Alertmanagers contains endpoint configuration for designated Alertmanagers.

Namespace of Endpoints object.

Name of Endpoints object in Namespace.

Port the Alertmanager API is exposed on.

Scheme to use when firing alerts.

Prefix for the HTTP path alerts are pushed to.

TLS Config to use for alertmanager connection.

Authorization section for this alertmanager endpoint

Version of the Alertmanager API that rule-evaluator uses to send alerts. It can be “v1” or “v2”.

Timeout is a per-target Alertmanager timeout when pushing alerts.

Type is the authentication type. Defaults to Bearer. Basic will cause an error, as the BasicAuth object should be used instead.

Credentials uses the secret as the credentials (token) for the authentication header.

Set the authentication type. Defaults to Bearer, Basic will cause an error

The secret’s key that contains the credentials of the request

Username is the BasicAuth username.

Password uses the secret as the BasicAuth password.

Specification of desired node selection for target discovery by Prometheus.

Most recently observed status of the resource.

Label selector that specifies which nodes are selected for this monitoring configuration. If left empty all nodes are selected.

The endpoints to scrape on the selected nodes.

Limits to apply at scrape time.

InsecureSkipVerify disables target certificate validation.

Specification of desired Pod selection for target discovery by Prometheus.

Most recently observed status of the resource.

Label selector that specifies which pods are selected for this monitoring configuration.

The endpoints to scrape on the selected pods.

Labels to add to the Prometheus target for discovered endpoints. The instance label is always set to <pod_name>:<port> or <node_name>:<port> if the scraped pod is controlled by a DaemonSet.

Limits to apply at scrape time.

FilterRunning will drop any pods that are in the “Failed” or “Succeeded” pod lifecycle. See: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle/#pod-phase Specifically, this prevents scraping Succeeded pods from K8s jobs, which could contribute to noisy logs or irrelevant metrics. Additionally, it can mitigate issues with reusing stale target labels in cases where Pod IPs are reused (e.g. spot containers). See: #145

Specification of rules to record and alert on.

Most recently observed status of the resource.

Pod metadata labels that are set on all scraped targets. Permitted keys are container, namespace, node, pod, top_level_controller_name and top_level_controller_type. The container label is only populated if the scrape port is referenced by name. Defaults to [container, namespace, pod, top_level_controller_name, top_level_controller_type]. If set to null, it will be interpreted as [namespace]. This is for backwards-compatibility only.

Labels to transfer from the Kubernetes Pod to Prometheus target labels. Mappings are applied in order.

ExternalLabels specifies external labels that are attached to all scraped data before being written to Google Cloud Monitoring or any other additional exports specified in the OperatorConfig. The precedence behavior matches that of Prometheus.

Filter limits which metric data is sent to Cloud Monitoring (it doesn’t apply to additional exports).

A reference to GCP service account credentials with which Prometheus collectors are run. It needs to have metric write permissions for all project IDs to which data is written. Within GKE, this can typically be left empty if the compute default service account has the required permissions.

Configuration to scrape the metric endpoints of the Kubelets.

Compression enables compression of metrics collection data

"gzip"

"none"

Compression enables compression of the config data propagated by the operator to collectors and the rule-evaluator. It is recommended to use the gzip option when using a large number of ClusterPodMonitoring, PodMonitoring, GlobalRules, ClusterRules, and/or Rules.

EnableMatchOneOf allows additional control over MatchOneOf filtering.

Available settings: * not set: The MatchOneOf settings are ignored, default is used. * false: MatchOneOf feature is explicitly disabled; export is forced to match all series. * true: The MatchOneOf settings are used, overwriting a default.

See MatchOneOf IMPORTANT section to learn about the MatchOneOf default.

MatchOneOf, if EnableMatchOneOf is true, controls the export filtering setting.

MatchOneOf expects a list of Prometheus time series matchers. Every time series must match at least one of the matchers to be exported. This field can be used equivalently to the match[] parameter of the Prometheus federation endpoint to selectively export data.

Example: ["{job!='foobar'}", "{__name__!~'container_foo.*|container_bar.*'}"]

IMPORTANT: MatchOneOf is guarded by the additional flag (EnableMatchOneOf) and removed from the public docs. Replacements: https://cloud.google.com/stackdriver/docs/managed-prometheus/setup-managed#filter-metrics.

Rationales: * This option is prone to misconfiguration, e.g. you need to manually match important built-in metrics (up, scrape_samples_added, etc.). * Unmatched metrics are still in the local collector memory (this filters on export only). * Typically, the default (empty array), means match all metrics. However, for the clusters that were using MatchOneOf filtering before the GMP 0.14.x, version, the default is what has been configured back then in the orphaned collector DaemonSet EXTRA_ARGS environment variable. If you are impacted: * use EnableMatchOneOf = false to reset the default * use EnableMatchOneOf = true to apply this configuration’s MatchOneOf * Remove EXTRA_ARGS environment variable from the collector DaemonSet (it’s safe to do so).

The URL of the endpoint that supports Prometheus Remote Write to export samples to.

