observatorium-template.yaml

apiVersion: template.openshift.io/v1
kind: Template
metadata:
  name: observatorium
objects:
- apiVersion: apps/v1
  kind: Deployment
  metadata:
    labels:
      app.kubernetes.io/component: avalanche
      app.kubernetes.io/name: avalanche-remote-writer
      app.kubernetes.io/part-of: observatorium
    name: avalanche-remote-writer
  spec:
    replicas: ${{AVALANCHE_REPLICAS}}
    selector:
      matchLabels:
        app.kubernetes.io/component: avalanche
        app.kubernetes.io/name: avalanche-remote-writer
        app.kubernetes.io/part-of: observatorium
    template:
      metadata:
        labels:
          app.kubernetes.io/component: avalanche
          app.kubernetes.io/name: avalanche-remote-writer
          app.kubernetes.io/part-of: observatorium
      spec:
        containers:
        - args:
          - --metric-count=1
          - --series-count=8333
          - --remote-url=http://${METRICS_WRITE_SERVICE_NAME}.${OBSERVATORIUM_METRICS_NAMESPACE}.svc.cluster.local:${METRICS_WRITE_SERVICE_PORT}/api/v1/receive
          - --remote-write-interval=30s
          - --remote-requests-count=1000000
          - --value-interval=3600
          - --series-interval=315360000
          - --metric-interval=315360000
          - --remote-tenant-header=THANOS-TENANT
          - --remote-tenant=0fc2b00e-201b-4c17-b9f2-19d91adc4fd2
          image: quay.io/observatorium/avalanche:make-tenant-header-configurable-2021-10-07-0a2cbf5
          name: avalanche-remote-writer
- apiVersion: v1
  kind: Service
  metadata:
    labels:
      app.kubernetes.io/component: api-cache
      app.kubernetes.io/instance: observatorium
      app.kubernetes.io/name: memcached
      app.kubernetes.io/part-of: observatorium
      app.kubernetes.io/version: ${MEMCACHED_IMAGE_TAG}
    name: observatorium-api-cache-memcached
  spec:
    clusterIP: None
    ports:
    - name: client
      port: 11211
      targetPort: 11211
    - name: metrics
      port: 9150
      targetPort: 9150
    selector:
      app.kubernetes.io/component: api-cache
      app.kubernetes.io/instance: observatorium
      app.kubernetes.io/name: memcached
      app.kubernetes.io/part-of: observatorium
- apiVersion: v1
  imagePullSecrets:
  - name: quay.io
  kind: ServiceAccount
  metadata:
    labels:
      app.kubernetes.io/component: api-cache
      app.kubernetes.io/instance: observatorium
      app.kubernetes.io/name: memcached
      app.kubernetes.io/part-of: observatorium
      app.kubernetes.io/version: ${MEMCACHED_IMAGE_TAG}
    name: observatorium-api-cache-memcached
- apiVersion: monitoring.coreos.com/v1
  kind: ServiceMonitor
  metadata:
    labels:
      prometheus: app-sre
    name: observatorium-api-cache-memcached
  spec:
    endpoints:
    - port: metrics
    namespaceSelector:
      matchNames: ${{NAMESPACES}}
    selector:
      matchLabels:
        app.kubernetes.io/component: api-cache
        app.kubernetes.io/instance: observatorium
        app.kubernetes.io/name: memcached
        app.kubernetes.io/part-of: observatorium
- apiVersion: apps/v1
  kind: StatefulSet
  metadata:
    labels:
      app.kubernetes.io/component: api-cache
      app.kubernetes.io/instance: observatorium
      app.kubernetes.io/name: memcached
      app.kubernetes.io/part-of: observatorium
      app.kubernetes.io/version: ${MEMCACHED_IMAGE_TAG}
    name: observatorium-api-cache-memcached
  spec:
    replicas: 1
    selector:
      matchLabels:
        app.kubernetes.io/component: api-cache
        app.kubernetes.io/instance: observatorium
        app.kubernetes.io/name: memcached
        app.kubernetes.io/part-of: observatorium
    serviceName: observatorium-api-cache-memcached
    template:
      metadata:
        labels:
          app.kubernetes.io/component: api-cache
          app.kubernetes.io/instance: observatorium
          app.kubernetes.io/name: memcached
          app.kubernetes.io/part-of: observatorium
          app.kubernetes.io/version: ${MEMCACHED_IMAGE_TAG}
      spec:
        containers:
        - args:
          - -m ${MEMCACHED_MEMORY_LIMIT_MB}
          - -I 5m
          - -c ${MEMCACHED_CONNECTION_LIMIT}
          - -v
          image: ${MEMCACHED_IMAGE}:${MEMCACHED_IMAGE_TAG}
          imagePullPolicy: IfNotPresent
          name: memcached
          ports:
          - containerPort: 11211
            name: client
          resources:
            limits:
              cpu: ${MEMCACHED_CPU_LIMIT}
              memory: ${MEMCACHED_MEMORY_LIMIT}
            requests:
              cpu: ${MEMCACHED_CPU_REQUEST}
              memory: ${MEMCACHED_MEMORY_REQUEST}
          terminationMessagePolicy: FallbackToLogsOnError
        - args:
          - --memcached.address=localhost:11211
          - --web.listen-address=0.0.0.0:9150
          image: ${MEMCACHED_EXPORTER_IMAGE}:${MEMCACHED_EXPORTER_IMAGE_TAG}
          imagePullPolicy: IfNotPresent
          name: exporter
          ports:
          - containerPort: 9150
            name: metrics
          resources:
            limits:
              cpu: ${MEMCACHED_EXPORTER_CPU_LIMIT}
              memory: ${MEMCACHED_EXPORTER_MEMORY_LIMIT}
            requests:
              cpu: ${MEMCACHED_EXPORTER_CPU_REQUEST}
              memory: ${MEMCACHED_EXPORTER_MEMORY_REQUEST}
        securityContext: {}
        serviceAccountName: observatorium-api-cache-memcached
- apiVersion: apps/v1
  kind: Deployment
  metadata:
    labels:
      app.kubernetes.io/component: rules-obsctl-reloader
      app.kubernetes.io/instance: observatorium
      app.kubernetes.io/name: rules-obsctl-reloader
      app.kubernetes.io/part-of: observatorium
      app.kubernetes.io/version: ${OBSCTL_RELOADER_IMAGE_TAG}
    name: rules-obsctl-reloader
  spec:
    replicas: 1
    selector:
      matchLabels:
        app.kubernetes.io/component: rules-obsctl-reloader
        app.kubernetes.io/instance: observatorium
        app.kubernetes.io/name: rules-obsctl-reloader
        app.kubernetes.io/part-of: observatorium
    strategy:
      rollingUpdate:
        maxSurge: 0
        maxUnavailable: 1
    template:
      metadata:
        labels:
          app.kubernetes.io/component: rules-obsctl-reloader
          app.kubernetes.io/instance: observatorium
          app.kubernetes.io/name: rules-obsctl-reloader
          app.kubernetes.io/part-of: observatorium
          app.kubernetes.io/version: ${OBSCTL_RELOADER_IMAGE_TAG}
      spec:
        containers:
        - args:
          - --log.level=debug
          - --web.internal.listen=0.0.0.0:8081
          - --sleep-duration-seconds=${SLEEP_DURATION_SECONDS}
          - --config-reload-interval-seconds=${CONFIG_RELOAD_INTERVAL_SECONDS}
          - --observatorium-api-url=${OBSERVATORIUM_URL}
          - --managed-tenants=${MANAGED_TENANTS}
          - --issuer-url=${OIDC_ISSUER_URL}
          - --audience=${OIDC_AUDIENCE}
          env:
          - name: NAMESPACE_NAME
            valueFrom:
              fieldRef:
                fieldPath: metadata.namespace
          image: ${OBSCTL_RELOADER_IMAGE}:${OBSCTL_RELOADER_IMAGE_TAG}
          imagePullPolicy: IfNotPresent
          name: obsctl-reloader
          resources: {}
        serviceAccountName: rules-obsctl-reloader
- apiVersion: rbac.authorization.k8s.io/v1
  kind: Role
  metadata:
    labels:
      app.kubernetes.io/component: rules-obsctl-reloader
      app.kubernetes.io/instance: observatorium
      app.kubernetes.io/name: rules-obsctl-reloader
