prometheus-operator

Renders Prometheus Operator Prometheus, PrometheusAgent, Alertmanager, AlertmanagerConfig, ThanosRuler, Probe, ScrapeConfig, ServiceMonitor, PodMonitor and PrometheusRule resources, plus Prometheus RBAC, from inventory parameters.

kubernetes operators observability

Latest: 1.1.3 · 2026-10-16
License: Apache-2.0
Owners: Moep90
Source: github.com/kadet-hub/generators · 0 repo stars, shared by 35 generators
Thumbs up: 👍 0 on GitHub Discussions
Popularity: 19 · 611 pulls

Request a feature Report a problem

Badge

Show the latest listed version in your README. shields.io draws the badge from this page's badge.json, which every catalog build updates; once no version is listed, it reads "not listed".

[![kadet-hub](https://img.shields.io/endpoint?url=https://kadet-hub.org/generators/prometheus-operator/badge.json)](https://kadet-hub.org/generators/prometheus-operator/)

Prometheus Operator Generator

Published on kadet-hub (catalog): pin a released version by digest from its catalog page.

Kapitan kadet generator for Prometheus Operator custom resources (monitoring.coreos.com):

Section	Kind	apiVersion	Output key
`prometheuses`	Prometheus	`monitoring.coreos.com/v1`	`<namespace>/<name>-prom`
`prometheus_agents`	PrometheusAgent	`monitoring.coreos.com/v1alpha1`	`<namespace>/<name>-promagent`
`alertmanagers`	Alertmanager	`monitoring.coreos.com/v1`	`<namespace>/<name>-am`
`alertmanager_configs`	AlertmanagerConfig	`monitoring.coreos.com/v1alpha1`	`<namespace>/<name>-amcfg`
`thanos_rulers`	ThanosRuler	`monitoring.coreos.com/v1`	`<namespace>/<name>-ruler`
`probes`	Probe	`monitoring.coreos.com/v1`	`<namespace>/<name>-prb`
`scrape_configs`	ScrapeConfig	`monitoring.coreos.com/v1alpha1`	`<namespace>/<name>-scfg`
`service_monitors`	ServiceMonitor	`monitoring.coreos.com/v1`	`<namespace>/<name>-smon`
`pod_monitors`	PodMonitor	`monitoring.coreos.com/v1`	`<namespace>/<name>-pmon`
`prometheus_rules`	PrometheusRule	`monitoring.coreos.com/v1`	`<namespace>/<name>-promrule`

rbac: true on a Prometheus or PrometheusAgent adds its ServiceAccount, ClusterRole and ClusterRoleBinding (see RBAC).

These are all monitoring.coreos.com kinds the operator and the kube-prometheus-stack chart install. Built for Prometheus Operator 0.94.1. monitoring.thanos.io resources (Thanos Operator) belong in the thanos generator.

Usage

Kapitan Configuration

parameters:
  kapitan:
    dependencies:
      - type: oci
        source: ghcr.io/kadet-hub/prometheus-operator@sha256:<digest>
        output_path: lib/prometheus-operator
    compile:
      - output_path: manifests/prometheus-operator/
        input_type: kadet
        output_type: yml
        input_paths:
          - lib/prometheus-operator

Inventory Contract

All keys live under parameters.generators.prometheus_operator. namespace at that level sets the default namespace, falling back to parameters.namespace, then default. release_label at that level is described under kube-prometheus-stack.

Every resource entry accepts namespace, labels, annotations and spec. For the same field, spec loses to the flat keys and shorthands below; a flat key or shorthand that overrides a spec value logs a warning.

