: "default"
+  labels:
+    app.kubernetes.io/instance: thanos
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
+    app.kubernetes.io/component: query
+spec:
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/instance: thanos
+      app.kubernetes.io/name: thanos
+      app.kubernetes.io/component: query
+  policyTypes:
+    - Ingress
+    - Egress
+  egress:
+    - {}
+  ingress:
+    - ports:
+        - port: 10902
+        - port: 10901
+        - port: 9090
+        - port: 10901
+---
+# Source: thanos/templates/receive/networkpolicy.yaml
+kind: NetworkPolicy
+apiVersion: networking.k8s.io/v1
+metadata:
+  name: thanos-receive
+  namespace: "default"
+  labels:
+    app.kubernetes.io/instance: thanos
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
+    app.kubernetes.io/component: receive
+spec:
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/instance: thanos
+      app.kubernetes.io/name: thanos
+      app.kubernetes.io/component: receive
+  policyTypes:
+    - Ingress
+    - Egress
+  egress:
+    - {}
+  ingress:
+    - ports:
+        - port: 10902
+        - port: 10902
+        - port: 10901
+        - port: 10901
+        - port: 19291
+        - port: 19291
+---
+# Source: thanos/templates/ruler/networkpolicy.yaml
+kind: NetworkPolicy
+apiVersion: networking.k8s.io/v1
+metadata:
+  name: thanos-ruler
+  namespace: "default"
+  labels:
+    app.kubernetes.io/instance: thanos
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
+    app.kubernetes.io/component: ruler
+spec:
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/instance: thanos
+      app.kubernetes.io/name: thanos
+      app.kubernetes.io/component: ruler
+  policyTypes:
+    - Ingress
+    - Egress
+  egress:
+    - {}
+  ingress:
+    - ports:
+        - port: 10902
+        - port: 9090
+        - port: 10901
+        - port: 10901
+---
+# Source: thanos/templates/storegateway/networkpolicy.yaml
+kind: NetworkPolicy
+apiVersion: networking.k8s.io/v1
+metadata:
+  name: thanos-storegateway
+  namespace: "default"
+  labels:
+    app.kubernetes.io/instance: thanos
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
+    app.kubernetes.io/component: storegateway
+spec:
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/instance: thanos
+      app.kubernetes.io/name: thanos
+      app.kubernetes.io/component: storegateway
+  policyTypes:
+    - Ingress
+    - Egress
+  egress:
+    - {}
+  ingress:
+    - ports:
+        - port: 10902
+        - port: 9090
+        - port: 10901
+        - port: 10901
+---
 # Source: thanos/templates/bucketweb/serviceaccount.yaml
 apiVersion: v1
 kind: ServiceAccount
 metadata:
   name: thanos-bucketweb
-  namespace: "default"
+  namespace: default
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: bucketweb
-  annotations:
-automountServiceAccountToken: true
+automountServiceAccountToken: false
 ---
 # Source: thanos/templates/compactor/serviceaccount.yaml
 apiVersion: v1
 kind: ServiceAccount
 metadata:
   name: thanos-compactor
-  namespace: "default"
+  namespace: default
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: compactor
-  annotations:
-automountServiceAccountToken: true
+automountServiceAccountToken: false
 ---
 # Source: thanos/templates/query/serviceaccount.yaml
 apiVersion: v1
 kind: ServiceAccount
 metadata:
   name: thanos-query
-  namespace: "default"
+  namespace: default
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: query
-  annotations:
-automountServiceAccountToken: true
+automountServiceAccountToken: false
 ---
 # Source: thanos/templates/storegateway/serviceaccount.yaml
 apiVersion: v1
 kind: ServiceAccount
 metadata:
   name: thanos-storegateway
-  namespace: "default"
+  namespace: default
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: storegateway
-  annotations:
-automountServiceAccountToken: true
+automountServiceAccountToken: false
 ---
 # Source: thanos/templates/bucketweb/service.yaml
 apiVersion: v1
 kind: Service
 metadata:
   name: thanos-bucketweb
-  namespace: "default"
+  namespace: default
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: bucketweb
-  annotations:
+    prometheus-operator/monitor: 'true'
 spec:
   type: ClusterIP
   ports:
@@ -75,8 +270,8 @@
       name: http
       nodePort: null
   selector:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: bucketweb
 ---
 # Source: thanos/templates/compactor/service.yaml
@@ -84,13 +279,13 @@
 kind: Service
 metadata:
   name: thanos-compactor
-  namespace: "default"
+  namespace: default
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: compactor
-  annotations:
+    prometheus-operator/monitor: 'true'
 spec:
   type: ClusterIP
   ports:
@@ -100,8 +295,8 @@
       name: http
       nodePort: null
   selector:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: compactor
 ---
 # Source: thanos/templates/query/service-grpc.yaml
@@ -109,13 +304,12 @@
 kind: Service
 metadata:
   name: thanos-query-grpc
-  namespace: "default"
+  namespace: default
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: query
-  annotations:
 spec:
   type: ClusterIP
   ports:
@@ -125,8 +319,8 @@
       name: grpc
       nodePort: null
   selector:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: query
 ---
 # Source: thanos/templates/query/service.yaml
@@ -134,13 +328,13 @@
 kind: Service
 metadata:
   name: thanos-query
-  namespace: "default"
+  namespace: default
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: query
-  annotations:
+    prometheus-operator/monitor: 'true'
 spec:
   type: ClusterIP
   ports:
@@ -150,8 +344,8 @@
       name: http
       nodePort: null
   selector:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: query
 ---
 # Source: thanos/templates/storegateway/service.yaml
@@ -159,14 +353,13 @@
 kind: Service
 metadata:
   name: thanos-storegateway
-  namespace: "default"
+  namespace: default
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: storegateway
     prometheus-operator/monitor: 'true'
-  annotations:
 spec:
   type: ClusterIP
   ports:
@@ -181,8 +374,8 @@
       name: grpc
       nodePort: null
   selector:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: storegateway
 ---
 # Source: thanos/templates/bucketweb/deployment.yaml
@@ -190,32 +383,32 @@
 kind: Deployment
 metadata:
   name: thanos-bucketweb
-  namespace: "default"
+  namespace: default
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: bucketweb
 spec:
   replicas: 1
+  revisionHistoryLimit: 10
   strategy:
     type: RollingUpdate
   selector:
     matchLabels:
-      app.kubernetes.io/name: thanos
       app.kubernetes.io/instance: thanos
+      app.kubernetes.io/name: thanos
       app.kubernetes.io/component: bucketweb
   template:
     metadata:
       labels:
-        app.kubernetes.io/name: thanos
         app.kubernetes.io/instance: thanos
         app.kubernetes.io/managed-by: Helm
+        app.kubernetes.io/name: thanos
         app.kubernetes.io/component: bucketweb
       annotations:
-        checksum/objstore-configuration: 01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b
     spec:
-      serviceAccount: thanos-bucketweb
+      serviceAccountName: thanos-bucketweb
       automountServiceAccountToken: true
       affinity:
         podAffinity:
@@ -224,25 +417,34 @@
             - podAffinityTerm:
                 labelSelector:
                   matchLabels:
-                    app.kubernetes.io/name: thanos
                     app.kubernetes.io/instance: thanos
+                    app.kubernetes.io/name: thanos
                     app.kubernetes.io/component: bucketweb
-                namespaces:
-                  - "default"
                 topologyKey: kubernetes.io/hostname
               weight: 1
         nodeAffinity:
       securityContext:
         fsGroup: 1001
+        fsGroupChangePolicy: Always
+        supplementalGroups: []
+        sysctls: []
       containers:
         - name: bucketweb
-          image: public.ecr.aws/bitnami/thanos:0.28.1-scratch-r0
+          image: public.ecr.aws/bitnami/thanos:0.34.1-debian-12-r3
           imagePullPolicy: "IfNotPresent"
           securityContext:
             allowPrivilegeEscalation: false
+            capabilities:
+              drop:
+                - ALL
+            privileged: false
             readOnlyRootFilesystem: true
+            runAsGroup: 1001
             runAsNonRoot: true
             runAsUser: 1001
+            seLinuxOptions: {}
+            seccompProfile:
+              type: RuntimeDefault
           args:
             - tools
             - bucket
@@ -297,32 +499,32 @@
 kind: Deployment
 metadata:
   name: thanos-compactor
-  namespace: "default"
+  namespace: default
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: compactor
 spec:
   replicas: 1
+  revisionHistoryLimit: 10
   strategy:
     type: Recreate
   selector:
     matchLabels:
-      app.kubernetes.io/name: thanos
       app.kubernetes.io/instance: thanos
+      app.kubernetes.io/name: thanos
       app.kubernetes.io/component: compactor
   template:
     metadata:
       labels:
-        app.kubernetes.io/name: thanos
         app.kubernetes.io/instance: thanos
         app.kubernetes.io/managed-by: Helm
+        app.kubernetes.io/name: thanos
         app.kubernetes.io/component: compactor
       annotations:
-        checksum/objstore-configuration: 01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b
     spec:
-      serviceAccount: thanos-compactor
+      serviceAccountName: thanos-compactor
       automountServiceAccountToken: true
       affinity:
         podAffinity:
@@ -331,25 +533,34 @@
             - podAffinityTerm:
                 labelSelector:
                   matchLabels:
-                    app.kubernetes.io/name: thanos
                     app.kubernetes.io/instance: thanos
+                    app.kubernetes.io/name: thanos
                     app.kubernetes.io/component: compactor
-                namespaces:
-                  - "default"
                 topologyKey: kubernetes.io/hostname
               weight: 1
         nodeAffinity:
       securityContext:
         fsGroup: 1001
+        fsGroupChangePolicy: Always
+        supplementalGroups: []
+        sysctls: []
       containers:
         - name: compactor
-          image: public.ecr.aws/bitnami/thanos:0.28.1-scratch-r0
+          image: public.ecr.aws/bitnami/thanos:0.34.1-debian-12-r3
           imagePullPolicy: "IfNotPresent"
           securityContext:
             allowPrivilegeEscalation: false
+            capabilities:
+              drop:
+                - ALL
+            privileged: false
             readOnlyRootFilesystem: true
+            runAsGroup: 1001
             runAsNonRoot: true
             runAsUser: 1001
+            seLinuxOptions: {}
+            seccompProfile:
+              type: RuntimeDefault
           args:
             - compact
             - --log.level=info
@@ -410,30 +621,31 @@
 kind: Deployment
 metadata:
   name: thanos-query
-  namespace: "default"
+  namespace: default
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: query
 spec:
   replicas: 1
+  revisionHistoryLimit: 10
   strategy:
     type: RollingUpdate
   selector:
     matchLabels:
-      app.kubernetes.io/name: thanos
       app.kubernetes.io/instance: thanos
+      app.kubernetes.io/name: thanos
       app.kubernetes.io/component: query
   template:
     metadata:
       labels:
-        app.kubernetes.io/name: thanos
         app.kubernetes.io/instance: thanos
         app.kubernetes.io/managed-by: Helm
+        app.kubernetes.io/name: thanos
         app.kubernetes.io/component: query
     spec:
-      serviceAccount: thanos-query
+      serviceAccountName: thanos-query
       automountServiceAccountToken: true
       affinity:
         podAffinity:
@@ -442,25 +654,34 @@
             - podAffinityTerm:
                 labelSelector:
                   matchLabels:
-                    app.kubernetes.io/name: thanos
                     app.kubernetes.io/instance: thanos
+                    app.kubernetes.io/name: thanos
                     app.kubernetes.io/component: query
-                namespaces:
-                  - "default"
                 topologyKey: kubernetes.io/hostname
               weight: 1
         nodeAffinity:
       securityContext:
         fsGroup: 1001
+        fsGroupChangePolicy: Always
+        supplementalGroups: []
+        sysctls: []
       containers:
         - name: query
-          image: public.ecr.aws/bitnami/thanos:0.28.1-scratch-r0
+          image: public.ecr.aws/bitnami/thanos:0.34.1-debian-12-r3
           imagePullPolicy: "IfNotPresent"
           securityContext:
             allowPrivilegeEscalation: false
+            capabilities:
+              drop:
+                - ALL
+            privileged: false
             readOnlyRootFilesystem: true
+            runAsGroup: 1001
             runAsNonRoot: true
             runAsUser: 1001
+            seLinuxOptions: {}
+            seccompProfile:
+              type: RuntimeDefault
           args:
             - query
             - --log.level=info
@@ -470,6 +691,7 @@
             - --query.replica-label=replica
             - --endpoint=dnssrv+_grpc._tcp.prometheus-thanos-discovery.monitoring.svc.cluster.local
             - --endpoint=dnssrv+_grpc._tcp.thanos-storegateway.default.svc.cluster.local
+            - --alert.query-url=http://thanos-query.default.svc.cluster.local:9090
           ports:
             - name: http
               containerPort: 10902
@@ -498,8 +720,14 @@
               port: http
               scheme: HTTP
           resources:
-            limits: {}
-            requests: {}
+            limits:
+              cpu: 150m
+              ephemeral-storage: 1024Mi
+              memory: 192Mi
+            requests:
+              cpu: 100m
+              ephemeral-storage: 50Mi
+              memory: 128Mi
           volumeMounts:
       volumes:
 ---
@@ -508,34 +736,34 @@
 kind: StatefulSet
 metadata:
   name: thanos-storegateway
-  namespace: "default"
+  namespace: default
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: storegateway
 spec:
   replicas: 1
+  revisionHistoryLimit: 10
   podManagementPolicy: OrderedReady
   serviceName: thanos-storegateway-headless
   updateStrategy:
     type: RollingUpdate
   selector:
     matchLabels:
-      app.kubernetes.io/name: thanos
       app.kubernetes.io/instance: thanos
+      app.kubernetes.io/name: thanos
       app.kubernetes.io/component: storegateway
   template:
     metadata:
       labels:
-        app.kubernetes.io/name: thanos
         app.kubernetes.io/instance: thanos
         app.kubernetes.io/managed-by: Helm
+        app.kubernetes.io/name: thanos
         app.kubernetes.io/component: storegateway
       annotations:
-        checksum/objstore-configuration: 01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b
     spec:
-      serviceAccount: thanos-storegateway
+      serviceAccountName: thanos-storegateway
       automountServiceAccountToken: true
       affinity:
         podAffinity:
@@ -544,25 +772,34 @@
             - podAffinityTerm:
                 labelSelector:
                   matchLabels:
-                    app.kubernetes.io/name: thanos
                     app.kubernetes.io/instance: thanos
+                    app.kubernetes.io/name: thanos
                     app.kubernetes.io/component: storegateway
-                namespaces:
-                  - "default"
                 topologyKey: kubernetes.io/hostname
               weight: 1
         nodeAffinity:
       securityContext:
         fsGroup: 1001
+        fsGroupChangePolicy: Always
+        supplementalGroups: []
+        sysctls: []
       containers:
         - name: storegateway
-          image: public.ecr.aws/bitnami/thanos:0.28.1-scratch-r0
+          image: public.ecr.aws/bitnami/thanos:0.34.1-debian-12-r3
           imagePullPolicy: "IfNotPresent"
           securityContext:
             allowPrivilegeEscalation: false
+            capabilities:
+              drop:
+                - ALL
+            privileged: false
             readOnlyRootFilesystem: true
+            runAsGroup: 1001
             runAsNonRoot: true
             runAsUser: 1001
+            seLinuxOptions: {}
+            seccompProfile:
+              type: RuntimeDefault
           args:
             - store
             - --log.level=info
@@ -599,8 +836,14 @@
               port: http
               scheme: HTTP
           resources:
-            limits: {}
-            requests: {}
+            limits:
+              cpu: 150m
+              ephemeral-storage: 1024Mi
+              memory: 192Mi
+            requests:
+              cpu: 100m
+              ephemeral-storage: 50Mi
+              memory: 128Mi
           volumeMounts:
             - name: objstore-config
               mountPath: /conf
@@ -625,11 +868,11 @@
 kind: Ingress
 metadata:
   name: thanos-query
-  namespace: "default"
+  namespace: default
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: query
   annotations:
     app: thanos
@@ -655,9 +898,9 @@
   name: thanos-bucketweb
   namespace: "default"
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: bucketweb
 spec:
   endpoints:
@@ -667,9 +910,10 @@
       - "default"
   selector:
     matchLabels:
-      app.kubernetes.io/name: thanos
       app.kubernetes.io/instance: thanos
+      app.kubernetes.io/name: thanos
       app.kubernetes.io/component: bucketweb
+      prometheus-operator/monitor: 'true'
 ---
 # Source: thanos/templates/compactor/servicemonitor.yaml
 apiVersion: monitoring.coreos.com/v1
@@ -678,9 +922,9 @@
   name: thanos-compactor
   namespace: "default"
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: compactor
 spec:
   endpoints:
@@ -690,9 +934,10 @@
       - "default"
   selector:
     matchLabels:
-      app.kubernetes.io/name: thanos
       app.kubernetes.io/instance: thanos
+      app.kubernetes.io/name: thanos
       app.kubernetes.io/component: compactor
+      prometheus-operator/monitor: 'true'
 ---
 # Source: thanos/templates/query/servicemonitor.yaml
 apiVersion: monitoring.coreos.com/v1
@@ -701,9 +946,9 @@
   name: thanos-query
   namespace: "default"
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: query
 spec:
   endpoints:
@@ -713,9 +958,10 @@
       - "default"
   selector:
     matchLabels:
-      app.kubernetes.io/name: thanos
       app.kubernetes.io/instance: thanos
+      app.kubernetes.io/name: thanos
       app.kubernetes.io/component: query
+      prometheus-operator/monitor: 'true'
 ---
 # Source: thanos/templates/storegateway/servicemonitor.yaml
 apiVersion: monitoring.coreos.com/v1
@@ -724,9 +970,9 @@
   name: thanos-storegateway
   namespace: "default"
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: storegateway
 spec:
   endpoints:
@@ -736,6 +982,7 @@
       - "default"
   selector:
     matchLabels:
-      app.kubernetes.io/name: thanos
       app.kubernetes.io/instance: thanos
+      app.kubernetes.io/name: thanos
       app.kubernetes.io/component: storegateway
+      prometheus-operator/monitor: 'true'

@renovate renovate bot force-pushed the renovate/thanos-15.x branch from 3bef2c6 to 9a233fb Compare April 22, 2024 16:12
@renovate renovate bot changed the title feat(charts)!: Update Helm release thanos to 15.1.1 feat(charts)!: Update Helm release thanos to 15.1.2 Apr 22, 2024
@github-actions GitHub Actions
Copy link

Path: cluster/core/monitoring/thanos/helm-release.yaml
Version: 11.5.5 -> 15.1.2

@@ -1,71 +1,266 @@
+# Source: thanos/templates/bucketweb/networkpolicy.yaml
+kind: NetworkPolicy
+apiVersion: networking.k8s.io/v1
+metadata:
+  name: thanos-bucketweb
+  namespace: "default"
+  labels:
+    app.kubernetes.io/instance: thanos
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
+    app.kubernetes.io/component: bucketweb
+spec:
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/instance: thanos
+      app.kubernetes.io/name: thanos
+      app.kubernetes.io/component: bucketweb
+  policyTypes:
+    - Ingress
+    - Egress
+  egress:
+    - {}
+  ingress:
+    - ports:
+        - port: 8080
+        - port: 8080
+---
+# Source: thanos/templates/compactor/networkpolicy.yaml
+kind: NetworkPolicy
+apiVersion: networking.k8s.io/v1
+metadata:
+  name: thanos-compactor
+  namespace: "default"
+  labels:
+    app.kubernetes.io/instance: thanos
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
+    app.kubernetes.io/component: compactor
+spec:
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/instance: thanos
+      app.kubernetes.io/name: thanos
+      app.kubernetes.io/component: compactor
+  policyTypes:
+    - Ingress
+    - Egress
+  egress:
+    - {}
+  ingress:
+    - ports:
+        - port: 10902
+        - port: 9090
+---
+# Source: thanos/templates/query-frontend/networkpolicy.yaml
+kind: NetworkPolicy
+apiVersion: networking.k8s.io/v1
+metadata:
+  name: thanos-query-frontend
+  namespace: "default"
+  labels:
+    app.kubernetes.io/instance: thanos
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
+    app.kubernetes.io/component: query-frontend
+spec:
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/instance: thanos
+      app.kubernetes.io/name: thanos
+      app.kubernetes.io/component: query-frontend
+  policyTypes:
+    - Ingress
+    - Egress
+  egress:
+    - {}
+  ingress:
+    - ports:
+        - port: 9090
+        - port: 9090
+---
+# Source: thanos/templates/query/networkpolicy.yaml
+kind: NetworkPolicy
+apiVersion: networking.k8s.io/v1
+metadata:
+  name: thanos-query
+  namespace: "default"
+  labels:
+    app.kubernetes.io/instance: thanos
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
+    app.kubernetes.io/component: query
+spec:
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/instance: thanos
+      app.kubernetes.io/name: thanos
+      app.kubernetes.io/component: query
+  policyTypes:
+    - Ingress
+    - Egress
+  egress:
+    - {}
+  ingress:
+    - ports:
+        - port: 10902
+        - port: 10901
+        - port: 9090
+        - port: 10901
+---
+# Source: thanos/templates/receive/networkpolicy.yaml
+kind: NetworkPolicy
+apiVersion: networking.k8s.io/v1
+metadata:
+  name: thanos-receive
+  namespace: "default"
+  labels:
+    app.kubernetes.io/instance: thanos
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
+    app.kubernetes.io/component: receive
+spec:
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/instance: thanos
+      app.kubernetes.io/name: thanos
+      app.kubernetes.io/component: receive
+  policyTypes:
+    - Ingress
+    - Egress
+  egress:
+    - {}
+  ingress:
+    - ports:
+        - port: 10902
+        - port: 10902
+        - port: 10901
+        - port: 10901
+        - port: 19291
+        - port: 19291
+---
+# Source: thanos/templates/ruler/networkpolicy.yaml
+kind: NetworkPolicy
+apiVersion: networking.k8s.io/v1
+metadata:
+  name: thanos-ruler
+  namespace: "default"
+  labels:
+    app.kubernetes.io/instance: thanos
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
+    app.kubernetes.io/component: ruler
+spec:
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/instance: thanos
+      app.kubernetes.io/name: thanos
+      app.kubernetes.io/component: ruler
+  policyTypes:
+    - Ingress
+    - Egress
+  egress:
+    - {}
+  ingress:
+    - ports:
+        - port: 10902
+        - port: 9090
+        - port: 10901
+        - port: 10901
+---
+# Source: thanos/templates/storegateway/networkpolicy.yaml
+kind: NetworkPolicy
+apiVersion: networking.k8s.io/v1
+metadata:
+  name: thanos-storegateway
+  namespace: "default"
+  labels:
+    app.kubernetes.io/instance: thanos
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
+    app.kubernetes.io/component: storegateway
+spec:
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/instance: thanos
+      app.kubernetes.io/name: thanos
+      app.kubernetes.io/component: storegateway
+  policyTypes:
+    - Ingress
+    - Egress
+  egress:
+    - {}
+  ingress:
+    - ports:
+        - port: 10902
+        - port: 9090
+        - port: 10901
+        - port: 10901
+---
 # Source: thanos/templates/bucketweb/serviceaccount.yaml
 apiVersion: v1
 kind: ServiceAccount
 metadata:
   name: thanos-bucketweb
-  namespace: "default"
+  namespace: default
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: bucketweb
-  annotations:
-automountServiceAccountToken: true
+automountServiceAccountToken: false
 ---
 # Source: thanos/templates/compactor/serviceaccount.yaml
 apiVersion: v1
 kind: ServiceAccount
 metadata:
   name: thanos-compactor
-  namespace: "default"
+  namespace: default
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: compactor
-  annotations:
-automountServiceAccountToken: true
+automountServiceAccountToken: false
 ---
 # Source: thanos/templates/query/serviceaccount.yaml
 apiVersion: v1
 kind: ServiceAccount
 metadata:
   name: thanos-query
-  namespace: "default"
+  namespace: default
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: query
-  annotations:
-automountServiceAccountToken: true
+automountServiceAccountToken: false
 ---
 # Source: thanos/templates/storegateway/serviceaccount.yaml
 apiVersion: v1
 kind: ServiceAccount
 metadata:
   name: thanos-storegateway
-  namespace: "default"
+  namespace: default
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: storegateway
-  annotations:
-automountServiceAccountToken: true
+automountServiceAccountToken: false
 ---
 # Source: thanos/templates/bucketweb/service.yaml
 apiVersion: v1
 kind: Service
 metadata:
   name: thanos-bucketweb
-  namespace: "default"
+  namespace: default
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: bucketweb
-  annotations:
+    prometheus-operator/monitor: 'true'
 spec:
   type: ClusterIP
   ports:
@@ -75,8 +270,8 @@
       name: http
       nodePort: null
   selector:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: bucketweb
 ---
 # Source: thanos/templates/compactor/service.yaml
@@ -84,13 +279,13 @@
 kind: Service
 metadata:
   name: thanos-compactor
-  namespace: "default"
+  namespace: default
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: compactor
-  annotations:
+    prometheus-operator/monitor: 'true'
 spec:
   type: ClusterIP
   ports:
@@ -100,8 +295,8 @@
       name: http
       nodePort: null
   selector:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: compactor
 ---
 # Source: thanos/templates/query/service-grpc.yaml
@@ -109,13 +304,12 @@
 kind: Service
 metadata:
   name: thanos-query-grpc
-  namespace: "default"
+  namespace: default
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: query
-  annotations:
 spec:
   type: ClusterIP
   ports:
@@ -125,8 +319,8 @@
       name: grpc
       nodePort: null
   selector:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: query
 ---
 # Source: thanos/templates/query/service.yaml
@@ -134,13 +328,13 @@
 kind: Service
 metadata:
   name: thanos-query
-  namespace: "default"
+  namespace: default
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: query
-  annotations:
+    prometheus-operator/monitor: 'true'
 spec:
   type: ClusterIP
   ports:
@@ -150,8 +344,8 @@
       name: http
       nodePort: null
   selector:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: query
 ---
 # Source: thanos/templates/storegateway/service.yaml
@@ -159,14 +353,13 @@
 kind: Service
 metadata:
   name: thanos-storegateway
-  namespace: "default"
+  namespace: default
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: storegateway
     prometheus-operator/monitor: 'true'
-  annotations:
 spec:
   type: ClusterIP
   ports:
@@ -181,8 +374,8 @@
       name: grpc
       nodePort: null
   selector:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: storegateway
 ---
 # Source: thanos/templates/bucketweb/deployment.yaml
@@ -190,32 +383,32 @@
 kind: Deployment
 metadata:
   name: thanos-bucketweb
-  namespace: "default"
+  namespace: default
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: bucketweb
 spec:
   replicas: 1
+  revisionHistoryLimit: 10
   strategy:
     type: RollingUpdate
   selector:
     matchLabels:
-      app.kubernetes.io/name: thanos
       app.kubernetes.io/instance: thanos
+      app.kubernetes.io/name: thanos
       app.kubernetes.io/component: bucketweb
   template:
     metadata:
       labels:
-        app.kubernetes.io/name: thanos
         app.kubernetes.io/instance: thanos
         app.kubernetes.io/managed-by: Helm
+        app.kubernetes.io/name: thanos
         app.kubernetes.io/component: bucketweb
       annotations:
-        checksum/objstore-configuration: 01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b
     spec:
-      serviceAccount: thanos-bucketweb
+      serviceAccountName: thanos-bucketweb
       automountServiceAccountToken: true
       affinity:
         podAffinity:
@@ -224,25 +417,34 @@
             - podAffinityTerm:
                 labelSelector:
                   matchLabels:
-                    app.kubernetes.io/name: thanos
                     app.kubernetes.io/instance: thanos
+                    app.kubernetes.io/name: thanos
                     app.kubernetes.io/component: bucketweb
-                namespaces:
-                  - "default"
                 topologyKey: kubernetes.io/hostname
               weight: 1
         nodeAffinity:
       securityContext:
         fsGroup: 1001
+        fsGroupChangePolicy: Always
+        supplementalGroups: []
+        sysctls: []
       containers:
         - name: bucketweb
-          image: public.ecr.aws/bitnami/thanos:0.28.1-scratch-r0
+          image: public.ecr.aws/bitnami/thanos:0.34.1-debian-12-r3
           imagePullPolicy: "IfNotPresent"
           securityContext:
             allowPrivilegeEscalation: false
+            capabilities:
+              drop:
+                - ALL
+            privileged: false
             readOnlyRootFilesystem: true
+            runAsGroup: 1001
             runAsNonRoot: true
             runAsUser: 1001
+            seLinuxOptions: {}
+            seccompProfile:
+              type: RuntimeDefault
           args:
             - tools
             - bucket
@@ -297,32 +499,32 @@
 kind: Deployment
 metadata:
   name: thanos-compactor
-  namespace: "default"
+  namespace: default
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: compactor
 spec:
   replicas: 1
+  revisionHistoryLimit: 10
   strategy:
     type: Recreate
   selector:
     matchLabels:
-      app.kubernetes.io/name: thanos
       app.kubernetes.io/instance: thanos
+      app.kubernetes.io/name: thanos
       app.kubernetes.io/component: compactor
   template:
     metadata:
       labels:
-        app.kubernetes.io/name: thanos
         app.kubernetes.io/instance: thanos
         app.kubernetes.io/managed-by: Helm
+        app.kubernetes.io/name: thanos
         app.kubernetes.io/component: compactor
       annotations:
-        checksum/objstore-configuration: 01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b
     spec:
-      serviceAccount: thanos-compactor
+      serviceAccountName: thanos-compactor
       automountServiceAccountToken: true
       affinity:
         podAffinity:
@@ -331,25 +533,34 @@
             - podAffinityTerm:
                 labelSelector:
                   matchLabels:
-                    app.kubernetes.io/name: thanos
                     app.kubernetes.io/instance: thanos
+                    app.kubernetes.io/name: thanos
                     app.kubernetes.io/component: compactor
-                namespaces:
-                  - "default"
                 topologyKey: kubernetes.io/hostname
               weight: 1
         nodeAffinity:
       securityContext:
         fsGroup: 1001
+        fsGroupChangePolicy: Always
+        supplementalGroups: []
+        sysctls: []
       containers:
         - name: compactor
-          image: public.ecr.aws/bitnami/thanos:0.28.1-scratch-r0
+          image: public.ecr.aws/bitnami/thanos:0.34.1-debian-12-r3
           imagePullPolicy: "IfNotPresent"
           securityContext:
             allowPrivilegeEscalation: false
+            capabilities:
+              drop:
+                - ALL
+            privileged: false
             readOnlyRootFilesystem: true
+            runAsGroup: 1001
             runAsNonRoot: true
             runAsUser: 1001
+            seLinuxOptions: {}
+            seccompProfile:
+              type: RuntimeDefault
           args:
             - compact
             - --log.level=info
@@ -410,30 +621,31 @@
 kind: Deployment
 metadata:
   name: thanos-query
-  namespace: "default"
+  namespace: default
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: query
 spec:
   replicas: 1
+  revisionHistoryLimit: 10
   strategy:
     type: RollingUpdate
   selector:
     matchLabels:
-      app.kubernetes.io/name: thanos
       app.kubernetes.io/instance: thanos
+      app.kubernetes.io/name: thanos
       app.kubernetes.io/component: query
   template:
     metadata:
       labels:
-        app.kubernetes.io/name: thanos
         app.kubernetes.io/instance: thanos
         app.kubernetes.io/managed-by: Helm
+        app.kubernetes.io/name: thanos
         app.kubernetes.io/component: query
     spec:
-      serviceAccount: thanos-query
+      serviceAccountName: thanos-query
       automountServiceAccountToken: true
       affinity:
         podAffinity:
@@ -442,25 +654,34 @@
             - podAffinityTerm:
                 labelSelector:
                   matchLabels:
-                    app.kubernetes.io/name: thanos
                     app.kubernetes.io/instance: thanos
+                    app.kubernetes.io/name: thanos
                     app.kubernetes.io/component: query
-                namespaces:
-                  - "default"
                 topologyKey: kubernetes.io/hostname
               weight: 1
         nodeAffinity:
       securityContext:
         fsGroup: 1001
+        fsGroupChangePolicy: Always
+        supplementalGroups: []
+        sysctls: []
       containers:
         - name: query
-          image: public.ecr.aws/bitnami/thanos:0.28.1-scratch-r0
+          image: public.ecr.aws/bitnami/thanos:0.34.1-debian-12-r3
           imagePullPolicy: "IfNotPresent"
           securityContext:
             allowPrivilegeEscalation: false
+            capabilities:
+              drop:
+                - ALL
+            privileged: false
             readOnlyRootFilesystem: true
+            runAsGroup: 1001
             runAsNonRoot: true
             runAsUser: 1001
+            seLinuxOptions: {}
+            seccompProfile:
+              type: RuntimeDefault
           args:
             - query
             - --log.level=info
@@ -470,6 +691,7 @@
             - --query.replica-label=replica
             - --endpoint=dnssrv+_grpc._tcp.prometheus-thanos-discovery.monitoring.svc.cluster.local
             - --endpoint=dnssrv+_grpc._tcp.thanos-storegateway.default.svc.cluster.local
+            - --alert.query-url=http://thanos-query.default.svc.cluster.local:9090
           ports:
             - name: http
               containerPort: 10902
@@ -498,8 +720,14 @@
               port: http
               scheme: HTTP
           resources:
-            limits: {}
-            requests: {}
+            limits:
+              cpu: 150m
+              ephemeral-storage: 1024Mi
+              memory: 192Mi
+            requests:
+              cpu: 100m
+              ephemeral-storage: 50Mi
+              memory: 128Mi
           volumeMounts:
       volumes:
 ---
@@ -508,34 +736,34 @@
 kind: StatefulSet
 metadata:
   name: thanos-storegateway
-  namespace: "default"
+  namespace: default
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: storegateway
 spec:
   replicas: 1
+  revisionHistoryLimit: 10
   podManagementPolicy: OrderedReady
   serviceName: thanos-storegateway-headless
   updateStrategy:
     type: RollingUpdate
   selector:
     matchLabels:
-      app.kubernetes.io/name: thanos
       app.kubernetes.io/instance: thanos
+      app.kubernetes.io/name: thanos
       app.kubernetes.io/component: storegateway
   template:
     metadata:
       labels:
-        app.kubernetes.io/name: thanos
         app.kubernetes.io/instance: thanos
         app.kubernetes.io/managed-by: Helm
+        app.kubernetes.io/name: thanos
         app.kubernetes.io/component: storegateway
       annotations:
-        checksum/objstore-configuration: 01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b
     spec:
-      serviceAccount: thanos-storegateway
+      serviceAccountName: thanos-storegateway
       automountServiceAccountToken: true
       affinity:
         podAffinity:
@@ -544,25 +772,34 @@
             - podAffinityTerm:
                 labelSelector:
                   matchLabels:
-                    app.kubernetes.io/name: thanos
                     app.kubernetes.io/instance: thanos
+                    app.kubernetes.io/name: thanos
                     app.kubernetes.io/component: storegateway
-                namespaces:
-                  - "default"
                 topologyKey: kubernetes.io/hostname
               weight: 1
         nodeAffinity:
       securityContext:
         fsGroup: 1001
+        fsGroupChangePolicy: Always
+        supplementalGroups: []
+        sysctls: []
       containers:
         - name: storegateway
-          image: public.ecr.aws/bitnami/thanos:0.28.1-scratch-r0
+          image: public.ecr.aws/bitnami/thanos:0.34.1-debian-12-r3
           imagePullPolicy: "IfNotPresent"
           securityContext:
             allowPrivilegeEscalation: false
+            capabilities:
+              drop:
+                - ALL
+            privileged: false
             readOnlyRootFilesystem: true
+            runAsGroup: 1001
             runAsNonRoot: true
             runAsUser: 1001
+            seLinuxOptions: {}
+            seccompProfile:
+              type: RuntimeDefault
           args:
             - store
             - --log.level=info
@@ -599,8 +836,14 @@
               port: http
               scheme: HTTP
           resources:
-            limits: {}
-            requests: {}
+            limits:
+              cpu: 150m
+              ephemeral-storage: 1024Mi
+              memory: 192Mi
+            requests:
+              cpu: 100m
+              ephemeral-storage: 50Mi
+              memory: 128Mi
           volumeMounts:
             - name: objstore-config
               mountPath: /conf
@@ -625,11 +868,11 @@
 kind: Ingress
 metadata:
   name: thanos-query
-  namespace: "default"
+  namespace: default
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: query
   annotations:
     app: thanos
@@ -655,9 +898,9 @@
   name: thanos-bucketweb
   namespace: "default"
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: bucketweb
 spec:
   endpoints:
@@ -667,9 +910,10 @@
       - "default"
   selector:
     matchLabels:
-      app.kubernetes.io/name: thanos
       app.kubernetes.io/instance: thanos
+      app.kubernetes.io/name: thanos
       app.kubernetes.io/component: bucketweb
+      prometheus-operator/monitor: 'true'
 ---
 # Source: thanos/templates/compactor/servicemonitor.yaml
 apiVersion: monitoring.coreos.com/v1
@@ -678,9 +922,9 @@
   name: thanos-compactor
   namespace: "default"
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: compactor
 spec:
   endpoints:
@@ -690,9 +934,10 @@
       - "default"
   selector:
     matchLabels:
-      app.kubernetes.io/name: thanos
       app.kubernetes.io/instance: thanos
+      app.kubernetes.io/name: thanos
       app.kubernetes.io/component: compactor
+      prometheus-operator/monitor: 'true'
 ---
 # Source: thanos/templates/query/servicemonitor.yaml
 apiVersion: monitoring.coreos.com/v1
@@ -701,9 +946,9 @@
   name: thanos-query
   namespace: "default"
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: query
 spec:
   endpoints:
@@ -713,9 +958,10 @@
       - "default"
   selector:
     matchLabels:
-      app.kubernetes.io/name: thanos
       app.kubernetes.io/instance: thanos
+      app.kubernetes.io/name: thanos
       app.kubernetes.io/component: query
+      prometheus-operator/monitor: 'true'
 ---
 # Source: thanos/templates/storegateway/servicemonitor.yaml
 apiVersion: monitoring.coreos.com/v1
@@ -724,9 +970,9 @@
   name: thanos-storegateway
   namespace: "default"
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: storegateway
 spec:
   endpoints:
@@ -736,6 +982,7 @@
       - "default"
   selector:
     matchLabels:
-      app.kubernetes.io/name: thanos
       app.kubernetes.io/instance: thanos
+      app.kubernetes.io/name: thanos
       app.kubernetes.io/component: storegateway
+      prometheus-operator/monitor: 'true'