      app.kubernetes.io/part-of: observatorium
      app.kubernetes.io/version: ${OBSCTL_RELOADER_IMAGE_TAG}
    name: rules-obsctl-reloader
  rules:
  - apiGroups:
    - monitoring.coreos.com
    resources:
    - prometheusrules
    verbs:
    - get
    - list
    - watch
  - apiGroups:
    - loki.grafana.com
    resources:
    - alertingrules
    - recordingrules
    verbs:
    - get
    - list
    - watch
  - apiGroups:
    - ""
    resources:
    - secrets
    verbs:
    - get
    - list
    - watch
- apiVersion: rbac.authorization.k8s.io/v1
  kind: RoleBinding
  metadata:
    labels:
      app.kubernetes.io/component: rules-obsctl-reloader
      app.kubernetes.io/instance: observatorium
      app.kubernetes.io/name: rules-obsctl-reloader
      app.kubernetes.io/part-of: observatorium
      app.kubernetes.io/version: ${OBSCTL_RELOADER_IMAGE_TAG}
    name: rules-obsctl-reloader
  roleRef:
    apiGroup: rbac.authorization.k8s.io
    kind: Role
    name: rules-obsctl-reloader
  subjects:
  - kind: ServiceAccount
    name: rules-obsctl-reloader
- apiVersion: v1
  kind: Service
  metadata:
    labels:
      app.kubernetes.io/component: rules-obsctl-reloader
      app.kubernetes.io/instance: observatorium
      app.kubernetes.io/name: rules-obsctl-reloader
      app.kubernetes.io/part-of: observatorium
      app.kubernetes.io/version: ${OBSCTL_RELOADER_IMAGE_TAG}
    name: rules-obsctl-reloader
  spec:
    ports:
    - name: internal
      port: 8081
      targetPort: 8081
    selector:
      app.kubernetes.io/component: rules-obsctl-reloader
      app.kubernetes.io/instance: observatorium
      app.kubernetes.io/name: rules-obsctl-reloader
      app.kubernetes.io/part-of: observatorium
- apiVersion: v1
  kind: ServiceAccount
  metadata:
    labels:
      app.kubernetes.io/component: rules-obsctl-reloader
      app.kubernetes.io/instance: observatorium
      app.kubernetes.io/name: rules-obsctl-reloader
      app.kubernetes.io/part-of: observatorium
      app.kubernetes.io/version: ${OBSCTL_RELOADER_IMAGE_TAG}
    name: rules-obsctl-reloader
- apiVersion: monitoring.coreos.com/v1
  kind: ServiceMonitor
  metadata:
    labels:
      prometheus: app-sre
    name: rules-obsctl-reloader
  spec:
    endpoints:
    - port: internal
    namespaceSelector:
      matchNames: ${{NAMESPACES}}
    selector:
      matchLabels:
        app.kubernetes.io/component: rules-obsctl-reloader
        app.kubernetes.io/instance: observatorium
        app.kubernetes.io/name: rules-obsctl-reloader
        app.kubernetes.io/part-of: observatorium
- apiVersion: apps/v1
  kind: Deployment
  metadata:
    labels:
      app.kubernetes.io/component: rules-storage
      app.kubernetes.io/instance: observatorium
      app.kubernetes.io/name: rules-objstore
      app.kubernetes.io/part-of: observatorium
      app.kubernetes.io/version: ${RULES_OBJSTORE_IMAGE_TAG}
    name: rules-objstore
  spec:
    replicas: 2
    selector:
      matchLabels:
        app.kubernetes.io/component: rules-storage
        app.kubernetes.io/instance: observatorium
        app.kubernetes.io/name: rules-objstore
        app.kubernetes.io/part-of: observatorium
    strategy:
      rollingUpdate:
        maxSurge: 0
        maxUnavailable: 1
    template:
      metadata:
        labels:
          app.kubernetes.io/component: rules-storage
          app.kubernetes.io/instance: observatorium
          app.kubernetes.io/name: rules-objstore
          app.kubernetes.io/part-of: observatorium
          app.kubernetes.io/version: ${RULES_OBJSTORE_IMAGE_TAG}
      spec:
        affinity:
          podAntiAffinity:
            preferredDuringSchedulingIgnoredDuringExecution:
            - podAffinityTerm:
                labelSelector:
                  matchExpressions:
                  - key: app.kubernetes.io/name
                    operator: In
                    values:
                    - rules-objstore
                topologyKey: kubernetes.io/hostname
              weight: 100
        containers:
        - args:
          - --debug.name=rules-objstore
          - --web.listen=0.0.0.0:8080
          - --web.internal.listen=0.0.0.0:8081
          - --web.healthchecks.url=http://localhost:8080
          - --log.level=${RULES_OBJSTORE_LOG_LEVEL}
          - --log.format=logfmt
          - --objstore.config-file=/etc/rules-objstore/objstore.yaml
          env:
          - name: AWS_ACCESS_KEY_ID
            valueFrom:
              secretKeyRef:
                key: aws_access_key_id
                name: ${RULES_OBJSTORE_S3_SECRET}
          - name: AWS_SECRET_ACCESS_KEY
            valueFrom:
              secretKeyRef:
                key: aws_secret_access_key
                name: ${RULES_OBJSTORE_S3_SECRET}
          image: ${RULES_OBJSTORE_IMAGE}:${RULES_OBJSTORE_IMAGE_TAG}
          imagePullPolicy: IfNotPresent
          livenessProbe:
            failureThreshold: 10
            httpGet:
              path: /live
              port: 8081
              scheme: HTTP
            periodSeconds: 30
          name: rules-objstore
          ports:
          - containerPort: 8081
            name: internal
          - containerPort: 8080
            name: public
          readinessProbe:
            failureThreshold: 12
            httpGet:
              path: /ready
              port: 8081
              scheme: HTTP
            periodSeconds: 5
          resources: {}
          volumeMounts:
          - mountPath: /etc/rules-objstore/objstore.yaml
            name: objstore
            readOnly: true
            subPath: objstore.yaml
        serviceAccountName: rules-objstore
        volumes:
        - name: objstore
          secret:
            secretName: ${RULES_OBJSTORE_SECRET}
- apiVersion: v1
  kind: Service
  metadata:
    labels:
      app.kubernetes.io/component: rules-storage
      app.kubernetes.io/instance: observatorium
      app.kubernetes.io/name: rules-objstore
      app.kubernetes.io/part-of: observatorium
      app.kubernetes.io/version: ${RULES_OBJSTORE_IMAGE_TAG}
    name: rules-objstore
  spec:
    ports:
    - name: internal
      port: 8081
      targetPort: 8081
    - name: public
      port: 8080
      targetPort: 8080
    selector:
      app.kubernetes.io/component: rules-storage
      app.kubernetes.io/instance: observatorium
      app.kubernetes.io/name: rules-objstore
      app.kubernetes.io/part-of: observatorium
- apiVersion: v1
  kind: ServiceAccount
  metadata:
    labels:
      app.kubernetes.io/component: rules-storage
      app.kubernetes.io/instance: observatorium
      app.kubernetes.io/name: rules-objstore
      app.kubernetes.io/part-of: observatorium
      app.kubernetes.io/version: ${RULES_OBJSTORE_IMAGE_TAG}
    name: rules-objstore
- apiVersion: monitoring.coreos.com/v1
  kind: ServiceMonitor
  metadata:
    labels:
      prometheus: app-sre
    name: rules-objstore
  spec:
    endpoints:
    - port: internal
    namespaceSelector:
      matchNames: ${{NAMESPACES}}
    selector:
      matchLabels:
        app.kubernetes.io/component: rules-storage
        app.kubernetes.io/instance: observatorium
        app.kubernetes.io/name: rules-objstore
        app.kubernetes.io/part-of: observatorium
- apiVersion: monitoring.coreos.com/v1
  kind: PrometheusRule
  metadata:
    labels:
      tenant: rhobs
    name: rules-reloader-slo
  spec:
    groups:
    - interval: 30s
      name: reloader-slo-alert
      rules:
      - alert: AlwaysFiringAlert
        annotations:
          description: Firing alert!
