telemeter-template.yaml

apiVersion: template.openshift.io/v1
kind: Template
metadata:
  name: telemeter
objects:
- apiVersion: v1
  data:
    authorize_url: aHR0cHM6Ly9hcGkuc3RhZ2Uub3BlbnNoaWZ0LmNvbS9hcGkvYWNjb3VudHNfbWdtdC92MS9jbHVzdGVyX3JlZ2lzdHJhdGlvbnM=
    client_id: dGVzdA==
    client_secret: WlhoaGJYQnNaUzFoY0hBdGMyVmpjbVYw
    oidc_issuer: aHR0cDovL2RleC5kZXguc3ZjLmNsdXN0ZXIubG9jYWw6NTU1Ni9kZXg=
  kind: Secret
  metadata:
    labels:
      k8s-app: telemeter-server
    name: telemeter-server
  type: Opaque
- apiVersion: v1
  kind: Service
  metadata:
    annotations:
      service.alpha.openshift.io/serving-cert-secret-name: telemeter-server-shared
    labels:
      k8s-app: telemeter-server
    name: telemeter-server
  spec:
    clusterIP: None
    ports:
    - name: external
      port: 8443
      targetPort: external
    - name: internal
      port: 8081
      targetPort: internal
    selector:
      k8s-app: telemeter-server
- apiVersion: v1
  kind: ServiceAccount
  metadata:
    name: telemeter-server
- apiVersion: monitoring.coreos.com/v1
  kind: ServiceMonitor
  metadata:
    labels:
      endpoint: metrics
      k8s-app: telemeter-server
      prometheus: app-sre
    name: telemeter-server
  spec:
    endpoints:
    - interval: 60s
      port: internal
      scheme: https
      tlsConfig:
        insecureSkipVerify: true
    jobLabel: k8s-app
    namespaceSelector:
      matchNames:
      - ${NAMESPACE}
    selector:
      matchLabels:
        k8s-app: telemeter-server
- apiVersion: apps/v1
  kind: StatefulSet
  metadata:
    name: telemeter-server
  spec:
    podManagementPolicy: Parallel
    replicas: ${{REPLICAS}}
    selector:
      matchLabels:
        k8s-app: telemeter-server
    serviceName: telemeter-server
    template:
      metadata:
        labels:
          k8s-app: telemeter-server
      spec:
        containers:
        - command:
          - /usr/bin/telemeter-server
          - --listen=0.0.0.0:8443
          - --listen-internal=0.0.0.0:8081
          - --shared-key=/etc/pki/service/tls.key
          - --tls-key=/etc/pki/service/tls.key
          - --tls-crt=/etc/pki/service/tls.crt
          - --internal-tls-key=/etc/pki/service/tls.key
          - --internal-tls-crt=/etc/pki/service/tls.crt
          - --authorize=$(AUTHORIZE_URL)
          - --oidc-issuer=$(OIDC_ISSUER)
          - --client-id=$(CLIENT_ID)
          - --client-secret=$(CLIENT_SECRET)
          - --memcached=memcached-0.memcached.${NAMESPACE}.svc.cluster.local:11211
          - --memcached=memcached-1.memcached.${NAMESPACE}.svc.cluster.local:11211
          - --memcached=memcached-2.memcached.${NAMESPACE}.svc.cluster.local:11211
          - --whitelist={__name__="alerts",alertstate="firing",severity=~"critical|warning|info|none"}
          - --whitelist={__name__="acm_console_page_count:sum", page=~"overview-classic|overview-fleet|search|search-details|clusters|application|governance"}
          - --whitelist={__name__="acm_managed_cluster_info"}
          - --whitelist={__name__="acm_managed_cluster_worker_cores:max"}
          - --whitelist={__name__="apiserver_list_watch_request_success_total:rate:sum", verb=~"LIST|WATCH"}
          - --whitelist={__name__="appsvcs:cores_by_product:sum"}
          - --whitelist={__name__="cam_app_workload_migrations"}
          - --whitelist={__name__="cco_credentials_mode"}
          - --whitelist={__name__="ceph_cluster_total_bytes"}
          - --whitelist={__name__="ceph_cluster_total_used_raw_bytes"}
          - --whitelist={__name__="ceph_health_status"}
          - --whitelist={__name__="che_workspace_failure_total"}
          - --whitelist={__name__="che_workspace_start_time_seconds_count"}
          - --whitelist={__name__="che_workspace_start_time_seconds_sum"}
          - --whitelist={__name__="che_workspace_started_total"}
          - --whitelist={__name__="che_workspace_status"}
          - --whitelist={__name__="cluster:alertmanager_integrations:max"}
          - --whitelist={__name__="cluster:apiserver_current_inflight_requests:sum:max_over_time:2m"}
          - --whitelist={__name__="cluster:capacity_cpu_cores:sum"}
          - --whitelist={__name__="cluster:capacity_memory_bytes:sum"}
          - --whitelist={__name__="cluster:console_auth_login_failures_total:sum"}
          - --whitelist={__name__="cluster:console_auth_login_requests_total:sum"}
          - --whitelist={__name__="cluster:console_auth_login_successes_total:sum"}
          - --whitelist={__name__="cluster:console_auth_logout_requests_total:sum"}
          - --whitelist={__name__="cluster:console_customization_perspectives_info:max"}
          - --whitelist={__name__="cluster:console_plugins_info:max"}
          - --whitelist={__name__="cluster:console_usage_users:max"}
          - --whitelist={__name__="cluster:cpu_usage_cores:sum"}
          - --whitelist={__name__="cluster:eo_es_data_nodes_total:max"}
          - --whitelist={__name__="cluster:eo_es_documents_created_total:sum"}
          - --whitelist={__name__="cluster:eo_es_documents_deleted_total:sum"}
          - --whitelist={__name__="cluster:health:group_severity:count", severity=~"critical|warning|info|none"}
          - --whitelist={__name__="cluster:ingress_controller_aws_nlb_active:sum"}
          - --whitelist={__name__="cluster:kata_monitor_running_shim_count:sum"}
          - --whitelist={__name__="cluster:kube_persistentvolume_plugin_type_counts:sum"}
          - --whitelist={__name__="cluster:kube_persistentvolumeclaim_resource_requests_storage_bytes:provisioner:sum"}
          - --whitelist={__name__="cluster:kubelet_volume_stats_used_bytes:provisioner:sum"}
          - --whitelist={__name__="cluster:log_collected_bytes_total:sum"}
          - --whitelist={__name__="cluster:log_logged_bytes_total:sum"}
          - --whitelist={__name__="cluster:memory_usage_bytes:sum"}
          - --whitelist={__name__="cluster:network_attachment_definition_enabled_instance_up:max"}
          - --whitelist={__name__="cluster:network_attachment_definition_instances:max"}
          - --whitelist={__name__="cluster:node_instance_type_count:sum"}
          - --whitelist={__name__="cluster:openshift_route_info:tls_termination:sum"}
          - --whitelist={__name__="cluster:ovnkube_controller_admin_network_policies_db_objects:max",table_name=~"ACL|Address_Set"}
          - --whitelist={__name__="cluster:ovnkube_controller_admin_network_policies_rules:max",direction=~"Ingress|Egress",action=~"Pass|Allow|Deny"}
          - --whitelist={__name__="cluster:ovnkube_controller_baseline_admin_network_policies_db_objects:max",table_name=~"ACL|Address_Set"}
          - --whitelist={__name__="cluster:ovnkube_controller_baseline_admin_network_policies_rules:max",direction=~"Ingress|Egress",action=~"Allow|Deny"}