@renovate renovate bot force-pushed the renovate/thanos-15.x branch from 9a233fb to 49416a1 Compare April 23, 2024 11:03
@renovate renovate bot changed the title feat(charts)!: Update Helm release thanos to 15.1.2 feat(charts)!: Update Helm release thanos to 15.1.3 Apr 23, 2024
@github-actions GitHub Actions
Copy link

Path: cluster/core/monitoring/thanos/helm-release.yaml
Version: 11.5.5 -> 15.1.3

@@ -1,71 +1,266 @@
+# Source: thanos/templates/bucketweb/networkpolicy.yaml
+kind: NetworkPolicy
+apiVersion: networking.k8s.io/v1
+metadata:
+  name: thanos-bucketweb
+  namespace: "default"
+  labels:
+    app.kubernetes.io/instance: thanos
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
+    app.kubernetes.io/component: bucketweb
+spec:
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/instance: thanos
+      app.kubernetes.io/name: thanos
+      app.kubernetes.io/component: bucketweb
+  policyTypes:
+    - Ingress
+    - Egress
+  egress:
+    - {}
+  ingress:
+    - ports:
+        - port: 8080
+        - port: 8080
+---
+# Source: thanos/templates/compactor/networkpolicy.yaml
+kind: NetworkPolicy
+apiVersion: networking.k8s.io/v1
+metadata:
+  name: thanos-compactor
+  namespace: "default"
+  labels:
+    app.kubernetes.io/instance: thanos
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
+    app.kubernetes.io/component: compactor
+spec:
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/instance: thanos
+      app.kubernetes.io/name: thanos
+      app.kubernetes.io/component: compactor
+  policyTypes:
+    - Ingress
+    - Egress
+  egress:
+    - {}
+  ingress:
+    - ports:
+        - port: 10902
+        - port: 9090
+---
+# Source: thanos/templates/query-frontend/networkpolicy.yaml
+kind: NetworkPolicy
+apiVersion: networking.k8s.io/v1
+metadata:
+  name: thanos-query-frontend
+  namespace: "default"
+  labels:
+    app.kubernetes.io/instance: thanos
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
+    app.kubernetes.io/component: query-frontend
+spec:
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/instance: thanos
+      app.kubernetes.io/name: thanos
+      app.kubernetes.io/component: query-frontend
+  policyTypes:
+    - Ingress
+    - Egress
+  egress:
+    - {}
+  ingress:
+    - ports:
+        - port: 9090
+        - port: 9090
+---
+# Source: thanos/templates/query/networkpolicy.yaml
+kind: NetworkPolicy
+apiVersion: networking.k8s.io/v1
+metadata:
+  name: thanos-query
+  namespace: "default"
+  labels:
+    app.kubernetes.io/instance: thanos
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
+    app.kubernetes.io/component: query
+spec:
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/instance: thanos
+      app.kubernetes.io/name: thanos
+      app.kubernetes.io/component: query
+  policyTypes:
+    - Ingress
+    - Egress
+  egress:
+    - {}
+  ingress:
+    - ports:
+        - port: 10902
+        - port: 10901
+        - port: 9090
+        - port: 10901
+---
+# Source: thanos/templates/receive/networkpolicy.yaml
+kind: NetworkPolicy
+apiVersion: networking.k8s.io/v1
+metadata:
+  name: thanos-receive
+  namespace: "default"
+  labels:
+    app.kubernetes.io/instance: thanos
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
+    app.kubernetes.io/component: receive
+spec:
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/instance: thanos
+      app.kubernetes.io/name: thanos
+      app.kubernetes.io/component: receive
+  policyTypes:
+    - Ingress
+    - Egress
+  egress:
+    - {}
+  ingress:
+    - ports:
+        - port: 10902
+        - port: 10902
+        - port: 10901
+        - port: 10901
+        - port: 19291
+        - port: 19291
+---
+# Source: thanos/templates/ruler/networkpolicy.yaml
+kind: NetworkPolicy
+apiVersion: networking.k8s.io/v1
+metadata:
+  name: thanos-ruler
+  namespace: "default"
+  labels:
+    app.kubernetes.io/instance: thanos
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
+    app.kubernetes.io/component: ruler
+spec:
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/instance: thanos
+      app.kubernetes.io/name: thanos
+      app.kubernetes.io/component: ruler
+  policyTypes:
+    - Ingress
+    - Egress
+  egress:
+    - {}
+  ingress:
+    - ports:
+        - port: 10902
+        - port: 9090
+        - port: 10901
+        - port: 10901
+---
+# Source: thanos/templates/storegateway/networkpolicy.yaml
+kind: NetworkPolicy
+apiVersion: networking.k8s.io/v1
+metadata:
+  name: thanos-storegateway
+  namespace: "default"
+  labels:
+    app.kubernetes.io/instance: thanos
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
+    app.kubernetes.io/component: storegateway
+spec:
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/instance: thanos
+      app.kubernetes.io/name: thanos
+      app.kubernetes.io/component: storegateway
+  policyTypes:
+    - Ingress
+    - Egress
+  egress:
+    - {}
+  ingress:
+    - ports:
+        - port: 10902
+        - port: 9090
+        - port: 10901
+        - port: 10901
+---
 # Source: thanos/templates/bucketweb/serviceaccount.yaml
 apiVersion: v1
 kind: ServiceAccount
 metadata:
   name: thanos-bucketweb
-  namespace: "default"
+  namespace: default
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: bucketweb
-  annotations:
-automountServiceAccountToken: true
+automountServiceAccountToken: false
 ---
 # Source: thanos/templates/compactor/serviceaccount.yaml
 apiVersion: v1
 kind: ServiceAccount
 metadata:
   name: thanos-compactor
-  namespace: "default"
+  namespace: default
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: compactor
-  annotations:
-automountServiceAccountToken: true
+automountServiceAccountToken: false
 ---
 # Source: thanos/templates/query/serviceaccount.yaml
 apiVersion: v1
 kind: ServiceAccount
 metadata:
   name: thanos-query
-  namespace: "default"
+  namespace: default
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: query
-  annotations:
-automountServiceAccountToken: true
+automountServiceAccountToken: false
 ---
 # Source: thanos/templates/storegateway/serviceaccount.yaml
 apiVersion: v1
 kind: ServiceAccount
 metadata:
   name: thanos-storegateway
-  namespace: "default"
+  namespace: default
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: storegateway
-  annotations:
-automountServiceAccountToken: true
+automountServiceAccountToken: false
 ---
 # Source: thanos/templates/bucketweb/service.yaml
 apiVersion: v1
 kind: Service
 metadata:
   name: thanos-bucketweb
-  namespace: "default"
+  namespace: default
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: bucketweb
-  annotations:
+    prometheus-operator/monitor: 'true'
 spec:
   type: ClusterIP
   ports:
@@ -75,8 +270,8 @@
       name: http
       nodePort: null
   selector:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: bucketweb
 ---
 # Source: thanos/templates/compactor/service.yaml
@@ -84,13 +279,13 @@
 kind: Service
 metadata:
   name: thanos-compactor
-  namespace: "default"
+  namespace: default
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: compactor
-  annotations:
+    prometheus-operator/monitor: 'true'
 spec:
   type: ClusterIP
   ports:
@@ -100,8 +295,8 @@
       name: http
       nodePort: null
   selector:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: compactor
 ---
 # Source: thanos/templates/query/service-grpc.yaml
@@ -109,13 +304,12 @@
 kind: Service
 metadata:
   name: thanos-query-grpc
-  namespace: "default"
+  namespace: default
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: query
-  annotations:
 spec:
   type: ClusterIP
   ports:
@@ -125,8 +319,8 @@
       name: grpc
       nodePort: null
   selector:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: query
 ---
 # Source: thanos/templates/query/service.yaml
@@ -134,13 +328,13 @@
 kind: Service
 metadata:
   name: thanos-query
-  namespace: "default"
+  namespace: default
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: query
-  annotations:
+    prometheus-operator/monitor: 'true'
 spec:
   type: ClusterIP
   ports:
@@ -150,8 +344,8 @@
       name: http
       nodePort: null
   selector:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: query
 ---
 # Source: thanos/templates/storegateway/service.yaml
@@ -159,14 +353,13 @@
 kind: Service
 metadata:
   name: thanos-storegateway
-  namespace: "default"
+  namespace: default
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: storegateway
     prometheus-operator/monitor: 'true'
-  annotations:
 spec:
   type: ClusterIP
   ports:
@@ -181,8 +374,8 @@
       name: grpc
       nodePort: null
   selector:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: storegateway
 ---
 # Source: thanos/templates/bucketweb/deployment.yaml
@@ -190,32 +383,32 @@
 kind: Deployment
 metadata:
   name: thanos-bucketweb
-  namespace: "default"
+  namespace: default
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: bucketweb
 spec:
   replicas: 1
+  revisionHistoryLimit: 10
   strategy:
     type: RollingUpdate
   selector:
     matchLabels:
-      app.kubernetes.io/name: thanos
       app.kubernetes.io/instance: thanos
+      app.kubernetes.io/name: thanos
       app.kubernetes.io/component: bucketweb
   template:
     metadata:
       labels:
-        app.kubernetes.io/name: thanos
         app.kubernetes.io/instance: thanos
         app.kubernetes.io/managed-by: Helm
+        app.kubernetes.io/name: thanos
         app.kubernetes.io/component: bucketweb
       annotations:
-        checksum/objstore-configuration: 01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b
     spec:
-      serviceAccount: thanos-bucketweb
+      serviceAccountName: thanos-bucketweb
       automountServiceAccountToken: true
       affinity:
         podAffinity:
@@ -224,25 +417,34 @@
             - podAffinityTerm:
                 labelSelector:
                   matchLabels:
-                    app.kubernetes.io/name: thanos
                     app.kubernetes.io/instance: thanos
+                    app.kubernetes.io/name: thanos
                     app.kubernetes.io/component: bucketweb
-                namespaces:
-                  - "default"
                 topologyKey: kubernetes.io/hostname
               weight: 1
         nodeAffinity:
       securityContext:
         fsGroup: 1001
+        fsGroupChangePolicy: Always
+        supplementalGroups: []
+        sysctls: []
       containers:
         - name: bucketweb
-          image: public.ecr.aws/bitnami/thanos:0.28.1-scratch-r0
+          image: public.ecr.aws/bitnami/thanos:0.34.1-debian-12-r3
           imagePullPolicy: "IfNotPresent"
           securityContext:
             allowPrivilegeEscalation: false
+            capabilities:
+              drop:
+                - ALL
+            privileged: false
             readOnlyRootFilesystem: true
+            runAsGroup: 1001
             runAsNonRoot: true
             runAsUser: 1001
+            seLinuxOptions: {}
+            seccompProfile:
+              type: RuntimeDefault
           args:
             - tools
             - bucket
@@ -297,32 +499,32 @@
 kind: Deployment
 metadata:
   name: thanos-compactor
-  namespace: "default"
+  namespace: default
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: compactor
 spec:
   replicas: 1
+  revisionHistoryLimit: 10
   strategy:
     type: Recreate
   selector:
     matchLabels:
-      app.kubernetes.io/name: thanos
       app.kubernetes.io/instance: thanos
+      app.kubernetes.io/name: thanos
       app.kubernetes.io/component: compactor
   template:
     metadata:
       labels:
-        app.kubernetes.io/name: thanos
         app.kubernetes.io/instance: thanos
         app.kubernetes.io/managed-by: Helm
+        app.kubernetes.io/name: thanos
         app.kubernetes.io/component: compactor
       annotations:
-        checksum/objstore-configuration: 01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b
     spec:
-      serviceAccount: thanos-compactor
+      serviceAccountName: thanos-compactor
       automountServiceAccountToken: true
       affinity:
         podAffinity:
@@ -331,25 +533,34 @@
             - podAffinityTerm:
                 labelSelector:
                   matchLabels:
-                    app.kubernetes.io/name: thanos
                     app.kubernetes.io/instance: thanos
+                    app.kubernetes.io/name: thanos
                     app.kubernetes.io/component: compactor
-                namespaces:
-                  - "default"
                 topologyKey: kubernetes.io/hostname
               weight: 1
         nodeAffinity:
       securityContext:
         fsGroup: 1001
+        fsGroupChangePolicy: Always
+        supplementalGroups: []
+        sysctls: []
       containers:
         - name: compactor
-          image: public.ecr.aws/bitnami/thanos:0.28.1-scratch-r0
+          image: public.ecr.aws/bitnami/thanos:0.34.1-debian-12-r3
           imagePullPolicy: "IfNotPresent"
           securityContext:
             allowPrivilegeEscalation: false
+            capabilities:
+              drop:
+                - ALL
+            privileged: false
             readOnlyRootFilesystem: true
+            runAsGroup: 1001
             runAsNonRoot: true
             runAsUser: 1001
+            seLinuxOptions: {}
+            seccompProfile:
+              type: RuntimeDefault
           args:
             - compact
             - --log.level=info
@@ -410,30 +621,31 @@
 kind: Deployment
 metadata:
   name: thanos-query
-  namespace: "default"
+  namespace: default
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: query
 spec:
   replicas: 1
+  revisionHistoryLimit: 10
   strategy:
     type: RollingUpdate
   selector:
     matchLabels:
-      app.kubernetes.io/name: thanos
       app.kubernetes.io/instance: thanos
+      app.kubernetes.io/name: thanos
       app.kubernetes.io/component: query
   template:
     metadata:
       labels:
-        app.kubernetes.io/name: thanos
         app.kubernetes.io/instance: thanos
         app.kubernetes.io/managed-by: Helm
+        app.kubernetes.io/name: thanos
         app.kubernetes.io/component: query
     spec:
-      serviceAccount: thanos-query
+      serviceAccountName: thanos-query
       automountServiceAccountToken: true
       affinity:
         podAffinity:
@@ -442,25 +654,34 @@
             - podAffinityTerm:
                 labelSelector:
                   matchLabels:
-                    app.kubernetes.io/name: thanos
                     app.kubernetes.io/instance: thanos
+                    app.kubernetes.io/name: thanos
                     app.kubernetes.io/component: query
-                namespaces:
-                  - "default"
                 topologyKey: kubernetes.io/hostname
               weight: 1
         nodeAffinity:
       securityContext:
         fsGroup: 1001
+        fsGroupChangePolicy: Always
+        supplementalGroups: []
+        sysctls: []
       containers:
         - name: query
-          image: public.ecr.aws/bitnami/thanos:0.28.1-scratch-r0
+          image: public.ecr.aws/bitnami/thanos:0.34.1-debian-12-r3
           imagePullPolicy: "IfNotPresent"
           securityContext:
             allowPrivilegeEscalation: false
+            capabilities:
+              drop:
+                - ALL
+            privileged: false
             readOnlyRootFilesystem: true
+            runAsGroup: 1001
             runAsNonRoot: true
             runAsUser: 1001
+            seLinuxOptions: {}
+            seccompProfile:
+              type: RuntimeDefault
           args:
             - query
             - --log.level=info
@@ -470,6 +691,7 @@
             - --query.replica-label=replica
             - --endpoint=dnssrv+_grpc._tcp.prometheus-thanos-discovery.monitoring.svc.cluster.local
             - --endpoint=dnssrv+_grpc._tcp.thanos-storegateway.default.svc.cluster.local
+            - --alert.query-url=http://thanos-query.default.svc.cluster.local:9090
           ports:
             - name: http
               containerPort: 10902
@@ -498,8 +720,14 @@
               port: http
               scheme: HTTP
           resources:
-            limits: {}
-            requests: {}
+            limits:
+              cpu: 150m
+              ephemeral-storage: 1024Mi
+              memory: 192Mi
+            requests:
+              cpu: 100m
+              ephemeral-storage: 50Mi
+              memory: 128Mi
           volumeMounts:
       volumes:
 ---
@@ -508,34 +736,34 @@
 kind: StatefulSet
 metadata:
   name: thanos-storegateway
-  namespace: "default"
+  namespace: default
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: storegateway
 spec:
   replicas: 1
+  revisionHistoryLimit: 10
   podManagementPolicy: OrderedReady
   serviceName: thanos-storegateway-headless
   updateStrategy:
     type: RollingUpdate
   selector:
     matchLabels:
-      app.kubernetes.io/name: thanos
       app.kubernetes.io/instance: thanos
+      app.kubernetes.io/name: thanos
       app.kubernetes.io/component: storegateway
   template:
     metadata:
       labels:
-        app.kubernetes.io/name: thanos
         app.kubernetes.io/instance: thanos
         app.kubernetes.io/managed-by: Helm
+        app.kubernetes.io/name: thanos
         app.kubernetes.io/component: storegateway
       annotations:
-        checksum/objstore-configuration: 01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b
     spec:
-      serviceAccount: thanos-storegateway
+      serviceAccountName: thanos-storegateway
       automountServiceAccountToken: true
       affinity:
         podAffinity:
@@ -544,25 +772,34 @@
             - podAffinityTerm:
                 labelSelector:
                   matchLabels:
-                    app.kubernetes.io/name: thanos
                     app.kubernetes.io/instance: thanos
+                    app.kubernetes.io/name: thanos
                     app.kubernetes.io/component: storegateway
-                namespaces:
-                  - "default"
                 topologyKey: kubernetes.io/hostname
               weight: 1
         nodeAffinity:
       securityContext:
         fsGroup: 1001
+        fsGroupChangePolicy: Always
+        supplementalGroups: []
+        sysctls: []
       containers:
         - name: storegateway
-          image: public.ecr.aws/bitnami/thanos:0.28.1-scratch-r0
+          image: public.ecr.aws/bitnami/thanos:0.34.1-debian-12-r3
           imagePullPolicy: "IfNotPresent"
           securityContext:
             allowPrivilegeEscalation: false
+            capabilities:
+              drop:
+                - ALL
+            privileged: false
             readOnlyRootFilesystem: true
+            runAsGroup: 1001
             runAsNonRoot: true
             runAsUser: 1001
+            seLinuxOptions: {}
+            seccompProfile:
+              type: RuntimeDefault
           args:
             - store
             - --log.level=info
@@ -599,8 +836,14 @@
               port: http
               scheme: HTTP
           resources:
-            limits: {}
-            requests: {}
+            limits:
+              cpu: 150m
+              ephemeral-storage: 1024Mi
+              memory: 192Mi
+            requests:
+              cpu: 100m
+              ephemeral-storage: 50Mi
+              memory: 128Mi
           volumeMounts:
             - name: objstore-config
               mountPath: /conf
@@ -625,11 +868,11 @@
 kind: Ingress
 metadata:
   name: thanos-query
-  namespace: "default"
+  namespace: default
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: query
   annotations:
     app: thanos
@@ -655,9 +898,9 @@
   name: thanos-bucketweb
   namespace: "default"
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: bucketweb
 spec:
   endpoints:
@@ -667,9 +910,10 @@
       - "default"
   selector:
     matchLabels:
-      app.kubernetes.io/name: thanos
       app.kubernetes.io/instance: thanos
+      app.kubernetes.io/name: thanos
       app.kubernetes.io/component: bucketweb
+      prometheus-operator/monitor: 'true'
 ---
 # Source: thanos/templates/compactor/servicemonitor.yaml
 apiVersion: monitoring.coreos.com/v1
@@ -678,9 +922,9 @@
   name: thanos-compactor
   namespace: "default"
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: compactor
 spec:
   endpoints:
@@ -690,9 +934,10 @@
       - "default"
   selector:
     matchLabels:
-      app.kubernetes.io/name: thanos
       app.kubernetes.io/instance: thanos
+      app.kubernetes.io/name: thanos
       app.kubernetes.io/component: compactor
+      prometheus-operator/monitor: 'true'
 ---
 # Source: thanos/templates/query/servicemonitor.yaml
 apiVersion: monitoring.coreos.com/v1
@@ -701,9 +946,9 @@
   name: thanos-query
   namespace: "default"
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: query
 spec:
   endpoints:
@@ -713,9 +958,10 @@
       - "default"
   selector:
     matchLabels:
-      app.kubernetes.io/name: thanos
       app.kubernetes.io/instance: thanos
+      app.kubernetes.io/name: thanos
       app.kubernetes.io/component: query
+      prometheus-operator/monitor: 'true'
 ---
 # Source: thanos/templates/storegateway/servicemonitor.yaml
 apiVersion: monitoring.coreos.com/v1
@@ -724,9 +970,9 @@
   name: thanos-storegateway
   namespace: "default"
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: storegateway
 spec:
   endpoints:
@@ -736,6 +982,7 @@
       - "default"
   selector:
     matchLabels:
-      app.kubernetes.io/name: thanos
       app.kubernetes.io/instance: thanos
+      app.kubernetes.io/name: thanos
       app.kubernetes.io/component: storegateway
+      prometheus-operator/monitor: 'true'

@renovate renovate bot force-pushed the renovate/thanos-15.x branch from 49416a1 to 7fc0e05 Compare April 23, 2024 17:16
@renovate renovate bot changed the title feat(charts)!: Update Helm release thanos to 15.1.3 feat(charts)!: Update Helm release thanos to 15.2.1 Apr 23, 2024
@github-actions GitHub Actions
Copy link