          message: Alert fired.
        expr: vector(1)
        for: 1m
        labels:
          severity: page
      - alert: AlwaysFiringAlert2
        annotations:
          description: Firing alert 2!
          message: Alert 2 fired.
        expr: vector(1)
        for: 1m
        labels:
          severity: page
      - alert: NeverFiringAlert
        annotations:
          description: Does not fire!
          message: Alert not fired.
        expr: vector(0) == 1
        for: 1m
        labels:
          severity: page
    - interval: 30s
      name: reloader-slo-record
      rules:
      - expr: vector(1)
        labels:
          test: slo-record
        record: AlwaysRecord
      - expr: vector(0) == 1
        labels:
          test: slo-record
        record: NeverRecord
    - interval: 30s
      name: reloader-slo-combined
      rules:
      - expr: vector(1)
        labels:
          test: slo-record
        record: CombinedRecord
      - alert: CombinedAlert
        annotations:
          description: Combined alert firing!
          message: Combined alert fired.
        expr: vector(1)
        for: 1m
        labels:
          severity: page
- apiVersion: v1
  data:
    queries.yaml: |-
      "queries":
      - "name": "query-path-sli-1M-samples"
        "query": "avg_over_time(avalanche_metric_mmmmm_0_0{tenant_id=\"0fc2b00e-201b-4c17-b9f2-19d91adc4fd2\"}[1h])"
      - "name": "query-path-sli-10M-samples"
        "query": "avg_over_time(avalanche_metric_mmmmm_0_0{tenant_id=\"0fc2b00e-201b-4c17-b9f2-19d91adc4fd2\"}[10h])"
      - "name": "query-path-sli-100M-samples"
        "query": "avg_over_time(avalanche_metric_mmmmm_0_0{tenant_id=\"0fc2b00e-201b-4c17-b9f2-19d91adc4fd2\"}[100h])"
  kind: ConfigMap
  metadata:
    annotations:
      qontract.recycle: "true"
    labels:
      app.kubernetes.io/component: blackbox-prober
      app.kubernetes.io/instance: observatorium
      app.kubernetes.io/name: observatorium-up
      app.kubernetes.io/part-of: observatorium
      app.kubernetes.io/version: master-2022-03-24-098c31a
    name: observatorium-observatorium-up
- apiVersion: apps/v1
  kind: Deployment
  metadata:
    labels:
      app.kubernetes.io/component: blackbox-prober
      app.kubernetes.io/instance: observatorium
      app.kubernetes.io/name: observatorium-up
      app.kubernetes.io/part-of: observatorium
      app.kubernetes.io/version: master-2022-03-24-098c31a
    name: observatorium-observatorium-up
  spec:
    replicas: ${{UP_REPLICAS}}
    selector:
      matchLabels:
        app.kubernetes.io/component: blackbox-prober
        app.kubernetes.io/instance: observatorium
        app.kubernetes.io/name: observatorium-up
        app.kubernetes.io/part-of: observatorium
    template:
      metadata:
        labels:
          app.kubernetes.io/component: blackbox-prober
          app.kubernetes.io/instance: observatorium
          app.kubernetes.io/name: observatorium-up
          app.kubernetes.io/part-of: observatorium
          app.kubernetes.io/version: master-2022-03-24-098c31a
      spec:
        containers:
        - args:
          - --duration=0
          - --log.level=debug
          - --endpoint-type=metrics
          - --queries-file=/etc/up/queries.yaml
          - --endpoint-read=http://observatorium-thanos-query-frontend.${OBSERVATORIUM_METRICS_NAMESPACE}.svc:9090
          image: quay.io/observatorium/up:master-2022-03-24-098c31a
          name: observatorium-up
          ports:
          - containerPort: 8080
            name: http
          resources:
            limits:
              cpu: ${UP_CPU_LIMIT}
              memory: ${UP_MEMORY_LIMIT}
            requests:
              cpu: ${UP_CPU_REQUEST}
              memory: ${UP_MEMORY_REQUEST}
          volumeMounts:
          - mountPath: /etc/up/
            name: query-config
            readOnly: false
        volumes:
        - configMap:
            name: observatorium-observatorium-up
          name: query-config
- apiVersion: v1
  data:
    queries.yaml: |-
      "queries":
      - "name": "rule-query-path-sli-1M-samples"
        "query": "avg_over_time(avalanche_metric_mmmmm_0_0{tenant_id=\"0fc2b00e-201b-4c17-b9f2-19d91adc4fd2\"}[1h])"
      - "name": "rule-query-path-sli-10M-samples"
        "query": "avg_over_time(avalanche_metric_mmmmm_0_0{tenant_id=\"0fc2b00e-201b-4c17-b9f2-19d91adc4fd2\"}[10h])"
      - "name": "rule-query-path-sli-100M-samples"
        "query": "avg_over_time(avalanche_metric_mmmmm_0_0{tenant_id=\"0fc2b00e-201b-4c17-b9f2-19d91adc4fd2\"}[100h])"
  kind: ConfigMap
  metadata:
    annotations:
      qontract.recycle: "true"
    labels:
      app.kubernetes.io/component: blackbox-prober
      app.kubernetes.io/instance: observatorium
      app.kubernetes.io/name: observatorium-up
      app.kubernetes.io/part-of: observatorium
      app.kubernetes.io/version: master-2022-03-24-098c31a
    name: observatorium-observatorium-up-ruler
- apiVersion: apps/v1
  kind: Deployment
  metadata:
    labels:
      app.kubernetes.io/component: blackbox-prober
      app.kubernetes.io/instance: observatorium
      app.kubernetes.io/name: observatorium-up
      app.kubernetes.io/part-of: observatorium
      app.kubernetes.io/version: master-2022-03-24-098c31a
    name: observatorium-observatorium-up-ruler
  spec:
    replicas: ${{UP_REPLICAS}}
    selector:
      matchLabels:
        app.kubernetes.io/component: blackbox-prober
        app.kubernetes.io/instance: observatorium
        app.kubernetes.io/name: observatorium-up
        app.kubernetes.io/part-of: observatorium
    template:
      metadata:
        labels:
          app.kubernetes.io/component: blackbox-prober
          app.kubernetes.io/instance: observatorium
          app.kubernetes.io/name: observatorium-up
          app.kubernetes.io/part-of: observatorium
          app.kubernetes.io/version: master-2022-03-24-098c31a
      spec:
        containers:
        - args:
          - --duration=0
          - --log.level=debug
          - --endpoint-type=metrics
          - --queries-file=/etc/up/queries.yaml
          - --endpoint-read=http://observatorium-ruler-query.${OBSERVATORIUM_METRICS_NAMESPACE}.svc:9090
          image: quay.io/observatorium/up:master-2022-03-24-098c31a
          name: observatorium-up
          ports:
          - containerPort: 8080
            name: http
          resources:
            limits:
              cpu: ${UP_CPU_LIMIT}
              memory: ${UP_MEMORY_LIMIT}
            requests:
              cpu: ${UP_CPU_REQUEST}
