feat(jsonnet): Add queryUrl support (#330)

Signed-off-by: adinhodovic <hodovicadin@gmail.com>

.bingo/.gitignore

@@ -5,6 +5,7 @@
 # But not these files:
 !.gitignore
 !*.mod
+!*.sum
 !README.md
 !Variables.mk
 !variables.env

.bingo/README.md

@@ -5,7 +5,8 @@ This is directory which stores Go modules with pinned buildable package that is
 * Run `bingo get` to install all tools having each own module file in this directory.
 * Run `bingo get <tool>` to install <tool> that have own module file in this directory.
 * For Makefile: Make sure to put `include .bingo/Variables.mk` in your Makefile, then use $(<upper case tool name>) variable where <tool> is the .bingo/<tool>.mod.
-* For shell: Run `source .bingo/variables.env` to source all environment variable for each tool
+* For shell: Run `source .bingo/variables.env` to source all environment variable for each tool.
+* For go: Import `.bingo/variables.go` to for variable names.
 * See https://github.com/bwplotka/bingo or -h on how to add, remove or change binaries dependencies.
 
 ## Requirements

.bingo/Variables.mk

@@ -1,10 +1,11 @@
-# Auto generated binary variables helper managed by https://github.com/bwplotka/bingo v0.2.3. DO NOT EDIT.
+# Auto generated binary variables helper managed by https://github.com/bwplotka/bingo v0.8. DO NOT EDIT.
 # All tools are designed to be build inside $GOBIN.
+BINGO_DIR := $(dir $(lastword $(MAKEFILE_LIST)))
 GOPATH ?= $(shell go env GOPATH)
 GOBIN  ?= $(firstword $(subst :, ,${GOPATH}))/bin
 GO     ?= $(shell which go)
 
-# Bellow generated variables ensure that every time a tool under each variable is invoked, the correct version
+# Below generated variables ensure that every time a tool under each variable is invoked, the correct version
 # will be used; reinstalling only if needed.
 # For example for embedmd variable:
 #
@@ -17,44 +18,44 @@ GO     ?= $(shell which go)
 #	@$(EMBEDMD) <flags/args..>
 #
 EMBEDMD := $(GOBIN)/embedmd-v1.0.0
-$(EMBEDMD): .bingo/embedmd.mod
+$(EMBEDMD): $(BINGO_DIR)/embedmd.mod
 	@# Install binary/ries using Go 1.14+ build command. This is using bwplotka/bingo-controlled, separate go module with pinned dependencies.
 	@echo "(re)installing $(GOBIN)/embedmd-v1.0.0"
-	@cd .bingo && $(GO) build -mod=mod -modfile=embedmd.mod -o=$(GOBIN)/embedmd-v1.0.0 "github.com/campoy/embedmd"
+	@cd $(BINGO_DIR) && GOWORK=off $(GO) build -mod=mod -modfile=embedmd.mod -o=$(GOBIN)/embedmd-v1.0.0 "github.com/campoy/embedmd"
 
 GOJSONTOYAML := $(GOBIN)/gojsontoyaml-v0.0.0-20200602132005-3697ded27e8c
-$(GOJSONTOYAML): .bingo/gojsontoyaml.mod
+$(GOJSONTOYAML): $(BINGO_DIR)/gojsontoyaml.mod
 	@# Install binary/ries using Go 1.14+ build command. This is using bwplotka/bingo-controlled, separate go module with pinned dependencies.
 	@echo "(re)installing $(GOBIN)/gojsontoyaml-v0.0.0-20200602132005-3697ded27e8c"
-	@cd .bingo && $(GO) build -mod=mod -modfile=gojsontoyaml.mod -o=$(GOBIN)/gojsontoyaml-v0.0.0-20200602132005-3697ded27e8c "github.com/brancz/gojsontoyaml"
+	@cd $(BINGO_DIR) && GOWORK=off $(GO) build -mod=mod -modfile=gojsontoyaml.mod -o=$(GOBIN)/gojsontoyaml-v0.0.0-20200602132005-3697ded27e8c "github.com/brancz/gojsontoyaml"
 
 JB := $(GOBIN)/jb-v0.4.0
-$(JB): .bingo/jb.mod
+$(JB): $(BINGO_DIR)/jb.mod
 	@# Install binary/ries using Go 1.14+ build command. This is using bwplotka/bingo-controlled, separate go module with pinned dependencies.
 	@echo "(re)installing $(GOBIN)/jb-v0.4.0"
-	@cd .bingo && $(GO) build -mod=mod -modfile=jb.mod -o=$(GOBIN)/jb-v0.4.0 "github.com/jsonnet-bundler/jsonnet-bundler/cmd/jb"
+	@cd $(BINGO_DIR) && GOWORK=off $(GO) build -mod=mod -modfile=jb.mod -o=$(GOBIN)/jb-v0.4.0 "github.com/jsonnet-bundler/jsonnet-bundler/cmd/jb"
 
-JSONNET_LINT := $(GOBIN)/jsonnet-lint-v0.17.1-0.20210101181740-31d71aaccda6
-$(JSONNET_LINT): .bingo/jsonnet-lint.mod
+JSONNET_LINT := $(GOBIN)/jsonnet-lint-v0.20.0
+$(JSONNET_LINT): $(BINGO_DIR)/jsonnet-lint.mod
 	@# Install binary/ries using Go 1.14+ build command. This is using bwplotka/bingo-controlled, separate go module with pinned dependencies.
-	@echo "(re)installing $(GOBIN)/jsonnet-lint-v0.17.1-0.20210101181740-31d71aaccda6"
-	@cd .bingo && $(GO) build -mod=mod -modfile=jsonnet-lint.mod -o=$(GOBIN)/jsonnet-lint-v0.17.1-0.20210101181740-31d71aaccda6 "github.com/google/go-jsonnet/cmd/jsonnet-lint"
+	@echo "(re)installing $(GOBIN)/jsonnet-lint-v0.20.0"
+	@cd $(BINGO_DIR) && GOWORK=off $(GO) build -mod=mod -modfile=jsonnet-lint.mod -o=$(GOBIN)/jsonnet-lint-v0.20.0 "github.com/google/go-jsonnet/cmd/jsonnet-lint"
 
-JSONNET := $(GOBIN)/jsonnet-v0.17.1-0.20210101181740-31d71aaccda6
-$(JSONNET): .bingo/jsonnet.mod
+JSONNET := $(GOBIN)/jsonnet-v0.20.0
+$(JSONNET): $(BINGO_DIR)/jsonnet.mod
 	@# Install binary/ries using Go 1.14+ build command. This is using bwplotka/bingo-controlled, separate go module with pinned dependencies.
-	@echo "(re)installing $(GOBIN)/jsonnet-v0.17.1-0.20210101181740-31d71aaccda6"
-	@cd .bingo && $(GO) build -mod=mod -modfile=jsonnet.mod -o=$(GOBIN)/jsonnet-v0.17.1-0.20210101181740-31d71aaccda6 "github.com/google/go-jsonnet/cmd/jsonnet"
+	@echo "(re)installing $(GOBIN)/jsonnet-v0.20.0"
+	@cd $(BINGO_DIR) && GOWORK=off $(GO) build -mod=mod -modfile=jsonnet.mod -o=$(GOBIN)/jsonnet-v0.20.0 "github.com/google/go-jsonnet/cmd/jsonnet"
 
-JSONNETFMT := $(GOBIN)/jsonnetfmt-v0.17.1-0.20210101181740-31d71aaccda6
-$(JSONNETFMT): .bingo/jsonnetfmt.mod
+JSONNETFMT := $(GOBIN)/jsonnetfmt-v0.20.0
+$(JSONNETFMT): $(BINGO_DIR)/jsonnetfmt.mod
 	@# Install binary/ries using Go 1.14+ build command. This is using bwplotka/bingo-controlled, separate go module with pinned dependencies.
-	@echo "(re)installing $(GOBIN)/jsonnetfmt-v0.17.1-0.20210101181740-31d71aaccda6"
-	@cd .bingo && $(GO) build -mod=mod -modfile=jsonnetfmt.mod -o=$(GOBIN)/jsonnetfmt-v0.17.1-0.20210101181740-31d71aaccda6 "github.com/google/go-jsonnet/cmd/jsonnetfmt"
+	@echo "(re)installing $(GOBIN)/jsonnetfmt-v0.20.0"
+	@cd $(BINGO_DIR) && GOWORK=off $(GO) build -mod=mod -modfile=jsonnetfmt.mod -o=$(GOBIN)/jsonnetfmt-v0.20.0 "github.com/google/go-jsonnet/cmd/jsonnetfmt"
 
-KUBECONFORM := $(GOBIN)/kubeconform-v0.4.4
-$(KUBECONFORM): .bingo/kubeconform.mod
+KUBECONFORM := $(GOBIN)/kubeconform-v0.6.3
+$(KUBECONFORM): $(BINGO_DIR)/kubeconform.mod
 	@# Install binary/ries using Go 1.14+ build command. This is using bwplotka/bingo-controlled, separate go module with pinned dependencies.
-	@echo "(re)installing $(GOBIN)/kubeconform-v0.4.4"
-	@cd .bingo && $(GO) build -mod=mod -modfile=kubeconform.mod -o=$(GOBIN)/kubeconform-v0.4.4 "github.com/yannh/kubeconform/cmd/kubeconform"
+	@echo "(re)installing $(GOBIN)/kubeconform-v0.6.3"
+	@cd $(BINGO_DIR) && GOWORK=off $(GO) build -mod=mod -modfile=kubeconform.mod -o=$(GOBIN)/kubeconform-v0.6.3 "github.com/yannh/kubeconform/cmd/kubeconform"
 

.bingo/embedmd.sum

@@ -0,0 +1,4 @@
+github.com/campoy/embedmd v1.0.0 h1:V4kI2qTJJLf4J29RzI/MAt2c3Bl4dQSYPuflzwFH2hY=
+github.com/campoy/embedmd v1.0.0/go.mod h1:oxyr9RCiSXg0M3VJ3ks0UGfp98BpSSGr0kpiX3MzVl8=
+github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
+github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=

.bingo/gojsontoyaml.sum

@@ -0,0 +1,7 @@
+github.com/brancz/gojsontoyaml v0.0.0-20200602132005-3697ded27e8c h1:hb6WqfcKQZlNx/vahy51SaIvKnoXD5609Nm0PC4msEM=
+github.com/brancz/gojsontoyaml v0.0.0-20200602132005-3697ded27e8c/go.mod h1:+00lOjYXPgMfxHVPvg9GDtc3BX5Xh5aFpB4gMB8gfMo=
+github.com/ghodss/yaml v1.0.0 h1:wQHKEahhL6wmXdzwWG11gIVCkOv05bNOh+Rxn0yngAk=
+github.com/ghodss/yaml v1.0.0/go.mod h1:4dBDuWmgqj2HViK6kFavaiC9ZROes6MMH2rRYeMEF04=
+gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
+gopkg.in/yaml.v2 v2.3.0 h1:clyUAQHOM3G0M3f5vQj7LuJrETvjVot3Z5el9nffUtU=
+gopkg.in/yaml.v2 v2.3.0/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=

.bingo/jb.sum

@@ -0,0 +1,24 @@
+github.com/alecthomas/template v0.0.0-20160405071501-a0175ee3bccc h1:cAKDfWh5VpdgMhJosfJnn5/FoN2SRZ4p7fJNX58YPaU=
+github.com/alecthomas/template v0.0.0-20160405071501-a0175ee3bccc/go.mod h1:LOuyumcjzFXgccqObfd/Ljyb9UuFJ6TxHnclSeseNhc=
+github.com/alecthomas/units v0.0.0-20151022065526-2efee857e7cf h1:qet1QNfXsQxTZqLG4oE62mJzwPIB8+Tee4RNCL9ulrY=
+github.com/alecthomas/units v0.0.0-20151022065526-2efee857e7cf/go.mod h1:ybxpYRFXyAe+OPACYpWeL0wqObRcbAqCMya13uyzqw0=
+github.com/campoy/embedmd v1.0.0/go.mod h1:oxyr9RCiSXg0M3VJ3ks0UGfp98BpSSGr0kpiX3MzVl8=
+github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/fatih/color v1.7.0 h1:DkWD4oS2D8LGGgTQ6IvwJJXSL5Vp2ffcQg58nFV38Ys=
+github.com/fatih/color v1.7.0/go.mod h1:Zm6kSWBoL9eyXnKyktHP6abPY2pDugNf5KwzbycvMj4=
+github.com/jsonnet-bundler/jsonnet-bundler v0.4.0 h1:4BKZ6LDqPc2wJDmaKnmYD/vDjUptJtnUpai802MibFc=
+github.com/jsonnet-bundler/jsonnet-bundler v0.4.0/go.mod h1:/by7P/OoohkI3q4CgSFqcoFsVY+IaNbzOVDknEsKDeU=
+github.com/mattn/go-colorable v0.0.9 h1:UVL0vNpWh04HeJXV0KLcaT7r06gOH2l4OW6ddYRUIY4=
+github.com/mattn/go-colorable v0.0.9/go.mod h1:9vuHe8Xs5qXnSaW/c/ABM9alt+Vo+STaOChaDxuIBZU=
+github.com/mattn/go-isatty v0.0.6 h1:SrwhHcpV4nWrMGdNcC2kXpMfcBVYGDuTArqyhocJgvA=
+github.com/mattn/go-isatty v0.0.6/go.mod h1:Iq45c/XA43vh69/j3iqttzPXn0bhXyGjM0Hdxcsrc5s=
+github.com/pkg/errors v0.8.0 h1:WdK/asTD0HN+q6hsWO3/vpuAkAr+tw6aNJNDFFf0+qw=
+github.com/pkg/errors v0.8.0/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
+github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
+github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
+github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
+golang.org/x/sys v0.0.0-20190222072716-a9d3bda3a223/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
+golang.org/x/sys v0.0.0-20190310054646-10058d7d4faa h1:lqti/xP+yD/6zH5TqEwx2MilNIJY5Vbc6Qr8J3qyPIQ=
+golang.org/x/sys v0.0.0-20190310054646-10058d7d4faa/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+gopkg.in/alecthomas/kingpin.v2 v2.2.6 h1:jMFz6MfLP0/4fUyZle81rXUoxOBFi19VUFKVDOQfozc=
+gopkg.in/alecthomas/kingpin.v2 v2.2.6/go.mod h1:FMv+mEhP44yOT+4EoQTLFTRgOQ1FBLkstjWtayDeSgw=

.bingo/jsonnet-lint.mod

@@ -2,8 +2,4 @@ module _ // Auto generated by https://github.com/bwplotka/bingo. DO NOT EDIT
 
 go 1.15
 
-require (
-	github.com/fatih/color v1.10.0 // indirect
-	github.com/google/go-jsonnet v0.17.1-0.20210101181740-31d71aaccda6 // cmd/jsonnet-lint
-	golang.org/x/sys v0.0.0-20210112091331-59c308dcf3cc // indirect
-)
+require github.com/google/go-jsonnet v0.20.0 // cmd/jsonnet-lint