Flat keys are the snake_case spelling of the CRD spec fields; values pass through unchanged unless a shorthand applies:

Kind	Flat keys
Prometheus, PrometheusAgent	`service_account_name`, `replicas`, `shards`, `version`, `image`, `scrape_interval`, `external_labels`, `resources`, `storage`, `remote_write`, `service_monitor_selector`, `service_monitor_namespace_selector`, `pod_monitor_selector`, `pod_monitor_namespace_selector`, `probe_selector`, `probe_namespace_selector`, `scrape_config_selector`, `scrape_config_namespace_selector`
Prometheus only	`retention`, `retention_size`, `evaluation_interval`, `rule_selector`, `rule_namespace_selector`, `alerting`
PrometheusAgent only	`mode`
Alertmanager	`replicas`, `retention`, `service_account_name`, `config_secret`, `alertmanager_config_selector`, `alertmanager_config_namespace_selector`, `storage`
AlertmanagerConfig	`route`, `receivers`, `inhibit_rules`, `mute_time_intervals`
ThanosRuler	`replicas`, `retention`, `evaluation_interval`, `rule_selector`, `rule_namespace_selector`, `query_endpoints`, `query_config`, `alertmanagers_url`, `alertmanagers_config`, `service_account_name`
Probe	`prober`, `module`, `targets`, `interval`, `scrape_timeout`, `job_name`
ScrapeConfig	`job_name`, `static_configs`, `kubernetes_sd_configs` (`kubernetesSDConfigs`), `http_sd_configs` (`httpSDConfigs`), `scrape_interval`, `metrics_path`, `scheme`
ServiceMonitor	`selector`, `namespace_selector`, `endpoints`, `job_label`, `target_labels`, `pod_target_labels`, `sample_limit`
PodMonitor	`selector`, `namespace_selector`, `pod_metrics_endpoints`, `job_label`, `pod_target_labels`, `sample_limit`
PrometheusRule	`groups`, `rules` (shorthand below)

Shorthands:

Input	Result	Source
`selector` and any `*_selector` except `namespace_selector`: `{<label>: <value>, ...}`	`{matchLabels: {<label>: <value>, ...}}`	LabelSelector
`storage: <size>` (Prometheus, PrometheusAgent, Alertmanager)	`{volumeClaimTemplate: {spec: {resources: {requests: {storage: <size>}}}}}`	storage guide, StorageSpec
Probe `prober: <host:port>`	`{url: <host:port>}`	ProberSpec
Probe `targets: [<target>, ...]`	`{staticConfig: {static: [<target>, ...]}}`	ProbeTargets
ServiceMonitor `endpoints`, PodMonitor `pod_metrics_endpoints`: `<port name>` or a list whose items are port names or endpoint objects	`[{port: <port name>}, ...]`	Endpoint, PodMetricsEndpoint, getting started
ServiceMonitor, PodMonitor `namespace_selector: [<namespace>, ...]`	`{matchNames: [<namespace>, ...]}`	NamespaceSelector
PrometheusRule `rules: [<rule>, ...]`	`{groups: [{name: <resource name>, rules: [<rule>, ...]}]}`	RuleGroup

A selector that contains matchLabels or matchExpressions, and {}, pass through unchanged, as do dict values of the other keys. namespace_selector dicts such as {any: true} pass through unchanged. Port numbers have no shorthand: a PodMonitor endpoint on a number needs {portNumber: <n>}, and a ServiceMonitor endpoint names a Service port. rules names its group after the resource; the operator writes one rule file per PrometheusRule, so the name is unique. Set rules or groups, not both; setting both fails the compile.

No defaults are added. The CRDs and the operator already default replicas, retention, intervals and port names, the operator’s flags set image and version, and the Alertmanager config Secret defaults to alertmanager-<name>; emitting any of them would only pin today’s values or override the operator’s configuration. Selectors stay unset unless configured: an unset selector selects nothing and {} selects everything (API reference), and choosing between them is a deployment decision. With all four of service_monitor_selector, pod_monitor_selector, probe_selector and scrape_config_selector unset, the operator leaves the Prometheus configuration unmanaged.

A ServiceMonitor or PodMonitor without namespace_selector discovers targets only in its own namespace (NamespaceSelector); scraping all namespaces needs namespace_selector: {any: true}. selector and ServiceMonitor endpoints are required by the CRD and have no default, so a monitor without them fails schema validation at compile time.

kube-prometheus-stack

The Prometheus and ThanosRuler of the kube-prometheus-stack chart select ServiceMonitors, PodMonitors, Probes, ScrapeConfigs and PrometheusRules by the label release: <helm release name> as long as the chart’s *SelectorNilUsesHelmValues values keep their default true (values, Prometheus template, ThanosRuler template; chart 92.3.0, Prometheus Operator 0.94.1). release_label: <helm release name> adds that label to every ServiceMonitor, PodMonitor, Probe, ScrapeConfig and PrometheusRule this generator renders. It has no default. A release key in a resource’s own labels wins over it. The chart’s AlertmanagerConfig selector does not use the label, so AlertmanagerConfig does not get it.

