feat(jsonnet): Add queryUrl support (#330)

Signed-off-by: adinhodovic <hodovicadin@gmail.com>

.bingo/.gitignore

@@ -0,0 +1,13 @@
+
+# Ignore everything
+*
+
+# But not these files:
+!.gitignore
+!*.mod
+!*.sum
+!README.md
+!Variables.mk
+!variables.env
+
+*tmp.mod

.bingo/README.md

@@ -0,0 +1,14 @@
+# Project Development Dependencies.
+
+This is directory which stores Go modules with pinned buildable package that is used within this repository, managed by https://github.com/bwplotka/bingo.
+
+* Run `bingo get` to install all tools having each own module file in this directory.
+* Run `bingo get <tool>` to install <tool> that have own module file in this directory.
+* For Makefile: Make sure to put `include .bingo/Variables.mk` in your Makefile, then use $(<upper case tool name>) variable where <tool> is the .bingo/<tool>.mod.
+* For shell: Run `source .bingo/variables.env` to source all environment variable for each tool.
+* For go: Import `.bingo/variables.go` to for variable names.
+* See https://github.com/bwplotka/bingo or -h on how to add, remove or change binaries dependencies.
+
+## Requirements
+
+* Go 1.14+

.bingo/Variables.mk

@@ -0,0 +1,61 @@
+# Auto generated binary variables helper managed by https://github.com/bwplotka/bingo v0.8. DO NOT EDIT.
+# All tools are designed to be build inside $GOBIN.
+BINGO_DIR := $(dir $(lastword $(MAKEFILE_LIST)))
+GOPATH ?= $(shell go env GOPATH)
+GOBIN  ?= $(firstword $(subst :, ,${GOPATH}))/bin
+GO     ?= $(shell which go)
+
+# Below generated variables ensure that every time a tool under each variable is invoked, the correct version
+# will be used; reinstalling only if needed.
+# For example for embedmd variable:
+#
+# In your main Makefile (for non array binaries):
+#
+#include .bingo/Variables.mk # Assuming -dir was set to .bingo .
+#
+#command: $(EMBEDMD)
+#	@echo "Running embedmd"
+#	@$(EMBEDMD) <flags/args..>
+#
+EMBEDMD := $(GOBIN)/embedmd-v1.0.0
+$(EMBEDMD): $(BINGO_DIR)/embedmd.mod
+	@# Install binary/ries using Go 1.14+ build command. This is using bwplotka/bingo-controlled, separate go module with pinned dependencies.
+	@echo "(re)installing $(GOBIN)/embedmd-v1.0.0"
+	@cd $(BINGO_DIR) && GOWORK=off $(GO) build -mod=mod -modfile=embedmd.mod -o=$(GOBIN)/embedmd-v1.0.0 "github.com/campoy/embedmd"
+
+GOJSONTOYAML := $(GOBIN)/gojsontoyaml-v0.0.0-20200602132005-3697ded27e8c
+$(GOJSONTOYAML): $(BINGO_DIR)/gojsontoyaml.mod
+	@# Install binary/ries using Go 1.14+ build command. This is using bwplotka/bingo-controlled, separate go module with pinned dependencies.
+	@echo "(re)installing $(GOBIN)/gojsontoyaml-v0.0.0-20200602132005-3697ded27e8c"
+	@cd $(BINGO_DIR) && GOWORK=off $(GO) build -mod=mod -modfile=gojsontoyaml.mod -o=$(GOBIN)/gojsontoyaml-v0.0.0-20200602132005-3697ded27e8c "github.com/brancz/gojsontoyaml"
+
+JB := $(GOBIN)/jb-v0.4.0
+$(JB): $(BINGO_DIR)/jb.mod
+	@# Install binary/ries using Go 1.14+ build command. This is using bwplotka/bingo-controlled, separate go module with pinned dependencies.
+	@echo "(re)installing $(GOBIN)/jb-v0.4.0"
+	@cd $(BINGO_DIR) && GOWORK=off $(GO) build -mod=mod -modfile=jb.mod -o=$(GOBIN)/jb-v0.4.0 "github.com/jsonnet-bundler/jsonnet-bundler/cmd/jb"
+
+JSONNET_LINT := $(GOBIN)/jsonnet-lint-v0.20.0
+$(JSONNET_LINT): $(BINGO_DIR)/jsonnet-lint.mod
+	@# Install binary/ries using Go 1.14+ build command. This is using bwplotka/bingo-controlled, separate go module with pinned dependencies.
+	@echo "(re)installing $(GOBIN)/jsonnet-lint-v0.20.0"
+	@cd $(BINGO_DIR) && GOWORK=off $(GO) build -mod=mod -modfile=jsonnet-lint.mod -o=$(GOBIN)/jsonnet-lint-v0.20.0 "github.com/google/go-jsonnet/cmd/jsonnet-lint"
+
+JSONNET := $(GOBIN)/jsonnet-v0.20.0
+$(JSONNET): $(BINGO_DIR)/jsonnet.mod
+	@# Install binary/ries using Go 1.14+ build command. This is using bwplotka/bingo-controlled, separate go module with pinned dependencies.
+	@echo "(re)installing $(GOBIN)/jsonnet-v0.20.0"
+	@cd $(BINGO_DIR) && GOWORK=off $(GO) build -mod=mod -modfile=jsonnet.mod -o=$(GOBIN)/jsonnet-v0.20.0 "github.com/google/go-jsonnet/cmd/jsonnet"
+
+JSONNETFMT := $(GOBIN)/jsonnetfmt-v0.20.0
+$(JSONNETFMT): $(BINGO_DIR)/jsonnetfmt.mod
+	@# Install binary/ries using Go 1.14+ build command. This is using bwplotka/bingo-controlled, separate go module with pinned dependencies.
+	@echo "(re)installing $(GOBIN)/jsonnetfmt-v0.20.0"
+	@cd $(BINGO_DIR) && GOWORK=off $(GO) build -mod=mod -modfile=jsonnetfmt.mod -o=$(GOBIN)/jsonnetfmt-v0.20.0 "github.com/google/go-jsonnet/cmd/jsonnetfmt"
+
+KUBECONFORM := $(GOBIN)/kubeconform-v0.6.3
+$(KUBECONFORM): $(BINGO_DIR)/kubeconform.mod
+	@# Install binary/ries using Go 1.14+ build command. This is using bwplotka/bingo-controlled, separate go module with pinned dependencies.
+	@echo "(re)installing $(GOBIN)/kubeconform-v0.6.3"
+	@cd $(BINGO_DIR) && GOWORK=off $(GO) build -mod=mod -modfile=kubeconform.mod -o=$(GOBIN)/kubeconform-v0.6.3 "github.com/yannh/kubeconform/cmd/kubeconform"
+

.bingo/embedmd.mod

@@ -0,0 +1,5 @@
+module _ // Auto generated by https://github.com/bwplotka/bingo. DO NOT EDIT
+
+go 1.15
+
+require github.com/campoy/embedmd v1.0.0

.bingo/embedmd.sum

@@ -0,0 +1,4 @@
+github.com/campoy/embedmd v1.0.0 h1:V4kI2qTJJLf4J29RzI/MAt2c3Bl4dQSYPuflzwFH2hY=
+github.com/campoy/embedmd v1.0.0/go.mod h1:oxyr9RCiSXg0M3VJ3ks0UGfp98BpSSGr0kpiX3MzVl8=
+github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
+github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=

.bingo/go.mod

@@ -0,0 +1 @@
+module _ // Fake go.mod auto-created by 'bingo' for go -moddir compatibility with non-Go projects. Commit this file, together with other .mod files.

.bingo/gojsontoyaml.mod

@@ -0,0 +1,5 @@
+module _ // Auto generated by https://github.com/bwplotka/bingo. DO NOT EDIT
+
+go 1.15
+
+require github.com/brancz/gojsontoyaml v0.0.0-20200602132005-3697ded27e8c

.bingo/gojsontoyaml.sum

@@ -0,0 +1,7 @@
+github.com/brancz/gojsontoyaml v0.0.0-20200602132005-3697ded27e8c h1:hb6WqfcKQZlNx/vahy51SaIvKnoXD5609Nm0PC4msEM=
+github.com/brancz/gojsontoyaml v0.0.0-20200602132005-3697ded27e8c/go.mod h1:+00lOjYXPgMfxHVPvg9GDtc3BX5Xh5aFpB4gMB8gfMo=
+github.com/ghodss/yaml v1.0.0 h1:wQHKEahhL6wmXdzwWG11gIVCkOv05bNOh+Rxn0yngAk=
+github.com/ghodss/yaml v1.0.0/go.mod h1:4dBDuWmgqj2HViK6kFavaiC9ZROes6MMH2rRYeMEF04=
+gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
+gopkg.in/yaml.v2 v2.3.0 h1:clyUAQHOM3G0M3f5vQj7LuJrETvjVot3Z5el9nffUtU=
+gopkg.in/yaml.v2 v2.3.0/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=

.bingo/jb.mod

@@ -0,0 +1,5 @@
+module _ // Auto generated by https://github.com/bwplotka/bingo. DO NOT EDIT
+
+go 1.15
+
+require github.com/jsonnet-bundler/jsonnet-bundler v0.4.0 // cmd/jb

.bingo/jb.sum

@@ -0,0 +1,24 @@
+github.com/alecthomas/template v0.0.0-20160405071501-a0175ee3bccc h1:cAKDfWh5VpdgMhJosfJnn5/FoN2SRZ4p7fJNX58YPaU=
+github.com/alecthomas/template v0.0.0-20160405071501-a0175ee3bccc/go.mod h1:LOuyumcjzFXgccqObfd/Ljyb9UuFJ6TxHnclSeseNhc=
+github.com/alecthomas/units v0.0.0-20151022065526-2efee857e7cf h1:qet1QNfXsQxTZqLG4oE62mJzwPIB8+Tee4RNCL9ulrY=
+github.com/alecthomas/units v0.0.0-20151022065526-2efee857e7cf/go.mod h1:ybxpYRFXyAe+OPACYpWeL0wqObRcbAqCMya13uyzqw0=
+github.com/campoy/embedmd v1.0.0/go.mod h1:oxyr9RCiSXg0M3VJ3ks0UGfp98BpSSGr0kpiX3MzVl8=
+github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/fatih/color v1.7.0 h1:DkWD4oS2D8LGGgTQ6IvwJJXSL5Vp2ffcQg58nFV38Ys=
+github.com/fatih/color v1.7.0/go.mod h1:Zm6kSWBoL9eyXnKyktHP6abPY2pDugNf5KwzbycvMj4=
+github.com/jsonnet-bundler/jsonnet-bundler v0.4.0 h1:4BKZ6LDqPc2wJDmaKnmYD/vDjUptJtnUpai802MibFc=
+github.com/jsonnet-bundler/jsonnet-bundler v0.4.0/go.mod h1:/by7P/OoohkI3q4CgSFqcoFsVY+IaNbzOVDknEsKDeU=
+github.com/mattn/go-colorable v0.0.9 h1:UVL0vNpWh04HeJXV0KLcaT7r06gOH2l4OW6ddYRUIY4=
+github.com/mattn/go-colorable v0.0.9/go.mod h1:9vuHe8Xs5qXnSaW/c/ABM9alt+Vo+STaOChaDxuIBZU=
+github.com/mattn/go-isatty v0.0.6 h1:SrwhHcpV4nWrMGdNcC2kXpMfcBVYGDuTArqyhocJgvA=
+github.com/mattn/go-isatty v0.0.6/go.mod h1:Iq45c/XA43vh69/j3iqttzPXn0bhXyGjM0Hdxcsrc5s=
+github.com/pkg/errors v0.8.0 h1:WdK/asTD0HN+q6hsWO3/vpuAkAr+tw6aNJNDFFf0+qw=
+github.com/pkg/errors v0.8.0/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
+github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
+github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
+github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
+golang.org/x/sys v0.0.0-20190222072716-a9d3bda3a223/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
+golang.org/x/sys v0.0.0-20190310054646-10058d7d4faa h1:lqti/xP+yD/6zH5TqEwx2MilNIJY5Vbc6Qr8J3qyPIQ=
+golang.org/x/sys v0.0.0-20190310054646-10058d7d4faa/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+gopkg.in/alecthomas/kingpin.v2 v2.2.6 h1:jMFz6MfLP0/4fUyZle81rXUoxOBFi19VUFKVDOQfozc=
+gopkg.in/alecthomas/kingpin.v2 v2.2.6/go.mod h1:FMv+mEhP44yOT+4EoQTLFTRgOQ1FBLkstjWtayDeSgw=

.bingo/jsonnet-lint.mod

@@ -0,0 +1,5 @@
+module _ // Auto generated by https://github.com/bwplotka/bingo. DO NOT EDIT
+
+go 1.15
+
+require github.com/google/go-jsonnet v0.20.0 // cmd/jsonnet-lint

.bingo/jsonnet-lint.sum

@@ -0,0 +1,41 @@
+github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/fatih/color v1.9.0/go.mod h1:eQcE1qtQxscV5RaZvpXrrb8Drkc3/DdQ+uUYCNjL+zU=
+github.com/fatih/color v1.10.0 h1:s36xzo75JdqLaaWoiEHk767eHiwo0598uUxyfiPkDsg=
+github.com/fatih/color v1.10.0/go.mod h1:ELkj/draVOlAH/xkhN6mQ50Qd0MPOk5AAr3maGEBuJM=
+github.com/fatih/color v1.12.0 h1:mRhaKNwANqRgUBGKmnI5ZxEk7QXmjQeCcuYFMX2bfcc=
+github.com/fatih/color v1.12.0/go.mod h1:ELkj/draVOlAH/xkhN6mQ50Qd0MPOk5AAr3maGEBuJM=
+github.com/google/go-jsonnet v0.17.1-0.20210101181740-31d71aaccda6 h1:91EupyycmO5ctzKuWEZ9nX0Cal1NveMiWcXxmRtLyLQ=
+github.com/google/go-jsonnet v0.17.1-0.20210101181740-31d71aaccda6/go.mod h1:sOcuej3UW1vpPTZOr8L7RQimqai1a57bt5j22LzGZCw=
+github.com/google/go-jsonnet v0.20.0 h1:WG4TTSARuV7bSm4PMB4ohjxe33IHT5WVTrJSU33uT4g=
+github.com/google/go-jsonnet v0.20.0/go.mod h1:VbgWF9JX7ztlv770x/TolZNGGFfiHEVx9G6ca2eUmeA=
+github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORNo=
+github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ=
+github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI=
+github.com/mattn/go-colorable v0.1.4/go.mod h1:U0ppj6V5qS13XJ6of8GYAs25YV2eR4EVcfRqFIhoBtE=
+github.com/mattn/go-colorable v0.1.8 h1:c1ghPdyEDarC70ftn0y+A/Ee++9zz8ljHG1b13eJ0s8=
+github.com/mattn/go-colorable v0.1.8/go.mod h1:u6P/XSegPjTcexA+o6vUJrdnUu04hMope9wVRipJSqc=
+github.com/mattn/go-isatty v0.0.8/go.mod h1:Iq45c/XA43vh69/j3iqttzPXn0bhXyGjM0Hdxcsrc5s=
+github.com/mattn/go-isatty v0.0.11/go.mod h1:PhnuNfih5lzO57/f3n+odYbM4JtupLOxQOAqxQCu2WE=
+github.com/mattn/go-isatty v0.0.12 h1:wuysRhFDzyxgEmMf5xjvJ2M9dZoWAXNNr5LSBS7uHXY=
+github.com/mattn/go-isatty v0.0.12/go.mod h1:cbi8OIDigv2wuxKPP5vlRcQ1OAZbq2CE4Kysco4FUpU=
+github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
+github.com/sergi/go-diff v1.1.0/go.mod h1:STckp+ISIX8hZLjrqAeVduY0gWCT9IjLuqbuNXdaHfM=
+github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
+github.com/stretchr/testify v1.4.0/go.mod h1:j7eGeouHqKxXV5pUuKE4zz7dFj8WfuZ+81PSLYec5m4=
+golang.org/x/sys v0.0.0-20190222072716-a9d3bda3a223/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
+golang.org/x/sys v0.0.0-20191026070338-33540a1f6037/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20200116001909-b77594299b42/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20200223170610-d5e6a3e2c0ae/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20210112091331-59c308dcf3cc h1:y0Og6AYdwus7SIAnKnDxjc4gJetRiYEWOx4AKbOeyEI=
+golang.org/x/sys v0.0.0-20210112091331-59c308dcf3cc/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.1.0 h1:kunALQeHf1/185U1i0GOB/fy1IPRDDpuoOOqRReG57U=
+golang.org/x/sys v0.1.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
+gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
+gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
+gopkg.in/yaml.v2 v2.2.4/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
+gopkg.in/yaml.v2 v2.2.7 h1:VUgggvou5XRW9mHwD/yXxIYSMtY0zoKQf/v226p2nyo=
+gopkg.in/yaml.v2 v2.2.7/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
+sigs.k8s.io/yaml v1.1.0 h1:4A07+ZFc2wgJwo8YNlQpr1rVlgUDlxXHhPJciaPY5gs=
+sigs.k8s.io/yaml v1.1.0/go.mod h1:UJmg0vDUVViEyp3mgSv9WPwZCDxu4rQW1olrI1uml+o=

.bingo/jsonnet.mod

@@ -0,0 +1,5 @@
+module _ // Auto generated by https://github.com/bwplotka/bingo. DO NOT EDIT
+
+go 1.15
+
+require github.com/google/go-jsonnet v0.20.0 // cmd/jsonnet

.bingo/jsonnet.sum

@@ -0,0 +1,41 @@
+github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/fatih/color v1.9.0/go.mod h1:eQcE1qtQxscV5RaZvpXrrb8Drkc3/DdQ+uUYCNjL+zU=
+github.com/fatih/color v1.10.0 h1:s36xzo75JdqLaaWoiEHk767eHiwo0598uUxyfiPkDsg=
+github.com/fatih/color v1.10.0/go.mod h1:ELkj/draVOlAH/xkhN6mQ50Qd0MPOk5AAr3maGEBuJM=
+github.com/fatih/color v1.12.0 h1:mRhaKNwANqRgUBGKmnI5ZxEk7QXmjQeCcuYFMX2bfcc=
+github.com/fatih/color v1.12.0/go.mod h1:ELkj/draVOlAH/xkhN6mQ50Qd0MPOk5AAr3maGEBuJM=
+github.com/google/go-jsonnet v0.17.1-0.20210101181740-31d71aaccda6 h1:91EupyycmO5ctzKuWEZ9nX0Cal1NveMiWcXxmRtLyLQ=
+github.com/google/go-jsonnet v0.17.1-0.20210101181740-31d71aaccda6/go.mod h1:sOcuej3UW1vpPTZOr8L7RQimqai1a57bt5j22LzGZCw=
+github.com/google/go-jsonnet v0.20.0 h1:WG4TTSARuV7bSm4PMB4ohjxe33IHT5WVTrJSU33uT4g=
+github.com/google/go-jsonnet v0.20.0/go.mod h1:VbgWF9JX7ztlv770x/TolZNGGFfiHEVx9G6ca2eUmeA=
+github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORNo=
+github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ=
+github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI=
+github.com/mattn/go-colorable v0.1.4/go.mod h1:U0ppj6V5qS13XJ6of8GYAs25YV2eR4EVcfRqFIhoBtE=
+github.com/mattn/go-colorable v0.1.8 h1:c1ghPdyEDarC70ftn0y+A/Ee++9zz8ljHG1b13eJ0s8=
+github.com/mattn/go-colorable v0.1.8/go.mod h1:u6P/XSegPjTcexA+o6vUJrdnUu04hMope9wVRipJSqc=
+github.com/mattn/go-isatty v0.0.8/go.mod h1:Iq45c/XA43vh69/j3iqttzPXn0bhXyGjM0Hdxcsrc5s=
+github.com/mattn/go-isatty v0.0.11/go.mod h1:PhnuNfih5lzO57/f3n+odYbM4JtupLOxQOAqxQCu2WE=
+github.com/mattn/go-isatty v0.0.12 h1:wuysRhFDzyxgEmMf5xjvJ2M9dZoWAXNNr5LSBS7uHXY=
+github.com/mattn/go-isatty v0.0.12/go.mod h1:cbi8OIDigv2wuxKPP5vlRcQ1OAZbq2CE4Kysco4FUpU=
+github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
+github.com/sergi/go-diff v1.1.0/go.mod h1:STckp+ISIX8hZLjrqAeVduY0gWCT9IjLuqbuNXdaHfM=
+github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
+github.com/stretchr/testify v1.4.0/go.mod h1:j7eGeouHqKxXV5pUuKE4zz7dFj8WfuZ+81PSLYec5m4=
+golang.org/x/sys v0.0.0-20190222072716-a9d3bda3a223/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
+golang.org/x/sys v0.0.0-20191026070338-33540a1f6037/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20200116001909-b77594299b42/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20200223170610-d5e6a3e2c0ae/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20210112091331-59c308dcf3cc h1:y0Og6AYdwus7SIAnKnDxjc4gJetRiYEWOx4AKbOeyEI=
+golang.org/x/sys v0.0.0-20210112091331-59c308dcf3cc/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.1.0 h1:kunALQeHf1/185U1i0GOB/fy1IPRDDpuoOOqRReG57U=
+golang.org/x/sys v0.1.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
+gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
+gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
+gopkg.in/yaml.v2 v2.2.4/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
+gopkg.in/yaml.v2 v2.2.7 h1:VUgggvou5XRW9mHwD/yXxIYSMtY0zoKQf/v226p2nyo=
+gopkg.in/yaml.v2 v2.2.7/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
+sigs.k8s.io/yaml v1.1.0 h1:4A07+ZFc2wgJwo8YNlQpr1rVlgUDlxXHhPJciaPY5gs=
+sigs.k8s.io/yaml v1.1.0/go.mod h1:UJmg0vDUVViEyp3mgSv9WPwZCDxu4rQW1olrI1uml+o=

.bingo/jsonnetfmt.mod

@@ -0,0 +1,5 @@
+module _ // Auto generated by https://github.com/bwplotka/bingo. DO NOT EDIT
+
+go 1.15
+
+require github.com/google/go-jsonnet v0.20.0 // cmd/jsonnetfmt

.bingo/jsonnetfmt.sum

@@ -0,0 +1,41 @@
+github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/fatih/color v1.9.0/go.mod h1:eQcE1qtQxscV5RaZvpXrrb8Drkc3/DdQ+uUYCNjL+zU=
+github.com/fatih/color v1.10.0 h1:s36xzo75JdqLaaWoiEHk767eHiwo0598uUxyfiPkDsg=
+github.com/fatih/color v1.10.0/go.mod h1:ELkj/draVOlAH/xkhN6mQ50Qd0MPOk5AAr3maGEBuJM=
+github.com/fatih/color v1.12.0 h1:mRhaKNwANqRgUBGKmnI5ZxEk7QXmjQeCcuYFMX2bfcc=
+github.com/fatih/color v1.12.0/go.mod h1:ELkj/draVOlAH/xkhN6mQ50Qd0MPOk5AAr3maGEBuJM=
+github.com/google/go-jsonnet v0.17.1-0.20210101181740-31d71aaccda6 h1:91EupyycmO5ctzKuWEZ9nX0Cal1NveMiWcXxmRtLyLQ=
+github.com/google/go-jsonnet v0.17.1-0.20210101181740-31d71aaccda6/go.mod h1:sOcuej3UW1vpPTZOr8L7RQimqai1a57bt5j22LzGZCw=
+github.com/google/go-jsonnet v0.20.0 h1:WG4TTSARuV7bSm4PMB4ohjxe33IHT5WVTrJSU33uT4g=
+github.com/google/go-jsonnet v0.20.0/go.mod h1:VbgWF9JX7ztlv770x/TolZNGGFfiHEVx9G6ca2eUmeA=
+github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORNo=
+github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ=
+github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI=
+github.com/mattn/go-colorable v0.1.4/go.mod h1:U0ppj6V5qS13XJ6of8GYAs25YV2eR4EVcfRqFIhoBtE=
+github.com/mattn/go-colorable v0.1.8 h1:c1ghPdyEDarC70ftn0y+A/Ee++9zz8ljHG1b13eJ0s8=
+github.com/mattn/go-colorable v0.1.8/go.mod h1:u6P/XSegPjTcexA+o6vUJrdnUu04hMope9wVRipJSqc=
+github.com/mattn/go-isatty v0.0.8/go.mod h1:Iq45c/XA43vh69/j3iqttzPXn0bhXyGjM0Hdxcsrc5s=
+github.com/mattn/go-isatty v0.0.11/go.mod h1:PhnuNfih5lzO57/f3n+odYbM4JtupLOxQOAqxQCu2WE=
+github.com/mattn/go-isatty v0.0.12 h1:wuysRhFDzyxgEmMf5xjvJ2M9dZoWAXNNr5LSBS7uHXY=
+github.com/mattn/go-isatty v0.0.12/go.mod h1:cbi8OIDigv2wuxKPP5vlRcQ1OAZbq2CE4Kysco4FUpU=
+github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
+github.com/sergi/go-diff v1.1.0/go.mod h1:STckp+ISIX8hZLjrqAeVduY0gWCT9IjLuqbuNXdaHfM=
+github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
+github.com/stretchr/testify v1.4.0/go.mod h1:j7eGeouHqKxXV5pUuKE4zz7dFj8WfuZ+81PSLYec5m4=
+golang.org/x/sys v0.0.0-20190222072716-a9d3bda3a223/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
+golang.org/x/sys v0.0.0-20191026070338-33540a1f6037/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20200116001909-b77594299b42/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20200223170610-d5e6a3e2c0ae/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20210112091331-59c308dcf3cc h1:y0Og6AYdwus7SIAnKnDxjc4gJetRiYEWOx4AKbOeyEI=
+golang.org/x/sys v0.0.0-20210112091331-59c308dcf3cc/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.1.0 h1:kunALQeHf1/185U1i0GOB/fy1IPRDDpuoOOqRReG57U=
+golang.org/x/sys v0.1.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
+gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
+gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
+gopkg.in/yaml.v2 v2.2.4/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
+gopkg.in/yaml.v2 v2.2.7 h1:VUgggvou5XRW9mHwD/yXxIYSMtY0zoKQf/v226p2nyo=
+gopkg.in/yaml.v2 v2.2.7/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
+sigs.k8s.io/yaml v1.1.0 h1:4A07+ZFc2wgJwo8YNlQpr1rVlgUDlxXHhPJciaPY5gs=
+sigs.k8s.io/yaml v1.1.0/go.mod h1:UJmg0vDUVViEyp3mgSv9WPwZCDxu4rQW1olrI1uml+o=

.bingo/kubeconform.mod

@@ -0,0 +1,5 @@
+module _ // Auto generated by https://github.com/bwplotka/bingo. DO NOT EDIT
+
+go 1.21
+
+require github.com/yannh/kubeconform v0.6.3 // cmd/kubeconform

.bingo/kubeconform.sum

@@ -0,0 +1,25 @@
+github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
+github.com/santhosh-tekuri/jsonschema/v5 v5.1.1 h1:lEOLY2vyGIqKWUI9nzsOJRV3mb3WC9dXYORsLEUcoeY=
+github.com/santhosh-tekuri/jsonschema/v5 v5.1.1/go.mod h1:FKdcjfQW6rpZSnxxUvEA5H/cDPdvJ/SZJQLWWXWGrZ0=
+github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
+github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
+github.com/xeipuuv/gojsonpointer v0.0.0-20180127040702-4e3ac2762d5f h1:J9EGpcZtP0E/raorCMxlFGSTBrsSlaDGf3jU/qvAE2c=
+github.com/xeipuuv/gojsonpointer v0.0.0-20180127040702-4e3ac2762d5f/go.mod h1:N2zxlSyiKSe5eX1tZViRH5QA0qijqEDrYZiPEAiq3wU=
+github.com/xeipuuv/gojsonreference v0.0.0-20180127040603-bd5ef7bd5415 h1:EzJWgHovont7NscjpAxXsDA8S8BMYve8Y5+7cuRE7R0=
+github.com/xeipuuv/gojsonreference v0.0.0-20180127040603-bd5ef7bd5415/go.mod h1:GwrjFmJcFw6At/Gs6z4yjiIwzuJ1/+UwLxMQDVQXShQ=
+github.com/xeipuuv/gojsonschema v1.2.0 h1:LhYJRs+L4fBtjZUfuSZIKGeVu0QRy8e5Xi7D17UxZ74=
+github.com/xeipuuv/gojsonschema v1.2.0/go.mod h1:anYRn/JVcOK2ZgGU+IjEV4nwlhoK5sQluxsYJ78Id3Y=
+github.com/yannh/kubeconform v0.4.4 h1:1+Wmd2QnZFaHd5hrNXWxwvPbE/pVTDNNWWXRaoN1Zbs=
+github.com/yannh/kubeconform v0.4.4/go.mod h1:Ysf3RSreh2rX8IJsVt/uT3Um/U3e3ykx6Fcz8nCdskM=
+github.com/yannh/kubeconform v0.6.3 h1:lNmb/kphyzitA+GBsOxjBsagCEpjLvt3+qo3XMiEOUA=
+github.com/yannh/kubeconform v0.6.3/go.mod h1:4E6oaL+lh7KgCG2SaOabeeAFBkyKu5D9ab0OEekGcbs=
+gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
+gopkg.in/yaml.v2 v2.2.8/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
+gopkg.in/yaml.v2 v2.3.0 h1:clyUAQHOM3G0M3f5vQj7LuJrETvjVot3Z5el9nffUtU=
+gopkg.in/yaml.v2 v2.3.0/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
+gopkg.in/yaml.v2 v2.4.0 h1:D8xgwECY7CYvx+Y2n4sBz93Jn9JRvxdiyyo8CTfuKaY=
+gopkg.in/yaml.v2 v2.4.0/go.mod h1:RDklbk79AGWmwhnvt/jBztapEOGDOx6ZbXqjP6csGnQ=
+sigs.k8s.io/yaml v1.2.0 h1:kr/MCeFWJWTwyaHoR9c8EjH9OumOmoF9YGiZd7lFm/Q=
+sigs.k8s.io/yaml v1.2.0/go.mod h1:yfXDCHCao9+ENCvLSE62v9VSji2MKu5jeNfTrofGhJc=