              memory: ${UP_MEMORY_REQUEST}
          volumeMounts:
          - mountPath: /etc/up/
            name: query-config
            readOnly: false
        volumes:
        - configMap:
            name: observatorium-observatorium-up-ruler
          name: query-config
- apiVersion: v1
  kind: Service
  metadata:
    labels:
      app.kubernetes.io/component: blackbox-prober
      app.kubernetes.io/instance: observatorium
      app.kubernetes.io/name: observatorium-up
      app.kubernetes.io/part-of: observatorium
      app.kubernetes.io/version: master-2022-03-24-098c31a
    name: observatorium-observatorium-up-ruler
  spec:
    ports:
    - name: http
      port: 8080
      targetPort: 8080
    selector:
      app.kubernetes.io/component: blackbox-prober
      app.kubernetes.io/instance: observatorium
      app.kubernetes.io/name: observatorium-up
      app.kubernetes.io/part-of: observatorium
- apiVersion: monitoring.coreos.com/v1
  kind: ServiceMonitor
  metadata:
    labels:
      prometheus: app-sre
    name: observatorium-up-ruler
  spec:
    endpoints:
    - port: http
    namespaceSelector:
      matchNames: ${{NAMESPACES}}
    selector:
      matchLabels:
        app.kubernetes.io/component: blackbox-prober
        app.kubernetes.io/instance: observatorium
        app.kubernetes.io/name: observatorium-up
        app.kubernetes.io/part-of: observatorium
- apiVersion: v1
  kind: Service
  metadata:
    labels:
      app.kubernetes.io/component: blackbox-prober
      app.kubernetes.io/instance: observatorium
      app.kubernetes.io/name: observatorium-up
      app.kubernetes.io/part-of: observatorium
      app.kubernetes.io/version: master-2022-03-24-098c31a
    name: observatorium-observatorium-up
  spec:
    ports:
    - name: http
      port: 8080
      targetPort: 8080
    selector:
      app.kubernetes.io/component: blackbox-prober
      app.kubernetes.io/instance: observatorium
      app.kubernetes.io/name: observatorium-up
      app.kubernetes.io/part-of: observatorium
- apiVersion: monitoring.coreos.com/v1
  kind: ServiceMonitor
  metadata:
    labels:
      prometheus: app-sre
    name: observatorium-up
  spec:
    endpoints:
    - port: http
    namespaceSelector:
      matchNames: ${{NAMESPACES}}
    selector:
      matchLabels:
        app.kubernetes.io/component: blackbox-prober
        app.kubernetes.io/instance: observatorium
        app.kubernetes.io/name: observatorium-up
        app.kubernetes.io/part-of: observatorium
- apiVersion: v1
  data:
    rbac.yaml: |-
      "roleBindings":
      - "name": "observatorium-cnv-qe"
        "roles":
        - "cnvqe-metrics-write"
        - "cnvqe-metrics-read"
        "subjects":
        - "kind": "user"
          "name": "service-account-observatorium-cnv-qe-staging"
        - "kind": "user"
          "name": "service-account-observatorium-cnv-qe"
      - "name": "observatorium-starburst-isv-write"
        "roles":
        - "rhods-metrics-write"
        "subjects":
        - "kind": "user"
          "name": "service-account-observatorium-starburst-isv-write-staging"
      - "name": "observatorium-starburst-isv-read"
        "roles":
        - "rhods-metrics-read"
        "subjects":
        - "kind": "user"
          "name": "service-account-observatorium-starburst-isv-read-staging"
      - "name": "observatorium-rhacs-metrics"
        "roles":
        - "rhacs-metrics-write"
        - "rhacs-metrics-read"
        "subjects":
        - "kind": "user"
          "name": "service-account-observatorium-rhacs-metrics-staging"
        - "kind": "user"
          "name": "service-account-observatorium-rhacs-metrics"
      - "name": "observatorium-rhacs-grafana"
        "roles":
        - "rhacs-metrics-read"
        "subjects":
        - "kind": "user"
          "name": "service-account-observatorium-rhacs-grafana-staging"
        - "kind": "user"
          "name": "service-account-observatorium-rhacs-grafana"
      - "name": "observatorium-rhobs"
        "roles":
        - "rhobs-metrics-write"
        - "rhobs-metrics-read"
        "subjects":
        - "kind": "user"
          "name": "service-account-observatorium-rhobs-testing"
        - "kind": "user"
          "name": "service-account-observatorium-rhobs-staging"
        - "kind": "user"
          "name": "service-account-observatorium-rhobs"
      - "name": "observatorium-rhobs-mst"
        "roles":
        - "rhobs-metrics-write"
        - "rhobs-metrics-read"
        "subjects":
        - "kind": "user"
          "name": "service-account-observatorium-rhobs-mst-staging"
        - "kind": "user"
          "name": "service-account-observatorium-rhobs-mst"
      - "name": "rhobs-admin"
        "roles":
        - "telemeter-metrics-read"
        - "rhobs-metrics-read"
        "subjects":
        - "kind": "group"
          "name": "team-monitoring@redhat.com"
      - "name": "telemeter-service"
        "roles":
        - "telemeter-metrics-write"
        - "telemeter-metrics-read"
        "subjects":
        - "kind": "user"
          "name": "service-account-telemeter-service-staging"
        - "kind": "user"
          "name": "service-account-telemeter-service"
      - "name": "observatorium-ccx-processing"
        "roles":
        - "telemeter-metrics-read"
        "subjects":
        - "kind": "user"
          "name": "service-account-observatorium-ccx-processing-staging"
        - "kind": "user"
          "name": "service-account-observatorium-ccx-processing"
      - "name": "observatorium-sdtcs"
        "roles":
        - "telemeter-metrics-read"
        "subjects":
        - "kind": "user"
          "name": "service-account-observatorium-sdtcs-staging"
        - "kind": "user"
          "name": "service-account-observatorium-sdtcs"
      - "name": "observatorium-subwatch"
        "roles":
        - "telemeter-metrics-read"
        "subjects":
        - "kind": "user"
          "name": "service-account-observatorium-subwatch-staging"
        - "kind": "user"
          "name": "service-account-observatorium-subwatch"
      - "name": "observatorium-psiocp"
        "roles":
        - "psiocp-metrics-write"
        - "psiocp-metrics-read"
        "subjects":
        - "kind": "user"
          "name": "service-account-observatorium-psiocp-staging"
      - "name": "observatorium-odfms-write"
        "roles":
        - "odfms-metrics-write"
        "subjects":
        - "kind": "user"
          "name": "service-account-observatorium-odfms-write"
      - "name": "observatorium-odfms-read"
        "roles":
        - "odfms-metrics-read"
