thanos

Thanos Generator

Published on kadet-hub (catalog): pin a released version by digest from its catalog page.

Kapitan kadet generator for Thanos Operator resources (monitoring.thanos.io/v1alpha1):

• ThanosQuery: Thanos Querier, optionally fronted by Query Frontend
• ThanosReceive: Receive router and ingester hashrings
• ThanosRuler: rule evaluation against Thanos Query
• ThanosStore: Store Gateway serving blocks from object storage
• ThanosCompact: compaction, downsampling and retention of object storage blocks

Built for Thanos Operator main@1b6edfb. The Thanos Operator has no release yet and marks its APIs alpha, so the schemas are pinned to main commit 1b6edfbba0e54af83870b158ee1124e499455b43; expect breaking changes when upstream moves.

monitoring.coreos.com/v1 ThanosRuler (Prometheus Operator) is a different API and belongs to the prometheus-operator generator. The Thanos sidecar is configured on the Prometheus Operator Prometheus resource. The object storage Secret belongs in the kubernetes generator.

Usage

Kapitan Configuration

parameters:
  kapitan:
    dependencies:
      - type: oci
        source: ghcr.io/kadet-hub/thanos@sha256:<digest>
        output_path: lib/thanos
    compile:
      - output_path: manifests/thanos/
        input_type: kadet
        output_type: yml
        input_paths:
          - lib/thanos

Inventory Contract

All keys live under parameters.generators.thanos.

Every resource accepts namespace, labels, annotations and spec. labels and annotations set the custom resource metadata; the CRD fields spec.labels and spec.annotations, which the operator copies to the generated workloads, are set through spec. For the same field, defaults lose to spec, and spec loses to the flat keys and shorthands below; a flat key or shorthand that overrides a spec value logs a warning.

Flat keys are the snake_case spelling of the top-level CRD spec fields; values pass through unchanged.

Common to ThanosQuery, ThanosRuler, ThanosStore and ThanosCompact: additional_args, additional_containers, additional_env, additional_ports, additional_service_ports, additional_volume_mounts, additional_volumes, affinity, base_image, config_maps, image_pull_policy, image_pull_secrets, log_format, log_level, node_selector, paused, pod_disruption_budget_config, resource_requirements, secrets, security_context, tolerations, topology_spread_constraints, version.

StatefulSet fields, on ThanosReceive, ThanosRuler, ThanosStore and ThanosCompact: min_ready_seconds, persistent_volume_claim_retention_policy, pod_management_policy, termination_grace_period_seconds.

Shorthands:

thanos.yaml is the Secret key used throughout the upstream samples and docs. A dict passes through, for a different key. On a ThanosReceive or ThanosRuler, set a different Secret through ingester_spec.defaultObjectStorageConfig or ruler_mode.stateful.objectStorageConfig in the full {name, key} form.

Defaults

A field the inventory leaves out is filled as below. Fields the CRD marks required get the CRD’s own default, so the shortest entry passes offline schema validation and behaves as if the API server had defaulted it. Other CRD defaults (imagePullPolicy: IfNotPresent, logFormat: logfmt and so on) are left to the API server.

The Thanos documentation is the one for v0.42.0, the version the operator deploys by default (options). No other component gets resource requests; neither the operator nor the Thanos docs give sizing values for them. The receive replication factor stays at the CRD default 1, since the Thanos docs give no recommended value; with replicationFactor 3 or 5 every hashring needs at least that many replicas to reach the write quorum (Thanos receive docs). Fields without a default (storage.size, ThanosRuler alertmanagerURL, ThanosReceive hashrings) stay required in the inventory.

Example

parameters:
  generators:
    thanos:
      namespace: monitoring
      object_storage_config: thanos-object-storage
      thanos_queries:
        global:
          replicas: 2
          query_frontend:
            replicas: 2
            logQueriesLongerThan: 10s
      thanos_receives:
        ingest:
          router_spec:
            replicas: 3
            replicationFactor: 3
          ingester_spec:
            hashrings:
              - name: default
                replicas: 3
                storage:
                  size: 10Gi
      thanos_rulers:
        rules:
          alertmanager_url: http://alertmanager.monitoring.svc:9093
          storage:
            size: 1Gi
      thanos_stores:
        gateway:
          replicas: 2
          storage:
            size: 10Gi
      thanos_compacts:
        compactor:
          retention: 1y
          storage:
            size: 50Gi

Every kind reads its object storage from the Secret thanos-object-storage, key thanos.yaml; the query deduplicates on the replica labels of Prometheus, the ingesters and the ruler; the compactor keeps every resolution for one year and requests one CPU.