Path: cluster/core/monitoring/thanos/helm-release.yaml
Version: 11.5.5 -> 15.2.1

@@ -1,71 +1,266 @@
+# Source: thanos/templates/bucketweb/networkpolicy.yaml
+kind: NetworkPolicy
+apiVersion: networking.k8s.io/v1
+metadata:
+  name: thanos-bucketweb
+  namespace: "default"
+  labels:
+    app.kubernetes.io/instance: thanos
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
+    app.kubernetes.io/component: bucketweb
+spec:
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/instance: thanos
+      app.kubernetes.io/name: thanos
+      app.kubernetes.io/component: bucketweb
+  policyTypes:
+    - Ingress
+    - Egress
+  egress:
+    - {}
+  ingress:
+    - ports:
+        - port: 8080
+        - port: 8080
+---
+# Source: thanos/templates/compactor/networkpolicy.yaml
+kind: NetworkPolicy
+apiVersion: networking.k8s.io/v1
+metadata:
+  name: thanos-compactor
+  namespace: "default"
+  labels:
+    app.kubernetes.io/instance: thanos
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
+    app.kubernetes.io/component: compactor
+spec:
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/instance: thanos
+      app.kubernetes.io/name: thanos
+      app.kubernetes.io/component: compactor
+  policyTypes:
+    - Ingress
+    - Egress
+  egress:
+    - {}
+  ingress:
+    - ports:
+        - port: 10902
+        - port: 9090
+---
+# Source: thanos/templates/query-frontend/networkpolicy.yaml
+kind: NetworkPolicy
+apiVersion: networking.k8s.io/v1
+metadata:
+  name: thanos-query-frontend
+  namespace: "default"
+  labels:
+    app.kubernetes.io/instance: thanos
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
+    app.kubernetes.io/component: query-frontend
+spec:
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/instance: thanos
+      app.kubernetes.io/name: thanos
+      app.kubernetes.io/component: query-frontend
+  policyTypes:
+    - Ingress
+    - Egress
+  egress:
+    - {}
+  ingress:
+    - ports:
+        - port: 9090
+        - port: 9090
+---
+# Source: thanos/templates/query/networkpolicy.yaml
+kind: NetworkPolicy
+apiVersion: networking.k8s.io/v1
+metadata:
+  name: thanos-query
+  namespace: "default"
+  labels:
+    app.kubernetes.io/instance: thanos
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
+    app.kubernetes.io/component: query
+spec:
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/instance: thanos
+      app.kubernetes.io/name: thanos
+      app.kubernetes.io/component: query
+  policyTypes:
+    - Ingress
+    - Egress
+  egress:
+    - {}
+  ingress:
+    - ports:
+        - port: 10902
+        - port: 10901
+        - port: 9090
+        - port: 10901
+---
+# Source: thanos/templates/receive/networkpolicy.yaml
+kind: NetworkPolicy
+apiVersion: networking.k8s.io/v1
+metadata:
+  name: thanos-receive
+  namespace: "default"
+  labels:
+    app.kubernetes.io/instance: thanos
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
+    app.kubernetes.io/component: receive
+spec:
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/instance: thanos
+      app.kubernetes.io/name: thanos
+      app.kubernetes.io/component: receive
+  policyTypes:
+    - Ingress
+    - Egress
+  egress:
+    - {}
+  ingress:
+    - ports:
+        - port: 10902
+        - port: 10902
+        - port: 10901
+        - port: 10901
+        - port: 19291
+        - port: 19291
+---
+# Source: thanos/templates/ruler/networkpolicy.yaml
+kind: NetworkPolicy
+apiVersion: networking.k8s.io/v1
+metadata:
+  name: thanos-ruler
+  namespace: "default"
+  labels:
+    app.kubernetes.io/instance: thanos
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
+    app.kubernetes.io/component: ruler
+spec:
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/instance: thanos
+      app.kubernetes.io/name: thanos
+      app.kubernetes.io/component: ruler
+  policyTypes:
+    - Ingress
+    - Egress
+  egress:
+    - {}
+  ingress:
+    - ports:
+        - port: 10902
+        - port: 9090
+        - port: 10901
+        - port: 10901
+---
+# Source: thanos/templates/storegateway/networkpolicy.yaml
+kind: NetworkPolicy
+apiVersion: networking.k8s.io/v1
+metadata:
+  name: thanos-storegateway
+  namespace: "default"
+  labels:
+    app.kubernetes.io/instance: thanos
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
+    app.kubernetes.io/component: storegateway
+spec:
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/instance: thanos
+      app.kubernetes.io/name: thanos
+      app.kubernetes.io/component: storegateway
+  policyTypes:
+    - Ingress
+    - Egress
+  egress:
+    - {}
+  ingress:
+    - ports:
+        - port: 10902
+        - port: 9090
+        - port: 10901
+        - port: 10901
+---
 # Source: thanos/templates/bucketweb/serviceaccount.yaml
 apiVersion: v1
 kind: ServiceAccount
 metadata:
   name: thanos-bucketweb
-  namespace: "default"
+  namespace: default
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: bucketweb
-  annotations:
-automountServiceAccountToken: true
+automountServiceAccountToken: false
 ---
 # Source: thanos/templates/compactor/serviceaccount.yaml
 apiVersion: v1
 kind: ServiceAccount
 metadata:
   name: thanos-compactor
-  namespace: "default"
+  namespace: default
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: compactor
-  annotations:
-automountServiceAccountToken: true
+automountServiceAccountToken: false
 ---
 # Source: thanos/templates/query/serviceaccount.yaml
 apiVersion: v1
 kind: ServiceAccount
 metadata:
   name: thanos-query
-  namespace: "default"
+  namespace: default
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: query
-  annotations:
-automountServiceAccountToken: true
+automountServiceAccountToken: false
 ---
 # Source: thanos/templates/storegateway/serviceaccount.yaml
 apiVersion: v1
 kind: ServiceAccount
 metadata:
   name: thanos-storegateway
-  namespace: "default"
+  namespace: default
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: storegateway
-  annotations:
-automountServiceAccountToken: true
+automountServiceAccountToken: false
 ---
 # Source: thanos/templates/bucketweb/service.yaml
 apiVersion: v1
 kind: Service
 metadata:
   name: thanos-bucketweb
-  namespace: "default"
+  namespace: default
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: bucketweb
-  annotations:
+    prometheus-operator/monitor: 'true'
 spec:
   type: ClusterIP
   ports:
@@ -75,8 +270,8 @@
       name: http
       nodePort: null
   selector:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: bucketweb
 ---
 # Source: thanos/templates/compactor/service.yaml
@@ -84,13 +279,13 @@
 kind: Service
 metadata:
   name: thanos-compactor
-  namespace: "default"
+  namespace: default
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: compactor
-  annotations:
+    prometheus-operator/monitor: 'true'
 spec:
   type: ClusterIP
   ports:
@@ -100,8 +295,8 @@
       name: http
       nodePort: null
   selector:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: compactor
 ---
 # Source: thanos/templates/query/service-grpc.yaml
@@ -109,13 +304,12 @@
 kind: Service
 metadata:
   name: thanos-query-grpc
-  namespace: "default"
+  namespace: default
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: query
-  annotations:
 spec:
   type: ClusterIP
   ports:
@@ -125,8 +319,8 @@
       name: grpc
       nodePort: null
   selector:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: query
 ---
 # Source: thanos/templates/query/service.yaml
@@ -134,13 +328,13 @@
 kind: Service
 metadata:
   name: thanos-query
-  namespace: "default"
+  namespace: default
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: query
-  annotations:
+    prometheus-operator/monitor: 'true'
 spec:
   type: ClusterIP
   ports:
@@ -150,8 +344,8 @@
       name: http
       nodePort: null
   selector:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: query
 ---
 # Source: thanos/templates/storegateway/service.yaml
@@ -159,14 +353,13 @@
 kind: Service
 metadata:
   name: thanos-storegateway
-  namespace: "default"
+  namespace: default
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: storegateway
     prometheus-operator/monitor: 'true'
-  annotations:
 spec:
   type: ClusterIP
   ports:
@@ -181,8 +374,8 @@
       name: grpc
       nodePort: null
   selector:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: storegateway
 ---
 # Source: thanos/templates/bucketweb/deployment.yaml
@@ -190,32 +383,32 @@
 kind: Deployment
 metadata:
   name: thanos-bucketweb
-  namespace: "default"
+  namespace: default
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: bucketweb
 spec:
   replicas: 1
+  revisionHistoryLimit: 10
   strategy:
     type: RollingUpdate
   selector:
     matchLabels:
-      app.kubernetes.io/name: thanos
       app.kubernetes.io/instance: thanos
+      app.kubernetes.io/name: thanos
       app.kubernetes.io/component: bucketweb
   template:
     metadata:
       labels:
-        app.kubernetes.io/name: thanos
         app.kubernetes.io/instance: thanos
         app.kubernetes.io/managed-by: Helm
+        app.kubernetes.io/name: thanos
         app.kubernetes.io/component: bucketweb
       annotations:
-        checksum/objstore-configuration: 01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b
     spec:
-      serviceAccount: thanos-bucketweb
+      serviceAccountName: thanos-bucketweb
       automountServiceAccountToken: true
       affinity:
         podAffinity:
@@ -224,25 +417,34 @@
             - podAffinityTerm:
                 labelSelector:
                   matchLabels:
-                    app.kubernetes.io/name: thanos
                     app.kubernetes.io/instance: thanos
+                    app.kubernetes.io/name: thanos
                     app.kubernetes.io/component: bucketweb
-                namespaces:
-                  - "default"
                 topologyKey: kubernetes.io/hostname
               weight: 1
         nodeAffinity:
       securityContext:
         fsGroup: 1001
+        fsGroupChangePolicy: Always
+        supplementalGroups: []
+        sysctls: []
       containers:
         - name: bucketweb
-          image: public.ecr.aws/bitnami/thanos:0.28.1-scratch-r0
+          image: public.ecr.aws/bitnami/thanos:0.34.1-debian-12-r3
           imagePullPolicy: "IfNotPresent"
           securityContext:
             allowPrivilegeEscalation: false
+            capabilities:
+              drop:
+                - ALL
+            privileged: false
             readOnlyRootFilesystem: true
+            runAsGroup: 1001
             runAsNonRoot: true
             runAsUser: 1001
+            seLinuxOptions: {}
+            seccompProfile:
+              type: RuntimeDefault
           args:
             - tools
             - bucket
@@ -297,32 +499,32 @@
 kind: Deployment
 metadata:
   name: thanos-compactor
-  namespace: "default"
+  namespace: default
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: compactor
 spec:
   replicas: 1
+  revisionHistoryLimit: 10
   strategy:
     type: Recreate
   selector:
     matchLabels:
-      app.kubernetes.io/name: thanos
       app.kubernetes.io/instance: thanos
+      app.kubernetes.io/name: thanos
       app.kubernetes.io/component: compactor
   template:
     metadata:
       labels:
-        app.kubernetes.io/name: thanos
         app.kubernetes.io/instance: thanos
         app.kubernetes.io/managed-by: Helm
+        app.kubernetes.io/name: thanos
         app.kubernetes.io/component: compactor
       annotations:
-        checksum/objstore-configuration: 01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b
     spec:
-      serviceAccount: thanos-compactor
+      serviceAccountName: thanos-compactor
       automountServiceAccountToken: true
       affinity:
         podAffinity:
@@ -331,25 +533,34 @@
             - podAffinityTerm:
                 labelSelector:
                   matchLabels:
-                    app.kubernetes.io/name: thanos
                     app.kubernetes.io/instance: thanos
+                    app.kubernetes.io/name: thanos
                     app.kubernetes.io/component: compactor
-                namespaces:
-                  - "default"
                 topologyKey: kubernetes.io/hostname
               weight: 1
         nodeAffinity:
       securityContext:
         fsGroup: 1001
+        fsGroupChangePolicy: Always
+        supplementalGroups: []
+        sysctls: []
       containers:
         - name: compactor
-          image: public.ecr.aws/bitnami/thanos:0.28.1-scratch-r0
+          image: public.ecr.aws/bitnami/thanos:0.34.1-debian-12-r3
           imagePullPolicy: "IfNotPresent"
           securityContext:
             allowPrivilegeEscalation: false
+            capabilities:
+              drop:
+                - ALL
+            privileged: false
             readOnlyRootFilesystem: true
+            runAsGroup: 1001
             runAsNonRoot: true
             runAsUser: 1001
+            seLinuxOptions: {}
+            seccompProfile:
+              type: RuntimeDefault
           args:
             - compact
             - --log.level=info
@@ -410,30 +621,31 @@
 kind: Deployment
 metadata:
   name: thanos-query
-  namespace: "default"
+  namespace: default
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: query
 spec:
   replicas: 1
+  revisionHistoryLimit: 10
   strategy:
     type: RollingUpdate
   selector:
     matchLabels:
-      app.kubernetes.io/name: thanos
       app.kubernetes.io/instance: thanos
+      app.kubernetes.io/name: thanos
       app.kubernetes.io/component: query
   template:
     metadata:
       labels:
-        app.kubernetes.io/name: thanos
         app.kubernetes.io/instance: thanos
         app.kubernetes.io/managed-by: Helm
+        app.kubernetes.io/name: thanos
         app.kubernetes.io/component: query
     spec:
-      serviceAccount: thanos-query
+      serviceAccountName: thanos-query
       automountServiceAccountToken: true
       affinity:
         podAffinity:
@@ -442,25 +654,34 @@
             - podAffinityTerm:
                 labelSelector:
                   matchLabels:
-                    app.kubernetes.io/name: thanos
                     app.kubernetes.io/instance: thanos
+                    app.kubernetes.io/name: thanos
                     app.kubernetes.io/component: query
-                namespaces:
-                  - "default"
                 topologyKey: kubernetes.io/hostname
               weight: 1
         nodeAffinity:
       securityContext:
         fsGroup: 1001
+        fsGroupChangePolicy: Always
+        supplementalGroups: []
+        sysctls: []
       containers:
         - name: query
-          image: public.ecr.aws/bitnami/thanos:0.28.1-scratch-r0
+          image: public.ecr.aws/bitnami/thanos:0.34.1-debian-12-r3
           imagePullPolicy: "IfNotPresent"
           securityContext:
             allowPrivilegeEscalation: false
+            capabilities:
+              drop:
+                - ALL
+            privileged: false
             readOnlyRootFilesystem: true
+            runAsGroup: 1001
             runAsNonRoot: true
             runAsUser: 1001
+            seLinuxOptions: {}
+            seccompProfile:
+              type: RuntimeDefault
           args:
             - query
             - --log.level=info
@@ -470,6 +691,7 @@
             - --query.replica-label=replica
             - --endpoint=dnssrv+_grpc._tcp.prometheus-thanos-discovery.monitoring.svc.cluster.local
             - --endpoint=dnssrv+_grpc._tcp.thanos-storegateway.default.svc.cluster.local
+            - --alert.query-url=http://thanos-query.default.svc.cluster.local:9090
           ports:
             - name: http
               containerPort: 10902
@@ -498,8 +720,14 @@
               port: http
               scheme: HTTP
           resources:
-            limits: {}
-            requests: {}
+            limits:
+              cpu: 150m
+              ephemeral-storage: 1024Mi
+              memory: 192Mi
+            requests:
+              cpu: 100m
+              ephemeral-storage: 50Mi
+              memory: 128Mi
           volumeMounts:
       volumes:
 ---
@@ -508,34 +736,34 @@
 kind: StatefulSet
 metadata:
   name: thanos-storegateway
-  namespace: "default"
+  namespace: default
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: storegateway
 spec:
   replicas: 1
+  revisionHistoryLimit: 10
   podManagementPolicy: OrderedReady
   serviceName: thanos-storegateway-headless
   updateStrategy:
     type: RollingUpdate
   selector:
     matchLabels:
-      app.kubernetes.io/name: thanos
       app.kubernetes.io/instance: thanos
+      app.kubernetes.io/name: thanos
       app.kubernetes.io/component: storegateway
   template:
     metadata:
       labels:
-        app.kubernetes.io/name: thanos
         app.kubernetes.io/instance: thanos
         app.kubernetes.io/managed-by: Helm
+        app.kubernetes.io/name: thanos
         app.kubernetes.io/component: storegateway
       annotations:
-        checksum/objstore-configuration: 01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b
     spec:
-      serviceAccount: thanos-storegateway
+      serviceAccountName: thanos-storegateway
       automountServiceAccountToken: true
       affinity:
         podAffinity:
@@ -544,25 +772,34 @@
             - podAffinityTerm:
                 labelSelector:
                   matchLabels:
-                    app.kubernetes.io/name: thanos
                     app.kubernetes.io/instance: thanos
+                    app.kubernetes.io/name: thanos
                     app.kubernetes.io/component: storegateway
-                namespaces:
-                  - "default"
                 topologyKey: kubernetes.io/hostname
               weight: 1
         nodeAffinity:
       securityContext:
         fsGroup: 1001
+        fsGroupChangePolicy: Always
+        supplementalGroups: []
+        sysctls: []
       containers:
         - name: storegateway
-          image: public.ecr.aws/bitnami/thanos:0.28.1-scratch-r0
+          image: public.ecr.aws/bitnami/thanos:0.34.1-debian-12-r3
           imagePullPolicy: "IfNotPresent"
           securityContext:
             allowPrivilegeEscalation: false
+            capabilities:
+              drop:
+                - ALL
+            privileged: false
             readOnlyRootFilesystem: true
+            runAsGroup: 1001
             runAsNonRoot: true
             runAsUser: 1001
+            seLinuxOptions: {}
+            seccompProfile:
+              type: RuntimeDefault
           args:
             - store
             - --log.level=info
@@ -599,8 +836,14 @@
               port: http
               scheme: HTTP
           resources:
-            limits: {}
-            requests: {}
+            limits:
+              cpu: 150m
+              ephemeral-storage: 1024Mi
+              memory: 192Mi
+            requests:
+              cpu: 100m
+              ephemeral-storage: 50Mi
+              memory: 128Mi
           volumeMounts:
             - name: objstore-config
               mountPath: /conf
@@ -625,11 +868,11 @@
 kind: Ingress
 metadata:
   name: thanos-query
-  namespace: "default"
+  namespace: default
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: query
   annotations:
     app: thanos
@@ -655,9 +898,9 @@
   name: thanos-bucketweb
   namespace: "default"
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: bucketweb
 spec:
   endpoints:
@@ -667,9 +910,10 @@
       - "default"
   selector:
     matchLabels:
-      app.kubernetes.io/name: thanos
       app.kubernetes.io/instance: thanos
+      app.kubernetes.io/name: thanos
       app.kubernetes.io/component: bucketweb
+      prometheus-operator/monitor: 'true'
 ---
 # Source: thanos/templates/compactor/servicemonitor.yaml
 apiVersion: monitoring.coreos.com/v1
@@ -678,9 +922,9 @@
   name: thanos-compactor
   namespace: "default"
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: compactor
 spec:
   endpoints:
@@ -690,9 +934,10 @@
       - "default"
   selector:
     matchLabels:
-      app.kubernetes.io/name: thanos
       app.kubernetes.io/instance: thanos
+      app.kubernetes.io/name: thanos
       app.kubernetes.io/component: compactor
+      prometheus-operator/monitor: 'true'
 ---
 # Source: thanos/templates/query/servicemonitor.yaml
 apiVersion: monitoring.coreos.com/v1
@@ -701,9 +946,9 @@
   name: thanos-query
   namespace: "default"
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: query
 spec:
   endpoints:
@@ -713,9 +958,10 @@
       - "default"
   selector:
     matchLabels:
-      app.kubernetes.io/name: thanos
       app.kubernetes.io/instance: thanos
+      app.kubernetes.io/name: thanos
       app.kubernetes.io/component: query
+      prometheus-operator/monitor: 'true'
 ---
 # Source: thanos/templates/storegateway/servicemonitor.yaml
 apiVersion: monitoring.coreos.com/v1
@@ -724,9 +970,9 @@
   name: thanos-storegateway
   namespace: "default"
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: storegateway
 spec:
   endpoints:
@@ -736,6 +982,7 @@
       - "default"
   selector:
     matchLabels:
-      app.kubernetes.io/name: thanos
       app.kubernetes.io/instance: thanos
+      app.kubernetes.io/name: thanos
       app.kubernetes.io/component: storegateway
+      prometheus-operator/monitor: 'true'

@renovate renovate bot changed the title feat(charts)!: Update Helm release thanos to 15.7.27 feat(charts)!: Update Helm release thanos to 15.7.28 Oct 8, 2024
@github-actions GitHub Actions
Copy link

github-actions bot commented Oct 8, 2024

Path: cluster/core/monitoring/thanos/helm-release.yaml
Version: 11.5.5 -> 15.7.28

@@ -1,71 +1,236 @@
+# Source: thanos/templates/bucketweb/networkpolicy.yaml
+kind: NetworkPolicy
+apiVersion: networking.k8s.io/v1
+metadata:
+  name: thanos-bucketweb
+  namespace: "default"
+  labels:
+    app.kubernetes.io/instance: thanos
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
+    app.kubernetes.io/component: bucketweb
+spec:
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/instance: thanos
+      app.kubernetes.io/name: thanos
+      app.kubernetes.io/component: bucketweb
+  policyTypes:
+    - Ingress
+    - Egress
+  egress:
+    - {}
+  ingress:
+    - ports:
+        - port: 8080
+        - port: 8080
+---
+# Source: thanos/templates/compactor/networkpolicy.yaml
+kind: NetworkPolicy
+apiVersion: networking.k8s.io/v1
+metadata:
+  name: thanos-compactor
+  namespace: "default"
+  labels:
+    app.kubernetes.io/instance: thanos
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
+    app.kubernetes.io/component: compactor
+spec:
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/instance: thanos
+      app.kubernetes.io/name: thanos
+      app.kubernetes.io/component: compactor
+  policyTypes:
+    - Ingress
+    - Egress
+  egress:
+    - {}
+  ingress:
+    - ports:
+        - port: 10902
+        - port: 9090
+---
+# Source: thanos/templates/query/networkpolicy.yaml
+kind: NetworkPolicy
+apiVersion: networking.k8s.io/v1
+metadata:
+  name: thanos-query
+  namespace: "default"
+  labels:
+    app.kubernetes.io/instance: thanos
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
+    app.kubernetes.io/component: query
+spec:
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/instance: thanos
+      app.kubernetes.io/name: thanos
+      app.kubernetes.io/component: query
+  policyTypes:
+    - Ingress
+    - Egress
+  egress:
+    - {}
+  ingress:
+    - ports:
+        - port: 10902
+        - port: 10901
+        - port: 9090
+        - port: 10901
+---
+# Source: thanos/templates/storegateway/networkpolicy.yaml
+kind: NetworkPolicy
+apiVersion: networking.k8s.io/v1
+metadata:
+  name: thanos-storegateway
+  namespace: "default"
+  labels:
+    app.kubernetes.io/instance: thanos
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
+    app.kubernetes.io/component: storegateway
+spec:
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/instance: thanos
+      app.kubernetes.io/name: thanos
+      app.kubernetes.io/component: storegateway
+  policyTypes:
+    - Ingress
+    - Egress
+  egress:
+    - {}
+  ingress:
+    - ports:
+        - port: 10902
+        - port: 9090
+        - port: 10901
+        - port: 10901
+---
+# Source: thanos/templates/bucketweb/pdb.yaml
+apiVersion: policy/v1
+kind: PodDisruptionBudget
+metadata:
+  name: thanos-bucketweb
+  namespace: default
+  labels:
+    app.kubernetes.io/instance: thanos
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
+    app.kubernetes.io/component: bucketweb
+spec:
+  maxUnavailable: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/instance: thanos
+      app.kubernetes.io/name: thanos
+      app.kubernetes.io/component: bucketweb
+---
+# Source: thanos/templates/query/pdb.yaml
+apiVersion: policy/v1
+kind: PodDisruptionBudget
+metadata:
+  name: thanos-query
+  namespace: default
+  labels:
+    app.kubernetes.io/instance: thanos
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
+    app.kubernetes.io/component: query
+spec:
+  maxUnavailable: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/instance: thanos
+      app.kubernetes.io/name: thanos
+      app.kubernetes.io/component: query
+---
+# Source: thanos/templates/storegateway/pdb.yaml
+apiVersion: policy/v1
+kind: PodDisruptionBudget
+metadata:
+  name: thanos-storegateway
+  namespace: default
+  labels:
+    app.kubernetes.io/instance: thanos
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
+    app.kubernetes.io/component: storegateway
+spec:
+  maxUnavailable: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/instance: thanos
+      app.kubernetes.io/name: thanos
+      app.kubernetes.io/component: storegateway
+---
 # Source: thanos/templates/bucketweb/serviceaccount.yaml
 apiVersion: v1
 kind: ServiceAccount
 metadata:
   name: thanos-bucketweb
-  namespace: "default"
+  namespace: default
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: bucketweb
-  annotations:
-automountServiceAccountToken: true
+automountServiceAccountToken: false
 ---
 # Source: thanos/templates/compactor/serviceaccount.yaml
 apiVersion: v1
 kind: ServiceAccount
 metadata:
   name: thanos-compactor
-  namespace: "default"
+  namespace: default
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: compactor
-  annotations:
-automountServiceAccountToken: true
+automountServiceAccountToken: false
 ---
 # Source: thanos/templates/query/serviceaccount.yaml
 apiVersion: v1
 kind: ServiceAccount
 metadata:
   name: thanos-query
-  namespace: "default"
+  namespace: default
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: query
-  annotations:
-automountServiceAccountToken: true
+automountServiceAccountToken: false
 ---
 # Source: thanos/templates/storegateway/serviceaccount.yaml
 apiVersion: v1
 kind: ServiceAccount
 metadata:
   name: thanos-storegateway
-  namespace: "default"
+  namespace: default
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: storegateway
-  annotations:
-automountServiceAccountToken: true
+automountServiceAccountToken: false
 ---
 # Source: thanos/templates/bucketweb/service.yaml
 apiVersion: v1
 kind: Service
 metadata:
   name: thanos-bucketweb
-  namespace: "default"
+  namespace: default
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: bucketweb
-  annotations:
+    prometheus-operator/monitor: 'true'
 spec:
   type: ClusterIP
   ports:
@@ -75,8 +240,8 @@
       name: http
       nodePort: null
   selector:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: bucketweb
 ---
 # Source: thanos/templates/compactor/service.yaml
@@ -84,13 +249,13 @@
 kind: Service
 metadata:
   name: thanos-compactor
-  namespace: "default"
+  namespace: default
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: compactor
-  annotations:
+    prometheus-operator/monitor: 'true'
 spec:
   type: ClusterIP
   ports:
@@ -100,8 +265,8 @@
       name: http
       nodePort: null
   selector:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: compactor
 ---
 # Source: thanos/templates/query/service-grpc.yaml
@@ -109,13 +274,12 @@
 kind: Service
 metadata:
   name: thanos-query-grpc
-  namespace: "default"
+  namespace: default
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: query
-  annotations:
 spec:
   type: ClusterIP
   ports:
@@ -125,8 +289,8 @@
       name: grpc
       nodePort: null
   selector:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: query
 ---
 # Source: thanos/templates/query/service.yaml
@@ -134,13 +298,13 @@
 kind: Service
 metadata:
   name: thanos-query
-  namespace: "default"
+  namespace: default
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: query
-  annotations:
+    prometheus-operator/monitor: 'true'
 spec:
   type: ClusterIP
   ports:
@@ -150,8 +314,8 @@
       name: http
       nodePort: null
   selector:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: query
 ---
 # Source: thanos/templates/storegateway/service.yaml
@@ -159,14 +323,13 @@
 kind: Service
 metadata:
   name: thanos-storegateway
-  namespace: "default"
+  namespace: default
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: storegateway
     prometheus-operator/monitor: 'true'
-  annotations:
 spec:
   type: ClusterIP
   ports:
@@ -181,8 +344,8 @@
       name: grpc
       nodePort: null
   selector:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: storegateway
 ---
 # Source: thanos/templates/bucketweb/deployment.yaml
@@ -190,32 +353,31 @@
 kind: Deployment
 metadata:
   name: thanos-bucketweb
-  namespace: "default"
+  namespace: default
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: bucketweb
 spec:
   replicas: 1
+  revisionHistoryLimit: 10
   strategy:
     type: RollingUpdate
   selector:
     matchLabels:
-      app.kubernetes.io/name: thanos
       app.kubernetes.io/instance: thanos
+      app.kubernetes.io/name: thanos
       app.kubernetes.io/component: bucketweb
   template:
     metadata:
       labels:
-        app.kubernetes.io/name: thanos
         app.kubernetes.io/instance: thanos
         app.kubernetes.io/managed-by: Helm
+        app.kubernetes.io/name: thanos
         app.kubernetes.io/component: bucketweb
-      annotations:
-        checksum/objstore-configuration: 01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b
     spec:
-      serviceAccount: thanos-bucketweb
+      serviceAccountName: thanos-bucketweb
       automountServiceAccountToken: true
       affinity:
         podAffinity:
@@ -224,25 +386,34 @@
             - podAffinityTerm:
                 labelSelector:
                   matchLabels:
-                    app.kubernetes.io/name: thanos
                     app.kubernetes.io/instance: thanos
+                    app.kubernetes.io/name: thanos
                     app.kubernetes.io/component: bucketweb
-                namespaces:
-                  - "default"
                 topologyKey: kubernetes.io/hostname
               weight: 1
         nodeAffinity:
       securityContext:
         fsGroup: 1001
+        fsGroupChangePolicy: Always
+        supplementalGroups: []
+        sysctls: []
       containers:
         - name: bucketweb
-          image: public.ecr.aws/bitnami/thanos:0.28.1-scratch-r0
+          image: public.ecr.aws/bitnami/thanos:0.36.1-debian-12-r3
           imagePullPolicy: "IfNotPresent"
           securityContext:
             allowPrivilegeEscalation: false
+            capabilities:
+              drop:
+                - ALL
+            privileged: false
             readOnlyRootFilesystem: true
+            runAsGroup: 1001
             runAsNonRoot: true
             runAsUser: 1001
+            seLinuxOptions: {}
+            seccompProfile:
+              type: RuntimeDefault
           args:
             - tools
             - bucket
@@ -297,32 +468,31 @@
 kind: Deployment
 metadata:
   name: thanos-compactor
-  namespace: "default"
+  namespace: default
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: compactor
 spec:
   replicas: 1
+  revisionHistoryLimit: 10
   strategy:
     type: Recreate
   selector:
     matchLabels:
-      app.kubernetes.io/name: thanos
       app.kubernetes.io/instance: thanos
+      app.kubernetes.io/name: thanos
       app.kubernetes.io/component: compactor
   template:
     metadata:
       labels:
-        app.kubernetes.io/name: thanos
         app.kubernetes.io/instance: thanos
         app.kubernetes.io/managed-by: Helm
+        app.kubernetes.io/name: thanos
         app.kubernetes.io/component: compactor
-      annotations:
-        checksum/objstore-configuration: 01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b
     spec:
-      serviceAccount: thanos-compactor
+      serviceAccountName: thanos-compactor
       automountServiceAccountToken: true
       affinity:
         podAffinity:
@@ -331,25 +501,34 @@
             - podAffinityTerm:
                 labelSelector:
                   matchLabels:
-                    app.kubernetes.io/name: thanos
                     app.kubernetes.io/instance: thanos
+                    app.kubernetes.io/name: thanos
                     app.kubernetes.io/component: compactor
-                namespaces:
-                  - "default"
                 topologyKey: kubernetes.io/hostname
               weight: 1
         nodeAffinity:
       securityContext:
         fsGroup: 1001
+        fsGroupChangePolicy: Always
+        supplementalGroups: []
+        sysctls: []
       containers:
         - name: compactor
-          image: public.ecr.aws/bitnami/thanos:0.28.1-scratch-r0
+          image: public.ecr.aws/bitnami/thanos:0.36.1-debian-12-r3
           imagePullPolicy: "IfNotPresent"
           securityContext:
             allowPrivilegeEscalation: false
+            capabilities:
+              drop:
+                - ALL
+            privileged: false
             readOnlyRootFilesystem: true
+            runAsGroup: 1001
             runAsNonRoot: true
             runAsUser: 1001
+            seLinuxOptions: {}
+            seccompProfile:
+              type: RuntimeDefault
           args:
             - compact
             - --log.level=info
@@ -410,30 +589,31 @@
 kind: Deployment
 metadata:
   name: thanos-query
-  namespace: "default"
+  namespace: default
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: query
 spec:
   replicas: 1
+  revisionHistoryLimit: 10
   strategy:
     type: RollingUpdate
   selector:
     matchLabels:
-      app.kubernetes.io/name: thanos
       app.kubernetes.io/instance: thanos
+      app.kubernetes.io/name: thanos
       app.kubernetes.io/component: query
   template:
     metadata:
       labels:
-        app.kubernetes.io/name: thanos
         app.kubernetes.io/instance: thanos
         app.kubernetes.io/managed-by: Helm
+        app.kubernetes.io/name: thanos
         app.kubernetes.io/component: query
     spec:
-      serviceAccount: thanos-query
+      serviceAccountName: thanos-query
       automountServiceAccountToken: true
       affinity:
         podAffinity:
@@ -442,25 +622,34 @@
             - podAffinityTerm:
                 labelSelector:
                   matchLabels:
-                    app.kubernetes.io/name: thanos
                     app.kubernetes.io/instance: thanos
+                    app.kubernetes.io/name: thanos
                     app.kubernetes.io/component: query
-                namespaces:
-                  - "default"
                 topologyKey: kubernetes.io/hostname
               weight: 1
         nodeAffinity:
       securityContext:
         fsGroup: 1001
+        fsGroupChangePolicy: Always
+        supplementalGroups: []
+        sysctls: []
       containers:
         - name: query
-          image: public.ecr.aws/bitnami/thanos:0.28.1-scratch-r0
+          image: public.ecr.aws/bitnami/thanos:0.36.1-debian-12-r3
           imagePullPolicy: "IfNotPresent"
           securityContext:
             allowPrivilegeEscalation: false
+            capabilities:
+              drop:
+                - ALL
+            privileged: false
             readOnlyRootFilesystem: true
+            runAsGroup: 1001
             runAsNonRoot: true
             runAsUser: 1001
+            seLinuxOptions: {}
+            seccompProfile:
+              type: RuntimeDefault
           args:
             - query
             - --log.level=info
@@ -470,6 +659,7 @@
             - --query.replica-label=replica
             - --endpoint=dnssrv+_grpc._tcp.prometheus-thanos-discovery.monitoring.svc.cluster.local
             - --endpoint=dnssrv+_grpc._tcp.thanos-storegateway.default.svc.cluster.local
+            - --alert.query-url=http://thanos-query.default.svc.cluster.local:9090
           ports:
             - name: http
               containerPort: 10902
@@ -498,8 +688,14 @@
               port: http
               scheme: HTTP
           resources:
-            limits: {}
-            requests: {}
+            limits:
+              cpu: 150m
+              ephemeral-storage: 2Gi
+              memory: 192Mi
+            requests:
+              cpu: 100m
+              ephemeral-storage: 50Mi
+              memory: 128Mi
           volumeMounts:
       volumes:
 ---
@@ -508,34 +704,33 @@
 kind: StatefulSet
 metadata:
   name: thanos-storegateway
-  namespace: "default"
+  namespace: default
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: storegateway
 spec:
   replicas: 1
+  revisionHistoryLimit: 10
   podManagementPolicy: OrderedReady
   serviceName: thanos-storegateway-headless
   updateStrategy:
     type: RollingUpdate
   selector:
     matchLabels:
-      app.kubernetes.io/name: thanos
       app.kubernetes.io/instance: thanos
+      app.kubernetes.io/name: thanos
       app.kubernetes.io/component: storegateway
   template:
     metadata:
       labels:
-        app.kubernetes.io/name: thanos
         app.kubernetes.io/instance: thanos
         app.kubernetes.io/managed-by: Helm
+        app.kubernetes.io/name: thanos
         app.kubernetes.io/component: storegateway
-      annotations:
-        checksum/objstore-configuration: 01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b
     spec:
-      serviceAccount: thanos-storegateway
+      serviceAccountName: thanos-storegateway
       automountServiceAccountToken: true
       affinity:
         podAffinity:
@@ -544,25 +739,34 @@
             - podAffinityTerm:
                 labelSelector:
                   matchLabels:
-                    app.kubernetes.io/name: thanos
                     app.kubernetes.io/instance: thanos
+                    app.kubernetes.io/name: thanos
                     app.kubernetes.io/component: storegateway
-                namespaces:
-                  - "default"
                 topologyKey: kubernetes.io/hostname
               weight: 1
         nodeAffinity:
       securityContext:
         fsGroup: 1001
+        fsGroupChangePolicy: Always
+        supplementalGroups: []
+        sysctls: []
       containers:
         - name: storegateway
-          image: public.ecr.aws/bitnami/thanos:0.28.1-scratch-r0
+          image: public.ecr.aws/bitnami/thanos:0.36.1-debian-12-r3
           imagePullPolicy: "IfNotPresent"
           securityContext:
             allowPrivilegeEscalation: false
+            capabilities:
+              drop:
+                - ALL
+            privileged: false
             readOnlyRootFilesystem: true
+            runAsGroup: 1001
             runAsNonRoot: true
             runAsUser: 1001
+            seLinuxOptions: {}
+            seccompProfile:
+              type: RuntimeDefault
           args:
             - store
             - --log.level=info
@@ -599,8 +803,14 @@
               port: http
               scheme: HTTP
           resources:
-            limits: {}
-            requests: {}
+            limits:
+              cpu: 150m
+              ephemeral-storage: 2Gi
+              memory: 192Mi
+            requests:
+              cpu: 100m
+              ephemeral-storage: 50Mi
+              memory: 128Mi
           volumeMounts:
             - name: objstore-config
               mountPath: /conf
@@ -611,7 +821,9 @@
           secret:
             secretName: thanos-objstore
   volumeClaimTemplates:
-    - metadata:
+    - apiVersion: v1
+      kind: PersistentVolumeClaim
+      metadata:
         name: data
       spec:
         accessModes:
@@ -625,11 +837,11 @@
 kind: Ingress
 metadata:
   name: thanos-query
-  namespace: "default"
+  namespace: default
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: query
   annotations:
     app: thanos
@@ -655,9 +867,9 @@
   name: thanos-bucketweb
   namespace: "default"
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: bucketweb
 spec:
   endpoints:
@@ -667,9 +879,10 @@
       - "default"
   selector:
     matchLabels:
-      app.kubernetes.io/name: thanos
       app.kubernetes.io/instance: thanos
+      app.kubernetes.io/name: thanos
       app.kubernetes.io/component: bucketweb
+      prometheus-operator/monitor: 'true'
 ---
 # Source: thanos/templates/compactor/servicemonitor.yaml
 apiVersion: monitoring.coreos.com/v1
@@ -678,9 +891,9 @@
   name: thanos-compactor
   namespace: "default"
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: compactor
 spec:
   endpoints:
@@ -690,9 +903,10 @@
       - "default"
   selector:
     matchLabels:
-      app.kubernetes.io/name: thanos
       app.kubernetes.io/instance: thanos
+      app.kubernetes.io/name: thanos
       app.kubernetes.io/component: compactor
+      prometheus-operator/monitor: 'true'
 ---
 # Source: thanos/templates/query/servicemonitor.yaml
 apiVersion: monitoring.coreos.com/v1
@@ -701,9 +915,9 @@
   name: thanos-query
   namespace: "default"
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: query
 spec:
   endpoints:
@@ -713,9 +927,10 @@
       - "default"
   selector:
     matchLabels:
-      app.kubernetes.io/name: thanos
       app.kubernetes.io/instance: thanos
+      app.kubernetes.io/name: thanos
       app.kubernetes.io/component: query
+      prometheus-operator/monitor: 'true'
 ---
 # Source: thanos/templates/storegateway/servicemonitor.yaml
 apiVersion: monitoring.coreos.com/v1
@@ -724,9 +939,9 @@
   name: thanos-storegateway
   namespace: "default"
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: storegateway
 spec:
   endpoints:
@@ -736,6 +951,7 @@
       - "default"
   selector:
     matchLabels:
-      app.kubernetes.io/name: thanos
       app.kubernetes.io/instance: thanos
+      app.kubernetes.io/name: thanos
       app.kubernetes.io/component: storegateway
+      prometheus-operator/monitor: 'true'