.bingo/kubeval.sum

@@ -0,0 +1,57 @@
+github.com/BurntSushi/toml v0.3.1/go.mod h1:xHWCNGjB5oqiDr8zfno3MHue2Ht5sIBksp03qcyfWMU=
+github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/fatih/color v1.7.0 h1:DkWD4oS2D8LGGgTQ6IvwJJXSL5Vp2ffcQg58nFV38Ys=
+github.com/fatih/color v1.7.0/go.mod h1:Zm6kSWBoL9eyXnKyktHP6abPY2pDugNf5KwzbycvMj4=
+github.com/fsnotify/fsnotify v1.4.7 h1:IXs+QLmnXW2CcXuY+8Mzv/fWEsPGWxqefPtCP5CnV9I=
+github.com/fsnotify/fsnotify v1.4.7/go.mod h1:jwhsz4b93w/PPRr/qN1Yymfu8t87LnFCMoQvtojpjFo=
+github.com/hashicorp/errwrap v0.0.0-20180715044906-d6c0cd880357 h1:Rem2+U35z1QtPQc6r+WolF7yXiefXqDKyk+lN2pE164=
+github.com/hashicorp/errwrap v0.0.0-20180715044906-d6c0cd880357/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
+github.com/hashicorp/go-multierror v0.0.0-20180717150148-3d5d8f294aa0 h1:j30noezaCfvNLcdMYSvHLv81DxYRSt1grlpseG67vhU=
+github.com/hashicorp/go-multierror v0.0.0-20180717150148-3d5d8f294aa0/go.mod h1:JMRHfdO9jKNzS/+BTlxCjKNQHg/jZAft8U7LloJvN7I=
+github.com/hashicorp/hcl v0.0.0-20180404174102-ef8a98b0bbce h1:xdsDDbiBDQTKASoGEZ+pEmF1OnWuu8AQ9I8iNbHNeno=
+github.com/hashicorp/hcl v0.0.0-20180404174102-ef8a98b0bbce/go.mod h1:oZtUIOe8dh44I2q6ScRibXws4Ajl+d+nod3AaR9vL5w=
+github.com/inconshreveable/mousetrap v1.0.0/go.mod h1:PxqpIevigyE2G7u3NXJIT2ANytuPF1OarO4DADm73n8=
+github.com/instrumenta/kubeval v0.0.0-20201005082916-38668c6c5b23 h1:M1Ms+wV9kd4g65MWhdyoMmaVIZj4U18t5bFRPs/zJUs=
+github.com/instrumenta/kubeval v0.0.0-20201005082916-38668c6c5b23/go.mod h1:cD+P/oZrBwOnaIHXrqvKPuN353KPxGomnsXSXf8pFJs=
+github.com/magiconair/properties v1.8.0 h1:LLgXmsheXeRoUOBOjtwPQCWIYqM/LU1ayDtDePerRcY=
+github.com/magiconair/properties v1.8.0/go.mod h1:PppfXfuXeibc/6YijjN8zIbojt8czPbwD3XqdrwzmxQ=
+github.com/mattn/go-colorable v0.1.0 h1:v2XXALHHh6zHfYTJ+cSkwtyffnaOyR1MXaA91mTrb8o=
+github.com/mattn/go-colorable v0.1.0/go.mod h1:9vuHe8Xs5qXnSaW/c/ABM9alt+Vo+STaOChaDxuIBZU=
+github.com/mattn/go-isatty v0.0.4 h1:bnP0vzxcAdeI1zdubAl5PjU6zsERjGZb7raWodagDYs=
+github.com/mattn/go-isatty v0.0.4/go.mod h1:M+lRXTBqGeGNdLjl/ufCoiOlB5xdOkqRJdNxMWT7Zi4=
+github.com/mitchellh/mapstructure v0.0.0-20180715050151-f15292f7a699 h1:KXZJFdun9knAVAR8tg/aHJEr5DgtcbqyvzacK+CDCaI=
+github.com/mitchellh/mapstructure v0.0.0-20180715050151-f15292f7a699/go.mod h1:FVVH3fgwuzCH5S8UJGiWEs2h04kUh9fWfEaFds41c1Y=
+github.com/pelletier/go-toml v0.0.0-20180724185102-c2dbbc24a979 h1:Uh8pTMDzw+nuDTW7lyxcpmYqQJFE8SnO93F3lyY4XzY=
+github.com/pelletier/go-toml v0.0.0-20180724185102-c2dbbc24a979/go.mod h1:5z9KED0ma1S8pY6P1sdut58dfprrGBbd/94hg7ilaic=
+github.com/pkg/errors v0.8.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
+github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
+github.com/spf13/afero v1.1.1 h1:Lt3ihYMlE+lreX1GS4Qw4ZsNpYQLxIXKBTEOXm3nt6I=
+github.com/spf13/afero v1.1.1/go.mod h1:j4pytiNVoe2o6bmDsKpLACNPDBIoEAkihy7loJ1B0CQ=
+github.com/spf13/cast v1.2.0 h1:HHl1DSRbEQN2i8tJmtS6ViPyHx35+p51amrdsiTCrkg=
+github.com/spf13/cast v1.2.0/go.mod h1:r2rcYCSwa1IExKTDiTfzaxqT2FNHs8hODu4LnUfgKEg=
+github.com/spf13/cobra v0.0.0-20180820174524-ff0d02e85550 h1:LB9SHuuXO8gnsHtexOQSpsJrrAHYA35lvHUaE74kznU=
+github.com/spf13/cobra v0.0.0-20180820174524-ff0d02e85550/go.mod h1:1l0Ry5zgKvJasoi3XT1TypsSe7PqH0Sj9dhYf7v3XqQ=
+github.com/spf13/jwalterweatherman v0.0.0-20180814060501-14d3d4c51834 h1:kJI9pPzfsULT/72wy7mxkRQZPtKWgFdCA2RTGZ4v8/E=
+github.com/spf13/jwalterweatherman v0.0.0-20180814060501-14d3d4c51834/go.mod h1:cQK4TGJAtQXfYWX+Ddv3mKDzgVb68N+wFjFa4jdeBTo=
+github.com/spf13/pflag v0.0.0-20180821114517-d929dcbb1086 h1:iU+nPfqRqK8ShQqnpZLv8cZ9oklo6NFUcmX1JT5Rudg=
+github.com/spf13/pflag v0.0.0-20180821114517-d929dcbb1086/go.mod h1:DYY7MBk1bdzusC3SYhjObp+wFpr4gzcvqqNjLnInEg4=
+github.com/spf13/viper v1.1.0 h1:V7OZpY8i3C1x/pDmU0zNNlfVoDz112fSYvtWMjjS3f4=
+github.com/spf13/viper v1.1.0/go.mod h1:A8kyI5cUJhb8N+3pkfONlcEcZbueH6nhAm0Fq7SrnBM=
+github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
+github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
+github.com/xeipuuv/gojsonpointer v0.0.0-20180127040702-4e3ac2762d5f h1:J9EGpcZtP0E/raorCMxlFGSTBrsSlaDGf3jU/qvAE2c=
+github.com/xeipuuv/gojsonpointer v0.0.0-20180127040702-4e3ac2762d5f/go.mod h1:N2zxlSyiKSe5eX1tZViRH5QA0qijqEDrYZiPEAiq3wU=
+github.com/xeipuuv/gojsonreference v0.0.0-20180127040603-bd5ef7bd5415 h1:EzJWgHovont7NscjpAxXsDA8S8BMYve8Y5+7cuRE7R0=
+github.com/xeipuuv/gojsonreference v0.0.0-20180127040603-bd5ef7bd5415/go.mod h1:GwrjFmJcFw6At/Gs6z4yjiIwzuJ1/+UwLxMQDVQXShQ=
+github.com/xeipuuv/gojsonschema v0.0.0-20180816142147-da425ebb7609 h1:BcMExZAULPkihVZ7UJXK7t8rwGqisXFw75tILnafhBY=
+github.com/xeipuuv/gojsonschema v0.0.0-20180816142147-da425ebb7609/go.mod h1:5yf86TLmAcydyeJq5YvxkGPE2fm/u4myDekKRoLuqhs=
+golang.org/x/sys v0.0.0-20180821044426-4ea2f632f6e9 h1:0RHCP7KEw0rDuVXXaT2gfV77uu6lTKa5aItB+EoFbQk=
+golang.org/x/sys v0.0.0-20180821044426-4ea2f632f6e9/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
+golang.org/x/text v0.0.0-20180810153555-6e3c4e7365dd h1:e/dojZNNKqwK3xq7UQTKTQJim18r/FxvQk7PFXULeZg=
+golang.org/x/text v0.0.0-20180810153555-6e3c4e7365dd/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
+gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
+gopkg.in/yaml.v2 v2.2.1 h1:mUhvW9EsL+naU5Q3cakzfE91YhliOondGd6ZrsDBHQE=
+gopkg.in/yaml.v2 v2.2.1/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
+sigs.k8s.io/yaml v1.1.0 h1:4A07+ZFc2wgJwo8YNlQpr1rVlgUDlxXHhPJciaPY5gs=
+sigs.k8s.io/yaml v1.1.0/go.mod h1:UJmg0vDUVViEyp3mgSv9WPwZCDxu4rQW1olrI1uml+o=

.bingo/variables.env

@@ -0,0 +1,24 @@
+# Auto generated binary variables helper managed by https://github.com/bwplotka/bingo v0.8. DO NOT EDIT.
+# All tools are designed to be build inside $GOBIN.
+# Those variables will work only until 'bingo get' was invoked, or if tools were installed via Makefile's Variables.mk.
+GOBIN=${GOBIN:=$(go env GOBIN)}
+
+if [ -z "$GOBIN" ]; then
+	GOBIN="$(go env GOPATH)/bin"
+fi
+
+
+EMBEDMD="${GOBIN}/embedmd-v1.0.0"
+
+GOJSONTOYAML="${GOBIN}/gojsontoyaml-v0.0.0-20200602132005-3697ded27e8c"
+
+JB="${GOBIN}/jb-v0.4.0"
+
+JSONNET_LINT="${GOBIN}/jsonnet-lint-v0.20.0"
+
+JSONNET="${GOBIN}/jsonnet-v0.20.0"
+
+JSONNETFMT="${GOBIN}/jsonnetfmt-v0.20.0"
+
+KUBECONFORM="${GOBIN}/kubeconform-v0.4.4"
+

.circleci/config.yml

@@ -1,14 +0,0 @@
-jobs:
-  build:
-    working_directory: /go/src/github.com/{{ORG_NAME}}/{{REPO_NAME}}
-    docker:
-      - image: quay.io/coreos/jsonnet-ci
-    steps:
-      - checkout
-      - run: make --always-make vendor generate
-      - run: git diff --exit-code
-workflows:
-  version: 2
-  build_and_test:
-    jobs:
-      - build

.crdschemas/servicemonitor-monitoring-v1.json

@@ -0,0 +1,500 @@
+{
+  "description": "ServiceMonitor defines monitoring for a set of services.",
+  "properties": {
+    "apiVersion": {
+      "description": "APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources",
+      "type": "string"
+    },
+    "kind": {
+      "description": "Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
+      "type": "string"
+    },
+    "metadata": {
+      "type": "object"
+    },
+    "spec": {
+      "description": "Specification of desired Service selection for target discovery by Prometheus.",
+      "properties": {
+        "endpoints": {
+          "description": "A list of endpoints allowed as part of this ServiceMonitor.",
+          "items": {
+            "description": "Endpoint defines a scrapeable endpoint serving Prometheus metrics.",
+            "properties": {
+              "basicAuth": {
+                "description": "BasicAuth allow an endpoint to authenticate over basic authentication More info: https://prometheus.io/docs/operating/configuration/#endpoints",
+                "properties": {
+                  "password": {
+                    "description": "The secret in the service monitor namespace that contains the password for authentication.",
+                    "properties": {
+                      "key": {
+                        "description": "The key of the secret to select from.  Must be a valid secret key.",
+                        "type": "string"
+                      },
+                      "name": {
+                        "description": "Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names TODO: Add other useful fields. apiVersion, kind, uid?",
+                        "type": "string"
+                      },
+                      "optional": {
+                        "description": "Specify whether the Secret or its key must be defined",
+                        "type": "boolean"
+                      }
+                    },
+                    "required": [
+                      "key"
+                    ],
+                    "type": "object",
+                    "additionalProperties": false
+                  },
+                  "username": {
+                    "description": "The secret in the service monitor namespace that contains the username for authentication.",
+                    "properties": {
+                      "key": {
+                        "description": "The key of the secret to select from.  Must be a valid secret key.",
+                        "type": "string"
+                      },
+                      "name": {
+                        "description": "Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names TODO: Add other useful fields. apiVersion, kind, uid?",
+                        "type": "string"
+                      },
+                      "optional": {
+                        "description": "Specify whether the Secret or its key must be defined",
+                        "type": "boolean"
+                      }
+                    },
+                    "required": [
+                      "key"
+                    ],
+                    "type": "object",
+                    "additionalProperties": false
+                  }
+                },
+                "type": "object",
+                "additionalProperties": false
+              },
+              "bearerTokenFile": {
+                "description": "File to read bearer token for scraping targets.",
+                "type": "string"
+              },
+              "bearerTokenSecret": {
+                "description": "Secret to mount to read bearer token for scraping targets. The secret needs to be in the same namespace as the service monitor and accessible by the Prometheus Operator.",
+                "properties": {
+                  "key": {
+                    "description": "The key of the secret to select from.  Must be a valid secret key.",
+                    "type": "string"
+                  },
+                  "name": {
+                    "description": "Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names TODO: Add other useful fields. apiVersion, kind, uid?",
+                    "type": "string"
+                  },
+                  "optional": {
+                    "description": "Specify whether the Secret or its key must be defined",
+                    "type": "boolean"
+                  }
+                },
+                "required": [
+                  "key"
+                ],
+                "type": "object",
+                "additionalProperties": false
+              },
+              "honorLabels": {
+                "description": "HonorLabels chooses the metric's labels on collisions with target labels.",
+                "type": "boolean"
+              },
+              "honorTimestamps": {
+                "description": "HonorTimestamps controls whether Prometheus respects the timestamps present in scraped data.",
+                "type": "boolean"
+              },
+              "interval": {
+                "description": "Interval at which metrics should be scraped",
+                "type": "string"
+              },
+              "metricRelabelings": {
+                "description": "MetricRelabelConfigs to apply to samples before ingestion.",
+                "items": {
+                  "description": "RelabelConfig allows dynamic rewriting of the label set, being applied to samples before ingestion. It defines `<metric_relabel_configs>`-section of Prometheus configuration. More info: https://prometheus.io/docs/prometheus/latest/configuration/configuration/#metric_relabel_configs",
+                  "properties": {
+                    "action": {
+                      "description": "Action to perform based on regex matching. Default is 'replace'",
+                      "type": "string"
+                    },
+                    "modulus": {
+                      "description": "Modulus to take of the hash of the source label values.",
+                      "format": "int64",
+                      "type": "integer"
+                    },
+                    "regex": {
+                      "description": "Regular expression against which the extracted value is matched. Default is '(.*)'",
+                      "type": "string"
+                    },
+                    "replacement": {
+                      "description": "Replacement value against which a regex replace is performed if the regular expression matches. Regex capture groups are available. Default is '$1'",
+                      "type": "string"
+                    },
+                    "separator": {
+                      "description": "Separator placed between concatenated source label values. default is ';'.",
+                      "type": "string"
+                    },
+                    "sourceLabels": {
+                      "description": "The source labels select values from existing labels. Their content is concatenated using the configured separator and matched against the configured regular expression for the replace, keep, and drop actions.",
+                      "items": {
+                        "type": "string"
+                      },
+                      "type": "array"
+                    },
+                    "targetLabel": {
+                      "description": "Label to which the resulting value is written in a replace action. It is mandatory for replace actions. Regex capture groups are available.",
+                      "type": "string"
+                    }
+                  },
+                  "type": "object",
+                  "additionalProperties": false
+                },
+                "type": "array"
+              },
+              "params": {
+                "additionalProperties": {
+                  "items": {
+                    "type": "string"
+                  },
+                  "type": "array"
+                },
+                "description": "Optional HTTP URL parameters",
+                "type": "object"
+              },
+              "path": {
+                "description": "HTTP path to scrape for metrics.",
+                "type": "string"
+              },
+              "port": {
+                "description": "Name of the service port this endpoint refers to. Mutually exclusive with targetPort.",
+                "type": "string"
+              },
+              "proxyUrl": {
+                "description": "ProxyURL eg http://proxyserver:2195 Directs scrapes to proxy through this endpoint.",
+                "type": "string"
+              },
+              "relabelings": {
+                "description": "RelabelConfigs to apply to samples before scraping. More info: https://prometheus.io/docs/prometheus/latest/configuration/configuration/#relabel_config",
+                "items": {
+                  "description": "RelabelConfig allows dynamic rewriting of the label set, being applied to samples before ingestion. It defines `<metric_relabel_configs>`-section of Prometheus configuration. More info: https://prometheus.io/docs/prometheus/latest/configuration/configuration/#metric_relabel_configs",
+                  "properties": {
+                    "action": {
+                      "description": "Action to perform based on regex matching. Default is 'replace'",
+                      "type": "string"
+                    },
+                    "modulus": {
+                      "description": "Modulus to take of the hash of the source label values.",
+                      "format": "int64",
+                      "type": "integer"
+                    },
+                    "regex": {
+                      "description": "Regular expression against which the extracted value is matched. Default is '(.*)'",
+                      "type": "string"
+                    },
+                    "replacement": {
+                      "description": "Replacement value against which a regex replace is performed if the regular expression matches. Regex capture groups are available. Default is '$1'",
+                      "type": "string"
+                    },
+                    "separator": {
+                      "description": "Separator placed between concatenated source label values. default is ';'.",
+                      "type": "string"
+                    },
+                    "sourceLabels": {
+                      "description": "The source labels select values from existing labels. Their content is concatenated using the configured separator and matched against the configured regular expression for the replace, keep, and drop actions.",
+                      "items": {
+                        "type": "string"
+                      },
+                      "type": "array"
+                    },
+                    "targetLabel": {
+                      "description": "Label to which the resulting value is written in a replace action. It is mandatory for replace actions. Regex capture groups are available.",
+                      "type": "string"
+                    }
+                  },
+                  "type": "object",
+                  "additionalProperties": false
+                },
+                "type": "array"
+              },
+              "scheme": {
+                "description": "HTTP scheme to use for scraping.",
+                "type": "string"
+              },
+              "scrapeTimeout": {
+                "description": "Timeout after which the scrape is ended",
+                "type": "string"
+              },
+              "targetPort": {
+                "anyOf": [
+                  {
+                    "type": "integer"
+                  },
+                  {
+                    "type": "string"
+                  }
+                ],
+                "description": "Name or number of the target port of the Pod behind the Service, the port must be specified with container port property. Mutually exclusive with port.",
+                "x-kubernetes-int-or-string": true
+              },
+              "tlsConfig": {
+                "description": "TLS configuration to use when scraping the endpoint",
+                "properties": {
+                  "ca": {
+                    "description": "Struct containing the CA cert to use for the targets.",
+                    "properties": {
+                      "configMap": {
+                        "description": "ConfigMap containing data to use for the targets.",
+                        "properties": {
+                          "key": {
+                            "description": "The key to select.",
+                            "type": "string"
+                          },
+                          "name": {
+                            "description": "Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names TODO: Add other useful fields. apiVersion, kind, uid?",
+                            "type": "string"
+                          },
+                          "optional": {
+                            "description": "Specify whether the ConfigMap or its key must be defined",
+                            "type": "boolean"
+                          }
+                        },
+                        "required": [
+                          "key"
+                        ],
+                        "type": "object",
+                        "additionalProperties": false
+                      },
+                      "secret": {
+                        "description": "Secret containing data to use for the targets.",
+                        "properties": {
+                          "key": {
+                            "description": "The key of the secret to select from.  Must be a valid secret key.",
+                            "type": "string"
+                          },
+                          "name": {
+                            "description": "Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names TODO: Add other useful fields. apiVersion, kind, uid?",
+                            "type": "string"
+                          },
+                          "optional": {
+                            "description": "Specify whether the Secret or its key must be defined",
+                            "type": "boolean"
+                          }
+                        },
+                        "required": [
+                          "key"
+                        ],
+                        "type": "object",
+                        "additionalProperties": false
+                      }
+                    },
+                    "type": "object",
+                    "additionalProperties": false
+                  },
+                  "caFile": {
+                    "description": "Path to the CA cert in the Prometheus container to use for the targets.",
+                    "type": "string"
+                  },
+                  "cert": {
+                    "description": "Struct containing the client cert file for the targets.",
+                    "properties": {
+                      "configMap": {
+                        "description": "ConfigMap containing data to use for the targets.",
+                        "properties": {
+                          "key": {
+                            "description": "The key to select.",
+                            "type": "string"
+                          },
+                          "name": {
+                            "description": "Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names TODO: Add other useful fields. apiVersion, kind, uid?",
+                            "type": "string"
+                          },
+                          "optional": {
+                            "description": "Specify whether the ConfigMap or its key must be defined",
+                            "type": "boolean"
+                          }
+                        },
+                        "required": [
+                          "key"
+                        ],
+                        "type": "object",
+                        "additionalProperties": false
+                      },
+                      "secret": {
+                        "description": "Secret containing data to use for the targets.",
+                        "properties": {
+                          "key": {
+                            "description": "The key of the secret to select from.  Must be a valid secret key.",
+                            "type": "string"
+                          },
+                          "name": {
+                            "description": "Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names TODO: Add other useful fields. apiVersion, kind, uid?",
+                            "type": "string"
+                          },
+                          "optional": {
+                            "description": "Specify whether the Secret or its key must be defined",
+                            "type": "boolean"
+                          }
+                        },
+                        "required": [
+                          "key"
+                        ],
+                        "type": "object",
+                        "additionalProperties": false
+                      }
+                    },
+                    "type": "object",
+                    "additionalProperties": false
+                  },
+                  "certFile": {
+                    "description": "Path to the client cert file in the Prometheus container for the targets.",
+                    "type": "string"
+                  },
+                  "insecureSkipVerify": {
+                    "description": "Disable target certificate validation.",
+                    "type": "boolean"
+                  },
+                  "keyFile": {
+                    "description": "Path to the client key file in the Prometheus container for the targets.",
+                    "type": "string"
+                  },
+                  "keySecret": {
+                    "description": "Secret containing the client key file for the targets.",
+                    "properties": {
+                      "key": {
+                        "description": "The key of the secret to select from.  Must be a valid secret key.",
+                        "type": "string"
+                      },
+                      "name": {
+                        "description": "Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names TODO: Add other useful fields. apiVersion, kind, uid?",
+                        "type": "string"
+                      },
+                      "optional": {
+                        "description": "Specify whether the Secret or its key must be defined",
+                        "type": "boolean"
+                      }
+                    },
+                    "required": [
+                      "key"
+                    ],
+                    "type": "object",
+                    "additionalProperties": false
+                  },
+                  "serverName": {
+                    "description": "Used to verify the hostname for the targets.",
+                    "type": "string"
+                  }
+                },
+                "type": "object",
+                "additionalProperties": false
+              }
+            },
+            "type": "object",
+            "additionalProperties": false
+          },
+          "type": "array"
+        },
+        "jobLabel": {
+          "description": "The label to use to retrieve the job name from.",
+          "type": "string"
+        },
+        "namespaceSelector": {
+          "description": "Selector to select which namespaces the Endpoints objects are discovered from.",
+          "properties": {
+            "any": {
+              "description": "Boolean describing whether all namespaces are selected in contrast to a list restricting them.",
+              "type": "boolean"
+            },
+            "matchNames": {
+              "description": "List of namespace names.",
+              "items": {
+                "type": "string"
+              },
+              "type": "array"
+            }
+          },
+          "type": "object",
+          "additionalProperties": false
+        },
+        "podTargetLabels": {
+          "description": "PodTargetLabels transfers labels on the Kubernetes Pod onto the target.",
+          "items": {
+            "type": "string"
+          },
+          "type": "array"
+        },
+        "sampleLimit": {
+          "description": "SampleLimit defines per-scrape limit on number of scraped samples that will be accepted.",
+          "format": "int64",
+          "type": "integer"
+        },
+        "selector": {
+          "description": "Selector to select Endpoints objects.",
+          "properties": {
+            "matchExpressions": {
+              "description": "matchExpressions is a list of label selector requirements. The requirements are ANDed.",
+              "items": {
+                "description": "A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values.",
+                "properties": {
+                  "key": {
+                    "description": "key is the label key that the selector applies to.",
+                    "type": "string"
+                  },
+                  "operator": {
+                    "description": "operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.",
+                    "type": "string"
+                  },
+                  "values": {
+                    "description": "values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.",
+                    "items": {
+                      "type": "string"
+                    },
+                    "type": "array"
+                  }
+                },
+                "required": [
+                  "key",
+                  "operator"
+                ],
+                "type": "object",
+                "additionalProperties": false
+              },
+              "type": "array"
+            },
+            "matchLabels": {
+              "additionalProperties": {
+                "type": "string"
+              },
+              "description": "matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is \"key\", the operator is \"In\", and the values array contains only \"value\". The requirements are ANDed.",
+              "type": "object"
+            }
+          },
+          "type": "object",
+          "additionalProperties": false
+        },
+        "targetLabels": {
+          "description": "TargetLabels transfers labels on the Kubernetes Service onto the target.",
+          "items": {
+            "type": "string"
+          },
+          "type": "array"
+        },
+        "targetLimit": {
+          "description": "TargetLimit defines a limit on the number of scraped targets that will be accepted.",
+          "format": "int64",
+          "type": "integer"
+        }
+      },
+      "required": [
+        "endpoints",
+        "selector"
+      ],
+      "type": "object",
+      "additionalProperties": false
+    }
+  },
+  "required": [
+    "spec"
+  ],
+  "type": "object"
+}

.github/workflows/ci.yml

@@ -0,0 +1,38 @@
+name: CI
+
+on:
+  push:
+    branches: [ main ]
+  pull_request:
+    branches: [ main ]
+  workflow_dispatch:
+
+jobs:
+  lint:
+    runs-on: ubuntu-latest
+    steps:
+    - uses: actions/checkout@v2
+    - name: Set up Go
+      uses: actions/setup-go@v2
+      with:
+        go-version: 1.17
+    - name: Vendor
+      run: make vendor
+    - name: Vendor Diff
+      run: git diff --exit-code
+    - name: Format
+      run: make --always-make fmt lint
+    - name: Format Diff
+      run: git diff --exit-code
+  build:
+    runs-on: ubuntu-latest
+    steps:
+    - uses: actions/checkout@v2
+    - name: Set up Go
+      uses: actions/setup-go@v2
+      with:
+        go-version: 1.17
+    - name: Generate
+      run: make --always-make vendor generate validate
+    - name: Generate Diff
+      run: git diff --exit-code

.gitignore

@@ -1,2 +1,4 @@
 tmp
 vendor/
+jsonnet/kube-thanos/jsonnetfile.lock.json
+.idea/

CHANGELOG.md

@@ -7,29 +7,225 @@ and this project adheres to [Semantic Versioning](http://semver.org/spec/v2.0.0.
 
 NOTE: As semantic versioning states all 0.y.z releases can contain breaking changes.
 
-> kube-thanos' major versions are in sync with upstream Thos project.
+> kube-thanos' major and minor versions are in sync with upstream Thanos project.
 
 We use *breaking* word for marking changes that are not backward compatible (relates only to v0.y.z releases.)
 
 ## Unreleased
 
+### Breaking Changes
+
 ### Changed
 
--
+- [#279](https://github.com/thanos-io/kube-thanos/pull/279) Change `hashringConfigmapName` to `hashringConfigMapName` in Receive configuration.
+- [#284](https://github.com/thanos-io/kube-thanos/pull/284) Change Receive `PodDisruptionBudget` api version to `policy/v1`
+- [#293](https://github.com/thanos-io/kube-thanos/pull/293) Upgrade to Thanos v0.30.2
+
+### Added
+
+- [#263](https://github.com/thanos-io/kube-thanos/pull/263) Add support for stateless Rulers.
+- [#271](https://github.com/thanos-io/kube-thanos/pull/271) Add annotation support for ServiceAccount.
+- [#286](https://github.com/thanos-io/kube-thanos/pull/286) Store: make the liveness probe timeout configurable.
+- [#292](https://github.com/thanos-io/kube-thanos/pull/292) Store: allow configuration of series, series sample, and downloaded bytes limits.
+- [#299](https://github.com/thanos-io/kube-thanos/pull/299) Query: allow configuration of telemetry.request options
+- [#301](https://github.com/thanos-io/kube-thanos/pull/301) Receive: allow configuration of `minReadySeconds` for StatefulSet
+- [#305](https://github.com/thanos-io/kube-thanos/pull/305) Receive: allow configuration of limits-config-file
+- [#308](https://github.com/thanos-io/kube-thanos/pull/308) Recive: add store limits flags
+- [#310](https://github.com/thanos-io/kube-thanos/pull/310) Ruler: Add host anti-affinity to ruler
+- [#313](https://github.com/thanos-io/kube-thanos/pull/313) Add per-container SecurityContext
+- [#330](https://github.com/thanos-io/kube-thanos/pull/330) Query: Add query url support to jsonnet library
+
+### Fixed
+
+- [#298](https://github.com/thanos-io/kube-thanos/pull/298) Use `kubernetes.io/os` instead of `beta.kubernetes.io/os` which has been deprecated since Kubernetes v1.14.
+
+
+## [v0.27.0](https://github.com/thanos-io/kube-thanos/tree/v0.27.0) (2022-07-07)
+- (no changes from `v0.26.0`)
+
+## [v0.26.0](https://github.com/thanos-io/kube-thanos/tree/v0.26.0) (2022-06-13)
+
+### Added
+
+- [#263](https://github.com/thanos-io/kube-thanos/pull/263) Add support for stateless Rulers.
+
+
+## [v0.24.0](https://github.com/thanos-io/kube-thanos/tree/v0.24.0) (2021-12-17)
+
+### Changed
+
+- [#254](https://github.com/thanos-io/kube-thanos/pull/254) Add support for tenant header configuration to receiver.
+- [#247](https://github.com/thanos-io/kube-thanos/pull/247) Make Compact service headless.
+
+### Added
+
+- [#265](https://github.com/thanos-io/kube-thanos/pull/265) Added support for multithreaded thanos compact.
+- [#237](https://github.com/thanos-io/kube-thanos/pull/237) Add new bucket replicate component.
+- [#245](https://github.com/thanos-io/kube-thanos/pull/245) Support scraping config reloader sidecar for ruler.
+- [#251](https://github.com/thanos-io/kube-thanos/pull/251) Add support for extraEnv (custom environment variables) to all components.
+- [#260](https://github.com/thanos-io/kube-thanos/pull/260) Add support custom certificate for the object store by configuring `tlsSecretName` and `tlsSecretMountPath` in `objectStorageConfig`.
+- [#261](https://github.com/thanos-io/kube-thanos/pull/261) Add support for imagePullPolicy to all components.
+
+[Full Changelog](https://github.com/thanos-io/kube-thanos/compare/v0.22.0...v0.24.0)
+
+
+## [v0.22.0](https://github.com/thanos-io/kube-thanos/tree/v0.22.0) (2021-08-17)
+
+### Added
+
+- [#232](https://github.com/thanos-io/kube-thanos/pull/232) Support compactor hash sharding.
+
+[Full Changelog](https://github.com/thanos-io/kube-thanos/compare/v0.21.0...v0.22.0)
+
+## [v0.21.0](https://github.com/thanos-io/kube-thanos/tree/v0.21.0) (2021-08-17)
+
+### Changed
+
+- [#226](https://github.com/thanos-io/kube-thanos/pull/226) Only schedule thanos components on linux nodes.
+
+### Added
+- [#244](https://github.com/thanos-io/kube-thanos/pull/244) Add functions to implement Thanos Receive split functionality.
+- [#228](https://github.com/thanos-io/kube-thanos/pull/228) Allow configuring `--web.prefix-header` of query.
+
+[Full Changelog](https://github.com/thanos-io/kube-thanos/compare/v0.20.0...v0.21.0)
+
+## [v0.20.0](https://github.com/thanos-io/kube-thanos/tree/v0.20.0) (2021-04-28)
+
+[Full Changelog](https://github.com/thanos-io/kube-thanos/compare/v0.19.0...v0.20.0)
+
+## [v0.19.0](https://github.com/thanos-io/kube-thanos/tree/v0.19.0) (2020-04-19)
+
+### Breaking Changes
+
+- [#196](https://github.com/thanos-io/kube-thanos/pull/196) Single ServiceAccount for all hashrings, causing hashrings position in the object tree to change.
+
+### Changed
+
+- [#196](https://github.com/thanos-io/kube-thanos/pull/196) Single ServiceAccount for each component.
+- [#200](https://github.com/thanos-io/kube-thanos/pull/200) [#202](https://github.com/thanos-io/kube-thanos/pull/200) Run all components as non-root.
+- [#208](https://github.com/thanos-io/kube-thanos/pull/208) Documentation: Refer to `main` branch in docs
+
+### Added
+
+- [#192](https://github.com/thanos-io/kube-thanos/pull/192) sidecar: Add pod discovery
+- [#194](https://github.com/thanos-io/kube-thanos/pull/194) Allow configuring --label and --receive.tenant-label-name flags.
+- [#209](https://github.com/thanos-io/kube-thanos/pull/209) Allow configuring --label and --refresh flags of bucket web.
+- [#213](https://github.com/thanos-io/kube-thanos/pull/213) Allow configuring `--min-time` and `--max-time` of store.
+- [#218](https://github.com/thanos-io/kube-thanos/pull/218) Enable `--query.auto-downsampling` for query by default.
+- [#221](https://github.com/thanos-io/kube-thanos/pull/221) Allow configuring `--tsdb.retention` and `--tsdb.block-duration` for rule.
+- [#225](https://github.com/thanos-io/kube-thanos/pull/225) Add support for alertmanager configuration and extra volumes for rule.
+
+[Full Changelog](https://github.com/thanos-io/kube-thanos/compare/v0.18.0...v0.19.0)
+
+## [v0.18.0](https://github.com/thanos-io/kube-thanos/tree/v0.18.0) (2020-04-19)
+
+### Breaking Changes
+
+- [#188](https://github.com/thanos-io/kube-thanos/pull/188) Single ServiceMonitor for store shards
+
+### Fixed
+
+- [#185](https://github.com/thanos-io/kube-thanos/pull/185) query-frontend, store: make cache types case insensitive
+
+[Full Changelog](https://github.com/thanos-io/kube-thanos/compare/v0.17.0...v0.18.0)
+
+## [v0.17.0](https://github.com/thanos-io/kube-thanos/tree/v0.17.0) (2020-12-08)
+
+### Added
+
+- [#166](https://github.com/thanos-io/kube-thanos/pull/166) Add new flags and memcached support to query frontend
+- [#169](https://github.com/thanos-io/kube-thanos/pull/169) Add --tracing.config support to all components
+- [#170](https://github.com/thanos-io/kube-thanos/pull/170) Add Store shard and Receive hashring helpers
+- [#173](https://github.com/thanos-io/kube-thanos/pull/173) Store, query, frontend: add log.format flag
+- [#178](https://github.com/thanos-io/kube-thanos/pull/178) compact, rule, tools: add log format flag
+
+### Fixed
+
+- [#176](https://github.com/thanos-io/kube-thanos/pull/176) store: fix error when bucket cache not used
+
+[Full Changelog](https://github.com/thanos-io/kube-thanos/compare/v0.16.0...v0.17.0)
+
+## [v0.16.0](https://github.com/thanos-io/kube-thanos/tree/v0.16.0) (2020-11-04)
+
+### Changed
+
+- [#164](https://github.com/thanos-io/kube-thanos/pull/164) Expose components via functions with params merged with defaults
+
+- #152 #153 #154 #155 #156 #157 #158 #159 Rewrite all components to not use ksonnet anymore (mostly internal change)
+
+### Added
+
+- [#148](https://github.com/thanos-io/kube-thanos/pull/148) Support for configuring Alertmanager on Thanos Ruler
+
+### Fixed
+
+- [#150](https://github.com/thanos-io/kube-thanos/pull/150) Update query frontend flag name
+
+[Full Changelog](https://github.com/thanos-io/kube-thanos/compare/v0.15.0...v0.16.0)
+
+## [v0.15.0](https://github.com/thanos-io/kube-thanos/tree/v0.15.0) (2020-09-07)
+
+### Added
+
+- [#142](https://github.com/thanos-io/kube-thanos/pull/142) query-frontend: Add thanos query frontend component.
+
+- [#145](https://github.com/thanos-io/kube-thanos/pull/145) querier: Add a new mixin to specify `--query.lookback-delta` flag.
+
+[Full Changelog](https://github.com/thanos-io/kube-thanos/compare/v0.14.0...v0.15.0)
+
+## [v0.14.0](https://github.com/thanos-io/kube-thanos/tree/v0.14.0) (2020-07-10)
+
+Compatible with https://github.com/thanos-io/thanos/releases/tag/v0.14.0
+
+### Changed
+
+- [#135](https://github.com/thanos-io/kube-thanos/pull/135) *: Relabel pod reference into instance label
+
+- [#134](https://github.com/thanos-io/kube-thanos/pull/131) receive: Only perform anti affinity against receive pods
+
+[Full Changelog](https://github.com/thanos-io/kube-thanos/compare/v0.13.0...v0.14.0)
+
+## [v0.13.0](https://github.com/thanos-io/kube-thanos/tree/v0.13.0) (2020-06-22)
+
+Compatible with https://github.com/thanos-io/thanos/releases/tag/v0.13.0
+
+### Changed
+
+- [#118](https://github.com/thanos-io/kube-thanos/pull/118) receive: Extend shutdown grace period to 900s (15min).
+
+- [#131](https://github.com/thanos-io/kube-thanos/pull/131) bucket: Update bucket web to tools bucket web
+
+### Added
+
+- [#119](https://github.com/thanos-io/kube-thanos/pull/119) receive: Distribute receive instances across node zones via pod anti affinity (note: only available on Kubernetes 1.17+)
+
+- [#122](https://github.com/thanos-io/kube-thanos/pull/122) store: Rename `withMemcachedIndexCache` to `withIndexCacheMemcached`
+
+- [#122](https://github.com/thanos-io/kube-thanos/pull/122) store: Enable caching bucket support
+
+- [#128](https://github.com/thanos-io/kube-thanos/pull/128) query: Allow configuring query timeout
+
+- [#129](https://github.com/thanos-io/kube-thanos/pull/129) store: Set pod anti affinity between store pods
+
+### Fixed
+
+- [#116](https://github.com/thanos-io/kube-thanos/pull/116) rule: No quotation marks on alert.label-drop
+
+[Full Changelog](https://github.com/thanos-io/kube-thanos/compare/v0.12.0...v0.13.0)
+
+## [v0.12.0](https://github.com/thanos-io/kube-thanos/tree/v0.12.0) (2020-04-16)
+
+Compatible with https://github.com/thanos-io/thanos/releases/tag/v0.12.0
 