          - --whitelist={__name__="cluster:ovnkube_controller_egress_routing_via_host:max"}
          - --whitelist={__name__="cluster:route_metrics_controller_routes_per_shard:avg"}
          - --whitelist={__name__="cluster:route_metrics_controller_routes_per_shard:max"}
          - --whitelist={__name__="cluster:route_metrics_controller_routes_per_shard:median"}
          - --whitelist={__name__="cluster:route_metrics_controller_routes_per_shard:min"}
          - --whitelist={__name__="cluster:telemetry_selected_series:count"}
          - --whitelist={__name__="cluster:virt_platform_nodes:sum"}
          - --whitelist={__name__="cluster:vmi_request_cpu_cores:sum"}
          - --whitelist={__name__="cluster:volume_manager_selinux_pod_context_mismatch_total"}
          - --whitelist={__name__="cluster:volume_manager_selinux_volume_context_mismatch_errors_total"}
          - --whitelist={__name__="cluster:volume_manager_selinux_volume_context_mismatch_warnings_total"}
          - --whitelist={__name__="cluster:volume_manager_selinux_volumes_admitted_total"}
          - --whitelist={__name__="cluster:vsphere_esxi_version_total:sum"}
          - --whitelist={__name__="cluster:vsphere_infrastructure_failure_domains:max"}
          - --whitelist={__name__="cluster:vsphere_node_hw_version_total:sum"}
          - --whitelist={__name__="cluster:vsphere_topology_tags:max"}
          - --whitelist={__name__="cluster:vsphere_vcenter_info:sum"}
          - --whitelist={__name__="cluster_feature_set"}
          - --whitelist={__name__="cluster_infrastructure_provider"}
          - --whitelist={__name__="cluster_installer"}
          - --whitelist={__name__="cluster_legacy_scheduler_policy"}
          - --whitelist={__name__="cluster_master_schedulable"}
          - --whitelist={__name__="cluster_name:hypershift_nodepools_available_replicas:sum"}
          - --whitelist={__name__="cluster_name:hypershift_nodepools_size:sum"}
          - --whitelist={__name__="cluster_operator_conditions"}
          - --whitelist={__name__="cluster_operator_up"}
          - --whitelist={__name__="cluster_version"}
          - --whitelist={__name__="cluster_version_available_updates"}
          - --whitelist={__name__="cluster_version_capability"}
          - --whitelist={__name__="cluster_version_payload"}
          - --whitelist={__name__="cnv:vmi_status_running:count"}
          - --whitelist={__name__="cnv_abnormal", reason=~"memory_working_set_delta_from_request|memory_rss_delta_from_request"}
          - --whitelist={__name__="code:apiserver_request_total:rate:sum"}
          - --whitelist={__name__="console_url"}
          - --whitelist={__name__="count:up0"}
          - --whitelist={__name__="count:up1"}
          - --whitelist={__name__="csv_abnormal"}
          - --whitelist={__name__="csv_succeeded"}
          - --whitelist={__name__="enabled:tempo_operator_tempostack_jaeger_ui:sum",enabled=~"true|false"}
          - --whitelist={__name__="eo_es_cluster_management_state_info"}
          - --whitelist={__name__="eo_es_defined_delete_namespaces_total"}
          - --whitelist={__name__="eo_es_misconfigured_memory_resources_info"}
          - --whitelist={__name__="eo_es_redundancy_policy_info"}
          - --whitelist={__name__="eo_es_storage_info"}
          - --whitelist={__name__="imageregistry:imagestreamtags_count:sum"}
          - --whitelist={__name__="imageregistry:operations_count:sum"}
          - --whitelist={__name__="insightsclient_request_send_total"}
          - --whitelist={__name__="instance:etcd_disk_backend_commit_duration_seconds:histogram_quantile",quantile="0.99"}
          - --whitelist={__name__="instance:etcd_disk_wal_fsync_duration_seconds:histogram_quantile",quantile="0.99"}
          - --whitelist={__name__="instance:etcd_mvcc_db_total_size_in_bytes:sum"}
          - --whitelist={__name__="instance:etcd_mvcc_db_total_size_in_use_in_bytes:sum"}
          - --whitelist={__name__="instance:etcd_network_peer_round_trip_time_seconds:histogram_quantile",quantile="0.99"}
          - --whitelist={__name__="instance:etcd_object_counts:sum"}
          - --whitelist={__name__="jaeger_operator_instances_agent_strategies"}
          - --whitelist={__name__="jaeger_operator_instances_storage_types"}
          - --whitelist={__name__="jaeger_operator_instances_strategies"}
          - --whitelist={__name__="job:ceph_osd_metadata:count"}
          - --whitelist={__name__="job:ceph_pools_iops:total"}
          - --whitelist={__name__="job:ceph_pools_iops_bytes:total"}
          - --whitelist={__name__="job:ceph_versions_running:count"}
          - --whitelist={__name__="job:kube_pv:count"}
          - --whitelist={__name__="job:noobaa_bucket_count:sum"}
          - --whitelist={__name__="job:noobaa_total_object_count:sum"}
          - --whitelist={__name__="job:noobaa_total_unhealthy_buckets:sum"}
          - --whitelist={__name__="job:odf_system_pvs:count"}
          - --whitelist={__name__="log_collector_error_count_total"}
          - --whitelist={__name__="log_forwarder_input_info"}
          - --whitelist={__name__="log_forwarder_output_info"}
          - --whitelist={__name__="log_forwarder_pipeline_info"}
          - --whitelist={__name__="log_logging_info"}
          - --whitelist={__name__="monitoring:container_memory_working_set_bytes:sum"}
          - --whitelist={__name__="monitoring:haproxy_server_http_responses_total:sum"}
          - --whitelist={__name__="namespace:noobaa_accounts:max"}
          - --whitelist={__name__="namespace:noobaa_buckets_claims:max"}
          - --whitelist={__name__="namespace:noobaa_namespace_buckets:max"}
          - --whitelist={__name__="namespace:noobaa_namespace_resources:max"}
          - --whitelist={__name__="namespace:noobaa_system_health_status:max"}
          - --whitelist={__name__="namespace:noobaa_unhealthy_bucket_claims:max"}
          - --whitelist={__name__="namespace:noobaa_unhealthy_namespace_buckets:max"}
          - --whitelist={__name__="namespace:noobaa_unhealthy_namespace_resources:max"}
          - --whitelist={__name__="namespace:noobaa_usage:max"}
          - --whitelist={__name__="namespace_job:scrape_samples_post_metric_relabeling:topk3"}
          - --whitelist={__name__="namespace_job:scrape_series_added:topk3_sum1h"}
          - --whitelist={__name__="node_role_os_version_machine:cpu_capacity_cores:sum"}
          - --whitelist={__name__="node_role_os_version_machine:cpu_capacity_sockets:sum"}
          - --whitelist={__name__="noobaa_accounts_num"}
          - --whitelist={__name__="noobaa_total_usage"}
          - --whitelist={__name__="nto_custom_profiles:count"}
          - --whitelist={__name__="ocs_advanced_feature_usage"}