@renovate renovate bot force-pushed the renovate/thanos-15.x branch from a11e2ea to b3c94c9 Compare October 14, 2024 21:08
@renovate renovate bot changed the title feat(charts)!: Update Helm release thanos to 15.7.28 feat(charts)!: Update Helm release thanos to 15.7.29 Oct 14, 2024
@github-actions GitHub Actions
Copy link

Path: cluster/core/monitoring/thanos/helm-release.yaml
Version: 11.5.5 -> 15.7.29

@@ -1,71 +1,236 @@
+# Source: thanos/templates/bucketweb/networkpolicy.yaml
+kind: NetworkPolicy
+apiVersion: networking.k8s.io/v1
+metadata:
+  name: thanos-bucketweb
+  namespace: "default"
+  labels:
+    app.kubernetes.io/instance: thanos
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
+    app.kubernetes.io/component: bucketweb
+spec:
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/instance: thanos
+      app.kubernetes.io/name: thanos
+      app.kubernetes.io/component: bucketweb
+  policyTypes:
+    - Ingress
+    - Egress
+  egress:
+    - {}
+  ingress:
+    - ports:
+        - port: 8080
+        - port: 8080
+---
+# Source: thanos/templates/compactor/networkpolicy.yaml
+kind: NetworkPolicy
+apiVersion: networking.k8s.io/v1
+metadata:
+  name: thanos-compactor
+  namespace: "default"
+  labels:
+    app.kubernetes.io/instance: thanos
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
+    app.kubernetes.io/component: compactor
+spec:
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/instance: thanos
+      app.kubernetes.io/name: thanos
+      app.kubernetes.io/component: compactor
+  policyTypes:
+    - Ingress
+    - Egress
+  egress:
+    - {}
+  ingress:
+    - ports:
+        - port: 10902
+        - port: 9090
+---
+# Source: thanos/templates/query/networkpolicy.yaml
+kind: NetworkPolicy
+apiVersion: networking.k8s.io/v1
+metadata:
+  name: thanos-query
+  namespace: "default"
+  labels:
+    app.kubernetes.io/instance: thanos
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
+    app.kubernetes.io/component: query
+spec:
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/instance: thanos
+      app.kubernetes.io/name: thanos
+      app.kubernetes.io/component: query
+  policyTypes:
+    - Ingress
+    - Egress
+  egress:
+    - {}
+  ingress:
+    - ports:
+        - port: 10902
+        - port: 10901
+        - port: 9090
+        - port: 10901
+---
+# Source: thanos/templates/storegateway/networkpolicy.yaml
+kind: NetworkPolicy
+apiVersion: networking.k8s.io/v1
+metadata:
+  name: thanos-storegateway
+  namespace: "default"
+  labels:
+    app.kubernetes.io/instance: thanos
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
+    app.kubernetes.io/component: storegateway
+spec:
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/instance: thanos
+      app.kubernetes.io/name: thanos
+      app.kubernetes.io/component: storegateway
+  policyTypes:
+    - Ingress
+    - Egress
+  egress:
+    - {}
+  ingress:
+    - ports:
+        - port: 10902
+        - port: 9090
+        - port: 10901
+        - port: 10901
+---
+# Source: thanos/templates/bucketweb/pdb.yaml
+apiVersion: policy/v1
+kind: PodDisruptionBudget
+metadata:
+  name: thanos-bucketweb
+  namespace: default
+  labels:
+    app.kubernetes.io/instance: thanos
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
+    app.kubernetes.io/component: bucketweb
+spec:
+  maxUnavailable: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/instance: thanos
+      app.kubernetes.io/name: thanos
+      app.kubernetes.io/component: bucketweb
+---
+# Source: thanos/templates/query/pdb.yaml
+apiVersion: policy/v1
+kind: PodDisruptionBudget
+metadata:
+  name: thanos-query
+  namespace: default
+  labels:
+    app.kubernetes.io/instance: thanos
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
+    app.kubernetes.io/component: query
+spec:
+  maxUnavailable: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/instance: thanos
+      app.kubernetes.io/name: thanos
+      app.kubernetes.io/component: query
+---
+# Source: thanos/templates/storegateway/pdb.yaml
+apiVersion: policy/v1
+kind: PodDisruptionBudget
+metadata:
+  name: thanos-storegateway
+  namespace: default
+  labels:
+    app.kubernetes.io/instance: thanos
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
+    app.kubernetes.io/component: storegateway
+spec:
+  maxUnavailable: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/instance: thanos
+      app.kubernetes.io/name: thanos
+      app.kubernetes.io/component: storegateway
+---
 # Source: thanos/templates/bucketweb/serviceaccount.yaml
 apiVersion: v1
 kind: ServiceAccount
 metadata:
   name: thanos-bucketweb
-  namespace: "default"
+  namespace: default
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: bucketweb
-  annotations:
-automountServiceAccountToken: true
+automountServiceAccountToken: false
 ---
 # Source: thanos/templates/compactor/serviceaccount.yaml
 apiVersion: v1
 kind: ServiceAccount
 metadata:
   name: thanos-compactor
-  namespace: "default"
+  namespace: default
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: compactor
-  annotations:
-automountServiceAccountToken: true
+automountServiceAccountToken: false
 ---
 # Source: thanos/templates/query/serviceaccount.yaml
 apiVersion: v1
 kind: ServiceAccount
 metadata:
   name: thanos-query
-  namespace: "default"
+  namespace: default
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: query
-  annotations:
-automountServiceAccountToken: true
+automountServiceAccountToken: false
 ---
 # Source: thanos/templates/storegateway/serviceaccount.yaml
 apiVersion: v1
 kind: ServiceAccount
 metadata:
   name: thanos-storegateway
-  namespace: "default"
+  namespace: default
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: storegateway
-  annotations:
-automountServiceAccountToken: true
+automountServiceAccountToken: false
 ---
 # Source: thanos/templates/bucketweb/service.yaml
 apiVersion: v1
 kind: Service
 metadata:
   name: thanos-bucketweb
-  namespace: "default"
+  namespace: default
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: bucketweb
-  annotations:
+    prometheus-operator/monitor: 'true'
 spec:
   type: ClusterIP
   ports:
@@ -75,8 +240,8 @@
       name: http
       nodePort: null
   selector:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: bucketweb
 ---
 # Source: thanos/templates/compactor/service.yaml
@@ -84,13 +249,13 @@
 kind: Service
 metadata:
   name: thanos-compactor
-  namespace: "default"
+  namespace: default
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: compactor
-  annotations:
+    prometheus-operator/monitor: 'true'
 spec:
   type: ClusterIP
   ports:
@@ -100,8 +265,8 @@
       name: http
       nodePort: null
   selector:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: compactor
 ---
 # Source: thanos/templates/query/service-grpc.yaml
@@ -109,13 +274,12 @@
 kind: Service
 metadata:
   name: thanos-query-grpc
-  namespace: "default"
+  namespace: default
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: query
-  annotations:
 spec:
   type: ClusterIP
   ports:
@@ -125,8 +289,8 @@
       name: grpc
       nodePort: null
   selector:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: query
 ---
 # Source: thanos/templates/query/service.yaml
@@ -134,13 +298,13 @@
 kind: Service
 metadata:
   name: thanos-query
-  namespace: "default"
+  namespace: default
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: query
-  annotations:
+    prometheus-operator/monitor: 'true'
 spec:
   type: ClusterIP
   ports:
@@ -150,8 +314,8 @@
       name: http
       nodePort: null
   selector:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: query
 ---
 # Source: thanos/templates/storegateway/service.yaml
@@ -159,14 +323,13 @@
 kind: Service
 metadata:
   name: thanos-storegateway
-  namespace: "default"
+  namespace: default
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: storegateway
     prometheus-operator/monitor: 'true'
-  annotations:
 spec:
   type: ClusterIP
   ports:
@@ -181,8 +344,8 @@
       name: grpc
       nodePort: null
   selector:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: storegateway
 ---
 # Source: thanos/templates/bucketweb/deployment.yaml
@@ -190,32 +353,31 @@
 kind: Deployment
 metadata:
   name: thanos-bucketweb
-  namespace: "default"
+  namespace: default
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: bucketweb
 spec:
   replicas: 1
+  revisionHistoryLimit: 10
   strategy:
     type: RollingUpdate
   selector:
     matchLabels:
-      app.kubernetes.io/name: thanos
       app.kubernetes.io/instance: thanos
+      app.kubernetes.io/name: thanos
       app.kubernetes.io/component: bucketweb
   template:
     metadata:
       labels:
-        app.kubernetes.io/name: thanos
         app.kubernetes.io/instance: thanos
         app.kubernetes.io/managed-by: Helm
+        app.kubernetes.io/name: thanos
         app.kubernetes.io/component: bucketweb
-      annotations:
-        checksum/objstore-configuration: 01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b
     spec:
-      serviceAccount: thanos-bucketweb
+      serviceAccountName: thanos-bucketweb
       automountServiceAccountToken: true
       affinity:
         podAffinity:
@@ -224,25 +386,34 @@
             - podAffinityTerm:
                 labelSelector:
                   matchLabels:
-                    app.kubernetes.io/name: thanos
                     app.kubernetes.io/instance: thanos
+                    app.kubernetes.io/name: thanos
                     app.kubernetes.io/component: bucketweb
-                namespaces:
-                  - "default"
                 topologyKey: kubernetes.io/hostname
               weight: 1
         nodeAffinity:
       securityContext:
         fsGroup: 1001
+        fsGroupChangePolicy: Always
+        supplementalGroups: []
+        sysctls: []
       containers:
         - name: bucketweb
-          image: public.ecr.aws/bitnami/thanos:0.28.1-scratch-r0
+          image: public.ecr.aws/bitnami/thanos:0.36.1-debian-12-r3
           imagePullPolicy: "IfNotPresent"
           securityContext:
             allowPrivilegeEscalation: false
+            capabilities:
+              drop:
+                - ALL
+            privileged: false
             readOnlyRootFilesystem: true
+            runAsGroup: 1001
             runAsNonRoot: true
             runAsUser: 1001
+            seLinuxOptions: {}
+            seccompProfile:
+              type: RuntimeDefault
           args:
             - tools
             - bucket
@@ -297,32 +468,31 @@
 kind: Deployment
 metadata:
   name: thanos-compactor
-  namespace: "default"
+  namespace: default
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: compactor
 spec:
   replicas: 1
+  revisionHistoryLimit: 10
   strategy:
     type: Recreate
   selector:
     matchLabels:
-      app.kubernetes.io/name: thanos
       app.kubernetes.io/instance: thanos
+      app.kubernetes.io/name: thanos
       app.kubernetes.io/component: compactor
   template:
     metadata:
       labels:
-        app.kubernetes.io/name: thanos
         app.kubernetes.io/instance: thanos
         app.kubernetes.io/managed-by: Helm
+        app.kubernetes.io/name: thanos
         app.kubernetes.io/component: compactor
-      annotations:
-        checksum/objstore-configuration: 01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b
     spec:
-      serviceAccount: thanos-compactor
+      serviceAccountName: thanos-compactor
       automountServiceAccountToken: true
       affinity:
         podAffinity:
@@ -331,25 +501,34 @@
             - podAffinityTerm:
                 labelSelector:
                   matchLabels:
-                    app.kubernetes.io/name: thanos
                     app.kubernetes.io/instance: thanos
+                    app.kubernetes.io/name: thanos
                     app.kubernetes.io/component: compactor
-                namespaces:
-                  - "default"
                 topologyKey: kubernetes.io/hostname
               weight: 1
         nodeAffinity:
       securityContext:
         fsGroup: 1001
+        fsGroupChangePolicy: Always
+        supplementalGroups: []
+        sysctls: []
       containers:
         - name: compactor
-          image: public.ecr.aws/bitnami/thanos:0.28.1-scratch-r0
+          image: public.ecr.aws/bitnami/thanos:0.36.1-debian-12-r3
           imagePullPolicy: "IfNotPresent"
           securityContext:
             allowPrivilegeEscalation: false
+            capabilities:
+              drop:
+                - ALL
+            privileged: false
             readOnlyRootFilesystem: true
+            runAsGroup: 1001
             runAsNonRoot: true
             runAsUser: 1001
+            seLinuxOptions: {}
+            seccompProfile:
+              type: RuntimeDefault
           args:
             - compact
             - --log.level=info
@@ -410,30 +589,31 @@
 kind: Deployment
 metadata:
   name: thanos-query
-  namespace: "default"
+  namespace: default
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: query
 spec:
   replicas: 1
+  revisionHistoryLimit: 10
   strategy:
     type: RollingUpdate
   selector:
     matchLabels:
-      app.kubernetes.io/name: thanos
       app.kubernetes.io/instance: thanos
+      app.kubernetes.io/name: thanos
       app.kubernetes.io/component: query
   template:
     metadata:
       labels:
-        app.kubernetes.io/name: thanos
         app.kubernetes.io/instance: thanos
         app.kubernetes.io/managed-by: Helm
+        app.kubernetes.io/name: thanos
         app.kubernetes.io/component: query
     spec:
-      serviceAccount: thanos-query
+      serviceAccountName: thanos-query
       automountServiceAccountToken: true
       affinity:
         podAffinity:
@@ -442,25 +622,34 @@
             - podAffinityTerm:
                 labelSelector:
                   matchLabels:
-                    app.kubernetes.io/name: thanos
                     app.kubernetes.io/instance: thanos
+                    app.kubernetes.io/name: thanos
                     app.kubernetes.io/component: query
-                namespaces:
-                  - "default"
                 topologyKey: kubernetes.io/hostname
               weight: 1
         nodeAffinity:
       securityContext:
         fsGroup: 1001
+        fsGroupChangePolicy: Always
+        supplementalGroups: []
+        sysctls: []
       containers:
         - name: query
-          image: public.ecr.aws/bitnami/thanos:0.28.1-scratch-r0
+          image: public.ecr.aws/bitnami/thanos:0.36.1-debian-12-r3
           imagePullPolicy: "IfNotPresent"
           securityContext:
             allowPrivilegeEscalation: false
+            capabilities:
+              drop:
+                - ALL
+            privileged: false
             readOnlyRootFilesystem: true
+            runAsGroup: 1001
             runAsNonRoot: true
             runAsUser: 1001
+            seLinuxOptions: {}
+            seccompProfile:
+              type: RuntimeDefault
           args:
             - query
             - --log.level=info
@@ -470,6 +659,7 @@
             - --query.replica-label=replica
             - --endpoint=dnssrv+_grpc._tcp.prometheus-thanos-discovery.monitoring.svc.cluster.local
             - --endpoint=dnssrv+_grpc._tcp.thanos-storegateway.default.svc.cluster.local
+            - --alert.query-url=http://thanos-query.default.svc.cluster.local:9090
           ports:
             - name: http
               containerPort: 10902
@@ -498,8 +688,14 @@
               port: http
               scheme: HTTP
           resources:
-            limits: {}
-            requests: {}
+            limits:
+              cpu: 150m
+              ephemeral-storage: 2Gi
+              memory: 192Mi
+            requests:
+              cpu: 100m
+              ephemeral-storage: 50Mi
+              memory: 128Mi
           volumeMounts:
       volumes:
 ---
@@ -508,34 +704,33 @@
 kind: StatefulSet
 metadata:
   name: thanos-storegateway
-  namespace: "default"
+  namespace: default
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: storegateway
 spec:
   replicas: 1
+  revisionHistoryLimit: 10
   podManagementPolicy: OrderedReady
   serviceName: thanos-storegateway-headless
   updateStrategy:
     type: RollingUpdate
   selector:
     matchLabels:
-      app.kubernetes.io/name: thanos
       app.kubernetes.io/instance: thanos
+      app.kubernetes.io/name: thanos
       app.kubernetes.io/component: storegateway
   template:
     metadata:
       labels:
-        app.kubernetes.io/name: thanos
         app.kubernetes.io/instance: thanos
         app.kubernetes.io/managed-by: Helm
+        app.kubernetes.io/name: thanos
         app.kubernetes.io/component: storegateway
-      annotations:
-        checksum/objstore-configuration: 01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b
     spec:
-      serviceAccount: thanos-storegateway
+      serviceAccountName: thanos-storegateway
       automountServiceAccountToken: true
       affinity:
         podAffinity:
@@ -544,25 +739,34 @@
             - podAffinityTerm:
                 labelSelector:
                   matchLabels:
-                    app.kubernetes.io/name: thanos
                     app.kubernetes.io/instance: thanos
+                    app.kubernetes.io/name: thanos
                     app.kubernetes.io/component: storegateway
-                namespaces:
-                  - "default"
                 topologyKey: kubernetes.io/hostname
               weight: 1
         nodeAffinity:
       securityContext:
         fsGroup: 1001
+        fsGroupChangePolicy: Always
+        supplementalGroups: []
+        sysctls: []
       containers:
         - name: storegateway
-          image: public.ecr.aws/bitnami/thanos:0.28.1-scratch-r0
+          image: public.ecr.aws/bitnami/thanos:0.36.1-debian-12-r3
           imagePullPolicy: "IfNotPresent"
           securityContext:
             allowPrivilegeEscalation: false
+            capabilities:
+              drop:
+                - ALL
+            privileged: false
             readOnlyRootFilesystem: true
+            runAsGroup: 1001
             runAsNonRoot: true
             runAsUser: 1001
+            seLinuxOptions: {}
+            seccompProfile:
+              type: RuntimeDefault
           args:
             - store
             - --log.level=info
@@ -599,8 +803,14 @@
               port: http
               scheme: HTTP
           resources:
-            limits: {}
-            requests: {}
+            limits:
+              cpu: 150m
+              ephemeral-storage: 2Gi
+              memory: 192Mi
+            requests:
+              cpu: 100m
+              ephemeral-storage: 50Mi
+              memory: 128Mi
           volumeMounts:
             - name: objstore-config
               mountPath: /conf
@@ -611,7 +821,9 @@
           secret:
             secretName: thanos-objstore
   volumeClaimTemplates:
-    - metadata:
+    - apiVersion: v1
+      kind: PersistentVolumeClaim
+      metadata:
         name: data
       spec:
         accessModes:
@@ -625,11 +837,11 @@
 kind: Ingress
 metadata:
   name: thanos-query
-  namespace: "default"
+  namespace: default
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: query
   annotations:
     app: thanos
@@ -655,9 +867,9 @@
   name: thanos-bucketweb
   namespace: "default"
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: bucketweb
 spec:
   endpoints:
@@ -667,9 +879,10 @@
       - "default"
   selector:
     matchLabels:
-      app.kubernetes.io/name: thanos
       app.kubernetes.io/instance: thanos
+      app.kubernetes.io/name: thanos
       app.kubernetes.io/component: bucketweb
+      prometheus-operator/monitor: 'true'
 ---
 # Source: thanos/templates/compactor/servicemonitor.yaml
 apiVersion: monitoring.coreos.com/v1
@@ -678,9 +891,9 @@
   name: thanos-compactor
   namespace: "default"
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: compactor
 spec:
   endpoints:
@@ -690,9 +903,10 @@
       - "default"
   selector:
     matchLabels:
-      app.kubernetes.io/name: thanos
       app.kubernetes.io/instance: thanos
+      app.kubernetes.io/name: thanos
       app.kubernetes.io/component: compactor
+      prometheus-operator/monitor: 'true'
 ---
 # Source: thanos/templates/query/servicemonitor.yaml
 apiVersion: monitoring.coreos.com/v1
@@ -701,9 +915,9 @@
   name: thanos-query
   namespace: "default"
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: query
 spec:
   endpoints:
@@ -713,9 +927,10 @@
       - "default"
   selector:
     matchLabels:
-      app.kubernetes.io/name: thanos
       app.kubernetes.io/instance: thanos
+      app.kubernetes.io/name: thanos
       app.kubernetes.io/component: query
+      prometheus-operator/monitor: 'true'
 ---
 # Source: thanos/templates/storegateway/servicemonitor.yaml
 apiVersion: monitoring.coreos.com/v1
@@ -724,9 +939,9 @@
   name: thanos-storegateway
   namespace: "default"
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: storegateway
 spec:
   endpoints:
@@ -736,6 +951,7 @@
       - "default"
   selector:
     matchLabels:
-      app.kubernetes.io/name: thanos
       app.kubernetes.io/instance: thanos
+      app.kubernetes.io/name: thanos
       app.kubernetes.io/component: storegateway
+      prometheus-operator/monitor: 'true'

@renovate renovate bot force-pushed the renovate/thanos-15.x branch from b3c94c9 to 56f90ba Compare October 24, 2024 17:38
@renovate renovate bot changed the title feat(charts)!: Update Helm release thanos to 15.7.29 feat(charts)!: Update Helm release thanos to 15.8.0 Oct 24, 2024
@github-actions GitHub Actions
Copy link