.bingo/jsonnet-lint.sum

@@ -0,0 +1,41 @@
+github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/fatih/color v1.9.0/go.mod h1:eQcE1qtQxscV5RaZvpXrrb8Drkc3/DdQ+uUYCNjL+zU=
+github.com/fatih/color v1.10.0 h1:s36xzo75JdqLaaWoiEHk767eHiwo0598uUxyfiPkDsg=
+github.com/fatih/color v1.10.0/go.mod h1:ELkj/draVOlAH/xkhN6mQ50Qd0MPOk5AAr3maGEBuJM=
+github.com/fatih/color v1.12.0 h1:mRhaKNwANqRgUBGKmnI5ZxEk7QXmjQeCcuYFMX2bfcc=
+github.com/fatih/color v1.12.0/go.mod h1:ELkj/draVOlAH/xkhN6mQ50Qd0MPOk5AAr3maGEBuJM=
+github.com/google/go-jsonnet v0.17.1-0.20210101181740-31d71aaccda6 h1:91EupyycmO5ctzKuWEZ9nX0Cal1NveMiWcXxmRtLyLQ=
+github.com/google/go-jsonnet v0.17.1-0.20210101181740-31d71aaccda6/go.mod h1:sOcuej3UW1vpPTZOr8L7RQimqai1a57bt5j22LzGZCw=
+github.com/google/go-jsonnet v0.20.0 h1:WG4TTSARuV7bSm4PMB4ohjxe33IHT5WVTrJSU33uT4g=
+github.com/google/go-jsonnet v0.20.0/go.mod h1:VbgWF9JX7ztlv770x/TolZNGGFfiHEVx9G6ca2eUmeA=
+github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORNo=
+github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ=
+github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI=
+github.com/mattn/go-colorable v0.1.4/go.mod h1:U0ppj6V5qS13XJ6of8GYAs25YV2eR4EVcfRqFIhoBtE=
+github.com/mattn/go-colorable v0.1.8 h1:c1ghPdyEDarC70ftn0y+A/Ee++9zz8ljHG1b13eJ0s8=
+github.com/mattn/go-colorable v0.1.8/go.mod h1:u6P/XSegPjTcexA+o6vUJrdnUu04hMope9wVRipJSqc=
+github.com/mattn/go-isatty v0.0.8/go.mod h1:Iq45c/XA43vh69/j3iqttzPXn0bhXyGjM0Hdxcsrc5s=
+github.com/mattn/go-isatty v0.0.11/go.mod h1:PhnuNfih5lzO57/f3n+odYbM4JtupLOxQOAqxQCu2WE=
+github.com/mattn/go-isatty v0.0.12 h1:wuysRhFDzyxgEmMf5xjvJ2M9dZoWAXNNr5LSBS7uHXY=
+github.com/mattn/go-isatty v0.0.12/go.mod h1:cbi8OIDigv2wuxKPP5vlRcQ1OAZbq2CE4Kysco4FUpU=
+github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
+github.com/sergi/go-diff v1.1.0/go.mod h1:STckp+ISIX8hZLjrqAeVduY0gWCT9IjLuqbuNXdaHfM=
+github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
+github.com/stretchr/testify v1.4.0/go.mod h1:j7eGeouHqKxXV5pUuKE4zz7dFj8WfuZ+81PSLYec5m4=
+golang.org/x/sys v0.0.0-20190222072716-a9d3bda3a223/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
+golang.org/x/sys v0.0.0-20191026070338-33540a1f6037/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20200116001909-b77594299b42/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20200223170610-d5e6a3e2c0ae/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20210112091331-59c308dcf3cc h1:y0Og6AYdwus7SIAnKnDxjc4gJetRiYEWOx4AKbOeyEI=
+golang.org/x/sys v0.0.0-20210112091331-59c308dcf3cc/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.1.0 h1:kunALQeHf1/185U1i0GOB/fy1IPRDDpuoOOqRReG57U=
+golang.org/x/sys v0.1.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
+gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
+gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
+gopkg.in/yaml.v2 v2.2.4/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
+gopkg.in/yaml.v2 v2.2.7 h1:VUgggvou5XRW9mHwD/yXxIYSMtY0zoKQf/v226p2nyo=
+gopkg.in/yaml.v2 v2.2.7/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
+sigs.k8s.io/yaml v1.1.0 h1:4A07+ZFc2wgJwo8YNlQpr1rVlgUDlxXHhPJciaPY5gs=
+sigs.k8s.io/yaml v1.1.0/go.mod h1:UJmg0vDUVViEyp3mgSv9WPwZCDxu4rQW1olrI1uml+o=

.bingo/jsonnet.mod

@@ -2,8 +2,4 @@ module _ // Auto generated by https://github.com/bwplotka/bingo. DO NOT EDIT
 
 go 1.15
 
-require (
-	github.com/fatih/color v1.10.0 // indirect
-	github.com/google/go-jsonnet v0.17.1-0.20210101181740-31d71aaccda6 // cmd/jsonnet
-	golang.org/x/sys v0.0.0-20210112091331-59c308dcf3cc // indirect
-)
+require github.com/google/go-jsonnet v0.20.0 // cmd/jsonnet

.bingo/jsonnet.sum

@@ -0,0 +1,41 @@
+github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/fatih/color v1.9.0/go.mod h1:eQcE1qtQxscV5RaZvpXrrb8Drkc3/DdQ+uUYCNjL+zU=
+github.com/fatih/color v1.10.0 h1:s36xzo75JdqLaaWoiEHk767eHiwo0598uUxyfiPkDsg=
+github.com/fatih/color v1.10.0/go.mod h1:ELkj/draVOlAH/xkhN6mQ50Qd0MPOk5AAr3maGEBuJM=
+github.com/fatih/color v1.12.0 h1:mRhaKNwANqRgUBGKmnI5ZxEk7QXmjQeCcuYFMX2bfcc=
+github.com/fatih/color v1.12.0/go.mod h1:ELkj/draVOlAH/xkhN6mQ50Qd0MPOk5AAr3maGEBuJM=
+github.com/google/go-jsonnet v0.17.1-0.20210101181740-31d71aaccda6 h1:91EupyycmO5ctzKuWEZ9nX0Cal1NveMiWcXxmRtLyLQ=
+github.com/google/go-jsonnet v0.17.1-0.20210101181740-31d71aaccda6/go.mod h1:sOcuej3UW1vpPTZOr8L7RQimqai1a57bt5j22LzGZCw=
+github.com/google/go-jsonnet v0.20.0 h1:WG4TTSARuV7bSm4PMB4ohjxe33IHT5WVTrJSU33uT4g=
+github.com/google/go-jsonnet v0.20.0/go.mod h1:VbgWF9JX7ztlv770x/TolZNGGFfiHEVx9G6ca2eUmeA=
+github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORNo=
+github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ=
+github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI=
+github.com/mattn/go-colorable v0.1.4/go.mod h1:U0ppj6V5qS13XJ6of8GYAs25YV2eR4EVcfRqFIhoBtE=
+github.com/mattn/go-colorable v0.1.8 h1:c1ghPdyEDarC70ftn0y+A/Ee++9zz8ljHG1b13eJ0s8=
+github.com/mattn/go-colorable v0.1.8/go.mod h1:u6P/XSegPjTcexA+o6vUJrdnUu04hMope9wVRipJSqc=
+github.com/mattn/go-isatty v0.0.8/go.mod h1:Iq45c/XA43vh69/j3iqttzPXn0bhXyGjM0Hdxcsrc5s=
+github.com/mattn/go-isatty v0.0.11/go.mod h1:PhnuNfih5lzO57/f3n+odYbM4JtupLOxQOAqxQCu2WE=
+github.com/mattn/go-isatty v0.0.12 h1:wuysRhFDzyxgEmMf5xjvJ2M9dZoWAXNNr5LSBS7uHXY=
+github.com/mattn/go-isatty v0.0.12/go.mod h1:cbi8OIDigv2wuxKPP5vlRcQ1OAZbq2CE4Kysco4FUpU=
+github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
+github.com/sergi/go-diff v1.1.0/go.mod h1:STckp+ISIX8hZLjrqAeVduY0gWCT9IjLuqbuNXdaHfM=
+github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
+github.com/stretchr/testify v1.4.0/go.mod h1:j7eGeouHqKxXV5pUuKE4zz7dFj8WfuZ+81PSLYec5m4=
+golang.org/x/sys v0.0.0-20190222072716-a9d3bda3a223/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
+golang.org/x/sys v0.0.0-20191026070338-33540a1f6037/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20200116001909-b77594299b42/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20200223170610-d5e6a3e2c0ae/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20210112091331-59c308dcf3cc h1:y0Og6AYdwus7SIAnKnDxjc4gJetRiYEWOx4AKbOeyEI=
+golang.org/x/sys v0.0.0-20210112091331-59c308dcf3cc/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.1.0 h1:kunALQeHf1/185U1i0GOB/fy1IPRDDpuoOOqRReG57U=
+golang.org/x/sys v0.1.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
+gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
+gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
+gopkg.in/yaml.v2 v2.2.4/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
+gopkg.in/yaml.v2 v2.2.7 h1:VUgggvou5XRW9mHwD/yXxIYSMtY0zoKQf/v226p2nyo=
+gopkg.in/yaml.v2 v2.2.7/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
+sigs.k8s.io/yaml v1.1.0 h1:4A07+ZFc2wgJwo8YNlQpr1rVlgUDlxXHhPJciaPY5gs=
+sigs.k8s.io/yaml v1.1.0/go.mod h1:UJmg0vDUVViEyp3mgSv9WPwZCDxu4rQW1olrI1uml+o=

.bingo/jsonnetfmt.mod

@@ -2,8 +2,4 @@ module _ // Auto generated by https://github.com/bwplotka/bingo. DO NOT EDIT
 
 go 1.15
 
-require (
-	github.com/fatih/color v1.10.0 // indirect
-	github.com/google/go-jsonnet v0.17.1-0.20210101181740-31d71aaccda6 // cmd/jsonnetfmt
-	golang.org/x/sys v0.0.0-20210112091331-59c308dcf3cc // indirect
-)
+require github.com/google/go-jsonnet v0.20.0 // cmd/jsonnetfmt

.bingo/jsonnetfmt.sum

@@ -0,0 +1,41 @@
+github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/fatih/color v1.9.0/go.mod h1:eQcE1qtQxscV5RaZvpXrrb8Drkc3/DdQ+uUYCNjL+zU=
+github.com/fatih/color v1.10.0 h1:s36xzo75JdqLaaWoiEHk767eHiwo0598uUxyfiPkDsg=
+github.com/fatih/color v1.10.0/go.mod h1:ELkj/draVOlAH/xkhN6mQ50Qd0MPOk5AAr3maGEBuJM=
+github.com/fatih/color v1.12.0 h1:mRhaKNwANqRgUBGKmnI5ZxEk7QXmjQeCcuYFMX2bfcc=
+github.com/fatih/color v1.12.0/go.mod h1:ELkj/draVOlAH/xkhN6mQ50Qd0MPOk5AAr3maGEBuJM=
+github.com/google/go-jsonnet v0.17.1-0.20210101181740-31d71aaccda6 h1:91EupyycmO5ctzKuWEZ9nX0Cal1NveMiWcXxmRtLyLQ=
+github.com/google/go-jsonnet v0.17.1-0.20210101181740-31d71aaccda6/go.mod h1:sOcuej3UW1vpPTZOr8L7RQimqai1a57bt5j22LzGZCw=
+github.com/google/go-jsonnet v0.20.0 h1:WG4TTSARuV7bSm4PMB4ohjxe33IHT5WVTrJSU33uT4g=
+github.com/google/go-jsonnet v0.20.0/go.mod h1:VbgWF9JX7ztlv770x/TolZNGGFfiHEVx9G6ca2eUmeA=
+github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORNo=
+github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ=
+github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI=
+github.com/mattn/go-colorable v0.1.4/go.mod h1:U0ppj6V5qS13XJ6of8GYAs25YV2eR4EVcfRqFIhoBtE=
+github.com/mattn/go-colorable v0.1.8 h1:c1ghPdyEDarC70ftn0y+A/Ee++9zz8ljHG1b13eJ0s8=
+github.com/mattn/go-colorable v0.1.8/go.mod h1:u6P/XSegPjTcexA+o6vUJrdnUu04hMope9wVRipJSqc=
+github.com/mattn/go-isatty v0.0.8/go.mod h1:Iq45c/XA43vh69/j3iqttzPXn0bhXyGjM0Hdxcsrc5s=
+github.com/mattn/go-isatty v0.0.11/go.mod h1:PhnuNfih5lzO57/f3n+odYbM4JtupLOxQOAqxQCu2WE=
+github.com/mattn/go-isatty v0.0.12 h1:wuysRhFDzyxgEmMf5xjvJ2M9dZoWAXNNr5LSBS7uHXY=
+github.com/mattn/go-isatty v0.0.12/go.mod h1:cbi8OIDigv2wuxKPP5vlRcQ1OAZbq2CE4Kysco4FUpU=
+github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
+github.com/sergi/go-diff v1.1.0/go.mod h1:STckp+ISIX8hZLjrqAeVduY0gWCT9IjLuqbuNXdaHfM=
+github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
+github.com/stretchr/testify v1.4.0/go.mod h1:j7eGeouHqKxXV5pUuKE4zz7dFj8WfuZ+81PSLYec5m4=
+golang.org/x/sys v0.0.0-20190222072716-a9d3bda3a223/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
+golang.org/x/sys v0.0.0-20191026070338-33540a1f6037/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20200116001909-b77594299b42/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20200223170610-d5e6a3e2c0ae/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20210112091331-59c308dcf3cc h1:y0Og6AYdwus7SIAnKnDxjc4gJetRiYEWOx4AKbOeyEI=
+golang.org/x/sys v0.0.0-20210112091331-59c308dcf3cc/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.1.0 h1:kunALQeHf1/185U1i0GOB/fy1IPRDDpuoOOqRReG57U=
+golang.org/x/sys v0.1.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
+gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
+gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
+gopkg.in/yaml.v2 v2.2.4/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
+gopkg.in/yaml.v2 v2.2.7 h1:VUgggvou5XRW9mHwD/yXxIYSMtY0zoKQf/v226p2nyo=
+gopkg.in/yaml.v2 v2.2.7/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
+sigs.k8s.io/yaml v1.1.0 h1:4A07+ZFc2wgJwo8YNlQpr1rVlgUDlxXHhPJciaPY5gs=
+sigs.k8s.io/yaml v1.1.0/go.mod h1:UJmg0vDUVViEyp3mgSv9WPwZCDxu4rQW1olrI1uml+o=

.bingo/kubeconform.mod

@@ -1,5 +1,5 @@
 module _ // Auto generated by https://github.com/bwplotka/bingo. DO NOT EDIT
 
-go 1.15
+go 1.21
 
-require github.com/yannh/kubeconform v0.4.4 // cmd/kubeconform
+require github.com/yannh/kubeconform v0.6.3 // cmd/kubeconform