        "subjects":
        - "kind": "user"
          "name": "service-account-observatorium-odfms-read"
      - "name": "observatorium-odfms"
        "roles":
        - "odfms-metrics-read"
        - "odfms-metrics-write"
        "subjects":
        - "kind": "user"
          "name": "service-account-observatorium-odfms-staging"
      - "name": "observatorium-reference-addon"
        "roles":
        - "reference-addon-metrics-write"
        - "reference-addon-metrics-read"
        "subjects":
        - "kind": "user"
          "name": "service-account-observatorium-reference-addon-staging"
        - "kind": "user"
          "name": "service-account-observatorium-reference-addon"
      - "name": "7f7f912e-0429-4639-8e70-609ecf65b280"
        "roles":
        - "telemeter-metrics-read"
        "subjects":
        - "kind": "user"
          "name": "service-account-7f7f912e-0429-4639-8e70-609ecf65b280"
      - "name": "8f7aa5e1-aa08-493d-82eb-cf24834fc08f"
        "roles":
        - "telemeter-metrics-read"
        "subjects":
        - "kind": "user"
          "name": "service-account-8f7aa5e1-aa08-493d-82eb-cf24834fc08f"
      - "name": "observatorium-rhtap"
        "roles":
        - "rhtap-metrics-read"
        - "rhtap-metrics-write"
        "subjects":
        - "kind": "user"
          "name": "service-account-observatorium-rhtap-staging"
        - "kind": "user"
          "name": "service-account-observatorium-rhtap"
      - "name": "observatorium-rhel-read"
        "roles":
        - "rhel-metrics-read"
        "subjects":
        - "kind": "user"
          "name": "service-account-observatorium-rhel-read-staging"
        - "kind": "user"
          "name": "service-account-observatorium-rhel-read"
      - "name": "observatorium-rhel-write"
        "roles":
        - "rhel-metrics-write"
        "subjects":
        - "kind": "user"
          "name": "service-account-observatorium-rhel-write-staging"
        - "kind": "user"
          "name": "service-account-observatorium-rhel-write"
      "roles":
      - "name": "cnvqe-metrics-write"
        "permissions":
        - "write"
        "resources":
        - "metrics"
        "tenants":
        - "cnvqe"
      - "name": "cnvqe-metrics-read"
        "permissions":
        - "read"
        "resources":
        - "metrics"
        "tenants":
        - "cnvqe"
      - "name": "rhods-metrics-write"
        "permissions":
        - "write"
        "resources":
        - "metrics"
        "tenants":
        - "rhods"
      - "name": "rhods-metrics-read"
        "permissions":
        - "read"
        "resources":
        - "metrics"
        "tenants":
        - "rhods"
      - "name": "rhacs-metrics-write"
        "permissions":
        - "write"
        "resources":
        - "metrics"
        "tenants":
        - "rhacs"
      - "name": "rhacs-metrics-read"
        "permissions":
        - "read"
        "resources":
        - "metrics"
        "tenants":
        - "rhacs"
      - "name": "rhobs-metrics-write"
        "permissions":
        - "write"
        "resources":
        - "metrics"
        "tenants":
        - "rhobs"
      - "name": "rhobs-metrics-read"
        "permissions":
        - "read"
        "resources":
        - "metrics"
        "tenants":
        - "rhobs"
      - "name": "telemeter-metrics-read"
        "permissions":
        - "read"
        "resources":
        - "metrics"
        "tenants":
        - "telemeter"
      - "name": "telemeter-metrics-write"
        "permissions":
        - "write"
        "resources":
        - "metrics"
        "tenants":
        - "telemeter"
      - "name": "psiocp-metrics-write"
        "permissions":
        - "write"
        "resources":
        - "metrics"
        "tenants":
        - "psiocp"
      - "name": "psiocp-metrics-read"
        "permissions":
        - "read"
        "resources":
        - "metrics"
        "tenants":
        - "psiocp"
      - "name": "odfms-metrics-write"
        "permissions":
        - "write"
        "resources":
        - "metrics"
        "tenants":
        - "odfms"
      - "name": "odfms-metrics-read"
        "permissions":
        - "read"
        "resources":
        - "metrics"
        "tenants":
        - "odfms"
      - "name": "reference-addon-metrics-write"
        "permissions":
        - "write"
        "resources":
        - "metrics"
        "tenants":
        - "reference-addon"
      - "name": "reference-addon-metrics-read"
        "permissions":
        - "read"
        "resources":
        - "metrics"
        "tenants":
        - "reference-addon"
      - "name": "rhtap-metrics-read"
        "permissions":
        - "read"
        "resources":
        - "metrics"
        "tenants":
        - "rhtap"
      - "name": "rhtap-metrics-write"
        "permissions":
        - "write"
        "resources":
        - "metrics"
        "tenants":
        - "rhtap"
      - "name": "rhel-metrics-read"
        "permissions":
        - "read"
        "resources":
        - "metrics"
        "tenants":
        - "rhel"
      - "name": "rhel-metrics-write"
        "permissions":
        - "write"
        "resources":
        - "metrics"
        "tenants":
        - "rhel"
  kind: ConfigMap
  metadata:
    annotations:
      qontract.recycle: "true"
    labels:
      app.kubernetes.io/component: api
      app.kubernetes.io/instance: observatorium
      app.kubernetes.io/name: observatorium-api
      app.kubernetes.io/part-of: observatorium
      app.kubernetes.io/version: ${OBSERVATORIUM_API_IMAGE_TAG}
    name: ${OBSERVATORIUM_API_IDENTIFIER}
- apiVersion: apps/v1
  kind: Deployment
  metadata:
    labels:
      app.kubernetes.io/component: api
      app.kubernetes.io/instance: observatorium
      app.kubernetes.io/name: observatorium-api
      app.kubernetes.io/part-of: observatorium
      app.kubernetes.io/version: ${OBSERVATORIUM_API_IMAGE_TAG}
    name: ${OBSERVATORIUM_API_IDENTIFIER}
  spec:
    replicas: ${{OBSERVATORIUM_API_REPLICAS}}
    selector:
      matchLabels:
        app.kubernetes.io/component: api
        app.kubernetes.io/instance: observatorium
        app.kubernetes.io/name: observatorium-api
        app.kubernetes.io/part-of: observatorium
    strategy:
      rollingUpdate:
        maxSurge: 0
        maxUnavailable: 1
    template:
      metadata:
        labels:
          app.kubernetes.io/component: api
          app.kubernetes.io/instance: observatorium
          app.kubernetes.io/name: observatorium-api
          app.kubernetes.io/part-of: observatorium