Path: cluster/core/monitoring/thanos/helm-release.yaml
Version: 11.5.5 -> 15.8.0

@@ -1,71 +1,236 @@
+# Source: thanos/templates/bucketweb/networkpolicy.yaml
+kind: NetworkPolicy
+apiVersion: networking.k8s.io/v1
+metadata:
+  name: thanos-bucketweb
+  namespace: "default"
+  labels:
+    app.kubernetes.io/instance: thanos
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
+    app.kubernetes.io/component: bucketweb
+spec:
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/instance: thanos
+      app.kubernetes.io/name: thanos
+      app.kubernetes.io/component: bucketweb
+  policyTypes:
+    - Ingress
+    - Egress
+  egress:
+    - {}
+  ingress:
+    - ports:
+        - port: 8080
+        - port: 8080
+---
+# Source: thanos/templates/compactor/networkpolicy.yaml
+kind: NetworkPolicy
+apiVersion: networking.k8s.io/v1
+metadata:
+  name: thanos-compactor
+  namespace: "default"
+  labels:
+    app.kubernetes.io/instance: thanos
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
+    app.kubernetes.io/component: compactor
+spec:
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/instance: thanos
+      app.kubernetes.io/name: thanos
+      app.kubernetes.io/component: compactor
+  policyTypes:
+    - Ingress
+    - Egress
+  egress:
+    - {}
+  ingress:
+    - ports:
+        - port: 10902
+        - port: 9090
+---
+# Source: thanos/templates/query/networkpolicy.yaml
+kind: NetworkPolicy
+apiVersion: networking.k8s.io/v1
+metadata:
+  name: thanos-query
+  namespace: "default"
+  labels:
+    app.kubernetes.io/instance: thanos
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
+    app.kubernetes.io/component: query
+spec:
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/instance: thanos
+      app.kubernetes.io/name: thanos
+      app.kubernetes.io/component: query
+  policyTypes:
+    - Ingress
+    - Egress
+  egress:
+    - {}
+  ingress:
+    - ports:
+        - port: 10902
+        - port: 10901
+        - port: 9090
+        - port: 10901
+---
+# Source: thanos/templates/storegateway/networkpolicy.yaml
+kind: NetworkPolicy
+apiVersion: networking.k8s.io/v1
+metadata:
+  name: thanos-storegateway
+  namespace: "default"
+  labels:
+    app.kubernetes.io/instance: thanos
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
+    app.kubernetes.io/component: storegateway
+spec:
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/instance: thanos
+      app.kubernetes.io/name: thanos
+      app.kubernetes.io/component: storegateway
+  policyTypes:
+    - Ingress
+    - Egress
+  egress:
+    - {}
+  ingress:
+    - ports:
+        - port: 10902
+        - port: 9090
+        - port: 10901
+        - port: 10901
+---
+# Source: thanos/templates/bucketweb/pdb.yaml
+apiVersion: policy/v1
+kind: PodDisruptionBudget
+metadata:
+  name: thanos-bucketweb
+  namespace: default
+  labels:
+    app.kubernetes.io/instance: thanos
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
+    app.kubernetes.io/component: bucketweb
+spec:
+  maxUnavailable: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/instance: thanos
+      app.kubernetes.io/name: thanos
+      app.kubernetes.io/component: bucketweb
+---
+# Source: thanos/templates/query/pdb.yaml
+apiVersion: policy/v1
+kind: PodDisruptionBudget
+metadata:
+  name: thanos-query
+  namespace: default
+  labels:
+    app.kubernetes.io/instance: thanos
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
+    app.kubernetes.io/component: query
+spec:
+  maxUnavailable: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/instance: thanos
+      app.kubernetes.io/name: thanos
+      app.kubernetes.io/component: query
+---
+# Source: thanos/templates/storegateway/pdb.yaml
+apiVersion: policy/v1
+kind: PodDisruptionBudget
+metadata:
+  name: thanos-storegateway
+  namespace: default
+  labels:
+    app.kubernetes.io/instance: thanos
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
+    app.kubernetes.io/component: storegateway
+spec:
+  maxUnavailable: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/instance: thanos
+      app.kubernetes.io/name: thanos
+      app.kubernetes.io/component: storegateway
+---
 # Source: thanos/templates/bucketweb/serviceaccount.yaml
 apiVersion: v1
 kind: ServiceAccount
 metadata:
   name: thanos-bucketweb
-  namespace: "default"
+  namespace: default
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: bucketweb
-  annotations:
-automountServiceAccountToken: true
+automountServiceAccountToken: false
 ---
 # Source: thanos/templates/compactor/serviceaccount.yaml
 apiVersion: v1
 kind: ServiceAccount
 metadata:
   name: thanos-compactor
-  namespace: "default"
+  namespace: default
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: compactor
-  annotations:
-automountServiceAccountToken: true
+automountServiceAccountToken: false
 ---
 # Source: thanos/templates/query/serviceaccount.yaml
 apiVersion: v1
 kind: ServiceAccount
 metadata:
   name: thanos-query
-  namespace: "default"
+  namespace: default
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: query
-  annotations:
-automountServiceAccountToken: true
+automountServiceAccountToken: false
 ---
 # Source: thanos/templates/storegateway/serviceaccount.yaml
 apiVersion: v1
 kind: ServiceAccount
 metadata:
   name: thanos-storegateway
-  namespace: "default"
+  namespace: default
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: storegateway
-  annotations:
-automountServiceAccountToken: true
+automountServiceAccountToken: false
 ---
 # Source: thanos/templates/bucketweb/service.yaml
 apiVersion: v1
 kind: Service
 metadata:
   name: thanos-bucketweb
-  namespace: "default"
+  namespace: default
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: bucketweb
-  annotations:
+    prometheus-operator/monitor: 'true'
 spec:
   type: ClusterIP
   ports:
@@ -75,8 +240,8 @@
       name: http
       nodePort: null
   selector:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: bucketweb
 ---
 # Source: thanos/templates/compactor/service.yaml
@@ -84,13 +249,13 @@
 kind: Service
 metadata:
   name: thanos-compactor
-  namespace: "default"
+  namespace: default
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: compactor
-  annotations:
+    prometheus-operator/monitor: 'true'
 spec:
   type: ClusterIP
   ports:
@@ -100,8 +265,8 @@
       name: http
       nodePort: null
   selector:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: compactor
 ---
 # Source: thanos/templates/query/service-grpc.yaml
@@ -109,13 +274,12 @@
 kind: Service
 metadata:
   name: thanos-query-grpc
-  namespace: "default"
+  namespace: default
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: query
-  annotations:
 spec:
   type: ClusterIP
   ports:
@@ -125,8 +289,8 @@
       name: grpc
       nodePort: null
   selector:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: query
 ---
 # Source: thanos/templates/query/service.yaml
@@ -134,13 +298,13 @@
 kind: Service
 metadata:
   name: thanos-query
-  namespace: "default"
+  namespace: default
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: query
-  annotations:
+    prometheus-operator/monitor: 'true'
 spec:
   type: ClusterIP
   ports:
@@ -150,8 +314,8 @@
       name: http
       nodePort: null
   selector:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: query
 ---
 # Source: thanos/templates/storegateway/service.yaml
@@ -159,14 +323,13 @@
 kind: Service
 metadata:
   name: thanos-storegateway
-  namespace: "default"
+  namespace: default
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: storegateway
     prometheus-operator/monitor: 'true'
-  annotations:
 spec:
   type: ClusterIP
   ports:
@@ -181,8 +344,8 @@
       name: grpc
       nodePort: null
   selector:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: storegateway
 ---
 # Source: thanos/templates/bucketweb/deployment.yaml
@@ -190,32 +353,31 @@
 kind: Deployment
 metadata:
   name: thanos-bucketweb
-  namespace: "default"
+  namespace: default
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: bucketweb
 spec:
   replicas: 1
+  revisionHistoryLimit: 10
   strategy:
     type: RollingUpdate
   selector:
     matchLabels:
-      app.kubernetes.io/name: thanos
       app.kubernetes.io/instance: thanos
+      app.kubernetes.io/name: thanos
       app.kubernetes.io/component: bucketweb
   template:
     metadata:
       labels:
-        app.kubernetes.io/name: thanos
         app.kubernetes.io/instance: thanos
         app.kubernetes.io/managed-by: Helm
+        app.kubernetes.io/name: thanos
         app.kubernetes.io/component: bucketweb
-      annotations:
-        checksum/objstore-configuration: 01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b
     spec:
-      serviceAccount: thanos-bucketweb
+      serviceAccountName: thanos-bucketweb
       automountServiceAccountToken: true
       affinity:
         podAffinity:
@@ -224,25 +386,34 @@
             - podAffinityTerm:
                 labelSelector:
                   matchLabels:
-                    app.kubernetes.io/name: thanos
                     app.kubernetes.io/instance: thanos
+                    app.kubernetes.io/name: thanos
                     app.kubernetes.io/component: bucketweb
-                namespaces:
-                  - "default"
                 topologyKey: kubernetes.io/hostname
               weight: 1
         nodeAffinity:
       securityContext:
         fsGroup: 1001
+        fsGroupChangePolicy: Always
+        supplementalGroups: []
+        sysctls: []
       containers:
         - name: bucketweb
-          image: public.ecr.aws/bitnami/thanos:0.28.1-scratch-r0
+          image: public.ecr.aws/bitnami/thanos:0.36.1-debian-12-r3
           imagePullPolicy: "IfNotPresent"
           securityContext:
             allowPrivilegeEscalation: false
+            capabilities:
+              drop:
+                - ALL
+            privileged: false
             readOnlyRootFilesystem: true
+            runAsGroup: 1001
             runAsNonRoot: true
             runAsUser: 1001
+            seLinuxOptions: {}
+            seccompProfile:
+              type: RuntimeDefault
           args:
             - tools
             - bucket
@@ -297,32 +468,31 @@
 kind: Deployment
 metadata:
   name: thanos-compactor
-  namespace: "default"
+  namespace: default
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: compactor
 spec:
   replicas: 1
+  revisionHistoryLimit: 10
   strategy:
     type: Recreate
   selector:
     matchLabels:
-      app.kubernetes.io/name: thanos
       app.kubernetes.io/instance: thanos
+      app.kubernetes.io/name: thanos
       app.kubernetes.io/component: compactor
   template:
     metadata:
       labels:
-        app.kubernetes.io/name: thanos
         app.kubernetes.io/instance: thanos
         app.kubernetes.io/managed-by: Helm
+        app.kubernetes.io/name: thanos
         app.kubernetes.io/component: compactor
-      annotations:
-        checksum/objstore-configuration: 01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b
     spec:
-      serviceAccount: thanos-compactor
+      serviceAccountName: thanos-compactor
       automountServiceAccountToken: true
       affinity:
         podAffinity:
@@ -331,25 +501,34 @@
             - podAffinityTerm:
                 labelSelector:
                   matchLabels:
-                    app.kubernetes.io/name: thanos
                     app.kubernetes.io/instance: thanos
+                    app.kubernetes.io/name: thanos
                     app.kubernetes.io/component: compactor
-                namespaces:
-                  - "default"
                 topologyKey: kubernetes.io/hostname
               weight: 1
         nodeAffinity:
       securityContext:
         fsGroup: 1001
+        fsGroupChangePolicy: Always
+        supplementalGroups: []
+        sysctls: []
       containers:
         - name: compactor
-          image: public.ecr.aws/bitnami/thanos:0.28.1-scratch-r0
+          image: public.ecr.aws/bitnami/thanos:0.36.1-debian-12-r3
           imagePullPolicy: "IfNotPresent"
           securityContext:
             allowPrivilegeEscalation: false
+            capabilities:
+              drop:
+                - ALL
+            privileged: false
             readOnlyRootFilesystem: true
+            runAsGroup: 1001
             runAsNonRoot: true
             runAsUser: 1001
+            seLinuxOptions: {}
+            seccompProfile:
+              type: RuntimeDefault
           args:
             - compact
             - --log.level=info
@@ -410,30 +589,31 @@
 kind: Deployment
 metadata:
   name: thanos-query
-  namespace: "default"
+  namespace: default
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: query
 spec:
   replicas: 1
+  revisionHistoryLimit: 10
   strategy:
     type: RollingUpdate
   selector:
     matchLabels:
-      app.kubernetes.io/name: thanos
       app.kubernetes.io/instance: thanos
+      app.kubernetes.io/name: thanos
       app.kubernetes.io/component: query
   template:
     metadata:
       labels:
-        app.kubernetes.io/name: thanos
         app.kubernetes.io/instance: thanos
         app.kubernetes.io/managed-by: Helm
+        app.kubernetes.io/name: thanos
         app.kubernetes.io/component: query
     spec:
-      serviceAccount: thanos-query
+      serviceAccountName: thanos-query
       automountServiceAccountToken: true
       affinity:
         podAffinity:
@@ -442,25 +622,34 @@
             - podAffinityTerm:
                 labelSelector:
                   matchLabels:
-                    app.kubernetes.io/name: thanos
                     app.kubernetes.io/instance: thanos
+                    app.kubernetes.io/name: thanos
                     app.kubernetes.io/component: query
-                namespaces:
-                  - "default"
                 topologyKey: kubernetes.io/hostname
               weight: 1
         nodeAffinity:
       securityContext:
         fsGroup: 1001
+        fsGroupChangePolicy: Always
+        supplementalGroups: []
+        sysctls: []
       containers:
         - name: query
-          image: public.ecr.aws/bitnami/thanos:0.28.1-scratch-r0
+          image: public.ecr.aws/bitnami/thanos:0.36.1-debian-12-r3
           imagePullPolicy: "IfNotPresent"
           securityContext:
             allowPrivilegeEscalation: false
+            capabilities:
+              drop:
+                - ALL
+            privileged: false
             readOnlyRootFilesystem: true
+            runAsGroup: 1001
             runAsNonRoot: true
             runAsUser: 1001
+            seLinuxOptions: {}
+            seccompProfile:
+              type: RuntimeDefault
           args:
             - query
             - --log.level=info
@@ -470,6 +659,7 @@
             - --query.replica-label=replica
             - --endpoint=dnssrv+_grpc._tcp.prometheus-thanos-discovery.monitoring.svc.cluster.local
             - --endpoint=dnssrv+_grpc._tcp.thanos-storegateway.default.svc.cluster.local
+            - --alert.query-url=http://thanos-query.default.svc.cluster.local:9090
           ports:
             - name: http
               containerPort: 10902
@@ -498,8 +688,14 @@
               port: http
               scheme: HTTP
           resources:
-            limits: {}
-            requests: {}
+            limits:
+              cpu: 150m
+              ephemeral-storage: 2Gi
+              memory: 192Mi
+            requests:
+              cpu: 100m
+              ephemeral-storage: 50Mi
+              memory: 128Mi
           volumeMounts:
       volumes:
 ---
@@ -508,34 +704,33 @@
 kind: StatefulSet
 metadata:
   name: thanos-storegateway
-  namespace: "default"
+  namespace: default
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: storegateway
 spec:
   replicas: 1
+  revisionHistoryLimit: 10
   podManagementPolicy: OrderedReady
   serviceName: thanos-storegateway-headless
   updateStrategy:
     type: RollingUpdate
   selector:
     matchLabels:
-      app.kubernetes.io/name: thanos
       app.kubernetes.io/instance: thanos
+      app.kubernetes.io/name: thanos
       app.kubernetes.io/component: storegateway
   template:
     metadata:
       labels:
-        app.kubernetes.io/name: thanos
         app.kubernetes.io/instance: thanos
         app.kubernetes.io/managed-by: Helm
+        app.kubernetes.io/name: thanos
         app.kubernetes.io/component: storegateway
-      annotations:
-        checksum/objstore-configuration: 01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b
     spec:
-      serviceAccount: thanos-storegateway
+      serviceAccountName: thanos-storegateway
       automountServiceAccountToken: true
       affinity:
         podAffinity:
@@ -544,25 +739,34 @@
             - podAffinityTerm:
                 labelSelector:
                   matchLabels:
-                    app.kubernetes.io/name: thanos
                     app.kubernetes.io/instance: thanos
+                    app.kubernetes.io/name: thanos
                     app.kubernetes.io/component: storegateway
-                namespaces:
-                  - "default"
                 topologyKey: kubernetes.io/hostname
               weight: 1
         nodeAffinity:
       securityContext:
         fsGroup: 1001
+        fsGroupChangePolicy: Always
+        supplementalGroups: []
+        sysctls: []
       containers:
         - name: storegateway
-          image: public.ecr.aws/bitnami/thanos:0.28.1-scratch-r0
+          image: public.ecr.aws/bitnami/thanos:0.36.1-debian-12-r3
           imagePullPolicy: "IfNotPresent"
           securityContext:
             allowPrivilegeEscalation: false
+            capabilities:
+              drop:
+                - ALL
+            privileged: false
             readOnlyRootFilesystem: true
+            runAsGroup: 1001
             runAsNonRoot: true
             runAsUser: 1001
+            seLinuxOptions: {}
+            seccompProfile:
+              type: RuntimeDefault
           args:
             - store
             - --log.level=info
@@ -599,8 +803,14 @@
               port: http
               scheme: HTTP
           resources:
-            limits: {}
-            requests: {}
+            limits:
+              cpu: 150m
+              ephemeral-storage: 2Gi
+              memory: 192Mi
+            requests:
+              cpu: 100m
+              ephemeral-storage: 50Mi
+              memory: 128Mi
           volumeMounts:
             - name: objstore-config
               mountPath: /conf
@@ -611,7 +821,9 @@
           secret:
             secretName: thanos-objstore
   volumeClaimTemplates:
-    - metadata:
+    - apiVersion: v1
+      kind: PersistentVolumeClaim
+      metadata:
         name: data
       spec:
         accessModes:
@@ -625,11 +837,11 @@
 kind: Ingress
 metadata:
   name: thanos-query
-  namespace: "default"
+  namespace: default
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: query
   annotations:
     app: thanos
@@ -655,9 +867,9 @@
   name: thanos-bucketweb
   namespace: "default"
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: bucketweb
 spec:
   endpoints:
@@ -667,9 +879,10 @@
       - "default"
   selector:
     matchLabels:
-      app.kubernetes.io/name: thanos
       app.kubernetes.io/instance: thanos
+      app.kubernetes.io/name: thanos
       app.kubernetes.io/component: bucketweb
+      prometheus-operator/monitor: 'true'
 ---
 # Source: thanos/templates/compactor/servicemonitor.yaml
 apiVersion: monitoring.coreos.com/v1
@@ -678,9 +891,9 @@
   name: thanos-compactor
   namespace: "default"
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: compactor
 spec:
   endpoints:
@@ -690,9 +903,10 @@
       - "default"
   selector:
     matchLabels:
-      app.kubernetes.io/name: thanos
       app.kubernetes.io/instance: thanos
+      app.kubernetes.io/name: thanos
       app.kubernetes.io/component: compactor
+      prometheus-operator/monitor: 'true'
 ---
 # Source: thanos/templates/query/servicemonitor.yaml
 apiVersion: monitoring.coreos.com/v1
@@ -701,9 +915,9 @@
   name: thanos-query
   namespace: "default"
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: query
 spec:
   endpoints:
@@ -713,9 +927,10 @@
       - "default"
   selector:
     matchLabels:
-      app.kubernetes.io/name: thanos
       app.kubernetes.io/instance: thanos
+      app.kubernetes.io/name: thanos
       app.kubernetes.io/component: query
+      prometheus-operator/monitor: 'true'
 ---
 # Source: thanos/templates/storegateway/servicemonitor.yaml
 apiVersion: monitoring.coreos.com/v1
@@ -724,9 +939,9 @@
   name: thanos-storegateway
   namespace: "default"
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: storegateway
 spec:
   endpoints:
@@ -736,6 +951,7 @@
       - "default"
   selector:
     matchLabels:
-      app.kubernetes.io/name: thanos
       app.kubernetes.io/instance: thanos
+      app.kubernetes.io/name: thanos
       app.kubernetes.io/component: storegateway
+      prometheus-operator/monitor: 'true'

@renovate renovate bot force-pushed the renovate/thanos-15.x branch from 56f90ba to 9db1fe6 Compare November 7, 2024 11:08
@renovate renovate bot changed the title feat(charts)!: Update Helm release thanos to 15.8.0 feat(charts)!: Update Helm release thanos to 15.8.1 Nov 7, 2024
@github-actions GitHub Actions
Copy link

github-actions bot commented Nov 7, 2024

Path: cluster/core/monitoring/thanos/helm-release.yaml
Version: 11.5.5 -> 15.8.1

@@ -1,71 +1,236 @@
+# Source: thanos/templates/bucketweb/networkpolicy.yaml
+kind: NetworkPolicy
+apiVersion: networking.k8s.io/v1
+metadata:
+  name: thanos-bucketweb
+  namespace: "default"
+  labels:
+    app.kubernetes.io/instance: thanos
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
+    app.kubernetes.io/component: bucketweb
+spec:
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/instance: thanos
+      app.kubernetes.io/name: thanos
+      app.kubernetes.io/component: bucketweb
+  policyTypes:
+    - Ingress
+    - Egress
+  egress:
+    - {}
+  ingress:
+    - ports:
+        - port: 8080
+        - port: 8080
+---
+# Source: thanos/templates/compactor/networkpolicy.yaml
+kind: NetworkPolicy
+apiVersion: networking.k8s.io/v1
+metadata:
+  name: thanos-compactor
+  namespace: "default"
+  labels:
+    app.kubernetes.io/instance: thanos
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
+    app.kubernetes.io/component: compactor
+spec:
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/instance: thanos
+      app.kubernetes.io/name: thanos
+      app.kubernetes.io/component: compactor
+  policyTypes:
+    - Ingress
+    - Egress
+  egress:
+    - {}
+  ingress:
+    - ports:
+        - port: 10902
+        - port: 9090
+---
+# Source: thanos/templates/query/networkpolicy.yaml
+kind: NetworkPolicy
+apiVersion: networking.k8s.io/v1
+metadata:
+  name: thanos-query
+  namespace: "default"
+  labels:
+    app.kubernetes.io/instance: thanos
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
+    app.kubernetes.io/component: query
+spec:
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/instance: thanos
+      app.kubernetes.io/name: thanos
+      app.kubernetes.io/component: query
+  policyTypes:
+    - Ingress
+    - Egress
+  egress:
+    - {}
+  ingress:
+    - ports:
+        - port: 10902
+        - port: 10901
+        - port: 9090
+        - port: 10901
+---
+# Source: thanos/templates/storegateway/networkpolicy.yaml
+kind: NetworkPolicy
+apiVersion: networking.k8s.io/v1
+metadata:
+  name: thanos-storegateway
+  namespace: "default"
+  labels:
+    app.kubernetes.io/instance: thanos
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
+    app.kubernetes.io/component: storegateway
+spec:
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/instance: thanos
+      app.kubernetes.io/name: thanos
+      app.kubernetes.io/component: storegateway
+  policyTypes:
+    - Ingress
+    - Egress
+  egress:
+    - {}
+  ingress:
+    - ports:
+        - port: 10902
+        - port: 9090
+        - port: 10901
+        - port: 10901
+---
+# Source: thanos/templates/bucketweb/pdb.yaml
+apiVersion: policy/v1
+kind: PodDisruptionBudget
+metadata:
+  name: thanos-bucketweb
+  namespace: default
+  labels:
+    app.kubernetes.io/instance: thanos
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
+    app.kubernetes.io/component: bucketweb
+spec:
+  maxUnavailable: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/instance: thanos
+      app.kubernetes.io/name: thanos
+      app.kubernetes.io/component: bucketweb
+---
+# Source: thanos/templates/query/pdb.yaml
+apiVersion: policy/v1
+kind: PodDisruptionBudget
+metadata:
+  name: thanos-query
+  namespace: default
+  labels:
+    app.kubernetes.io/instance: thanos
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
+    app.kubernetes.io/component: query
+spec:
+  maxUnavailable: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/instance: thanos
+      app.kubernetes.io/name: thanos
+      app.kubernetes.io/component: query
+---
+# Source: thanos/templates/storegateway/pdb.yaml
+apiVersion: policy/v1
+kind: PodDisruptionBudget
+metadata:
+  name: thanos-storegateway
+  namespace: default
+  labels:
+    app.kubernetes.io/instance: thanos
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
+    app.kubernetes.io/component: storegateway
+spec:
+  maxUnavailable: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/instance: thanos
+      app.kubernetes.io/name: thanos
+      app.kubernetes.io/component: storegateway
+---
 # Source: thanos/templates/bucketweb/serviceaccount.yaml
 apiVersion: v1
 kind: ServiceAccount
 metadata:
   name: thanos-bucketweb
-  namespace: "default"
+  namespace: default
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: bucketweb
-  annotations:
-automountServiceAccountToken: true
+automountServiceAccountToken: false
 ---
 # Source: thanos/templates/compactor/serviceaccount.yaml
 apiVersion: v1
 kind: ServiceAccount
 metadata:
   name: thanos-compactor
-  namespace: "default"
+  namespace: default
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: compactor
-  annotations:
-automountServiceAccountToken: true
+automountServiceAccountToken: false
 ---
 # Source: thanos/templates/query/serviceaccount.yaml
 apiVersion: v1
 kind: ServiceAccount
 metadata:
   name: thanos-query
-  namespace: "default"
+  namespace: default
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: query
-  annotations:
-automountServiceAccountToken: true
+automountServiceAccountToken: false
 ---
 # Source: thanos/templates/storegateway/serviceaccount.yaml
 apiVersion: v1
 kind: ServiceAccount
 metadata:
   name: thanos-storegateway
-  namespace: "default"
+  namespace: default
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: storegateway
-  annotations:
-automountServiceAccountToken: true
+automountServiceAccountToken: false
 ---
 # Source: thanos/templates/bucketweb/service.yaml
 apiVersion: v1
 kind: Service
 metadata:
   name: thanos-bucketweb
-  namespace: "default"
+  namespace: default
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: bucketweb
-  annotations:
+    prometheus-operator/monitor: 'true'
 spec:
   type: ClusterIP
   ports:
@@ -75,8 +240,8 @@
       name: http
       nodePort: null
   selector:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: bucketweb
 ---
 # Source: thanos/templates/compactor/service.yaml
@@ -84,13 +249,13 @@
 kind: Service
 metadata:
   name: thanos-compactor
-  namespace: "default"
+  namespace: default
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: compactor
-  annotations:
+    prometheus-operator/monitor: 'true'
 spec:
   type: ClusterIP
   ports:
@@ -100,8 +265,8 @@
       name: http
       nodePort: null
   selector:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: compactor
 ---
 # Source: thanos/templates/query/service-grpc.yaml
@@ -109,13 +274,12 @@
 kind: Service
 metadata:
   name: thanos-query-grpc
-  namespace: "default"
+  namespace: default
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: query
-  annotations:
 spec:
   type: ClusterIP
   ports:
@@ -125,8 +289,8 @@
       name: grpc
       nodePort: null
   selector:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: query
 ---
 # Source: thanos/templates/query/service.yaml
@@ -134,13 +298,13 @@
 kind: Service
 metadata:
   name: thanos-query
-  namespace: "default"
+  namespace: default
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: query
-  annotations:
+    prometheus-operator/monitor: 'true'
 spec:
   type: ClusterIP
   ports:
@@ -150,8 +314,8 @@
       name: http
       nodePort: null
   selector:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: query
 ---
 # Source: thanos/templates/storegateway/service.yaml
@@ -159,14 +323,13 @@
 kind: Service
 metadata:
   name: thanos-storegateway
-  namespace: "default"
+  namespace: default
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: storegateway
     prometheus-operator/monitor: 'true'
-  annotations:
 spec:
   type: ClusterIP
   ports:
@@ -181,8 +344,8 @@
       name: grpc
       nodePort: null
   selector:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: storegateway
 ---
 # Source: thanos/templates/bucketweb/deployment.yaml
@@ -190,32 +353,31 @@
 kind: Deployment
 metadata:
   name: thanos-bucketweb
-  namespace: "default"
+  namespace: default
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: bucketweb
 spec:
   replicas: 1
+  revisionHistoryLimit: 10
   strategy:
     type: RollingUpdate
   selector:
     matchLabels:
-      app.kubernetes.io/name: thanos
       app.kubernetes.io/instance: thanos
+      app.kubernetes.io/name: thanos
       app.kubernetes.io/component: bucketweb
   template:
     metadata:
       labels:
-        app.kubernetes.io/name: thanos
         app.kubernetes.io/instance: thanos
         app.kubernetes.io/managed-by: Helm
+        app.kubernetes.io/name: thanos
         app.kubernetes.io/component: bucketweb
-      annotations:
-        checksum/objstore-configuration: 01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b
     spec:
-      serviceAccount: thanos-bucketweb
+      serviceAccountName: thanos-bucketweb
       automountServiceAccountToken: true
       affinity:
         podAffinity:
@@ -224,25 +386,34 @@
             - podAffinityTerm:
                 labelSelector:
                   matchLabels:
-                    app.kubernetes.io/name: thanos
                     app.kubernetes.io/instance: thanos
+                    app.kubernetes.io/name: thanos
                     app.kubernetes.io/component: bucketweb
-                namespaces:
-                  - "default"
                 topologyKey: kubernetes.io/hostname
               weight: 1
         nodeAffinity:
       securityContext:
         fsGroup: 1001
+        fsGroupChangePolicy: Always
+        supplementalGroups: []
+        sysctls: []
       containers:
         - name: bucketweb
-          image: public.ecr.aws/bitnami/thanos:0.28.1-scratch-r0
+          image: public.ecr.aws/bitnami/thanos:0.36.1-debian-12-r5
           imagePullPolicy: "IfNotPresent"
           securityContext:
             allowPrivilegeEscalation: false
+            capabilities:
+              drop:
+                - ALL
+            privileged: false
             readOnlyRootFilesystem: true
+            runAsGroup: 1001
             runAsNonRoot: true
             runAsUser: 1001
+            seLinuxOptions: {}
+            seccompProfile:
+              type: RuntimeDefault
           args:
             - tools
             - bucket
@@ -297,32 +468,31 @@
 kind: Deployment
 metadata:
   name: thanos-compactor
-  namespace: "default"
+  namespace: default
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: compactor
 spec:
   replicas: 1
+  revisionHistoryLimit: 10
   strategy:
     type: Recreate
   selector:
     matchLabels:
-      app.kubernetes.io/name: thanos
       app.kubernetes.io/instance: thanos
+      app.kubernetes.io/name: thanos
       app.kubernetes.io/component: compactor
   template:
     metadata:
       labels:
-        app.kubernetes.io/name: thanos
         app.kubernetes.io/instance: thanos
         app.kubernetes.io/managed-by: Helm
+        app.kubernetes.io/name: thanos
         app.kubernetes.io/component: compactor
-      annotations:
-        checksum/objstore-configuration: 01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b
     spec:
-      serviceAccount: thanos-compactor
+      serviceAccountName: thanos-compactor
       automountServiceAccountToken: true
       affinity:
         podAffinity:
@@ -331,25 +501,34 @@
             - podAffinityTerm:
                 labelSelector:
                   matchLabels:
-                    app.kubernetes.io/name: thanos
                     app.kubernetes.io/instance: thanos
+                    app.kubernetes.io/name: thanos
                     app.kubernetes.io/component: compactor
-                namespaces:
-                  - "default"
                 topologyKey: kubernetes.io/hostname
               weight: 1
         nodeAffinity:
       securityContext:
         fsGroup: 1001
+        fsGroupChangePolicy: Always
+        supplementalGroups: []
+        sysctls: []
       containers:
         - name: compactor
-          image: public.ecr.aws/bitnami/thanos:0.28.1-scratch-r0
+          image: public.ecr.aws/bitnami/thanos:0.36.1-debian-12-r5
           imagePullPolicy: "IfNotPresent"
           securityContext:
             allowPrivilegeEscalation: false
+            capabilities:
+              drop:
+                - ALL
+            privileged: false
             readOnlyRootFilesystem: true
+            runAsGroup: 1001
             runAsNonRoot: true
             runAsUser: 1001
+            seLinuxOptions: {}
+            seccompProfile:
+              type: RuntimeDefault
           args:
             - compact
             - --log.level=info
@@ -410,30 +589,31 @@
 kind: Deployment
 metadata:
   name: thanos-query
-  namespace: "default"
+  namespace: default
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: query
 spec:
   replicas: 1
+  revisionHistoryLimit: 10
   strategy:
     type: RollingUpdate
   selector:
     matchLabels:
-      app.kubernetes.io/name: thanos
       app.kubernetes.io/instance: thanos
+      app.kubernetes.io/name: thanos
       app.kubernetes.io/component: query
   template:
     metadata:
       labels:
-        app.kubernetes.io/name: thanos
         app.kubernetes.io/instance: thanos
         app.kubernetes.io/managed-by: Helm
+        app.kubernetes.io/name: thanos
         app.kubernetes.io/component: query
     spec:
-      serviceAccount: thanos-query
+      serviceAccountName: thanos-query
       automountServiceAccountToken: true
       affinity:
         podAffinity:
@@ -442,25 +622,34 @@
             - podAffinityTerm:
                 labelSelector:
                   matchLabels:
-                    app.kubernetes.io/name: thanos
                     app.kubernetes.io/instance: thanos
+                    app.kubernetes.io/name: thanos
                     app.kubernetes.io/component: query
-                namespaces:
-                  - "default"
                 topologyKey: kubernetes.io/hostname
               weight: 1
         nodeAffinity:
       securityContext:
         fsGroup: 1001
+        fsGroupChangePolicy: Always
+        supplementalGroups: []
+        sysctls: []
       containers:
         - name: query
-          image: public.ecr.aws/bitnami/thanos:0.28.1-scratch-r0
+          image: public.ecr.aws/bitnami/thanos:0.36.1-debian-12-r5
           imagePullPolicy: "IfNotPresent"
           securityContext:
             allowPrivilegeEscalation: false
+            capabilities:
+              drop:
+                - ALL
+            privileged: false
             readOnlyRootFilesystem: true
+            runAsGroup: 1001
             runAsNonRoot: true
             runAsUser: 1001
+            seLinuxOptions: {}
+            seccompProfile:
+              type: RuntimeDefault
           args:
             - query
             - --log.level=info
@@ -470,6 +659,7 @@
             - --query.replica-label=replica
             - --endpoint=dnssrv+_grpc._tcp.prometheus-thanos-discovery.monitoring.svc.cluster.local
             - --endpoint=dnssrv+_grpc._tcp.thanos-storegateway.default.svc.cluster.local
+            - --alert.query-url=http://thanos-query.default.svc.cluster.local:9090
           ports:
             - name: http
               containerPort: 10902
@@ -498,8 +688,14 @@
               port: http
               scheme: HTTP
           resources:
-            limits: {}
-            requests: {}
+            limits:
+              cpu: 150m
+              ephemeral-storage: 2Gi
+              memory: 192Mi
+            requests:
+              cpu: 100m
+              ephemeral-storage: 50Mi
+              memory: 128Mi
           volumeMounts:
       volumes:
 ---
@@ -508,34 +704,33 @@
 kind: StatefulSet
 metadata:
   name: thanos-storegateway
-  namespace: "default"
+  namespace: default
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: storegateway
 spec:
   replicas: 1
+  revisionHistoryLimit: 10
   podManagementPolicy: OrderedReady
   serviceName: thanos-storegateway-headless
   updateStrategy:
     type: RollingUpdate
   selector:
     matchLabels:
-      app.kubernetes.io/name: thanos
       app.kubernetes.io/instance: thanos
+      app.kubernetes.io/name: thanos
       app.kubernetes.io/component: storegateway
   template:
     metadata:
       labels:
-        app.kubernetes.io/name: thanos
         app.kubernetes.io/instance: thanos
         app.kubernetes.io/managed-by: Helm
+        app.kubernetes.io/name: thanos
         app.kubernetes.io/component: storegateway
-      annotations:
-        checksum/objstore-configuration: 01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b
     spec:
-      serviceAccount: thanos-storegateway
+      serviceAccountName: thanos-storegateway
       automountServiceAccountToken: true
       affinity:
         podAffinity:
@@ -544,25 +739,34 @@
             - podAffinityTerm:
                 labelSelector:
                   matchLabels:
-                    app.kubernetes.io/name: thanos
                     app.kubernetes.io/instance: thanos
+                    app.kubernetes.io/name: thanos
                     app.kubernetes.io/component: storegateway
-                namespaces:
-                  - "default"
                 topologyKey: kubernetes.io/hostname
               weight: 1
         nodeAffinity:
       securityContext:
         fsGroup: 1001
+        fsGroupChangePolicy: Always
+        supplementalGroups: []
+        sysctls: []
       containers:
         - name: storegateway
-          image: public.ecr.aws/bitnami/thanos:0.28.1-scratch-r0
+          image: public.ecr.aws/bitnami/thanos:0.36.1-debian-12-r5
           imagePullPolicy: "IfNotPresent"
           securityContext:
             allowPrivilegeEscalation: false
+            capabilities:
+              drop:
+                - ALL
+            privileged: false
             readOnlyRootFilesystem: true
+            runAsGroup: 1001
             runAsNonRoot: true
             runAsUser: 1001
+            seLinuxOptions: {}
+            seccompProfile:
+              type: RuntimeDefault
           args:
             - store
             - --log.level=info
@@ -599,8 +803,14 @@
               port: http
               scheme: HTTP
           resources:
-            limits: {}
-            requests: {}
+            limits:
+              cpu: 150m
+              ephemeral-storage: 2Gi
+              memory: 192Mi
+            requests:
+              cpu: 100m
+              ephemeral-storage: 50Mi
+              memory: 128Mi
           volumeMounts:
             - name: objstore-config
               mountPath: /conf
@@ -611,7 +821,9 @@
           secret:
             secretName: thanos-objstore
   volumeClaimTemplates:
-    - metadata:
+    - apiVersion: v1
+      kind: PersistentVolumeClaim
+      metadata:
         name: data
       spec:
         accessModes:
@@ -625,11 +837,11 @@
 kind: Ingress
 metadata:
   name: thanos-query
-  namespace: "default"
+  namespace: default
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: query
   annotations:
     app: thanos
@@ -655,9 +867,9 @@
   name: thanos-bucketweb
   namespace: "default"
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: bucketweb
 spec:
   endpoints:
@@ -667,9 +879,10 @@
       - "default"
   selector:
     matchLabels:
-      app.kubernetes.io/name: thanos
       app.kubernetes.io/instance: thanos
+      app.kubernetes.io/name: thanos
       app.kubernetes.io/component: bucketweb
+      prometheus-operator/monitor: 'true'
 ---
 # Source: thanos/templates/compactor/servicemonitor.yaml
 apiVersion: monitoring.coreos.com/v1
@@ -678,9 +891,9 @@
   name: thanos-compactor
   namespace: "default"
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: compactor
 spec:
   endpoints:
@@ -690,9 +903,10 @@
       - "default"
   selector:
     matchLabels:
-      app.kubernetes.io/name: thanos
       app.kubernetes.io/instance: thanos
+      app.kubernetes.io/name: thanos
       app.kubernetes.io/component: compactor
+      prometheus-operator/monitor: 'true'
 ---
 # Source: thanos/templates/query/servicemonitor.yaml
 apiVersion: monitoring.coreos.com/v1
@@ -701,9 +915,9 @@
   name: thanos-query
   namespace: "default"
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: query
 spec:
   endpoints:
@@ -713,9 +927,10 @@
       - "default"
   selector:
     matchLabels:
-      app.kubernetes.io/name: thanos
       app.kubernetes.io/instance: thanos
+      app.kubernetes.io/name: thanos
       app.kubernetes.io/component: query
+      prometheus-operator/monitor: 'true'
 ---
 # Source: thanos/templates/storegateway/servicemonitor.yaml
 apiVersion: monitoring.coreos.com/v1
@@ -724,9 +939,9 @@
   name: thanos-storegateway
   namespace: "default"
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: storegateway
 spec:
   endpoints:
@@ -736,6 +951,7 @@
       - "default"
   selector:
     matchLabels:
-      app.kubernetes.io/name: thanos
       app.kubernetes.io/instance: thanos
+      app.kubernetes.io/name: thanos
       app.kubernetes.io/component: storegateway
+      prometheus-operator/monitor: 'true'