 ### Added
 
 - [#105](https://github.com/thanos-io/kube-thanos/pull/105) compactor, store: Add deduplication replica label flags and delete delay labels
 
-- [#105](https://github.com/thanos-io/kube-thanos/pull/105) compactor, store: Add deduplication replica label flags and delete delay labels
+- [#106](https://github.com/thanos-io/kube-thanos/pull/106) store: Add memcached mixin
 
-### Fixed
+[Full Changelog](https://github.com/thanos-io/kube-thanos/compare/v0.11.0...v0.12.0)
 
--
-
-[Full Changelog](https://github.com/thanos-io/kube-thanos/compare/master...v0.11.0)
-
-## [v0.11.0](https://github.com/thanos-io/kube-thanos/tree/v0.11.0) (2020-02-11)
+## [v0.11.0](https://github.com/thanos-io/kube-thanos/tree/v0.11.0) (2020-04-08)
 
 Compatible with https://github.com/thanos-io/thanos/releases/tag/v0.11.0
 

Makefile

@@ -1,32 +1,22 @@
-SHELL=/usr/bin/env bash -o pipefail
-BIN_DIR ?= $(shell pwd)/tmp/bin
+include .bingo/Variables.mk
 
-EMBEDMD ?= $(BIN_DIR)/embedmd
-GOJSONTOYAML ?= $(BIN_DIR)/gojsontoyaml
-JSONNET ?= $(BIN_DIR)/jsonnet
-JSONNET_BUNDLER ?= $(BIN_DIR)/jb
-JSONNET_FMT ?= $(BIN_DIR)/jsonnetfmt
+FIRST_GOPATH := $(firstword $(subst :, ,$(shell go env GOPATH)))
 JSONNET_SRC = $(shell find . -name 'vendor' -prune -o -name 'jsonnet/vendor' -prune -o -name 'tmp' -prune -o -name '*.libsonnet' -print -o -name '*.jsonnet' -print)
-JSONNET_FMT_CMD := $(JSONNET_FMT) -n 2 --max-blank-lines 2 --string-style s --comment-style s
-
-CONTAINER_CMD:=docker run --rm \
-		-u="$(shell id -u):$(shell id -g)" \
-		-v "$(shell go env GOCACHE):/.cache/go-build" \
-		-v "$(PWD):/go/src/github.com/thanos-io/kube-thanos:Z" \
-		-w "/go/src/github.com/thanos-io/kube-thanos" \
-		-e USER=deadbeef \
-		-e GO111MODULE=on \
-		quay.io/coreos/jsonnet-ci
+JSONNETFMT_CMD := $(JSONNETFMT) -n 2 --max-blank-lines 2 --string-style s --comment-style s
 
 EXAMPLES := examples
 MANIFESTS := manifests
+CRDSCHEMAS := .crdschemas
+TMP := tmp
 
-all: generate fmt
+K8S_VERSION := 1.27.0
+PROM_OPERATOR_VERSION := 0.46.0
 
-.PHONY: generate-in-docker
-generate-in-docker:
-	@echo ">> Compiling assets and generating Kubernetes manifests"
-	$(CONTAINER_CMD) make $(MFLAGS) generate
+PIP  := pip3
+CRDS := \
+	https://raw.githubusercontent.com/prometheus-operator/prometheus-operator/v$(PROM_OPERATOR_VERSION)/jsonnet/prometheus-operator/servicemonitor-crd.libsonnet \
+
+all: fmt generate validate
 
 .PHONY: generate
 generate: vendor ${MANIFESTS} **.md
@@ -35,42 +25,59 @@ generate: vendor ${MANIFESTS} **.md
 	$(EMBEDMD) -w `find . -name "*.md" | grep -v vendor`
 
 .PHONY: ${MANIFESTS}
-${MANIFESTS}: $(JSONNET) $(GOJSONTOYAML) vendor example.jsonnet build.sh
+${MANIFESTS}: $(JSONNET) $(GOJSONTOYAML) vendor example.jsonnet all.jsonnet build.sh
 	@rm -rf ${MANIFESTS}
 	@mkdir -p ${MANIFESTS}
-	PATH=$$PATH:$$(pwd)/$(BIN_DIR) ./build.sh
+	JSONNET=$(JSONNET) GOJSONTOYAML=$(GOJSONTOYAML) ./build.sh
 
 .PHONY: fmt
-fmt: $(JSONNET_FMT)
-	PATH=$$PATH:$$(pwd)/$(BIN_DIR) echo ${JSONNET_SRC} | xargs -n 1 -- $(JSONNET_FMT_CMD) -i
+fmt: $(JSONNETFMT)
+	echo ${JSONNET_SRC} | xargs -n 1 -- $(JSONNETFMT_CMD) -i
 
-vendor: | $(JSONNET_BUNDLER) jsonnetfile.json jsonnetfile.lock.json
-	$(JSONNET_BUNDLER) install
+.PHONY: lint
+lint: $(JSONNET_LINT) vendor
+	echo ${JSONNET_SRC} | xargs -n 1 -- $(JSONNET_LINT) -J vendor
+
+.PHONY: vendor
+vendor: | $(JB) jsonnetfile.json jsonnetfile.lock.json
+	$(JB) install
+
+.PHONY: deploy
+deploy:
+	kubectl create ns thanos
+	kubectl create ns minio
+	kubectl apply -f https://raw.githubusercontent.com/prometheus-operator/prometheus-operator/v$(PROM_OPERATOR_VERSION)/example/prometheus-operator-crd/monitoring.coreos.com_servicemonitors.yaml
+	kubectl create -f examples/development-minio/
+	kubectl create -f manifests/
+
+.PHONY: teardown
+teardown:
+	kubectl delete -f examples/development-minio/
+	kubectl delete -f manifests/
+	kubectl delete ns thanos
+	kubectl delete ns minio
 
 .PHONY: clean
 clean:
 	-rm -rf tmp/bin
 	rm -rf manifests/
 
-$(BIN_DIR):
-	mkdir -p $(BIN_DIR)
+${TMP}/bin/openapi2jsonschema.py:
+	@$(PIP) show pyyaml >/dev/null
+	@mkdir -p $(TMP)
+	@curl -sSfo $@ https://raw.githubusercontent.com/yannh/kubeconform/v0.4.4/scripts/openapi2jsonschema.py
+	@chmod +x $@
 
-$(EMBEDMD): $(BIN_DIR)
-	go get -d github.com/campoy/embedmd
-	go build -o $@ github.com/campoy/embedmd
+${CRDSCHEMAS}: $(TMP)/bin/openapi2jsonschema.py
+	@rm -rf $@
+	@mkdir -p $@
+	@cd $@ && for crd in $(CRDS); do \
+	  FILENAME_FORMAT='{kind}-{group}-{version}' $(CURDIR)/$(TMP)/bin/openapi2jsonschema.py "$${crd}"; \
+	done
 
-$(GOJSONTOYAML): $(BIN_DIR)
-	go get -d github.com/brancz/gojsontoyaml
-	go build -o $@ github.com/brancz/gojsontoyaml
-
-$(JSONNET): $(BIN_DIR)
-	go get -d github.com/google/go-jsonnet/cmd/jsonnet
-	go build -o $@ github.com/google/go-jsonnet/cmd/jsonnet
-
-$(JSONNET_FMT): $(BIN_DIR)
-	go get -d github.com/google/go-jsonnet/cmd/jsonnetfmt
-	go build -o $@ github.com/google/go-jsonnet/cmd/jsonnetfmt
-
-$(JSONNET_BUNDLER): $(BIN_DIR)
-	curl -L -o $(JSONNET_BUNDLER) "https://github.com/jsonnet-bundler/jsonnet-bundler/releases/download/v0.3.1/jb-$(shell go env GOOS)-$(shell go env GOARCH)"
-	chmod +x $(JSONNET_BUNDLER)
+.PHONY: validate
+validate: $(KUBECONFORM) $(MANIFESTS) $(EXAMPLES)/all/manifests
+	$(KUBECONFORM) -strict -kubernetes-version $(K8S_VERSION) -output tap \
+		-schema-location 'https://raw.githubusercontent.com/yannh/kubernetes-json-schema/master' \
+		-schema-location '$(CRDSCHEMAS)/{{ .ResourceKind }}{{ .KindSuffix }}.json' \
+		$(MANIFESTS) $(EXAMPLES)/all/manifests

README.md

@@ -23,12 +23,12 @@ This project is intended to be used as a library (i.e. the intent is not for you
 Though for a quickstart a compiled version of the Kubernetes [manifests](manifests) generated with this library (specifically with `example.jsonnet`) is checked into this repository in order to try the content out quickly. To try out the stack un-customized run:
  * Simply create the stack:
 ```shell
-$ kubectl create -f manifests/
+$ make deploy
 ```
 
  * And to teardown the stack:
 ```shell
-$ kubectl delete -f manifests/
+$ make teardown
 ```
 
 ## Customizing kube-thanos
@@ -46,12 +46,12 @@ Install this library in your own project with [jsonnet-bundler](https://github.c
 $ mkdir my-kube-thanos; cd my-kube-thanos
 $ jb init  # Creates the initial/empty `jsonnetfile.json`
 # Install the kube-thanos dependency
-$ jb install github.com/thanos-io/kube-thanos/jsonnet/kube-thanos@master # Creates `vendor/` & `jsonnetfile.lock.json`, and fills in `jsonnetfile.json`
+$ jb install github.com/thanos-io/kube-thanos/jsonnet/kube-thanos@main # Creates `vendor/` & `jsonnetfile.lock.json`, and fills in `jsonnetfile.json`
 ```
 
 > `jb` can be installed with `go get github.com/jsonnet-bundler/jsonnet-bundler/cmd/jb`
 
-> An e.g. of how to install a given version of this library: `jb install github.com/thanos-io/kube-thanos/jsonnet/kube-thanos@master`
+> An e.g. of how to install a given version of this library: `jb install github.com/thanos-io/kube-thanos/jsonnet/kube-thanos@main`
 
 In order to update the kube-thanos dependency, simply use the jsonnet-bundler update functionality:
 ```shell
@@ -68,21 +68,22 @@ Here's [example.jsonnet](example.jsonnet):
 
 [embedmd]:# (example.jsonnet)
 ```jsonnet
-local k = import 'ksonnet/ksonnet.beta.4/k.libsonnet';
-local sts = k.apps.v1.statefulSet;
-local deployment = k.apps.v1.deployment;
-local t = (import 'kube-thanos/thanos.libsonnet');
+local t = import 'kube-thanos/thanos.libsonnet';
+
+// For an example with every option and component, please check all.jsonnet
 
 local commonConfig = {
   config+:: {
     local cfg = self,
     namespace: 'thanos',
-    version: 'v0.12.0',
+    version: 'v0.31.0',
     image: 'quay.io/thanos/thanos:' + cfg.version,
+    imagePullPolicy: 'IfNotPresent',
     objectStorageConfig: {
       name: 'thanos-objectstorage',
       key: 'thanos.yaml',
     },
+    hashringConfigMapName: 'hashring-config',
     volumeClaimTemplate: {
       spec: {
         accessModes: ['ReadWriteOnce'],
@@ -96,66 +97,46 @@ local commonConfig = {
   },
 };
 
-//local b = t.bucket + commonConfig + {
-//  config+:: {
-//    name: 'thanos-bucket',
-//    replicas: 1,
-//  },
-//};
-//
-//local c = t.compact + t.compact.withVolumeClaimTemplate + t.compact.withServiceMonitor + commonConfig + {
-//  config+:: {
-//    name: 'thanos-compact',
-//    replicas: 1,
-//  },
-//};
-//
-//local re = t.receive + t.receive.withVolumeClaimTemplate + t.receive.withServiceMonitor + commonConfig + {
-//  config+:: {
-//    name: 'thanos-receive',
-//    replicas: 1,
-//    replicationFactor: 1,
-//  },
-//};
-//
-//local ru = t.rule + t.rule.withVolumeClaimTemplate + t.rule.withServiceMonitor + commonConfig + {
-//  config+:: {
-//    name: 'thanos-rule',
-//    replicas: 1,
-//  },
-//};
+local i = t.receiveIngestor(commonConfig.config {
+  replicas: 1,
+  replicaLabels: ['receive_replica'],
+  replicationFactor: 1,
+  // Disable shipping to object storage for the purposes of this example
+  objectStorageConfig: null,
+  serviceMonitor: true,
+});
 
-local s = t.store + t.store.withVolumeClaimTemplate + t.store.withServiceMonitor + commonConfig + {
-  config+:: {
-    name: 'thanos-store',
-    replicas: 1,
-  },
-};
+local r = t.receiveRouter(commonConfig.config {
+  replicas: 1,
+  replicaLabels: ['receive_replica'],
+  replicationFactor: 1,
+  // Disable shipping to object storage for the purposes of this example
+  objectStorageConfig: null,
+  endpoints: i.endpoints,
+});
 
-local q = t.query + t.query.withServiceMonitor + commonConfig + {
-  config+:: {
-    name: 'thanos-query',
-    replicas: 1,
-    stores: [
-      'dnssrv+_grpc._tcp.%s.%s.svc.cluster.local' % [service.metadata.name, service.metadata.namespace]
-      for service in [s.service]
-    ],
-    replicaLabels: ['prometheus_replica', 'rule_replica'],
-  },
-};
+local s = t.store(commonConfig.config {
+  replicas: 1,
+  serviceMonitor: true,
+});
 
-//local finalRu = ru {
-//  config+:: {
-//    queriers: ['dnssrv+_http._tcp.%s.%s.svc.cluster.local' % [q.service.metadata.name, q.service.metadata.namespace]],
-//  },
-//};
+local q = t.query(commonConfig.config {
+  replicas: 1,
+  replicaLabels: ['prometheus_replica', 'rule_replica'],
+  serviceMonitor: true,
+  stores: [s.storeEndpoint] + i.storeEndpoints,
+});
 
-//{ ['thanos-bucket-' + name]: b[name] for name in std.objectFields(b) } +
-//{ ['thanos-compact-' + name]: c[name] for name in std.objectFields(c) } +
-//{ ['thanos-receive-' + name]: re[name] for name in std.objectFields(re) } +
-//{ ['thanos-rule-' + name]: finalRu[name] for name in std.objectFields(finalRu) } +
 { ['thanos-store-' + name]: s[name] for name in std.objectFields(s) } +
-{ ['thanos-query-' + name]: q[name] for name in std.objectFields(q) }
+{ ['thanos-query-' + name]: q[name] for name in std.objectFields(q) } +
+{ ['thanos-receive-router-' + resource]: r[resource] for resource in std.objectFields(r) } +
+{ ['thanos-receive-ingestor-' + resource]: i[resource] for resource in std.objectFields(i) if resource != 'ingestors' } +
+{
+  ['thanos-receive-ingestor-' + hashring + '-' + resource]: i.ingestors[hashring][resource]
+  for hashring in std.objectFields(i.ingestors)
+  for resource in std.objectFields(i.ingestors[hashring])
+  if i.ingestors[hashring][resource] != null
+}
 ```
 
 And here's the [build.sh](build.sh) script (which uses `vendor/` to render all manifests in a json structure of `{filename: manifest-content}`):
@@ -171,19 +152,29 @@ set -x
 # only exit with zero if all commands of the pipeline exit successfully
 set -o pipefail
 
+JSONNET=${JSONNET:-jsonnet}
+GOJSONTOYAML=${GOJSONTOYAML:-gojsontoyaml}
+
 # Make sure to start with a clean 'manifests' dir
 rm -rf manifests
 mkdir manifests
 
 # optional, but we would like to generate yaml, not json
-jsonnet -J vendor -m manifests "${1-example.jsonnet}" | xargs -I{} sh -c 'cat {} | gojsontoyaml > {}.yaml; rm -f {}' -- {}
+${JSONNET} -J vendor -m manifests "${1-example.jsonnet}" | xargs -I{} sh -c "cat {} | ${GOJSONTOYAML} > {}.yaml; rm -f {}" -- {}
+find manifests -type f ! -name '*.yaml' -delete
 
 # The following script generates all components, mostly used for testing
 
 rm -rf examples/all/manifests
+rm -rf examples/development-minio
 mkdir examples/all/manifests
+mkdir examples/development-minio
 