.bingo/kubeconform.sum

@@ -0,0 +1,25 @@
+github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
+github.com/santhosh-tekuri/jsonschema/v5 v5.1.1 h1:lEOLY2vyGIqKWUI9nzsOJRV3mb3WC9dXYORsLEUcoeY=
+github.com/santhosh-tekuri/jsonschema/v5 v5.1.1/go.mod h1:FKdcjfQW6rpZSnxxUvEA5H/cDPdvJ/SZJQLWWXWGrZ0=
+github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
+github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
+github.com/xeipuuv/gojsonpointer v0.0.0-20180127040702-4e3ac2762d5f h1:J9EGpcZtP0E/raorCMxlFGSTBrsSlaDGf3jU/qvAE2c=
+github.com/xeipuuv/gojsonpointer v0.0.0-20180127040702-4e3ac2762d5f/go.mod h1:N2zxlSyiKSe5eX1tZViRH5QA0qijqEDrYZiPEAiq3wU=
+github.com/xeipuuv/gojsonreference v0.0.0-20180127040603-bd5ef7bd5415 h1:EzJWgHovont7NscjpAxXsDA8S8BMYve8Y5+7cuRE7R0=
+github.com/xeipuuv/gojsonreference v0.0.0-20180127040603-bd5ef7bd5415/go.mod h1:GwrjFmJcFw6At/Gs6z4yjiIwzuJ1/+UwLxMQDVQXShQ=
+github.com/xeipuuv/gojsonschema v1.2.0 h1:LhYJRs+L4fBtjZUfuSZIKGeVu0QRy8e5Xi7D17UxZ74=
+github.com/xeipuuv/gojsonschema v1.2.0/go.mod h1:anYRn/JVcOK2ZgGU+IjEV4nwlhoK5sQluxsYJ78Id3Y=
+github.com/yannh/kubeconform v0.4.4 h1:1+Wmd2QnZFaHd5hrNXWxwvPbE/pVTDNNWWXRaoN1Zbs=
+github.com/yannh/kubeconform v0.4.4/go.mod h1:Ysf3RSreh2rX8IJsVt/uT3Um/U3e3ykx6Fcz8nCdskM=
+github.com/yannh/kubeconform v0.6.3 h1:lNmb/kphyzitA+GBsOxjBsagCEpjLvt3+qo3XMiEOUA=
+github.com/yannh/kubeconform v0.6.3/go.mod h1:4E6oaL+lh7KgCG2SaOabeeAFBkyKu5D9ab0OEekGcbs=
+gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
+gopkg.in/yaml.v2 v2.2.8/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
+gopkg.in/yaml.v2 v2.3.0 h1:clyUAQHOM3G0M3f5vQj7LuJrETvjVot3Z5el9nffUtU=
+gopkg.in/yaml.v2 v2.3.0/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
+gopkg.in/yaml.v2 v2.4.0 h1:D8xgwECY7CYvx+Y2n4sBz93Jn9JRvxdiyyo8CTfuKaY=
+gopkg.in/yaml.v2 v2.4.0/go.mod h1:RDklbk79AGWmwhnvt/jBztapEOGDOx6ZbXqjP6csGnQ=
+sigs.k8s.io/yaml v1.2.0 h1:kr/MCeFWJWTwyaHoR9c8EjH9OumOmoF9YGiZd7lFm/Q=
+sigs.k8s.io/yaml v1.2.0/go.mod h1:yfXDCHCao9+ENCvLSE62v9VSji2MKu5jeNfTrofGhJc=

.bingo/kubeval.sum

@@ -0,0 +1,57 @@
+github.com/BurntSushi/toml v0.3.1/go.mod h1:xHWCNGjB5oqiDr8zfno3MHue2Ht5sIBksp03qcyfWMU=
+github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/fatih/color v1.7.0 h1:DkWD4oS2D8LGGgTQ6IvwJJXSL5Vp2ffcQg58nFV38Ys=
+github.com/fatih/color v1.7.0/go.mod h1:Zm6kSWBoL9eyXnKyktHP6abPY2pDugNf5KwzbycvMj4=
+github.com/fsnotify/fsnotify v1.4.7 h1:IXs+QLmnXW2CcXuY+8Mzv/fWEsPGWxqefPtCP5CnV9I=
+github.com/fsnotify/fsnotify v1.4.7/go.mod h1:jwhsz4b93w/PPRr/qN1Yymfu8t87LnFCMoQvtojpjFo=
+github.com/hashicorp/errwrap v0.0.0-20180715044906-d6c0cd880357 h1:Rem2+U35z1QtPQc6r+WolF7yXiefXqDKyk+lN2pE164=
+github.com/hashicorp/errwrap v0.0.0-20180715044906-d6c0cd880357/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
+github.com/hashicorp/go-multierror v0.0.0-20180717150148-3d5d8f294aa0 h1:j30noezaCfvNLcdMYSvHLv81DxYRSt1grlpseG67vhU=
+github.com/hashicorp/go-multierror v0.0.0-20180717150148-3d5d8f294aa0/go.mod h1:JMRHfdO9jKNzS/+BTlxCjKNQHg/jZAft8U7LloJvN7I=
+github.com/hashicorp/hcl v0.0.0-20180404174102-ef8a98b0bbce h1:xdsDDbiBDQTKASoGEZ+pEmF1OnWuu8AQ9I8iNbHNeno=
+github.com/hashicorp/hcl v0.0.0-20180404174102-ef8a98b0bbce/go.mod h1:oZtUIOe8dh44I2q6ScRibXws4Ajl+d+nod3AaR9vL5w=
+github.com/inconshreveable/mousetrap v1.0.0/go.mod h1:PxqpIevigyE2G7u3NXJIT2ANytuPF1OarO4DADm73n8=
+github.com/instrumenta/kubeval v0.0.0-20201005082916-38668c6c5b23 h1:M1Ms+wV9kd4g65MWhdyoMmaVIZj4U18t5bFRPs/zJUs=
+github.com/instrumenta/kubeval v0.0.0-20201005082916-38668c6c5b23/go.mod h1:cD+P/oZrBwOnaIHXrqvKPuN353KPxGomnsXSXf8pFJs=
+github.com/magiconair/properties v1.8.0 h1:LLgXmsheXeRoUOBOjtwPQCWIYqM/LU1ayDtDePerRcY=
+github.com/magiconair/properties v1.8.0/go.mod h1:PppfXfuXeibc/6YijjN8zIbojt8czPbwD3XqdrwzmxQ=
+github.com/mattn/go-colorable v0.1.0 h1:v2XXALHHh6zHfYTJ+cSkwtyffnaOyR1MXaA91mTrb8o=
+github.com/mattn/go-colorable v0.1.0/go.mod h1:9vuHe8Xs5qXnSaW/c/ABM9alt+Vo+STaOChaDxuIBZU=
+github.com/mattn/go-isatty v0.0.4 h1:bnP0vzxcAdeI1zdubAl5PjU6zsERjGZb7raWodagDYs=
+github.com/mattn/go-isatty v0.0.4/go.mod h1:M+lRXTBqGeGNdLjl/ufCoiOlB5xdOkqRJdNxMWT7Zi4=
+github.com/mitchellh/mapstructure v0.0.0-20180715050151-f15292f7a699 h1:KXZJFdun9knAVAR8tg/aHJEr5DgtcbqyvzacK+CDCaI=
+github.com/mitchellh/mapstructure v0.0.0-20180715050151-f15292f7a699/go.mod h1:FVVH3fgwuzCH5S8UJGiWEs2h04kUh9fWfEaFds41c1Y=
+github.com/pelletier/go-toml v0.0.0-20180724185102-c2dbbc24a979 h1:Uh8pTMDzw+nuDTW7lyxcpmYqQJFE8SnO93F3lyY4XzY=
+github.com/pelletier/go-toml v0.0.0-20180724185102-c2dbbc24a979/go.mod h1:5z9KED0ma1S8pY6P1sdut58dfprrGBbd/94hg7ilaic=
+github.com/pkg/errors v0.8.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
+github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
+github.com/spf13/afero v1.1.1 h1:Lt3ihYMlE+lreX1GS4Qw4ZsNpYQLxIXKBTEOXm3nt6I=
+github.com/spf13/afero v1.1.1/go.mod h1:j4pytiNVoe2o6bmDsKpLACNPDBIoEAkihy7loJ1B0CQ=
+github.com/spf13/cast v1.2.0 h1:HHl1DSRbEQN2i8tJmtS6ViPyHx35+p51amrdsiTCrkg=
+github.com/spf13/cast v1.2.0/go.mod h1:r2rcYCSwa1IExKTDiTfzaxqT2FNHs8hODu4LnUfgKEg=
+github.com/spf13/cobra v0.0.0-20180820174524-ff0d02e85550 h1:LB9SHuuXO8gnsHtexOQSpsJrrAHYA35lvHUaE74kznU=
+github.com/spf13/cobra v0.0.0-20180820174524-ff0d02e85550/go.mod h1:1l0Ry5zgKvJasoi3XT1TypsSe7PqH0Sj9dhYf7v3XqQ=
+github.com/spf13/jwalterweatherman v0.0.0-20180814060501-14d3d4c51834 h1:kJI9pPzfsULT/72wy7mxkRQZPtKWgFdCA2RTGZ4v8/E=
+github.com/spf13/jwalterweatherman v0.0.0-20180814060501-14d3d4c51834/go.mod h1:cQK4TGJAtQXfYWX+Ddv3mKDzgVb68N+wFjFa4jdeBTo=
+github.com/spf13/pflag v0.0.0-20180821114517-d929dcbb1086 h1:iU+nPfqRqK8ShQqnpZLv8cZ9oklo6NFUcmX1JT5Rudg=
+github.com/spf13/pflag v0.0.0-20180821114517-d929dcbb1086/go.mod h1:DYY7MBk1bdzusC3SYhjObp+wFpr4gzcvqqNjLnInEg4=
+github.com/spf13/viper v1.1.0 h1:V7OZpY8i3C1x/pDmU0zNNlfVoDz112fSYvtWMjjS3f4=
+github.com/spf13/viper v1.1.0/go.mod h1:A8kyI5cUJhb8N+3pkfONlcEcZbueH6nhAm0Fq7SrnBM=
+github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
+github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
+github.com/xeipuuv/gojsonpointer v0.0.0-20180127040702-4e3ac2762d5f h1:J9EGpcZtP0E/raorCMxlFGSTBrsSlaDGf3jU/qvAE2c=
+github.com/xeipuuv/gojsonpointer v0.0.0-20180127040702-4e3ac2762d5f/go.mod h1:N2zxlSyiKSe5eX1tZViRH5QA0qijqEDrYZiPEAiq3wU=
+github.com/xeipuuv/gojsonreference v0.0.0-20180127040603-bd5ef7bd5415 h1:EzJWgHovont7NscjpAxXsDA8S8BMYve8Y5+7cuRE7R0=
+github.com/xeipuuv/gojsonreference v0.0.0-20180127040603-bd5ef7bd5415/go.mod h1:GwrjFmJcFw6At/Gs6z4yjiIwzuJ1/+UwLxMQDVQXShQ=
+github.com/xeipuuv/gojsonschema v0.0.0-20180816142147-da425ebb7609 h1:BcMExZAULPkihVZ7UJXK7t8rwGqisXFw75tILnafhBY=
+github.com/xeipuuv/gojsonschema v0.0.0-20180816142147-da425ebb7609/go.mod h1:5yf86TLmAcydyeJq5YvxkGPE2fm/u4myDekKRoLuqhs=
+golang.org/x/sys v0.0.0-20180821044426-4ea2f632f6e9 h1:0RHCP7KEw0rDuVXXaT2gfV77uu6lTKa5aItB+EoFbQk=
+golang.org/x/sys v0.0.0-20180821044426-4ea2f632f6e9/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
+golang.org/x/text v0.0.0-20180810153555-6e3c4e7365dd h1:e/dojZNNKqwK3xq7UQTKTQJim18r/FxvQk7PFXULeZg=
+golang.org/x/text v0.0.0-20180810153555-6e3c4e7365dd/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
+gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
+gopkg.in/yaml.v2 v2.2.1 h1:mUhvW9EsL+naU5Q3cakzfE91YhliOondGd6ZrsDBHQE=
+gopkg.in/yaml.v2 v2.2.1/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
+sigs.k8s.io/yaml v1.1.0 h1:4A07+ZFc2wgJwo8YNlQpr1rVlgUDlxXHhPJciaPY5gs=
+sigs.k8s.io/yaml v1.1.0/go.mod h1:UJmg0vDUVViEyp3mgSv9WPwZCDxu4rQW1olrI1uml+o=

.bingo/variables.env

@@ -1,4 +1,4 @@
-# Auto generated binary variables helper managed by https://github.com/bwplotka/bingo v0.2.3. DO NOT EDIT.
+# Auto generated binary variables helper managed by https://github.com/bwplotka/bingo v0.8. DO NOT EDIT.
 # All tools are designed to be build inside $GOBIN.
 # Those variables will work only until 'bingo get' was invoked, or if tools were installed via Makefile's Variables.mk.
 GOBIN=${GOBIN:=$(go env GOBIN)}
@@ -8,17 +8,17 @@ if [ -z "$GOBIN" ]; then
 fi
 
 
-EMBEDMD="$GOBIN/embedmd-v1.0.0"
+EMBEDMD="${GOBIN}/embedmd-v1.0.0"
 
-GOJSONTOYAML="$GOBIN/gojsontoyaml-v0.0.0-20200602132005-3697ded27e8c"
+GOJSONTOYAML="${GOBIN}/gojsontoyaml-v0.0.0-20200602132005-3697ded27e8c"
 
-JB="$GOBIN/jb-v0.4.0"
+JB="${GOBIN}/jb-v0.4.0"
 
-JSONNET_LINT="$GOBIN/jsonnet-lint-v0.17.1-0.20210101181740-31d71aaccda6"
+JSONNET_LINT="${GOBIN}/jsonnet-lint-v0.20.0"
 
-JSONNET="$GOBIN/jsonnet-v0.17.1-0.20210101181740-31d71aaccda6"
+JSONNET="${GOBIN}/jsonnet-v0.20.0"
 
-JSONNETFMT="$GOBIN/jsonnetfmt-v0.17.1-0.20210101181740-31d71aaccda6"
+JSONNETFMT="${GOBIN}/jsonnetfmt-v0.20.0"
 
-KUBECONFORM="$GOBIN/kubeconform-v0.4.4"
+KUBECONFORM="${GOBIN}/kubeconform-v0.4.4"
 

.circleci/config.yml

@@ -1,25 +0,0 @@
-jobs:
-  lint:
-    working_directory: /go/src/github.com/{{ORG_NAME}}/{{REPO_NAME}}
-    docker:
-      - image: circleci/golang:1.15
-    steps:
-      - checkout
-      - run: make vendor
-      - run: git diff --exit-code
-      - run: make --always-make fmt lint
-      - run: git diff --exit-code
-  build:
-    working_directory: /go/src/github.com/{{ORG_NAME}}/{{REPO_NAME}}
-    docker:
-      - image: circleci/golang:1.15
-    steps:
-      - checkout
-      - run: make --always-make vendor generate validate
-      - run: git diff --exit-code
-workflows:
-  version: 2
-  build_and_test:
-    jobs:
-      - lint
-      - build

.github/workflows/ci.yml

@@ -0,0 +1,38 @@
+name: CI
+
+on:
+  push:
+    branches: [ main ]
+  pull_request:
+    branches: [ main ]
+  workflow_dispatch:
+
+jobs:
+  lint:
+    runs-on: ubuntu-latest
+    steps:
+    - uses: actions/checkout@v2
+    - name: Set up Go
+      uses: actions/setup-go@v2
+      with:
+        go-version: 1.17
+    - name: Vendor
+      run: make vendor
+    - name: Vendor Diff
+      run: git diff --exit-code
+    - name: Format
+      run: make --always-make fmt lint
+    - name: Format Diff
+      run: git diff --exit-code
+  build:
+    runs-on: ubuntu-latest
+    steps:
+    - uses: actions/checkout@v2
+    - name: Set up Go
+      uses: actions/setup-go@v2
+      with:
+        go-version: 1.17
+    - name: Generate
+      run: make --always-make vendor generate validate
+    - name: Generate Diff
+      run: git diff --exit-code

.gitignore

@@ -1,3 +1,4 @@
 tmp
 vendor/
 jsonnet/kube-thanos/jsonnetfile.lock.json
+.idea/

CHANGELOG.md

@@ -16,11 +16,82 @@ We use *breaking* word for marking changes that are not backward compatible (rel
 ### Breaking Changes
 