RBAC

rbac: true on a Prometheus or PrometheusAgent entry adds the RBAC the upstream RBAC guide lists as a prerequisite. Absent or false adds nothing.

Resource	Output key	Name
ServiceAccount	`<namespace>/<sa>-sa`	`<sa>`
ClusterRole	`<namespace>-<name>-clusterrole`	`<namespace>-<name>`
ClusterRoleBinding	`<namespace>-<name>-crb`	`<namespace>-<name>`

<sa> is service_account_name (or serviceAccountName in spec), else the CR name; spec.serviceAccountName is set to it. The ClusterRole grants get/list/watch on nodes, nodes/metrics, services, endpoints, pods, endpointslices and ingresses, get on configmaps and get on /metrics. The CR’s labels apply to all three. A Prometheus and a PrometheusAgent with the same name and namespace cannot both set rbac: true.

Example

parameters:
  generators:
    prometheus_operator:
      namespace: monitoring
      prometheuses:
        main:
          rbac: true
          replicas: 2
          retention: 15d
          storage: 50Gi
          service_monitor_selector:
            team: platform
          service_monitor_namespace_selector: {}
          rule_selector:
            team: platform
          alerting:
            alertmanagers:
              - name: alertmanager-operated
                namespace: monitoring
                port: web
          spec:
            enableAdminAPI: false
      prometheus_agents:
        agent:
          rbac: true
          service_account_name: prometheus-agent
          remote_write:
            - url: https://metrics.example.com/api/v1/write
          pod_monitor_selector:
            team: platform
      alertmanagers:
        main:
          replicas: 3
          storage: 1Gi
          alertmanager_config_selector:
            team: platform
      alertmanager_configs:
        platform:
          labels:
            team: platform
          route:
            receiver: team-mail
            groupBy:
              - alertname
          receivers:
            - name: team-mail
              emailConfigs:
                - to: oncall@example.com
      thanos_rulers:
        main:
          query_endpoints:
            - dnssrv+_http._tcp.thanos-query.monitoring.svc
          rule_selector:
            team: platform
          alertmanagers_url:
            - dnssrv+_web._tcp.alertmanager-operated.monitoring.svc
      probes:
        website:
          module: http_2xx
          prober: blackbox-exporter.monitoring.svc:9115
          targets:
            - https://example.com
      scrape_configs:
        node-exporter:
          static_configs:
            - targets:
                - node-1.example.com:9100
          metrics_path: /metrics
      service_monitors:
        alertmanager:
          labels:
            team: platform
          selector:
            operated-alertmanager: "true"
          endpoints: web
      pod_monitors:
        thanos-ruler:
          labels:
            team: platform
          selector:
            app.kubernetes.io/name: thanos-ruler
          namespace_selector:
            - monitoring
          pod_metrics_endpoints:
            - web
      prometheus_rules:
        platform-alerts:
          labels:
            team: platform
          rules:
            - alert: AlertmanagerDown
              expr: absent(up{job="alertmanager-operated"} == 1)
              for: 5m
              labels:
                severity: critical

Versions

Add a version's inventory entry, then compile with the consumer workflow, which verifies the artifact and runs Kapitan in the sandbox.

Free of charge, as is and on a best-effort basis: use at your own risk, and review the compiled output before you apply it. Terms

This catalog was built from index serial 47. Set index_serial: 47 in .kapitan-sandbox.yaml and the consumer workflow refuses any older index, so a rolled-back index cannot bring back a yanked version.