-jsonnet -J vendor -m examples/all/manifests "${1-all.jsonnet}" | xargs -I{} sh -c 'cat {} | gojsontoyaml > {}.yaml; rm -f {}' -- {}
+${JSONNET} -J vendor -m examples/all/manifests "${1-all.jsonnet}" | xargs -I{} sh -c "cat {} | ${GOJSONTOYAML} > {}.yaml; rm -f {}" -- {}
+find examples/all/manifests -type f ! -name '*.yaml' -delete
+
+${JSONNET} -J vendor -m examples/development-minio "${1-minio.jsonnet}" | xargs -I{} sh -c "cat {} | ${GOJSONTOYAML} > {}.yaml; rm -f {}" -- {}
+find examples/development-minio -type f ! -name '*.yaml' -delete
 ```
 
 > Note you need `jsonnet` (`go get github.com/google/go-jsonnet/cmd/jsonnet`) and `gojsontoyaml` (`go get github.com/brancz/gojsontoyaml`) installed to run `build.sh`. If you just want json output, not yaml, then you can skip the pipe and everything afterwards.

all.jsonnet

@@ -1,127 +1,268 @@
-local k = import 'ksonnet/ksonnet.beta.4/k.libsonnet';
-local sts = k.apps.v1.statefulSet;
-local deployment = k.apps.v1.deployment;
-local t = (import 'kube-thanos/thanos.libsonnet');
+local t = import 'kube-thanos/thanos.libsonnet';
+
+// THIS IS MERELY AN EXAMPLE MEANT TO SHOW HOW TO USE ALL COMPONENTS!
+// Neither this example nor its manifests in examples/all/manifests/ are meant to ever be run.
 
 local commonConfig = {
-  config+:: {
-    local cfg = self,
-    namespace: 'thanos',
-    version: 'v0.12.0',
-    image: 'quay.io/thanos/thanos:' + cfg.version,
-    objectStorageConfig: {
-      name: 'thanos-objectstorage',
-      key: 'thanos.yaml',
-    },
-    volumeClaimTemplate: {
-      spec: {
-        accessModes: ['ReadWriteOnce'],
-        resources: {
-          requests: {
-            storage: '10Gi',
-          },
+  local cfg = self,
+  namespace: 'thanos',
+  version: 'v0.30.2',
+  image: 'quay.io/thanos/thanos:' + cfg.version,
+  replicaLabels: ['prometheus_replica', 'rule_replica'],
+  objectStorageConfig: {
+    name: 'thanos-objectstorage',
+    key: 'thanos.yaml',
+    tlsSecretName: '',
+    tlsSecretMountPath: '',
+  },
+  resources: {
+    requests: { cpu: 0.123, memory: '123Mi' },
+    limits: { cpu: 0.420, memory: '420Mi' },
+  },
+  volumeClaimTemplate: {
+    spec: {
+      accessModes: ['ReadWriteOnce'],
+      resources: {
+        requests: {
+          storage: '10Gi',
         },
       },
     },
   },
-};
-
-local b =
-  t.bucket +
-  commonConfig + {
-    config+:: {
-      name: 'thanos-bucket',
-      replicas: 1,
+  // This enables jaeger tracing for all components, as commonConfig is shared
+  tracing+: {
+    type: 'JAEGER',
+    config+: {
+      sampler_type: 'ratelimiting',
+      sampler_param: 2,
     },
-  };
-
-local c =
-  t.compact +
-  t.compact.withVolumeClaimTemplate +
-  t.compact.withServiceMonitor +
-  commonConfig + {
-    config+:: {
-      name: 'thanos-compact',
-      replicas: 1,
-    },
-  };
-
-local re =
-  t.receive +
-  t.receive.withVolumeClaimTemplate +
-  t.receive.withServiceMonitor +
-  commonConfig + {
-    config+:: {
-      name: 'thanos-receive',
-      replicas: 1,
-      replicationFactor: 1,
-    },
-  };
-
-local ru =
-  t.rule +
-  t.rule.withVolumeClaimTemplate +
-  t.rule.withServiceMonitor +
-  commonConfig + {
-    config+:: {
-      name: 'thanos-rule',
-      replicas: 1,
-    },
-  };
-
-local s =
-  t.store +
-  t.store.withVolumeClaimTemplate +
-  t.store.withServiceMonitor +
-  commonConfig + {
-    config+:: {
-      name: 'thanos-store',
-      replicas: 1,
-    },
-  };
-
-local swm =
-  t.store +
-  t.store.withVolumeClaimTemplate +
-  t.store.withServiceMonitor + t.store.withMemcachedIndexCache +
-  commonConfig + {
-    config+:: {
-      name: 'thanos-store',
-      replicas: 1,
-      memcached+: {
-        // NOTICE: <MEMCACHED_SERCIVE> is a placeholder to generate examples.
-        // List of memcached addresses, that will get resolved with the DNS service discovery provider.
-        // For DNS service discovery reference https://thanos.io/service-discovery.md/#dns-service-discovery
-        addresses: ['dnssrv+_client._tcp.<MEMCACHED_SERCIVE>.%s.svc.cluster.local' % commonConfig.config.namespace],
-      },
-    },
-  };
-
-local q =
-  t.query +
-  t.query.withServiceMonitor +
-  commonConfig + {
-    config+:: {
-      name: 'thanos-query',
-      replicas: 1,
-      stores: [
-        'dnssrv+_grpc._tcp.%s.%s.svc.cluster.local' % [service.metadata.name, service.metadata.namespace]
-        for service in [re.service, ru.service, s.service]
-      ],
-      replicaLabels: ['prometheus_replica', 'rule_replica'],
-    },
-  };
-
-local finalRu = ru {
-  config+:: {
-    queriers: ['dnssrv+_http._tcp.%s.%s.svc.cluster.local' % [q.service.metadata.name, q.service.metadata.namespace]],
   },
 };
 
-{ ['thanos-bucket-' + name]: b[name] for name in std.objectFields(b) } +
-{ ['thanos-compact-' + name]: c[name] for name in std.objectFields(c) } +
-{ ['thanos-receive-' + name]: re[name] for name in std.objectFields(re) } +
-{ ['thanos-rule-' + name]: finalRu[name] for name in std.objectFields(finalRu) } +
-{ ['thanos-store-' + name]: s[name] for name in std.objectFields(s) } +
-{ ['thanos-query-' + name]: q[name] for name in std.objectFields(q) } +
-{ 'thanos-store-statefulSet-with-memcached': swm.statefulSet }
+local b = t.bucket(commonConfig {
+  replicas: 1,
+  label: 'cluster_name',
+  refresh: '5m',
+  // Example on how to overwrite the tracing config on a per component basis
+  // tracing+: {
+  //   config+: {
+  //     service_name: 'awesome-thanos-bucket',
+  //   },
+  // },
+});
+
+local br = t.bucketReplicate(commonConfig {
+  replicas: 1,
+  // Use the same object storage secret as an example.
+  // Need to use another one in real cases.
+  objectStorageToConfig: {
+    name: 'thanos-objectstorage',
+    key: 'thanos.yaml',
+  },
+  compactionLevels: [1, 2, 3],
+  resolutions: ['0s'],
+});
+
+local c = t.compact(commonConfig {
+  replicas: 1,
+  serviceMonitor: true,
+  disableDownsampling: true,
+  deduplicationReplicaLabels: super.replicaLabels,  // reuse same labels for deduplication
+});
+
+local cs = t.compactShards(commonConfig {
+  shards: 3,
+  sourceLabels: ['cluster'],
+  replicas: 1,
+  serviceMonitor: true,
+  disableDownsampling: true,
+});
+
+local re = t.receive(commonConfig {
+  replicas: 1,
+  replicationFactor: 1,
+  serviceMonitor: true,
+  hashringConfigMapName: 'hashring',
+});
+
+local ru = t.rule(commonConfig {
+  replicas: 1,
+  rulesConfig: [{ name: 'test', key: 'test' }],
+  alertmanagersURLs: ['alertmanager:9093'],
+  alertmanagerConfigFile: {
+    name: 'thanos-ruler-config',
+    key: 'config.yaml',
+  },
+  remoteWriteConfigFile: {
+    name: 'thanos-stateless-ruler-config',
+    key: 'rw-config.yaml',
+  },
+  reloaderImage: 'jimmidyson/configmap-reload:v0.5.0',
+  serviceMonitor: true,
+});
+
+local sc = t.sidecar(commonConfig {
+  // namespace: 'monitoring',
+  serviceMonitor: true,
+  // Labels of the Prometheus pods with a Thanos Sidecar container
+  podLabelSelector: {
+    // Here it is the default label given by the prometheus-operator
+    // to all Prometheus pods
+    app: 'prometheus',
+  },
+});
+
+local s = t.store(commonConfig {
+  replicas: 1,
+  serviceMonitor: true,
+  bucketCache: {
+    type: 'memcached',
+    config+: {
+      // NOTICE: <MEMCACHED_SERVICE> is a placeholder to generate examples.
+      // List of memcached addresses, that will get resolved with the DNS service discovery provider.
+      // For DNS service discovery reference https://thanos.io/tip/thanos/service-discovery.md/#dns-service-discovery
+      addresses: ['dnssrv+_client._tcp.<MEMCACHED_SERVICE>.%s.svc.cluster.local' % commonConfig.namespace],
+    },
+  },
+  indexCache: {
+    type: 'memcached',
+    config+: {
+      // NOTICE: <MEMCACHED_SERVICE> is a placeholder to generate examples.
+      // List of memcached addresses, that will get resolved with the DNS service discovery provider.
+      // For DNS service discovery reference https://thanos.io/tip/thanos/service-discovery.md/#dns-service-discovery
+      addresses: ['dnssrv+_client._tcp.<MEMCACHED_SERVICE>.%s.svc.cluster.local' % commonConfig.namespace],
+    },
+  },
+});
+
+local q = t.query(commonConfig {
+  name: 'thanos-query',
+  replicas: 1,
+  externalPrefix: '',
+  resources: {},
+  queryTimeout: '5m',
+  autoDownsampling: true,
+  lookbackDelta: '15m',
+  ports: {
+    grpc: 10901,
+    http: 9090,
+  },
+  serviceMonitor: true,
+  logLevel: 'debug',
+});
+
+local finalRu = t.rule(ru.config {
+  queriers: ['dnssrv+_http._tcp.%s.%s.svc.cluster.local' % [q.service.metadata.name, q.service.metadata.namespace]],
+});
+
+local qf = t.queryFrontend(commonConfig {
+  replicas: 1,
+  downstreamURL: 'http://%s.%s.svc.cluster.local.:%d' % [
+    q.service.metadata.name,
+    q.service.metadata.namespace,
+    q.service.spec.ports[1].port,
+  ],
+  splitInterval: '12h',
+  maxRetries: 10,
+  logQueriesLongerThan: '10s',
+  serviceMonitor: true,
+  queryRangeCache: {
+    type: 'memcached',
+    config+: {
+      // NOTICE: <MEMCACHED_SERVICE> is a placeholder to generate examples.
+      // List of memcached addresses, that will get resolved with the DNS service discovery provider.
+      // For DNS service discovery reference https://thanos.io/tip/thanos/service-discovery.md/#dns-service-discovery
+      addresses: ['dnssrv+_client._tcp.<MEMCACHED_SERVICE>.%s.svc.cluster.local' % commonConfig.namespace],
+    },
+  },
+  labelsCache: {
+    type: 'memcached',
+    config+: {
+      // NOTICE: <MEMCACHED_SERVICE> is a placeholder to generate examples.
+      // List of memcached addresses, that will get resolved with the DNS service discovery provider.
+      // For DNS service discovery reference https://thanos.io/tip/thanos/service-discovery.md/#dns-service-discovery
+      addresses: ['dnssrv+_client._tcp.<MEMCACHED_SERVICE>.%s.svc.cluster.local' % commonConfig.namespace],
+    },
+  },
+});
+
+local rcvs = t.receiveHashrings(commonConfig {
+  hashrings: [
+    {
+      hashring: 'default',
+      tenants: [],
+    },
+    {
+      hashring: 'region-1',
+      tenants: [],
+    },
+  ],
+  replicas: 3,
+  replicationFactor: 2,
+  serviceMonitor: true,
+  hashringConfigMapName: 'hashring',
+});
+
+local strs = t.storeShards(commonConfig {
+  shards: 3,
+  replicas: 1,
+  serviceMonitor: true,
+  bucketCache: {
+    type: 'memcached',
+    config+: {
+      // NOTICE: <MEMCACHED_SERVICE> is a placeholder to generate examples.
+      // List of memcached addresses, that will get resolved with the DNS service discovery provider.
+      // For DNS service discovery reference https://thanos.io/tip/thanos/service-discovery.md/#dns-service-discovery
+      addresses: ['dnssrv+_client._tcp.<MEMCACHED_SERVICE>.%s.svc.cluster.local' % commonConfig.namespace],
+    },
+  },
+  indexCache: {
+    type: 'memcached',
+    config+: {
+      // NOTICE: <MEMCACHED_SERVICE> is a placeholder to generate examples.
+      // List of memcached addresses, that will get resolved with the DNS service discovery provider.
+      // For DNS service discovery reference https://thanos.io/tip/thanos/service-discovery.md/#dns-service-discovery
+      addresses: ['dnssrv+_client._tcp.<MEMCACHED_SERVICE>.%s.svc.cluster.local' % commonConfig.namespace],
+    },
+  },
+});
+
+local finalQ = t.query(q.config {
+  stores: [
+    'dnssrv+_grpc._tcp.%s.%s.svc.cluster.local' % [service.metadata.name, service.metadata.namespace]
+    for service in [re.service, ru.service, sc.service, s.service] +
+                   [rcvs.hashrings[hashring].service for hashring in std.objectFields(rcvs.hashrings)] +
+                   [strs.shards[shard].service for shard in std.objectFields(strs.shards)]
+  ],
+});
+
+{ ['thanos-bucket-' + name]: b[name] for name in std.objectFields(b) if b[name] != null } +
+{ ['thanos-bucket-replicate-' + name]: br[name] for name in std.objectFields(br) if br[name] != null } +
+{ ['thanos-compact-' + name]: c[name] for name in std.objectFields(c) if c[name] != null } +
+{
+  ['thanos-compact-' + shard + '-' + name]: cs.shards[shard][name]
+  for shard in std.objectFields(cs.shards)
+  for name in std.objectFields(cs.shards[shard])
+  if cs.shards[shard][name] != null
+} +
+{ ['thanos-receive-' + name]: re[name] for name in std.objectFields(re) if re[name] != null } +
+{ ['thanos-rule-' + name]: finalRu[name] for name in std.objectFields(finalRu) if finalRu[name] != null } +
+{ ['thanos-sidecar-' + name]: sc[name] for name in std.objectFields(sc) if sc[name] != null } +
+{ ['thanos-store-' + name]: s[name] for name in std.objectFields(s) if s[name] != null } +
+{ ['thanos-query-' + name]: finalQ[name] for name in std.objectFields(finalQ) if finalQ[name] != null } +
+{ ['thanos-query-frontend-' + name]: qf[name] for name in std.objectFields(qf) if qf[name] != null } +
+{
+  ['thanos-receive-' + hashring + '-' + name]: rcvs.hashrings[hashring][name]
+  for hashring in std.objectFields(rcvs.hashrings)
+  for name in std.objectFields(rcvs.hashrings[hashring])
+  if rcvs.hashrings[hashring][name] != null
+} +
+{
+  ['thanos-store-' + shard + '-' + name]: strs.shards[shard][name]
+  for shard in std.objectFields(strs.shards)
+  for name in std.objectFields(strs.shards[shard])
+  if strs.shards[shard][name] != null
+} +
+{ ['thanos-compact-shards-' + name]: cs[name] for name in std.objectFields(cs) if name != 'shards' && cs[name] != null } +
+{ ['thanos-receive-hashrings-' + name]: rcvs[name] for name in std.objectFields(rcvs) if name != 'hashrings' && rcvs[name] != null } +
+{ ['thanos-store-shards-' + name]: strs[name] for name in std.objectFields(strs) if name != 'shards' && strs[name] != null }

build.sh

@@ -7,16 +7,26 @@ set -x
 # only exit with zero if all commands of the pipeline exit successfully
 set -o pipefail
 
+JSONNET=${JSONNET:-jsonnet}
+GOJSONTOYAML=${GOJSONTOYAML:-gojsontoyaml}
+
 # Make sure to start with a clean 'manifests' dir
 rm -rf manifests
 mkdir manifests
 
 # optional, but we would like to generate yaml, not json
-jsonnet -J vendor -m manifests "${1-example.jsonnet}" | xargs -I{} sh -c 'cat {} | gojsontoyaml > {}.yaml; rm -f {}' -- {}
+${JSONNET} -J vendor -m manifests "${1-example.jsonnet}" | xargs -I{} sh -c "cat {} | ${GOJSONTOYAML} > {}.yaml; rm -f {}" -- {}
+find manifests -type f ! -name '*.yaml' -delete
 
 # The following script generates all components, mostly used for testing
 
 rm -rf examples/all/manifests
+rm -rf examples/development-minio
 mkdir examples/all/manifests
+mkdir examples/development-minio
 
-jsonnet -J vendor -m examples/all/manifests "${1-all.jsonnet}" | xargs -I{} sh -c 'cat {} | gojsontoyaml > {}.yaml; rm -f {}' -- {}
+${JSONNET} -J vendor -m examples/all/manifests "${1-all.jsonnet}" | xargs -I{} sh -c "cat {} | ${GOJSONTOYAML} > {}.yaml; rm -f {}" -- {}
+find examples/all/manifests -type f ! -name '*.yaml' -delete
+
+${JSONNET} -J vendor -m examples/development-minio "${1-minio.jsonnet}" | xargs -I{} sh -c "cat {} | ${GOJSONTOYAML} > {}.yaml; rm -f {}" -- {}
+find examples/development-minio -type f ! -name '*.yaml' -delete

example.jsonnet

@@ -1,18 +1,19 @@
-local k = import 'ksonnet/ksonnet.beta.4/k.libsonnet';
-local sts = k.apps.v1.statefulSet;
-local deployment = k.apps.v1.deployment;
-local t = (import 'kube-thanos/thanos.libsonnet');
+local t = import 'kube-thanos/thanos.libsonnet';
+
+// For an example with every option and component, please check all.jsonnet
 
 local commonConfig = {
   config+:: {
     local cfg = self,
     namespace: 'thanos',
-    version: 'v0.12.0',
+    version: 'v0.31.0',
     image: 'quay.io/thanos/thanos:' + cfg.version,
+    imagePullPolicy: 'IfNotPresent',
     objectStorageConfig: {
       name: 'thanos-objectstorage',
       key: 'thanos.yaml',
     },
+    hashringConfigMapName: 'hashring-config',
     volumeClaimTemplate: {
       spec: {
         accessModes: ['ReadWriteOnce'],
@@ -26,63 +27,43 @@ local commonConfig = {
   },
 };
 
-//local b = t.bucket + commonConfig + {
-//  config+:: {
-//    name: 'thanos-bucket',
-//    replicas: 1,
-//  },
-//};
-//
-//local c = t.compact + t.compact.withVolumeClaimTemplate + t.compact.withServiceMonitor + commonConfig + {
-//  config+:: {
-//    name: 'thanos-compact',
-//    replicas: 1,
-//  },
-//};
-//
-//local re = t.receive + t.receive.withVolumeClaimTemplate + t.receive.withServiceMonitor + commonConfig + {
-//  config+:: {
-//    name: 'thanos-receive',
-//    replicas: 1,
-//    replicationFactor: 1,
-//  },
-//};
-//
-//local ru = t.rule + t.rule.withVolumeClaimTemplate + t.rule.withServiceMonitor + commonConfig + {
-//  config+:: {
-//    name: 'thanos-rule',
-//    replicas: 1,
-//  },
-//};
+local i = t.receiveIngestor(commonConfig.config {
+  replicas: 1,
+  replicaLabels: ['receive_replica'],
+  replicationFactor: 1,
+  // Disable shipping to object storage for the purposes of this example
+  objectStorageConfig: null,
+  serviceMonitor: true,
+});
 
-local s = t.store + t.store.withVolumeClaimTemplate + t.store.withServiceMonitor + commonConfig + {
-  config+:: {
-    name: 'thanos-store',
-    replicas: 1,
-  },
-};
+local r = t.receiveRouter(commonConfig.config {
+  replicas: 1,
+  replicaLabels: ['receive_replica'],
+  replicationFactor: 1,
+  // Disable shipping to object storage for the purposes of this example
+  objectStorageConfig: null,
+  endpoints: i.endpoints,
+});
 
-local q = t.query + t.query.withServiceMonitor + commonConfig + {
-  config+:: {
-    name: 'thanos-query',
-    replicas: 1,
-    stores: [
-      'dnssrv+_grpc._tcp.%s.%s.svc.cluster.local' % [service.metadata.name, service.metadata.namespace]
-      for service in [s.service]
-    ],
-    replicaLabels: ['prometheus_replica', 'rule_replica'],
-  },
-};
+local s = t.store(commonConfig.config {
+  replicas: 1,
+  serviceMonitor: true,
+});
 
-//local finalRu = ru {
-//  config+:: {
-//    queriers: ['dnssrv+_http._tcp.%s.%s.svc.cluster.local' % [q.service.metadata.name, q.service.metadata.namespace]],
-//  },
-//};
+local q = t.query(commonConfig.config {
+  replicas: 1,
+  replicaLabels: ['prometheus_replica', 'rule_replica'],
+  serviceMonitor: true,
+  stores: [s.storeEndpoint] + i.storeEndpoints,
+});
 
-//{ ['thanos-bucket-' + name]: b[name] for name in std.objectFields(b) } +
-//{ ['thanos-compact-' + name]: c[name] for name in std.objectFields(c) } +
-//{ ['thanos-receive-' + name]: re[name] for name in std.objectFields(re) } +
-//{ ['thanos-rule-' + name]: finalRu[name] for name in std.objectFields(finalRu) } +
 { ['thanos-store-' + name]: s[name] for name in std.objectFields(s) } +
-{ ['thanos-query-' + name]: q[name] for name in std.objectFields(q) }
+{ ['thanos-query-' + name]: q[name] for name in std.objectFields(q) } +
+{ ['thanos-receive-router-' + resource]: r[resource] for resource in std.objectFields(r) } +
+{ ['thanos-receive-ingestor-' + resource]: i[resource] for resource in std.objectFields(i) if resource != 'ingestors' } +
+{
+  ['thanos-receive-ingestor-' + hashring + '-' + resource]: i.ingestors[hashring][resource]
+  for hashring in std.objectFields(i.ingestors)
+  for resource in std.objectFields(i.ingestors[hashring])
+  if i.ingestors[hashring][resource] != null
+}

examples/all/manifests/thanos-bucket-deployment.yaml

@@ -5,7 +5,7 @@ metadata:
     app.kubernetes.io/component: object-store-bucket-debugging
     app.kubernetes.io/instance: thanos-bucket
     app.kubernetes.io/name: thanos-bucket
-    app.kubernetes.io/version: v0.12.0
+    app.kubernetes.io/version: v0.30.2
   name: thanos-bucket
   namespace: thanos
 spec:
@@ -21,20 +21,36 @@ spec:
         app.kubernetes.io/component: object-store-bucket-debugging
         app.kubernetes.io/instance: thanos-bucket
         app.kubernetes.io/name: thanos-bucket
-        app.kubernetes.io/version: v0.12.0
+        app.kubernetes.io/version: v0.30.2
     spec:
       containers:
       - args:
+        - tools
         - bucket
         - web
+        - --log.level=info
+        - --log.format=logfmt
         - --objstore.config=$(OBJSTORE_CONFIG)
+        - |-
+          --tracing.config="config":
+            "sampler_param": 2
+            "sampler_type": "ratelimiting"
+            "service_name": "thanos-bucket"
+          "type": "JAEGER"
+        - --label=cluster_name
+        - --refresh=5m
         env:
         - name: OBJSTORE_CONFIG
           valueFrom:
             secretKeyRef:
               key: thanos.yaml
               name: thanos-objectstorage
-        image: quay.io/thanos/thanos:v0.12.0
+        - name: HOST_IP_ADDRESS
+          valueFrom:
+            fieldRef:
+              fieldPath: status.hostIP
+        image: quay.io/thanos/thanos:v0.30.2
+        imagePullPolicy: IfNotPresent
         livenessProbe:
           failureThreshold: 4
           httpGet:
@@ -53,5 +69,35 @@ spec:
             port: 10902
             scheme: HTTP
           periodSeconds: 5
+        resources:
+          limits:
+            cpu: 0.42
+            memory: 420Mi
+          requests:
+            cpu: 0.123
+            memory: 123Mi
+        securityContext:
+          allowPrivilegeEscalation: false
+          capabilities:
+            drop:
+            - ALL
+          readOnlyRootFilesystem: true
+          runAsGroup: 65532
+          runAsNonRoot: true
+          runAsUser: 65534
+          seccompProfile:
+            type: RuntimeDefault
         terminationMessagePolicy: FallbackToLogsOnError
+        volumeMounts: []
+      nodeSelector:
+        kubernetes.io/os: linux
+      securityContext:
+        fsGroup: 65534
+        runAsGroup: 65532
+        runAsNonRoot: true
+        runAsUser: 65534
+        seccompProfile:
+          type: RuntimeDefault
+      serviceAccountName: thanos-bucket
       terminationGracePeriodSeconds: 120
+      volumes: []

examples/all/manifests/thanos-bucket-replicate-deployment.yaml

@@ -0,0 +1,100 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  labels:
+    app.kubernetes.io/component: object-store-bucket-replicate
+    app.kubernetes.io/instance: thanos-bucket-replicate
+    app.kubernetes.io/name: thanos-bucket-replicate
+    app.kubernetes.io/version: v0.30.2
+  name: thanos-bucket-replicate
+  namespace: thanos
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/component: object-store-bucket-replicate
+      app.kubernetes.io/instance: thanos-bucket-replicate
+      app.kubernetes.io/name: thanos-bucket-replicate
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/component: object-store-bucket-replicate
+        app.kubernetes.io/instance: thanos-bucket-replicate
+        app.kubernetes.io/name: thanos-bucket-replicate
+        app.kubernetes.io/version: v0.30.2
+    spec:
+      containers:
+      - args:
+        - tools
+        - bucket
+        - replicate
+        - --log.level=info
+        - --log.format=logfmt
+        - --objstore.config=$(OBJSTORE_CONFIG)
+        - --objstore-to.config=$(OBJSTORE_TO_CONFIG)
+        - |-
+          --tracing.config="config":
+            "sampler_param": 2
+            "sampler_type": "ratelimiting"
+            "service_name": "thanos-bucket-replicate"
+          "type": "JAEGER"
+        - --compaction=1
+        - --compaction=2
+        - --compaction=3
+        - --resolution=0s
+        env:
+        - name: OBJSTORE_CONFIG
+          valueFrom:
+            secretKeyRef:
+              key: thanos.yaml
+              name: thanos-objectstorage
+        - name: OBJSTORE_TO_CONFIG
+          valueFrom:
+            secretKeyRef:
+              key: thanos.yaml
+              name: thanos-objectstorage
+        - name: HOST_IP_ADDRESS
+          valueFrom:
+            fieldRef:
+              fieldPath: status.hostIP
+        image: quay.io/thanos/thanos:v0.30.2
+        imagePullPolicy: IfNotPresent
+        livenessProbe:
+          failureThreshold: 4
+          httpGet:
+            path: /-/healthy
+            port: 10902
+            scheme: HTTP
+          periodSeconds: 30
+        name: thanos-bucket-replicate
+        ports:
+        - containerPort: 10902
+          name: http
+        readinessProbe:
+          failureThreshold: 20
+          httpGet:
+            path: /-/ready
+            port: 10902
+            scheme: HTTP
+          periodSeconds: 5
+        resources:
+          limits:
+            cpu: 0.42
+            memory: 420Mi
+          requests:
+            cpu: 0.123
+            memory: 123Mi
+        terminationMessagePolicy: FallbackToLogsOnError
+        volumeMounts: []
+      nodeSelector:
+        kubernetes.io/os: linux
+      securityContext:
+        fsGroup: 65534
+        runAsGroup: 65532
+        runAsNonRoot: true
+        runAsUser: 65534
+        seccompProfile:
+          type: RuntimeDefault
+      serviceAccountName: thanos-bucket-replicate
+      terminationGracePeriodSeconds: 120
+      volumes: []

examples/all/manifests/thanos-bucket-replicate-service.yaml

@@ -0,0 +1,19 @@
+apiVersion: v1
+kind: Service
+metadata:
+  labels:
+    app.kubernetes.io/component: object-store-bucket-replicate
+    app.kubernetes.io/instance: thanos-bucket-replicate
+    app.kubernetes.io/name: thanos-bucket-replicate
+    app.kubernetes.io/version: v0.30.2
+  name: thanos-bucket-replicate
+  namespace: thanos
+spec:
+  ports:
+  - name: http
+    port: 10902
+    targetPort: 10902
+  selector:
+    app.kubernetes.io/component: object-store-bucket-replicate
+    app.kubernetes.io/instance: thanos-bucket-replicate
+    app.kubernetes.io/name: thanos-bucket-replicate

examples/all/manifests/thanos-bucket-replicate-serviceAccount.yaml

@@ -0,0 +1,11 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  annotations: {}
+  labels:
+    app.kubernetes.io/component: object-store-bucket-replicate
+    app.kubernetes.io/instance: thanos-bucket-replicate
+    app.kubernetes.io/name: thanos-bucket-replicate
+    app.kubernetes.io/version: v0.30.2
+  name: thanos-bucket-replicate
+  namespace: thanos

examples/all/manifests/thanos-bucket-service.yaml

@@ -5,14 +5,14 @@ metadata:
     app.kubernetes.io/component: object-store-bucket-debugging
     app.kubernetes.io/instance: thanos-bucket
     app.kubernetes.io/name: thanos-bucket
-    app.kubernetes.io/version: v0.12.0
+    app.kubernetes.io/version: v0.30.2
   name: thanos-bucket
   namespace: thanos
 spec:
   ports:
   - name: http
     port: 10902
-    targetPort: http
+    targetPort: 10902
   selector:
     app.kubernetes.io/component: object-store-bucket-debugging
     app.kubernetes.io/instance: thanos-bucket

examples/all/manifests/thanos-bucket-serviceAccount.yaml

@@ -0,0 +1,11 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  annotations: {}
+  labels:
+    app.kubernetes.io/component: object-store-bucket-debugging
+    app.kubernetes.io/instance: thanos-bucket
+    app.kubernetes.io/name: thanos-bucket
+    app.kubernetes.io/version: v0.30.2
+  name: thanos-bucket
+  namespace: thanos

examples/all/manifests/thanos-compact-service.yaml

@@ -5,14 +5,15 @@ metadata:
     app.kubernetes.io/component: database-compactor
     app.kubernetes.io/instance: thanos-compact
     app.kubernetes.io/name: thanos-compact
-    app.kubernetes.io/version: v0.12.0
+    app.kubernetes.io/version: v0.30.2
   name: thanos-compact
   namespace: thanos
 spec:
+  clusterIP: None
   ports:
   - name: http
     port: 10902
-    targetPort: http
+    targetPort: 10902
   selector:
     app.kubernetes.io/component: database-compactor
     app.kubernetes.io/instance: thanos-compact

examples/all/manifests/thanos-compact-serviceAccount.yaml

@@ -0,0 +1,11 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  annotations: {}
+  labels:
+    app.kubernetes.io/component: database-compactor
+    app.kubernetes.io/instance: thanos-compact
+    app.kubernetes.io/name: thanos-compact
+    app.kubernetes.io/version: v0.30.2
+  name: thanos-compact
+  namespace: thanos

examples/all/manifests/thanos-compact-serviceMonitor.yaml

@@ -5,12 +5,19 @@ metadata:
     app.kubernetes.io/component: database-compactor
     app.kubernetes.io/instance: thanos-compact
     app.kubernetes.io/name: thanos-compact
-    app.kubernetes.io/version: v0.12.0
+    app.kubernetes.io/version: v0.30.2
   name: thanos-compact
   namespace: thanos
 spec:
   endpoints:
   - port: http
+    relabelings:
+    - action: replace
+      separator: /
+      sourceLabels:
+      - namespace
+      - pod
+      targetLabel: instance
   selector:
     matchLabels:
       app.kubernetes.io/component: database-compactor

examples/all/manifests/thanos-compact-shard0-service.yaml

@@ -0,0 +1,22 @@
+apiVersion: v1
+kind: Service
+metadata:
+  labels:
+    app.kubernetes.io/component: database-compactor
+    app.kubernetes.io/instance: thanos-compact-0
+    app.kubernetes.io/name: thanos-compact
+    app.kubernetes.io/version: v0.30.2
+    compact.thanos.io/shard: shard-0
+  name: thanos-compact-0
+  namespace: thanos
+spec:
+  clusterIP: None
+  ports:
+  - name: http
+    port: 10902
+    targetPort: 10902
+  selector:
+    app.kubernetes.io/component: database-compactor
+    app.kubernetes.io/instance: thanos-compact-0
+    app.kubernetes.io/name: thanos-compact
+    compact.thanos.io/shard: shard-0

examples/all/manifests/thanos-compact-shard0-statefulSet.yaml

@@ -0,0 +1,146 @@
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  labels:
+    app.kubernetes.io/component: database-compactor
+    app.kubernetes.io/instance: thanos-compact-0
+    app.kubernetes.io/name: thanos-compact
+    app.kubernetes.io/version: v0.30.2
+    compact.thanos.io/shard: shard-0
+  name: thanos-compact-0
+  namespace: thanos
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/component: database-compactor
+      app.kubernetes.io/instance: thanos-compact-0
+      app.kubernetes.io/name: thanos-compact
+      compact.thanos.io/shard: shard-0
+  serviceName: thanos-compact-0
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/component: database-compactor
+        app.kubernetes.io/instance: thanos-compact-0
+        app.kubernetes.io/name: thanos-compact
+        app.kubernetes.io/version: v0.30.2
+        compact.thanos.io/shard: shard-0
+    spec:
+      affinity:
+        podAntiAffinity:
+          preferredDuringSchedulingIgnoredDuringExecution:
+          - podAffinityTerm:
+              labelSelector:
+                matchExpressions:
+                - key: app.kubernetes.io/name
+                  operator: In
+                  values:
+                  - thanos-compact
+                - key: app.kubernetes.io/instance
+                  operator: In
+                  values:
+                  - thanos-compact-0
+              namespaces:
+              - thanos
+              topologyKey: kubernetes.io/hostname
+            weight: 100
+      containers:
+      - args:
+        - compact
+        - --wait
+        - --log.level=info
+        - --log.format=logfmt
+        - --objstore.config=$(OBJSTORE_CONFIG)
+        - --data-dir=/var/thanos/compact
+        - --debug.accept-malformed-index
+        - --retention.resolution-raw=0d
+        - --retention.resolution-5m=0d
+        - --retention.resolution-1h=0d
+        - --delete-delay=48h
+        - --compact.concurrency=1
+        - --downsample.concurrency=1
+        - --downsampling.disable
+        - |-
+          --tracing.config="config":
+            "sampler_param": 2
+            "sampler_type": "ratelimiting"
+            "service_name": "thanos-compact"
+          "type": "JAEGER"
+        - |
+          --selector.relabel-config=
+            - action: hashmod
+              source_labels: ["cluster"]
+              target_label: shard
+              modulus: 3
+            - action: keep
+              source_labels: ["shard"]
+              regex: 0
+        env:
+        - name: OBJSTORE_CONFIG
+          valueFrom:
+            secretKeyRef:
+              key: thanos.yaml
+              name: thanos-objectstorage
+        - name: HOST_IP_ADDRESS
+          valueFrom:
+            fieldRef:
+              fieldPath: status.hostIP
+        image: quay.io/thanos/thanos:v0.30.2
+        imagePullPolicy: IfNotPresent
+        livenessProbe:
+          failureThreshold: 4
+          httpGet:
+            path: /-/healthy
+            port: 10902
+            scheme: HTTP
+          periodSeconds: 30
+        name: thanos-compact
+        ports:
+        - containerPort: 10902
+          name: http
+        readinessProbe:
+          failureThreshold: 20
+          httpGet:
+            path: /-/ready
+            port: 10902
+            scheme: HTTP
+          periodSeconds: 5
+        resources:
+          limits:
+            cpu: 0.42
+            memory: 420Mi
+          requests:
+            cpu: 0.123
+            memory: 123Mi
+        terminationMessagePolicy: FallbackToLogsOnError
+        volumeMounts:
+        - mountPath: /var/thanos/compact
+          name: data
+          readOnly: false
+      nodeSelector:
+        kubernetes.io/os: linux
+      securityContext:
+        fsGroup: 65534
+        runAsGroup: 65532
+        runAsNonRoot: true
+        runAsUser: 65534
+        seccompProfile:
+          type: RuntimeDefault
+      serviceAccountName: thanos-compact
+      terminationGracePeriodSeconds: 120
+      volumes: []
+  volumeClaimTemplates:
+  - metadata:
+      labels:
+        app.kubernetes.io/component: database-compactor
+        app.kubernetes.io/instance: thanos-compact-0
+        app.kubernetes.io/name: thanos-compact
+        compact.thanos.io/shard: shard-0
+      name: data
+    spec:
+      accessModes:
+      - ReadWriteOnce
+      resources:
+        requests:
+          storage: 10Gi

examples/all/manifests/thanos-compact-shard1-service.yaml

@@ -0,0 +1,22 @@
+apiVersion: v1
+kind: Service
+metadata:
+  labels:
+    app.kubernetes.io/component: database-compactor
+    app.kubernetes.io/instance: thanos-compact-1
+    app.kubernetes.io/name: thanos-compact
+    app.kubernetes.io/version: v0.30.2
+    compact.thanos.io/shard: shard-1
+  name: thanos-compact-1
+  namespace: thanos
+spec:
+  clusterIP: None
+  ports:
+  - name: http
+    port: 10902
+    targetPort: 10902
+  selector:
+    app.kubernetes.io/component: database-compactor
+    app.kubernetes.io/instance: thanos-compact-1
+    app.kubernetes.io/name: thanos-compact
+    compact.thanos.io/shard: shard-1