@renovate renovate bot force-pushed the renovate/thanos-15.x branch from 9db1fe6 to fa93d1b Compare November 26, 2024 19:01
@github-actions GitHub Actions
Copy link

Path: cluster/core/monitoring/thanos/helm-release.yaml
Version: 11.5.5 -> 15.8.2

@@ -1,71 +1,236 @@
+# Source: thanos/templates/bucketweb/networkpolicy.yaml
+kind: NetworkPolicy
+apiVersion: networking.k8s.io/v1
+metadata:
+  name: thanos-bucketweb
+  namespace: "default"
+  labels:
+    app.kubernetes.io/instance: thanos
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
+    app.kubernetes.io/component: bucketweb
+spec:
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/instance: thanos
+      app.kubernetes.io/name: thanos
+      app.kubernetes.io/component: bucketweb
+  policyTypes:
+    - Ingress
+    - Egress
+  egress:
+    - {}
+  ingress:
+    - ports:
+        - port: 8080
+        - port: 8080
+---
+# Source: thanos/templates/compactor/networkpolicy.yaml
+kind: NetworkPolicy
+apiVersion: networking.k8s.io/v1
+metadata:
+  name: thanos-compactor
+  namespace: "default"
+  labels:
+    app.kubernetes.io/instance: thanos
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
+    app.kubernetes.io/component: compactor
+spec:
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/instance: thanos
+      app.kubernetes.io/name: thanos
+      app.kubernetes.io/component: compactor
+  policyTypes:
+    - Ingress
+    - Egress
+  egress:
+    - {}
+  ingress:
+    - ports:
+        - port: 10902
+        - port: 9090
+---
+# Source: thanos/templates/query/networkpolicy.yaml
+kind: NetworkPolicy
+apiVersion: networking.k8s.io/v1
+metadata:
+  name: thanos-query
+  namespace: "default"
+  labels:
+    app.kubernetes.io/instance: thanos
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
+    app.kubernetes.io/component: query
+spec:
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/instance: thanos
+      app.kubernetes.io/name: thanos
+      app.kubernetes.io/component: query
+  policyTypes:
+    - Ingress
+    - Egress
+  egress:
+    - {}
+  ingress:
+    - ports:
+        - port: 10902
+        - port: 10901
+        - port: 9090
+        - port: 10901
+---
+# Source: thanos/templates/storegateway/networkpolicy.yaml
+kind: NetworkPolicy
+apiVersion: networking.k8s.io/v1
+metadata:
+  name: thanos-storegateway
+  namespace: "default"
+  labels:
+    app.kubernetes.io/instance: thanos
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
+    app.kubernetes.io/component: storegateway
+spec:
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/instance: thanos
+      app.kubernetes.io/name: thanos
+      app.kubernetes.io/component: storegateway
+  policyTypes:
+    - Ingress
+    - Egress
+  egress:
+    - {}
+  ingress:
+    - ports:
+        - port: 10902
+        - port: 9090
+        - port: 10901
+        - port: 10901
+---
+# Source: thanos/templates/bucketweb/pdb.yaml
+apiVersion: policy/v1
+kind: PodDisruptionBudget
+metadata:
+  name: thanos-bucketweb
+  namespace: default
+  labels:
+    app.kubernetes.io/instance: thanos
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
+    app.kubernetes.io/component: bucketweb
+spec:
+  maxUnavailable: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/instance: thanos
+      app.kubernetes.io/name: thanos
+      app.kubernetes.io/component: bucketweb
+---
+# Source: thanos/templates/query/pdb.yaml
+apiVersion: policy/v1
+kind: PodDisruptionBudget
+metadata:
+  name: thanos-query
+  namespace: default
+  labels:
+    app.kubernetes.io/instance: thanos
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
+    app.kubernetes.io/component: query
+spec:
+  maxUnavailable: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/instance: thanos
+      app.kubernetes.io/name: thanos
+      app.kubernetes.io/component: query
+---
+# Source: thanos/templates/storegateway/pdb.yaml
+apiVersion: policy/v1
+kind: PodDisruptionBudget
+metadata:
+  name: thanos-storegateway
+  namespace: default
+  labels:
+    app.kubernetes.io/instance: thanos
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
+    app.kubernetes.io/component: storegateway
+spec:
+  maxUnavailable: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/instance: thanos
+      app.kubernetes.io/name: thanos
+      app.kubernetes.io/component: storegateway
+---
 # Source: thanos/templates/bucketweb/serviceaccount.yaml
 apiVersion: v1
 kind: ServiceAccount
 metadata:
   name: thanos-bucketweb
-  namespace: "default"
+  namespace: default
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: bucketweb
-  annotations:
-automountServiceAccountToken: true
+automountServiceAccountToken: false
 ---
 # Source: thanos/templates/compactor/serviceaccount.yaml
 apiVersion: v1
 kind: ServiceAccount
 metadata:
   name: thanos-compactor
-  namespace: "default"
+  namespace: default
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: compactor
-  annotations:
-automountServiceAccountToken: true
+automountServiceAccountToken: false
 ---
 # Source: thanos/templates/query/serviceaccount.yaml
 apiVersion: v1
 kind: ServiceAccount
 metadata:
   name: thanos-query
-  namespace: "default"
+  namespace: default
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: query
-  annotations:
-automountServiceAccountToken: true
+automountServiceAccountToken: false
 ---
 # Source: thanos/templates/storegateway/serviceaccount.yaml
 apiVersion: v1
 kind: ServiceAccount
 metadata:
   name: thanos-storegateway
-  namespace: "default"
+  namespace: default
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: storegateway
-  annotations:
-automountServiceAccountToken: true
+automountServiceAccountToken: false
 ---
 # Source: thanos/templates/bucketweb/service.yaml
 apiVersion: v1
 kind: Service
 metadata:
   name: thanos-bucketweb
-  namespace: "default"
+  namespace: default
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: bucketweb
-  annotations:
+    prometheus-operator/monitor: 'true'
 spec:
   type: ClusterIP
   ports:
@@ -75,8 +240,8 @@
       name: http
       nodePort: null
   selector:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: bucketweb
 ---
 # Source: thanos/templates/compactor/service.yaml
@@ -84,13 +249,13 @@
 kind: Service
 metadata:
   name: thanos-compactor
-  namespace: "default"
+  namespace: default
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: compactor
-  annotations:
+    prometheus-operator/monitor: 'true'
 spec:
   type: ClusterIP
   ports:
@@ -100,8 +265,8 @@
       name: http
       nodePort: null
   selector:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: compactor
 ---
 # Source: thanos/templates/query/service-grpc.yaml
@@ -109,13 +274,12 @@
 kind: Service
 metadata:
   name: thanos-query-grpc
-  namespace: "default"
+  namespace: default
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: query
-  annotations:
 spec:
   type: ClusterIP
   ports:
@@ -125,8 +289,8 @@
       name: grpc
       nodePort: null
   selector:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: query
 ---
 # Source: thanos/templates/query/service.yaml
@@ -134,13 +298,13 @@
 kind: Service
 metadata:
   name: thanos-query
-  namespace: "default"
+  namespace: default
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: query
-  annotations:
+    prometheus-operator/monitor: 'true'
 spec:
   type: ClusterIP
   ports:
@@ -150,8 +314,8 @@
       name: http
       nodePort: null
   selector:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: query
 ---
 # Source: thanos/templates/storegateway/service.yaml
@@ -159,14 +323,13 @@
 kind: Service
 metadata:
   name: thanos-storegateway
-  namespace: "default"
+  namespace: default
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: storegateway
     prometheus-operator/monitor: 'true'
-  annotations:
 spec:
   type: ClusterIP
   ports:
@@ -181,8 +344,8 @@
       name: grpc
       nodePort: null
   selector:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: storegateway
 ---
 # Source: thanos/templates/bucketweb/deployment.yaml
@@ -190,32 +353,31 @@
 kind: Deployment
 metadata:
   name: thanos-bucketweb
-  namespace: "default"
+  namespace: default
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: bucketweb
 spec:
   replicas: 1
+  revisionHistoryLimit: 10
   strategy:
     type: RollingUpdate
   selector:
     matchLabels:
-      app.kubernetes.io/name: thanos
       app.kubernetes.io/instance: thanos
+      app.kubernetes.io/name: thanos
       app.kubernetes.io/component: bucketweb
   template:
     metadata:
       labels:
-        app.kubernetes.io/name: thanos
         app.kubernetes.io/instance: thanos
         app.kubernetes.io/managed-by: Helm
+        app.kubernetes.io/name: thanos
         app.kubernetes.io/component: bucketweb
-      annotations:
-        checksum/objstore-configuration: 01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b
     spec:
-      serviceAccount: thanos-bucketweb
+      serviceAccountName: thanos-bucketweb
       automountServiceAccountToken: true
       affinity:
         podAffinity:
@@ -224,25 +386,34 @@
             - podAffinityTerm:
                 labelSelector:
                   matchLabels:
-                    app.kubernetes.io/name: thanos
                     app.kubernetes.io/instance: thanos
+                    app.kubernetes.io/name: thanos
                     app.kubernetes.io/component: bucketweb
-                namespaces:
-                  - "default"
                 topologyKey: kubernetes.io/hostname
               weight: 1
         nodeAffinity:
       securityContext:
         fsGroup: 1001
+        fsGroupChangePolicy: Always
+        supplementalGroups: []
+        sysctls: []
       containers:
         - name: bucketweb
-          image: public.ecr.aws/bitnami/thanos:0.28.1-scratch-r0
+          image: public.ecr.aws/bitnami/thanos:0.37.0-debian-12-r0
           imagePullPolicy: "IfNotPresent"
           securityContext:
             allowPrivilegeEscalation: false
+            capabilities:
+              drop:
+                - ALL
+            privileged: false
             readOnlyRootFilesystem: true
+            runAsGroup: 1001
             runAsNonRoot: true
             runAsUser: 1001
+            seLinuxOptions: {}
+            seccompProfile:
+              type: RuntimeDefault
           args:
             - tools
             - bucket
@@ -297,32 +468,31 @@
 kind: Deployment
 metadata:
   name: thanos-compactor
-  namespace: "default"
+  namespace: default
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: compactor
 spec:
   replicas: 1
+  revisionHistoryLimit: 10
   strategy:
     type: Recreate
   selector:
     matchLabels:
-      app.kubernetes.io/name: thanos
       app.kubernetes.io/instance: thanos
+      app.kubernetes.io/name: thanos
       app.kubernetes.io/component: compactor
   template:
     metadata:
       labels:
-        app.kubernetes.io/name: thanos
         app.kubernetes.io/instance: thanos
         app.kubernetes.io/managed-by: Helm
+        app.kubernetes.io/name: thanos
         app.kubernetes.io/component: compactor
-      annotations:
-        checksum/objstore-configuration: 01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b
     spec:
-      serviceAccount: thanos-compactor
+      serviceAccountName: thanos-compactor
       automountServiceAccountToken: true
       affinity:
         podAffinity:
@@ -331,25 +501,34 @@
             - podAffinityTerm:
                 labelSelector:
                   matchLabels:
-                    app.kubernetes.io/name: thanos
                     app.kubernetes.io/instance: thanos
+                    app.kubernetes.io/name: thanos
                     app.kubernetes.io/component: compactor
-                namespaces:
-                  - "default"
                 topologyKey: kubernetes.io/hostname
               weight: 1
         nodeAffinity:
       securityContext:
         fsGroup: 1001
+        fsGroupChangePolicy: Always
+        supplementalGroups: []
+        sysctls: []
       containers:
         - name: compactor
-          image: public.ecr.aws/bitnami/thanos:0.28.1-scratch-r0
+          image: public.ecr.aws/bitnami/thanos:0.37.0-debian-12-r0
           imagePullPolicy: "IfNotPresent"
           securityContext:
             allowPrivilegeEscalation: false
+            capabilities:
+              drop:
+                - ALL
+            privileged: false
             readOnlyRootFilesystem: true
+            runAsGroup: 1001
             runAsNonRoot: true
             runAsUser: 1001
+            seLinuxOptions: {}
+            seccompProfile:
+              type: RuntimeDefault
           args:
             - compact
             - --log.level=info
@@ -410,30 +589,31 @@
 kind: Deployment
 metadata:
   name: thanos-query
-  namespace: "default"
+  namespace: default
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: query
 spec:
   replicas: 1
+  revisionHistoryLimit: 10
   strategy:
     type: RollingUpdate
   selector:
     matchLabels:
-      app.kubernetes.io/name: thanos
       app.kubernetes.io/instance: thanos
+      app.kubernetes.io/name: thanos
       app.kubernetes.io/component: query
   template:
     metadata:
       labels:
-        app.kubernetes.io/name: thanos
         app.kubernetes.io/instance: thanos
         app.kubernetes.io/managed-by: Helm
+        app.kubernetes.io/name: thanos
         app.kubernetes.io/component: query
     spec:
-      serviceAccount: thanos-query
+      serviceAccountName: thanos-query
       automountServiceAccountToken: true
       affinity:
         podAffinity:
@@ -442,25 +622,34 @@
             - podAffinityTerm:
                 labelSelector:
                   matchLabels:
-                    app.kubernetes.io/name: thanos
                     app.kubernetes.io/instance: thanos
+                    app.kubernetes.io/name: thanos
                     app.kubernetes.io/component: query
-                namespaces:
-                  - "default"
                 topologyKey: kubernetes.io/hostname
               weight: 1
         nodeAffinity:
       securityContext:
         fsGroup: 1001
+        fsGroupChangePolicy: Always
+        supplementalGroups: []
+        sysctls: []
       containers:
         - name: query
-          image: public.ecr.aws/bitnami/thanos:0.28.1-scratch-r0
+          image: public.ecr.aws/bitnami/thanos:0.37.0-debian-12-r0
           imagePullPolicy: "IfNotPresent"
           securityContext:
             allowPrivilegeEscalation: false
+            capabilities:
+              drop:
+                - ALL
+            privileged: false
             readOnlyRootFilesystem: true
+            runAsGroup: 1001
             runAsNonRoot: true
             runAsUser: 1001
+            seLinuxOptions: {}
+            seccompProfile:
+              type: RuntimeDefault
           args:
             - query
             - --log.level=info
@@ -470,6 +659,7 @@
             - --query.replica-label=replica
             - --endpoint=dnssrv+_grpc._tcp.prometheus-thanos-discovery.monitoring.svc.cluster.local
             - --endpoint=dnssrv+_grpc._tcp.thanos-storegateway.default.svc.cluster.local
+            - --alert.query-url=http://thanos-query.default.svc.cluster.local:9090
           ports:
             - name: http
               containerPort: 10902
@@ -498,8 +688,14 @@
               port: http
               scheme: HTTP
           resources:
-            limits: {}
-            requests: {}
+            limits:
+              cpu: 150m
+              ephemeral-storage: 2Gi
+              memory: 192Mi
+            requests:
+              cpu: 100m
+              ephemeral-storage: 50Mi
+              memory: 128Mi
           volumeMounts:
       volumes:
 ---
@@ -508,34 +704,33 @@
 kind: StatefulSet
 metadata:
   name: thanos-storegateway
-  namespace: "default"
+  namespace: default
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: storegateway
 spec:
   replicas: 1
+  revisionHistoryLimit: 10
   podManagementPolicy: OrderedReady
   serviceName: thanos-storegateway-headless
   updateStrategy:
     type: RollingUpdate
   selector:
     matchLabels:
-      app.kubernetes.io/name: thanos
       app.kubernetes.io/instance: thanos
+      app.kubernetes.io/name: thanos
       app.kubernetes.io/component: storegateway
   template:
     metadata:
       labels:
-        app.kubernetes.io/name: thanos
         app.kubernetes.io/instance: thanos
         app.kubernetes.io/managed-by: Helm
+        app.kubernetes.io/name: thanos
         app.kubernetes.io/component: storegateway
-      annotations:
-        checksum/objstore-configuration: 01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b
     spec:
-      serviceAccount: thanos-storegateway
+      serviceAccountName: thanos-storegateway
       automountServiceAccountToken: true
       affinity:
         podAffinity:
@@ -544,25 +739,34 @@
             - podAffinityTerm:
                 labelSelector:
                   matchLabels:
-                    app.kubernetes.io/name: thanos
                     app.kubernetes.io/instance: thanos
+                    app.kubernetes.io/name: thanos
                     app.kubernetes.io/component: storegateway
-                namespaces:
-                  - "default"
                 topologyKey: kubernetes.io/hostname
               weight: 1
         nodeAffinity:
       securityContext:
         fsGroup: 1001
+        fsGroupChangePolicy: Always
+        supplementalGroups: []
+        sysctls: []
       containers:
         - name: storegateway
-          image: public.ecr.aws/bitnami/thanos:0.28.1-scratch-r0
+          image: public.ecr.aws/bitnami/thanos:0.37.0-debian-12-r0
           imagePullPolicy: "IfNotPresent"
           securityContext:
             allowPrivilegeEscalation: false
+            capabilities:
+              drop:
+                - ALL
+            privileged: false
             readOnlyRootFilesystem: true
+            runAsGroup: 1001
             runAsNonRoot: true
             runAsUser: 1001
+            seLinuxOptions: {}
+            seccompProfile:
+              type: RuntimeDefault
           args:
             - store
             - --log.level=info
@@ -599,8 +803,14 @@
               port: http
               scheme: HTTP
           resources:
-            limits: {}
-            requests: {}
+            limits:
+              cpu: 150m
+              ephemeral-storage: 2Gi
+              memory: 192Mi
+            requests:
+              cpu: 100m
+              ephemeral-storage: 50Mi
+              memory: 128Mi
           volumeMounts:
             - name: objstore-config
               mountPath: /conf
@@ -611,7 +821,9 @@
           secret:
             secretName: thanos-objstore
   volumeClaimTemplates:
-    - metadata:
+    - apiVersion: v1
+      kind: PersistentVolumeClaim
+      metadata:
         name: data
       spec:
         accessModes:
@@ -625,11 +837,11 @@
 kind: Ingress
 metadata:
   name: thanos-query
-  namespace: "default"
+  namespace: default
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: query
   annotations:
     app: thanos
@@ -655,9 +867,9 @@
   name: thanos-bucketweb
   namespace: "default"
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: bucketweb
 spec:
   endpoints:
@@ -667,9 +879,10 @@
       - "default"
   selector:
     matchLabels:
-      app.kubernetes.io/name: thanos
       app.kubernetes.io/instance: thanos
+      app.kubernetes.io/name: thanos
       app.kubernetes.io/component: bucketweb
+      prometheus-operator/monitor: 'true'
 ---
 # Source: thanos/templates/compactor/servicemonitor.yaml
 apiVersion: monitoring.coreos.com/v1
@@ -678,9 +891,9 @@
   name: thanos-compactor
   namespace: "default"
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: compactor
 spec:
   endpoints:
@@ -690,9 +903,10 @@
       - "default"
   selector:
     matchLabels:
-      app.kubernetes.io/name: thanos
       app.kubernetes.io/instance: thanos
+      app.kubernetes.io/name: thanos
       app.kubernetes.io/component: compactor
+      prometheus-operator/monitor: 'true'
 ---
 # Source: thanos/templates/query/servicemonitor.yaml
 apiVersion: monitoring.coreos.com/v1
@@ -701,9 +915,9 @@
   name: thanos-query
   namespace: "default"
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: query
 spec:
   endpoints:
@@ -713,9 +927,10 @@
       - "default"
   selector:
     matchLabels:
-      app.kubernetes.io/name: thanos
       app.kubernetes.io/instance: thanos
+      app.kubernetes.io/name: thanos
       app.kubernetes.io/component: query
+      prometheus-operator/monitor: 'true'
 ---
 # Source: thanos/templates/storegateway/servicemonitor.yaml
 apiVersion: monitoring.coreos.com/v1
@@ -724,9 +939,9 @@
   name: thanos-storegateway
   namespace: "default"
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: storegateway
 spec:
   endpoints:
@@ -736,6 +951,7 @@
       - "default"
   selector:
     matchLabels:
-      app.kubernetes.io/name: thanos
       app.kubernetes.io/instance: thanos
+      app.kubernetes.io/name: thanos
       app.kubernetes.io/component: storegateway
+      prometheus-operator/monitor: 'true'