          - --whitelist={__name__="odf_system_bucket_count", system_type="OCS", system_vendor="Red Hat"}
          - --whitelist={__name__="odf_system_health_status"}
          - --whitelist={__name__="odf_system_objects_total", system_type="OCS", system_vendor="Red Hat"}
          - --whitelist={__name__="odf_system_raw_capacity_total_bytes"}
          - --whitelist={__name__="odf_system_raw_capacity_used_bytes"}
          - --whitelist={__name__="olm_resolution_duration_seconds"}
          - --whitelist={__name__="ols:provider_model_configuration"}
          - --whitelist={__name__="ols:rest_api_query_calls_total:2xx"}
          - --whitelist={__name__="ols:rest_api_query_calls_total:4xx"}
          - --whitelist={__name__="ols:rest_api_query_calls_total:5xx"}
          - --whitelist={__name__="openshift:build_by_strategy:sum"}
          - --whitelist={__name__="openshift:cpu_usage_cores:sum"}
          - --whitelist={__name__="openshift:memory_usage_bytes:sum"}
          - --whitelist={__name__="openshift:openshift_network_operator_ipsec_state:info"}
          - --whitelist={__name__="openshift:prometheus_tsdb_head_samples_appended_total:sum"}
          - --whitelist={__name__="openshift:prometheus_tsdb_head_series:sum"}
          - --whitelist={__name__="openshift_csi_share_configmap"}
          - --whitelist={__name__="openshift_csi_share_mount_failures_total"}
          - --whitelist={__name__="openshift_csi_share_mount_requests_total"}
          - --whitelist={__name__="openshift_csi_share_secret"}
          - --whitelist={__name__="openshift_logging:log_forwarder_input_type:sum"}
          - --whitelist={__name__="openshift_logging:log_forwarder_output_type:sum"}
          - --whitelist={__name__="openshift_logging:log_forwarder_pipelines:sum"}
          - --whitelist={__name__="openshift_logging:log_forwarders:sum"}
          - --whitelist={__name__="openshift_logging:vector_component_received_bytes_total:rate5m"}
          - --whitelist={__name__="os_image_url_override:sum"}
          - --whitelist={__name__="platform:hypershift_hostedclusters:max"}
          - --whitelist={__name__="platform:hypershift_nodepools:max"}
          - --whitelist={__name__="pod:eo_es_shards_total:max"}
          - --whitelist={__name__="profile:cluster_monitoring_operator_collection_profile:max"}
          - --whitelist={__name__="rhacs:telemetry:rox_central_info"}
          - --whitelist={__name__="rhacs:telemetry:rox_central_secured_clusters"}
          - --whitelist={__name__="rhacs:telemetry:rox_central_secured_nodes"}
          - --whitelist={__name__="rhacs:telemetry:rox_central_secured_vcpus"}
          - --whitelist={__name__="rhacs:telemetry:rox_sensor_info"}
          - --whitelist={__name__="rhmi_status"}
          - --whitelist={__name__="rhoam_7d_slo_percentile:max"}
          - --whitelist={__name__="rhoam_7d_slo_remaining_error_budget:max"}
          - --whitelist={__name__="rhods_aggregate_availability"}
          - --whitelist={__name__="rhods_total_users"}
          - --whitelist={__name__="state:rhoam_critical_alerts:max"}
          - --whitelist={__name__="state:rhoam_warning_alerts:max"}
          - --whitelist={__name__="state:tempo_operator_tempostack_managed:sum",state=~"Managed|Unmanaged"}
          - --whitelist={__name__="status:upgrading:version:rhoam_state:max"}
          - --whitelist={__name__="subscription_sync_total"}
          - --whitelist={__name__="type:opentelemetry_collector_connectors:sum",type=~"spanmetricsconnector|forwardconnector"}
          - --whitelist={__name__="type:opentelemetry_collector_exporters:sum",type=~"debugexporter|loggingexporter|otlpexporter|otlphttpexporter|prometheusexporter|lokiexporter|kafkaexporter|awscloudwatchlogsexporter|loadbalancingexporter"}
          - --whitelist={__name__="type:opentelemetry_collector_extensions:sum",type=~"zpagesextension|ballastextension|memorylimiterextension|jaegerremotesampling|healthcheckextension|pprofextension|oauth2clientauthextension|oidcauthextension|bearertokenauthextension|filestorage"}
          - --whitelist={__name__="type:opentelemetry_collector_info:sum",type=~"deployment|daemonset|sidecar|statefulset"}
          - --whitelist={__name__="type:opentelemetry_collector_processors:sum",type=~"batchprocessor|memorylimiterprocessor|attributesprocessor|resourceprocessor|spanprocessor|k8sattributesprocessor|resourcedetectionprocessor|filterprocessor|routingprocessor|cumulativetodeltaprocessor|groupbyattrsprocessor"}
          - --whitelist={__name__="type:opentelemetry_collector_receivers:sum",type=~"jaegerreceiver|hostmetricsreceiver|opencensusreceiver|prometheusreceiver|zipkinreceiver|kafkareceiver|filelogreceiver|journaldreceiver|k8seventsreceiver|kubeletstatsreceiver|k8sclusterreceiver|k8sobjectsreceiver"}
          - --whitelist={__name__="type:tempo_operator_tempostack_multi_tenancy:sum",type=~"enabled|disabled"}
          - --whitelist={__name__="type:tempo_operator_tempostack_storage_backend:sum",type=~"azure|gcs|s3"}
          - --whitelist={__name__="vendor_model:node_accelerator_cards:sum",vendor=~"NVIDIA|AMD|GAUDI|INTEL|QUALCOMM"}
          - --whitelist={__name__="workload:cpu_usage_cores:sum"}
          - --whitelist={__name__="workload:memory_usage_bytes:sum"}
          - --whitelist={__name__=~"cluster:usage:.*"}
          - --elide-label=prometheus_replica
          - --log-level=${TELEMETER_LOG_LEVEL}
          - --token-expire-seconds=${TELEMETER_SERVER_TOKEN_EXPIRE_SECONDS}
          - --limit-bytes=5242880
          - --forward-url=${TELEMETER_FORWARD_URL}
          env:
          - name: AUTHORIZE_URL
            valueFrom:
              secretKeyRef:
                key: authorize_url
                name: telemeter-server
          - name: OIDC_ISSUER
            valueFrom:
              secretKeyRef:
                key: oidc_issuer
                name: telemeter-server
          - name: CLIENT_SECRET
            valueFrom:
              secretKeyRef:
                key: client_secret
                name: telemeter-server
          - name: CLIENT_ID
            valueFrom:
              secretKeyRef:
                key: client_id
                name: telemeter-server
          image: ${IMAGE}:${IMAGE_TAG}
          livenessProbe:
            httpGet:
              path: /healthz
              port: 8443
              scheme: HTTPS
          name: telemeter-server
          ports:
          - containerPort: 8443
            name: external
          - containerPort: 8081
            name: internal
          readinessProbe:
            httpGet:
              path: /healthz/ready
              port: 8443
              scheme: HTTPS
          resources:
            limits:
              cpu: ${TELEMETER_SERVER_CPU_LIMIT}
              memory: ${TELEMETER_SERVER_MEMORY_LIMIT}