          app.kubernetes.io/tracing: jaeger-agent
          app.kubernetes.io/version: ${OBSERVATORIUM_API_IMAGE_TAG}
      spec:
        affinity:
          podAntiAffinity:
            preferredDuringSchedulingIgnoredDuringExecution:
            - podAffinityTerm:
                labelSelector:
                  matchExpressions:
                  - key: app.kubernetes.io/name
                    operator: In
                    values:
                    - observatorium-api
                topologyKey: kubernetes.io/hostname
              weight: 100
        containers:
        - args:
          - --web.listen=0.0.0.0:8080
          - --web.internal.listen=0.0.0.0:8081
          - --log.level=${OBSERVATORIUM_API_LOG_LEVEL}
          - --metrics.read.endpoint=http://observatorium-thanos-query-frontend.${OBSERVATORIUM_METRICS_NAMESPACE}.svc.cluster.local:9090
          - --metrics.write.endpoint=http://${METRICS_WRITE_SERVICE_NAME}.${OBSERVATORIUM_METRICS_NAMESPACE}.svc.cluster.local:${METRICS_WRITE_SERVICE_PORT}
          - --metrics.rules.endpoint=http://rules-objstore.${NAMESPACE}.svc.cluster.local:8080
          - --metrics.alertmanager.endpoint=${ALERTMANAGER_API_ENDPOINT}
          - --rbac.config=/etc/observatorium/rbac.yaml
          - --tenants.config=/etc/observatorium/tenants.yaml
          - --middleware.rate-limiter.grpc-address=observatorium-gubernator.${NAMESPACE}.svc.cluster.local:8081
          image: ${OBSERVATORIUM_API_IMAGE}:${OBSERVATORIUM_API_IMAGE_TAG}
          imagePullPolicy: IfNotPresent
          livenessProbe:
            failureThreshold: 10
            httpGet:
              path: /live
              port: 8081
              scheme: HTTP
            periodSeconds: 30
          name: observatorium-api
          ports:
          - containerPort: 8090
            name: grpc-public
          - containerPort: 8081
            name: internal
          - containerPort: 8080
            name: public
          readinessProbe:
            failureThreshold: 12
            httpGet:
              path: /ready
              port: 8081
              scheme: HTTP
            periodSeconds: 5
          resources:
            limits:
              cpu: ${OBSERVATORIUM_API_CPU_LIMIT}
              memory: ${OBSERVATORIUM_API_MEMORY_LIMIT}
            requests:
              cpu: ${OBSERVATORIUM_API_CPU_REQUEST}
              memory: ${OBSERVATORIUM_API_MEMORY_REQUEST}
          volumeMounts:
          - mountPath: /etc/observatorium/rbac.yaml
            name: rbac
            readOnly: true
            subPath: rbac.yaml
          - mountPath: /etc/observatorium/tenants.yaml
            name: tenants
            readOnly: true
            subPath: tenants.yaml
        - args:
          - --web.listen=127.0.0.1:8082
          - --web.internal.listen=0.0.0.0:8083
          - --web.healthchecks.url=http://127.0.0.1:8082
          - --log.level=${OPA_AMS_LOG_LEVEL}
          - --ams.url=${AMS_URL}
          - --resource-type-prefix=observatorium
          - --oidc.client-id=$(CLIENT_ID)
          - --oidc.client-secret=$(CLIENT_SECRET)
          - --oidc.issuer-url=$(ISSUER_URL)
          - --opa.package=observatorium
          - --memcached=observatorium-api-cache-memcached.${NAMESPACE}.svc.cluster.local:11211
          - --memcached.expire=${OPA_AMS_MEMCACHED_EXPIRE}
          - --ams.mappings=osd=${OSD_ORGANIZATION_ID}
          - --ams.mappings=osd=${SD_OPS_ORGANIZATION_ID}
          - --ams.mappings=cnvqe=${CNVQE_ORGANIZATION_ID}
          - --internal.tracing.endpoint=localhost:6831
          env:
          - name: ISSUER_URL
            valueFrom:
              secretKeyRef:
                key: issuer-url
                name: ${OBSERVATORIUM_API_IDENTIFIER}
          - name: CLIENT_ID
            valueFrom:
              secretKeyRef:
                key: client-id
                name: ${OBSERVATORIUM_API_IDENTIFIER}
          - name: CLIENT_SECRET
            valueFrom:
              secretKeyRef:
                key: client-secret
                name: ${OBSERVATORIUM_API_IDENTIFIER}
          image: ${OPA_AMS_IMAGE}:${OPA_AMS_IMAGE_TAG}
          livenessProbe:
            failureThreshold: 10
            httpGet:
              path: /live
              port: 8083
              scheme: HTTP
            periodSeconds: 30
          name: opa-ams
          ports:
          - containerPort: 8082
            name: opa-ams-api
          - containerPort: 8083
            name: opa-ams-metrics
          readinessProbe:
            failureThreshold: 12
            httpGet:
              path: /ready
              port: 8083
              scheme: HTTP
            periodSeconds: 5
          resources:
            limits:
              cpu: ${OPA_AMS_CPU_LIMIT}
              memory: ${OPA_AMS_MEMORY_LIMIT}
            requests:
              cpu: ${OPA_AMS_CPU_REQUEST}
              memory: ${OPA_AMS_MEMORY_REQUEST}
        - args:
          - --reporter.grpc.host-port=dns:///${TRACING_COLLECTOR_ENDPOINT}
          - --reporter.type=grpc
          - --agent.tags=pod.namespace=$(NAMESPACE),pod.name=$(POD)
          env:
          - name: NAMESPACE
            valueFrom:
              fieldRef:
                fieldPath: metadata.namespace
          - name: POD
            valueFrom:
              fieldRef:
                fieldPath: metadata.name
          image: ${JAEGER_AGENT_IMAGE}:${JAEGER_AGENT_IMAGE_TAG}
          livenessProbe:
            failureThreshold: 5
            httpGet:
              path: /
              port: 14271
              scheme: HTTP
          name: jaeger-agent
          ports:
          - containerPort: 5778
            name: configs
          - containerPort: 6831
            name: jaeger-thrift
          - containerPort: 14271
            name: metrics
          readinessProbe:
            httpGet:
              path: /
              port: 14271
              scheme: HTTP
            initialDelaySeconds: 1
          resources:
            limits:
              cpu: 128m
              memory: 128Mi
            requests:
              cpu: 32m
              memory: 64Mi
        serviceAccountName: ${SERVICE_ACCOUNT_NAME}
        volumes:
        - configMap:
            name: ${OBSERVATORIUM_API_IDENTIFIER}
          name: rbac
        - name: tenants
          secret:
            secretName: ${OBSERVATORIUM_API_IDENTIFIER}
- apiVersion: v1
  kind: Secret
  metadata:
    labels:
      app.kubernetes.io/component: api
      app.kubernetes.io/instance: observatorium
      app.kubernetes.io/name: observatorium-api