@renovate renovate bot changed the title feat(charts)!: Update Helm release thanos to 15.8.1 feat(charts)!: Update Helm release thanos to 15.8.2 Nov 26, 2024
@renovate renovate bot force-pushed the renovate/thanos-15.x branch from fa93d1b to f50c9a5 Compare December 4, 2024 10:07
@renovate renovate bot changed the title feat(charts)!: Update Helm release thanos to 15.8.2 feat(charts)!: Update Helm release thanos to 15.8.3 Dec 4, 2024
@github-actions GitHub Actions
Copy link

github-actions bot commented Dec 4, 2024

Path: cluster/core/monitoring/thanos/helm-release.yaml
Version: 11.5.5 -> 15.8.3

@@ -1,71 +1,236 @@
+# Source: thanos/templates/bucketweb/networkpolicy.yaml
+kind: NetworkPolicy
+apiVersion: networking.k8s.io/v1
+metadata:
+  name: thanos-bucketweb
+  namespace: "default"
+  labels:
+    app.kubernetes.io/instance: thanos
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
+    app.kubernetes.io/component: bucketweb
+spec:
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/instance: thanos
+      app.kubernetes.io/name: thanos
+      app.kubernetes.io/component: bucketweb
+  policyTypes:
+    - Ingress
+    - Egress
+  egress:
+    - {}
+  ingress:
+    - ports:
+        - port: 8080
+        - port: 8080
+---
+# Source: thanos/templates/compactor/networkpolicy.yaml
+kind: NetworkPolicy
+apiVersion: networking.k8s.io/v1
+metadata:
+  name: thanos-compactor
+  namespace: "default"
+  labels:
+    app.kubernetes.io/instance: thanos
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
+    app.kubernetes.io/component: compactor
+spec:
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/instance: thanos
+      app.kubernetes.io/name: thanos
+      app.kubernetes.io/component: compactor
+  policyTypes:
+    - Ingress
+    - Egress
+  egress:
+    - {}
+  ingress:
+    - ports:
+        - port: 10902
+        - port: 9090
+---
+# Source: thanos/templates/query/networkpolicy.yaml
+kind: NetworkPolicy
+apiVersion: networking.k8s.io/v1
+metadata:
+  name: thanos-query
+  namespace: "default"
+  labels:
+    app.kubernetes.io/instance: thanos
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
+    app.kubernetes.io/component: query
+spec:
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/instance: thanos
+      app.kubernetes.io/name: thanos
+      app.kubernetes.io/component: query
+  policyTypes:
+    - Ingress
+    - Egress
+  egress:
+    - {}
+  ingress:
+    - ports:
+        - port: 10902
+        - port: 10901
+        - port: 9090
+        - port: 10901
+---
+# Source: thanos/templates/storegateway/networkpolicy.yaml
+kind: NetworkPolicy
+apiVersion: networking.k8s.io/v1
+metadata:
+  name: thanos-storegateway
+  namespace: "default"
+  labels:
+    app.kubernetes.io/instance: thanos
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
+    app.kubernetes.io/component: storegateway
+spec:
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/instance: thanos
+      app.kubernetes.io/name: thanos
+      app.kubernetes.io/component: storegateway
+  policyTypes:
+    - Ingress
+    - Egress
+  egress:
+    - {}
+  ingress:
+    - ports:
+        - port: 10902
+        - port: 9090
+        - port: 10901
+        - port: 10901
+---
+# Source: thanos/templates/bucketweb/pdb.yaml
+apiVersion: policy/v1
+kind: PodDisruptionBudget
+metadata:
+  name: thanos-bucketweb
+  namespace: default
+  labels:
+    app.kubernetes.io/instance: thanos
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
+    app.kubernetes.io/component: bucketweb
+spec:
+  maxUnavailable: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/instance: thanos
+      app.kubernetes.io/name: thanos
+      app.kubernetes.io/component: bucketweb
+---
+# Source: thanos/templates/query/pdb.yaml
+apiVersion: policy/v1
+kind: PodDisruptionBudget
+metadata:
+  name: thanos-query
+  namespace: default
+  labels:
+    app.kubernetes.io/instance: thanos
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
+    app.kubernetes.io/component: query
+spec:
+  maxUnavailable: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/instance: thanos
+      app.kubernetes.io/name: thanos
+      app.kubernetes.io/component: query
+---
+# Source: thanos/templates/storegateway/pdb.yaml
+apiVersion: policy/v1
+kind: PodDisruptionBudget
+metadata:
+  name: thanos-storegateway
+  namespace: default
+  labels:
+    app.kubernetes.io/instance: thanos
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
+    app.kubernetes.io/component: storegateway
+spec:
+  maxUnavailable: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/instance: thanos
+      app.kubernetes.io/name: thanos
+      app.kubernetes.io/component: storegateway
+---
 # Source: thanos/templates/bucketweb/serviceaccount.yaml
 apiVersion: v1
 kind: ServiceAccount
 metadata:
   name: thanos-bucketweb
-  namespace: "default"
+  namespace: default
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: bucketweb
-  annotations:
-automountServiceAccountToken: true
+automountServiceAccountToken: false
 ---
 # Source: thanos/templates/compactor/serviceaccount.yaml
 apiVersion: v1
 kind: ServiceAccount
 metadata:
   name: thanos-compactor
-  namespace: "default"
+  namespace: default
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: compactor
-  annotations:
-automountServiceAccountToken: true
+automountServiceAccountToken: false
 ---
 # Source: thanos/templates/query/serviceaccount.yaml
 apiVersion: v1
 kind: ServiceAccount
 metadata:
   name: thanos-query
-  namespace: "default"
+  namespace: default
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: query
-  annotations:
-automountServiceAccountToken: true
+automountServiceAccountToken: false
 ---
 # Source: thanos/templates/storegateway/serviceaccount.yaml
 apiVersion: v1
 kind: ServiceAccount
 metadata:
   name: thanos-storegateway
-  namespace: "default"
+  namespace: default
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: storegateway
-  annotations:
-automountServiceAccountToken: true
+automountServiceAccountToken: false
 ---
 # Source: thanos/templates/bucketweb/service.yaml
 apiVersion: v1
 kind: Service
 metadata:
   name: thanos-bucketweb
-  namespace: "default"
+  namespace: default
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: bucketweb
-  annotations:
+    prometheus-operator/monitor: 'true'
 spec:
   type: ClusterIP
   ports:
@@ -75,8 +240,8 @@
       name: http
       nodePort: null
   selector:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: bucketweb
 ---
 # Source: thanos/templates/compactor/service.yaml
@@ -84,13 +249,13 @@
 kind: Service
 metadata:
   name: thanos-compactor
-  namespace: "default"
+  namespace: default
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: compactor
-  annotations:
+    prometheus-operator/monitor: 'true'
 spec:
   type: ClusterIP
   ports:
@@ -100,8 +265,8 @@
       name: http
       nodePort: null
   selector:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: compactor
 ---
 # Source: thanos/templates/query/service-grpc.yaml
@@ -109,13 +274,12 @@
 kind: Service
 metadata:
   name: thanos-query-grpc
-  namespace: "default"
+  namespace: default
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: query
-  annotations:
 spec:
   type: ClusterIP
   ports:
@@ -125,8 +289,8 @@
       name: grpc
       nodePort: null
   selector:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: query
 ---
 # Source: thanos/templates/query/service.yaml
@@ -134,13 +298,13 @@
 kind: Service
 metadata:
   name: thanos-query
-  namespace: "default"
+  namespace: default
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: query
-  annotations:
+    prometheus-operator/monitor: 'true'
 spec:
   type: ClusterIP
   ports:
@@ -150,8 +314,8 @@
       name: http
       nodePort: null
   selector:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: query
 ---
 # Source: thanos/templates/storegateway/service.yaml
@@ -159,14 +323,13 @@
 kind: Service
 metadata:
   name: thanos-storegateway
-  namespace: "default"
+  namespace: default
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: storegateway
     prometheus-operator/monitor: 'true'
-  annotations:
 spec:
   type: ClusterIP
   ports:
@@ -181,8 +344,8 @@
       name: grpc
       nodePort: null
   selector:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: storegateway
 ---
 # Source: thanos/templates/bucketweb/deployment.yaml
@@ -190,32 +353,31 @@
 kind: Deployment
 metadata:
   name: thanos-bucketweb
-  namespace: "default"
+  namespace: default
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: bucketweb
 spec:
   replicas: 1
+  revisionHistoryLimit: 10
   strategy:
     type: RollingUpdate
   selector:
     matchLabels:
-      app.kubernetes.io/name: thanos
       app.kubernetes.io/instance: thanos
+      app.kubernetes.io/name: thanos
       app.kubernetes.io/component: bucketweb
   template:
     metadata:
       labels:
-        app.kubernetes.io/name: thanos
         app.kubernetes.io/instance: thanos
         app.kubernetes.io/managed-by: Helm
+        app.kubernetes.io/name: thanos
         app.kubernetes.io/component: bucketweb
-      annotations:
-        checksum/objstore-configuration: 01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b
     spec:
-      serviceAccount: thanos-bucketweb
+      serviceAccountName: thanos-bucketweb
       automountServiceAccountToken: true
       affinity:
         podAffinity:
@@ -224,25 +386,34 @@
             - podAffinityTerm:
                 labelSelector:
                   matchLabels:
-                    app.kubernetes.io/name: thanos
                     app.kubernetes.io/instance: thanos
+                    app.kubernetes.io/name: thanos
                     app.kubernetes.io/component: bucketweb
-                namespaces:
-                  - "default"
                 topologyKey: kubernetes.io/hostname
               weight: 1
         nodeAffinity:
       securityContext:
         fsGroup: 1001
+        fsGroupChangePolicy: Always
+        supplementalGroups: []
+        sysctls: []
       containers:
         - name: bucketweb
-          image: public.ecr.aws/bitnami/thanos:0.28.1-scratch-r0
+          image: public.ecr.aws/bitnami/thanos:0.37.0-debian-12-r1
           imagePullPolicy: "IfNotPresent"
           securityContext:
             allowPrivilegeEscalation: false
+            capabilities:
+              drop:
+                - ALL
+            privileged: false
             readOnlyRootFilesystem: true
+            runAsGroup: 1001
             runAsNonRoot: true
             runAsUser: 1001
+            seLinuxOptions: {}
+            seccompProfile:
+              type: RuntimeDefault
           args:
             - tools
             - bucket
@@ -297,32 +468,31 @@
 kind: Deployment
 metadata:
   name: thanos-compactor
-  namespace: "default"
+  namespace: default
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: compactor
 spec:
   replicas: 1
+  revisionHistoryLimit: 10
   strategy:
     type: Recreate
   selector:
     matchLabels:
-      app.kubernetes.io/name: thanos
       app.kubernetes.io/instance: thanos
+      app.kubernetes.io/name: thanos
       app.kubernetes.io/component: compactor
   template:
     metadata:
       labels:
-        app.kubernetes.io/name: thanos
         app.kubernetes.io/instance: thanos
         app.kubernetes.io/managed-by: Helm
+        app.kubernetes.io/name: thanos
         app.kubernetes.io/component: compactor
-      annotations:
-        checksum/objstore-configuration: 01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b
     spec:
-      serviceAccount: thanos-compactor
+      serviceAccountName: thanos-compactor
       automountServiceAccountToken: true
       affinity:
         podAffinity:
@@ -331,25 +501,34 @@
             - podAffinityTerm:
                 labelSelector:
                   matchLabels:
-                    app.kubernetes.io/name: thanos
                     app.kubernetes.io/instance: thanos
+                    app.kubernetes.io/name: thanos
                     app.kubernetes.io/component: compactor
-                namespaces:
-                  - "default"
                 topologyKey: kubernetes.io/hostname
               weight: 1
         nodeAffinity:
       securityContext:
         fsGroup: 1001
+        fsGroupChangePolicy: Always
+        supplementalGroups: []
+        sysctls: []
       containers:
         - name: compactor
-          image: public.ecr.aws/bitnami/thanos:0.28.1-scratch-r0
+          image: public.ecr.aws/bitnami/thanos:0.37.0-debian-12-r1
           imagePullPolicy: "IfNotPresent"
           securityContext:
             allowPrivilegeEscalation: false
+            capabilities:
+              drop:
+                - ALL
+            privileged: false
             readOnlyRootFilesystem: true
+            runAsGroup: 1001
             runAsNonRoot: true
             runAsUser: 1001
+            seLinuxOptions: {}
+            seccompProfile:
+              type: RuntimeDefault
           args:
             - compact
             - --log.level=info
@@ -410,30 +589,31 @@
 kind: Deployment
 metadata:
   name: thanos-query
-  namespace: "default"
+  namespace: default
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: query
 spec:
   replicas: 1
+  revisionHistoryLimit: 10
   strategy:
     type: RollingUpdate
   selector:
     matchLabels:
-      app.kubernetes.io/name: thanos
       app.kubernetes.io/instance: thanos
+      app.kubernetes.io/name: thanos
       app.kubernetes.io/component: query
   template:
     metadata:
       labels:
-        app.kubernetes.io/name: thanos
         app.kubernetes.io/instance: thanos
         app.kubernetes.io/managed-by: Helm
+        app.kubernetes.io/name: thanos
         app.kubernetes.io/component: query
     spec:
-      serviceAccount: thanos-query
+      serviceAccountName: thanos-query
       automountServiceAccountToken: true
       affinity:
         podAffinity:
@@ -442,25 +622,34 @@
             - podAffinityTerm:
                 labelSelector:
                   matchLabels:
-                    app.kubernetes.io/name: thanos
                     app.kubernetes.io/instance: thanos
+                    app.kubernetes.io/name: thanos
                     app.kubernetes.io/component: query
-                namespaces:
-                  - "default"
                 topologyKey: kubernetes.io/hostname
               weight: 1
         nodeAffinity:
       securityContext:
         fsGroup: 1001
+        fsGroupChangePolicy: Always
+        supplementalGroups: []
+        sysctls: []
       containers:
         - name: query
-          image: public.ecr.aws/bitnami/thanos:0.28.1-scratch-r0
+          image: public.ecr.aws/bitnami/thanos:0.37.0-debian-12-r1
           imagePullPolicy: "IfNotPresent"
           securityContext:
             allowPrivilegeEscalation: false
+            capabilities:
+              drop:
+                - ALL
+            privileged: false
             readOnlyRootFilesystem: true
+            runAsGroup: 1001
             runAsNonRoot: true
             runAsUser: 1001
+            seLinuxOptions: {}
+            seccompProfile:
+              type: RuntimeDefault
           args:
             - query
             - --log.level=info
@@ -470,6 +659,7 @@
             - --query.replica-label=replica
             - --endpoint=dnssrv+_grpc._tcp.prometheus-thanos-discovery.monitoring.svc.cluster.local
             - --endpoint=dnssrv+_grpc._tcp.thanos-storegateway.default.svc.cluster.local
+            - --alert.query-url=http://thanos-query.default.svc.cluster.local:9090
           ports:
             - name: http
               containerPort: 10902
@@ -498,8 +688,14 @@
               port: http
               scheme: HTTP
           resources:
-            limits: {}
-            requests: {}
+            limits:
+              cpu: 150m
+              ephemeral-storage: 2Gi
+              memory: 192Mi
+            requests:
+              cpu: 100m
+              ephemeral-storage: 50Mi
+              memory: 128Mi
           volumeMounts:
       volumes:
 ---
@@ -508,34 +704,33 @@
 kind: StatefulSet
 metadata:
   name: thanos-storegateway
-  namespace: "default"
+  namespace: default
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: storegateway
 spec:
   replicas: 1
+  revisionHistoryLimit: 10
   podManagementPolicy: OrderedReady
   serviceName: thanos-storegateway-headless
   updateStrategy:
     type: RollingUpdate
   selector:
     matchLabels:
-      app.kubernetes.io/name: thanos
       app.kubernetes.io/instance: thanos
+      app.kubernetes.io/name: thanos
       app.kubernetes.io/component: storegateway
   template:
     metadata:
       labels:
-        app.kubernetes.io/name: thanos
         app.kubernetes.io/instance: thanos
         app.kubernetes.io/managed-by: Helm
+        app.kubernetes.io/name: thanos
         app.kubernetes.io/component: storegateway
-      annotations:
-        checksum/objstore-configuration: 01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b
     spec:
-      serviceAccount: thanos-storegateway
+      serviceAccountName: thanos-storegateway
       automountServiceAccountToken: true
       affinity:
         podAffinity:
@@ -544,25 +739,34 @@
             - podAffinityTerm:
                 labelSelector:
                   matchLabels:
-                    app.kubernetes.io/name: thanos
                     app.kubernetes.io/instance: thanos
+                    app.kubernetes.io/name: thanos
                     app.kubernetes.io/component: storegateway
-                namespaces:
-                  - "default"
                 topologyKey: kubernetes.io/hostname
               weight: 1
         nodeAffinity:
       securityContext:
         fsGroup: 1001
+        fsGroupChangePolicy: Always
+        supplementalGroups: []
+        sysctls: []
       containers:
         - name: storegateway
-          image: public.ecr.aws/bitnami/thanos:0.28.1-scratch-r0
+          image: public.ecr.aws/bitnami/thanos:0.37.0-debian-12-r1
           imagePullPolicy: "IfNotPresent"
           securityContext:
             allowPrivilegeEscalation: false
+            capabilities:
+              drop:
+                - ALL
+            privileged: false
             readOnlyRootFilesystem: true
+            runAsGroup: 1001
             runAsNonRoot: true
             runAsUser: 1001
+            seLinuxOptions: {}
+            seccompProfile:
+              type: RuntimeDefault
           args:
             - store
             - --log.level=info
@@ -599,8 +803,14 @@
               port: http
               scheme: HTTP
           resources:
-            limits: {}
-            requests: {}
+            limits:
+              cpu: 150m
+              ephemeral-storage: 2Gi
+              memory: 192Mi
+            requests:
+              cpu: 100m
+              ephemeral-storage: 50Mi
+              memory: 128Mi
           volumeMounts:
             - name: objstore-config
               mountPath: /conf
@@ -611,7 +821,9 @@
           secret:
             secretName: thanos-objstore
   volumeClaimTemplates:
-    - metadata:
+    - apiVersion: v1
+      kind: PersistentVolumeClaim
+      metadata:
         name: data
       spec:
         accessModes:
@@ -625,11 +837,11 @@
 kind: Ingress
 metadata:
   name: thanos-query
-  namespace: "default"
+  namespace: default
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: query
   annotations:
     app: thanos
@@ -655,9 +867,9 @@
   name: thanos-bucketweb
   namespace: "default"
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: bucketweb
 spec:
   endpoints:
@@ -667,9 +879,10 @@
       - "default"
   selector:
     matchLabels:
-      app.kubernetes.io/name: thanos
       app.kubernetes.io/instance: thanos
+      app.kubernetes.io/name: thanos
       app.kubernetes.io/component: bucketweb
+      prometheus-operator/monitor: 'true'
 ---
 # Source: thanos/templates/compactor/servicemonitor.yaml
 apiVersion: monitoring.coreos.com/v1
@@ -678,9 +891,9 @@
   name: thanos-compactor
   namespace: "default"
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: compactor
 spec:
   endpoints:
@@ -690,9 +903,10 @@
       - "default"
   selector:
     matchLabels:
-      app.kubernetes.io/name: thanos
       app.kubernetes.io/instance: thanos
+      app.kubernetes.io/name: thanos
       app.kubernetes.io/component: compactor
+      prometheus-operator/monitor: 'true'
 ---
 # Source: thanos/templates/query/servicemonitor.yaml
 apiVersion: monitoring.coreos.com/v1
@@ -701,9 +915,9 @@
   name: thanos-query
   namespace: "default"
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: query
 spec:
   endpoints:
@@ -713,9 +927,10 @@
       - "default"
   selector:
     matchLabels:
-      app.kubernetes.io/name: thanos
       app.kubernetes.io/instance: thanos
+      app.kubernetes.io/name: thanos
       app.kubernetes.io/component: query
+      prometheus-operator/monitor: 'true'
 ---
 # Source: thanos/templates/storegateway/servicemonitor.yaml
 apiVersion: monitoring.coreos.com/v1
@@ -724,9 +939,9 @@
   name: thanos-storegateway
   namespace: "default"
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: storegateway
 spec:
   endpoints:
@@ -736,6 +951,7 @@
       - "default"
   selector:
     matchLabels:
-      app.kubernetes.io/name: thanos
       app.kubernetes.io/instance: thanos
+      app.kubernetes.io/name: thanos
       app.kubernetes.io/component: storegateway
+      prometheus-operator/monitor: 'true'

@renovate renovate bot force-pushed the renovate/thanos-15.x branch from f50c9a5 to eaeb810 Compare December 4, 2024 15:49
@github-actions GitHub Actions
Copy link

github-actions bot commented Dec 4, 2024

Path: cluster/core/monitoring/thanos/helm-release.yaml
Version: 11.5.5 -> 15.8.4

@@ -1,71 +1,236 @@
+# Source: thanos/templates/bucketweb/networkpolicy.yaml
+kind: NetworkPolicy
+apiVersion: networking.k8s.io/v1
+metadata:
+  name: thanos-bucketweb
+  namespace: "default"
+  labels:
+    app.kubernetes.io/instance: thanos
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
+    app.kubernetes.io/component: bucketweb
+spec:
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/instance: thanos
+      app.kubernetes.io/name: thanos
+      app.kubernetes.io/component: bucketweb
+  policyTypes:
+    - Ingress
+    - Egress
+  egress:
+    - {}
+  ingress:
+    - ports:
+        - port: 8080
+        - port: 8080
+---
+# Source: thanos/templates/compactor/networkpolicy.yaml
+kind: NetworkPolicy
+apiVersion: networking.k8s.io/v1
+metadata:
+  name: thanos-compactor
+  namespace: "default"
+  labels:
+    app.kubernetes.io/instance: thanos
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
+    app.kubernetes.io/component: compactor
+spec:
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/instance: thanos
+      app.kubernetes.io/name: thanos
+      app.kubernetes.io/component: compactor
+  policyTypes:
+    - Ingress
+    - Egress
+  egress:
+    - {}
+  ingress:
+    - ports:
+        - port: 10902
+        - port: 9090
+---
+# Source: thanos/templates/query/networkpolicy.yaml
+kind: NetworkPolicy
+apiVersion: networking.k8s.io/v1
+metadata:
+  name: thanos-query
+  namespace: "default"
+  labels:
+    app.kubernetes.io/instance: thanos
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
+    app.kubernetes.io/component: query
+spec:
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/instance: thanos
+      app.kubernetes.io/name: thanos
+      app.kubernetes.io/component: query
+  policyTypes:
+    - Ingress
+    - Egress
+  egress:
+    - {}
+  ingress:
+    - ports:
+        - port: 10902
+        - port: 10901
+        - port: 9090
+        - port: 10901
+---
+# Source: thanos/templates/storegateway/networkpolicy.yaml
+kind: NetworkPolicy
+apiVersion: networking.k8s.io/v1
+metadata:
+  name: thanos-storegateway
+  namespace: "default"
+  labels:
+    app.kubernetes.io/instance: thanos
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
+    app.kubernetes.io/component: storegateway
+spec:
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/instance: thanos
+      app.kubernetes.io/name: thanos
+      app.kubernetes.io/component: storegateway
+  policyTypes:
+    - Ingress
+    - Egress
+  egress:
+    - {}
+  ingress:
+    - ports:
+        - port: 10902
+        - port: 9090
+        - port: 10901
+        - port: 10901
+---
+# Source: thanos/templates/bucketweb/pdb.yaml
+apiVersion: policy/v1
+kind: PodDisruptionBudget
+metadata:
+  name: thanos-bucketweb
+  namespace: default
+  labels:
+    app.kubernetes.io/instance: thanos
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
+    app.kubernetes.io/component: bucketweb
+spec:
+  maxUnavailable: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/instance: thanos
+      app.kubernetes.io/name: thanos
+      app.kubernetes.io/component: bucketweb
+---
+# Source: thanos/templates/query/pdb.yaml
+apiVersion: policy/v1
+kind: PodDisruptionBudget
+metadata:
+  name: thanos-query
+  namespace: default
+  labels:
+    app.kubernetes.io/instance: thanos
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
+    app.kubernetes.io/component: query
+spec:
+  maxUnavailable: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/instance: thanos
+      app.kubernetes.io/name: thanos
+      app.kubernetes.io/component: query
+---
+# Source: thanos/templates/storegateway/pdb.yaml
+apiVersion: policy/v1
+kind: PodDisruptionBudget
+metadata:
+  name: thanos-storegateway
+  namespace: default
+  labels:
+    app.kubernetes.io/instance: thanos
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
+    app.kubernetes.io/component: storegateway
+spec:
+  maxUnavailable: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/instance: thanos
+      app.kubernetes.io/name: thanos
+      app.kubernetes.io/component: storegateway
+---
 # Source: thanos/templates/bucketweb/serviceaccount.yaml
 apiVersion: v1
 kind: ServiceAccount
 metadata:
   name: thanos-bucketweb
-  namespace: "default"
+  namespace: default
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: bucketweb
-  annotations:
-automountServiceAccountToken: true
+automountServiceAccountToken: false
 ---
 # Source: thanos/templates/compactor/serviceaccount.yaml
 apiVersion: v1
 kind: ServiceAccount
 metadata:
   name: thanos-compactor
-  namespace: "default"
+  namespace: default
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: compactor
-  annotations:
-automountServiceAccountToken: true
+automountServiceAccountToken: false
 ---
 # Source: thanos/templates/query/serviceaccount.yaml
 apiVersion: v1
 kind: ServiceAccount
 metadata:
   name: thanos-query
-  namespace: "default"
+  namespace: default
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: query
-  annotations:
-automountServiceAccountToken: true
+automountServiceAccountToken: false
 ---
 # Source: thanos/templates/storegateway/serviceaccount.yaml
 apiVersion: v1
 kind: ServiceAccount
 metadata:
   name: thanos-storegateway
-  namespace: "default"
+  namespace: default
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: storegateway
-  annotations:
-automountServiceAccountToken: true
+automountServiceAccountToken: false
 ---
 # Source: thanos/templates/bucketweb/service.yaml
 apiVersion: v1
 kind: Service
 metadata:
   name: thanos-bucketweb
-  namespace: "default"
+  namespace: default
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: bucketweb
-  annotations:
+    prometheus-operator/monitor: 'true'
 spec:
   type: ClusterIP
   ports:
@@ -75,8 +240,8 @@
       name: http
       nodePort: null
   selector:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: bucketweb
 ---
 # Source: thanos/templates/compactor/service.yaml
@@ -84,13 +249,13 @@
 kind: Service
 metadata:
   name: thanos-compactor
-  namespace: "default"
+  namespace: default
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: compactor
-  annotations:
+    prometheus-operator/monitor: 'true'
 spec:
   type: ClusterIP
   ports:
@@ -100,8 +265,8 @@
       name: http
       nodePort: null
   selector:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: compactor
 ---
 # Source: thanos/templates/query/service-grpc.yaml
@@ -109,13 +274,12 @@
 kind: Service
 metadata:
   name: thanos-query-grpc
-  namespace: "default"
+  namespace: default
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: query
-  annotations:
 spec:
   type: ClusterIP
   ports:
@@ -125,8 +289,8 @@
       name: grpc
       nodePort: null
   selector:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: query
 ---
 # Source: thanos/templates/query/service.yaml
@@ -134,13 +298,13 @@
 kind: Service
 metadata:
   name: thanos-query
-  namespace: "default"
+  namespace: default
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: query
-  annotations:
+    prometheus-operator/monitor: 'true'
 spec:
   type: ClusterIP
   ports:
@@ -150,8 +314,8 @@
       name: http
       nodePort: null
   selector:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: query
 ---
 # Source: thanos/templates/storegateway/service.yaml
@@ -159,14 +323,13 @@
 kind: Service
 metadata:
   name: thanos-storegateway
-  namespace: "default"
+  namespace: default
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: storegateway
     prometheus-operator/monitor: 'true'
-  annotations:
 spec:
   type: ClusterIP
   ports:
@@ -181,8 +344,8 @@
       name: grpc
       nodePort: null
   selector:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: storegateway
 ---
 # Source: thanos/templates/bucketweb/deployment.yaml
@@ -190,32 +353,31 @@
 kind: Deployment
 metadata:
   name: thanos-bucketweb
-  namespace: "default"
+  namespace: default
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: bucketweb
 spec:
   replicas: 1
+  revisionHistoryLimit: 10
   strategy:
     type: RollingUpdate
   selector:
     matchLabels:
-      app.kubernetes.io/name: thanos
       app.kubernetes.io/instance: thanos
+      app.kubernetes.io/name: thanos
       app.kubernetes.io/component: bucketweb
   template:
     metadata:
       labels:
-        app.kubernetes.io/name: thanos
         app.kubernetes.io/instance: thanos
         app.kubernetes.io/managed-by: Helm
+        app.kubernetes.io/name: thanos
         app.kubernetes.io/component: bucketweb
-      annotations:
-        checksum/objstore-configuration: 01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b
     spec:
-      serviceAccount: thanos-bucketweb
+      serviceAccountName: thanos-bucketweb
       automountServiceAccountToken: true
       affinity:
         podAffinity:
@@ -224,25 +386,34 @@
             - podAffinityTerm:
                 labelSelector:
                   matchLabels:
-                    app.kubernetes.io/name: thanos
                     app.kubernetes.io/instance: thanos
+                    app.kubernetes.io/name: thanos
                     app.kubernetes.io/component: bucketweb
-                namespaces:
-                  - "default"
                 topologyKey: kubernetes.io/hostname
               weight: 1
         nodeAffinity:
       securityContext:
         fsGroup: 1001
+        fsGroupChangePolicy: Always
+        supplementalGroups: []
+        sysctls: []
       containers:
         - name: bucketweb
-          image: public.ecr.aws/bitnami/thanos:0.28.1-scratch-r0
+          image: public.ecr.aws/bitnami/thanos:0.37.1-debian-12-r0
           imagePullPolicy: "IfNotPresent"
           securityContext:
             allowPrivilegeEscalation: false
+            capabilities:
+              drop:
+                - ALL
+            privileged: false
             readOnlyRootFilesystem: true
+            runAsGroup: 1001
             runAsNonRoot: true
             runAsUser: 1001
+            seLinuxOptions: {}
+            seccompProfile:
+              type: RuntimeDefault
           args:
             - tools
             - bucket
@@ -297,32 +468,31 @@
 kind: Deployment
 metadata:
   name: thanos-compactor
-  namespace: "default"
+  namespace: default
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: compactor
 spec:
   replicas: 1
+  revisionHistoryLimit: 10
   strategy:
     type: Recreate
   selector:
     matchLabels:
-      app.kubernetes.io/name: thanos
       app.kubernetes.io/instance: thanos
+      app.kubernetes.io/name: thanos
       app.kubernetes.io/component: compactor
   template:
     metadata:
       labels:
-        app.kubernetes.io/name: thanos
         app.kubernetes.io/instance: thanos
         app.kubernetes.io/managed-by: Helm
+        app.kubernetes.io/name: thanos
         app.kubernetes.io/component: compactor
-      annotations:
-        checksum/objstore-configuration: 01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b
     spec:
-      serviceAccount: thanos-compactor
+      serviceAccountName: thanos-compactor
       automountServiceAccountToken: true
       affinity:
         podAffinity:
@@ -331,25 +501,34 @@
             - podAffinityTerm:
                 labelSelector:
                   matchLabels:
-                    app.kubernetes.io/name: thanos
                     app.kubernetes.io/instance: thanos
+                    app.kubernetes.io/name: thanos
                     app.kubernetes.io/component: compactor
-                namespaces:
-                  - "default"
                 topologyKey: kubernetes.io/hostname
               weight: 1
         nodeAffinity:
       securityContext:
         fsGroup: 1001
+        fsGroupChangePolicy: Always
+        supplementalGroups: []
+        sysctls: []
       containers:
         - name: compactor
-          image: public.ecr.aws/bitnami/thanos:0.28.1-scratch-r0
+          image: public.ecr.aws/bitnami/thanos:0.37.1-debian-12-r0
           imagePullPolicy: "IfNotPresent"
           securityContext:
             allowPrivilegeEscalation: false
+            capabilities:
+              drop:
+                - ALL
+            privileged: false
             readOnlyRootFilesystem: true
+            runAsGroup: 1001
             runAsNonRoot: true
             runAsUser: 1001
+            seLinuxOptions: {}
+            seccompProfile:
+              type: RuntimeDefault
           args:
             - compact
             - --log.level=info
@@ -410,30 +589,31 @@
 kind: Deployment
 metadata:
   name: thanos-query
-  namespace: "default"
+  namespace: default
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: query
 spec:
   replicas: 1
+  revisionHistoryLimit: 10
   strategy:
     type: RollingUpdate
   selector:
     matchLabels:
-      app.kubernetes.io/name: thanos
       app.kubernetes.io/instance: thanos
+      app.kubernetes.io/name: thanos
       app.kubernetes.io/component: query
   template:
     metadata:
       labels:
-        app.kubernetes.io/name: thanos
         app.kubernetes.io/instance: thanos
         app.kubernetes.io/managed-by: Helm
+        app.kubernetes.io/name: thanos
         app.kubernetes.io/component: query
     spec:
-      serviceAccount: thanos-query
+      serviceAccountName: thanos-query
       automountServiceAccountToken: true
       affinity:
         podAffinity:
@@ -442,25 +622,34 @@
             - podAffinityTerm:
                 labelSelector:
                   matchLabels:
-                    app.kubernetes.io/name: thanos
                     app.kubernetes.io/instance: thanos
+                    app.kubernetes.io/name: thanos
                     app.kubernetes.io/component: query
-                namespaces:
-                  - "default"
                 topologyKey: kubernetes.io/hostname
               weight: 1
         nodeAffinity:
       securityContext:
         fsGroup: 1001
+        fsGroupChangePolicy: Always
+        supplementalGroups: []
+        sysctls: []
       containers:
         - name: query
-          image: public.ecr.aws/bitnami/thanos:0.28.1-scratch-r0
+          image: public.ecr.aws/bitnami/thanos:0.37.1-debian-12-r0
           imagePullPolicy: "IfNotPresent"
           securityContext:
             allowPrivilegeEscalation: false
+            capabilities:
+              drop:
+                - ALL
+            privileged: false
             readOnlyRootFilesystem: true
+            runAsGroup: 1001
             runAsNonRoot: true
             runAsUser: 1001
+            seLinuxOptions: {}
+            seccompProfile:
+              type: RuntimeDefault
           args:
             - query
             - --log.level=info
@@ -470,6 +659,7 @@
             - --query.replica-label=replica
             - --endpoint=dnssrv+_grpc._tcp.prometheus-thanos-discovery.monitoring.svc.cluster.local
             - --endpoint=dnssrv+_grpc._tcp.thanos-storegateway.default.svc.cluster.local
+            - --alert.query-url=http://thanos-query.default.svc.cluster.local:9090
           ports:
             - name: http
               containerPort: 10902
@@ -498,8 +688,14 @@
               port: http
               scheme: HTTP
           resources:
-            limits: {}
-            requests: {}
+            limits:
+              cpu: 150m
+              ephemeral-storage: 2Gi
+              memory: 192Mi
+            requests:
+              cpu: 100m
+              ephemeral-storage: 50Mi
+              memory: 128Mi
           volumeMounts:
       volumes:
 ---
@@ -508,34 +704,33 @@
 kind: StatefulSet
 metadata:
   name: thanos-storegateway
-  namespace: "default"
+  namespace: default
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: storegateway
 spec:
   replicas: 1
+  revisionHistoryLimit: 10
   podManagementPolicy: OrderedReady
   serviceName: thanos-storegateway-headless
   updateStrategy:
     type: RollingUpdate
   selector:
     matchLabels:
-      app.kubernetes.io/name: thanos
       app.kubernetes.io/instance: thanos
+      app.kubernetes.io/name: thanos
       app.kubernetes.io/component: storegateway
   template:
     metadata:
       labels:
-        app.kubernetes.io/name: thanos
         app.kubernetes.io/instance: thanos
         app.kubernetes.io/managed-by: Helm
+        app.kubernetes.io/name: thanos
         app.kubernetes.io/component: storegateway
-      annotations:
-        checksum/objstore-configuration: 01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b
     spec:
-      serviceAccount: thanos-storegateway
+      serviceAccountName: thanos-storegateway
       automountServiceAccountToken: true
       affinity:
         podAffinity:
@@ -544,25 +739,34 @@
             - podAffinityTerm:
                 labelSelector:
                   matchLabels:
-                    app.kubernetes.io/name: thanos
                     app.kubernetes.io/instance: thanos
+                    app.kubernetes.io/name: thanos
                     app.kubernetes.io/component: storegateway
-                namespaces:
-                  - "default"
                 topologyKey: kubernetes.io/hostname
               weight: 1
         nodeAffinity:
       securityContext:
         fsGroup: 1001
+        fsGroupChangePolicy: Always
+        supplementalGroups: []
+        sysctls: []
       containers:
         - name: storegateway
-          image: public.ecr.aws/bitnami/thanos:0.28.1-scratch-r0
+          image: public.ecr.aws/bitnami/thanos:0.37.1-debian-12-r0
           imagePullPolicy: "IfNotPresent"
           securityContext:
             allowPrivilegeEscalation: false
+            capabilities:
+              drop:
+                - ALL
+            privileged: false
             readOnlyRootFilesystem: true
+            runAsGroup: 1001
             runAsNonRoot: true
             runAsUser: 1001
+            seLinuxOptions: {}
+            seccompProfile:
+              type: RuntimeDefault
           args:
             - store
             - --log.level=info
@@ -599,8 +803,14 @@
               port: http
               scheme: HTTP
           resources:
-            limits: {}
-            requests: {}
+            limits:
+              cpu: 150m
+              ephemeral-storage: 2Gi
+              memory: 192Mi
+            requests:
+              cpu: 100m
+              ephemeral-storage: 50Mi
+              memory: 128Mi
           volumeMounts:
             - name: objstore-config
               mountPath: /conf
@@ -611,7 +821,9 @@
           secret:
             secretName: thanos-objstore
   volumeClaimTemplates:
-    - metadata:
+    - apiVersion: v1
+      kind: PersistentVolumeClaim
+      metadata:
         name: data
       spec:
         accessModes:
@@ -625,11 +837,11 @@
 kind: Ingress
 metadata:
   name: thanos-query
-  namespace: "default"
+  namespace: default
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: query
   annotations:
     app: thanos
@@ -655,9 +867,9 @@
   name: thanos-bucketweb
   namespace: "default"
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: bucketweb
 spec:
   endpoints:
@@ -667,9 +879,10 @@
       - "default"
   selector:
     matchLabels:
-      app.kubernetes.io/name: thanos
       app.kubernetes.io/instance: thanos
+      app.kubernetes.io/name: thanos
       app.kubernetes.io/component: bucketweb
+      prometheus-operator/monitor: 'true'
 ---
 # Source: thanos/templates/compactor/servicemonitor.yaml
 apiVersion: monitoring.coreos.com/v1
@@ -678,9 +891,9 @@
   name: thanos-compactor
   namespace: "default"
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: compactor
 spec:
   endpoints:
@@ -690,9 +903,10 @@
       - "default"
   selector:
     matchLabels:
-      app.kubernetes.io/name: thanos
       app.kubernetes.io/instance: thanos
+      app.kubernetes.io/name: thanos
       app.kubernetes.io/component: compactor
+      prometheus-operator/monitor: 'true'
 ---
 # Source: thanos/templates/query/servicemonitor.yaml
 apiVersion: monitoring.coreos.com/v1
@@ -701,9 +915,9 @@
   name: thanos-query
   namespace: "default"
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: query
 spec:
   endpoints:
@@ -713,9 +927,10 @@
       - "default"
   selector:
     matchLabels:
-      app.kubernetes.io/name: thanos
       app.kubernetes.io/instance: thanos
+      app.kubernetes.io/name: thanos
       app.kubernetes.io/component: query
+      prometheus-operator/monitor: 'true'
 ---
 # Source: thanos/templates/storegateway/servicemonitor.yaml
 apiVersion: monitoring.coreos.com/v1
@@ -724,9 +939,9 @@
   name: thanos-storegateway
   namespace: "default"
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: storegateway
 spec:
   endpoints:
@@ -736,6 +951,7 @@
       - "default"
   selector:
     matchLabels:
-      app.kubernetes.io/name: thanos
       app.kubernetes.io/instance: thanos
+      app.kubernetes.io/name: thanos
       app.kubernetes.io/component: storegateway
+      prometheus-operator/monitor: 'true'