Specification of rules to record and alert on.

Most recently observed status of the resource.

(Members of ProxyConfig are embedded into this type.)

Authorization is the HTTP authorization credentials for the targets.

BasicAuth is the HTTP basic authentication credentials for the targets.

TLS configures the scrape request’s TLS settings.

OAuth2 is the OAuth2 client credentials used to fetch a token for the targets.

The interval at which the metric endpoints are scraped.

TLSInsecureSkipVerify disables verifying the target cert. This can be useful for clusters provisioned with kubeadm.

Kubernetes resource label to remap.

Remapped Prometheus target label. Defaults to the same name as From.

ConfigSecret refers to the name of a single-key Secret in the public namespace that holds the managed Alertmanager config file.

ExternalURL is the URL under which Alertmanager is externally reachable (for example, if Alertmanager is served via a reverse proxy). Used for generating relative and absolute links back to Alertmanager itself. If the URL has a path portion, it will be used to prefix all HTTP endpoints served by Alertmanager, otherwise relevant URL components will be derived automatically.

If no URL is provided, Alertmanager will point to the Google Cloud Metric Explorer page.

Status of the condition, one of True, False, Unknown.

The last time this condition was updated.

Last time the condition transitioned from one status to another.

The reason for the condition’s last transition.

A human-readable message indicating details about the transition.

"ConfigurationCreateSuccess"

ConfigurationCreateSuccess indicates that the config generated from the monitoring resource was created successfully.

The generation observed by the controller.

Represents the latest available observations of a podmonitor’s current state.

(Members of ProxyConfig are embedded into this type.)

ClientID is the public identifier for the client.

ClientSecret uses the secret as the client secret token.

Scopes represents the scopes for the token request.

TokenURL is the URL to fetch the token from.

EndpointParams are additional parameters to append to the token URL.

TLS configures the token request’s TLS settings.

Rules specifies how the operator configures and deploys rule-evaluator.

Collection specifies how the operator configures collection, including scraping and an integrated export to Google Cloud Monitoring.

Exports is an EXPERIMENTAL feature that specifies additional, optional endpoints to export to, on top of Google Cloud Monitoring collection. Note: To disable integrated export to Google Cloud Monitoring specify a non-matching filter in the “collection.filter” field.

ManagedAlertmanager holds information for configuring the managed instance of Alertmanager.

Features holds configuration for optional managed-collection features.

Scaling contains configuration options for scaling GMP.

Configuration of target status reporting.

Settings for the collector configuration propagation.

Specification of desired Pod selection for target discovery by Prometheus.

Most recently observed status of the resource.

Label selector that specifies which pods are selected for this monitoring configuration.

The endpoints to scrape on the selected pods.

Labels to add to the Prometheus target for discovered endpoints. The instance label is always set to <pod_name>:<port> or <node_name>:<port> if the scraped pod is controlled by a DaemonSet.

Limits to apply at scrape time.

FilterRunning will drop any pods that are in the “Failed” or “Succeeded” pod lifecycle. See: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle/#pod-phase

(Members of MonitoringStatus are embedded into this type.)

Represents the latest available observations of target state for each ScrapeEndpoint.

ProxyURL is the HTTP proxy server to use to connect to the targets.

Encoded passwords are not supported.

The source labels select values from existing labels. Their content is concatenated using the configured separator and matched against the configured regular expression for the replace, keep, and drop actions.

Separator placed between concatenated source label values. Defaults to ‘;’.

Label to which the resulting value is written in a replace action. It is mandatory for replace actions. Regex capture groups are available.

Regular expression against which the extracted value is matched. Defaults to ‘(.*)’.

Modulus to take of the hash of the source label values.

Replacement value against which a regex replace is performed if the regular expression matches. Regex capture groups are available. Defaults to ‘$1’.

Action to perform based on regex matching. Defaults to ‘replace’.

Record the result of the expression to this metric name. Only one of record and alert must be set.

Name of the alert to evaluate the expression as. Only one of record and alert must be set.

The PromQL expression to evaluate.

The duration to wait before a firing alert produced by this rule is sent to Alertmanager. Only valid if alert is set.

A set of labels to attach to the result of the query expression.

A set of annotations to attach to alerts produced by the query expression. Only valid if alert is set.

ExternalLabels specifies external labels that are attached to any rule results and alerts produced by rules. The precedence behavior matches that of Prometheus.

QueryProjectID is the GCP project ID to evaluate rules against. If left blank, the rule-evaluator will try attempt to infer the Project ID from the environment.

The base URL used for the generator URL in the alert notification payload. Should point to an instance of a query frontend that gives access to queryProjectID.

Alerting contains how the rule-evaluator configures alerting.

A reference to GCP service account credentials with which the rule evaluator container is run. It needs to have metric read permissions against queryProjectId and metric write permissions against all projects to which rule results are written. Within GKE, this can typically be left empty if the compute default service account has the required permissions.

The name of the rule group.

The interval at which to evaluate the rules. Must be a valid Prometheus duration.