            requests:
              cpu: ${TELEMETER_SERVER_CPU_REQUEST}
              memory: ${TELEMETER_SERVER_MEMORY_REQUEST}
          volumeMounts:
          - mountPath: /etc/pki/service
            name: telemeter-server-tls
            readOnly: false
        serviceAccountName: telemeter-server
        volumes:
        - name: secret-telemeter-server
          secret:
            secretName: telemeter-server
        - name: telemeter-server-tls
          secret:
            secretName: telemeter-server-shared
- apiVersion: apps/v1
  kind: StatefulSet
  metadata:
    name: telemeter-server-canary
  spec:
    podManagementPolicy: Parallel
    replicas: ${{REPLICAS_CANARY}}
    selector:
      matchLabels:
        k8s-app: telemeter-server
        track: canary
    serviceName: telemeter-server
    template:
      metadata:
        labels:
          k8s-app: telemeter-server
          track: canary
      spec:
        containers:
        - command:
          - /usr/bin/telemeter-server
          - --listen=0.0.0.0:8443
          - --listen-internal=0.0.0.0:8081
          - --shared-key=/etc/pki/service/tls.key
          - --tls-key=/etc/pki/service/tls.key
          - --tls-crt=/etc/pki/service/tls.crt
          - --internal-tls-key=/etc/pki/service/tls.key
          - --internal-tls-crt=/etc/pki/service/tls.crt
          - --authorize=$(AUTHORIZE_URL)
          - --oidc-issuer=$(OIDC_ISSUER)
          - --client-id=$(CLIENT_ID)
          - --client-secret=$(CLIENT_SECRET)
          - --memcached=memcached-0.memcached.${NAMESPACE}.svc.cluster.local:11211
          - --memcached=memcached-1.memcached.${NAMESPACE}.svc.cluster.local:11211
          - --memcached=memcached-2.memcached.${NAMESPACE}.svc.cluster.local:11211
          - --whitelist={__name__="alerts",alertstate="firing",severity=~"critical|warning|info|none"}
          - --whitelist={__name__="acm_console_page_count:sum", page=~"overview-classic|overview-fleet|search|search-details|clusters|application|governance"}
          - --whitelist={__name__="acm_managed_cluster_info"}
          - --whitelist={__name__="acm_managed_cluster_worker_cores:max"}
          - --whitelist={__name__="apiserver_list_watch_request_success_total:rate:sum", verb=~"LIST|WATCH"}
          - --whitelist={__name__="appsvcs:cores_by_product:sum"}
          - --whitelist={__name__="cam_app_workload_migrations"}
          - --whitelist={__name__="cco_credentials_mode"}
          - --whitelist={__name__="ceph_cluster_total_bytes"}
          - --whitelist={__name__="ceph_cluster_total_used_raw_bytes"}
          - --whitelist={__name__="ceph_health_status"}
          - --whitelist={__name__="che_workspace_failure_total"}
          - --whitelist={__name__="che_workspace_start_time_seconds_count"}
          - --whitelist={__name__="che_workspace_start_time_seconds_sum"}
          - --whitelist={__name__="che_workspace_started_total"}
          - --whitelist={__name__="che_workspace_status"}
          - --whitelist={__name__="cluster:alertmanager_integrations:max"}
          - --whitelist={__name__="cluster:apiserver_current_inflight_requests:sum:max_over_time:2m"}
          - --whitelist={__name__="cluster:capacity_cpu_cores:sum"}
          - --whitelist={__name__="cluster:capacity_memory_bytes:sum"}
          - --whitelist={__name__="cluster:console_auth_login_failures_total:sum"}
          - --whitelist={__name__="cluster:console_auth_login_requests_total:sum"}
          - --whitelist={__name__="cluster:console_auth_login_successes_total:sum"}
          - --whitelist={__name__="cluster:console_auth_logout_requests_total:sum"}
          - --whitelist={__name__="cluster:console_customization_perspectives_info:max"}
          - --whitelist={__name__="cluster:console_plugins_info:max"}
          - --whitelist={__name__="cluster:console_usage_users:max"}
          - --whitelist={__name__="cluster:cpu_usage_cores:sum"}
          - --whitelist={__name__="cluster:eo_es_data_nodes_total:max"}
          - --whitelist={__name__="cluster:eo_es_documents_created_total:sum"}
          - --whitelist={__name__="cluster:eo_es_documents_deleted_total:sum"}
          - --whitelist={__name__="cluster:health:group_severity:count", severity=~"critical|warning|info|none"}
          - --whitelist={__name__="cluster:ingress_controller_aws_nlb_active:sum"}
          - --whitelist={__name__="cluster:kata_monitor_running_shim_count:sum"}
          - --whitelist={__name__="cluster:kube_persistentvolume_plugin_type_counts:sum"}
          - --whitelist={__name__="cluster:kube_persistentvolumeclaim_resource_requests_storage_bytes:provisioner:sum"}
          - --whitelist={__name__="cluster:kubelet_volume_stats_used_bytes:provisioner:sum"}
          - --whitelist={__name__="cluster:log_collected_bytes_total:sum"}
          - --whitelist={__name__="cluster:log_logged_bytes_total:sum"}
          - --whitelist={__name__="cluster:memory_usage_bytes:sum"}
          - --whitelist={__name__="cluster:network_attachment_definition_enabled_instance_up:max"}
          - --whitelist={__name__="cluster:network_attachment_definition_instances:max"}
          - --whitelist={__name__="cluster:node_instance_type_count:sum"}
          - --whitelist={__name__="cluster:openshift_route_info:tls_termination:sum"}
          - --whitelist={__name__="cluster:ovnkube_controller_admin_network_policies_db_objects:max",table_name=~"ACL|Address_Set"}
          - --whitelist={__name__="cluster:ovnkube_controller_admin_network_policies_rules:max",direction=~"Ingress|Egress",action=~"Pass|Allow|Deny"}
          - --whitelist={__name__="cluster:ovnkube_controller_baseline_admin_network_policies_db_objects:max",table_name=~"ACL|Address_Set"}
          - --whitelist={__name__="cluster:ovnkube_controller_baseline_admin_network_policies_rules:max",direction=~"Ingress|Egress",action=~"Allow|Deny"}
          - --whitelist={__name__="cluster:ovnkube_controller_egress_routing_via_host:max"}
          - --whitelist={__name__="cluster:route_metrics_controller_routes_per_shard:avg"}
          - --whitelist={__name__="cluster:route_metrics_controller_routes_per_shard:max"}
          - --whitelist={__name__="cluster:route_metrics_controller_routes_per_shard:median"}
          - --whitelist={__name__="cluster:route_metrics_controller_routes_per_shard:min"}
          - --whitelist={__name__="cluster:telemetry_selected_series:count"}
          - --whitelist={__name__="cluster:virt_platform_nodes:sum"}
          - --whitelist={__name__="cluster:vmi_request_cpu_cores:sum"}
          - --whitelist={__name__="cluster:volume_manager_selinux_pod_context_mismatch_total"}
          - --whitelist={__name__="cluster:volume_manager_selinux_volume_context_mismatch_errors_total"}