 ### Changed
+
+- [#279](https://github.com/thanos-io/kube-thanos/pull/279) Change `hashringConfigmapName` to `hashringConfigMapName` in Receive configuration.
+- [#284](https://github.com/thanos-io/kube-thanos/pull/284) Change Receive `PodDisruptionBudget` api version to `policy/v1`
+- [#293](https://github.com/thanos-io/kube-thanos/pull/293) Upgrade to Thanos v0.30.2
+
+### Added
+
+- [#263](https://github.com/thanos-io/kube-thanos/pull/263) Add support for stateless Rulers.
+- [#271](https://github.com/thanos-io/kube-thanos/pull/271) Add annotation support for ServiceAccount.
+- [#286](https://github.com/thanos-io/kube-thanos/pull/286) Store: make the liveness probe timeout configurable.
+- [#292](https://github.com/thanos-io/kube-thanos/pull/292) Store: allow configuration of series, series sample, and downloaded bytes limits.
+- [#299](https://github.com/thanos-io/kube-thanos/pull/299) Query: allow configuration of telemetry.request options
+- [#301](https://github.com/thanos-io/kube-thanos/pull/301) Receive: allow configuration of `minReadySeconds` for StatefulSet
+- [#305](https://github.com/thanos-io/kube-thanos/pull/305) Receive: allow configuration of limits-config-file
+- [#308](https://github.com/thanos-io/kube-thanos/pull/308) Recive: add store limits flags
+- [#310](https://github.com/thanos-io/kube-thanos/pull/310) Ruler: Add host anti-affinity to ruler
+- [#313](https://github.com/thanos-io/kube-thanos/pull/313) Add per-container SecurityContext
+- [#330](https://github.com/thanos-io/kube-thanos/pull/330) Query: Add query url support to jsonnet library
+
+### Fixed
+
+- [#298](https://github.com/thanos-io/kube-thanos/pull/298) Use `kubernetes.io/os` instead of `beta.kubernetes.io/os` which has been deprecated since Kubernetes v1.14.
+
+
+## [v0.27.0](https://github.com/thanos-io/kube-thanos/tree/v0.27.0) (2022-07-07)
+- (no changes from `v0.26.0`)
+
+## [v0.26.0](https://github.com/thanos-io/kube-thanos/tree/v0.26.0) (2022-06-13)
+
+### Added
+
+- [#263](https://github.com/thanos-io/kube-thanos/pull/263) Add support for stateless Rulers.
+
+
+## [v0.24.0](https://github.com/thanos-io/kube-thanos/tree/v0.24.0) (2021-12-17)
+
+### Changed
+
+- [#254](https://github.com/thanos-io/kube-thanos/pull/254) Add support for tenant header configuration to receiver.
+- [#247](https://github.com/thanos-io/kube-thanos/pull/247) Make Compact service headless.
+
+### Added
+
+- [#265](https://github.com/thanos-io/kube-thanos/pull/265) Added support for multithreaded thanos compact.
+- [#237](https://github.com/thanos-io/kube-thanos/pull/237) Add new bucket replicate component.
+- [#245](https://github.com/thanos-io/kube-thanos/pull/245) Support scraping config reloader sidecar for ruler.
+- [#251](https://github.com/thanos-io/kube-thanos/pull/251) Add support for extraEnv (custom environment variables) to all components.
+- [#260](https://github.com/thanos-io/kube-thanos/pull/260) Add support custom certificate for the object store by configuring `tlsSecretName` and `tlsSecretMountPath` in `objectStorageConfig`.
+- [#261](https://github.com/thanos-io/kube-thanos/pull/261) Add support for imagePullPolicy to all components.
+
+[Full Changelog](https://github.com/thanos-io/kube-thanos/compare/v0.22.0...v0.24.0)
+
+
+## [v0.22.0](https://github.com/thanos-io/kube-thanos/tree/v0.22.0) (2021-08-17)
+
+### Added
+
+- [#232](https://github.com/thanos-io/kube-thanos/pull/232) Support compactor hash sharding.
+
+[Full Changelog](https://github.com/thanos-io/kube-thanos/compare/v0.21.0...v0.22.0)
+
+## [v0.21.0](https://github.com/thanos-io/kube-thanos/tree/v0.21.0) (2021-08-17)
+
+### Changed
+
 - [#226](https://github.com/thanos-io/kube-thanos/pull/226) Only schedule thanos components on linux nodes.
 
 ### Added
+- [#244](https://github.com/thanos-io/kube-thanos/pull/244) Add functions to implement Thanos Receive split functionality.
 - [#228](https://github.com/thanos-io/kube-thanos/pull/228) Allow configuring `--web.prefix-header` of query.
-### Fixed
+
+[Full Changelog](https://github.com/thanos-io/kube-thanos/compare/v0.20.0...v0.21.0)
+
+## [v0.20.0](https://github.com/thanos-io/kube-thanos/tree/v0.20.0) (2021-04-28)
+
+[Full Changelog](https://github.com/thanos-io/kube-thanos/compare/v0.19.0...v0.20.0)
 
 ## [v0.19.0](https://github.com/thanos-io/kube-thanos/tree/v0.19.0) (2020-04-19)
 
@@ -42,6 +113,7 @@ We use *breaking* word for marking changes that are not backward compatible (rel
 - [#213](https://github.com/thanos-io/kube-thanos/pull/213) Allow configuring `--min-time` and `--max-time` of store.
 - [#218](https://github.com/thanos-io/kube-thanos/pull/218) Enable `--query.auto-downsampling` for query by default.
 - [#221](https://github.com/thanos-io/kube-thanos/pull/221) Allow configuring `--tsdb.retention` and `--tsdb.block-duration` for rule.
+- [#225](https://github.com/thanos-io/kube-thanos/pull/225) Add support for alertmanager configuration and extra volumes for rule.
 
 [Full Changelog](https://github.com/thanos-io/kube-thanos/compare/v0.18.0...v0.19.0)
 

Makefile

@@ -9,7 +9,7 @@ MANIFESTS := manifests
 CRDSCHEMAS := .crdschemas
 TMP := tmp
 
-K8S_VERSION := 1.20.4
+K8S_VERSION := 1.27.0
 PROM_OPERATOR_VERSION := 0.46.0
 
 PIP  := pip3
@@ -42,6 +42,21 @@ lint: $(JSONNET_LINT) vendor
 vendor: | $(JB) jsonnetfile.json jsonnetfile.lock.json
 	$(JB) install
 
+.PHONY: deploy
+deploy:
+	kubectl create ns thanos
+	kubectl create ns minio
+	kubectl apply -f https://raw.githubusercontent.com/prometheus-operator/prometheus-operator/v$(PROM_OPERATOR_VERSION)/example/prometheus-operator-crd/monitoring.coreos.com_servicemonitors.yaml
+	kubectl create -f examples/development-minio/
+	kubectl create -f manifests/
+
+.PHONY: teardown
+teardown:
+	kubectl delete -f examples/development-minio/
+	kubectl delete -f manifests/
+	kubectl delete ns thanos
+	kubectl delete ns minio
+
 .PHONY: clean
 clean:
 	-rm -rf tmp/bin

README.md

@@ -23,12 +23,12 @@ This project is intended to be used as a library (i.e. the intent is not for you
 Though for a quickstart a compiled version of the Kubernetes [manifests](manifests) generated with this library (specifically with `example.jsonnet`) is checked into this repository in order to try the content out quickly. To try out the stack un-customized run:
  * Simply create the stack:
 ```shell
-$ kubectl create -f manifests/
+$ make deploy
 ```
 
  * And to teardown the stack:
 ```shell
-$ kubectl delete -f manifests/
+$ make teardown
 ```
 
 ## Customizing kube-thanos
@@ -76,12 +76,14 @@ local commonConfig = {
   config+:: {
     local cfg = self,
     namespace: 'thanos',
-    version: 'v0.19.0',
+    version: 'v0.31.0',
     image: 'quay.io/thanos/thanos:' + cfg.version,
+    imagePullPolicy: 'IfNotPresent',
     objectStorageConfig: {
       name: 'thanos-objectstorage',
       key: 'thanos.yaml',
     },
+    hashringConfigMapName: 'hashring-config',
     volumeClaimTemplate: {
       spec: {
         accessModes: ['ReadWriteOnce'],
@@ -95,6 +97,24 @@ local commonConfig = {
   },
 };
 
+local i = t.receiveIngestor(commonConfig.config {
+  replicas: 1,
+  replicaLabels: ['receive_replica'],
+  replicationFactor: 1,
+  // Disable shipping to object storage for the purposes of this example
+  objectStorageConfig: null,
+  serviceMonitor: true,
+});
+
+local r = t.receiveRouter(commonConfig.config {
+  replicas: 1,
+  replicaLabels: ['receive_replica'],
+  replicationFactor: 1,
+  // Disable shipping to object storage for the purposes of this example
+  objectStorageConfig: null,
+  endpoints: i.endpoints,
+});
+
 local s = t.store(commonConfig.config {
   replicas: 1,
   serviceMonitor: true,
@@ -104,10 +124,19 @@ local q = t.query(commonConfig.config {
   replicas: 1,
   replicaLabels: ['prometheus_replica', 'rule_replica'],
   serviceMonitor: true,
+  stores: [s.storeEndpoint] + i.storeEndpoints,
 });
 
 { ['thanos-store-' + name]: s[name] for name in std.objectFields(s) } +
-{ ['thanos-query-' + name]: q[name] for name in std.objectFields(q) }
+{ ['thanos-query-' + name]: q[name] for name in std.objectFields(q) } +
+{ ['thanos-receive-router-' + resource]: r[resource] for resource in std.objectFields(r) } +
+{ ['thanos-receive-ingestor-' + resource]: i[resource] for resource in std.objectFields(i) if resource != 'ingestors' } +
+{
+  ['thanos-receive-ingestor-' + hashring + '-' + resource]: i.ingestors[hashring][resource]
+  for hashring in std.objectFields(i.ingestors)
+  for resource in std.objectFields(i.ingestors[hashring])
+  if i.ingestors[hashring][resource] != null
+}
 ```
 
 And here's the [build.sh](build.sh) script (which uses `vendor/` to render all manifests in a json structure of `{filename: manifest-content}`):
@@ -137,10 +166,15 @@ find manifests -type f ! -name '*.yaml' -delete
 # The following script generates all components, mostly used for testing
 
 rm -rf examples/all/manifests
+rm -rf examples/development-minio
 mkdir examples/all/manifests
+mkdir examples/development-minio
 
 ${JSONNET} -J vendor -m examples/all/manifests "${1-all.jsonnet}" | xargs -I{} sh -c "cat {} | ${GOJSONTOYAML} > {}.yaml; rm -f {}" -- {}
 find examples/all/manifests -type f ! -name '*.yaml' -delete
+
+${JSONNET} -J vendor -m examples/development-minio "${1-minio.jsonnet}" | xargs -I{} sh -c "cat {} | ${GOJSONTOYAML} > {}.yaml; rm -f {}" -- {}
+find examples/development-minio -type f ! -name '*.yaml' -delete
 ```
 
 > Note you need `jsonnet` (`go get github.com/google/go-jsonnet/cmd/jsonnet`) and `gojsontoyaml` (`go get github.com/brancz/gojsontoyaml`) installed to run `build.sh`. If you just want json output, not yaml, then you can skip the pipe and everything afterwards.

all.jsonnet

@@ -6,12 +6,14 @@ local t = import 'kube-thanos/thanos.libsonnet';
 local commonConfig = {
   local cfg = self,
   namespace: 'thanos',
-  version: 'v0.19.0',
+  version: 'v0.30.2',
   image: 'quay.io/thanos/thanos:' + cfg.version,
   replicaLabels: ['prometheus_replica', 'rule_replica'],
   objectStorageConfig: {
     name: 'thanos-objectstorage',
     key: 'thanos.yaml',
+    tlsSecretName: '',
+    tlsSecretMountPath: '',
   },
   resources: {
     requests: { cpu: 0.123, memory: '123Mi' },
@@ -49,6 +51,18 @@ local b = t.bucket(commonConfig {
   // },
 });
 
+local br = t.bucketReplicate(commonConfig {
+  replicas: 1,
+  // Use the same object storage secret as an example.
+  // Need to use another one in real cases.
+  objectStorageToConfig: {
+    name: 'thanos-objectstorage',
+    key: 'thanos.yaml',
+  },
+  compactionLevels: [1, 2, 3],
+  resolutions: ['0s'],
+});
+
 local c = t.compact(commonConfig {
   replicas: 1,
   serviceMonitor: true,
@@ -56,6 +70,14 @@ local c = t.compact(commonConfig {
   deduplicationReplicaLabels: super.replicaLabels,  // reuse same labels for deduplication
 });
 
+local cs = t.compactShards(commonConfig {
+  shards: 3,
+  sourceLabels: ['cluster'],
+  replicas: 1,
+  serviceMonitor: true,
+  disableDownsampling: true,
+});
+
 local re = t.receive(commonConfig {
   replicas: 1,
   replicationFactor: 1,
@@ -67,6 +89,14 @@ local ru = t.rule(commonConfig {
   replicas: 1,
   rulesConfig: [{ name: 'test', key: 'test' }],
   alertmanagersURLs: ['alertmanager:9093'],
+  alertmanagerConfigFile: {
+    name: 'thanos-ruler-config',
+    key: 'config.yaml',
+  },
+  remoteWriteConfigFile: {
+    name: 'thanos-stateless-ruler-config',
+    key: 'rw-config.yaml',
+  },
   reloaderImage: 'jimmidyson/configmap-reload:v0.5.0',
   serviceMonitor: true,
 });
@@ -90,7 +120,7 @@ local s = t.store(commonConfig {
     config+: {
       // NOTICE: <MEMCACHED_SERVICE> is a placeholder to generate examples.
       // List of memcached addresses, that will get resolved with the DNS service discovery provider.
-      // For DNS service discovery reference https://thanos.io/service-discovery.md/#dns-service-discovery
+      // For DNS service discovery reference https://thanos.io/tip/thanos/service-discovery.md/#dns-service-discovery
       addresses: ['dnssrv+_client._tcp.<MEMCACHED_SERVICE>.%s.svc.cluster.local' % commonConfig.namespace],
     },
   },
@@ -99,7 +129,7 @@ local s = t.store(commonConfig {
     config+: {
       // NOTICE: <MEMCACHED_SERVICE> is a placeholder to generate examples.
       // List of memcached addresses, that will get resolved with the DNS service discovery provider.
-      // For DNS service discovery reference https://thanos.io/service-discovery.md/#dns-service-discovery
+      // For DNS service discovery reference https://thanos.io/tip/thanos/service-discovery.md/#dns-service-discovery
       addresses: ['dnssrv+_client._tcp.<MEMCACHED_SERVICE>.%s.svc.cluster.local' % commonConfig.namespace],
     },
   },
@@ -141,7 +171,7 @@ local qf = t.queryFrontend(commonConfig {
     config+: {
       // NOTICE: <MEMCACHED_SERVICE> is a placeholder to generate examples.
       // List of memcached addresses, that will get resolved with the DNS service discovery provider.
-      // For DNS service discovery reference https://thanos.io/service-discovery.md/#dns-service-discovery
+      // For DNS service discovery reference https://thanos.io/tip/thanos/service-discovery.md/#dns-service-discovery
       addresses: ['dnssrv+_client._tcp.<MEMCACHED_SERVICE>.%s.svc.cluster.local' % commonConfig.namespace],
     },
   },
@@ -150,7 +180,7 @@ local qf = t.queryFrontend(commonConfig {
     config+: {
       // NOTICE: <MEMCACHED_SERVICE> is a placeholder to generate examples.
       // List of memcached addresses, that will get resolved with the DNS service discovery provider.
-      // For DNS service discovery reference https://thanos.io/service-discovery.md/#dns-service-discovery
+      // For DNS service discovery reference https://thanos.io/tip/thanos/service-discovery.md/#dns-service-discovery
       addresses: ['dnssrv+_client._tcp.<MEMCACHED_SERVICE>.%s.svc.cluster.local' % commonConfig.namespace],
     },
   },
@@ -182,7 +212,7 @@ local strs = t.storeShards(commonConfig {
     config+: {
       // NOTICE: <MEMCACHED_SERVICE> is a placeholder to generate examples.
       // List of memcached addresses, that will get resolved with the DNS service discovery provider.
-      // For DNS service discovery reference https://thanos.io/service-discovery.md/#dns-service-discovery
+      // For DNS service discovery reference https://thanos.io/tip/thanos/service-discovery.md/#dns-service-discovery
       addresses: ['dnssrv+_client._tcp.<MEMCACHED_SERVICE>.%s.svc.cluster.local' % commonConfig.namespace],
     },
   },
@@ -191,7 +221,7 @@ local strs = t.storeShards(commonConfig {
     config+: {
       // NOTICE: <MEMCACHED_SERVICE> is a placeholder to generate examples.
       // List of memcached addresses, that will get resolved with the DNS service discovery provider.
-      // For DNS service discovery reference https://thanos.io/service-discovery.md/#dns-service-discovery
+      // For DNS service discovery reference https://thanos.io/tip/thanos/service-discovery.md/#dns-service-discovery
       addresses: ['dnssrv+_client._tcp.<MEMCACHED_SERVICE>.%s.svc.cluster.local' % commonConfig.namespace],
     },
   },
@@ -207,7 +237,14 @@ local finalQ = t.query(q.config {
 });
 