      app.kubernetes.io/part-of: observatorium
      app.kubernetes.io/version: ${OBSERVATORIUM_API_IMAGE_TAG}
    name: ${OBSERVATORIUM_API_IDENTIFIER}
  stringData:
    client-id: test
    client-secret: ZXhhbXBsZS1hcHAtc2VjcmV0
    issuer-url: http://dex.dex.svc.cluster.local:5556/dex
    tenants.yaml: |-
      "tenants":
      - "id": "770c1124-6ae8-4324-a9d4-9ce08590094b"
        "name": "rhobs"
        "oidc":
          "clientID": "test"
          "clientSecret": "ZXhhbXBsZS1hcHAtc2VjcmV0"
          "issuerURL": "http://dex.dex.svc.cluster.local:5556/dex"
          "usernameClaim": "email"
      - "id": "FB870BF3-9F3A-44FF-9BF7-D7A047A52F43"
        "name": "telemeter"
        "oidc":
          "clientID": "test"
          "clientSecret": "ZXhhbXBsZS1hcHAtc2VjcmV0"
          "issuerURL": "http://dex.dex.svc.cluster.local:5556/dex"
          "usernameClaim": "email"
- apiVersion: v1
  kind: Service
  metadata:
    labels:
      app.kubernetes.io/component: api
      app.kubernetes.io/instance: observatorium
      app.kubernetes.io/name: observatorium-api
      app.kubernetes.io/part-of: observatorium
      app.kubernetes.io/version: ${OBSERVATORIUM_API_IMAGE_TAG}
    name: ${OBSERVATORIUM_API_IDENTIFIER}
  spec:
    ports:
    - appProtocol: h2c
      name: grpc-public
      port: 8090
      targetPort: 8090
    - appProtocol: http
      name: internal
      port: 8081
      targetPort: 8081
    - appProtocol: http
      name: public
      port: 8080
      targetPort: 8080
    - name: opa-ams-api
      port: 8082
      targetPort: 8082
    - name: opa-ams-metrics
      port: 8083
      targetPort: 8083
    selector:
      app.kubernetes.io/component: api
      app.kubernetes.io/instance: observatorium
      app.kubernetes.io/name: observatorium-api
      app.kubernetes.io/part-of: observatorium
- apiVersion: v1
  kind: ServiceAccount
  metadata:
    labels:
      app.kubernetes.io/component: api
      app.kubernetes.io/instance: observatorium
      app.kubernetes.io/name: observatorium-api
      app.kubernetes.io/part-of: observatorium
      app.kubernetes.io/version: ${OBSERVATORIUM_API_IMAGE_TAG}
    name: ${OBSERVATORIUM_API_IDENTIFIER}
- apiVersion: monitoring.coreos.com/v1
  kind: ServiceMonitor
  metadata:
    labels:
      prometheus: app-sre
    name: observatorium-api
  spec:
    endpoints:
    - port: internal
    - port: opa-ams-metrics
    namespaceSelector:
      matchNames: ${{NAMESPACES}}
    selector:
      matchLabels:
        app.kubernetes.io/component: api
        app.kubernetes.io/instance: observatorium
        app.kubernetes.io/name: observatorium-api
        app.kubernetes.io/part-of: observatorium
- apiVersion: apps/v1
  kind: Deployment
  metadata:
    labels:
      app.kubernetes.io/component: rate-limiter
      app.kubernetes.io/instance: observatorium
      app.kubernetes.io/name: gubernator
      app.kubernetes.io/part-of: observatorium
      app.kubernetes.io/version: ${GUBERNATOR_IMAGE_TAG}
    name: observatorium-gubernator
  spec:
    replicas: ${{GUBERNATOR_REPLICAS}}
    selector:
      matchLabels:
        app.kubernetes.io/component: rate-limiter
        app.kubernetes.io/instance: observatorium
        app.kubernetes.io/name: gubernator
        app.kubernetes.io/part-of: observatorium
    strategy:
      rollingUpdate:
        maxSurge: 0
        maxUnavailable: 1
    template:
      metadata:
        labels:
          app.kubernetes.io/component: rate-limiter
          app.kubernetes.io/instance: observatorium
          app.kubernetes.io/name: gubernator
          app.kubernetes.io/part-of: observatorium
          app.kubernetes.io/version: ${GUBERNATOR_IMAGE_TAG}
      spec:
        affinity:
          podAntiAffinity:
            preferredDuringSchedulingIgnoredDuringExecution:
            - podAffinityTerm:
                labelSelector:
                  matchExpressions:
                  - key: app.kubernetes.io/name
                    operator: In
                    values:
                    - gubernator
                topologyKey: kubernetes.io/hostname
              weight: 100
        containers:
        - env:
          - name: GUBER_K8S_NAMESPACE
            valueFrom:
              fieldRef:
                fieldPath: metadata.namespace
          - name: GUBER_K8S_POD_IP
            valueFrom:
              fieldRef:
                fieldPath: status.podIP
          - name: GUBER_HTTP_ADDRESS
            value: 0.0.0.0:8080
          - name: GUBER_GRPC_ADDRESS
            value: 0.0.0.0:8081
          - name: GUBER_K8S_POD_PORT
            value: "8081"
          - name: GUBER_K8S_ENDPOINTS_SELECTOR
            value: app.kubernetes.io/name=gubernator
          - name: GUBER_PEER_DISCOVERY_TYPE
            value: k8s
          - name: GUBER_LOG_LEVEL
            value: ${GUBERNATOR_LOG_LEVEL}
          - name: OTEL_TRACES_EXPORTER
            value: none
          image: ${GUBERNATOR_IMAGE}:${GUBERNATOR_IMAGE_TAG}
          imagePullPolicy: IfNotPresent
          name: gubernator
          ports:
          - containerPort: 8081
            name: grpc
          - containerPort: 8080
            name: http
          readinessProbe:
            failureThreshold: 3
            httpGet:
              path: /v1/HealthCheck
              port: 8080
              scheme: HTTP
            initialDelaySeconds: 10
            periodSeconds: 30
            timeoutSeconds: 1
          resources:
            limits:
              cpu: ${GUBERNATOR_CPU_LIMIT}
              memory: ${GUBERNATOR_MEMORY_LIMIT}
            requests:
              cpu: ${GUBERNATOR_CPU_REQUEST}
              memory: ${GUBERNATOR_MEMORY_REQUEST}
        restartPolicy: Always
        serviceAccountName: observatorium-gubernator
- apiVersion: rbac.authorization.k8s.io/v1
  kind: Role
  metadata:
    labels:
      app.kubernetes.io/component: rate-limiter
      app.kubernetes.io/instance: observatorium
      app.kubernetes.io/name: gubernator
      app.kubernetes.io/part-of: observatorium
      app.kubernetes.io/version: ${GUBERNATOR_IMAGE_TAG}
    name: observatorium-gubernator
  rules:
  - apiGroups:
    - ""
    resources:
    - endpoints
    verbs:
    - list
    - watch
    - get
- apiVersion: rbac.authorization.k8s.io/v1
  kind: RoleBinding
  metadata:
    labels:
      app.kubernetes.io/component: rate-limiter
      app.kubernetes.io/instance: observatorium
      app.kubernetes.io/name: gubernator
      app.kubernetes.io/part-of: observatorium
      app.kubernetes.io/version: ${GUBERNATOR_IMAGE_TAG}