          - --whitelist={__name__="cluster:volume_manager_selinux_volume_context_mismatch_warnings_total"}
          - --whitelist={__name__="cluster:volume_manager_selinux_volumes_admitted_total"}
          - --whitelist={__name__="cluster:vsphere_esxi_version_total:sum"}
          - --whitelist={__name__="cluster:vsphere_infrastructure_failure_domains:max"}
          - --whitelist={__name__="cluster:vsphere_node_hw_version_total:sum"}
          - --whitelist={__name__="cluster:vsphere_topology_tags:max"}
          - --whitelist={__name__="cluster:vsphere_vcenter_info:sum"}
          - --whitelist={__name__="cluster_feature_set"}
          - --whitelist={__name__="cluster_infrastructure_provider"}
          - --whitelist={__name__="cluster_installer"}
          - --whitelist={__name__="cluster_legacy_scheduler_policy"}
          - --whitelist={__name__="cluster_master_schedulable"}
          - --whitelist={__name__="cluster_name:hypershift_nodepools_available_replicas:sum"}
          - --whitelist={__name__="cluster_name:hypershift_nodepools_size:sum"}
          - --whitelist={__name__="cluster_operator_conditions"}
          - --whitelist={__name__="cluster_operator_up"}
          - --whitelist={__name__="cluster_version"}
          - --whitelist={__name__="cluster_version_available_updates"}
          - --whitelist={__name__="cluster_version_capability"}
          - --whitelist={__name__="cluster_version_payload"}
          - --whitelist={__name__="cnv:vmi_status_running:count"}
          - --whitelist={__name__="cnv_abnormal", reason=~"memory_working_set_delta_from_request|memory_rss_delta_from_request"}
          - --whitelist={__name__="code:apiserver_request_total:rate:sum"}
          - --whitelist={__name__="console_url"}
          - --whitelist={__name__="count:up0"}
          - --whitelist={__name__="count:up1"}
          - --whitelist={__name__="csv_abnormal"}
          - --whitelist={__name__="csv_succeeded"}
          - --whitelist={__name__="enabled:tempo_operator_tempostack_jaeger_ui:sum",enabled=~"true|false"}
          - --whitelist={__name__="eo_es_cluster_management_state_info"}
          - --whitelist={__name__="eo_es_defined_delete_namespaces_total"}
          - --whitelist={__name__="eo_es_misconfigured_memory_resources_info"}
          - --whitelist={__name__="eo_es_redundancy_policy_info"}
          - --whitelist={__name__="eo_es_storage_info"}
          - --whitelist={__name__="imageregistry:imagestreamtags_count:sum"}
          - --whitelist={__name__="imageregistry:operations_count:sum"}
          - --whitelist={__name__="insightsclient_request_send_total"}
          - --whitelist={__name__="instance:etcd_disk_backend_commit_duration_seconds:histogram_quantile",quantile="0.99"}
          - --whitelist={__name__="instance:etcd_disk_wal_fsync_duration_seconds:histogram_quantile",quantile="0.99"}
          - --whitelist={__name__="instance:etcd_mvcc_db_total_size_in_bytes:sum"}
          - --whitelist={__name__="instance:etcd_mvcc_db_total_size_in_use_in_bytes:sum"}
          - --whitelist={__name__="instance:etcd_network_peer_round_trip_time_seconds:histogram_quantile",quantile="0.99"}
          - --whitelist={__name__="instance:etcd_object_counts:sum"}
          - --whitelist={__name__="jaeger_operator_instances_agent_strategies"}
          - --whitelist={__name__="jaeger_operator_instances_storage_types"}
          - --whitelist={__name__="jaeger_operator_instances_strategies"}
          - --whitelist={__name__="job:ceph_osd_metadata:count"}
          - --whitelist={__name__="job:ceph_pools_iops:total"}
          - --whitelist={__name__="job:ceph_pools_iops_bytes:total"}
          - --whitelist={__name__="job:ceph_versions_running:count"}
          - --whitelist={__name__="job:kube_pv:count"}
          - --whitelist={__name__="job:noobaa_bucket_count:sum"}
          - --whitelist={__name__="job:noobaa_total_object_count:sum"}
          - --whitelist={__name__="job:noobaa_total_unhealthy_buckets:sum"}
          - --whitelist={__name__="job:odf_system_pvs:count"}
          - --whitelist={__name__="log_collector_error_count_total"}
          - --whitelist={__name__="log_forwarder_input_info"}
          - --whitelist={__name__="log_forwarder_output_info"}
          - --whitelist={__name__="log_forwarder_pipeline_info"}
          - --whitelist={__name__="log_logging_info"}
          - --whitelist={__name__="monitoring:container_memory_working_set_bytes:sum"}
          - --whitelist={__name__="monitoring:haproxy_server_http_responses_total:sum"}
          - --whitelist={__name__="namespace:noobaa_accounts:max"}
          - --whitelist={__name__="namespace:noobaa_buckets_claims:max"}
          - --whitelist={__name__="namespace:noobaa_namespace_buckets:max"}
          - --whitelist={__name__="namespace:noobaa_namespace_resources:max"}
          - --whitelist={__name__="namespace:noobaa_system_health_status:max"}
          - --whitelist={__name__="namespace:noobaa_unhealthy_bucket_claims:max"}
          - --whitelist={__name__="namespace:noobaa_unhealthy_namespace_buckets:max"}
          - --whitelist={__name__="namespace:noobaa_unhealthy_namespace_resources:max"}
          - --whitelist={__name__="namespace:noobaa_usage:max"}
          - --whitelist={__name__="namespace_job:scrape_samples_post_metric_relabeling:topk3"}
          - --whitelist={__name__="namespace_job:scrape_series_added:topk3_sum1h"}
          - --whitelist={__name__="node_role_os_version_machine:cpu_capacity_cores:sum"}
          - --whitelist={__name__="node_role_os_version_machine:cpu_capacity_sockets:sum"}
          - --whitelist={__name__="noobaa_accounts_num"}
          - --whitelist={__name__="noobaa_total_usage"}
          - --whitelist={__name__="nto_custom_profiles:count"}
          - --whitelist={__name__="ocs_advanced_feature_usage"}
          - --whitelist={__name__="odf_system_bucket_count", system_type="OCS", system_vendor="Red Hat"}
          - --whitelist={__name__="odf_system_health_status"}
          - --whitelist={__name__="odf_system_objects_total", system_type="OCS", system_vendor="Red Hat"}
          - --whitelist={__name__="odf_system_raw_capacity_total_bytes"}
          - --whitelist={__name__="odf_system_raw_capacity_used_bytes"}
          - --whitelist={__name__="olm_resolution_duration_seconds"}
          - --whitelist={__name__="ols:provider_model_configuration"}
          - --whitelist={__name__="ols:rest_api_query_calls_total:2xx"}
          - --whitelist={__name__="ols:rest_api_query_calls_total:4xx"}
          - --whitelist={__name__="ols:rest_api_query_calls_total:5xx"}
          - --whitelist={__name__="openshift:build_by_strategy:sum"}
          - --whitelist={__name__="openshift:cpu_usage_cores:sum"}