 { ['thanos-bucket-' + name]: b[name] for name in std.objectFields(b) if b[name] != null } +
+{ ['thanos-bucket-replicate-' + name]: br[name] for name in std.objectFields(br) if br[name] != null } +
 { ['thanos-compact-' + name]: c[name] for name in std.objectFields(c) if c[name] != null } +
+{
+  ['thanos-compact-' + shard + '-' + name]: cs.shards[shard][name]
+  for shard in std.objectFields(cs.shards)
+  for name in std.objectFields(cs.shards[shard])
+  if cs.shards[shard][name] != null
+} +
 { ['thanos-receive-' + name]: re[name] for name in std.objectFields(re) if re[name] != null } +
 { ['thanos-rule-' + name]: finalRu[name] for name in std.objectFields(finalRu) if finalRu[name] != null } +
 { ['thanos-sidecar-' + name]: sc[name] for name in std.objectFields(sc) if sc[name] != null } +
@@ -221,12 +258,11 @@ local finalQ = t.query(q.config {
   if rcvs.hashrings[hashring][name] != null
 } +
 {
-  ['store-' + shard + '-' + name]: strs.shards[shard][name]
+  ['thanos-store-' + shard + '-' + name]: strs.shards[shard][name]
   for shard in std.objectFields(strs.shards)
   for name in std.objectFields(strs.shards[shard])
   if strs.shards[shard][name] != null
 } +
-{
-  'store-shards-serviceMonitor': strs.serviceMonitor,
-  'receive-hashrings-serviceMonitor': rcvs.serviceMonitor,
-}
+{ ['thanos-compact-shards-' + name]: cs[name] for name in std.objectFields(cs) if name != 'shards' && cs[name] != null } +
+{ ['thanos-receive-hashrings-' + name]: rcvs[name] for name in std.objectFields(rcvs) if name != 'hashrings' && rcvs[name] != null } +
+{ ['thanos-store-shards-' + name]: strs[name] for name in std.objectFields(strs) if name != 'shards' && strs[name] != null }

build.sh

@@ -21,7 +21,12 @@ find manifests -type f ! -name '*.yaml' -delete
 # The following script generates all components, mostly used for testing
 
 rm -rf examples/all/manifests
+rm -rf examples/development-minio
 mkdir examples/all/manifests
+mkdir examples/development-minio
 
 ${JSONNET} -J vendor -m examples/all/manifests "${1-all.jsonnet}" | xargs -I{} sh -c "cat {} | ${GOJSONTOYAML} > {}.yaml; rm -f {}" -- {}
 find examples/all/manifests -type f ! -name '*.yaml' -delete
+
+${JSONNET} -J vendor -m examples/development-minio "${1-minio.jsonnet}" | xargs -I{} sh -c "cat {} | ${GOJSONTOYAML} > {}.yaml; rm -f {}" -- {}
+find examples/development-minio -type f ! -name '*.yaml' -delete

example.jsonnet

@@ -6,12 +6,14 @@ local commonConfig = {
   config+:: {
     local cfg = self,
     namespace: 'thanos',
-    version: 'v0.19.0',
+    version: 'v0.31.0',
     image: 'quay.io/thanos/thanos:' + cfg.version,
+    imagePullPolicy: 'IfNotPresent',
     objectStorageConfig: {
       name: 'thanos-objectstorage',
       key: 'thanos.yaml',
     },
+    hashringConfigMapName: 'hashring-config',
     volumeClaimTemplate: {
       spec: {
         accessModes: ['ReadWriteOnce'],
@@ -25,6 +27,24 @@ local commonConfig = {
   },
 };
 
+local i = t.receiveIngestor(commonConfig.config {
+  replicas: 1,
+  replicaLabels: ['receive_replica'],
+  replicationFactor: 1,
+  // Disable shipping to object storage for the purposes of this example
+  objectStorageConfig: null,
+  serviceMonitor: true,
+});
+
+local r = t.receiveRouter(commonConfig.config {
+  replicas: 1,
+  replicaLabels: ['receive_replica'],
+  replicationFactor: 1,
+  // Disable shipping to object storage for the purposes of this example
+  objectStorageConfig: null,
+  endpoints: i.endpoints,
+});
+
 local s = t.store(commonConfig.config {
   replicas: 1,
   serviceMonitor: true,
@@ -34,7 +54,16 @@ local q = t.query(commonConfig.config {
   replicas: 1,
   replicaLabels: ['prometheus_replica', 'rule_replica'],
   serviceMonitor: true,
+  stores: [s.storeEndpoint] + i.storeEndpoints,
 });
 
 { ['thanos-store-' + name]: s[name] for name in std.objectFields(s) } +
-{ ['thanos-query-' + name]: q[name] for name in std.objectFields(q) }
+{ ['thanos-query-' + name]: q[name] for name in std.objectFields(q) } +
+{ ['thanos-receive-router-' + resource]: r[resource] for resource in std.objectFields(r) } +
+{ ['thanos-receive-ingestor-' + resource]: i[resource] for resource in std.objectFields(i) if resource != 'ingestors' } +
+{
+  ['thanos-receive-ingestor-' + hashring + '-' + resource]: i.ingestors[hashring][resource]
+  for hashring in std.objectFields(i.ingestors)
+  for resource in std.objectFields(i.ingestors[hashring])
+  if i.ingestors[hashring][resource] != null
+}

examples/all/manifests/thanos-bucket-deployment.yaml

@@ -5,7 +5,7 @@ metadata:
     app.kubernetes.io/component: object-store-bucket-debugging
     app.kubernetes.io/instance: thanos-bucket
     app.kubernetes.io/name: thanos-bucket
-    app.kubernetes.io/version: v0.19.0
+    app.kubernetes.io/version: v0.30.2
   name: thanos-bucket
   namespace: thanos
 spec:
@@ -21,7 +21,7 @@ spec:
         app.kubernetes.io/component: object-store-bucket-debugging
         app.kubernetes.io/instance: thanos-bucket
         app.kubernetes.io/name: thanos-bucket
-        app.kubernetes.io/version: v0.19.0
+        app.kubernetes.io/version: v0.30.2
     spec:
       containers:
       - args:
@@ -49,7 +49,8 @@ spec:
           valueFrom:
             fieldRef:
               fieldPath: status.hostIP
-        image: quay.io/thanos/thanos:v0.19.0
+        image: quay.io/thanos/thanos:v0.30.2
+        imagePullPolicy: IfNotPresent
         livenessProbe:
           failureThreshold: 4
           httpGet:
@@ -75,11 +76,28 @@ spec:
           requests:
             cpu: 0.123
             memory: 123Mi
+        securityContext:
+          allowPrivilegeEscalation: false
+          capabilities:
+            drop:
+            - ALL
+          readOnlyRootFilesystem: true
+          runAsGroup: 65532
+          runAsNonRoot: true
+          runAsUser: 65534
+          seccompProfile:
+            type: RuntimeDefault
         terminationMessagePolicy: FallbackToLogsOnError
+        volumeMounts: []
       nodeSelector:
-        beta.kubernetes.io/os: linux
+        kubernetes.io/os: linux
       securityContext:
         fsGroup: 65534
+        runAsGroup: 65532
+        runAsNonRoot: true
         runAsUser: 65534
+        seccompProfile:
+          type: RuntimeDefault
       serviceAccountName: thanos-bucket
       terminationGracePeriodSeconds: 120
+      volumes: []

examples/all/manifests/thanos-bucket-replicate-deployment.yaml

@@ -0,0 +1,100 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  labels:
+    app.kubernetes.io/component: object-store-bucket-replicate
+    app.kubernetes.io/instance: thanos-bucket-replicate
+    app.kubernetes.io/name: thanos-bucket-replicate
+    app.kubernetes.io/version: v0.30.2
+  name: thanos-bucket-replicate
+  namespace: thanos
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/component: object-store-bucket-replicate
+      app.kubernetes.io/instance: thanos-bucket-replicate
+      app.kubernetes.io/name: thanos-bucket-replicate
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/component: object-store-bucket-replicate
+        app.kubernetes.io/instance: thanos-bucket-replicate
+        app.kubernetes.io/name: thanos-bucket-replicate
+        app.kubernetes.io/version: v0.30.2
+    spec:
+      containers:
+      - args:
+        - tools
+        - bucket
+        - replicate
+        - --log.level=info
+        - --log.format=logfmt
+        - --objstore.config=$(OBJSTORE_CONFIG)
+        - --objstore-to.config=$(OBJSTORE_TO_CONFIG)
+        - |-
+          --tracing.config="config":
+            "sampler_param": 2
+            "sampler_type": "ratelimiting"
+            "service_name": "thanos-bucket-replicate"
+          "type": "JAEGER"
+        - --compaction=1
+        - --compaction=2
+        - --compaction=3
+        - --resolution=0s
+        env:
+        - name: OBJSTORE_CONFIG
+          valueFrom:
+            secretKeyRef:
+              key: thanos.yaml
+              name: thanos-objectstorage
+        - name: OBJSTORE_TO_CONFIG
+          valueFrom:
+            secretKeyRef:
+              key: thanos.yaml
+              name: thanos-objectstorage
+        - name: HOST_IP_ADDRESS
+          valueFrom:
+            fieldRef:
+              fieldPath: status.hostIP
+        image: quay.io/thanos/thanos:v0.30.2
+        imagePullPolicy: IfNotPresent
+        livenessProbe:
+          failureThreshold: 4
+          httpGet:
+            path: /-/healthy
+            port: 10902
+            scheme: HTTP
+          periodSeconds: 30
+        name: thanos-bucket-replicate
+        ports:
+        - containerPort: 10902
+          name: http
+        readinessProbe:
+          failureThreshold: 20
+          httpGet:
+            path: /-/ready
+            port: 10902
+            scheme: HTTP
+          periodSeconds: 5
+        resources:
+          limits:
+            cpu: 0.42
+            memory: 420Mi
+          requests:
+            cpu: 0.123
+            memory: 123Mi
+        terminationMessagePolicy: FallbackToLogsOnError
+        volumeMounts: []
+      nodeSelector:
+        kubernetes.io/os: linux
+      securityContext:
+        fsGroup: 65534
+        runAsGroup: 65532
+        runAsNonRoot: true
+        runAsUser: 65534
+        seccompProfile:
+          type: RuntimeDefault
+      serviceAccountName: thanos-bucket-replicate
+      terminationGracePeriodSeconds: 120
+      volumes: []

examples/all/manifests/thanos-bucket-replicate-service.yaml

@@ -0,0 +1,19 @@
+apiVersion: v1
+kind: Service
+metadata:
+  labels:
+    app.kubernetes.io/component: object-store-bucket-replicate
+    app.kubernetes.io/instance: thanos-bucket-replicate
+    app.kubernetes.io/name: thanos-bucket-replicate
+    app.kubernetes.io/version: v0.30.2
+  name: thanos-bucket-replicate
+  namespace: thanos
+spec:
+  ports:
+  - name: http
+    port: 10902
+    targetPort: 10902
+  selector:
+    app.kubernetes.io/component: object-store-bucket-replicate
+    app.kubernetes.io/instance: thanos-bucket-replicate
+    app.kubernetes.io/name: thanos-bucket-replicate

examples/all/manifests/thanos-bucket-replicate-serviceAccount.yaml

@@ -0,0 +1,11 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  annotations: {}
+  labels:
+    app.kubernetes.io/component: object-store-bucket-replicate
+    app.kubernetes.io/instance: thanos-bucket-replicate
+    app.kubernetes.io/name: thanos-bucket-replicate
+    app.kubernetes.io/version: v0.30.2
+  name: thanos-bucket-replicate
+  namespace: thanos

examples/all/manifests/thanos-bucket-service.yaml

@@ -5,7 +5,7 @@ metadata:
     app.kubernetes.io/component: object-store-bucket-debugging
     app.kubernetes.io/instance: thanos-bucket
     app.kubernetes.io/name: thanos-bucket
-    app.kubernetes.io/version: v0.19.0
+    app.kubernetes.io/version: v0.30.2
   name: thanos-bucket
   namespace: thanos
 spec:

examples/all/manifests/thanos-bucket-serviceAccount.yaml

@@ -1,10 +1,11 @@
 apiVersion: v1
 kind: ServiceAccount
 metadata:
+  annotations: {}
   labels:
     app.kubernetes.io/component: object-store-bucket-debugging
     app.kubernetes.io/instance: thanos-bucket
     app.kubernetes.io/name: thanos-bucket
-    app.kubernetes.io/version: v0.19.0
+    app.kubernetes.io/version: v0.30.2
   name: thanos-bucket
   namespace: thanos

examples/all/manifests/thanos-compact-service.yaml

@@ -5,10 +5,11 @@ metadata:
     app.kubernetes.io/component: database-compactor
     app.kubernetes.io/instance: thanos-compact
     app.kubernetes.io/name: thanos-compact
-    app.kubernetes.io/version: v0.19.0
+    app.kubernetes.io/version: v0.30.2
   name: thanos-compact
   namespace: thanos
 spec:
+  clusterIP: None
   ports:
   - name: http
     port: 10902

examples/all/manifests/thanos-compact-serviceAccount.yaml

@@ -1,10 +1,11 @@
 apiVersion: v1
 kind: ServiceAccount
 metadata:
+  annotations: {}
   labels:
     app.kubernetes.io/component: database-compactor
     app.kubernetes.io/instance: thanos-compact
     app.kubernetes.io/name: thanos-compact
-    app.kubernetes.io/version: v0.19.0
+    app.kubernetes.io/version: v0.30.2
   name: thanos-compact
   namespace: thanos

examples/all/manifests/thanos-compact-serviceMonitor.yaml

@@ -5,14 +5,15 @@ metadata:
     app.kubernetes.io/component: database-compactor
     app.kubernetes.io/instance: thanos-compact
     app.kubernetes.io/name: thanos-compact
-    app.kubernetes.io/version: v0.19.0
+    app.kubernetes.io/version: v0.30.2
   name: thanos-compact
   namespace: thanos
 spec:
   endpoints:
   - port: http
     relabelings:
-    - separator: /
+    - action: replace
+      separator: /
       sourceLabels:
       - namespace
       - pod