examples/all/manifests/thanos-compact-shard1-statefulSet.yaml

@@ -0,0 +1,146 @@
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  labels:
+    app.kubernetes.io/component: database-compactor
+    app.kubernetes.io/instance: thanos-compact-1
+    app.kubernetes.io/name: thanos-compact
+    app.kubernetes.io/version: v0.30.2
+    compact.thanos.io/shard: shard-1
+  name: thanos-compact-1
+  namespace: thanos
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/component: database-compactor
+      app.kubernetes.io/instance: thanos-compact-1
+      app.kubernetes.io/name: thanos-compact
+      compact.thanos.io/shard: shard-1
+  serviceName: thanos-compact-1
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/component: database-compactor
+        app.kubernetes.io/instance: thanos-compact-1
+        app.kubernetes.io/name: thanos-compact
+        app.kubernetes.io/version: v0.30.2
+        compact.thanos.io/shard: shard-1
+    spec:
+      affinity:
+        podAntiAffinity:
+          preferredDuringSchedulingIgnoredDuringExecution:
+          - podAffinityTerm:
+              labelSelector:
+                matchExpressions:
+                - key: app.kubernetes.io/name
+                  operator: In
+                  values:
+                  - thanos-compact
+                - key: app.kubernetes.io/instance
+                  operator: In
+                  values:
+                  - thanos-compact-1
+              namespaces:
+              - thanos
+              topologyKey: kubernetes.io/hostname
+            weight: 100
+      containers:
+      - args:
+        - compact
+        - --wait
+        - --log.level=info
+        - --log.format=logfmt
+        - --objstore.config=$(OBJSTORE_CONFIG)
+        - --data-dir=/var/thanos/compact
+        - --debug.accept-malformed-index
+        - --retention.resolution-raw=0d
+        - --retention.resolution-5m=0d
+        - --retention.resolution-1h=0d
+        - --delete-delay=48h
+        - --compact.concurrency=1
+        - --downsample.concurrency=1
+        - --downsampling.disable
+        - |-
+          --tracing.config="config":
+            "sampler_param": 2
+            "sampler_type": "ratelimiting"
+            "service_name": "thanos-compact"
+          "type": "JAEGER"
+        - |
+          --selector.relabel-config=
+            - action: hashmod
+              source_labels: ["cluster"]
+              target_label: shard
+              modulus: 3
+            - action: keep
+              source_labels: ["shard"]
+              regex: 1
+        env:
+        - name: OBJSTORE_CONFIG
+          valueFrom:
+            secretKeyRef:
+              key: thanos.yaml
+              name: thanos-objectstorage
+        - name: HOST_IP_ADDRESS
+          valueFrom:
+            fieldRef:
+              fieldPath: status.hostIP
+        image: quay.io/thanos/thanos:v0.30.2
+        imagePullPolicy: IfNotPresent
+        livenessProbe:
+          failureThreshold: 4
+          httpGet:
+            path: /-/healthy
+            port: 10902
+            scheme: HTTP
+          periodSeconds: 30
+        name: thanos-compact
+        ports:
+        - containerPort: 10902
+          name: http
+        readinessProbe:
+          failureThreshold: 20
+          httpGet:
+            path: /-/ready
+            port: 10902
+            scheme: HTTP
+          periodSeconds: 5
+        resources:
+          limits:
+            cpu: 0.42
+            memory: 420Mi
+          requests:
+            cpu: 0.123
+            memory: 123Mi
+        terminationMessagePolicy: FallbackToLogsOnError
+        volumeMounts:
+        - mountPath: /var/thanos/compact
+          name: data
+          readOnly: false
+      nodeSelector:
+        kubernetes.io/os: linux
+      securityContext:
+        fsGroup: 65534
+        runAsGroup: 65532
+        runAsNonRoot: true
+        runAsUser: 65534
+        seccompProfile:
+          type: RuntimeDefault
+      serviceAccountName: thanos-compact
+      terminationGracePeriodSeconds: 120
+      volumes: []
+  volumeClaimTemplates:
+  - metadata:
+      labels:
+        app.kubernetes.io/component: database-compactor
+        app.kubernetes.io/instance: thanos-compact-1
+        app.kubernetes.io/name: thanos-compact
+        compact.thanos.io/shard: shard-1
+      name: data
+    spec:
+      accessModes:
+      - ReadWriteOnce
+      resources:
+        requests:
+          storage: 10Gi

examples/all/manifests/thanos-compact-shard2-service.yaml

@@ -0,0 +1,22 @@
+apiVersion: v1
+kind: Service
+metadata:
+  labels:
+    app.kubernetes.io/component: database-compactor
+    app.kubernetes.io/instance: thanos-compact-2
+    app.kubernetes.io/name: thanos-compact
+    app.kubernetes.io/version: v0.30.2
+    compact.thanos.io/shard: shard-2
+  name: thanos-compact-2
+  namespace: thanos
+spec:
+  clusterIP: None
+  ports:
+  - name: http
+    port: 10902
+    targetPort: 10902
+  selector:
+    app.kubernetes.io/component: database-compactor
+    app.kubernetes.io/instance: thanos-compact-2
+    app.kubernetes.io/name: thanos-compact
+    compact.thanos.io/shard: shard-2

examples/all/manifests/thanos-compact-shard2-statefulSet.yaml

@@ -0,0 +1,146 @@
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  labels:
+    app.kubernetes.io/component: database-compactor
+    app.kubernetes.io/instance: thanos-compact-2
+    app.kubernetes.io/name: thanos-compact
+    app.kubernetes.io/version: v0.30.2
+    compact.thanos.io/shard: shard-2
+  name: thanos-compact-2
+  namespace: thanos
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/component: database-compactor
+      app.kubernetes.io/instance: thanos-compact-2
+      app.kubernetes.io/name: thanos-compact
+      compact.thanos.io/shard: shard-2
+  serviceName: thanos-compact-2
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/component: database-compactor
+        app.kubernetes.io/instance: thanos-compact-2
+        app.kubernetes.io/name: thanos-compact
+        app.kubernetes.io/version: v0.30.2
+        compact.thanos.io/shard: shard-2
+    spec:
+      affinity:
+        podAntiAffinity:
+          preferredDuringSchedulingIgnoredDuringExecution:
+          - podAffinityTerm:
+              labelSelector:
+                matchExpressions:
+                - key: app.kubernetes.io/name
+                  operator: In
+                  values:
+                  - thanos-compact
+                - key: app.kubernetes.io/instance
+                  operator: In
+                  values:
+                  - thanos-compact-2
+              namespaces:
+              - thanos
+              topologyKey: kubernetes.io/hostname
+            weight: 100
+      containers:
+      - args:
+        - compact
+        - --wait
+        - --log.level=info
+        - --log.format=logfmt
+        - --objstore.config=$(OBJSTORE_CONFIG)
+        - --data-dir=/var/thanos/compact
+        - --debug.accept-malformed-index
+        - --retention.resolution-raw=0d
+        - --retention.resolution-5m=0d
+        - --retention.resolution-1h=0d
+        - --delete-delay=48h
+        - --compact.concurrency=1
+        - --downsample.concurrency=1
+        - --downsampling.disable
+        - |-
+          --tracing.config="config":
+            "sampler_param": 2
+            "sampler_type": "ratelimiting"
+            "service_name": "thanos-compact"
+          "type": "JAEGER"
+        - |
+          --selector.relabel-config=
+            - action: hashmod
+              source_labels: ["cluster"]
+              target_label: shard
+              modulus: 3
+            - action: keep
+              source_labels: ["shard"]
+              regex: 2
+        env:
+        - name: OBJSTORE_CONFIG
+          valueFrom:
+            secretKeyRef:
+              key: thanos.yaml
+              name: thanos-objectstorage
+        - name: HOST_IP_ADDRESS
+          valueFrom:
+            fieldRef:
+              fieldPath: status.hostIP
+        image: quay.io/thanos/thanos:v0.30.2
+        imagePullPolicy: IfNotPresent
+        livenessProbe:
+          failureThreshold: 4
+          httpGet:
+            path: /-/healthy
+            port: 10902
+            scheme: HTTP
+          periodSeconds: 30
+        name: thanos-compact
+        ports:
+        - containerPort: 10902
+          name: http
+        readinessProbe:
+          failureThreshold: 20
+          httpGet:
+            path: /-/ready
+            port: 10902
+            scheme: HTTP
+          periodSeconds: 5
+        resources:
+          limits:
+            cpu: 0.42
+            memory: 420Mi
+          requests:
+            cpu: 0.123
+            memory: 123Mi
+        terminationMessagePolicy: FallbackToLogsOnError
+        volumeMounts:
+        - mountPath: /var/thanos/compact
+          name: data
+          readOnly: false
+      nodeSelector:
+        kubernetes.io/os: linux
+      securityContext:
+        fsGroup: 65534
+        runAsGroup: 65532
+        runAsNonRoot: true
+        runAsUser: 65534
+        seccompProfile:
+          type: RuntimeDefault
+      serviceAccountName: thanos-compact
+      terminationGracePeriodSeconds: 120
+      volumes: []
+  volumeClaimTemplates:
+  - metadata:
+      labels:
+        app.kubernetes.io/component: database-compactor
+        app.kubernetes.io/instance: thanos-compact-2
+        app.kubernetes.io/name: thanos-compact
+        compact.thanos.io/shard: shard-2
+      name: data
+    spec:
+      accessModes:
+      - ReadWriteOnce
+      resources:
+        requests:
+          storage: 10Gi

examples/all/manifests/thanos-compact-shards-serviceAccount.yaml

@@ -0,0 +1,11 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  annotations: {}
+  labels:
+    app.kubernetes.io/component: database-compactor
+    app.kubernetes.io/instance: thanos-compact
+    app.kubernetes.io/name: thanos-compact
+    app.kubernetes.io/version: v0.30.2
+  name: thanos-compact
+  namespace: thanos

examples/all/manifests/thanos-compact-shards-serviceMonitor.yaml

@@ -0,0 +1,30 @@
+apiVersion: monitoring.coreos.com/v1
+kind: ServiceMonitor
+metadata:
+  labels:
+    app.kubernetes.io/component: database-compactor
+    app.kubernetes.io/instance: thanos-compact
+    app.kubernetes.io/name: thanos-compact
+    app.kubernetes.io/version: v0.30.2
+  name: thanos-compact
+  namespace: thanos
+spec:
+  endpoints:
+  - port: http
+    relabelings:
+    - action: replace
+      separator: /
+      sourceLabels:
+      - namespace
+      - pod
+      targetLabel: instance
+    - action: replace
+      regex: shard\-(\d+)
+      replacement: $1
+      sourceLabels:
+      - __meta_kubernetes_service_label_compact_thanos_io_shard
+      targetLabel: shard
+  selector:
+    matchLabels:
+      app.kubernetes.io/component: database-compactor
+      app.kubernetes.io/name: thanos-compact

examples/all/manifests/thanos-compact-statefulSet.yaml

@@ -5,7 +5,7 @@ metadata:
     app.kubernetes.io/component: database-compactor
     app.kubernetes.io/instance: thanos-compact
     app.kubernetes.io/name: thanos-compact
-    app.kubernetes.io/version: v0.12.0
+    app.kubernetes.io/version: v0.30.2
   name: thanos-compact
   namespace: thanos
 spec:
@@ -22,22 +22,62 @@ spec:
         app.kubernetes.io/component: database-compactor
         app.kubernetes.io/instance: thanos-compact
         app.kubernetes.io/name: thanos-compact
-        app.kubernetes.io/version: v0.12.0
+        app.kubernetes.io/version: v0.30.2
     spec:
+      affinity:
+        podAntiAffinity:
+          preferredDuringSchedulingIgnoredDuringExecution:
+          - podAffinityTerm:
+              labelSelector:
+                matchExpressions:
+                - key: app.kubernetes.io/name
+                  operator: In
+                  values:
+                  - thanos-compact
+                - key: app.kubernetes.io/instance
+                  operator: In
+                  values:
+                  - thanos-compact
+              namespaces:
+              - thanos
+              topologyKey: kubernetes.io/hostname
+            weight: 100
       containers:
       - args:
         - compact
         - --wait
+        - --log.level=info
+        - --log.format=logfmt
         - --objstore.config=$(OBJSTORE_CONFIG)
         - --data-dir=/var/thanos/compact
         - --debug.accept-malformed-index
+        - --retention.resolution-raw=0d
+        - --retention.resolution-5m=0d
+        - --retention.resolution-1h=0d
+        - --delete-delay=48h
+        - --compact.concurrency=1
+        - --downsample.concurrency=1
+        - --downsampling.disable
+        - --deduplication.replica-label=prometheus_replica
+        - --deduplication.replica-label=rule_replica
+        - |-
+          --tracing.config="config":
+            "sampler_param": 2
+            "sampler_type": "ratelimiting"
+            "service_name": "thanos-compact"
+          "type": "JAEGER"
         env:
         - name: OBJSTORE_CONFIG
           valueFrom:
             secretKeyRef:
               key: thanos.yaml
               name: thanos-objectstorage
-        image: quay.io/thanos/thanos:v0.12.0
+        - name: HOST_IP_ADDRESS
+          valueFrom:
+            fieldRef:
+              fieldPath: status.hostIP
+        image: quay.io/thanos/thanos:v0.30.2
+        imagePullPolicy: IfNotPresent
         livenessProbe:
           failureThreshold: 4
           httpGet:
@@ -56,11 +96,28 @@ spec:
             port: 10902
             scheme: HTTP
           periodSeconds: 5
+        resources:
+          limits:
+            cpu: 0.42
+            memory: 420Mi
+          requests:
+            cpu: 0.123
+            memory: 123Mi
         terminationMessagePolicy: FallbackToLogsOnError
         volumeMounts:
         - mountPath: /var/thanos/compact
           name: data
           readOnly: false
+      nodeSelector:
+        kubernetes.io/os: linux
+      securityContext:
+        fsGroup: 65534
+        runAsGroup: 65532
+        runAsNonRoot: true
+        runAsUser: 65534
+        seccompProfile:
+          type: RuntimeDefault
+      serviceAccountName: thanos-compact
       terminationGracePeriodSeconds: 120
       volumes: []
   volumeClaimTemplates:

examples/all/manifests/thanos-query-deployment.yaml

@@ -5,7 +5,7 @@ metadata:
     app.kubernetes.io/component: query-layer
     app.kubernetes.io/instance: thanos-query
     app.kubernetes.io/name: thanos-query
-    app.kubernetes.io/version: v0.12.0
+    app.kubernetes.io/version: v0.30.2
   name: thanos-query
   namespace: thanos
 spec:
@@ -21,7 +21,7 @@ spec:
         app.kubernetes.io/component: query-layer
         app.kubernetes.io/instance: thanos-query
         app.kubernetes.io/name: thanos-query
-        app.kubernetes.io/version: v0.12.0
+        app.kubernetes.io/version: v0.30.2
     spec:
       affinity:
         podAntiAffinity:
@@ -42,12 +42,35 @@ spec:
         - query
         - --grpc-address=0.0.0.0:10901
         - --http-address=0.0.0.0:9090
+        - --log.level=debug
+        - --log.format=logfmt
         - --query.replica-label=prometheus_replica
         - --query.replica-label=rule_replica
-        - --store=dnssrv+_grpc._tcp.thanos-receive.thanos.svc.cluster.local
-        - --store=dnssrv+_grpc._tcp.thanos-rule.thanos.svc.cluster.local
-        - --store=dnssrv+_grpc._tcp.thanos-store.thanos.svc.cluster.local
-        image: quay.io/thanos/thanos:v0.12.0
+        - --endpoint=dnssrv+_grpc._tcp.thanos-receive.thanos.svc.cluster.local
+        - --endpoint=dnssrv+_grpc._tcp.thanos-rule.thanos.svc.cluster.local
+        - --endpoint=dnssrv+_grpc._tcp.thanos-sidecar.thanos.svc.cluster.local
+        - --endpoint=dnssrv+_grpc._tcp.thanos-store.thanos.svc.cluster.local
+        - --endpoint=dnssrv+_grpc._tcp.thanos-receive-default.thanos.svc.cluster.local
+        - --endpoint=dnssrv+_grpc._tcp.thanos-receive-region-1.thanos.svc.cluster.local
+        - --endpoint=dnssrv+_grpc._tcp.thanos-store-0.thanos.svc.cluster.local
+        - --endpoint=dnssrv+_grpc._tcp.thanos-store-1.thanos.svc.cluster.local
+        - --endpoint=dnssrv+_grpc._tcp.thanos-store-2.thanos.svc.cluster.local
+        - --query.timeout=5m
+        - --query.lookback-delta=15m
+        - |-
+          --tracing.config="config":
+            "sampler_param": 2
+            "sampler_type": "ratelimiting"
+            "service_name": "thanos-query"
+          "type": "JAEGER"
+        - --query.auto-downsampling
+        env:
+        - name: HOST_IP_ADDRESS
+          valueFrom:
+            fieldRef:
+              fieldPath: status.hostIP
+        image: quay.io/thanos/thanos:v0.30.2
+        imagePullPolicy: IfNotPresent
         livenessProbe:
           failureThreshold: 4
           httpGet:
@@ -68,5 +91,27 @@ spec:
             port: 9090
             scheme: HTTP
           periodSeconds: 5
+        resources: {}
+        securityContext:
+          allowPrivilegeEscalation: false
+          capabilities:
+            drop:
+            - ALL
+          readOnlyRootFilesystem: true
+          runAsGroup: 65532
+          runAsNonRoot: true
+          runAsUser: 65534
+          seccompProfile:
+            type: RuntimeDefault
         terminationMessagePolicy: FallbackToLogsOnError
+      nodeSelector:
+        kubernetes.io/os: linux
+      securityContext:
+        fsGroup: 65534
+        runAsGroup: 65532
+        runAsNonRoot: true
+        runAsUser: 65534
+        seccompProfile:
+          type: RuntimeDefault
+      serviceAccountName: thanos-query
       terminationGracePeriodSeconds: 120

examples/all/manifests/thanos-query-frontend-deployment.yaml

@@ -0,0 +1,137 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  labels:
+    app.kubernetes.io/component: query-cache
+    app.kubernetes.io/instance: thanos-query-frontend
+    app.kubernetes.io/name: thanos-query-frontend
+    app.kubernetes.io/version: v0.30.2
+  name: thanos-query-frontend
+  namespace: thanos
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/component: query-cache
+      app.kubernetes.io/instance: thanos-query-frontend
+      app.kubernetes.io/name: thanos-query-frontend
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/component: query-cache
+        app.kubernetes.io/instance: thanos-query-frontend
+        app.kubernetes.io/name: thanos-query-frontend
+        app.kubernetes.io/version: v0.30.2
+    spec:
+      affinity:
+        podAntiAffinity:
+          preferredDuringSchedulingIgnoredDuringExecution:
+          - podAffinityTerm:
+              labelSelector:
+                matchExpressions:
+                - key: app.kubernetes.io/name
+                  operator: In
+                  values:
+                  - thanos-query-frontend
+              namespaces:
+              - thanos
+              topologyKey: kubernetes.io/hostname
+            weight: 100
+      containers:
+      - args:
+        - query-frontend
+        - --log.level=info
+        - --log.format=logfmt
+        - --query-frontend.compress-responses
+        - --http-address=0.0.0.0:9090
+        - --query-frontend.downstream-url=http://thanos-query.thanos.svc.cluster.local.:9090
+        - --query-range.split-interval=12h
+        - --labels.split-interval=12h
+        - --query-range.max-retries-per-request=10
+        - --labels.max-retries-per-request=10
+        - --query-frontend.log-queries-longer-than=10s
+        - |-
+          --query-range.response-cache-config="config":
+            "addresses":
+            - "dnssrv+_client._tcp.<MEMCACHED_SERVICE>.thanos.svc.cluster.local"
+            "dns_provider_update_interval": "10s"
+            "max_async_buffer_size": 10000
+            "max_async_concurrency": 20
+            "max_get_multi_batch_size": 0
+            "max_get_multi_concurrency": 100
+            "max_idle_connections": 100
+            "timeout": "500ms"
+          "type": "memcached"
+        - |-
+          --labels.response-cache-config="config":
+            "addresses":
+            - "dnssrv+_client._tcp.<MEMCACHED_SERVICE>.thanos.svc.cluster.local"
+            "dns_provider_update_interval": "10s"
+            "max_async_buffer_size": 10000
+            "max_async_concurrency": 20
+            "max_get_multi_batch_size": 0
+            "max_get_multi_concurrency": 100
+            "max_idle_connections": 100
+            "timeout": "500ms"
+          "type": "memcached"
+        - |-
+          --tracing.config="config":
+            "sampler_param": 2
+            "sampler_type": "ratelimiting"
+            "service_name": "thanos-query-frontend"
+          "type": "JAEGER"
+        env:
+        - name: HOST_IP_ADDRESS
+          valueFrom:
+            fieldRef:
+              fieldPath: status.hostIP
+        image: quay.io/thanos/thanos:v0.30.2
+        imagePullPolicy: IfNotPresent
+        livenessProbe:
+          failureThreshold: 4
+          httpGet:
+            path: /-/healthy
+            port: 9090
+            scheme: HTTP
+          periodSeconds: 30
+        name: thanos-query-frontend
+        ports:
+        - containerPort: 9090
+          name: http
+        readinessProbe:
+          failureThreshold: 20
+          httpGet:
+            path: /-/ready
+            port: 9090
+            scheme: HTTP
+          periodSeconds: 5
+        resources:
+          limits:
+            cpu: 0.42
+            memory: 420Mi
+          requests:
+            cpu: 0.123
+            memory: 123Mi
+        securityContext:
+          allowPrivilegeEscalation: false
+          capabilities:
+            drop:
+            - ALL
+          readOnlyRootFilesystem: true
+          runAsGroup: 65532
+          runAsNonRoot: true
+          runAsUser: 65534
+          seccompProfile:
+            type: RuntimeDefault
+        terminationMessagePolicy: FallbackToLogsOnError
+      nodeSelector:
+        kubernetes.io/os: linux
+      securityContext:
+        fsGroup: 65534
+        runAsGroup: 65532
+        runAsNonRoot: true
+        runAsUser: 65534
+        seccompProfile:
+          type: RuntimeDefault
+      serviceAccountName: thanos-query-frontend
+      terminationGracePeriodSeconds: 120

examples/all/manifests/thanos-query-frontend-service.yaml

@@ -0,0 +1,19 @@
+apiVersion: v1
+kind: Service
+metadata:
+  labels:
+    app.kubernetes.io/component: query-cache
+    app.kubernetes.io/instance: thanos-query-frontend
+    app.kubernetes.io/name: thanos-query-frontend
+    app.kubernetes.io/version: v0.30.2
+  name: thanos-query-frontend
+  namespace: thanos
+spec:
+  ports:
+  - name: http
+    port: 9090
+    targetPort: 9090
+  selector:
+    app.kubernetes.io/component: query-cache
+    app.kubernetes.io/instance: thanos-query-frontend
+    app.kubernetes.io/name: thanos-query-frontend

examples/all/manifests/thanos-query-frontend-serviceAccount.yaml

@@ -0,0 +1,11 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  annotations: {}
+  labels:
+    app.kubernetes.io/component: query-cache
+    app.kubernetes.io/instance: thanos-query-frontend
+    app.kubernetes.io/name: thanos-query-frontend
+    app.kubernetes.io/version: v0.30.2
+  name: thanos-query-frontend
+  namespace: thanos

examples/all/manifests/thanos-query-frontend-serviceMonitor.yaml

@@ -0,0 +1,25 @@
+apiVersion: monitoring.coreos.com/v1
+kind: ServiceMonitor
+metadata:
+  labels:
+    app.kubernetes.io/component: query-cache
+    app.kubernetes.io/instance: thanos-query-frontend
+    app.kubernetes.io/name: thanos-query-frontend
+    app.kubernetes.io/version: v0.30.2
+  name: thanos-query-frontend
+  namespace: thanos
+spec:
+  endpoints:
+  - port: http
+    relabelings:
+    - action: replace
+      separator: /
+      sourceLabels:
+      - namespace
+      - pod
+      targetLabel: instance
+  selector:
+    matchLabels:
+      app.kubernetes.io/component: query-cache
+      app.kubernetes.io/instance: thanos-query-frontend
+      app.kubernetes.io/name: thanos-query-frontend

examples/all/manifests/thanos-query-service.yaml

@@ -5,17 +5,17 @@ metadata:
     app.kubernetes.io/component: query-layer
     app.kubernetes.io/instance: thanos-query
     app.kubernetes.io/name: thanos-query
-    app.kubernetes.io/version: v0.12.0
+    app.kubernetes.io/version: v0.30.2
   name: thanos-query
   namespace: thanos
 spec:
   ports:
   - name: grpc
     port: 10901
-    targetPort: grpc
+    targetPort: 10901
   - name: http
     port: 9090
-    targetPort: http
+    targetPort: 9090
   selector:
     app.kubernetes.io/component: query-layer
     app.kubernetes.io/instance: thanos-query

examples/all/manifests/thanos-query-serviceAccount.yaml

@@ -0,0 +1,11 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  annotations: {}
+  labels:
+    app.kubernetes.io/component: query-layer
+    app.kubernetes.io/instance: thanos-query
+    app.kubernetes.io/name: thanos-query
+    app.kubernetes.io/version: v0.30.2
+  name: thanos-query
+  namespace: thanos

examples/all/manifests/thanos-query-serviceMonitor.yaml

@@ -5,12 +5,19 @@ metadata:
     app.kubernetes.io/component: query-layer
     app.kubernetes.io/instance: thanos-query
     app.kubernetes.io/name: thanos-query
-    app.kubernetes.io/version: v0.12.0
+    app.kubernetes.io/version: v0.30.2
   name: thanos-query
   namespace: thanos
 spec:
   endpoints:
   - port: http
+    relabelings:
+    - action: replace
+      separator: /
+      sourceLabels:
+      - namespace
+      - pod
+      targetLabel: instance
   selector:
     matchLabels:
       app.kubernetes.io/component: query-layer

examples/all/manifests/thanos-receive-default-podDisruptionBudget.yaml

@@ -0,0 +1,13 @@
+apiVersion: policy/v1
+kind: PodDisruptionBudget
+metadata:
+  name: thanos-receive-default
+  namespace: thanos
+spec:
+  maxUnavailable: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/component: database-write-hashring
+      app.kubernetes.io/instance: thanos-receive-default
+      app.kubernetes.io/name: thanos-receive
+      controller.receive.thanos.io/hashring: default

examples/all/manifests/thanos-receive-default-service.yaml

@@ -0,0 +1,28 @@
+apiVersion: v1
+kind: Service
+metadata:
+  labels:
+    app.kubernetes.io/component: database-write-hashring
+    app.kubernetes.io/instance: thanos-receive-default
+    app.kubernetes.io/name: thanos-receive
+    app.kubernetes.io/version: v0.30.2
+    controller.receive.thanos.io/hashring: default
+  name: thanos-receive-default
+  namespace: thanos
+spec:
+  clusterIP: None
+  ports:
+  - name: grpc
+    port: 10901
+    targetPort: 10901
+  - name: http
+    port: 10902
+    targetPort: 10902
+  - name: remote-write
+    port: 19291
+    targetPort: 19291
+  selector:
+    app.kubernetes.io/component: database-write-hashring
+    app.kubernetes.io/instance: thanos-receive-default
+    app.kubernetes.io/name: thanos-receive
+    controller.receive.thanos.io/hashring: default

examples/all/manifests/thanos-receive-default-statefulSet.yaml

@@ -0,0 +1,171 @@
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  labels:
+    app.kubernetes.io/component: database-write-hashring
+    app.kubernetes.io/instance: thanos-receive-default
+    app.kubernetes.io/name: thanos-receive
+    app.kubernetes.io/version: v0.30.2
+    controller.receive.thanos.io: thanos-receive-controller
+    controller.receive.thanos.io/hashring: default
+  name: thanos-receive-default
+  namespace: thanos
+spec:
+  minReadySeconds: 0
+  replicas: 3
+  selector:
+    matchLabels:
+      app.kubernetes.io/component: database-write-hashring
+      app.kubernetes.io/instance: thanos-receive-default
+      app.kubernetes.io/name: thanos-receive
+      controller.receive.thanos.io/hashring: default
+  serviceName: thanos-receive-default
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/component: database-write-hashring
+        app.kubernetes.io/instance: thanos-receive-default
+        app.kubernetes.io/name: thanos-receive
+        app.kubernetes.io/version: v0.30.2
+        controller.receive.thanos.io/hashring: default
+    spec:
+      affinity:
+        podAntiAffinity:
+          preferredDuringSchedulingIgnoredDuringExecution:
+          - podAffinityTerm:
+              labelSelector:
+                matchExpressions:
+                - key: app.kubernetes.io/name
+                  operator: In
+                  values:
+                  - thanos-receive
+                - key: app.kubernetes.io/instance
+                  operator: In
+                  values:
+                  - thanos-receive-default
+              namespaces:
+              - thanos
+              topologyKey: kubernetes.io/hostname
+            weight: 100
+          - podAffinityTerm:
+              labelSelector:
+                matchExpressions:
+                - key: app.kubernetes.io/name
+                  operator: In
+                  values:
+                  - thanos-receive
+                - key: app.kubernetes.io/instance
+                  operator: In
+                  values:
+                  - thanos-receive-default
+              namespaces:
+              - thanos
+              topologyKey: topology.kubernetes.io/zone
+            weight: 100
+      containers:
+      - args:
+        - receive
+        - --log.level=info
+        - --log.format=logfmt
+        - --grpc-address=0.0.0.0:10901
+        - --http-address=0.0.0.0:10902
+        - --remote-write.address=0.0.0.0:19291
+        - --receive.replication-factor=2
+        - --tsdb.path=/var/thanos/receive
+        - --tsdb.retention=15d
+        - --label=replica="$(NAME)"
+        - --label=receive="true"
+        - --objstore.config=$(OBJSTORE_CONFIG)
+        - --receive.local-endpoint=$(NAME).thanos-receive-default.$(NAMESPACE).svc.cluster.local:10901
+        - --receive.hashrings-file=/var/lib/thanos-receive/hashrings.json
+        - |-
+          --tracing.config="config":
+            "sampler_param": 2
+            "sampler_type": "ratelimiting"
+            "service_name": "thanos-receive"
+          "type": "JAEGER"
+        env:
+        - name: NAME
+          valueFrom:
+            fieldRef:
+              fieldPath: metadata.name
+        - name: NAMESPACE
+          valueFrom:
+            fieldRef:
+              fieldPath: metadata.namespace
+        - name: HOST_IP_ADDRESS
+          valueFrom:
+            fieldRef:
+              fieldPath: status.hostIP
+        - name: OBJSTORE_CONFIG
+          valueFrom:
+            secretKeyRef:
+              key: thanos.yaml
+              name: thanos-objectstorage
+        image: quay.io/thanos/thanos:v0.30.2
+        imagePullPolicy: IfNotPresent
+        livenessProbe:
+          failureThreshold: 8
+          httpGet:
+            path: /-/healthy
+            port: 10902
+            scheme: HTTP
+          periodSeconds: 30
+        name: thanos-receive
+        ports:
+        - containerPort: 10901
+          name: grpc
+        - containerPort: 10902
+          name: http
+        - containerPort: 19291
+          name: remote-write
+        readinessProbe:
+          failureThreshold: 20
+          httpGet:
+            path: /-/ready
+            port: 10902
+            scheme: HTTP
+          periodSeconds: 5
+        resources:
+          limits:
+            cpu: 0.42
+            memory: 420Mi
+          requests:
+            cpu: 0.123
+            memory: 123Mi
+        terminationMessagePolicy: FallbackToLogsOnError
+        volumeMounts:
+        - mountPath: /var/thanos/receive
+          name: data
+          readOnly: false
+        - mountPath: /var/lib/thanos-receive
+          name: hashring-config
+      nodeSelector:
+        kubernetes.io/os: linux
+      securityContext:
+        fsGroup: 65534
+        runAsGroup: 65532
+        runAsNonRoot: true
+        runAsUser: 65534
+        seccompProfile:
+          type: RuntimeDefault
+      serviceAccountName: thanos-receive
+      terminationGracePeriodSeconds: 900
+      volumes:
+      - configMap:
+          name: hashring
+        name: hashring-config
+  volumeClaimTemplates:
+  - metadata:
+      labels:
+        app.kubernetes.io/component: database-write-hashring
+        app.kubernetes.io/instance: thanos-receive-default
+        app.kubernetes.io/name: thanos-receive
+        controller.receive.thanos.io/hashring: default
+      name: data
+    spec:
+      accessModes:
+      - ReadWriteOnce
+      resources:
+        requests:
+          storage: 10Gi

examples/all/manifests/thanos-receive-hashrings-serviceAccount.yaml

@@ -0,0 +1,11 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  annotations: {}
+  labels:
+    app.kubernetes.io/component: database-write-hashring
+    app.kubernetes.io/instance: thanos-receive
+    app.kubernetes.io/name: thanos-receive
+    app.kubernetes.io/version: v0.30.2
+  name: thanos-receive
+  namespace: thanos

examples/all/manifests/thanos-receive-hashrings-serviceMonitor.yaml

@@ -0,0 +1,28 @@
+apiVersion: monitoring.coreos.com/v1
+kind: ServiceMonitor
+metadata:
+  labels:
+    app.kubernetes.io/component: database-write-hashring
+    app.kubernetes.io/instance: thanos-receive
+    app.kubernetes.io/name: thanos-receive
+    app.kubernetes.io/version: v0.30.2
+  name: thanos-receive
+  namespace: thanos
+spec:
+  endpoints:
+  - port: http
+    relabelings:
+    - action: replace
+      separator: /
+      sourceLabels:
+      - namespace
+      - pod
+      targetLabel: instance
+    - action: replace
+      sourceLabels:
+      - __meta_kubernetes_service_label_controller_receive_thanos_io_shard
+      targetLabel: hashring
+  selector:
+    matchLabels:
+      app.kubernetes.io/component: database-write-hashring
+      app.kubernetes.io/name: thanos-receive

examples/all/manifests/thanos-receive-region-1-podDisruptionBudget.yaml

@@ -0,0 +1,13 @@
+apiVersion: policy/v1
+kind: PodDisruptionBudget
+metadata:
+  name: thanos-receive-region-1
+  namespace: thanos
+spec:
+  maxUnavailable: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/component: database-write-hashring
+      app.kubernetes.io/instance: thanos-receive-region-1
+      app.kubernetes.io/name: thanos-receive
+      controller.receive.thanos.io/hashring: region-1