    name: observatorium-gubernator
  roleRef:
    apiGroup: rbac.authorization.k8s.io
    kind: Role
    name: observatorium-gubernator
  subjects:
  - kind: ServiceAccount
    name: observatorium-gubernator
    namespace: ${NAMESPACE}
- apiVersion: v1
  kind: Service
  metadata:
    labels:
      app.kubernetes.io/component: rate-limiter
      app.kubernetes.io/instance: observatorium
      app.kubernetes.io/name: gubernator
      app.kubernetes.io/part-of: observatorium
      app.kubernetes.io/version: ${GUBERNATOR_IMAGE_TAG}
    name: observatorium-gubernator
  spec:
    clusterIP: None
    ports:
    - name: grpc
      port: 8081
      targetPort: 8081
    - name: http
      port: 8080
      targetPort: 8080
    selector:
      app.kubernetes.io/component: rate-limiter
      app.kubernetes.io/instance: observatorium
      app.kubernetes.io/name: gubernator
      app.kubernetes.io/part-of: observatorium
- apiVersion: v1
  imagePullSecrets:
  - name: quay.io
  kind: ServiceAccount
  metadata:
    labels:
      app.kubernetes.io/component: rate-limiter
      app.kubernetes.io/instance: observatorium
      app.kubernetes.io/name: gubernator
      app.kubernetes.io/part-of: observatorium
      app.kubernetes.io/version: ${GUBERNATOR_IMAGE_TAG}
    name: observatorium-gubernator
- apiVersion: monitoring.coreos.com/v1
  kind: ServiceMonitor
  metadata:
    labels:
      prometheus: app-sre
    name: observatorium-gubernator
  spec:
    endpoints:
    - port: http
    namespaceSelector:
      matchNames: ${{NAMESPACES}}
    selector:
      matchLabels:
        app.kubernetes.io/component: rate-limiter
        app.kubernetes.io/instance: observatorium
        app.kubernetes.io/name: gubernator
        app.kubernetes.io/part-of: observatorium
parameters:
- name: NAMESPACE
  value: observatorium
- name: NAMESPACES
  value: '["telemeter", "observatorium-metrics", "observatorium-mst-production"]'
- name: OBSERVATORIUM_METRICS_NAMESPACE
  value: observatorium-metrics
- name: AMS_URL
  value: https://api.openshift.com
- name: GUBERNATOR_CPU_LIMIT
  value: 600m
- name: GUBERNATOR_CPU_REQUEST
  value: 300m
- name: GUBERNATOR_IMAGE_TAG
  value: v2.6.0
- name: GUBERNATOR_IMAGE
  value: quay.io/app-sre/gubernator
- name: GUBERNATOR_MEMORY_LIMIT
  value: 200Mi
- name: GUBERNATOR_MEMORY_REQUEST
  value: 100Mi
- name: GUBERNATOR_REPLICAS
  value: "2"
- name: GUBERNATOR_LOG_LEVEL
  value: debug
- name: JAEGER_AGENT_IMAGE_TAG
  value: 1.29.0
- name: JAEGER_AGENT_IMAGE
  value: jaegertracing/jaeger-agent
- name: JAEGER_COLLECTOR_NAMESPACE
  value: $(NAMESPACE)
- name: TRACING_COLLECTOR_ENDPOINT
  value: otel-trace-writer-collector-headless.observatorium-tools.svc:14250
- name: MEMCACHED_CONNECTION_LIMIT
  value: "3072"
- name: MEMCACHED_CPU_LIMIT
  value: "3"
- name: MEMCACHED_CPU_REQUEST
  value: 500m
- name: MEMCACHED_EXPORTER_CPU_LIMIT
  value: 200m
- name: MEMCACHED_EXPORTER_CPU_REQUEST
  value: 50m
- name: MEMCACHED_EXPORTER_IMAGE_TAG
  value: v0.6.0
- name: MEMCACHED_EXPORTER_IMAGE
  value: docker.io/prom/memcached-exporter
- name: MEMCACHED_EXPORTER_MEMORY_LIMIT
  value: 200Mi
- name: MEMCACHED_EXPORTER_MEMORY_REQUEST
  value: 50Mi
- name: MEMCACHED_IMAGE_TAG
  value: 1.6.13-alpine
- name: MEMCACHED_IMAGE
  value: docker.io/memcached
- name: MEMCACHED_MEMORY_LIMIT_MB
  value: "2048"
- name: MEMCACHED_MEMORY_LIMIT
  value: 1844Mi
- name: MEMCACHED_MEMORY_REQUEST
  value: 1329Mi
- name: OAUTH_PROXY_CPU_LIMITS
  value: 200m
- name: OAUTH_PROXY_CPU_REQUEST
  value: 100m
- name: OAUTH_PROXY_IMAGE_TAG
  value: 4.7.0
- name: OAUTH_PROXY_IMAGE
  value: quay.io/openshift/origin-oauth-proxy
- name: OAUTH_PROXY_MEMORY_LIMITS
  value: 200Mi
- name: OAUTH_PROXY_MEMORY_REQUEST
  value: 100Mi
- name: OBSERVATORIUM_API_CPU_LIMIT
  value: "1"
- name: OBSERVATORIUM_API_CPU_REQUEST
  value: 100m
- name: OBSERVATORIUM_API_IDENTIFIER
  value: observatorium-observatorium-api
- name: OBSERVATORIUM_API_IMAGE_TAG
  value: main-2023-08-17-3f47d62
- name: OBSERVATORIUM_API_IMAGE
  value: quay.io/observatorium/api
- name: OBSERVATORIUM_API_MEMORY_LIMIT
  value: 1Gi
- name: OBSERVATORIUM_API_MEMORY_REQUEST
  value: 256Mi
- name: OBSERVATORIUM_API_REPLICAS
  value: "3"
- name: OBSERVATORIUM_API_PER_POD_CONCURRENT_REQUETST_LIMIT
  value: "50"
- name: OBSERVATORIUM_API_LOG_LEVEL
  value: warn
- name: OPA_AMS_CPU_LIMIT
  value: 200m
- name: OPA_AMS_CPU_REQUEST
  value: 100m
- name: OPA_AMS_IMAGE_TAG
  value: master-2022-11-03-222daab
- name: OPA_AMS_IMAGE
  value: quay.io/observatorium/opa-ams
- name: OPA_AMS_MEMCACHED_EXPIRE
  value: "300"
- name: OPA_AMS_MEMORY_LIMIT
  value: 200Mi
- name: OPA_AMS_MEMORY_REQUEST
  value: 100Mi
- name: OPA_AMS_LOG_LEVEL
  value: warn
- name: RULES_OBJSTORE_IMAGE
  value: quay.io/observatorium/rules-objstore
- name: RULES_OBJSTORE_IMAGE_TAG
  value: main-2022-09-21-9df4d2c
- name: RULES_OBJSTORE_S3_SECRET
  value: rules-objstore-stage-s3
- name: RULES_OBJSTORE_SECRET
  value: rules-objstore
- name: RULES_OBJSTORE_LOG_LEVEL
  value: info
- name: SERVICE_ACCOUNT_NAME
  value: prometheus-telemeter
- name: UP_CPU_REQUEST
  value: 100m
- name: UP_CPU_LIMIT
  value: 500m
- name: UP_MEMORY_REQUEST
  value: 1Gi
- name: UP_MEMORY_LIMIT
  value: 2Gi
- name: UP_REPLICAS
  value: "1"
- name: AVALANCHE_REPLICAS
  value: "1"
- name: OBSERVATORIUM_URL
  value: http://observatorium-observatorium-api.${NAMESPACE}.svc:8080
- name: OIDC_AUDIENCE
  value: observatorium
- name: OIDC_ISSUER_URL
  value: https://sso.redhat.com/auth/realms/redhat-external
- name: SLEEP_DURATION_SECONDS
  value: "15"
- name: CONFIG_RELOAD_INTERVAL_SECONDS
  value: "60"
- name: MANAGED_TENANTS
  value: rhobs,osd,appsre
- name: RHOBS_RELOADER_SECRET_NAME
  value: rhobs-tenant
- name: OSD_RELOADER_SECRET_NAME
  value: observatorium-observatorium-mst-api
- name: HYPERSHIFT_PLATFORM_STAGING_RELOADER_SECRET_NAME
  value: rhobs-hypershift-platform-staging-tenant
- name: HYPERSHIFT_PLATFORM_RELOADER_SECRET_NAME
  value: rhobs-hypershift-platform-tenant
- name: APPSRE_RELOADER_SECRET_NAME
  value: observatorium-appsre
- name: RHTAP_RELOADER_SECRET_NAME
  value: observatorium-rhtap
- name: OBSCTL_RELOADER_IMAGE
  value: quay.io/app-sre/obsctl-reloader
- name: OBSCTL_RELOADER_IMAGE_TAG
  value: 969b895
- name: METRICS_WRITE_SERVICE_NAME
  value: observatorium-thanos-receive
- name: METRICS_WRITE_SERVICE_PORT
  value: "19291"
- name: CNVQE_ORGANIZATION_ID
  value: ""
- name: OSD_ORGANIZATION_ID
  value: ""
- name: SD_OPS_ORGANIZATION_ID
  value: ""
- name: ALERTMANAGER_API_ENDPOINT
  value: ""