examples/all/manifests/thanos-compact-shard0-service.yaml

@@ -0,0 +1,22 @@
+apiVersion: v1
+kind: Service
+metadata:
+  labels:
+    app.kubernetes.io/component: database-compactor
+    app.kubernetes.io/instance: thanos-compact-0
+    app.kubernetes.io/name: thanos-compact
+    app.kubernetes.io/version: v0.30.2
+    compact.thanos.io/shard: shard-0
+  name: thanos-compact-0
+  namespace: thanos
+spec:
+  clusterIP: None
+  ports:
+  - name: http
+    port: 10902
+    targetPort: 10902
+  selector:
+    app.kubernetes.io/component: database-compactor
+    app.kubernetes.io/instance: thanos-compact-0
+    app.kubernetes.io/name: thanos-compact
+    compact.thanos.io/shard: shard-0

examples/all/manifests/thanos-compact-shard0-statefulSet.yaml

@@ -0,0 +1,146 @@
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  labels:
+    app.kubernetes.io/component: database-compactor
+    app.kubernetes.io/instance: thanos-compact-0
+    app.kubernetes.io/name: thanos-compact
+    app.kubernetes.io/version: v0.30.2
+    compact.thanos.io/shard: shard-0
+  name: thanos-compact-0
+  namespace: thanos
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/component: database-compactor
+      app.kubernetes.io/instance: thanos-compact-0
+      app.kubernetes.io/name: thanos-compact
+      compact.thanos.io/shard: shard-0
+  serviceName: thanos-compact-0
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/component: database-compactor
+        app.kubernetes.io/instance: thanos-compact-0
+        app.kubernetes.io/name: thanos-compact
+        app.kubernetes.io/version: v0.30.2
+        compact.thanos.io/shard: shard-0
+    spec:
+      affinity:
+        podAntiAffinity:
+          preferredDuringSchedulingIgnoredDuringExecution:
+          - podAffinityTerm:
+              labelSelector:
+                matchExpressions:
+                - key: app.kubernetes.io/name
+                  operator: In
+                  values:
+                  - thanos-compact
+                - key: app.kubernetes.io/instance
+                  operator: In
+                  values:
+                  - thanos-compact-0
+              namespaces:
+              - thanos
+              topologyKey: kubernetes.io/hostname
+            weight: 100
+      containers:
+      - args:
+        - compact
+        - --wait
+        - --log.level=info
+        - --log.format=logfmt
+        - --objstore.config=$(OBJSTORE_CONFIG)
+        - --data-dir=/var/thanos/compact
+        - --debug.accept-malformed-index
+        - --retention.resolution-raw=0d
+        - --retention.resolution-5m=0d
+        - --retention.resolution-1h=0d
+        - --delete-delay=48h
+        - --compact.concurrency=1
+        - --downsample.concurrency=1
+        - --downsampling.disable
+        - |-
+          --tracing.config="config":
+            "sampler_param": 2
+            "sampler_type": "ratelimiting"
+            "service_name": "thanos-compact"
+          "type": "JAEGER"
+        - |
+          --selector.relabel-config=
+            - action: hashmod
+              source_labels: ["cluster"]
+              target_label: shard
+              modulus: 3
+            - action: keep
+              source_labels: ["shard"]
+              regex: 0
+        env:
+        - name: OBJSTORE_CONFIG
+          valueFrom:
+            secretKeyRef:
+              key: thanos.yaml
+              name: thanos-objectstorage
+        - name: HOST_IP_ADDRESS
+          valueFrom:
+            fieldRef:
+              fieldPath: status.hostIP
+        image: quay.io/thanos/thanos:v0.30.2
+        imagePullPolicy: IfNotPresent
+        livenessProbe:
+          failureThreshold: 4
+          httpGet:
+            path: /-/healthy
+            port: 10902
+            scheme: HTTP
+          periodSeconds: 30
+        name: thanos-compact
+        ports:
+        - containerPort: 10902
+          name: http
+        readinessProbe:
+          failureThreshold: 20
+          httpGet:
+            path: /-/ready
+            port: 10902
+            scheme: HTTP
+          periodSeconds: 5
+        resources:
+          limits:
+            cpu: 0.42
+            memory: 420Mi
+          requests:
+            cpu: 0.123
+            memory: 123Mi
+        terminationMessagePolicy: FallbackToLogsOnError
+        volumeMounts:
+        - mountPath: /var/thanos/compact
+          name: data
+          readOnly: false
+      nodeSelector:
+        kubernetes.io/os: linux
+      securityContext:
+        fsGroup: 65534
+        runAsGroup: 65532
+        runAsNonRoot: true
+        runAsUser: 65534
+        seccompProfile:
+          type: RuntimeDefault
+      serviceAccountName: thanos-compact
+      terminationGracePeriodSeconds: 120
+      volumes: []
+  volumeClaimTemplates:
+  - metadata:
+      labels:
+        app.kubernetes.io/component: database-compactor
+        app.kubernetes.io/instance: thanos-compact-0
+        app.kubernetes.io/name: thanos-compact
+        compact.thanos.io/shard: shard-0
+      name: data
+    spec:
+      accessModes:
+      - ReadWriteOnce
+      resources:
+        requests:
+          storage: 10Gi

examples/all/manifests/thanos-compact-shard1-service.yaml

@@ -0,0 +1,22 @@
+apiVersion: v1
+kind: Service
+metadata:
+  labels:
+    app.kubernetes.io/component: database-compactor
+    app.kubernetes.io/instance: thanos-compact-1
+    app.kubernetes.io/name: thanos-compact
+    app.kubernetes.io/version: v0.30.2
+    compact.thanos.io/shard: shard-1
+  name: thanos-compact-1
+  namespace: thanos
+spec:
+  clusterIP: None
+  ports:
+  - name: http
+    port: 10902
+    targetPort: 10902
+  selector:
+    app.kubernetes.io/component: database-compactor
+    app.kubernetes.io/instance: thanos-compact-1
+    app.kubernetes.io/name: thanos-compact
+    compact.thanos.io/shard: shard-1

examples/all/manifests/thanos-compact-shard1-statefulSet.yaml

@@ -0,0 +1,146 @@
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  labels:
+    app.kubernetes.io/component: database-compactor
+    app.kubernetes.io/instance: thanos-compact-1
+    app.kubernetes.io/name: thanos-compact
+    app.kubernetes.io/version: v0.30.2
+    compact.thanos.io/shard: shard-1
+  name: thanos-compact-1
+  namespace: thanos
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/component: database-compactor
+      app.kubernetes.io/instance: thanos-compact-1
+      app.kubernetes.io/name: thanos-compact
+      compact.thanos.io/shard: shard-1
+  serviceName: thanos-compact-1
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/component: database-compactor
+        app.kubernetes.io/instance: thanos-compact-1
+        app.kubernetes.io/name: thanos-compact
+        app.kubernetes.io/version: v0.30.2
+        compact.thanos.io/shard: shard-1
+    spec:
+      affinity:
+        podAntiAffinity:
+          preferredDuringSchedulingIgnoredDuringExecution:
+          - podAffinityTerm:
+              labelSelector:
+                matchExpressions:
+                - key: app.kubernetes.io/name
+                  operator: In
+                  values:
+                  - thanos-compact
+                - key: app.kubernetes.io/instance
+                  operator: In
+                  values:
+                  - thanos-compact-1
+              namespaces:
+              - thanos
+              topologyKey: kubernetes.io/hostname
+            weight: 100
+      containers:
+      - args:
+        - compact
+        - --wait
+        - --log.level=info
+        - --log.format=logfmt
+        - --objstore.config=$(OBJSTORE_CONFIG)
+        - --data-dir=/var/thanos/compact
+        - --debug.accept-malformed-index
+        - --retention.resolution-raw=0d
+        - --retention.resolution-5m=0d
+        - --retention.resolution-1h=0d
+        - --delete-delay=48h
+        - --compact.concurrency=1
+        - --downsample.concurrency=1
+        - --downsampling.disable
+        - |-
+          --tracing.config="config":
+            "sampler_param": 2
+            "sampler_type": "ratelimiting"
+            "service_name": "thanos-compact"
+          "type": "JAEGER"
+        - |
+          --selector.relabel-config=
+            - action: hashmod
+              source_labels: ["cluster"]
+              target_label: shard
+              modulus: 3
+            - action: keep
+              source_labels: ["shard"]
+              regex: 1
+        env:
+        - name: OBJSTORE_CONFIG
+          valueFrom:
+            secretKeyRef:
+              key: thanos.yaml
+              name: thanos-objectstorage
+        - name: HOST_IP_ADDRESS
+          valueFrom:
+            fieldRef:
+              fieldPath: status.hostIP
+        image: quay.io/thanos/thanos:v0.30.2
+        imagePullPolicy: IfNotPresent
+        livenessProbe:
+          failureThreshold: 4
+          httpGet:
+            path: /-/healthy
+            port: 10902
+            scheme: HTTP
+          periodSeconds: 30
+        name: thanos-compact
+        ports:
+        - containerPort: 10902
+          name: http
+        readinessProbe:
+          failureThreshold: 20
+          httpGet:
+            path: /-/ready
+            port: 10902
+            scheme: HTTP
+          periodSeconds: 5
+        resources:
+          limits:
+            cpu: 0.42
+            memory: 420Mi
+          requests:
+            cpu: 0.123
+            memory: 123Mi
+        terminationMessagePolicy: FallbackToLogsOnError
+        volumeMounts:
+        - mountPath: /var/thanos/compact
+          name: data
+          readOnly: false
+      nodeSelector:
+        kubernetes.io/os: linux
+      securityContext:
+        fsGroup: 65534
+        runAsGroup: 65532
+        runAsNonRoot: true
+        runAsUser: 65534
+        seccompProfile:
+          type: RuntimeDefault
+      serviceAccountName: thanos-compact
+      terminationGracePeriodSeconds: 120
+      volumes: []
+  volumeClaimTemplates:
+  - metadata:
+      labels:
+        app.kubernetes.io/component: database-compactor
+        app.kubernetes.io/instance: thanos-compact-1
+        app.kubernetes.io/name: thanos-compact
+        compact.thanos.io/shard: shard-1
+      name: data
+    spec:
+      accessModes:
+      - ReadWriteOnce
+      resources:
+        requests:
+          storage: 10Gi

examples/all/manifests/thanos-compact-shard2-service.yaml

@@ -0,0 +1,22 @@
+apiVersion: v1
+kind: Service
+metadata:
+  labels:
+    app.kubernetes.io/component: database-compactor
+    app.kubernetes.io/instance: thanos-compact-2
+    app.kubernetes.io/name: thanos-compact
+    app.kubernetes.io/version: v0.30.2
+    compact.thanos.io/shard: shard-2
+  name: thanos-compact-2
+  namespace: thanos
+spec:
+  clusterIP: None
+  ports:
+  - name: http
+    port: 10902
+    targetPort: 10902
+  selector:
+    app.kubernetes.io/component: database-compactor
+    app.kubernetes.io/instance: thanos-compact-2
+    app.kubernetes.io/name: thanos-compact
+    compact.thanos.io/shard: shard-2

examples/all/manifests/thanos-compact-shard2-statefulSet.yaml

@@ -0,0 +1,146 @@
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  labels:
+    app.kubernetes.io/component: database-compactor
+    app.kubernetes.io/instance: thanos-compact-2
+    app.kubernetes.io/name: thanos-compact
+    app.kubernetes.io/version: v0.30.2
+    compact.thanos.io/shard: shard-2
+  name: thanos-compact-2
+  namespace: thanos
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/component: database-compactor
+      app.kubernetes.io/instance: thanos-compact-2
+      app.kubernetes.io/name: thanos-compact
+      compact.thanos.io/shard: shard-2
+  serviceName: thanos-compact-2
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/component: database-compactor
+        app.kubernetes.io/instance: thanos-compact-2
+        app.kubernetes.io/name: thanos-compact
+        app.kubernetes.io/version: v0.30.2
+        compact.thanos.io/shard: shard-2
+    spec:
+      affinity:
+        podAntiAffinity:
+          preferredDuringSchedulingIgnoredDuringExecution:
+          - podAffinityTerm:
+              labelSelector:
+                matchExpressions:
+                - key: app.kubernetes.io/name
+                  operator: In
+                  values:
+                  - thanos-compact
+                - key: app.kubernetes.io/instance
+                  operator: In
+                  values:
+                  - thanos-compact-2
+              namespaces:
+              - thanos
+              topologyKey: kubernetes.io/hostname
+            weight: 100
+      containers:
+      - args:
+        - compact
+        - --wait
+        - --log.level=info
+        - --log.format=logfmt
+        - --objstore.config=$(OBJSTORE_CONFIG)
+        - --data-dir=/var/thanos/compact
+        - --debug.accept-malformed-index
+        - --retention.resolution-raw=0d
+        - --retention.resolution-5m=0d
+        - --retention.resolution-1h=0d
+        - --delete-delay=48h
+        - --compact.concurrency=1
+        - --downsample.concurrency=1
+        - --downsampling.disable
+        - |-
+          --tracing.config="config":
+            "sampler_param": 2
+            "sampler_type": "ratelimiting"
+            "service_name": "thanos-compact"
+          "type": "JAEGER"
+        - |
+          --selector.relabel-config=
+            - action: hashmod
+              source_labels: ["cluster"]
+              target_label: shard
+              modulus: 3
+            - action: keep
+              source_labels: ["shard"]
+              regex: 2
+        env:
+        - name: OBJSTORE_CONFIG
+          valueFrom:
+            secretKeyRef:
+              key: thanos.yaml
+              name: thanos-objectstorage
+        - name: HOST_IP_ADDRESS
+          valueFrom:
+            fieldRef:
+              fieldPath: status.hostIP
+        image: quay.io/thanos/thanos:v0.30.2
+        imagePullPolicy: IfNotPresent
+        livenessProbe:
+          failureThreshold: 4
+          httpGet:
+            path: /-/healthy
+            port: 10902
+            scheme: HTTP
+          periodSeconds: 30
+        name: thanos-compact
+        ports:
+        - containerPort: 10902
+          name: http
+        readinessProbe:
+          failureThreshold: 20
+          httpGet:
+            path: /-/ready
+            port: 10902
+            scheme: HTTP
+          periodSeconds: 5
+        resources:
+          limits:
+            cpu: 0.42
+            memory: 420Mi
+          requests:
+            cpu: 0.123
+            memory: 123Mi
+        terminationMessagePolicy: FallbackToLogsOnError
+        volumeMounts:
+        - mountPath: /var/thanos/compact
+          name: data
+          readOnly: false
+      nodeSelector:
+        kubernetes.io/os: linux
+      securityContext:
+        fsGroup: 65534
+        runAsGroup: 65532
+        runAsNonRoot: true
+        runAsUser: 65534
+        seccompProfile:
+          type: RuntimeDefault
+      serviceAccountName: thanos-compact
+      terminationGracePeriodSeconds: 120
+      volumes: []
+  volumeClaimTemplates:
+  - metadata:
+      labels:
+        app.kubernetes.io/component: database-compactor
+        app.kubernetes.io/instance: thanos-compact-2
+        app.kubernetes.io/name: thanos-compact
+        compact.thanos.io/shard: shard-2
+      name: data
+    spec:
+      accessModes:
+      - ReadWriteOnce
+      resources:
+        requests:
+          storage: 10Gi

examples/all/manifests/thanos-compact-shards-serviceAccount.yaml

@@ -0,0 +1,11 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  annotations: {}
+  labels:
+    app.kubernetes.io/component: database-compactor
+    app.kubernetes.io/instance: thanos-compact
+    app.kubernetes.io/name: thanos-compact
+    app.kubernetes.io/version: v0.30.2
+  name: thanos-compact
+  namespace: thanos