examples/all/manifests/thanos-receive-region-1-service.yaml

@@ -0,0 +1,28 @@
+apiVersion: v1
+kind: Service
+metadata:
+  labels:
+    app.kubernetes.io/component: database-write-hashring
+    app.kubernetes.io/instance: thanos-receive-region-1
+    app.kubernetes.io/name: thanos-receive
+    app.kubernetes.io/version: v0.30.2
+    controller.receive.thanos.io/hashring: region-1
+  name: thanos-receive-region-1
+  namespace: thanos
+spec:
+  clusterIP: None
+  ports:
+  - name: grpc
+    port: 10901
+    targetPort: 10901
+  - name: http
+    port: 10902
+    targetPort: 10902
+  - name: remote-write
+    port: 19291
+    targetPort: 19291
+  selector:
+    app.kubernetes.io/component: database-write-hashring
+    app.kubernetes.io/instance: thanos-receive-region-1
+    app.kubernetes.io/name: thanos-receive
+    controller.receive.thanos.io/hashring: region-1

examples/all/manifests/thanos-receive-region-1-statefulSet.yaml

@@ -0,0 +1,171 @@
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  labels:
+    app.kubernetes.io/component: database-write-hashring
+    app.kubernetes.io/instance: thanos-receive-region-1
+    app.kubernetes.io/name: thanos-receive
+    app.kubernetes.io/version: v0.30.2
+    controller.receive.thanos.io: thanos-receive-controller
+    controller.receive.thanos.io/hashring: region-1
+  name: thanos-receive-region-1
+  namespace: thanos
+spec:
+  minReadySeconds: 0
+  replicas: 3
+  selector:
+    matchLabels:
+      app.kubernetes.io/component: database-write-hashring
+      app.kubernetes.io/instance: thanos-receive-region-1
+      app.kubernetes.io/name: thanos-receive
+      controller.receive.thanos.io/hashring: region-1
+  serviceName: thanos-receive-region-1
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/component: database-write-hashring
+        app.kubernetes.io/instance: thanos-receive-region-1
+        app.kubernetes.io/name: thanos-receive
+        app.kubernetes.io/version: v0.30.2
+        controller.receive.thanos.io/hashring: region-1
+    spec:
+      affinity:
+        podAntiAffinity:
+          preferredDuringSchedulingIgnoredDuringExecution:
+          - podAffinityTerm:
+              labelSelector:
+                matchExpressions:
+                - key: app.kubernetes.io/name
+                  operator: In
+                  values:
+                  - thanos-receive
+                - key: app.kubernetes.io/instance
+                  operator: In
+                  values:
+                  - thanos-receive-region-1
+              namespaces:
+              - thanos
+              topologyKey: kubernetes.io/hostname
+            weight: 100
+          - podAffinityTerm:
+              labelSelector:
+                matchExpressions:
+                - key: app.kubernetes.io/name
+                  operator: In
+                  values:
+                  - thanos-receive
+                - key: app.kubernetes.io/instance
+                  operator: In
+                  values:
+                  - thanos-receive-region-1
+              namespaces:
+              - thanos
+              topologyKey: topology.kubernetes.io/zone
+            weight: 100
+      containers:
+      - args:
+        - receive
+        - --log.level=info
+        - --log.format=logfmt
+        - --grpc-address=0.0.0.0:10901
+        - --http-address=0.0.0.0:10902
+        - --remote-write.address=0.0.0.0:19291
+        - --receive.replication-factor=2
+        - --tsdb.path=/var/thanos/receive
+        - --tsdb.retention=15d
+        - --label=replica="$(NAME)"
+        - --label=receive="true"
+        - --objstore.config=$(OBJSTORE_CONFIG)
+        - --receive.local-endpoint=$(NAME).thanos-receive-region-1.$(NAMESPACE).svc.cluster.local:10901
+        - --receive.hashrings-file=/var/lib/thanos-receive/hashrings.json
+        - |-
+          --tracing.config="config":
+            "sampler_param": 2
+            "sampler_type": "ratelimiting"
+            "service_name": "thanos-receive"
+          "type": "JAEGER"
+        env:
+        - name: NAME
+          valueFrom:
+            fieldRef:
+              fieldPath: metadata.name
+        - name: NAMESPACE
+          valueFrom:
+            fieldRef:
+              fieldPath: metadata.namespace
+        - name: HOST_IP_ADDRESS
+          valueFrom:
+            fieldRef:
+              fieldPath: status.hostIP
+        - name: OBJSTORE_CONFIG
+          valueFrom:
+            secretKeyRef:
+              key: thanos.yaml
+              name: thanos-objectstorage
+        image: quay.io/thanos/thanos:v0.30.2
+        imagePullPolicy: IfNotPresent
+        livenessProbe:
+          failureThreshold: 8
+          httpGet:
+            path: /-/healthy
+            port: 10902
+            scheme: HTTP
+          periodSeconds: 30
+        name: thanos-receive
+        ports:
+        - containerPort: 10901
+          name: grpc
+        - containerPort: 10902
+          name: http
+        - containerPort: 19291
+          name: remote-write
+        readinessProbe:
+          failureThreshold: 20
+          httpGet:
+            path: /-/ready
+            port: 10902
+            scheme: HTTP
+          periodSeconds: 5
+        resources:
+          limits:
+            cpu: 0.42
+            memory: 420Mi
+          requests:
+            cpu: 0.123
+            memory: 123Mi
+        terminationMessagePolicy: FallbackToLogsOnError
+        volumeMounts:
+        - mountPath: /var/thanos/receive
+          name: data
+          readOnly: false
+        - mountPath: /var/lib/thanos-receive
+          name: hashring-config
+      nodeSelector:
+        kubernetes.io/os: linux
+      securityContext:
+        fsGroup: 65534
+        runAsGroup: 65532
+        runAsNonRoot: true
+        runAsUser: 65534
+        seccompProfile:
+          type: RuntimeDefault
+      serviceAccountName: thanos-receive
+      terminationGracePeriodSeconds: 900
+      volumes:
+      - configMap:
+          name: hashring
+        name: hashring-config
+  volumeClaimTemplates:
+  - metadata:
+      labels:
+        app.kubernetes.io/component: database-write-hashring
+        app.kubernetes.io/instance: thanos-receive-region-1
+        app.kubernetes.io/name: thanos-receive
+        controller.receive.thanos.io/hashring: region-1
+      name: data
+    spec:
+      accessModes:
+      - ReadWriteOnce
+      resources:
+        requests:
+          storage: 10Gi

examples/all/manifests/thanos-receive-service.yaml

@@ -5,7 +5,7 @@ metadata:
     app.kubernetes.io/component: database-write-hashring
     app.kubernetes.io/instance: thanos-receive
     app.kubernetes.io/name: thanos-receive
-    app.kubernetes.io/version: v0.12.0
+    app.kubernetes.io/version: v0.30.2
   name: thanos-receive
   namespace: thanos
 spec:

examples/all/manifests/thanos-receive-serviceAccount.yaml

@@ -0,0 +1,11 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  annotations: {}
+  labels:
+    app.kubernetes.io/component: database-write-hashring
+    app.kubernetes.io/instance: thanos-receive
+    app.kubernetes.io/name: thanos-receive
+    app.kubernetes.io/version: v0.30.2
+  name: thanos-receive
+  namespace: thanos

examples/all/manifests/thanos-receive-serviceMonitor.yaml

@@ -5,12 +5,19 @@ metadata:
     app.kubernetes.io/component: database-write-hashring
     app.kubernetes.io/instance: thanos-receive
     app.kubernetes.io/name: thanos-receive
-    app.kubernetes.io/version: v0.12.0
+    app.kubernetes.io/version: v0.30.2
   name: thanos-receive
   namespace: thanos
 spec:
   endpoints:
   - port: http
+    relabelings:
+    - action: replace
+      separator: /
+      sourceLabels:
+      - namespace
+      - pod
+      targetLabel: instance
   selector:
     matchLabels:
       app.kubernetes.io/component: database-write-hashring

examples/all/manifests/thanos-receive-statefulSet.yaml

@@ -5,10 +5,11 @@ metadata:
     app.kubernetes.io/component: database-write-hashring
     app.kubernetes.io/instance: thanos-receive
     app.kubernetes.io/name: thanos-receive
-    app.kubernetes.io/version: v0.12.0
+    app.kubernetes.io/version: v0.30.2
   name: thanos-receive
   namespace: thanos
 spec:
+  minReadySeconds: 0
   replicas: 1
   selector:
     matchLabels:
@@ -22,7 +23,7 @@ spec:
         app.kubernetes.io/component: database-write-hashring
         app.kubernetes.io/instance: thanos-receive
         app.kubernetes.io/name: thanos-receive
-        app.kubernetes.io/version: v0.12.0
+        app.kubernetes.io/version: v0.30.2
     spec:
       affinity:
         podAntiAffinity:
@@ -30,6 +31,10 @@ spec:
           - podAffinityTerm:
               labelSelector:
                 matchExpressions:
+                - key: app.kubernetes.io/name
+                  operator: In
+                  values:
+                  - thanos-receive
                 - key: app.kubernetes.io/instance
                   operator: In
                   values:
@@ -38,18 +43,43 @@ spec:
               - thanos
               topologyKey: kubernetes.io/hostname
             weight: 100
+          - podAffinityTerm:
+              labelSelector:
+                matchExpressions:
+                - key: app.kubernetes.io/name
+                  operator: In
+                  values:
+                  - thanos-receive
+                - key: app.kubernetes.io/instance
+                  operator: In
+                  values:
+                  - thanos-receive
+              namespaces:
+              - thanos
+              topologyKey: topology.kubernetes.io/zone
+            weight: 100
       containers:
       - args:
         - receive
+        - --log.level=info
+        - --log.format=logfmt
         - --grpc-address=0.0.0.0:10901
         - --http-address=0.0.0.0:10902
         - --remote-write.address=0.0.0.0:19291
         - --receive.replication-factor=1
-        - --objstore.config=$(OBJSTORE_CONFIG)
         - --tsdb.path=/var/thanos/receive
+        - --tsdb.retention=15d
         - --label=replica="$(NAME)"
         - --label=receive="true"
+        - --objstore.config=$(OBJSTORE_CONFIG)
         - --receive.local-endpoint=$(NAME).thanos-receive.$(NAMESPACE).svc.cluster.local:10901
+        - --receive.hashrings-file=/var/lib/thanos-receive/hashrings.json
+        - |-
+          --tracing.config="config":
+            "sampler_param": 2
+            "sampler_type": "ratelimiting"
+            "service_name": "thanos-receive"
+          "type": "JAEGER"
         env:
         - name: NAME
           valueFrom:
@@ -59,12 +89,17 @@ spec:
           valueFrom:
             fieldRef:
               fieldPath: metadata.namespace
+        - name: HOST_IP_ADDRESS
+          valueFrom:
+            fieldRef:
+              fieldPath: status.hostIP
         - name: OBJSTORE_CONFIG
           valueFrom:
             secretKeyRef:
               key: thanos.yaml
               name: thanos-objectstorage
-        image: quay.io/thanos/thanos:v0.12.0
+        image: quay.io/thanos/thanos:v0.30.2
+        imagePullPolicy: IfNotPresent
         livenessProbe:
           failureThreshold: 8
           httpGet:
@@ -87,13 +122,35 @@ spec:
             port: 10902
             scheme: HTTP
           periodSeconds: 5
+        resources:
+          limits:
+            cpu: 0.42
+            memory: 420Mi
+          requests:
+            cpu: 0.123
+            memory: 123Mi
         terminationMessagePolicy: FallbackToLogsOnError
         volumeMounts:
         - mountPath: /var/thanos/receive
           name: data
           readOnly: false
-      terminationGracePeriodSeconds: 120
-      volumes: []
+        - mountPath: /var/lib/thanos-receive
+          name: hashring-config
+      nodeSelector:
+        kubernetes.io/os: linux
+      securityContext:
+        fsGroup: 65534
+        runAsGroup: 65532
+        runAsNonRoot: true
+        runAsUser: 65534
+        seccompProfile:
+          type: RuntimeDefault
+      serviceAccountName: thanos-receive
+      terminationGracePeriodSeconds: 900
+      volumes:
+      - configMap:
+          name: hashring
+        name: hashring-config
   volumeClaimTemplates:
   - metadata:
       labels:

examples/all/manifests/thanos-rule-service.yaml

@@ -5,7 +5,7 @@ metadata:
     app.kubernetes.io/component: rule-evaluation-engine
     app.kubernetes.io/instance: thanos-rule
     app.kubernetes.io/name: thanos-rule
-    app.kubernetes.io/version: v0.12.0
+    app.kubernetes.io/version: v0.30.2
   name: thanos-rule
   namespace: thanos
 spec:
@@ -13,10 +13,13 @@ spec:
   ports:
   - name: grpc
     port: 10901
-    targetPort: grpc
+    targetPort: 10901
   - name: http
     port: 10902
-    targetPort: http
+    targetPort: 10902
+  - name: reloader
+    port: 9533
+    targetPort: 9533
   selector:
     app.kubernetes.io/component: rule-evaluation-engine
     app.kubernetes.io/instance: thanos-rule

examples/all/manifests/thanos-rule-serviceAccount.yaml

@@ -0,0 +1,11 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  annotations: {}
+  labels:
+    app.kubernetes.io/component: rule-evaluation-engine
+    app.kubernetes.io/instance: thanos-rule
+    app.kubernetes.io/name: thanos-rule
+    app.kubernetes.io/version: v0.30.2
+  name: thanos-rule
+  namespace: thanos

examples/all/manifests/thanos-rule-serviceMonitor.yaml

@@ -5,12 +5,20 @@ metadata:
     app.kubernetes.io/component: rule-evaluation-engine
     app.kubernetes.io/instance: thanos-rule
     app.kubernetes.io/name: thanos-rule
-    app.kubernetes.io/version: v0.12.0
+    app.kubernetes.io/version: v0.30.2
   name: thanos-rule
   namespace: thanos
 spec:
   endpoints:
   - port: http
+    relabelings:
+    - action: replace
+      separator: /
+      sourceLabels:
+      - namespace
+      - pod
+      targetLabel: instance
+  - port: reloader
   selector:
     matchLabels:
       app.kubernetes.io/component: rule-evaluation-engine

examples/all/manifests/thanos-rule-statefulSet.yaml

@@ -5,7 +5,7 @@ metadata:
     app.kubernetes.io/component: rule-evaluation-engine
     app.kubernetes.io/instance: thanos-rule
     app.kubernetes.io/name: thanos-rule
-    app.kubernetes.io/version: v0.12.0
+    app.kubernetes.io/version: v0.30.2
   name: thanos-rule
   namespace: thanos
 spec:
@@ -22,18 +22,50 @@ spec:
         app.kubernetes.io/component: rule-evaluation-engine
         app.kubernetes.io/instance: thanos-rule
         app.kubernetes.io/name: thanos-rule
-        app.kubernetes.io/version: v0.12.0
+        app.kubernetes.io/version: v0.30.2
     spec:
+      affinity:
+        podAntiAffinity:
+          preferredDuringSchedulingIgnoredDuringExecution:
+          - podAffinityTerm:
+              labelSelector:
+                matchExpressions:
+                - key: app.kubernetes.io/name
+                  operator: In
+                  values:
+                  - thanos-rule
+                - key: app.kubernetes.io/instance
+                  operator: In
+                  values:
+                  - thanos-rule
+              namespaces:
+              - thanos
+              topologyKey: kubernetes.io/hostname
+            weight: 100
       containers:
       - args:
         - rule
+        - --log.level=info
+        - --log.format=logfmt
         - --grpc-address=0.0.0.0:10901
         - --http-address=0.0.0.0:10902
         - --objstore.config=$(OBJSTORE_CONFIG)
         - --data-dir=/var/thanos/rule
         - --label=rule_replica="$(NAME)"
-        - --alert.label-drop="rule_replica"
+        - --alert.label-drop=rule_replica
+        - --tsdb.retention=48h
+        - --tsdb.block-duration=2h
         - --query=dnssrv+_http._tcp.thanos-query.thanos.svc.cluster.local
+        - --alertmanagers.url=alertmanager:9093
+        - --alertmanagers.config-file=/etc/thanos/config/thanos-ruler-config/config.yaml
+        - --rule-file=/etc/thanos/rules/test/test
+        - |-
+          --tracing.config="config":
+            "sampler_param": 2
+            "sampler_type": "ratelimiting"
+            "service_name": "thanos-rule"
+          "type": "JAEGER"
+        - --remote-write.config-file=/etc/thanos/config/thanos-stateless-ruler-config/rw-config.yaml
         env:
         - name: NAME
           valueFrom:
@@ -44,7 +76,12 @@ spec:
             secretKeyRef:
               key: thanos.yaml
               name: thanos-objectstorage
-        image: quay.io/thanos/thanos:v0.12.0
+        - name: HOST_IP_ADDRESS
+          valueFrom:
+            fieldRef:
+              fieldPath: status.hostIP
+        image: quay.io/thanos/thanos:v0.30.2
+        imagePullPolicy: IfNotPresent
         livenessProbe:
           failureThreshold: 24
           httpGet:
@@ -58,6 +95,8 @@ spec:
           name: grpc
         - containerPort: 10902
           name: http
+        - containerPort: 9533
+          name: reloader
         readinessProbe:
           failureThreshold: 18
           httpGet:
@@ -66,12 +105,72 @@ spec:
             scheme: HTTP
           initialDelaySeconds: 10
           periodSeconds: 5
+        resources:
+          limits:
+            cpu: 0.42
+            memory: 420Mi
+          requests:
+            cpu: 0.123
+            memory: 123Mi
+        securityContext:
+          allowPrivilegeEscalation: false
+          capabilities:
+            drop:
+            - ALL
+          readOnlyRootFilesystem: true
+          runAsGroup: 65532
+          runAsNonRoot: true
+          runAsUser: 65534
+          seccompProfile:
+            type: RuntimeDefault
         terminationMessagePolicy: FallbackToLogsOnError
         volumeMounts:
         - mountPath: /var/thanos/rule
           name: data
           readOnly: false
-      volumes: []
+        - mountPath: /etc/thanos/rules/test
+          name: test
+        - mountPath: /etc/thanos/config/thanos-ruler-config
+          name: thanos-ruler-config
+          readOnly: true
+        - mountPath: /etc/thanos/config/thanos-stateless-ruler-config
+          name: thanos-stateless-ruler-config
+          readOnly: true
+      - args:
+        - -webhook-url=http://localhost:10902/-/reload
+        - -volume-dir=/etc/thanos/rules/test
+        - -volume-dir=/etc/thanos/config/thanos-ruler-config
+        - -volume-dir=/etc/thanos/config/thanos-stateless-ruler-config
+        image: jimmidyson/configmap-reload:v0.5.0
+        imagePullPolicy: IfNotPresent
+        name: configmap-reloader
+        volumeMounts:
+        - mountPath: /etc/thanos/rules/test
+          name: test
+        - mountPath: /etc/thanos/config/thanos-ruler-config
+          name: thanos-ruler-config
+        - mountPath: /etc/thanos/config/thanos-stateless-ruler-config
+          name: thanos-stateless-ruler-config
+      nodeSelector:
+        kubernetes.io/os: linux
+      securityContext:
+        fsGroup: 65534
+        runAsGroup: 65532
+        runAsNonRoot: true
+        runAsUser: 65534
+        seccompProfile:
+          type: RuntimeDefault
+      serviceAccountName: thanos-rule
+      volumes:
+      - configMap:
+          name: test
+        name: test
+      - configMap:
+          name: thanos-ruler-config
+        name: thanos-ruler-config
+      - configMap:
+          name: thanos-stateless-ruler-config
+        name: thanos-stateless-ruler-config
   volumeClaimTemplates:
   - metadata:
       labels:

examples/all/manifests/thanos-sidecar-service.yaml

@@ -0,0 +1,21 @@
+apiVersion: v1
+kind: Service
+metadata:
+  labels:
+    app.kubernetes.io/component: prometheus-sidecar
+    app.kubernetes.io/instance: thanos-sidecar
+    app.kubernetes.io/name: thanos-sidecar
+    app.kubernetes.io/version: v0.30.2
+  name: thanos-sidecar
+  namespace: thanos
+spec:
+  clusterIP: None
+  ports:
+  - name: grpc
+    port: 10901
+    targetPort: 10901
+  - name: http
+    port: 10902
+    targetPort: 10902
+  selector:
+    app: prometheus

examples/all/manifests/thanos-sidecar-serviceMonitor.yaml

@@ -0,0 +1,25 @@
+apiVersion: monitoring.coreos.com/v1
+kind: ServiceMonitor
+metadata:
+  labels:
+    app.kubernetes.io/component: prometheus-sidecar
+    app.kubernetes.io/instance: thanos-sidecar
+    app.kubernetes.io/name: thanos-sidecar
+    app.kubernetes.io/version: v0.30.2
+  name: thanos-sidecar
+  namespace: thanos
+spec:
+  endpoints:
+  - port: http
+    relabelings:
+    - action: replace
+      separator: /
+      sourceLabels:
+      - namespace
+      - pod
+      targetLabel: instance
+  selector:
+    matchLabels:
+      app.kubernetes.io/component: prometheus-sidecar
+      app.kubernetes.io/instance: thanos-sidecar
+      app.kubernetes.io/name: thanos-sidecar

examples/all/manifests/thanos-store-service.yaml

@@ -5,7 +5,7 @@ metadata:
     app.kubernetes.io/component: object-store-gateway
     app.kubernetes.io/instance: thanos-store
     app.kubernetes.io/name: thanos-store
-    app.kubernetes.io/version: v0.12.0
+    app.kubernetes.io/version: v0.30.2
   name: thanos-store
   namespace: thanos
 spec:

examples/all/manifests/thanos-store-serviceAccount.yaml

@@ -0,0 +1,11 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  annotations: {}
+  labels:
+    app.kubernetes.io/component: object-store-gateway
+    app.kubernetes.io/instance: thanos-store
+    app.kubernetes.io/name: thanos-store
+    app.kubernetes.io/version: v0.30.2
+  name: thanos-store
+  namespace: thanos

examples/all/manifests/thanos-store-serviceMonitor.yaml

@@ -5,12 +5,19 @@ metadata:
     app.kubernetes.io/component: object-store-gateway
     app.kubernetes.io/instance: thanos-store
     app.kubernetes.io/name: thanos-store
-    app.kubernetes.io/version: v0.12.0
+    app.kubernetes.io/version: v0.30.2
   name: thanos-store
   namespace: thanos
 spec:
   endpoints:
   - port: http
+    relabelings:
+    - action: replace
+      separator: /
+      sourceLabels:
+      - namespace
+      - pod
+      targetLabel: instance
   selector:
     matchLabels:
       app.kubernetes.io/component: object-store-gateway

examples/all/manifests/thanos-store-shard0-service.yaml

@@ -0,0 +1,25 @@
+apiVersion: v1
+kind: Service
+metadata:
+  labels:
+    app.kubernetes.io/component: object-store-gateway
+    app.kubernetes.io/instance: thanos-store-0
+    app.kubernetes.io/name: thanos-store
+    app.kubernetes.io/version: v0.30.2
+    store.thanos.io/shard: shard-0
+  name: thanos-store-0
+  namespace: thanos
+spec:
+  clusterIP: None
+  ports:
+  - name: grpc
+    port: 10901
+    targetPort: 10901
+  - name: http
+    port: 10902
+    targetPort: 10902
+  selector:
+    app.kubernetes.io/component: object-store-gateway
+    app.kubernetes.io/instance: thanos-store-0
+    app.kubernetes.io/name: thanos-store
+    store.thanos.io/shard: shard-0

examples/all/manifests/thanos-store-shard0-statefulSet.yaml

@@ -0,0 +1,189 @@
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  labels:
+    app.kubernetes.io/component: object-store-gateway
+    app.kubernetes.io/instance: thanos-store-0
+    app.kubernetes.io/name: thanos-store
+    app.kubernetes.io/version: v0.30.2
+    store.thanos.io/shard: shard-0
+  name: thanos-store-0
+  namespace: thanos
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/component: object-store-gateway
+      app.kubernetes.io/instance: thanos-store-0
+      app.kubernetes.io/name: thanos-store
+      store.thanos.io/shard: shard-0
+  serviceName: thanos-store-0
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/component: object-store-gateway
+        app.kubernetes.io/instance: thanos-store-0
+        app.kubernetes.io/name: thanos-store
+        app.kubernetes.io/version: v0.30.2
+        store.thanos.io/shard: shard-0
+    spec:
+      affinity:
+        podAntiAffinity:
+          preferredDuringSchedulingIgnoredDuringExecution:
+          - podAffinityTerm:
+              labelSelector:
+                matchExpressions:
+                - key: app.kubernetes.io/name
+                  operator: In
+                  values:
+                  - thanos-store
+                - key: app.kubernetes.io/instance
+                  operator: In
+                  values:
+                  - thanos-store-0
+              namespaces:
+              - thanos
+              topologyKey: kubernetes.io/hostname
+            weight: 100
+      containers:
+      - args:
+        - store
+        - --log.level=info
+        - --log.format=logfmt
+        - --data-dir=/var/thanos/store
+        - --grpc-address=0.0.0.0:10901
+        - --http-address=0.0.0.0:10902
+        - --objstore.config=$(OBJSTORE_CONFIG)
+        - --ignore-deletion-marks-delay=24h
+        - |-
+          --index-cache.config="config":
+            "addresses":
+            - "dnssrv+_client._tcp.<MEMCACHED_SERVICE>.thanos.svc.cluster.local"
+            "dns_provider_update_interval": "10s"
+            "max_async_buffer_size": 10000
+            "max_async_concurrency": 20
+            "max_get_multi_batch_size": 0
+            "max_get_multi_concurrency": 100
+            "max_idle_connections": 100
+            "max_item_size": "1MiB"
+            "timeout": "500ms"
+          "type": "memcached"
+        - |-
+          --store.caching-bucket.config="blocks_iter_ttl": "5m"
+          "chunk_object_attrs_ttl": "24h"
+          "chunk_subrange_size": 16000
+          "chunk_subrange_ttl": "24h"
+          "config":
+            "addresses":
+            - "dnssrv+_client._tcp.<MEMCACHED_SERVICE>.thanos.svc.cluster.local"
+            "dns_provider_update_interval": "10s"
+            "max_async_buffer_size": 10000
+            "max_async_concurrency": 20
+            "max_get_multi_batch_size": 0
+            "max_get_multi_concurrency": 100
+            "max_idle_connections": 100
+            "max_item_size": "1MiB"
+            "timeout": "500ms"
+          "max_chunks_get_range_requests": 3
+          "metafile_content_ttl": "24h"
+          "metafile_doesnt_exist_ttl": "15m"
+          "metafile_exists_ttl": "2h"
+          "metafile_max_size": "1MiB"
+          "type": "memcached"
+        - |-
+          --tracing.config="config":
+            "sampler_param": 2
+            "sampler_type": "ratelimiting"
+            "service_name": "thanos-store"
+          "type": "JAEGER"
+        - |
+          --selector.relabel-config=
+            - action: hashmod
+              source_labels: ["__block_id"]
+              target_label: shard
+              modulus: 3
+            - action: keep
+              source_labels: ["shard"]
+              regex: 0
+        env:
+        - name: OBJSTORE_CONFIG
+          valueFrom:
+            secretKeyRef:
+              key: thanos.yaml
+              name: thanos-objectstorage
+        - name: HOST_IP_ADDRESS
+          valueFrom:
+            fieldRef:
+              fieldPath: status.hostIP
+        image: quay.io/thanos/thanos:v0.30.2
+        imagePullPolicy: IfNotPresent
+        livenessProbe:
+          failureThreshold: 8
+          httpGet:
+            path: /-/healthy
+            port: 10902
+            scheme: HTTP
+          periodSeconds: 30
+          timeoutSeconds: 1
+        name: thanos-store
+        ports:
+        - containerPort: 10901
+          name: grpc
+        - containerPort: 10902
+          name: http
+        readinessProbe:
+          failureThreshold: 20
+          httpGet:
+            path: /-/ready
+            port: 10902
+            scheme: HTTP
+          periodSeconds: 5
+        resources:
+          limits:
+            cpu: 0.42
+            memory: 420Mi
+          requests:
+            cpu: 0.123
+            memory: 123Mi
+        securityContext:
+          allowPrivilegeEscalation: false
+          capabilities:
+            drop:
+            - ALL
+          readOnlyRootFilesystem: true
+          runAsGroup: 65532
+          runAsNonRoot: true
+          runAsUser: 65534
+          seccompProfile:
+            type: RuntimeDefault
+        terminationMessagePolicy: FallbackToLogsOnError
+        volumeMounts:
+        - mountPath: /var/thanos/store
+          name: data
+          readOnly: false
+      nodeSelector:
+        kubernetes.io/os: linux
+      securityContext:
+        fsGroup: 65534
+        runAsGroup: 65532
+        runAsNonRoot: true
+        runAsUser: 65534
+        seccompProfile:
+          type: RuntimeDefault
+      serviceAccountName: thanos-store
+      terminationGracePeriodSeconds: 120
+      volumes: []
+  volumeClaimTemplates:
+  - metadata:
+      labels:
+        app.kubernetes.io/component: object-store-gateway
+        app.kubernetes.io/instance: thanos-store-0
+        app.kubernetes.io/name: thanos-store
+        store.thanos.io/shard: shard-0
+      name: data
+    spec:
+      accessModes:
+      - ReadWriteOnce
+      resources:
+        requests:
+          storage: 10Gi

examples/all/manifests/thanos-store-shard1-service.yaml

@@ -0,0 +1,25 @@
+apiVersion: v1
+kind: Service
+metadata:
+  labels:
+    app.kubernetes.io/component: object-store-gateway
+    app.kubernetes.io/instance: thanos-store-1
+    app.kubernetes.io/name: thanos-store
+    app.kubernetes.io/version: v0.30.2
+    store.thanos.io/shard: shard-1
+  name: thanos-store-1
+  namespace: thanos
+spec:
+  clusterIP: None
+  ports:
+  - name: grpc
+    port: 10901
+    targetPort: 10901
+  - name: http
+    port: 10902
+    targetPort: 10902
+  selector:
+    app.kubernetes.io/component: object-store-gateway
+    app.kubernetes.io/instance: thanos-store-1
+    app.kubernetes.io/name: thanos-store
+    store.thanos.io/shard: shard-1

examples/all/manifests/thanos-store-shard1-statefulSet.yaml

@@ -0,0 +1,189 @@
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  labels:
+    app.kubernetes.io/component: object-store-gateway
+    app.kubernetes.io/instance: thanos-store-1
+    app.kubernetes.io/name: thanos-store
+    app.kubernetes.io/version: v0.30.2
+    store.thanos.io/shard: shard-1
+  name: thanos-store-1
+  namespace: thanos
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/component: object-store-gateway
+      app.kubernetes.io/instance: thanos-store-1
+      app.kubernetes.io/name: thanos-store
+      store.thanos.io/shard: shard-1
+  serviceName: thanos-store-1
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/component: object-store-gateway
+        app.kubernetes.io/instance: thanos-store-1
+        app.kubernetes.io/name: thanos-store
+        app.kubernetes.io/version: v0.30.2
+        store.thanos.io/shard: shard-1
+    spec:
+      affinity:
+        podAntiAffinity:
+          preferredDuringSchedulingIgnoredDuringExecution:
+          - podAffinityTerm:
+              labelSelector:
+                matchExpressions:
+                - key: app.kubernetes.io/name
+                  operator: In
+                  values:
+                  - thanos-store
+                - key: app.kubernetes.io/instance
+                  operator: In
+                  values:
+                  - thanos-store-1
+              namespaces:
+              - thanos
+              topologyKey: kubernetes.io/hostname
+            weight: 100
+      containers:
+      - args:
+        - store
+        - --log.level=info
+        - --log.format=logfmt
+        - --data-dir=/var/thanos/store
+        - --grpc-address=0.0.0.0:10901
+        - --http-address=0.0.0.0:10902
+        - --objstore.config=$(OBJSTORE_CONFIG)
+        - --ignore-deletion-marks-delay=24h
+        - |-
+          --index-cache.config="config":
+            "addresses":
+            - "dnssrv+_client._tcp.<MEMCACHED_SERVICE>.thanos.svc.cluster.local"
+            "dns_provider_update_interval": "10s"
+            "max_async_buffer_size": 10000
+            "max_async_concurrency": 20
+            "max_get_multi_batch_size": 0
+            "max_get_multi_concurrency": 100
+            "max_idle_connections": 100
+            "max_item_size": "1MiB"
+            "timeout": "500ms"
+          "type": "memcached"
+        - |-
+          --store.caching-bucket.config="blocks_iter_ttl": "5m"
+          "chunk_object_attrs_ttl": "24h"
+          "chunk_subrange_size": 16000
+          "chunk_subrange_ttl": "24h"
+          "config":
+            "addresses":
+            - "dnssrv+_client._tcp.<MEMCACHED_SERVICE>.thanos.svc.cluster.local"
+            "dns_provider_update_interval": "10s"
+            "max_async_buffer_size": 10000
+            "max_async_concurrency": 20
+            "max_get_multi_batch_size": 0
+            "max_get_multi_concurrency": 100
+            "max_idle_connections": 100
+            "max_item_size": "1MiB"
+            "timeout": "500ms"
+          "max_chunks_get_range_requests": 3
+          "metafile_content_ttl": "24h"
+          "metafile_doesnt_exist_ttl": "15m"
+          "metafile_exists_ttl": "2h"
+          "metafile_max_size": "1MiB"
+          "type": "memcached"
+        - |-
+          --tracing.config="config":
+            "sampler_param": 2
+            "sampler_type": "ratelimiting"
+            "service_name": "thanos-store"
+          "type": "JAEGER"
+        - |
+          --selector.relabel-config=
+            - action: hashmod
+              source_labels: ["__block_id"]
+              target_label: shard
+              modulus: 3
+            - action: keep
+              source_labels: ["shard"]
+              regex: 1
+        env:
+        - name: OBJSTORE_CONFIG
+          valueFrom:
+            secretKeyRef:
+              key: thanos.yaml
+              name: thanos-objectstorage
+        - name: HOST_IP_ADDRESS
+          valueFrom:
+            fieldRef:
+              fieldPath: status.hostIP
+        image: quay.io/thanos/thanos:v0.30.2
+        imagePullPolicy: IfNotPresent
+        livenessProbe:
+          failureThreshold: 8
+          httpGet:
+            path: /-/healthy
+            port: 10902
+            scheme: HTTP
+          periodSeconds: 30
+          timeoutSeconds: 1
+        name: thanos-store
+        ports:
+        - containerPort: 10901
+          name: grpc
+        - containerPort: 10902
+          name: http
+        readinessProbe:
+          failureThreshold: 20
+          httpGet:
+            path: /-/ready
+            port: 10902
+            scheme: HTTP
+          periodSeconds: 5
+        resources:
+          limits:
+            cpu: 0.42
+            memory: 420Mi
+          requests:
+            cpu: 0.123
+            memory: 123Mi
+        securityContext:
+          allowPrivilegeEscalation: false
+          capabilities:
+            drop:
+            - ALL
+          readOnlyRootFilesystem: true
+          runAsGroup: 65532
+          runAsNonRoot: true
+          runAsUser: 65534
+          seccompProfile:
+            type: RuntimeDefault
+        terminationMessagePolicy: FallbackToLogsOnError
+        volumeMounts:
+        - mountPath: /var/thanos/store
+          name: data
+          readOnly: false
+      nodeSelector:
+        kubernetes.io/os: linux
+      securityContext:
+        fsGroup: 65534
+        runAsGroup: 65532
+        runAsNonRoot: true
+        runAsUser: 65534
+        seccompProfile:
+          type: RuntimeDefault
+      serviceAccountName: thanos-store
+      terminationGracePeriodSeconds: 120
+      volumes: []
+  volumeClaimTemplates:
+  - metadata:
+      labels:
+        app.kubernetes.io/component: object-store-gateway
+        app.kubernetes.io/instance: thanos-store-1
+        app.kubernetes.io/name: thanos-store
+        store.thanos.io/shard: shard-1
+      name: data
+    spec:
+      accessModes:
+      - ReadWriteOnce
+      resources:
+        requests:
+          storage: 10Gi

examples/all/manifests/thanos-store-shard2-service.yaml

@@ -0,0 +1,25 @@
+apiVersion: v1
+kind: Service
+metadata:
+  labels:
+    app.kubernetes.io/component: object-store-gateway
+    app.kubernetes.io/instance: thanos-store-2
+    app.kubernetes.io/name: thanos-store
+    app.kubernetes.io/version: v0.30.2
+    store.thanos.io/shard: shard-2
+  name: thanos-store-2
+  namespace: thanos
+spec:
+  clusterIP: None
+  ports:
+  - name: grpc
+    port: 10901
+    targetPort: 10901
+  - name: http
+    port: 10902
+    targetPort: 10902
+  selector:
+    app.kubernetes.io/component: object-store-gateway
+    app.kubernetes.io/instance: thanos-store-2
+    app.kubernetes.io/name: thanos-store
+    store.thanos.io/shard: shard-2

examples/all/manifests/thanos-store-shard2-statefulSet.yaml

@@ -0,0 +1,189 @@
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  labels:
+    app.kubernetes.io/component: object-store-gateway
+    app.kubernetes.io/instance: thanos-store-2
+    app.kubernetes.io/name: thanos-store
+    app.kubernetes.io/version: v0.30.2
+    store.thanos.io/shard: shard-2
+  name: thanos-store-2
+  namespace: thanos
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/component: object-store-gateway
+      app.kubernetes.io/instance: thanos-store-2
+      app.kubernetes.io/name: thanos-store
+      store.thanos.io/shard: shard-2
+  serviceName: thanos-store-2
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/component: object-store-gateway
+        app.kubernetes.io/instance: thanos-store-2
+        app.kubernetes.io/name: thanos-store
+        app.kubernetes.io/version: v0.30.2
+        store.thanos.io/shard: shard-2
+    spec:
+      affinity:
+        podAntiAffinity:
+          preferredDuringSchedulingIgnoredDuringExecution:
+          - podAffinityTerm:
+              labelSelector:
+                matchExpressions:
+                - key: app.kubernetes.io/name
+                  operator: In
+                  values:
+                  - thanos-store
+                - key: app.kubernetes.io/instance
+                  operator: In
+                  values:
+                  - thanos-store-2
+              namespaces:
+              - thanos
+              topologyKey: kubernetes.io/hostname
+            weight: 100
+      containers:
+      - args:
+        - store
+        - --log.level=info
+        - --log.format=logfmt
+        - --data-dir=/var/thanos/store
+        - --grpc-address=0.0.0.0:10901
+        - --http-address=0.0.0.0:10902
+        - --objstore.config=$(OBJSTORE_CONFIG)
+        - --ignore-deletion-marks-delay=24h
+        - |-
+          --index-cache.config="config":
+            "addresses":
+            - "dnssrv+_client._tcp.<MEMCACHED_SERVICE>.thanos.svc.cluster.local"
+            "dns_provider_update_interval": "10s"
+            "max_async_buffer_size": 10000
+            "max_async_concurrency": 20
+            "max_get_multi_batch_size": 0
+            "max_get_multi_concurrency": 100
+            "max_idle_connections": 100
+            "max_item_size": "1MiB"
+            "timeout": "500ms"
+          "type": "memcached"
+        - |-
+          --store.caching-bucket.config="blocks_iter_ttl": "5m"
+          "chunk_object_attrs_ttl": "24h"
+          "chunk_subrange_size": 16000
+          "chunk_subrange_ttl": "24h"
+          "config":
+            "addresses":
+            - "dnssrv+_client._tcp.<MEMCACHED_SERVICE>.thanos.svc.cluster.local"
+            "dns_provider_update_interval": "10s"
+            "max_async_buffer_size": 10000
+            "max_async_concurrency": 20
+            "max_get_multi_batch_size": 0
+            "max_get_multi_concurrency": 100
+            "max_idle_connections": 100
+            "max_item_size": "1MiB"
+            "timeout": "500ms"
+          "max_chunks_get_range_requests": 3
+          "metafile_content_ttl": "24h"
+          "metafile_doesnt_exist_ttl": "15m"
+          "metafile_exists_ttl": "2h"
+          "metafile_max_size": "1MiB"
+          "type": "memcached"
+        - |-
+          --tracing.config="config":
+            "sampler_param": 2
+            "sampler_type": "ratelimiting"
+            "service_name": "thanos-store"
+          "type": "JAEGER"
+        - |
+          --selector.relabel-config=
+            - action: hashmod
+              source_labels: ["__block_id"]
+              target_label: shard
+              modulus: 3
+            - action: keep
+              source_labels: ["shard"]
+              regex: 2
+        env:
+        - name: OBJSTORE_CONFIG
+          valueFrom:
+            secretKeyRef:
+              key: thanos.yaml
+              name: thanos-objectstorage
+        - name: HOST_IP_ADDRESS
+          valueFrom:
+            fieldRef:
+              fieldPath: status.hostIP
+        image: quay.io/thanos/thanos:v0.30.2
+        imagePullPolicy: IfNotPresent
+        livenessProbe:
+          failureThreshold: 8
+          httpGet:
+            path: /-/healthy
+            port: 10902
+            scheme: HTTP
+          periodSeconds: 30
+          timeoutSeconds: 1
+        name: thanos-store
+        ports:
+        - containerPort: 10901
+          name: grpc
+        - containerPort: 10902
+          name: http
+        readinessProbe:
+          failureThreshold: 20
+          httpGet:
+            path: /-/ready
+            port: 10902
+            scheme: HTTP
+          periodSeconds: 5
+        resources:
+          limits:
+            cpu: 0.42
+            memory: 420Mi
+          requests:
+            cpu: 0.123
+            memory: 123Mi
+        securityContext:
+          allowPrivilegeEscalation: false
+          capabilities:
+            drop:
+            - ALL
+          readOnlyRootFilesystem: true
+          runAsGroup: 65532
+          runAsNonRoot: true
+          runAsUser: 65534
+          seccompProfile:
+            type: RuntimeDefault
+        terminationMessagePolicy: FallbackToLogsOnError
+        volumeMounts:
+        - mountPath: /var/thanos/store
+          name: data
+          readOnly: false
+      nodeSelector:
+        kubernetes.io/os: linux
+      securityContext:
+        fsGroup: 65534
+        runAsGroup: 65532
+        runAsNonRoot: true
+        runAsUser: 65534
+        seccompProfile:
+          type: RuntimeDefault
+      serviceAccountName: thanos-store
+      terminationGracePeriodSeconds: 120
+      volumes: []
+  volumeClaimTemplates:
+  - metadata:
+      labels:
+        app.kubernetes.io/component: object-store-gateway
+        app.kubernetes.io/instance: thanos-store-2
+        app.kubernetes.io/name: thanos-store
+        store.thanos.io/shard: shard-2
+      name: data
+    spec:
+      accessModes:
+      - ReadWriteOnce
+      resources:
+        requests:
+          storage: 10Gi

examples/all/manifests/thanos-store-shards-serviceAccount.yaml

@@ -0,0 +1,11 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  annotations: {}
+  labels:
+    app.kubernetes.io/component: object-store-gateway
+    app.kubernetes.io/instance: thanos-store
+    app.kubernetes.io/name: thanos-store
+    app.kubernetes.io/version: v0.30.2
+  name: thanos-store
+  namespace: thanos

examples/all/manifests/thanos-store-shards-serviceMonitor.yaml

@@ -0,0 +1,30 @@
+apiVersion: monitoring.coreos.com/v1
+kind: ServiceMonitor
+metadata:
+  labels:
+    app.kubernetes.io/component: object-store-gateway
+    app.kubernetes.io/instance: thanos-store
+    app.kubernetes.io/name: thanos-store
+    app.kubernetes.io/version: v0.30.2
+  name: thanos-store
+  namespace: thanos
+spec:
+  endpoints:
+  - port: http
+    relabelings:
+    - action: replace
+      separator: /
+      sourceLabels:
+      - namespace
+      - pod
+      targetLabel: instance
+    - action: replace
+      regex: shard\-(\d+)
+      replacement: $1
+      sourceLabels:
+      - __meta_kubernetes_service_label_store_thanos_io_shard
+      targetLabel: shard
+  selector:
+    matchLabels:
+      app.kubernetes.io/component: object-store-gateway
+      app.kubernetes.io/name: thanos-store

examples/all/manifests/thanos-store-statefulSet-with-memcached.yaml

@@ -1,94 +0,0 @@
-apiVersion: apps/v1
-kind: StatefulSet
-metadata:
-  labels:
-    app.kubernetes.io/component: object-store-gateway
-    app.kubernetes.io/instance: thanos-store
-    app.kubernetes.io/name: thanos-store
-    app.kubernetes.io/version: v0.12.0
-  name: thanos-store
-  namespace: thanos
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app.kubernetes.io/component: object-store-gateway
-      app.kubernetes.io/instance: thanos-store
-      app.kubernetes.io/name: thanos-store
-  serviceName: thanos-store
-  template:
-    metadata:
-      labels:
-        app.kubernetes.io/component: object-store-gateway
-        app.kubernetes.io/instance: thanos-store
-        app.kubernetes.io/name: thanos-store
-        app.kubernetes.io/version: v0.12.0
-    spec:
-      containers:
-      - args:
-        - store
-        - --data-dir=/var/thanos/store
-        - --grpc-address=0.0.0.0:10901
-        - --http-address=0.0.0.0:10902
-        - --objstore.config=$(OBJSTORE_CONFIG)
-        - --experimental.enable-index-cache-postings-compression
-        - |-
-          --index-cache.config="config":
-            "addresses":
-            - "dnssrv+_client._tcp.<MEMCACHED_SERCIVE>.thanos.svc.cluster.local"
-            "dns_provider_update_interval": "10s"
-            "max_async_buffer_size": 10000
-            "max_async_concurrency": 20
-            "max_get_multi_batch_size": 0
-            "max_get_multi_concurrency": 100
-            "max_idle_connections": 100
-            "max_item_size": "1MiB"
-            "timeout": "500ms"
-          "type": "MEMCACHED"
-        env:
-        - name: OBJSTORE_CONFIG
-          valueFrom:
-            secretKeyRef:
-              key: thanos.yaml
-              name: thanos-objectstorage
-        image: quay.io/thanos/thanos:v0.12.0
-        livenessProbe:
-          failureThreshold: 8
-          httpGet:
-            path: /-/healthy
-            port: 10902
-            scheme: HTTP
-          periodSeconds: 30
-        name: thanos-store
-        ports:
-        - containerPort: 10901
-          name: grpc
-        - containerPort: 10902
-          name: http
-        readinessProbe:
-          failureThreshold: 20
-          httpGet:
-            path: /-/ready
-            port: 10902
-            scheme: HTTP
-          periodSeconds: 5
-        terminationMessagePolicy: FallbackToLogsOnError
-        volumeMounts:
-        - mountPath: /var/thanos/store
-          name: data
-          readOnly: false
-      terminationGracePeriodSeconds: 120
-      volumes: []
-  volumeClaimTemplates:
-  - metadata:
-      labels:
-        app.kubernetes.io/component: object-store-gateway
-        app.kubernetes.io/instance: thanos-store
-        app.kubernetes.io/name: thanos-store
-      name: data
-    spec:
-      accessModes:
-      - ReadWriteOnce
-      resources:
-        requests:
-          storage: 10Gi

examples/all/manifests/thanos-store-statefulSet.yaml

@@ -5,7 +5,7 @@ metadata:
     app.kubernetes.io/component: object-store-gateway
     app.kubernetes.io/instance: thanos-store
     app.kubernetes.io/name: thanos-store
-    app.kubernetes.io/version: v0.12.0
+    app.kubernetes.io/version: v0.30.2
   name: thanos-store
   namespace: thanos
 spec:
@@ -22,22 +22,89 @@ spec:
         app.kubernetes.io/component: object-store-gateway
         app.kubernetes.io/instance: thanos-store
         app.kubernetes.io/name: thanos-store
-        app.kubernetes.io/version: v0.12.0
+        app.kubernetes.io/version: v0.30.2
     spec:
+      affinity:
+        podAntiAffinity:
+          preferredDuringSchedulingIgnoredDuringExecution:
+          - podAffinityTerm:
+              labelSelector:
+                matchExpressions:
+                - key: app.kubernetes.io/name
+                  operator: In
+                  values:
+                  - thanos-store
+                - key: app.kubernetes.io/instance
+                  operator: In
+                  values:
+                  - thanos-store
+              namespaces:
+              - thanos
+              topologyKey: kubernetes.io/hostname
+            weight: 100
       containers:
       - args:
         - store
+        - --log.level=info
+        - --log.format=logfmt
         - --data-dir=/var/thanos/store
         - --grpc-address=0.0.0.0:10901
         - --http-address=0.0.0.0:10902
         - --objstore.config=$(OBJSTORE_CONFIG)
+        - --ignore-deletion-marks-delay=24h
+        - |-
+          --index-cache.config="config":
+            "addresses":
+            - "dnssrv+_client._tcp.<MEMCACHED_SERVICE>.thanos.svc.cluster.local"
+            "dns_provider_update_interval": "10s"
+            "max_async_buffer_size": 10000
+            "max_async_concurrency": 20
+            "max_get_multi_batch_size": 0
+            "max_get_multi_concurrency": 100
+            "max_idle_connections": 100
+            "max_item_size": "1MiB"
+            "timeout": "500ms"
+          "type": "memcached"
+        - |-
+          --store.caching-bucket.config="blocks_iter_ttl": "5m"
+          "chunk_object_attrs_ttl": "24h"
+          "chunk_subrange_size": 16000
+          "chunk_subrange_ttl": "24h"
+          "config":
+            "addresses":
+            - "dnssrv+_client._tcp.<MEMCACHED_SERVICE>.thanos.svc.cluster.local"
+            "dns_provider_update_interval": "10s"
+            "max_async_buffer_size": 10000
+            "max_async_concurrency": 20
+            "max_get_multi_batch_size": 0
+            "max_get_multi_concurrency": 100
+            "max_idle_connections": 100
+            "max_item_size": "1MiB"
+            "timeout": "500ms"
+          "max_chunks_get_range_requests": 3
+          "metafile_content_ttl": "24h"
+          "metafile_doesnt_exist_ttl": "15m"
+          "metafile_exists_ttl": "2h"
+          "metafile_max_size": "1MiB"
+          "type": "memcached"
+        - |-
+          --tracing.config="config":
+            "sampler_param": 2
+            "sampler_type": "ratelimiting"
+            "service_name": "thanos-store"
+          "type": "JAEGER"
         env:
         - name: OBJSTORE_CONFIG
           valueFrom:
             secretKeyRef:
               key: thanos.yaml
               name: thanos-objectstorage
-        image: quay.io/thanos/thanos:v0.12.0
+        - name: HOST_IP_ADDRESS
+          valueFrom:
+            fieldRef:
+              fieldPath: status.hostIP
+        image: quay.io/thanos/thanos:v0.30.2
+        imagePullPolicy: IfNotPresent
         livenessProbe:
           failureThreshold: 8
           httpGet:
@@ -45,6 +112,7 @@ spec:
             port: 10902
             scheme: HTTP
           periodSeconds: 30
+          timeoutSeconds: 1
         name: thanos-store
         ports:
         - containerPort: 10901
@@ -58,11 +126,39 @@ spec:
             port: 10902
             scheme: HTTP
           periodSeconds: 5
+        resources:
+          limits:
+            cpu: 0.42
+            memory: 420Mi
+          requests:
+            cpu: 0.123
+            memory: 123Mi
+        securityContext:
+          allowPrivilegeEscalation: false
+          capabilities:
+            drop:
+            - ALL
+          readOnlyRootFilesystem: true
+          runAsGroup: 65532
+          runAsNonRoot: true
+          runAsUser: 65534
+          seccompProfile:
+            type: RuntimeDefault
         terminationMessagePolicy: FallbackToLogsOnError
         volumeMounts:
         - mountPath: /var/thanos/store
           name: data
           readOnly: false
+      nodeSelector:
+        kubernetes.io/os: linux
+      securityContext:
+        fsGroup: 65534
+        runAsGroup: 65532
+        runAsNonRoot: true
+        runAsUser: 65534
+        seccompProfile:
+          type: RuntimeDefault
+      serviceAccountName: thanos-store
       terminationGracePeriodSeconds: 120
       volumes: []
   volumeClaimTemplates:

examples/development-minio/minio-deployment.yaml

@@ -2,6 +2,7 @@ apiVersion: apps/v1
 kind: Deployment
 metadata:
   name: minio
+  namespace: thanos
 spec:
   selector:
     matchLabels:
@@ -14,22 +15,25 @@ spec:
         app.kubernetes.io/name: minio
     spec:
       containers:
-      - name: minio
-        image: minio/minio
-        command:
+      - command:
         - /bin/sh
         - -c
-        - "mkdir -p /storage/thanos && /usr/bin/minio server /storage"
+        - |
+          mkdir -p /storage/thanos && \
+          /usr/bin/docker-entrypoint.sh minio server /storage
         env:
-        - name: MINIO_ACCESS_KEY
-          value: "minio"
-        - name: MINIO_SECRET_KEY
-          value: "minio123"
+        - name: MINIO_ROOT_USER
+          value: minio
+        - name: MINIO_ROOT_PASSWORD
+          value: minio123
+        image: minio/minio:RELEASE.2023-05-27T05-56-19Z
+        imagePullPolicy: IfNotPresent
+        name: minio
         ports:
         - containerPort: 9000
         volumeMounts:
-        - name: storage
-          mountPath: "/storage"
+        - mountPath: /storage
+          name: storage
       volumes:
       - name: storage
         persistentVolumeClaim:

examples/development-minio/minio-pvc.yaml

@@ -1,13 +1,13 @@
 apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
-  name: minio
-  namespace: thanos
   labels:
     app.kubernetes.io/name: minio
+  name: minio
+  namespace: thanos
 spec:
   accessModes:
-    - ReadWriteOnce
+  - ReadWriteOnce
   resources:
     requests:
-      storage: 10Gi
+      storage: 5Gi

examples/development-minio/minio-secret-thanos.yaml

@@ -2,13 +2,14 @@ apiVersion: v1
 kind: Secret
 metadata:
   name: thanos-objectstorage
-type: Opaque
+  namespace: thanos
 stringData:
-  thanos.yaml: |-
+  thanos.yaml: |
     type: s3
     config:
       bucket: thanos
-      endpoint: minio:9000
+      endpoint: minio.thanos.svc.cluster.local:9000
       insecure: true
       access_key: minio
       secret_key: minio123
+type: Opaque

examples/development-minio/minio-service.yaml

@@ -2,11 +2,12 @@ apiVersion: v1
 kind: Service
 metadata:
   name: minio
+  namespace: thanos
 spec:
-  type: ClusterIP
   ports:
-    - port: 9000
-      targetPort: 9000
-      protocol: TCP
+  - port: 9000
+    protocol: TCP
+    targetPort: 9000
   selector:
     app.kubernetes.io/name: minio
+  type: ClusterIP

examples/thanos-receive.jsonnet

@@ -1,13 +1,10 @@
-local k = import 'ksonnet/ksonnet.beta.4/k.libsonnet';
-local sts = k.apps.v1.statefulSet;
-local deployment = k.apps.v1.deployment;
-local t = (import 'kube-thanos/kube-thanos-receive.libsonnet');
+local receive = import 'kube-thanos/kube-thanos-receive.libsonnet';
 
-t.receive {
+receive({
   local tr = self,
   name:: 'thanos-receive',
   namespace:: 'observability',
-  version:: 'v0.12.0-rc.0',
+  version:: 'v0.24.0',
   image:: 'quay.io/thanos/thanos:v' + tr.version,
   replicas:: 3,
   replicationFactor:: 3,
@@ -18,4 +15,4 @@ t.receive {
   pvcTemplate+:: {
     size: '50G',
   },
-}
+})

jsonnet/kube-thanos/jsonnetfile.json

@@ -1,16 +1,5 @@
 {
   "version": 1,
-  "dependencies": [
-    {
-      "source": {
-        "git": {
-          "remote": "https://github.com/ksonnet/ksonnet-lib",
-          "subdir": ""
-        }
-      },
-      "version": "master",
-      "name": "ksonnet"
-    }
-  ],
+  "dependencies": [],
   "legacyImports": true
 }

jsonnet/kube-thanos/jsonnetfile.lock.json

@@ -1,17 +0,0 @@
-{
-  "version": 1,
-  "dependencies": [
-    {
-      "source": {
-        "git": {
-          "remote": "https://github.com/ksonnet/ksonnet-lib",
-          "subdir": ""
-        }
-      },
-      "version": "0d2f82676817bbf9e4acf6495b2090205f323b9f",
-      "sum": "h28BXZ7+vczxYJ2sCt8JuR9+yznRtU/iA6DCpQUrtEg=",
-      "name": "ksonnet"
-    }
-  ],
-  "legacyImports": false
-}

jsonnet/kube-thanos/kube-thanos-bucket-replicate.libsonnet

@@ -0,0 +1,212 @@
+// These are the defaults for this components configuration.
+// When calling the function to generate the component's manifest,
+// you can pass an object structured like the default to overwrite default values.
+local defaults = {
+  local defaults = self,
+  name: 'thanos-bucket-replicate',
+  namespace: error 'must provide namespace',
+  version: error 'must provide version',
+  image: error 'must provide image',
+  imagePullPolicy: 'IfNotPresent',
+  objectStorageConfig: error 'must provide objectStorageConfig',
+  objectStorageToConfig: error 'must provide objectStorageToConfig',  // Destination object store configuration.
+  resources: {},
+  logLevel: 'info',
+  logFormat: 'logfmt',
+  ports: {
+    http: 10902,
+  },
+  tracing: {},
+  minTime: '',
+  maxTime: '',
+  compactionLevels: [],
+  resolutions: [],
+  extraEnv: [],
+
+  commonLabels:: {
+    'app.kubernetes.io/name': 'thanos-bucket-replicate',
+    'app.kubernetes.io/instance': defaults.name,
+    'app.kubernetes.io/version': defaults.version,
+    'app.kubernetes.io/component': 'object-store-bucket-replicate',
+  },
+
+  podLabelSelector:: {
+    [labelName]: defaults.commonLabels[labelName]
+    for labelName in std.objectFields(defaults.commonLabels)
+    if labelName != 'app.kubernetes.io/version'
+  },
+
+  securityContext:: {
+    fsGroup: 65534,
+    runAsUser: 65534,
+    runAsGroup: 65532,
+    runAsNonRoot: true,
+    seccompProfile: { type: 'RuntimeDefault' },
+  },
+  securityContextContainer:: {
+    runAsUser: defaults.securityContext.runAsUser,
+    runAsGroup: defaults.securityContext.runAsGroup,
+    runAsNonRoot: defaults.securityContext.runAsNonRoot,
+    seccompProfile: defaults.securityContext.seccompProfile,
+    allowPrivilegeEscalation: false,
+    readOnlyRootFilesystem: true,
+    capabilities: { drop: ['ALL'] },
+  },
+
+  serviceAccountAnnotations:: {},
+};
+
+function(params) {
+  local tbr = self,
+
+  // Combine the defaults and the passed params to make the component's config.
+  config:: defaults + params,
+  // Safety checks for combined config of defaults and params
+  assert std.isNumber(tbr.config.replicas) && tbr.config.replicas >= 0 : 'thanos bucket replicate replicas has to be number >= 0',
+  assert std.isObject(tbr.config.resources),
+
+  service: {
+    apiVersion: 'v1',
+    kind: 'Service',
+    metadata: {
+      name: tbr.config.name,
+      namespace: tbr.config.namespace,
+      labels: tbr.config.commonLabels,
+    },
+    spec: {
+      ports: [
+        {
+          assert std.isString(name),
+          assert std.isNumber(tbr.config.ports[name]),
+
+          name: name,
+          port: tbr.config.ports[name],
+          targetPort: tbr.config.ports[name],
+        }
+        for name in std.objectFields(tbr.config.ports)
+      ],
+      selector: tbr.config.podLabelSelector,
+    },
+  },
+
+  serviceAccount: {
+    apiVersion: 'v1',
+    kind: 'ServiceAccount',
+    metadata: {
+      name: tbr.config.name,
+      namespace: tbr.config.namespace,
+      labels: tbr.config.commonLabels,
+      annotations: tbr.config.serviceAccountAnnotations,
+    },
+  },
+
+  deployment:
+    local container = {
+      name: 'thanos-bucket-replicate',
+      image: tbr.config.image,
+      imagePullPolicy: tbr.config.imagePullPolicy,
+      args: [
+        'tools',
+        'bucket',
+        'replicate',
+        '--log.level=' + tbr.config.logLevel,
+        '--log.format=' + tbr.config.logFormat,
+        '--objstore.config=$(OBJSTORE_CONFIG)',
+        '--objstore-to.config=$(OBJSTORE_TO_CONFIG)',
+      ] + (
+        if std.length(tbr.config.tracing) > 0 then [
+          '--tracing.config=' + std.manifestYamlDoc(
+            { config+: { service_name: defaults.name } } + tbr.config.tracing
+          ),
+        ] else []
+      ) + (
+        if std.length(tbr.config.minTime) > 0 then [
+          '--min-time=' + tbr.config.minTime,
+        ] else []
+      ) + (
+        if std.length(tbr.config.maxTime) > 0 then [
+          '--max-time=' + tbr.config.maxTime,
+        ] else []
+      ) + (
+        if std.length(tbr.config.compactionLevels) > 0 then [
+          '--compaction=%d' % compactionLevel
+          for compactionLevel in tbr.config.compactionLevels
+        ] else []
+      ) + (
+        if std.length(tbr.config.resolutions) > 0 then [
+          '--resolution=%s' % resolution
+          for resolution in tbr.config.resolutions
+        ] else []
+      ),
+      env: [
+        { name: 'OBJSTORE_CONFIG', valueFrom: { secretKeyRef: {
+          key: tbr.config.objectStorageConfig.key,
+          name: tbr.config.objectStorageConfig.name,
+        } } },
+        { name: 'OBJSTORE_TO_CONFIG', valueFrom: { secretKeyRef: {
+          key: tbr.config.objectStorageToConfig.key,
+          name: tbr.config.objectStorageToConfig.name,
+        } } },
+        {
+          // Inject the host IP to make configuring tracing convenient.
+          name: 'HOST_IP_ADDRESS',
+          valueFrom: {
+            fieldRef: {
+              fieldPath: 'status.hostIP',
+            },
+          },
+        },
+      ] + (
+        if std.length(tbr.config.extraEnv) > 0 then tbr.config.extraEnv else []
+      ),
+      ports: [
+        { name: name, containerPort: tbr.config.ports[name] }
+        for name in std.objectFields(tbr.config.ports)
+      ],
+      livenessProbe: { failureThreshold: 4, periodSeconds: 30, httpGet: {
+        scheme: 'HTTP',
+        port: tbr.config.ports.http,
+        path: '/-/healthy',
+      } },
+      readinessProbe: { failureThreshold: 20, periodSeconds: 5, httpGet: {
+        scheme: 'HTTP',
+        port: tbr.config.ports.http,
+        path: '/-/ready',
+      } },
+      resources: if tbr.config.resources != {} then tbr.config.resources else {},
+      terminationMessagePolicy: 'FallbackToLogsOnError',
+      volumeMounts: if std.objectHas(tbr.config.objectStorageConfig, 'tlsSecretName') && std.length(tbr.config.objectStorageConfig.tlsSecretName) > 0 then [
+        { name: 'tls-secret', mountPath: tbr.config.objectStorageConfig.tlsSecretMountPath },
+      ] else [],
+    };
+
+    {
+      apiVersion: 'apps/v1',
+      kind: 'Deployment',
+      metadata: {
+        name: tbr.config.name,
+        namespace: tbr.config.namespace,
+        labels: tbr.config.commonLabels,
+      },
+      spec: {
+        replicas: 1,
+        selector: { matchLabels: tbr.config.podLabelSelector },
+        template: {
+          metadata: { labels: tbr.config.commonLabels },
+          spec: {
+            serviceAccountName: tbr.serviceAccount.metadata.name,
+            securityContext: tbr.config.securityContext,
+            containers: [container],
+            volumes: if std.objectHas(tbr.config.objectStorageConfig, 'tlsSecretName') && std.length(tbr.config.objectStorageConfig.tlsSecretName) > 0 then [{
+              name: 'tls-secret',
+              secret: { secretName: tbr.config.objectStorageConfig.tlsSecretName },
+            }] else [],
+            terminationGracePeriodSeconds: 120,
+            nodeSelector: {
+              'kubernetes.io/os': 'linux',
+            },
+          },
+        },
+      },
+    },
+}

jsonnet/kube-thanos/kube-thanos-bucket.libsonnet

@@ -1,102 +1,193 @@
-local k = import 'ksonnet/ksonnet.beta.4/k.libsonnet';
+// These are the defaults for this components configuration.
+// When calling the function to generate the component's manifest,
+// you can pass an object structured like the default to overwrite default values.
+local defaults = {
+  local defaults = self,
+  name: 'thanos-bucket',
+  namespace: error 'must provide namespace',
+  version: error 'must provide version',
+  image: error 'must provide image',
+  imagePullPolicy: 'IfNotPresent',
+  objectStorageConfig: error 'must provide objectStorageConfig',
+  resources: {},
+  logLevel: 'info',
+  logFormat: 'logfmt',
+  ports: {
+    http: 10902,
+  },
+  tracing: {},
+  extraEnv: [],
 
-{
+  commonLabels:: {
+    'app.kubernetes.io/name': 'thanos-bucket',
+    'app.kubernetes.io/instance': defaults.name,
+    'app.kubernetes.io/version': defaults.version,
+    'app.kubernetes.io/component': 'object-store-bucket-debugging',
+  },
+
+  podLabelSelector:: {
+    [labelName]: defaults.commonLabels[labelName]
+    for labelName in std.objectFields(defaults.commonLabels)
+    if labelName != 'app.kubernetes.io/version'
+  },
+
+  securityContext:: {
+    fsGroup: 65534,
+    runAsUser: 65534,
+    runAsGroup: 65532,
+    runAsNonRoot: true,
+    seccompProfile: { type: 'RuntimeDefault' },
+  },
+  securityContextContainer:: {
+    runAsUser: defaults.securityContext.runAsUser,
+    runAsGroup: defaults.securityContext.runAsGroup,
+    runAsNonRoot: defaults.securityContext.runAsNonRoot,
+    seccompProfile: defaults.securityContext.seccompProfile,
+    allowPrivilegeEscalation: false,
+    readOnlyRootFilesystem: true,
+    capabilities: { drop: ['ALL'] },
+  },
+
+  serviceAccountAnnotations:: {},
+};
+
+function(params) {
   local tb = self,
 
-  config:: {
-    name: error 'must provide name',
-    namespace: error 'must provide namespace',
-    version: error 'must provide version',
-    image: error 'must provide image',
-    objectStorageConfig: error 'must provide objectStorageConfig',
+  // Combine the defaults and the passed params to make the component's config.
+  config:: defaults + params,
+  // Safety checks for combined config of defaults and params
+  assert std.isNumber(tb.config.replicas) && tb.config.replicas >= 0 : 'thanos bucket replicas has to be number >= 0',
+  assert std.isObject(tb.config.resources),
 
-    commonLabels:: {
-      'app.kubernetes.io/name': 'thanos-bucket',
-      'app.kubernetes.io/instance': tb.config.name,
-      'app.kubernetes.io/version': tb.config.version,
-      'app.kubernetes.io/component': 'object-store-bucket-debugging',
+  service: {
+    apiVersion: 'v1',
+    kind: 'Service',
+    metadata: {
+      name: tb.config.name,
+      namespace: tb.config.namespace,
+      labels: tb.config.commonLabels,
     },
+    spec: {
+      ports: [
+        {
+          assert std.isString(name),
+          assert std.isNumber(tb.config.ports[name]),
 
-    podLabelSelector:: {
-      [labelName]: tb.config.commonLabels[labelName]
-      for labelName in std.objectFields(tb.config.commonLabels)
-      if !std.setMember(labelName, ['app.kubernetes.io/version'])
+          name: name,
+          port: tb.config.ports[name],
+          targetPort: tb.config.ports[name],
+        }
+        for name in std.objectFields(tb.config.ports)
+      ],
+      selector: tb.config.podLabelSelector,
     },
   },
 
-  service:
-    local service = k.core.v1.service;
-    local ports = service.mixin.spec.portsType;
-
-    service.new(
-      tb.config.name,
-      tb.config.podLabelSelector,
-      [ports.newNamed('http', 10902, 'http')],
-    ) +
-    service.mixin.metadata.withNamespace(tb.config.namespace) +
-    service.mixin.metadata.withLabels(tb.config.commonLabels),
+  serviceAccount: {
+    apiVersion: 'v1',
+    kind: 'ServiceAccount',
+    metadata: {
+      name: tb.config.name,
+      namespace: tb.config.namespace,
+      labels: tb.config.commonLabels,
+      annotations: tb.config.serviceAccountAnnotations,
+    },
+  },
 
   deployment:
-    local deployment = k.apps.v1.deployment;
-    local container = deployment.mixin.spec.template.spec.containersType;
-    local containerEnv = container.envType;
-
-    local c =
-      container.new('thanos-bucket', tb.config.image) +
-      container.withTerminationMessagePolicy('FallbackToLogsOnError') +
-      container.withArgs([
+    local container = {
+      name: 'thanos-bucket',
+      image: tb.config.image,
+      imagePullPolicy: tb.config.imagePullPolicy,
+      args: [
+        'tools',
         'bucket',
         'web',
+        '--log.level=' + tb.config.logLevel,
+        '--log.format=' + tb.config.logFormat,
         '--objstore.config=$(OBJSTORE_CONFIG)',
-      ]) +
-      container.withEnv([
-        containerEnv.fromSecretRef(
-          'OBJSTORE_CONFIG',
-          tb.config.objectStorageConfig.name,
-          tb.config.objectStorageConfig.key,
-        ),
-      ]) +
-      container.withPorts([
-        { name: 'http', containerPort: tb.service.spec.ports[0].port },
-      ]) +
-      container.mixin.livenessProbe +
-      container.mixin.livenessProbe.withPeriodSeconds(30) +
-      container.mixin.livenessProbe.withFailureThreshold(4) +
-      container.mixin.livenessProbe.httpGet.withPort(tb.service.spec.ports[0].port) +
-      container.mixin.livenessProbe.httpGet.withScheme('HTTP') +
-      container.mixin.livenessProbe.httpGet.withPath('/-/healthy') +
-      container.mixin.readinessProbe +
-      container.mixin.readinessProbe.withPeriodSeconds(5) +
-      container.mixin.readinessProbe.withFailureThreshold(20) +
-      container.mixin.readinessProbe.httpGet.withPort(tb.service.spec.ports[0].port) +
-      container.mixin.readinessProbe.httpGet.withScheme('HTTP') +