          - --whitelist={__name__="openshift:memory_usage_bytes:sum"}
          - --whitelist={__name__="openshift:openshift_network_operator_ipsec_state:info"}
          - --whitelist={__name__="openshift:prometheus_tsdb_head_samples_appended_total:sum"}
          - --whitelist={__name__="openshift:prometheus_tsdb_head_series:sum"}
          - --whitelist={__name__="openshift_csi_share_configmap"}
          - --whitelist={__name__="openshift_csi_share_mount_failures_total"}
          - --whitelist={__name__="openshift_csi_share_mount_requests_total"}
          - --whitelist={__name__="openshift_csi_share_secret"}
          - --whitelist={__name__="openshift_logging:log_forwarder_input_type:sum"}
          - --whitelist={__name__="openshift_logging:log_forwarder_output_type:sum"}
          - --whitelist={__name__="openshift_logging:log_forwarder_pipelines:sum"}
          - --whitelist={__name__="openshift_logging:log_forwarders:sum"}
          - --whitelist={__name__="openshift_logging:vector_component_received_bytes_total:rate5m"}
          - --whitelist={__name__="os_image_url_override:sum"}
          - --whitelist={__name__="platform:hypershift_hostedclusters:max"}
          - --whitelist={__name__="platform:hypershift_nodepools:max"}
          - --whitelist={__name__="pod:eo_es_shards_total:max"}
          - --whitelist={__name__="profile:cluster_monitoring_operator_collection_profile:max"}
          - --whitelist={__name__="rhacs:telemetry:rox_central_info"}
          - --whitelist={__name__="rhacs:telemetry:rox_central_secured_clusters"}
          - --whitelist={__name__="rhacs:telemetry:rox_central_secured_nodes"}
          - --whitelist={__name__="rhacs:telemetry:rox_central_secured_vcpus"}
          - --whitelist={__name__="rhacs:telemetry:rox_sensor_info"}
          - --whitelist={__name__="rhmi_status"}
          - --whitelist={__name__="rhoam_7d_slo_percentile:max"}
          - --whitelist={__name__="rhoam_7d_slo_remaining_error_budget:max"}
          - --whitelist={__name__="rhods_aggregate_availability"}
          - --whitelist={__name__="rhods_total_users"}
          - --whitelist={__name__="state:rhoam_critical_alerts:max"}
          - --whitelist={__name__="state:rhoam_warning_alerts:max"}
          - --whitelist={__name__="state:tempo_operator_tempostack_managed:sum",state=~"Managed|Unmanaged"}
          - --whitelist={__name__="status:upgrading:version:rhoam_state:max"}
          - --whitelist={__name__="subscription_sync_total"}
          - --whitelist={__name__="type:opentelemetry_collector_connectors:sum",type=~"spanmetricsconnector|forwardconnector"}
          - --whitelist={__name__="type:opentelemetry_collector_exporters:sum",type=~"debugexporter|loggingexporter|otlpexporter|otlphttpexporter|prometheusexporter|lokiexporter|kafkaexporter|awscloudwatchlogsexporter|loadbalancingexporter"}
          - --whitelist={__name__="type:opentelemetry_collector_extensions:sum",type=~"zpagesextension|ballastextension|memorylimiterextension|jaegerremotesampling|healthcheckextension|pprofextension|oauth2clientauthextension|oidcauthextension|bearertokenauthextension|filestorage"}
          - --whitelist={__name__="type:opentelemetry_collector_info:sum",type=~"deployment|daemonset|sidecar|statefulset"}
          - --whitelist={__name__="type:opentelemetry_collector_processors:sum",type=~"batchprocessor|memorylimiterprocessor|attributesprocessor|resourceprocessor|spanprocessor|k8sattributesprocessor|resourcedetectionprocessor|filterprocessor|routingprocessor|cumulativetodeltaprocessor|groupbyattrsprocessor"}
          - --whitelist={__name__="type:opentelemetry_collector_receivers:sum",type=~"jaegerreceiver|hostmetricsreceiver|opencensusreceiver|prometheusreceiver|zipkinreceiver|kafkareceiver|filelogreceiver|journaldreceiver|k8seventsreceiver|kubeletstatsreceiver|k8sclusterreceiver|k8sobjectsreceiver"}
          - --whitelist={__name__="type:tempo_operator_tempostack_multi_tenancy:sum",type=~"enabled|disabled"}
          - --whitelist={__name__="type:tempo_operator_tempostack_storage_backend:sum",type=~"azure|gcs|s3"}
          - --whitelist={__name__="vendor_model:node_accelerator_cards:sum",vendor=~"NVIDIA|AMD|GAUDI|INTEL|QUALCOMM"}
          - --whitelist={__name__="workload:cpu_usage_cores:sum"}
          - --whitelist={__name__="workload:memory_usage_bytes:sum"}
          - --whitelist={__name__=~"cluster:usage:.*"}
          - --elide-label=prometheus_replica
          - --log-level=${TELEMETER_LOG_LEVEL}
          - --token-expire-seconds=${TELEMETER_SERVER_TOKEN_EXPIRE_SECONDS}
          - --limit-bytes=5242880
          - --forward-url=${TELEMETER_FORWARD_URL}
          - --log-level=debug
          env:
          - name: AUTHORIZE_URL
            valueFrom:
              secretKeyRef:
                key: authorize_url
                name: telemeter-server
          - name: OIDC_ISSUER
            valueFrom:
              secretKeyRef:
                key: oidc_issuer
                name: telemeter-server
          - name: CLIENT_SECRET
            valueFrom:
              secretKeyRef:
                key: client_secret
                name: telemeter-server
          - name: CLIENT_ID
            valueFrom:
              secretKeyRef:
                key: client_id
                name: telemeter-server
          image: ${IMAGE_CANARY}:${IMAGE_CANARY_TAG}
          livenessProbe:
            httpGet:
              path: /healthz
              port: 8443
              scheme: HTTPS
          name: telemeter-server
          ports:
          - containerPort: 8443
            name: external
          - containerPort: 8081
            name: internal
          readinessProbe:
            httpGet:
              path: /healthz/ready
              port: 8443
              scheme: HTTPS
          resources:
            limits:
              cpu: ${TELEMETER_SERVER_CPU_LIMIT}
              memory: ${TELEMETER_SERVER_MEMORY_LIMIT}
            requests:
              cpu: ${TELEMETER_SERVER_CPU_REQUEST}
              memory: ${TELEMETER_SERVER_MEMORY_REQUEST}
          volumeMounts:
          - mountPath: /etc/pki/service
            name: telemeter-server-tls
            readOnly: false
        serviceAccountName: telemeter-server
        volumes:
        - name: secret-telemeter-server
          secret:
            secretName: telemeter-server
        - name: telemeter-server-tls
          secret:
            secretName: telemeter-server-shared
- apiVersion: v1
  kind: Service
  metadata:
    labels:
      app.kubernetes.io/name: memcached
    name: memcached
  spec:
    clusterIP: None
    ports:
    - name: client
      port: 11211
      targetPort: 11211
    - name: metrics
      port: 9150
      targetPort: 9150
    selector:
      app.kubernetes.io/component: telemeter-cache