@renovate renovate bot changed the title feat(charts)!: Update Helm release thanos to 15.8.3 feat(charts)!: Update Helm release thanos to 15.8.4 Dec 4, 2024
@renovate renovate bot force-pushed the renovate/thanos-15.x branch from eaeb810 to b9a8851 Compare December 10, 2024 11:48
@github-actions GitHub Actions
Copy link

Path: cluster/core/monitoring/thanos/helm-release.yaml
Version: 11.5.5 -> 15.8.5

@@ -1,71 +1,236 @@
+# Source: thanos/templates/bucketweb/networkpolicy.yaml
+kind: NetworkPolicy
+apiVersion: networking.k8s.io/v1
+metadata:
+  name: thanos-bucketweb
+  namespace: "default"
+  labels:
+    app.kubernetes.io/instance: thanos
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
+    app.kubernetes.io/component: bucketweb
+spec:
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/instance: thanos
+      app.kubernetes.io/name: thanos
+      app.kubernetes.io/component: bucketweb
+  policyTypes:
+    - Ingress
+    - Egress
+  egress:
+    - {}
+  ingress:
+    - ports:
+        - port: 8080
+        - port: 8080
+---
+# Source: thanos/templates/compactor/networkpolicy.yaml
+kind: NetworkPolicy
+apiVersion: networking.k8s.io/v1
+metadata:
+  name: thanos-compactor
+  namespace: "default"
+  labels:
+    app.kubernetes.io/instance: thanos
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
+    app.kubernetes.io/component: compactor
+spec:
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/instance: thanos
+      app.kubernetes.io/name: thanos
+      app.kubernetes.io/component: compactor
+  policyTypes:
+    - Ingress
+    - Egress
+  egress:
+    - {}
+  ingress:
+    - ports:
+        - port: 10902
+        - port: 9090
+---
+# Source: thanos/templates/query/networkpolicy.yaml
+kind: NetworkPolicy
+apiVersion: networking.k8s.io/v1
+metadata:
+  name: thanos-query
+  namespace: "default"
+  labels:
+    app.kubernetes.io/instance: thanos
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
+    app.kubernetes.io/component: query
+spec:
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/instance: thanos
+      app.kubernetes.io/name: thanos
+      app.kubernetes.io/component: query
+  policyTypes:
+    - Ingress
+    - Egress
+  egress:
+    - {}
+  ingress:
+    - ports:
+        - port: 10902
+        - port: 10901
+        - port: 9090
+        - port: 10901
+---
+# Source: thanos/templates/storegateway/networkpolicy.yaml
+kind: NetworkPolicy
+apiVersion: networking.k8s.io/v1
+metadata:
+  name: thanos-storegateway
+  namespace: "default"
+  labels:
+    app.kubernetes.io/instance: thanos
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
+    app.kubernetes.io/component: storegateway
+spec:
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/instance: thanos
+      app.kubernetes.io/name: thanos
+      app.kubernetes.io/component: storegateway
+  policyTypes:
+    - Ingress
+    - Egress
+  egress:
+    - {}
+  ingress:
+    - ports:
+        - port: 10902
+        - port: 9090
+        - port: 10901
+        - port: 10901
+---
+# Source: thanos/templates/bucketweb/pdb.yaml
+apiVersion: policy/v1
+kind: PodDisruptionBudget
+metadata:
+  name: thanos-bucketweb
+  namespace: default
+  labels:
+    app.kubernetes.io/instance: thanos
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
+    app.kubernetes.io/component: bucketweb
+spec:
+  maxUnavailable: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/instance: thanos
+      app.kubernetes.io/name: thanos
+      app.kubernetes.io/component: bucketweb
+---
+# Source: thanos/templates/query/pdb.yaml
+apiVersion: policy/v1
+kind: PodDisruptionBudget
+metadata:
+  name: thanos-query
+  namespace: default
+  labels:
+    app.kubernetes.io/instance: thanos
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
+    app.kubernetes.io/component: query
+spec:
+  maxUnavailable: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/instance: thanos
+      app.kubernetes.io/name: thanos
+      app.kubernetes.io/component: query
+---
+# Source: thanos/templates/storegateway/pdb.yaml
+apiVersion: policy/v1
+kind: PodDisruptionBudget
+metadata:
+  name: thanos-storegateway
+  namespace: default
+  labels:
+    app.kubernetes.io/instance: thanos
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
+    app.kubernetes.io/component: storegateway
+spec:
+  maxUnavailable: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/instance: thanos
+      app.kubernetes.io/name: thanos
+      app.kubernetes.io/component: storegateway
+---
 # Source: thanos/templates/bucketweb/serviceaccount.yaml
 apiVersion: v1
 kind: ServiceAccount
 metadata:
   name: thanos-bucketweb
-  namespace: "default"
+  namespace: default
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: bucketweb
-  annotations:
-automountServiceAccountToken: true
+automountServiceAccountToken: false
 ---
 # Source: thanos/templates/compactor/serviceaccount.yaml
 apiVersion: v1
 kind: ServiceAccount
 metadata:
   name: thanos-compactor
-  namespace: "default"
+  namespace: default
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: compactor
-  annotations:
-automountServiceAccountToken: true
+automountServiceAccountToken: false
 ---
 # Source: thanos/templates/query/serviceaccount.yaml
 apiVersion: v1
 kind: ServiceAccount
 metadata:
   name: thanos-query
-  namespace: "default"
+  namespace: default
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: query
-  annotations:
-automountServiceAccountToken: true
+automountServiceAccountToken: false
 ---
 # Source: thanos/templates/storegateway/serviceaccount.yaml
 apiVersion: v1
 kind: ServiceAccount
 metadata:
   name: thanos-storegateway
-  namespace: "default"
+  namespace: default
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: storegateway
-  annotations:
-automountServiceAccountToken: true
+automountServiceAccountToken: false
 ---
 # Source: thanos/templates/bucketweb/service.yaml
 apiVersion: v1
 kind: Service
 metadata:
   name: thanos-bucketweb
-  namespace: "default"
+  namespace: default
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: bucketweb
-  annotations:
+    prometheus-operator/monitor: 'true'
 spec:
   type: ClusterIP
   ports:
@@ -75,8 +240,8 @@
       name: http
       nodePort: null
   selector:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: bucketweb
 ---
 # Source: thanos/templates/compactor/service.yaml
@@ -84,13 +249,13 @@
 kind: Service
 metadata:
   name: thanos-compactor
-  namespace: "default"
+  namespace: default
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: compactor
-  annotations:
+    prometheus-operator/monitor: 'true'
 spec:
   type: ClusterIP
   ports:
@@ -100,8 +265,8 @@
       name: http
       nodePort: null
   selector:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: compactor
 ---
 # Source: thanos/templates/query/service-grpc.yaml
@@ -109,13 +274,12 @@
 kind: Service
 metadata:
   name: thanos-query-grpc
-  namespace: "default"
+  namespace: default
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: query
-  annotations:
 spec:
   type: ClusterIP
   ports:
@@ -125,8 +289,8 @@
       name: grpc
       nodePort: null
   selector:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: query
 ---
 # Source: thanos/templates/query/service.yaml
@@ -134,13 +298,13 @@
 kind: Service
 metadata:
   name: thanos-query
-  namespace: "default"
+  namespace: default
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: query
-  annotations:
+    prometheus-operator/monitor: 'true'
 spec:
   type: ClusterIP
   ports:
@@ -150,8 +314,8 @@
       name: http
       nodePort: null
   selector:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: query
 ---
 # Source: thanos/templates/storegateway/service.yaml
@@ -159,14 +323,13 @@
 kind: Service
 metadata:
   name: thanos-storegateway
-  namespace: "default"
+  namespace: default
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: storegateway
     prometheus-operator/monitor: 'true'
-  annotations:
 spec:
   type: ClusterIP
   ports:
@@ -181,8 +344,8 @@
       name: grpc
       nodePort: null
   selector:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: storegateway
 ---
 # Source: thanos/templates/bucketweb/deployment.yaml
@@ -190,32 +353,31 @@
 kind: Deployment
 metadata:
   name: thanos-bucketweb
-  namespace: "default"
+  namespace: default
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: bucketweb
 spec:
   replicas: 1
+  revisionHistoryLimit: 10
   strategy:
     type: RollingUpdate
   selector:
     matchLabels:
-      app.kubernetes.io/name: thanos
       app.kubernetes.io/instance: thanos
+      app.kubernetes.io/name: thanos
       app.kubernetes.io/component: bucketweb
   template:
     metadata:
       labels:
-        app.kubernetes.io/name: thanos
         app.kubernetes.io/instance: thanos
         app.kubernetes.io/managed-by: Helm
+        app.kubernetes.io/name: thanos
         app.kubernetes.io/component: bucketweb
-      annotations:
-        checksum/objstore-configuration: 01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b
     spec:
-      serviceAccount: thanos-bucketweb
+      serviceAccountName: thanos-bucketweb
       automountServiceAccountToken: true
       affinity:
         podAffinity:
@@ -224,25 +386,34 @@
             - podAffinityTerm:
                 labelSelector:
                   matchLabels:
-                    app.kubernetes.io/name: thanos
                     app.kubernetes.io/instance: thanos
+                    app.kubernetes.io/name: thanos
                     app.kubernetes.io/component: bucketweb
-                namespaces:
-                  - "default"
                 topologyKey: kubernetes.io/hostname
               weight: 1
         nodeAffinity:
       securityContext:
         fsGroup: 1001
+        fsGroupChangePolicy: Always
+        supplementalGroups: []
+        sysctls: []
       containers:
         - name: bucketweb
-          image: public.ecr.aws/bitnami/thanos:0.28.1-scratch-r0
+          image: public.ecr.aws/bitnami/thanos:0.37.1-debian-12-r0
           imagePullPolicy: "IfNotPresent"
           securityContext:
             allowPrivilegeEscalation: false
+            capabilities:
+              drop:
+                - ALL
+            privileged: false
             readOnlyRootFilesystem: true
+            runAsGroup: 1001
             runAsNonRoot: true
             runAsUser: 1001
+            seLinuxOptions: {}
+            seccompProfile:
+              type: RuntimeDefault
           args:
             - tools
             - bucket
@@ -297,32 +468,31 @@
 kind: Deployment
 metadata:
   name: thanos-compactor
-  namespace: "default"
+  namespace: default
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: compactor
 spec:
   replicas: 1
+  revisionHistoryLimit: 10
   strategy:
     type: Recreate
   selector:
     matchLabels:
-      app.kubernetes.io/name: thanos
       app.kubernetes.io/instance: thanos
+      app.kubernetes.io/name: thanos
       app.kubernetes.io/component: compactor
   template:
     metadata:
       labels:
-        app.kubernetes.io/name: thanos
         app.kubernetes.io/instance: thanos
         app.kubernetes.io/managed-by: Helm
+        app.kubernetes.io/name: thanos
         app.kubernetes.io/component: compactor
-      annotations:
-        checksum/objstore-configuration: 01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b
     spec:
-      serviceAccount: thanos-compactor
+      serviceAccountName: thanos-compactor
       automountServiceAccountToken: true
       affinity:
         podAffinity:
@@ -331,25 +501,34 @@
             - podAffinityTerm:
                 labelSelector:
                   matchLabels:
-                    app.kubernetes.io/name: thanos
                     app.kubernetes.io/instance: thanos
+                    app.kubernetes.io/name: thanos
                     app.kubernetes.io/component: compactor
-                namespaces:
-                  - "default"
                 topologyKey: kubernetes.io/hostname
               weight: 1
         nodeAffinity:
       securityContext:
         fsGroup: 1001
+        fsGroupChangePolicy: Always
+        supplementalGroups: []
+        sysctls: []
       containers:
         - name: compactor
-          image: public.ecr.aws/bitnami/thanos:0.28.1-scratch-r0
+          image: public.ecr.aws/bitnami/thanos:0.37.1-debian-12-r0
           imagePullPolicy: "IfNotPresent"
           securityContext:
             allowPrivilegeEscalation: false
+            capabilities:
+              drop:
+                - ALL
+            privileged: false
             readOnlyRootFilesystem: true
+            runAsGroup: 1001
             runAsNonRoot: true
             runAsUser: 1001
+            seLinuxOptions: {}
+            seccompProfile:
+              type: RuntimeDefault
           args:
             - compact
             - --log.level=info
@@ -410,30 +589,31 @@
 kind: Deployment
 metadata:
   name: thanos-query
-  namespace: "default"
+  namespace: default
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: query
 spec:
   replicas: 1
+  revisionHistoryLimit: 10
   strategy:
     type: RollingUpdate
   selector:
     matchLabels:
-      app.kubernetes.io/name: thanos
       app.kubernetes.io/instance: thanos
+      app.kubernetes.io/name: thanos
       app.kubernetes.io/component: query
   template:
     metadata:
       labels:
-        app.kubernetes.io/name: thanos
         app.kubernetes.io/instance: thanos
         app.kubernetes.io/managed-by: Helm
+        app.kubernetes.io/name: thanos
         app.kubernetes.io/component: query
     spec:
-      serviceAccount: thanos-query
+      serviceAccountName: thanos-query
       automountServiceAccountToken: true
       affinity:
         podAffinity:
@@ -442,25 +622,34 @@
             - podAffinityTerm:
                 labelSelector:
                   matchLabels:
-                    app.kubernetes.io/name: thanos
                     app.kubernetes.io/instance: thanos
+                    app.kubernetes.io/name: thanos
                     app.kubernetes.io/component: query
-                namespaces:
-                  - "default"
                 topologyKey: kubernetes.io/hostname
               weight: 1
         nodeAffinity:
       securityContext:
         fsGroup: 1001
+        fsGroupChangePolicy: Always
+        supplementalGroups: []
+        sysctls: []
       containers:
         - name: query
-          image: public.ecr.aws/bitnami/thanos:0.28.1-scratch-r0
+          image: public.ecr.aws/bitnami/thanos:0.37.1-debian-12-r0
           imagePullPolicy: "IfNotPresent"
           securityContext:
             allowPrivilegeEscalation: false
+            capabilities:
+              drop:
+                - ALL
+            privileged: false
             readOnlyRootFilesystem: true
+            runAsGroup: 1001
             runAsNonRoot: true
             runAsUser: 1001
+            seLinuxOptions: {}
+            seccompProfile:
+              type: RuntimeDefault
           args:
             - query
             - --log.level=info
@@ -470,6 +659,7 @@
             - --query.replica-label=replica
             - --endpoint=dnssrv+_grpc._tcp.prometheus-thanos-discovery.monitoring.svc.cluster.local
             - --endpoint=dnssrv+_grpc._tcp.thanos-storegateway.default.svc.cluster.local
+            - --alert.query-url=http://thanos-query.default.svc.cluster.local:9090
           ports:
             - name: http
               containerPort: 10902
@@ -498,8 +688,14 @@
               port: http
               scheme: HTTP
           resources:
-            limits: {}
-            requests: {}
+            limits:
+              cpu: 150m
+              ephemeral-storage: 2Gi
+              memory: 192Mi
+            requests:
+              cpu: 100m
+              ephemeral-storage: 50Mi
+              memory: 128Mi
           volumeMounts:
       volumes:
 ---
@@ -508,34 +704,33 @@
 kind: StatefulSet
 metadata:
   name: thanos-storegateway
-  namespace: "default"
+  namespace: default
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: storegateway
 spec:
   replicas: 1
+  revisionHistoryLimit: 10
   podManagementPolicy: OrderedReady
   serviceName: thanos-storegateway-headless
   updateStrategy:
     type: RollingUpdate
   selector:
     matchLabels:
-      app.kubernetes.io/name: thanos
       app.kubernetes.io/instance: thanos
+      app.kubernetes.io/name: thanos
       app.kubernetes.io/component: storegateway
   template:
     metadata:
       labels:
-        app.kubernetes.io/name: thanos
         app.kubernetes.io/instance: thanos
         app.kubernetes.io/managed-by: Helm
+        app.kubernetes.io/name: thanos
         app.kubernetes.io/component: storegateway
-      annotations:
-        checksum/objstore-configuration: 01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b
     spec:
-      serviceAccount: thanos-storegateway
+      serviceAccountName: thanos-storegateway
       automountServiceAccountToken: true
       affinity:
         podAffinity:
@@ -544,25 +739,34 @@
             - podAffinityTerm:
                 labelSelector:
                   matchLabels:
-                    app.kubernetes.io/name: thanos
                     app.kubernetes.io/instance: thanos
+                    app.kubernetes.io/name: thanos
                     app.kubernetes.io/component: storegateway
-                namespaces:
-                  - "default"
                 topologyKey: kubernetes.io/hostname
               weight: 1
         nodeAffinity:
       securityContext:
         fsGroup: 1001
+        fsGroupChangePolicy: Always
+        supplementalGroups: []
+        sysctls: []
       containers:
         - name: storegateway
-          image: public.ecr.aws/bitnami/thanos:0.28.1-scratch-r0
+          image: public.ecr.aws/bitnami/thanos:0.37.1-debian-12-r0
           imagePullPolicy: "IfNotPresent"
           securityContext:
             allowPrivilegeEscalation: false
+            capabilities:
+              drop:
+                - ALL
+            privileged: false
             readOnlyRootFilesystem: true
+            runAsGroup: 1001
             runAsNonRoot: true
             runAsUser: 1001
+            seLinuxOptions: {}
+            seccompProfile:
+              type: RuntimeDefault
           args:
             - store
             - --log.level=info
@@ -599,8 +803,14 @@
               port: http
               scheme: HTTP
           resources:
-            limits: {}
-            requests: {}
+            limits:
+              cpu: 150m
+              ephemeral-storage: 2Gi
+              memory: 192Mi
+            requests:
+              cpu: 100m
+              ephemeral-storage: 50Mi
+              memory: 128Mi
           volumeMounts:
             - name: objstore-config
               mountPath: /conf
@@ -611,7 +821,9 @@
           secret:
             secretName: thanos-objstore
   volumeClaimTemplates:
-    - metadata:
+    - apiVersion: v1
+      kind: PersistentVolumeClaim
+      metadata:
         name: data
       spec:
         accessModes:
@@ -625,11 +837,11 @@
 kind: Ingress
 metadata:
   name: thanos-query
-  namespace: "default"
+  namespace: default
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: query
   annotations:
     app: thanos
@@ -655,9 +867,9 @@
   name: thanos-bucketweb
   namespace: "default"
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: bucketweb
 spec:
   endpoints:
@@ -667,9 +879,10 @@
       - "default"
   selector:
     matchLabels:
-      app.kubernetes.io/name: thanos
       app.kubernetes.io/instance: thanos
+      app.kubernetes.io/name: thanos
       app.kubernetes.io/component: bucketweb
+      prometheus-operator/monitor: 'true'
 ---
 # Source: thanos/templates/compactor/servicemonitor.yaml
 apiVersion: monitoring.coreos.com/v1
@@ -678,9 +891,9 @@
   name: thanos-compactor
   namespace: "default"
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: compactor
 spec:
   endpoints:
@@ -690,9 +903,10 @@
       - "default"
   selector:
     matchLabels:
-      app.kubernetes.io/name: thanos
       app.kubernetes.io/instance: thanos
+      app.kubernetes.io/name: thanos
       app.kubernetes.io/component: compactor
+      prometheus-operator/monitor: 'true'
 ---
 # Source: thanos/templates/query/servicemonitor.yaml
 apiVersion: monitoring.coreos.com/v1
@@ -701,9 +915,9 @@
   name: thanos-query
   namespace: "default"
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: query
 spec:
   endpoints:
@@ -713,9 +927,10 @@
       - "default"
   selector:
     matchLabels:
-      app.kubernetes.io/name: thanos
       app.kubernetes.io/instance: thanos
+      app.kubernetes.io/name: thanos
       app.kubernetes.io/component: query
+      prometheus-operator/monitor: 'true'
 ---
 # Source: thanos/templates/storegateway/servicemonitor.yaml
 apiVersion: monitoring.coreos.com/v1
@@ -724,9 +939,9 @@
   name: thanos-storegateway
   namespace: "default"
   labels:
-    app.kubernetes.io/name: thanos
     app.kubernetes.io/instance: thanos
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
     app.kubernetes.io/component: storegateway
 spec:
   endpoints:
@@ -736,6 +951,7 @@
       - "default"
   selector:
     matchLabels:
-      app.kubernetes.io/name: thanos
       app.kubernetes.io/instance: thanos
+      app.kubernetes.io/name: thanos
       app.kubernetes.io/component: storegateway
+      prometheus-operator/monitor: 'true'

@renovate renovate bot changed the title feat(charts)!: Update Helm release thanos to 15.8.4 feat(charts)!: Update Helm release thanos to 15.8.5 Dec 10, 2024
@renovate renovate bot force-pushed the renovate/thanos-15.x branch from b9a8851 to 628b2a7 Compare December 11, 2024 06:25
@renovate renovate bot changed the title feat(charts)!: Update Helm release thanos to 15.8.5 feat(charts)!: Update Helm release thanos to 15.9.0 Dec 11, 2024
@renovate renovate bot force-pushed the renovate/thanos-15.x branch from 628b2a7 to cadd83b Compare December 11, 2024 16:43
@renovate renovate bot changed the title feat(charts)!: Update Helm release thanos to 15.9.0 feat(charts)!: Update Helm release thanos to 15.9.1 Dec 11, 2024
@renovate renovate bot force-pushed the renovate/thanos-15.x branch from cadd83b to 56778cb Compare December 12, 2024 15:09
@renovate renovate bot changed the title feat(charts)!: Update Helm release thanos to 15.9.1 feat(charts)!: Update Helm release thanos to 15.9.2 Dec 12, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@dfroberg dfroberg Awaiting requested review from dfroberg dfroberg is a code owner

Assignees
No one assigned
Labels
renovate/helm
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
0 participants