-      container.mixin.readinessProbe.httpGet.withPath('/-/ready');
+      ] + (
+        if std.length(tb.config.tracing) > 0 then [
+          '--tracing.config=' + std.manifestYamlDoc(
+            { config+: { service_name: defaults.name } } + tb.config.tracing
+          ),
+        ] else []
+      ) + (
+        if std.objectHas(tb.config, 'label') then [
+          '--label=' + tb.config.label,
+        ] else []
+      ) + (
+        if std.objectHas(tb.config, 'refresh') then [
+          '--refresh=' + tb.config.refresh,
+        ] else []
+      ),
+      env: [
+        { name: 'OBJSTORE_CONFIG', valueFrom: { secretKeyRef: {
+          key: tb.config.objectStorageConfig.key,
+          name: tb.config.objectStorageConfig.name,
+        } } },
+        {
+          // Inject the host IP to make configuring tracing convenient.
+          name: 'HOST_IP_ADDRESS',
+          valueFrom: {
+            fieldRef: {
+              fieldPath: 'status.hostIP',
+            },
+          },
+        },
+      ] + (
+        if std.length(tb.config.extraEnv) > 0 then tb.config.extraEnv else []
+      ),
+      ports: [
+        { name: name, containerPort: tb.config.ports[name] }
+        for name in std.objectFields(tb.config.ports)
+      ],
+      livenessProbe: { failureThreshold: 4, periodSeconds: 30, httpGet: {
+        scheme: 'HTTP',
+        port: tb.config.ports.http,
+        path: '/-/healthy',
+      } },
+      readinessProbe: { failureThreshold: 20, periodSeconds: 5, httpGet: {
+        scheme: 'HTTP',
+        port: tb.config.ports.http,
+        path: '/-/ready',
+      } },
+      resources: if tb.config.resources != {} then tb.config.resources else {},
+      securityContext: tb.config.securityContextContainer,
+      terminationMessagePolicy: 'FallbackToLogsOnError',
+      volumeMounts: if std.objectHas(tb.config.objectStorageConfig, 'tlsSecretName') && std.length(tb.config.objectStorageConfig.tlsSecretName) > 0 then [
+        { name: 'tls-secret', mountPath: tb.config.objectStorageConfig.tlsSecretMountPath },
+      ] else [],
+    };
 
-    deployment.new(tb.config.name, 1, c, tb.config.commonLabels) +
-    deployment.mixin.metadata.withNamespace(tb.config.namespace) +
-    deployment.mixin.metadata.withLabels(tb.config.commonLabels) +
-    deployment.mixin.spec.selector.withMatchLabels(tb.config.podLabelSelector) +
-    deployment.mixin.spec.template.spec.withTerminationGracePeriodSeconds(120),
-
-  withResources:: {
-    local tb = self,
-    config+:: {
-      resources: error 'must provide resources',
-    },
-
-    deployment+: {
-      spec+: {
-        template+: {
-          spec+: {
-            containers: [
-              if c.name == 'thanos-bucket' then c {
-                resources: tb.config.resources,
-              } else c
-              for c in super.containers
-            ],
+    {
+      apiVersion: 'apps/v1',
+      kind: 'Deployment',
+      metadata: {
+        name: tb.config.name,
+        namespace: tb.config.namespace,
+        labels: tb.config.commonLabels,
+      },
+      spec: {
+        replicas: 1,
+        selector: { matchLabels: tb.config.podLabelSelector },
+        template: {
+          metadata: { labels: tb.config.commonLabels },
+          spec: {
+            serviceAccountName: tb.serviceAccount.metadata.name,
+            securityContext: tb.config.securityContext,
+            containers: [container],
+            volumes: if std.objectHas(tb.config.objectStorageConfig, 'tlsSecretName') && std.length(tb.config.objectStorageConfig.tlsSecretName) > 0 then [{
+              name: 'tls-secret',
+              secret: { secretName: tb.config.objectStorageConfig.tlsSecretName },
+            }] else [],
+            terminationGracePeriodSeconds: 120,
+            nodeSelector: {
+              'kubernetes.io/os': 'linux',
+            },
           },
         },
       },
     },
-  },
 }

jsonnet/kube-thanos/kube-thanos-compact-default-params.libsonnet

@@ -0,0 +1,63 @@
+// These are the defaults for this components configuration.
+// When calling the function to generate the component's manifest,
+// you can pass an object structured like the default to overwrite default values.
+{
+  local defaults = self,
+  name: 'thanos-compact',
+  namespace: error 'must provide namespace',
+  version: error 'must provide version',
+  image: error 'must provide image',
+  imagePullPolicy: 'IfNotPresent',
+  objectStorageConfig: error 'must provide objectStorageConfig',
+  resources: {},
+  logLevel: 'info',
+  logFormat: 'logfmt',
+  serviceMonitor: false,
+  volumeClaimTemplate: {},
+  retentionResolutionRaw: '0d',
+  retentionResolution5m: '0d',
+  retentionResolution1h: '0d',
+  compactConcurrency: 1,
+  deduplicationReplicaLabels: [],
+  deleteDelay: '48h',
+  disableDownsampling: false,
+  downsampleConcurrency: 1,
+  ports: {
+    http: 10902,
+  },
+  tracing: {},
+  extraEnv: [],
+
+  commonLabels:: {
+    'app.kubernetes.io/name': 'thanos-compact',
+    'app.kubernetes.io/instance': defaults.name,
+    'app.kubernetes.io/version': defaults.version,
+    'app.kubernetes.io/component': 'database-compactor',
+  },
+
+  podLabelSelector:: {
+    [labelName]: defaults.commonLabels[labelName]
+    for labelName in std.objectFields(defaults.commonLabels)
+    if labelName != 'app.kubernetes.io/version'
+  },
+
+  securityContext:: {
+    fsGroup: 65534,
+    runAsUser: 65534,
+    runAsGroup: 65532,
+    runAsNonRoot: true,
+    seccompProfile: { type: 'RuntimeDefault' },
+  },
+
+  securityContextContainer:: {
+    runAsUser: defaults.securityContext.runAsUser,
+    runAsGroup: defaults.securityContext.runAsGroup,
+    runAsNonRoot: defaults.securityContext.runAsNonRoot,
+    seccompProfile: defaults.securityContext.seccompProfile,
+    allowPrivilegeEscalation: false,
+    readOnlyRootFilesystem: true,
+    capabilities: { drop: ['ALL'] },
+  },
+
+  serviceAccountAnnotations:: {},
+}

jsonnet/kube-thanos/kube-thanos-compact-shards.libsonnet

@@ -0,0 +1,109 @@
+local compactConfigDefaults = import 'kube-thanos/kube-thanos-compact-default-params.libsonnet';
+local compact = import 'kube-thanos/kube-thanos-compact.libsonnet';
+
+// These are the defaults for this components configuration.
+// When calling the function to generate the component's manifest,
+// you can pass an object structured like the default to overwrite default values.
+local defaults = compactConfigDefaults {
+  shards: 1,
+};
+
+function(params)
+  // Combine the defaults and the passed params to make the component's config.
+  local config = defaults + params;
+
+  // Safety checks for combined config of defaults and params
+  assert std.isNumber(config.shards) && config.shards >= 0 : 'thanos compact shards has to be number >= 0';
+  assert std.isArray(config.sourceLabels) && std.length(config.sourceLabels) > 0;
+
+  { config:: config } + {
+    local allShards = self,
+
+    serviceAccount: {
+      apiVersion: 'v1',
+      kind: 'ServiceAccount',
+      metadata: {
+        name: config.name,
+        namespace: config.namespace,
+        labels: config.commonLabels,
+        annotations: config.serviceAccountAnnotations,
+      },
+    },
+
+    shards: {
+      ['shard' + i]: compact(config {
+        name+: '-%d' % i,
+        commonLabels+:: { 'compact.thanos.io/shard': 'shard-' + i },
+      }) {
+        serviceAccount: null,  // one service account for all compactors
+        serviceMonitor: null,  // one service monitor for all compactors
+
+        statefulSet+: {
+          spec+: {
+            template+: {
+              spec+: {
+                serviceAccountName: allShards.serviceAccount.metadata.name,
+                containers: [
+                  if c.name == 'thanos-compact' then c {
+                    args+: [
+                      |||
+                        --selector.relabel-config=
+                          - action: hashmod
+                            source_labels: %s
+                            target_label: shard
+                            modulus: %d
+                          - action: keep
+                            source_labels: ["shard"]
+                            regex: %d
+                      ||| % [config.sourceLabels, config.shards, i],
+                    ],
+                  } else c
+                  for c in super.containers
+                ],
+              },
+            },
+          },
+        },
+      }
+      for i in std.range(0, config.shards - 1)
+    },
+  } + {
+    serviceMonitor: if config.serviceMonitor == true then {
+      apiVersion: 'monitoring.coreos.com/v1',
+      kind: 'ServiceMonitor',
+      metadata+: {
+        name: config.name,
+        namespace: config.namespace,
+        labels: config.commonLabels,
+      },
+      spec: {
+        selector: {
+          matchLabels: {
+            [key]: config.podLabelSelector[key]
+            for key in std.objectFields(config.podLabelSelector)
+            if key != 'app.kubernetes.io/instance'
+          },
+        },
+        endpoints: [
+          {
+            port: 'http',
+            relabelings: [
+              {
+                action: 'replace',
+                sourceLabels: ['namespace', 'pod'],
+                separator: '/',
+                targetLabel: 'instance',
+              },
+              {
+                action: 'replace',
+                sourceLabels: ['__meta_kubernetes_service_label_compact_thanos_io_shard'],
+                regex: 'shard\\-(\\d+)',
+                replacement: '$1',
+                targetLabel: 'shard',
+              },
+            ],
+          },
+        ],
+      },
+    },
+  }

jsonnet/kube-thanos/kube-thanos-compact.libsonnet

@@ -1,255 +1,214 @@
-local k = import 'ksonnet/ksonnet.beta.4/k.libsonnet';
+local defaults = import 'kube-thanos/kube-thanos-compact-default-params.libsonnet';
 
-{
+function(params) {
   local tc = self,
 
-  config:: {
-    name: error 'must provide name',
-    namespace: error 'must provide namespace',
-    version: error 'must provide version',
-    image: error 'must provide image',
-    objectStorageConfig: error 'must provide objectStorageConfig',
+  // Combine the defaults and the passed params to make the component's config.
+  config:: defaults + params,
+  // Safety checks for combined config of defaults and params
+  assert std.isNumber(tc.config.compactConcurrency),
+  assert std.isNumber(tc.config.downsampleConcurrency),
+  assert std.isNumber(tc.config.replicas) && (tc.config.replicas == 0 || tc.config.replicas == 1) : 'thanos compact replicas can only be 0 or 1',
+  assert std.isObject(tc.config.resources),
+  assert std.isObject(tc.config.volumeClaimTemplate),
+  assert !std.objectHas(tc.config.volumeClaimTemplate, 'spec') || std.assertEqual(tc.config.volumeClaimTemplate.spec.accessModes, ['ReadWriteOnce']) : 'thanos compact PVC accessMode can only be ReadWriteOnce',
+  assert std.isBoolean(tc.config.serviceMonitor),
+  assert std.isArray(tc.config.deduplicationReplicaLabels),
 
-    commonLabels:: {
-      'app.kubernetes.io/name': 'thanos-compact',
-      'app.kubernetes.io/instance': tc.config.name,
-      'app.kubernetes.io/version': tc.config.version,
-      'app.kubernetes.io/component': 'database-compactor',
+  service: {
+    apiVersion: 'v1',
+    kind: 'Service',
+    metadata: {
+      name: tc.config.name,
+      namespace: tc.config.namespace,
+      labels: tc.config.commonLabels,
     },
+    spec: {
+      clusterIP: 'None',
+      selector: tc.config.podLabelSelector,
+      ports: [
+        {
+          assert std.isString(name),
+          assert std.isNumber(tc.config.ports[name]),
 
-    podLabelSelector:: {
-      [labelName]: tc.config.commonLabels[labelName]
-      for labelName in std.objectFields(tc.config.commonLabels)
-      if !std.setMember(labelName, ['app.kubernetes.io/version'])
+          name: name,
+          port: tc.config.ports[name],
+          targetPort: tc.config.ports[name],
+        }
+        for name in std.objectFields(tc.config.ports)
+      ],
     },
   },
 
-  service:
-    local service = k.core.v1.service;
-    local ports = service.mixin.spec.portsType;
-
-    service.new(
-      tc.config.name,
-      tc.config.podLabelSelector,
-      [
-        ports.newNamed('http', 10902, 'http'),
-      ],
-    ) +
-    service.mixin.metadata.withNamespace(tc.config.namespace) +
-    service.mixin.metadata.withLabels(tc.config.commonLabels),
+  serviceAccount: {
+    apiVersion: 'v1',
+    kind: 'ServiceAccount',
+    metadata: {
+      name: tc.config.name,
+      namespace: tc.config.namespace,
+      labels: tc.config.commonLabels,
+      annotations: tc.config.serviceAccountAnnotations,
+    },
+  },
 
   statefulSet:
-    local statefulSet = k.apps.v1.statefulSet;
-    local volume = statefulSet.mixin.spec.template.spec.volumesType;
-    local container = statefulSet.mixin.spec.template.spec.containersType;
-    local containerEnv = container.envType;
-    local containerVolumeMount = container.volumeMountsType;
-
-    local c =
-      container.new('thanos-compact', tc.config.image) +
-      container.withTerminationMessagePolicy('FallbackToLogsOnError') +
-      container.withArgs([
+    local c = {
+      name: 'thanos-compact',
+      image: tc.config.image,
+      imagePullPolicy: tc.config.imagePullPolicy,
+      args: [
         'compact',
         '--wait',
+        '--log.level=' + tc.config.logLevel,
+        '--log.format=' + tc.config.logFormat,
         '--objstore.config=$(OBJSTORE_CONFIG)',
         '--data-dir=/var/thanos/compact',
         '--debug.accept-malformed-index',
-      ]) +
-      container.withEnv([
-        containerEnv.fromSecretRef(
-          'OBJSTORE_CONFIG',
-          tc.config.objectStorageConfig.name,
-          tc.config.objectStorageConfig.key,
-        ),
-      ]) +
-      container.withPorts([
-        { name: 'http', containerPort: tc.service.spec.ports[0].port },
-      ]) +
-      container.withVolumeMounts([
-        containerVolumeMount.new('data', '/var/thanos/compact', false),
-      ]) +
-      container.mixin.livenessProbe +
-      container.mixin.livenessProbe.withPeriodSeconds(30) +
-      container.mixin.livenessProbe.withFailureThreshold(4) +
-      container.mixin.livenessProbe.httpGet.withPort(tc.service.spec.ports[0].port) +
-      container.mixin.livenessProbe.httpGet.withScheme('HTTP') +
-      container.mixin.livenessProbe.httpGet.withPath('/-/healthy') +
-      container.mixin.readinessProbe +
-      container.mixin.readinessProbe.withPeriodSeconds(5) +
-      container.mixin.readinessProbe.withFailureThreshold(20) +
-      container.mixin.readinessProbe.httpGet.withPort(tc.service.spec.ports[0].port) +
-      container.mixin.readinessProbe.httpGet.withScheme('HTTP') +
-      container.mixin.readinessProbe.httpGet.withPath('/-/ready');
+        '--retention.resolution-raw=' + tc.config.retentionResolutionRaw,
+        '--retention.resolution-5m=' + tc.config.retentionResolution5m,
+        '--retention.resolution-1h=' + tc.config.retentionResolution1h,
+        '--delete-delay=' + tc.config.deleteDelay,
+        '--compact.concurrency=' + tc.config.compactConcurrency,
+        '--downsample.concurrency=' + tc.config.downsampleConcurrency,
+      ] + (
+        if tc.config.disableDownsampling then ['--downsampling.disable'] else []
+      ) + (
+        if std.length(tc.config.deduplicationReplicaLabels) > 0 then
+          [
+            '--deduplication.replica-label=' + l
+            for l in tc.config.deduplicationReplicaLabels
+          ] else []
+      ) + (
+        if std.length(tc.config.tracing) > 0 then [
+          '--tracing.config=' + std.manifestYamlDoc(
+            { config+: { service_name: defaults.name } } + tc.config.tracing
+          ),
+        ] else []
+      ),
+      env: [
+        { name: 'OBJSTORE_CONFIG', valueFrom: { secretKeyRef: {
+          key: tc.config.objectStorageConfig.key,
+          name: tc.config.objectStorageConfig.name,
+        } } },
+        {
+          // Inject the host IP to make configuring tracing convenient.
+          name: 'HOST_IP_ADDRESS',
+          valueFrom: {
+            fieldRef: {
+              fieldPath: 'status.hostIP',
+            },
+          },
+        },
+      ] + (
+        if std.length(tc.config.extraEnv) > 0 then tc.config.extraEnv else []
+      ),
+      ports: [
+        { name: name, containerPort: tc.config.ports[name] }
+        for name in std.objectFields(tc.config.ports)
+      ],
+      livenessProbe: { failureThreshold: 4, periodSeconds: 30, httpGet: {
+        scheme: 'HTTP',
+        port: tc.config.ports.http,
+        path: '/-/healthy',
+      } },
+      readinessProbe: { failureThreshold: 20, periodSeconds: 5, httpGet: {
+        scheme: 'HTTP',
+        port: tc.config.ports.http,
+        path: '/-/ready',
+      } },
+      volumeMounts: [{
+        name: 'data',
+        mountPath: '/var/thanos/compact',
+        readOnly: false,
+      }] + (
+        if std.objectHas(tc.config.objectStorageConfig, 'tlsSecretName') && std.length(tc.config.objectStorageConfig.tlsSecretName) > 0 then [
+          { name: 'tls-secret', mountPath: tc.config.objectStorageConfig.tlsSecretMountPath },
+        ] else []
+      ),
+      resources: if tc.config.resources != {} then tc.config.resources else {},
+      terminationMessagePolicy: 'FallbackToLogsOnError',
+    };
 
-    statefulSet.new(tc.config.name, tc.config.replicas, c, [], tc.config.commonLabels) +
-    statefulSet.mixin.metadata.withNamespace(tc.config.namespace) +
-    statefulSet.mixin.metadata.withLabels(tc.config.commonLabels) +
-    statefulSet.mixin.spec.withServiceName(tc.service.metadata.name) +
-    statefulSet.mixin.spec.template.spec.withTerminationGracePeriodSeconds(120) +
-    statefulSet.mixin.spec.template.spec.withVolumes([
-      volume.fromEmptyDir('data'),
-    ]) +
-    statefulSet.mixin.spec.selector.withMatchLabels(tc.config.podLabelSelector) +
     {
-      spec+: {
-        volumeClaimTemplates: null,
-      },
-    },
-
-  withServiceMonitor:: {
-    local tc = self,
-    serviceMonitor: {
-      apiVersion: 'monitoring.coreos.com/v1',
-      kind: 'ServiceMonitor',
-      metadata+: {
+      apiVersion: 'apps/v1',
+      kind: 'StatefulSet',
+      metadata: {
         name: tc.config.name,
         namespace: tc.config.namespace,
         labels: tc.config.commonLabels,
       },
       spec: {
-        selector: {
-          matchLabels: tc.config.podLabelSelector,
-        },
-        endpoints: [
-          { port: 'http' },
-        ],
-      },
-    },
-  },
-
-  withVolumeClaimTemplate:: {
-    local tc = self,
-    config+:: {
-      volumeClaimTemplate: error 'must provide volumeClaimTemplate',
-    },
-    statefulSet+: {
-      spec+: {
-        template+: {
-          spec+: {
-            volumes: std.filter(function(v) v.name != 'data', super.volumes),
+        replicas: 1,
+        selector: { matchLabels: tc.config.podLabelSelector },
+        serviceName: tc.service.metadata.name,
+        template: {
+          metadata: {
+            labels: tc.config.commonLabels,
+          },
+          spec: {
+            serviceAccountName: tc.serviceAccount.metadata.name,
+            securityContext: tc.config.securityContext,
+            containers: [c],
+            volumes: if std.objectHas(tc.config.objectStorageConfig, 'tlsSecretName') && std.length(tc.config.objectStorageConfig.tlsSecretName) > 0 then [{
+              name: 'tls-secret',
+              secret: { secretName: tc.config.objectStorageConfig.tlsSecretName },
+            }] else [],
+            terminationGracePeriodSeconds: 120,
+            nodeSelector: {
+              'kubernetes.io/os': 'linux',
+            },
+            affinity: { podAntiAffinity: {
+              preferredDuringSchedulingIgnoredDuringExecution: [{
+                podAffinityTerm: {
+                  namespaces: [tc.config.namespace],
+                  topologyKey: 'kubernetes.io/hostname',
+                  labelSelector: { matchExpressions: [{
+                    key: 'app.kubernetes.io/name',
+                    operator: 'In',
+                    values: [tc.statefulSet.metadata.labels['app.kubernetes.io/name']],
+                  }, {
+                    key: 'app.kubernetes.io/instance',
+                    operator: 'In',
+                    values: [tc.statefulSet.metadata.labels['app.kubernetes.io/instance']],
+                  }] },
+                },
+                weight: 100,
+              }],
+            } },
           },
         },
-        volumeClaimTemplates: [tc.config.volumeClaimTemplate {
+        volumeClaimTemplates: if std.length(tc.config.volumeClaimTemplate) > 0 then [tc.config.volumeClaimTemplate {
           metadata+: {
             name: 'data',
             labels+: tc.config.podLabelSelector,
           },
-        }],
+        }] else [],
       },
     },
-  },
 
-  withRetention:: {
-    local tc = self,
-    config+:: {
-      retentionResolutionRaw: error 'must provide retentionResolutionRaw',
-      retentionResolution5m: error 'must provide retentionResolution5m',
-      retentionResolution1h: error 'must provide retentionResolution1h',
+  serviceMonitor: if tc.config.serviceMonitor == true then {
+    apiVersion: 'monitoring.coreos.com/v1',
+    kind: 'ServiceMonitor',
+    metadata+: {
+      name: tc.config.name,
+      namespace: tc.config.namespace,
+      labels: tc.config.commonLabels,
     },
-
-    statefulSet+: {
-      spec+: {
-        template+: {
-          spec+: {
-            containers: [
-              if c.name == 'thanos-compact' then c {
-                args+: [
-                  '--retention.resolution-raw=' + tc.config.retentionResolutionRaw,
-                  '--retention.resolution-5m=' + tc.config.retentionResolution5m,
-                  '--retention.resolution-1h=' + tc.config.retentionResolution1h,
-                ],
-              } else c
-              for c in super.containers
-            ],
-          },
+    spec: {
+      selector: {
+        matchLabels: tc.config.podLabelSelector,
+      },
+      endpoints: [
+        {
+          port: 'http',
+          relabelings: [{
+            action: 'replace',
+            sourceLabels: ['namespace', 'pod'],
+            separator: '/',
+            targetLabel: 'instance',
+          }],
         },
-      },
-    },
-  },
-
-  withDownsamplingDisabled:: {
-    local tc = self,
-
-    statefulSet+: {
-      spec+: {
-        template+: {
-          spec+: {
-            containers: [
-              if c.name == 'thanos-compact' then c {
-                args+: [
-                  '--downsampling.disable',
-                ],
-              } else c
-              for c in super.containers
-            ],
-          },
-        },
-      },
-    },
-  },
-
-  withDeduplication:: {
-    local tc = self,
-
-    statefulSet+: {
-      spec+: {
-        template+: {
-          spec+: {
-            containers: [
-              if c.name == 'thanos-compact' then c {
-                args+: [
-                  '--deduplication.replica-label=' + l
-                  for l in tc.config.deduplicationReplicaLabels
-                ],
-              } else c
-              for c in super.containers
-            ],
-          },
-        },
-      },
-    },
-  },
-
-  withDeleteDelay:: {
-    local tc = self,
-
-    statefulSet+: {
-      spec+: {
-        template+: {
-          spec+: {
-            containers: [
-              if c.name == 'thanos-compact' then c {
-                args+: [
-                  '--delete-delay=' + tc.config.deleteDelay,
-                ],
-              } else c
-              for c in super.containers
-            ],
-          },
-        },
-      },
-    },
-  },
-
-  withResources:: {
-    local tc = self,
-    config+:: {
-      resources: error 'must provide resources',
-    },
-
-    statefulSet+: {
-      spec+: {
-        template+: {
-          spec+: {
-            containers: [
-              if c.name == 'thanos-compact' then c {
-                resources: tc.config.resources,
-              } else c
-              for c in super.containers
-            ],
-          },
-        },
-      },
+      ],
     },
   },
 }

jsonnet/kube-thanos/kube-thanos-query-frontend.libsonnet

@@ -0,0 +1,293 @@
+// These are the defaults for this components configuration.
+// When calling the function to generate the component's manifest,
+// you can pass an object structured like the default to overwrite default values.
+local defaults = {
+  local defaults = self,
+  name: 'thanos-query-frontend',
+  namespace: error 'must provide namespace',
+  version: error 'must provide version',
+  image: error 'must provide image',
+  imagePullPolicy: 'IfNotPresent',
+  replicas: error 'must provide replicas',
+  downstreamURL: error 'must provide downstreamURL',
+  splitInterval: '24h',
+  maxRetries: 5,
+  logQueriesLongerThan: '0',
+  fifoCache+:: {
+    config+: {
+      max_size: '0',  // Don't limit maximum item size.
+      max_size_items: 2048,
+      validity: '6h',
+    },
+  },
+  queryRangeCache: {},
+  queryUrl: '',
+  labelsCache: {},
+  logLevel: 'info',
+  logFormat: 'logfmt',
+  resources: {},
+  serviceMonitor: false,
+  ports: {
+    http: 9090,
+  },
+  tracing: {},
+  extraEnv: [],
+
+  memcachedDefaults+:: {
+    config+: {
+      // List of memcached addresses, that will get resolved with the DNS service discovery provider.
+      // For DNS service discovery reference https://thanos.io/service-discovery.md/#dns-service-discovery
+      addresses+: error 'must provide memcached addresses',
+      timeout: '500ms',
+      max_idle_connections: 100,
+      max_async_concurrency: 20,
+      max_async_buffer_size: 10000,
+      max_get_multi_concurrency: 100,
+      max_get_multi_batch_size: 0,
+      dns_provider_update_interval: '10s',
+    },
+  },
+
+  commonLabels:: {
+    'app.kubernetes.io/name': 'thanos-query-frontend',
+    'app.kubernetes.io/instance': defaults.name,
+    'app.kubernetes.io/version': defaults.version,
+    'app.kubernetes.io/component': 'query-cache',
+  },
+
+  podLabelSelector:: {
+    [labelName]: defaults.commonLabels[labelName]
+    for labelName in std.objectFields(defaults.commonLabels)
+    if labelName != 'app.kubernetes.io/version'
+  },
+
+  securityContext:: {
+    fsGroup: 65534,
+    runAsUser: 65534,
+    runAsGroup: 65532,
+    runAsNonRoot: true,
+    seccompProfile: { type: 'RuntimeDefault' },
+  },
+
+  securityContextContainer:: {
+    runAsUser: defaults.securityContext.runAsUser,
+    runAsGroup: defaults.securityContext.runAsGroup,
+    runAsNonRoot: defaults.securityContext.runAsNonRoot,
+    seccompProfile: defaults.securityContext.seccompProfile,
+    allowPrivilegeEscalation: false,
+    readOnlyRootFilesystem: true,
+    capabilities: { drop: ['ALL'] },
+  },
+
+  serviceAccountAnnotations:: {},
+};
+
+function(params) {
+  local tqf = self,
+
+  // Combine the defaults and the passed params to make the component's config.
+  config:: defaults + params + {
+    queryRangeCache+:
+      if std.objectHas(params, 'queryRangeCache')
+         && std.objectHas(params.queryRangeCache, 'type')
+         && std.asciiUpper(params.queryRangeCache.type) == 'MEMCACHED' then
+
+        defaults.memcachedDefaults + params.queryRangeCache
+      else if std.objectHas(params, 'queryRangeCache')
+              && std.objectHas(params.queryRangeCache, 'type')
+              && std.asciiUpper(params.queryRangeCache.type) == 'IN-MEMORY' then
+
+        defaults.fifoCache + params.queryRangeCache
+      else {},
+    labelsCache+:
+      if std.objectHas(params, 'labelsCache')
+         && std.objectHas(params.labelsCache, 'type')
+         && std.asciiUpper(params.labelsCache.type) == 'MEMCACHED' then
+
+        defaults.memcachedDefaults + params.labelsCache
+      else if std.objectHas(params, 'labelsCache')
+              && std.objectHas(params.labelsCache, 'type')
+              && std.asciiUpper(params.labelsCache.type) == 'IN-MEMORY' then
+
+        defaults.fifoCache + params.labelsCache
+      else {},
+  },
+  // Safety checks for combined config of defaults and params
+  assert std.isNumber(tqf.config.replicas) && tqf.config.replicas >= 0 : 'thanos query frontend replicas has to be number >= 0',
+  assert std.isObject(tqf.config.resources),
+  assert std.isBoolean(tqf.config.serviceMonitor),
+  assert std.isNumber(tqf.config.maxRetries) && tqf.config.maxRetries >= 0 : 'thanos query frontend maxRetries has to be number >= 0',
+
+  service: {
+    apiVersion: 'v1',
+    kind: 'Service',
+    metadata: {
+      name: tqf.config.name,
+      namespace: tqf.config.namespace,
+      labels: tqf.config.commonLabels,
+    },
+    spec: {
+      selector: tqf.config.podLabelSelector,
+      ports: [
+        {
+          assert std.isString(name),
+          assert std.isNumber(tqf.config.ports[name]),
+
+          name: name,
+          port: tqf.config.ports[name],
+          targetPort: tqf.config.ports[name],
+        }
+        for name in std.objectFields(tqf.config.ports)
+      ],
+    },
+  },
+
+  serviceAccount: {
+    apiVersion: 'v1',
+    kind: 'ServiceAccount',
+    metadata: {
+      name: tqf.config.name,
+      namespace: tqf.config.namespace,
+      labels: tqf.config.commonLabels,
+      annotations: tqf.config.serviceAccountAnnotations,
+    },
+  },
+
+  deployment:
+    local c = {
+      name: 'thanos-query-frontend',
+      image: tqf.config.image,
+      imagePullPolicy: tqf.config.imagePullPolicy,
+      args: [
+        'query-frontend',
+        '--log.level=' + tqf.config.logLevel,
+        '--log.format=' + tqf.config.logFormat,
+        '--query-frontend.compress-responses',
+        '--http-address=0.0.0.0:%d' % tqf.config.ports.http,
+        '--query-frontend.downstream-url=%s' % tqf.config.downstreamURL,
+        '--query-range.split-interval=%s' % tqf.config.splitInterval,
+        '--labels.split-interval=%s' % tqf.config.splitInterval,
+        '--query-range.max-retries-per-request=%d' % tqf.config.maxRetries,
+        '--labels.max-retries-per-request=%d' % tqf.config.maxRetries,
+        '--query-frontend.log-queries-longer-than=%s' % tqf.config.logQueriesLongerThan,
+      ] + (
+        if std.length(tqf.config.queryRangeCache) > 0 then [
+          '--query-range.response-cache-config=' + std.manifestYamlDoc(
+            tqf.config.queryRangeCache
+          ),
+        ] else []
+      ) + (
+        if std.length(tqf.config.labelsCache) > 0 then [
+          '--labels.response-cache-config=' + std.manifestYamlDoc(
+            tqf.config.labelsCache
+          ),
+        ] else []
+      ) + (
+        if std.length(tqf.config.tracing) > 0 then [
+          '--tracing.config=' + std.manifestYamlDoc(
+            { config+: { service_name: defaults.name } } + tqf.config.tracing
+          ),
+        ] else []
+      ) + (
+        if tqf.config.queryUrl != '' then [
+          '--alert.query-url=' + tqf.config.queryUrl,
+        ] else []
+      ),
+      env: [
+        {
+          // Inject the host IP to make configuring tracing convenient.
+          name: 'HOST_IP_ADDRESS',
+          valueFrom: {
+            fieldRef: {
+              fieldPath: 'status.hostIP',
+            },
+          },
+        },
+      ] + (
+        if std.length(tqf.config.extraEnv) > 0 then tqf.config.extraEnv else []
+      ),
+      ports: [
+        { name: name, containerPort: tqf.config.ports[name] }
+        for name in std.objectFields(tqf.config.ports)
+      ],
+      livenessProbe: { failureThreshold: 4, periodSeconds: 30, httpGet: {
+        scheme: 'HTTP',
+        port: tqf.config.ports.http,
+        path: '/-/healthy',
+      } },
+      readinessProbe: { failureThreshold: 20, periodSeconds: 5, httpGet: {
+        scheme: 'HTTP',
+        port: tqf.config.ports.http,
+        path: '/-/ready',
+      } },
+      resources: if tqf.config.resources != {} then tqf.config.resources else {},
+      securityContext: tqf.config.securityContextContainer,
+      terminationMessagePolicy: 'FallbackToLogsOnError',
+    };
+
+    {
+      apiVersion: 'apps/v1',
+      kind: 'Deployment',
+      metadata: {
+        name: tqf.config.name,
+        namespace: tqf.config.namespace,
+        labels: tqf.config.commonLabels,
+      },
+      spec: {
+        replicas: tqf.config.replicas,
+        selector: { matchLabels: tqf.config.podLabelSelector },
+        template: {
+          metadata: { labels: tqf.config.commonLabels },
+          spec: {
+            containers: [c],
+            serviceAccountName: tqf.serviceAccount.metadata.name,
+            securityContext: tqf.config.securityContext,
+            terminationGracePeriodSeconds: 120,
+            nodeSelector: {
+              'kubernetes.io/os': 'linux',
+            },
+            affinity: { podAntiAffinity: {
+              preferredDuringSchedulingIgnoredDuringExecution: [{
+                podAffinityTerm: {
+                  namespaces: [tqf.config.namespace],
+                  topologyKey: 'kubernetes.io/hostname',
+                  labelSelector: { matchExpressions: [{
+                    key: 'app.kubernetes.io/name',
+                    operator: 'In',
+                    values: [tqf.deployment.metadata.labels['app.kubernetes.io/name']],
+                  }] },
+                },
+                weight: 100,
+              }],
+            } },
+          },
+        },
+      },
+    },
+
+  serviceMonitor: if tqf.config.serviceMonitor == true then {
+    apiVersion: 'monitoring.coreos.com/v1',
+    kind: 'ServiceMonitor',
+    metadata+: {
+      name: tqf.config.name,
+      namespace: tqf.config.namespace,
+      labels: tqf.config.commonLabels,
+    },
+    spec: {
+      selector: {
+        matchLabels: tqf.config.podLabelSelector,
+      },
+      endpoints: [
+        {
+          port: 'http',
+          relabelings: [{
+            action: 'replace',
+            sourceLabels: ['namespace', 'pod'],
+            separator: '/',
+            targetLabel: 'instance',
+          }],
+        },
+      ],
+    },
+  },
+}