      app.kubernetes.io/instance: telemeter
      app.kubernetes.io/name: memcached
      app.kubernetes.io/part-of: telemeter
- apiVersion: v1
  imagePullSecrets:
  - name: quay.io
  kind: ServiceAccount
  metadata:
    name: telemeter-memcached
- apiVersion: monitoring.coreos.com/v1
  kind: ServiceMonitor
  metadata:
    labels:
      app.kubernetes.io/name: memcached
      prometheus: app-sre
    name: memcached
  spec:
    endpoints:
    - interval: 30s
      port: metrics
    jobLabel: app.kubernetes.io/component
    namespaceSelector:
      matchNames:
      - ${NAMESPACE}
    selector:
      matchLabels:
        app.kubernetes.io/name: memcached
- apiVersion: apps/v1
  kind: StatefulSet
  metadata:
    labels:
      app.kubernetes.io/component: telemeter-cache
      app.kubernetes.io/instance: telemeter
      app.kubernetes.io/name: memcached
      app.kubernetes.io/part-of: telemeter
    name: memcached
  spec:
    replicas: 3
    selector:
      matchLabels:
        app.kubernetes.io/component: telemeter-cache
        app.kubernetes.io/instance: telemeter
        app.kubernetes.io/name: memcached
        app.kubernetes.io/part-of: telemeter
    serviceName: memcached
    template:
      metadata:
        labels:
          app.kubernetes.io/component: telemeter-cache
          app.kubernetes.io/instance: telemeter
          app.kubernetes.io/name: memcached
          app.kubernetes.io/part-of: telemeter
      spec:
        containers:
        - args:
          - -m 1024
          - -I 1m
          - -c 1024
          - -v
          image: ${MEMCACHED_IMAGE}:${MEMCACHED_IMAGE_TAG}
          name: memcached
          ports:
          - containerPort: 11211
            name: client
          resources:
            limits:
              cpu: ${MEMCACHED_CPU_LIMIT}
              memory: ${MEMCACHED_MEMORY_LIMIT}
            requests:
              cpu: ${MEMCACHED_CPU_REQUEST}
              memory: ${MEMCACHED_MEMORY_REQUEST}
        - args:
          - --memcached.address=localhost:11211
          - --web.listen-address=0.0.0.0:9150
          image: ${MEMCACHED_EXPORTER_IMAGE}:${MEMCACHED_EXPORTER_IMAGE_TAG}
          name: memcached-exporter
          ports:
          - containerPort: 9150
            name: metrics
          resources:
            limits:
              cpu: 200m
              memory: 200Mi
            requests:
              cpu: 50m
              memory: 50Mi
        serviceAccountName: telemeter-memcached
- apiVersion: v1
  data:
    nginx.conf: |
      daemon off;
      worker_processes 1;
      error_log /dev/stderr;
      pid /tmp/nginx.pid;

      events {
          worker_connections 1024;
      }

      http {
        log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
                          '$status $body_bytes_sent "$http_referer" '
                          '"$http_user_agent" "$http_x_forwarded_for"';

        server {
          listen *:8080;
          server_name _;
          access_log  /dev/stdout  main;
          error_log /dev/stderr;

          location / {
            proxy_set_header THANOS-TENANT FB870BF3-9F3A-44FF-9BF7-D7A047A52F43;
            proxy_pass http://${PROMETHEUS_AMS_REMOTE_WRITE_PROXY_TARGET}.${OBSERVATORIUM_METRICS_NAMESPACE}.svc.cluster.local:${PROMETHEUS_AMS_REMOTE_WRITE_PROXY_PORT};
          }
        }
      }
  kind: ConfigMap
  metadata:
    annotations:
      qontract.recycle: "true"
    labels:
      app.kubernetes.io/component: prometheus-ams
      app.kubernetes.io/instance: remote-write-proxy
      app.kubernetes.io/name: nginx
      app.kubernetes.io/part-of: prometheus-ams
    name: prometheus-remote-write-proxy-config
- apiVersion: apps/v1
  kind: Deployment
  metadata:
    labels:
      app.kubernetes.io/component: prometheus-ams
      app.kubernetes.io/instance: remote-write-proxy
      app.kubernetes.io/name: nginx
      app.kubernetes.io/part-of: prometheus-ams
    name: prometheus-remote-write-proxy
  spec:
    replicas: 1
    selector:
      matchLabels:
        app.kubernetes.io/instance: remote-write-proxy
        app.kubernetes.io/name: nginx
    template:
      metadata:
        labels:
          app.kubernetes.io/component: prometheus-ams
          app.kubernetes.io/instance: remote-write-proxy
          app.kubernetes.io/name: nginx
          app.kubernetes.io/part-of: prometheus-ams
      spec:
        containers:
        - args:
          - -c
          - /config/nginx.conf
          command:
          - nginx
          image: ${PROMETHEUS_AMS_REMOTE_WRITE_PROXY_IMAGE}:${PROMETHEUS_AMS_REMOTE_WRITE_PROXY_VERSION}
          name: remote-write-proxy
          ports:
          - containerPort: 8080
            name: http
          resources:
            limits:
              cpu: 100m
              memory: 64Mi
            requests:
              cpu: 50m
              memory: 16Mi
          volumeMounts:
          - mountPath: /config
            name: prometheus-remote-write-proxy-config
            readOnly: true
        volumes:
        - configMap:
            name: prometheus-remote-write-proxy-config
          name: prometheus-remote-write-proxy-config
- apiVersion: v1
  kind: Service
  metadata:
    labels:
      app.kubernetes.io/component: prometheus-ams
      app.kubernetes.io/instance: remote-write-proxy
      app.kubernetes.io/name: nginx
      app.kubernetes.io/part-of: prometheus-ams
    name: prometheus-ams-remote-write-proxy
  spec:
    ports:
    - name: http
      port: 8080
      targetPort: http
    selector:
      app.kubernetes.io/instance: remote-write-proxy
      app.kubernetes.io/name: nginx
- apiVersion: apps/v1
  kind: Deployment
  metadata:
    labels:
      app.kubernetes.io/instance: telemeter-token-refresher
      app.kubernetes.io/name: token-refresher
      app.kubernetes.io/version: ${TOKEN_REFRESHER_IMAGE_TAG}
    name: telemeter-token-refresher
  spec:
    selector:
      matchLabels:
        app.kubernetes.io/instance: telemeter-token-refresher
        app.kubernetes.io/name: token-refresher
    template:
      metadata:
        labels:
          app.kubernetes.io/instance: telemeter-token-refresher
          app.kubernetes.io/name: token-refresher
          app.kubernetes.io/version: ${TOKEN_REFRESHER_IMAGE_TAG}
      spec:
        containers:
        - args:
          - --log.level=${TOKEN_REFRESHER_LOG_LEVEL}
          - --log.format=logfmt
          - --web.listen=0.0.0.0:8080
          - --web.internal.listen=0.0.0.0:8081
          - --oidc.audience=$(OIDC_AUDIENCE)
          - --oidc.client-id=$(OIDC_CLIENT_ID)
          - --oidc.client-secret=$(OIDC_CLIENT_SECRET)
          - --oidc.issuer-url=$(OIDC_ISSUER_URL)
          - --url=http://observatorium-observatorium-api.${OBSERVATORIUM_NAMESPACE}.svc:8080/api/metrics/v1/telemeter