Checks find known patterns; they do not prove a generator safe. What a listing covers

Version	Built for (schema-checked)
1.1.3	Kubernetes 1.37.1 Prometheus Operator 0.94.1
1.1.2	Kubernetes 1.35.0 Prometheus Operator 0.94.1
1.1.1	Kubernetes 1.35.0 Prometheus Operator 0.94.1
1.1.0	Kubernetes 1.35.0 Prometheus Operator 0.94.1
1.0.0	Kubernetes 1.35.0 Prometheus Operator 0.94.1

1.1.3# 2026-10-16

Inventory

parameters:
  kapitan:
    dependencies:
      - type: oci
        source: ghcr.io/kadet-hub/prometheus-operator:1.1.3@sha256:705a388f56bf5abf5bd9cc9e34b843fdee4666c7e47eafd037955612df4b72b5
        output_path: lib/prometheus-operator

Verify

gh attestation verify \
  oci://ghcr.io/kadet-hub/prometheus-operator@sha256:705a388f56bf5abf5bd9cc9e34b843fdee4666c7e47eafd037955612df4b72b5 \
  --owner kadet-hub \
  --cert-identity https://github.com/kadet-hub/registry/.github/workflows/release.yml@refs/heads/main

Transparency log: Rekor entry 3274968024, in Sigstore's public, append-only log, so the attestation stays checkable independent of this site.

Kapitan declared: >=0.36.3,<0.37
Kapitan checked: 0.36.3
Backends checked: reclass-rs, omegaconf
With --cache: passed
krab: compatible
Built for (schema-checked): Kubernetes 1.37.1
Prometheus Operator 0.94.1
Source: prometheus-operator-v1.1.3 · 5d0cd337937f9f34a1a7268ce955a93caa839a6d · prometheus-operator
Binaries: none
Output capabilities: none
Digest: sha256:705a388f56bf5abf5bd9cc9e34b843fdee4666c7e47eafd037955612df4b72b5

Checks

Checked by the release run on 2026-10-16, gate at a31e96336fac.

Secrets gitleaks 8.30.1
No secret matched the marketplace's gitleaks rules.
Malware ClamAV 1.5.4
No file matched a ClamAV signature.
Malicious package heuristics GuardDog 3.2.0
No GuardDog threat rule matched.
Dangerous code Semgrep 1.180.0
No marketplace Semgrep rule matched, such as eval, subprocess or network calls.
Python errors Ruff 0.17.0
No syntax error or undefined name (Ruff, error rules only).
File tree tree_check.py
No symlink, executable or banned file; imports within the allowlist.
Sandboxed compile gVisor 20261005, Kapitan 0.36.3
The fixture compiled without network, with decoy credentials; no undeclared program ran, no decoy was read.
Output capabilities Conftest 0.71.1
The compiled output uses only the capabilities the manifest declares.
CI detection Kapitan 0.36.3
The output is the same with CI variables set.

SBOM (SPDX 2.3)

Output diff

Fixture output against 1.1.2: 0 files, 0 hunks.

Output diff

1.1.2# 2026-10-14

Inventory

parameters:
  kapitan:
    dependencies:
      - type: oci
        source: ghcr.io/kadet-hub/prometheus-operator:1.1.2@sha256:732c2d7126b56aaa6eebbacd66bdfa9e12ca831d23e6ec66dff14d174df235ae
        output_path: lib/prometheus-operator

Verify

gh attestation verify \
  oci://ghcr.io/kadet-hub/prometheus-operator@sha256:732c2d7126b56aaa6eebbacd66bdfa9e12ca831d23e6ec66dff14d174df235ae \
  --owner kadet-hub \
  --cert-identity https://github.com/kadet-hub/registry/.github/workflows/release.yml@refs/heads/main

Transparency log: Rekor entry 3250301555, in Sigstore's public, append-only log, so the attestation stays checkable independent of this site.

Kapitan declared: >=0.36.3,<0.37
Kapitan checked: 0.36.3
Backends checked: not recorded
With --cache: not recorded
krab: compatible
Built for (schema-checked): Kubernetes 1.35.0
Prometheus Operator 0.94.1
Source: prometheus-operator-v1.1.2 · e4891e8fd85ca0a19ebf361e8b54fd6473fd8a2f · prometheus-operator
Binaries: none
Output capabilities: none
Digest: sha256:732c2d7126b56aaa6eebbacd66bdfa9e12ca831d23e6ec66dff14d174df235ae

Checks

Checked by the release run on 2026-10-14, gate at fe9998b5168d.