A list of rules that are executed sequentially as part of this group.

Specification of rules to record and alert on.

Most recently observed status of the resource.

A list of Prometheus rule groups.

(Members of MonitoringStatus are embedded into this type.)

Targets emitting the error message.

Total count of similar errors.

The label set, keys and values, of the target.

Error message.

Scrape duration in seconds.

Health status.

(Members of HTTPClientConfig are embedded into this type.)

Prometheus HTTP client configuration.

Name or number of the port to scrape. The container metadata label is only populated if the port is referenced by name because port numbers are not unique across containers.

Protocol scheme to use to scrape.

HTTP path to scrape metrics from. Defaults to “/metrics”.

HTTP GET params to use when scraping.

Interval at which to scrape metrics. Must be a valid Prometheus duration.

Timeout for metrics scrapes. Must be a valid Prometheus duration. Must not be larger than the scrape interval.

Relabeling rules for metrics scraped from this endpoint. Relabeling rules that override protected target labels (project_id, location, cluster, namespace, job, instance, top_level_controller, top_level_controller_type, or address) are not permitted. The labelmap action is not permitted in general.

The name of the ScrapeEndpoint.

Total number of active targets.

Total number of active, unhealthy targets.

Last time this status was updated.

A fixed sample of targets grouped by error type.

Fraction of collectors included in status, bounded [0,1]. Ideally, this should always be 1. Anything less can be considered a problem and should be investigated.

Maximum number of samples accepted within a single scrape. Uses Prometheus default if left unspecified.

Maximum number of labels accepted for a single sample. Uses Prometheus default if left unspecified.

Maximum label name length. Uses Prometheus default if left unspecified.

Maximum label value length. Uses Prometheus default if left unspecified.

Protocol scheme to use to scrape.

HTTP path to scrape metrics from. Defaults to “/metrics”.

HTTP GET params to use when scraping.

Interval at which to scrape metrics. Must be a valid Prometheus duration.

Timeout for metrics scrapes. Must be a valid Prometheus duration. Must not be larger then the scrape interval.

Relabeling rules for metrics scraped from this endpoint. Relabeling rules that override protected target labels (project_id, location, cluster, namespace, job, instance, or address) are not permitted. The labelmap action is not permitted in general.

TLS configures the scrape request’s TLS settings.

Name of the secret to select from.

Key of the secret to select from. Must be a valid secret key.

Namespace of the secret to select from. If empty the parent resource namespace will be chosen.

Secret containing data to use for the targets.

ConfigMap containing data to use for the targets.

Secret represents reference to a given key from certain Secret in a given namespace.

ServerName is used to verify the hostname for the targets.

InsecureSkipVerify disables target certificate validation.

MinVersion is the minimum TLS version. Accepted values: TLS10 (TLS 1.0), TLS11 (TLS 1.1), TLS12 (TLS 1.2), TLS13 (TLS 1.3).

If unset, Prometheus will use Go default minimum version, which is TLS 1.2. See MinVersion in https://pkg.go.dev/crypto/tls#Config.

MaxVersion is the maximum TLS version. Accepted values: TLS10 (TLS 1.0), TLS11 (TLS 1.1), TLS12 (TLS 1.2), TLS13 (TLS 1.3).

If unset, Prometheus will use Go default minimum version, which is TLS 1.2. See MinVersion in https://pkg.go.dev/crypto/tls#Config.

Cert uses the secret as the certificate for client authentication to the server.

Key uses the secret as the private key for client authentication to the server.

Struct containing the CA cert to use for the targets.

Struct containing the client cert file for the targets.

Secret containing the client key file for the targets.

Used to verify the hostname for the targets.

Disable target certificate validation.

Minimum TLS version. Accepted values: TLS10 (TLS 1.0), TLS11 (TLS 1.1), TLS12 (TLS 1.2), TLS13 (TLS 1.3). If unset, Prometheus will use Go default minimum version, which is TLS 1.2. See MinVersion in https://pkg.go.dev/crypto/tls#Config.

Maximum TLS version. Accepted values: TLS10 (TLS 1.0), TLS11 (TLS 1.1), TLS12 (TLS 1.2), TLS13 (TLS 1.3). If unset, Prometheus will use Go default minimum version, which is TLS 1.2. See MinVersion in https://pkg.go.dev/crypto/tls#Config.

Pod metadata labels that are set on all scraped targets. Permitted keys are container, node, pod, top_level_controller_name, and top_level_controller_type. The container label is only populated if the scrape port is referenced by name. Defaults to [container, pod, top_level_controller_name, top_level_controller_type]. If set to null, it will be interpreted as the empty list. This is for backwards-compatibility only.

Labels to transfer from the Kubernetes Pod to Prometheus target labels. Mappings are applied in order.

Enable target status reporting.

Enabled configures whether the operator configures Vertical Pod Autoscaling for GMP workloads. In GKE, installing Vertical Pod Autoscaling requires a cluster restart, and therefore it also results in an operator restart. In other environments, the operator may need to be restarted to enable VPA to run the following check again and watch for the objects.