          env:
          - name: OIDC_AUDIENCE
            valueFrom:
              secretKeyRef:
                key: audience
                name: ${TOKEN_REFRESHER_SECRET_NAME}
          - name: OIDC_CLIENT_ID
            valueFrom:
              secretKeyRef:
                key: clientID
                name: ${TOKEN_REFRESHER_SECRET_NAME}
          - name: OIDC_CLIENT_SECRET
            valueFrom:
              secretKeyRef:
                key: clientSecret
                name: ${TOKEN_REFRESHER_SECRET_NAME}
          - name: OIDC_ISSUER_URL
            valueFrom:
              secretKeyRef:
                key: issuerURL
                name: ${TOKEN_REFRESHER_SECRET_NAME}
          image: quay.io/observatorium/token-refresher:${TOKEN_REFRESHER_IMAGE_TAG}
          name: token-refresher
          ports:
          - containerPort: 8081
            name: internal
          - containerPort: 8080
            name: web
        - args:
          - -provider=openshift
          - -https-address=:8443
          - -http-address=
          - -email-domain=*
          - -upstream=http://localhost:8080
          - -openshift-service-account=${SERVICE_ACCOUNT_NAME}
          - '-openshift-sar={"resource": "namespaces", "verb": "get", "name": "${NAMESPACE}", "namespace": "${NAMESPACE}"}'
          - '-openshift-delegate-urls={"/": {"resource": "namespaces", "verb": "get", "name": "${NAMESPACE}", "namespace": "${NAMESPACE}"}}'
          - -tls-cert=/etc/tls/private/tls.crt
          - -tls-key=/etc/tls/private/tls.key
          - -client-secret-file=/var/run/secrets/kubernetes.io/serviceaccount/token
          - -cookie-secret-file=/etc/proxy/secrets/session_secret
          - -openshift-ca=/etc/pki/tls/cert.pem
          - -openshift-ca=/var/run/secrets/kubernetes.io/serviceaccount/ca.crt
          image: ${OAUTH_PROXY_IMAGE}:${OAUTH_PROXY_IMAGE_TAG}
          name: oauth-proxy
          ports:
          - containerPort: 8443
            name: https
          resources:
            limits:
              cpu: ${OAUTH_PROXY_CPU_LIMITS}
              memory: ${OAUTH_PROXY_MEMORY_LIMITS}
            requests:
              cpu: ${OAUTH_PROXY_CPU_REQUEST}
              memory: ${OAUTH_PROXY_MEMORY_REQUEST}
          volumeMounts:
          - mountPath: /etc/tls/private
            name: token-refresher-tls
            readOnly: false
          - mountPath: /etc/proxy/secrets
            name: token-refresher-proxy
            readOnly: false
        serviceAccountName: ${SERVICE_ACCOUNT_NAME}
        volumes:
        - name: token-refresher-tls
          secret:
            secretName: token-refresher-tls
        - name: token-refresher-proxy
          secret:
            secretName: token-refresher-proxy
- apiVersion: v1
  data:
    session_secret: c2VjcmV0
  kind: Secret
  metadata:
    labels:
      app.kubernetes.io/instance: telemeter-token-refresher
      app.kubernetes.io/name: token-refresher
      app.kubernetes.io/version: ${TOKEN_REFRESHER_IMAGE_TAG}
    name: token-refresher-proxy
  type: Opaque
- apiVersion: v1
  kind: Service
  metadata:
    annotations:
      service.alpha.openshift.io/serving-cert-secret-name: token-refresher-tls
    labels:
      app.kubernetes.io/instance: telemeter-token-refresher
      app.kubernetes.io/name: token-refresher
      app.kubernetes.io/version: ${TOKEN_REFRESHER_IMAGE_TAG}
    name: telemeter-token-refresher
  spec:
    ports:
    - name: internal
      port: 8081
      protocol: TCP
      targetPort: 8081
    - name: web
      port: 8080
      protocol: TCP
      targetPort: 8080
    - name: https
      port: 8443
      targetPort: 8443
    selector:
      app.kubernetes.io/instance: telemeter-token-refresher
      app.kubernetes.io/name: token-refresher
    type: ClusterIP
- apiVersion: monitoring.coreos.com/v1
  kind: ServiceMonitor
  metadata:
    labels:
      app.kubernetes.io/instance: telemeter-token-refresher
      app.kubernetes.io/name: token-refresher
      app.kubernetes.io/version: ${TOKEN_REFRESHER_IMAGE_TAG}
    name: telemeter-token-refresher
  spec:
    endpoints:
    - port: internal
    namespaceSelector:
      matchNames:
      - ${NAMESPACE}
    selector:
      matchLabels:
        app.kubernetes.io/instance: telemeter-token-refresher
        app.kubernetes.io/name: token-refresher
parameters:
- name: NAMESPACE
  value: telemeter
- name: IMAGE_CANARY_TAG
  value: b4f226c
- name: IMAGE_CANARY
  value: quay.io/app-sre/telemeter
- name: IMAGE_TAG
  value: df72531
- name: IMAGE
  value: quay.io/app-sre/telemeter
- name: MEMCACHED_CPU_LIMIT
  value: "3"
- name: MEMCACHED_CPU_REQUEST
  value: 500m
- name: MEMCACHED_EXPORTER_CPU_LIMIT
  value: 200m
- name: MEMCACHED_EXPORTER_CPU_REQUEST
  value: 50m
- name: MEMCACHED_EXPORTER_IMAGE_TAG
  value: v0.6.0
- name: MEMCACHED_EXPORTER_IMAGE
  value: docker.io/prom/memcached-exporter
- name: MEMCACHED_EXPORTER_MEMORY_LIMIT
  value: 200Mi
- name: MEMCACHED_EXPORTER_MEMORY_REQUEST
  value: 50Mi
- name: MEMCACHED_IMAGE_TAG
  value: 1.6.13-alpine
- name: MEMCACHED_IMAGE
  value: docker.io/memcached
- name: MEMCACHED_MEMORY_LIMIT
  value: 1844Mi
- name: MEMCACHED_MEMORY_REQUEST
  value: 1329Mi
- name: OAUTH_PROXY_IMAGE
  value: quay.io/openshift/origin-oauth-proxy
- name: OAUTH_PROXY_IMAGE_TAG
  value: 4.7.0
- name: OAUTH_PROXY_CPU_REQUEST
  value: 100m
- name: OAUTH_PROXY_MEMORY_REQUEST
  value: 100Mi
- name: OAUTH_PROXY_CPU_LIMITS
  value: 200m
- name: OAUTH_PROXY_MEMORY_LIMITS
  value: 200Mi
- name: OBSERVATORIUM_NAMESPACE
  value: observatorium
- name: OBSERVATORIUM_METRICS_NAMESPACE
  value: observatorium-metrics
- name: PROMETHEUS_AMS_REMOTE_WRITE_PROXY_IMAGE
  value: quay.io/app-sre/observatorium-receive-proxy
- name: PROMETHEUS_AMS_REMOTE_WRITE_PROXY_TARGET
  value: observatorium-thanos-receive
- name: PROMETHEUS_AMS_REMOTE_WRITE_PROXY_PORT
  value: "19291"
- name: PROMETHEUS_AMS_REMOTE_WRITE_PROXY_VERSION
  value: 14e844d
- name: PROMETHEUS_IMAGE
  value: quay.io/prometheus/prometheus
- name: PROMETHEUS_VERSION
  value: v2.12.0
- name: REPLICAS_CANARY
  value: "0"
- name: REPLICAS
  value: "10"
- name: SERVICE_ACCOUNT_NAME
  value: prometheus-telemeter
- name: STORAGE_CLASS
  value: gp2
- name: TELEMETER_FORWARD_URL
  value: ""
- name: TELEMETER_LOG_LEVEL
  value: warn
- name: TELEMETER_SERVER_CPU_LIMIT
  value: "1"
- name: TELEMETER_SERVER_CPU_REQUEST
  value: 100m
- name: TELEMETER_SERVER_MEMORY_LIMIT
  value: 1Gi
- name: TELEMETER_SERVER_MEMORY_REQUEST
  value: 500Mi
- name: TELEMETER_SERVER_TOKEN_EXPIRE_SECONDS
  value: "3600"
- name: TOKEN_REFRESHER_IMAGE_TAG
  value: master-2021-03-05-b34376b
- name: TOKEN_REFRESHER_LOG_LEVEL
  value: info
- name: TOKEN_REFRESHER_SECRET_NAME
  value: token-refresher-oidc