Secrets gitleaks 8.30.1
No secret matched the marketplace's gitleaks rules.
Malware ClamAV 1.5.4
No file matched a ClamAV signature.
Malicious package heuristics GuardDog 3.2.0
No GuardDog threat rule matched.
Dangerous code Semgrep 1.180.0
No marketplace Semgrep rule matched, such as eval, subprocess or network calls.
Python errors Ruff 0.17.0
No syntax error or undefined name (Ruff, error rules only).
File tree tree_check.py
No symlink, executable or banned file; imports within the allowlist.
Sandboxed compile gVisor 20261005, Kapitan 0.36.3
The fixture compiled without network, with decoy credentials; no undeclared program ran, no decoy was read.
Output capabilities Conftest 0.71.1
The compiled output uses only the capabilities the manifest declares.
CI detection Kapitan 0.36.3
The output is the same with CI variables set.

SBOM (SPDX 2.3)

Output diff

No output diff recorded: this version was published before the release run recorded one.

1.1.1# 2026-10-13

Inventory

parameters:
  kapitan:
    dependencies:
      - type: oci
        source: ghcr.io/kadet-hub/prometheus-operator:1.1.1@sha256:a6122bb8255e34112a7f5d1a9a80ca0d65eba0c4a615338c5687cf74fb403e52
        output_path: lib/prometheus-operator

Verify

gh attestation verify \
  oci://ghcr.io/kadet-hub/prometheus-operator@sha256:a6122bb8255e34112a7f5d1a9a80ca0d65eba0c4a615338c5687cf74fb403e52 \
  --owner kadet-hub \
  --cert-identity https://github.com/kadet-hub/registry/.github/workflows/release.yml@refs/heads/main

Transparency log: Rekor entry 3244276170, in Sigstore's public, append-only log, so the attestation stays checkable independent of this site.

Kapitan declared: >=0.36.3,<0.37
Kapitan checked: 0.36.3
Backends checked: not recorded
With --cache: not recorded
krab: compatible
Built for (schema-checked): Kubernetes 1.35.0
Prometheus Operator 0.94.1
Source: prometheus-operator-v1.1.1 · 9166cb30e0ae4874bc8f229c6a6823eff7451d04 · prometheus-operator
Binaries: none
Output capabilities: none
Digest: sha256:a6122bb8255e34112a7f5d1a9a80ca0d65eba0c4a615338c5687cf74fb403e52

Checks

Checked by the release run on 2026-10-13, gate at cb64712208f8.

Secrets gitleaks 8.30.1
No secret matched the marketplace's gitleaks rules.
Malware ClamAV 1.5.4
No file matched a ClamAV signature.
Malicious package heuristics GuardDog 3.2.0
No GuardDog threat rule matched.
Dangerous code Semgrep 1.180.0
No marketplace Semgrep rule matched, such as eval, subprocess or network calls.
Python errors Ruff 0.17.0
No syntax error or undefined name (Ruff, error rules only).
File tree tree_check.py
No symlink, executable or banned file; imports within the allowlist.
Sandboxed compile gVisor 20261005, Kapitan 0.36.3
The fixture compiled without network, with decoy credentials; no undeclared program ran, no decoy was read.
Output capabilities Conftest 0.71.1
The compiled output uses only the capabilities the manifest declares.
CI detection Kapitan 0.36.3
The output is the same with CI variables set.

SBOM (SPDX 2.3)

Output diff

No output diff recorded: this version was published before the release run recorded one.

1.1.0# 2026-10-11

Inventory

parameters:
  kapitan:
    dependencies:
      - type: oci
        source: ghcr.io/kadet-hub/prometheus-operator:1.1.0@sha256:f570e4390728d59443c81a41253e74410f5fba7986d0683902494cc2b7cdab69
        output_path: lib/prometheus-operator

Verify

gh attestation verify \
  oci://ghcr.io/kadet-hub/prometheus-operator@sha256:f570e4390728d59443c81a41253e74410f5fba7986d0683902494cc2b7cdab69 \
  --owner kadet-hub \
  --cert-identity https://github.com/kadet-hub/registry/.github/workflows/release.yml@refs/heads/main

Transparency log: Rekor entry 3214144384, in Sigstore's public, append-only log, so the attestation stays checkable independent of this site.

Kapitan declared: >=0.36.3,<0.37
Kapitan checked: 0.36.3
Backends checked: not recorded
With --cache: not recorded
krab: compatible
Built for (schema-checked): Kubernetes 1.35.0
Prometheus Operator 0.94.1
Source: prometheus-operator-v1.1.0 · dccb03cf01fd06f12e450d884b7e415e8aa2e959 · prometheus-operator
Binaries: none
Output capabilities: none
Digest: sha256:f570e4390728d59443c81a41253e74410f5fba7986d0683902494cc2b7cdab69

Checks

Checked by the release run on 2026-10-11, gate at ba56b80d2115.

Secrets gitleaks 8.30.1
No secret matched the marketplace's gitleaks rules.
Malware ClamAV 1.5.4
No file matched a ClamAV signature.
Malicious package heuristics GuardDog 3.2.0
No GuardDog threat rule matched.
Dangerous code Semgrep 1.180.0
No marketplace Semgrep rule matched, such as eval, subprocess or network calls.
Python errors Ruff 0.17.0
No syntax error or undefined name (Ruff, error rules only).
File tree tree_check.py
No symlink, executable or banned file; imports within the allowlist.
Sandboxed compile gVisor 20261005, Kapitan 0.36.3
The fixture compiled without network, with decoy credentials; no undeclared program ran, no decoy was read.
Output capabilities Conftest 0.71.1
The compiled output uses only the capabilities the manifest declares.
CI detection Kapitan 0.36.3
The output is the same with CI variables set.

SBOM (SPDX 2.3)

Output diff

No output diff recorded: this version was published before the release run recorded one.

1.0.0# 2026-10-11

Inventory

parameters:
  kapitan:
    dependencies:
      - type: oci
        source: ghcr.io/kadet-hub/prometheus-operator:1.0.0@sha256:dad06b1497830479704711a04b33eeedbdc3ad295542a8cd093d9861d6200b4c
        output_path: lib/prometheus-operator

Verify

gh attestation verify \
  oci://ghcr.io/kadet-hub/prometheus-operator@sha256:dad06b1497830479704711a04b33eeedbdc3ad295542a8cd093d9861d6200b4c \
  --owner kadet-hub \
  --cert-identity https://github.com/kadet-hub/registry/.github/workflows/release.yml@refs/heads/main

Transparency log: Rekor entry 3211168380, in Sigstore's public, append-only log, so the attestation stays checkable independent of this site.

Kapitan declared: >=0.36.3,<0.37
Kapitan checked: 0.36.3
Backends checked: not recorded
With --cache: not recorded
krab: compatible
Built for (schema-checked): Kubernetes 1.35.0
Prometheus Operator 0.94.1
Source: prometheus-operator-v1.0.0 · 91b3915d464dd9327ffce043f5ae528c26de7dff · prometheus-operator
Binaries: none
Output capabilities: none
Digest: sha256:dad06b1497830479704711a04b33eeedbdc3ad295542a8cd093d9861d6200b4c

Checks

Checked by the release run on 2026-10-11, gate at 994707bbec61.

Secrets gitleaks 8.30.1
No secret matched the marketplace's gitleaks rules.
Malware ClamAV 1.5.4
No file matched a ClamAV signature.
Malicious package heuristics GuardDog 3.2.0
No GuardDog threat rule matched.
Dangerous code Semgrep 1.180.0
No marketplace Semgrep rule matched, such as eval, subprocess or network calls.
Python errors Ruff 0.17.0
No syntax error or undefined name (Ruff, error rules only).
File tree tree_check.py
No symlink, executable or banned file; imports within the allowlist.
Sandboxed compile gVisor 20261005, Kapitan 0.36.3
The fixture compiled without network, with decoy credentials; no undeclared program ran, no decoy was read.
Output capabilities Conftest 0.71.1
The compiled output uses only the capabilities the manifest declares.
CI detection Kapitan 0.36.3
The output is the same with CI variables set.

SBOM (SPDX 2.3)

Output diff

No output diff recorded: this version was published before the release run recorded one.