examples/all/manifests/thanos-compact-shards-serviceMonitor.yaml

@@ -0,0 +1,30 @@
+apiVersion: monitoring.coreos.com/v1
+kind: ServiceMonitor
+metadata:
+  labels:
+    app.kubernetes.io/component: database-compactor
+    app.kubernetes.io/instance: thanos-compact
+    app.kubernetes.io/name: thanos-compact
+    app.kubernetes.io/version: v0.30.2
+  name: thanos-compact
+  namespace: thanos
+spec:
+  endpoints:
+  - port: http
+    relabelings:
+    - action: replace
+      separator: /
+      sourceLabels:
+      - namespace
+      - pod
+      targetLabel: instance
+    - action: replace
+      regex: shard\-(\d+)
+      replacement: $1
+      sourceLabels:
+      - __meta_kubernetes_service_label_compact_thanos_io_shard
+      targetLabel: shard
+  selector:
+    matchLabels:
+      app.kubernetes.io/component: database-compactor
+      app.kubernetes.io/name: thanos-compact

examples/all/manifests/thanos-compact-statefulSet.yaml

@@ -5,7 +5,7 @@ metadata:
     app.kubernetes.io/component: database-compactor
     app.kubernetes.io/instance: thanos-compact
     app.kubernetes.io/name: thanos-compact
-    app.kubernetes.io/version: v0.19.0
+    app.kubernetes.io/version: v0.30.2
   name: thanos-compact
   namespace: thanos
 spec:
@@ -22,8 +22,26 @@ spec:
         app.kubernetes.io/component: database-compactor
         app.kubernetes.io/instance: thanos-compact
         app.kubernetes.io/name: thanos-compact
-        app.kubernetes.io/version: v0.19.0
+        app.kubernetes.io/version: v0.30.2
     spec:
+      affinity:
+        podAntiAffinity:
+          preferredDuringSchedulingIgnoredDuringExecution:
+          - podAffinityTerm:
+              labelSelector:
+                matchExpressions:
+                - key: app.kubernetes.io/name
+                  operator: In
+                  values:
+                  - thanos-compact
+                - key: app.kubernetes.io/instance
+                  operator: In
+                  values:
+                  - thanos-compact
+              namespaces:
+              - thanos
+              topologyKey: kubernetes.io/hostname
+            weight: 100
       containers:
       - args:
         - compact
@@ -37,6 +55,8 @@ spec:
         - --retention.resolution-5m=0d
         - --retention.resolution-1h=0d
         - --delete-delay=48h
+        - --compact.concurrency=1
+        - --downsample.concurrency=1
         - --downsampling.disable
         - --deduplication.replica-label=prometheus_replica
         - --deduplication.replica-label=rule_replica
@@ -56,7 +76,8 @@ spec:
           valueFrom:
             fieldRef:
               fieldPath: status.hostIP
-        image: quay.io/thanos/thanos:v0.19.0
+        image: quay.io/thanos/thanos:v0.30.2
+        imagePullPolicy: IfNotPresent
         livenessProbe:
           failureThreshold: 4
           httpGet:
@@ -88,10 +109,14 @@ spec:
           name: data
           readOnly: false
       nodeSelector:
-        beta.kubernetes.io/os: linux
+        kubernetes.io/os: linux
       securityContext:
         fsGroup: 65534
+        runAsGroup: 65532
+        runAsNonRoot: true
         runAsUser: 65534
+        seccompProfile:
+          type: RuntimeDefault
       serviceAccountName: thanos-compact
       terminationGracePeriodSeconds: 120
       volumes: []

examples/all/manifests/thanos-query-deployment.yaml

@@ -5,7 +5,7 @@ metadata:
     app.kubernetes.io/component: query-layer
     app.kubernetes.io/instance: thanos-query
     app.kubernetes.io/name: thanos-query
-    app.kubernetes.io/version: v0.19.0
+    app.kubernetes.io/version: v0.30.2
   name: thanos-query
   namespace: thanos
 spec:
@@ -21,7 +21,7 @@ spec:
         app.kubernetes.io/component: query-layer
         app.kubernetes.io/instance: thanos-query
         app.kubernetes.io/name: thanos-query
-        app.kubernetes.io/version: v0.19.0
+        app.kubernetes.io/version: v0.30.2
     spec:
       affinity:
         podAntiAffinity:
@@ -46,15 +46,15 @@ spec:
         - --log.format=logfmt
         - --query.replica-label=prometheus_replica
         - --query.replica-label=rule_replica
-        - --store=dnssrv+_grpc._tcp.thanos-receive.thanos.svc.cluster.local
-        - --store=dnssrv+_grpc._tcp.thanos-rule.thanos.svc.cluster.local
-        - --store=dnssrv+_grpc._tcp.thanos-sidecar.thanos.svc.cluster.local
-        - --store=dnssrv+_grpc._tcp.thanos-store.thanos.svc.cluster.local
-        - --store=dnssrv+_grpc._tcp.thanos-receive-default.thanos.svc.cluster.local
-        - --store=dnssrv+_grpc._tcp.thanos-receive-region-1.thanos.svc.cluster.local
-        - --store=dnssrv+_grpc._tcp.thanos-store-0.thanos.svc.cluster.local
-        - --store=dnssrv+_grpc._tcp.thanos-store-1.thanos.svc.cluster.local
-        - --store=dnssrv+_grpc._tcp.thanos-store-2.thanos.svc.cluster.local
+        - --endpoint=dnssrv+_grpc._tcp.thanos-receive.thanos.svc.cluster.local
+        - --endpoint=dnssrv+_grpc._tcp.thanos-rule.thanos.svc.cluster.local
+        - --endpoint=dnssrv+_grpc._tcp.thanos-sidecar.thanos.svc.cluster.local
+        - --endpoint=dnssrv+_grpc._tcp.thanos-store.thanos.svc.cluster.local
+        - --endpoint=dnssrv+_grpc._tcp.thanos-receive-default.thanos.svc.cluster.local
+        - --endpoint=dnssrv+_grpc._tcp.thanos-receive-region-1.thanos.svc.cluster.local
+        - --endpoint=dnssrv+_grpc._tcp.thanos-store-0.thanos.svc.cluster.local
+        - --endpoint=dnssrv+_grpc._tcp.thanos-store-1.thanos.svc.cluster.local
+        - --endpoint=dnssrv+_grpc._tcp.thanos-store-2.thanos.svc.cluster.local
         - --query.timeout=5m
         - --query.lookback-delta=15m
         - |-
@@ -69,7 +69,8 @@ spec:
           valueFrom:
             fieldRef:
               fieldPath: status.hostIP
-        image: quay.io/thanos/thanos:v0.19.0
+        image: quay.io/thanos/thanos:v0.30.2
+        imagePullPolicy: IfNotPresent
         livenessProbe:
           failureThreshold: 4
           httpGet:
@@ -91,11 +92,26 @@ spec:
             scheme: HTTP
           periodSeconds: 5
         resources: {}
+        securityContext:
+          allowPrivilegeEscalation: false
+          capabilities:
+            drop:
+            - ALL
+          readOnlyRootFilesystem: true
+          runAsGroup: 65532
+          runAsNonRoot: true
+          runAsUser: 65534
+          seccompProfile:
+            type: RuntimeDefault
         terminationMessagePolicy: FallbackToLogsOnError
       nodeSelector:
-        beta.kubernetes.io/os: linux
+        kubernetes.io/os: linux
       securityContext:
         fsGroup: 65534
+        runAsGroup: 65532
+        runAsNonRoot: true
         runAsUser: 65534
+        seccompProfile:
+          type: RuntimeDefault
       serviceAccountName: thanos-query
       terminationGracePeriodSeconds: 120

examples/all/manifests/thanos-query-frontend-deployment.yaml

@@ -5,7 +5,7 @@ metadata:
     app.kubernetes.io/component: query-cache
     app.kubernetes.io/instance: thanos-query-frontend
     app.kubernetes.io/name: thanos-query-frontend
-    app.kubernetes.io/version: v0.19.0
+    app.kubernetes.io/version: v0.30.2
   name: thanos-query-frontend
   namespace: thanos
 spec:
@@ -21,7 +21,7 @@ spec:
         app.kubernetes.io/component: query-cache
         app.kubernetes.io/instance: thanos-query-frontend
         app.kubernetes.io/name: thanos-query-frontend
-        app.kubernetes.io/version: v0.19.0
+        app.kubernetes.io/version: v0.30.2
     spec:
       affinity:
         podAntiAffinity:
@@ -85,7 +85,8 @@ spec:
           valueFrom:
             fieldRef:
               fieldPath: status.hostIP
-        image: quay.io/thanos/thanos:v0.19.0
+        image: quay.io/thanos/thanos:v0.30.2
+        imagePullPolicy: IfNotPresent
         livenessProbe:
           failureThreshold: 4
           httpGet:
@@ -111,11 +112,26 @@ spec:
           requests:
             cpu: 0.123
             memory: 123Mi
+        securityContext:
+          allowPrivilegeEscalation: false
+          capabilities:
+            drop:
+            - ALL
+          readOnlyRootFilesystem: true
+          runAsGroup: 65532
+          runAsNonRoot: true
+          runAsUser: 65534
+          seccompProfile:
+            type: RuntimeDefault
         terminationMessagePolicy: FallbackToLogsOnError
       nodeSelector:
-        beta.kubernetes.io/os: linux
+        kubernetes.io/os: linux
       securityContext:
         fsGroup: 65534
+        runAsGroup: 65532
+        runAsNonRoot: true
         runAsUser: 65534
+        seccompProfile:
+          type: RuntimeDefault
       serviceAccountName: thanos-query-frontend
       terminationGracePeriodSeconds: 120

examples/all/manifests/thanos-query-frontend-service.yaml

@@ -5,7 +5,7 @@ metadata:
     app.kubernetes.io/component: query-cache
     app.kubernetes.io/instance: thanos-query-frontend
     app.kubernetes.io/name: thanos-query-frontend
-    app.kubernetes.io/version: v0.19.0
+    app.kubernetes.io/version: v0.30.2
   name: thanos-query-frontend
   namespace: thanos
 spec:

examples/all/manifests/thanos-query-frontend-serviceAccount.yaml

@@ -1,10 +1,11 @@
 apiVersion: v1
 kind: ServiceAccount
 metadata:
+  annotations: {}
   labels:
     app.kubernetes.io/component: query-cache
     app.kubernetes.io/instance: thanos-query-frontend
     app.kubernetes.io/name: thanos-query-frontend
-    app.kubernetes.io/version: v0.19.0
+    app.kubernetes.io/version: v0.30.2
   name: thanos-query-frontend
   namespace: thanos

examples/all/manifests/thanos-query-frontend-serviceMonitor.yaml

@@ -5,14 +5,15 @@ metadata:
     app.kubernetes.io/component: query-cache
     app.kubernetes.io/instance: thanos-query-frontend
     app.kubernetes.io/name: thanos-query-frontend
-    app.kubernetes.io/version: v0.19.0
+    app.kubernetes.io/version: v0.30.2
   name: thanos-query-frontend
   namespace: thanos
 spec:
   endpoints:
   - port: http
     relabelings:
-    - separator: /
+    - action: replace
+      separator: /
       sourceLabels:
       - namespace
       - pod

examples/all/manifests/thanos-query-service.yaml

@@ -5,7 +5,7 @@ metadata:
     app.kubernetes.io/component: query-layer
     app.kubernetes.io/instance: thanos-query
     app.kubernetes.io/name: thanos-query
-    app.kubernetes.io/version: v0.19.0
+    app.kubernetes.io/version: v0.30.2
   name: thanos-query
   namespace: thanos
 spec:

examples/all/manifests/thanos-query-serviceAccount.yaml

@@ -1,10 +1,11 @@
 apiVersion: v1
 kind: ServiceAccount
 metadata:
+  annotations: {}
   labels:
     app.kubernetes.io/component: query-layer
     app.kubernetes.io/instance: thanos-query
     app.kubernetes.io/name: thanos-query
-    app.kubernetes.io/version: v0.19.0
+    app.kubernetes.io/version: v0.30.2
   name: thanos-query
   namespace: thanos

examples/all/manifests/thanos-query-serviceMonitor.yaml

@@ -5,14 +5,15 @@ metadata:
     app.kubernetes.io/component: query-layer
     app.kubernetes.io/instance: thanos-query
     app.kubernetes.io/name: thanos-query
-    app.kubernetes.io/version: v0.19.0
+    app.kubernetes.io/version: v0.30.2
   name: thanos-query
   namespace: thanos
 spec:
   endpoints:
   - port: http
     relabelings:
-    - separator: /
+    - action: replace
+      separator: /
       sourceLabels:
       - namespace
       - pod

examples/all/manifests/thanos-receive-default-podDisruptionBudget.yaml

@@ -1,4 +1,4 @@
-apiVersion: policy/v1beta1
+apiVersion: policy/v1
 kind: PodDisruptionBudget
 metadata:
   name: thanos-receive-default

examples/all/manifests/thanos-receive-default-service.yaml

@@ -5,7 +5,7 @@ metadata:
     app.kubernetes.io/component: database-write-hashring
     app.kubernetes.io/instance: thanos-receive-default
     app.kubernetes.io/name: thanos-receive
-    app.kubernetes.io/version: v0.19.0
+    app.kubernetes.io/version: v0.30.2
     controller.receive.thanos.io/hashring: default
   name: thanos-receive-default
   namespace: thanos

examples/all/manifests/thanos-receive-default-statefulSet.yaml

@@ -5,12 +5,13 @@ metadata:
     app.kubernetes.io/component: database-write-hashring
     app.kubernetes.io/instance: thanos-receive-default
     app.kubernetes.io/name: thanos-receive
-    app.kubernetes.io/version: v0.19.0
+    app.kubernetes.io/version: v0.30.2
     controller.receive.thanos.io: thanos-receive-controller
     controller.receive.thanos.io/hashring: default
   name: thanos-receive-default
   namespace: thanos
 spec:
+  minReadySeconds: 0
   replicas: 3
   selector:
     matchLabels:
@@ -25,7 +26,7 @@ spec:
         app.kubernetes.io/component: database-write-hashring
         app.kubernetes.io/instance: thanos-receive-default
         app.kubernetes.io/name: thanos-receive
-        app.kubernetes.io/version: v0.19.0
+        app.kubernetes.io/version: v0.30.2
         controller.receive.thanos.io/hashring: default
     spec:
       affinity:
@@ -70,12 +71,12 @@ spec:
         - --http-address=0.0.0.0:10902
         - --remote-write.address=0.0.0.0:19291
         - --receive.replication-factor=2
-        - --objstore.config=$(OBJSTORE_CONFIG)
         - --tsdb.path=/var/thanos/receive
         - --tsdb.retention=15d
-        - --receive.local-endpoint=$(NAME).thanos-receive-default.$(NAMESPACE).svc.cluster.local:10901
         - --label=replica="$(NAME)"
         - --label=receive="true"
+        - --objstore.config=$(OBJSTORE_CONFIG)
+        - --receive.local-endpoint=$(NAME).thanos-receive-default.$(NAMESPACE).svc.cluster.local:10901
         - --receive.hashrings-file=/var/lib/thanos-receive/hashrings.json
         - |-
           --tracing.config="config":
@@ -92,16 +93,17 @@ spec:
           valueFrom:
             fieldRef:
               fieldPath: metadata.namespace
+        - name: HOST_IP_ADDRESS
+          valueFrom:
+            fieldRef:
+              fieldPath: status.hostIP
         - name: OBJSTORE_CONFIG
           valueFrom:
             secretKeyRef:
               key: thanos.yaml
               name: thanos-objectstorage
-        - name: HOST_IP_ADDRESS
-          valueFrom:
-            fieldRef:
-              fieldPath: status.hostIP
-        image: quay.io/thanos/thanos:v0.19.0
+        image: quay.io/thanos/thanos:v0.30.2
+        imagePullPolicy: IfNotPresent
         livenessProbe:
           failureThreshold: 8
           httpGet:
@@ -139,10 +141,14 @@ spec:
         - mountPath: /var/lib/thanos-receive
           name: hashring-config
       nodeSelector:
-        beta.kubernetes.io/os: linux
+        kubernetes.io/os: linux
       securityContext:
         fsGroup: 65534
+        runAsGroup: 65532
+        runAsNonRoot: true
         runAsUser: 65534
+        seccompProfile:
+          type: RuntimeDefault
       serviceAccountName: thanos-receive
       terminationGracePeriodSeconds: 900
       volumes:

examples/all/manifests/thanos-receive-hashrings-serviceAccount.yaml

@@ -0,0 +1,11 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  annotations: {}
+  labels:
+    app.kubernetes.io/component: database-write-hashring
+    app.kubernetes.io/instance: thanos-receive
+    app.kubernetes.io/name: thanos-receive
+    app.kubernetes.io/version: v0.30.2
+  name: thanos-receive
+  namespace: thanos

examples/all/manifests/thanos-receive-hashrings-serviceMonitor.yaml

@@ -5,19 +5,21 @@ metadata:
     app.kubernetes.io/component: database-write-hashring
     app.kubernetes.io/instance: thanos-receive
     app.kubernetes.io/name: thanos-receive
-    app.kubernetes.io/version: v0.19.0
+    app.kubernetes.io/version: v0.30.2
   name: thanos-receive
   namespace: thanos
 spec:
   endpoints:
   - port: http
     relabelings:
-    - separator: /
+    - action: replace
+      separator: /
       sourceLabels:
       - namespace
       - pod
       targetLabel: instance
-    - sourceLabels:
+    - action: replace
+      sourceLabels:
       - __meta_kubernetes_service_label_controller_receive_thanos_io_shard
       targetLabel: hashring
   selector:

examples/all/manifests/thanos-receive-region-1-podDisruptionBudget.yaml

@@ -1,4 +1,4 @@
-apiVersion: policy/v1beta1
+apiVersion: policy/v1
 kind: PodDisruptionBudget
 metadata:
   name: thanos-receive-region-1

examples/all/manifests/thanos-receive-region-1-service.yaml

@@ -5,7 +5,7 @@ metadata:
     app.kubernetes.io/component: database-write-hashring
     app.kubernetes.io/instance: thanos-receive-region-1
     app.kubernetes.io/name: thanos-receive
-    app.kubernetes.io/version: v0.19.0
+    app.kubernetes.io/version: v0.30.2
     controller.receive.thanos.io/hashring: region-1
   name: thanos-receive-region-1
   namespace: thanos

examples/all/manifests/thanos-receive-region-1-statefulSet.yaml

@@ -5,12 +5,13 @@ metadata:
     app.kubernetes.io/component: database-write-hashring
     app.kubernetes.io/instance: thanos-receive-region-1
     app.kubernetes.io/name: thanos-receive
-    app.kubernetes.io/version: v0.19.0
+    app.kubernetes.io/version: v0.30.2
     controller.receive.thanos.io: thanos-receive-controller
     controller.receive.thanos.io/hashring: region-1
   name: thanos-receive-region-1
   namespace: thanos
 spec:
+  minReadySeconds: 0
   replicas: 3
   selector:
     matchLabels:
@@ -25,7 +26,7 @@ spec:
         app.kubernetes.io/component: database-write-hashring
         app.kubernetes.io/instance: thanos-receive-region-1
         app.kubernetes.io/name: thanos-receive
-        app.kubernetes.io/version: v0.19.0
+        app.kubernetes.io/version: v0.30.2
         controller.receive.thanos.io/hashring: region-1
     spec:
       affinity:
@@ -70,12 +71,12 @@ spec:
         - --http-address=0.0.0.0:10902
         - --remote-write.address=0.0.0.0:19291
         - --receive.replication-factor=2
-        - --objstore.config=$(OBJSTORE_CONFIG)
         - --tsdb.path=/var/thanos/receive
         - --tsdb.retention=15d
-        - --receive.local-endpoint=$(NAME).thanos-receive-region-1.$(NAMESPACE).svc.cluster.local:10901
         - --label=replica="$(NAME)"
         - --label=receive="true"
+        - --objstore.config=$(OBJSTORE_CONFIG)
+        - --receive.local-endpoint=$(NAME).thanos-receive-region-1.$(NAMESPACE).svc.cluster.local:10901
         - --receive.hashrings-file=/var/lib/thanos-receive/hashrings.json
         - |-
           --tracing.config="config":
@@ -92,16 +93,17 @@ spec:
           valueFrom:
             fieldRef:
               fieldPath: metadata.namespace
+        - name: HOST_IP_ADDRESS
+          valueFrom:
+            fieldRef:
+              fieldPath: status.hostIP
         - name: OBJSTORE_CONFIG
           valueFrom:
             secretKeyRef:
               key: thanos.yaml
               name: thanos-objectstorage
-        - name: HOST_IP_ADDRESS
-          valueFrom:
-            fieldRef:
-              fieldPath: status.hostIP
-        image: quay.io/thanos/thanos:v0.19.0
+        image: quay.io/thanos/thanos:v0.30.2
+        imagePullPolicy: IfNotPresent
         livenessProbe:
           failureThreshold: 8
           httpGet:
@@ -139,10 +141,14 @@ spec:
         - mountPath: /var/lib/thanos-receive
           name: hashring-config
       nodeSelector:
-        beta.kubernetes.io/os: linux
+        kubernetes.io/os: linux
       securityContext:
         fsGroup: 65534
+        runAsGroup: 65532
+        runAsNonRoot: true
         runAsUser: 65534
+        seccompProfile:
+          type: RuntimeDefault
       serviceAccountName: thanos-receive
       terminationGracePeriodSeconds: 900
       volumes:

examples/all/manifests/thanos-receive-service.yaml

@@ -5,7 +5,7 @@ metadata:
     app.kubernetes.io/component: database-write-hashring
     app.kubernetes.io/instance: thanos-receive
     app.kubernetes.io/name: thanos-receive
-    app.kubernetes.io/version: v0.19.0
+    app.kubernetes.io/version: v0.30.2
   name: thanos-receive
   namespace: thanos
 spec:

examples/all/manifests/thanos-receive-serviceAccount.yaml

@@ -1,10 +1,11 @@
 apiVersion: v1
 kind: ServiceAccount
 metadata:
+  annotations: {}
   labels:
     app.kubernetes.io/component: database-write-hashring
     app.kubernetes.io/instance: thanos-receive
     app.kubernetes.io/name: thanos-receive
-    app.kubernetes.io/version: v0.19.0
+    app.kubernetes.io/version: v0.30.2
   name: thanos-receive
   namespace: thanos

examples/all/manifests/thanos-receive-serviceMonitor.yaml

@@ -5,14 +5,15 @@ metadata:
     app.kubernetes.io/component: database-write-hashring
     app.kubernetes.io/instance: thanos-receive
     app.kubernetes.io/name: thanos-receive
-    app.kubernetes.io/version: v0.19.0
+    app.kubernetes.io/version: v0.30.2
   name: thanos-receive
   namespace: thanos
 spec:
   endpoints:
   - port: http
     relabelings:
-    - separator: /
+    - action: replace
+      separator: /
       sourceLabels:
       - namespace
       - pod

examples/all/manifests/thanos-receive-statefulSet.yaml

@@ -5,10 +5,11 @@ metadata:
     app.kubernetes.io/component: database-write-hashring
     app.kubernetes.io/instance: thanos-receive
     app.kubernetes.io/name: thanos-receive
-    app.kubernetes.io/version: v0.19.0
+    app.kubernetes.io/version: v0.30.2
   name: thanos-receive
   namespace: thanos
 spec:
+  minReadySeconds: 0
   replicas: 1
   selector:
     matchLabels:
@@ -22,7 +23,7 @@ spec:
         app.kubernetes.io/component: database-write-hashring
         app.kubernetes.io/instance: thanos-receive
         app.kubernetes.io/name: thanos-receive
-        app.kubernetes.io/version: v0.19.0
+        app.kubernetes.io/version: v0.30.2
     spec:
       affinity:
         podAntiAffinity:
@@ -66,12 +67,12 @@ spec:
         - --http-address=0.0.0.0:10902
         - --remote-write.address=0.0.0.0:19291
         - --receive.replication-factor=1
-        - --objstore.config=$(OBJSTORE_CONFIG)
         - --tsdb.path=/var/thanos/receive
         - --tsdb.retention=15d
-        - --receive.local-endpoint=$(NAME).thanos-receive.$(NAMESPACE).svc.cluster.local:10901
         - --label=replica="$(NAME)"
         - --label=receive="true"
+        - --objstore.config=$(OBJSTORE_CONFIG)
+        - --receive.local-endpoint=$(NAME).thanos-receive.$(NAMESPACE).svc.cluster.local:10901
         - --receive.hashrings-file=/var/lib/thanos-receive/hashrings.json
         - |-
           --tracing.config="config":
@@ -88,16 +89,17 @@ spec:
           valueFrom:
             fieldRef:
               fieldPath: metadata.namespace
+        - name: HOST_IP_ADDRESS
+          valueFrom:
+            fieldRef:
+              fieldPath: status.hostIP
         - name: OBJSTORE_CONFIG
           valueFrom:
             secretKeyRef:
               key: thanos.yaml
               name: thanos-objectstorage
-        - name: HOST_IP_ADDRESS
-          valueFrom:
-            fieldRef:
-              fieldPath: status.hostIP
-        image: quay.io/thanos/thanos:v0.19.0
+        image: quay.io/thanos/thanos:v0.30.2
+        imagePullPolicy: IfNotPresent
         livenessProbe:
           failureThreshold: 8
           httpGet:
@@ -135,10 +137,14 @@ spec:
         - mountPath: /var/lib/thanos-receive
           name: hashring-config
       nodeSelector:
-        beta.kubernetes.io/os: linux
+        kubernetes.io/os: linux
       securityContext:
         fsGroup: 65534
+        runAsGroup: 65532
+        runAsNonRoot: true
         runAsUser: 65534
+        seccompProfile:
+          type: RuntimeDefault
       serviceAccountName: thanos-receive
       terminationGracePeriodSeconds: 900
       volumes:

examples/all/manifests/thanos-rule-service.yaml

@@ -5,7 +5,7 @@ metadata:
     app.kubernetes.io/component: rule-evaluation-engine
     app.kubernetes.io/instance: thanos-rule
     app.kubernetes.io/name: thanos-rule
-    app.kubernetes.io/version: v0.19.0
+    app.kubernetes.io/version: v0.30.2
   name: thanos-rule
   namespace: thanos
 spec:
@@ -17,6 +17,9 @@ spec:
   - name: http
     port: 10902
     targetPort: 10902
+  - name: reloader
+    port: 9533
+    targetPort: 9533
   selector:
     app.kubernetes.io/component: rule-evaluation-engine
     app.kubernetes.io/instance: thanos-rule

examples/all/manifests/thanos-rule-serviceAccount.yaml

@@ -1,10 +1,11 @@
 apiVersion: v1
 kind: ServiceAccount
 metadata:
+  annotations: {}
   labels:
     app.kubernetes.io/component: rule-evaluation-engine
     app.kubernetes.io/instance: thanos-rule
     app.kubernetes.io/name: thanos-rule
-    app.kubernetes.io/version: v0.19.0
+    app.kubernetes.io/version: v0.30.2
   name: thanos-rule
   namespace: thanos

examples/all/manifests/thanos-rule-serviceMonitor.yaml

@@ -5,18 +5,20 @@ metadata:
     app.kubernetes.io/component: rule-evaluation-engine
     app.kubernetes.io/instance: thanos-rule
     app.kubernetes.io/name: thanos-rule
-    app.kubernetes.io/version: v0.19.0
+    app.kubernetes.io/version: v0.30.2
   name: thanos-rule
   namespace: thanos
 spec:
   endpoints:
   - port: http
     relabelings:
-    - separator: /
+    - action: replace
+      separator: /
       sourceLabels:
       - namespace
       - pod
       targetLabel: instance
+  - port: reloader
   selector:
     matchLabels:
       app.kubernetes.io/component: rule-evaluation-engine

examples/all/manifests/thanos-rule-statefulSet.yaml

@@ -5,7 +5,7 @@ metadata:
     app.kubernetes.io/component: rule-evaluation-engine
     app.kubernetes.io/instance: thanos-rule
     app.kubernetes.io/name: thanos-rule
-    app.kubernetes.io/version: v0.19.0
+    app.kubernetes.io/version: v0.30.2
   name: thanos-rule
   namespace: thanos
 spec:
@@ -22,8 +22,26 @@ spec:
         app.kubernetes.io/component: rule-evaluation-engine
         app.kubernetes.io/instance: thanos-rule
         app.kubernetes.io/name: thanos-rule
-        app.kubernetes.io/version: v0.19.0
+        app.kubernetes.io/version: v0.30.2
     spec:
+      affinity:
+        podAntiAffinity:
+          preferredDuringSchedulingIgnoredDuringExecution:
+          - podAffinityTerm:
+              labelSelector:
+                matchExpressions:
+                - key: app.kubernetes.io/name
+                  operator: In
+                  values:
+                  - thanos-rule
+                - key: app.kubernetes.io/instance
+                  operator: In
+                  values:
+                  - thanos-rule
+              namespaces:
+              - thanos
+              topologyKey: kubernetes.io/hostname
+            weight: 100
       containers:
       - args:
         - rule
@@ -39,6 +57,7 @@ spec:
         - --tsdb.block-duration=2h
         - --query=dnssrv+_http._tcp.thanos-query.thanos.svc.cluster.local
         - --alertmanagers.url=alertmanager:9093
+        - --alertmanagers.config-file=/etc/thanos/config/thanos-ruler-config/config.yaml
         - --rule-file=/etc/thanos/rules/test/test
         - |-
           --tracing.config="config":
@@ -46,6 +65,7 @@ spec:
             "sampler_type": "ratelimiting"
             "service_name": "thanos-rule"
           "type": "JAEGER"
+        - --remote-write.config-file=/etc/thanos/config/thanos-stateless-ruler-config/rw-config.yaml
         env:
         - name: NAME
           valueFrom:
@@ -60,7 +80,8 @@ spec:
           valueFrom:
             fieldRef:
               fieldPath: status.hostIP
-        image: quay.io/thanos/thanos:v0.19.0
+        image: quay.io/thanos/thanos:v0.30.2
+        imagePullPolicy: IfNotPresent
         livenessProbe:
           failureThreshold: 24
           httpGet:
@@ -74,6 +95,8 @@ spec:
           name: grpc
         - containerPort: 10902
           name: http
+        - containerPort: 9533
+          name: reloader
         readinessProbe:
           failureThreshold: 18
           httpGet:
@@ -89,6 +112,17 @@ spec:
           requests:
             cpu: 0.123
             memory: 123Mi
+        securityContext:
+          allowPrivilegeEscalation: false
+          capabilities:
+            drop:
+            - ALL
+          readOnlyRootFilesystem: true
+          runAsGroup: 65532
+          runAsNonRoot: true
+          runAsUser: 65534
+          seccompProfile:
+            type: RuntimeDefault
         terminationMessagePolicy: FallbackToLogsOnError
         volumeMounts:
         - mountPath: /var/thanos/rule
@@ -96,24 +130,47 @@ spec:
           readOnly: false
         - mountPath: /etc/thanos/rules/test
           name: test
+        - mountPath: /etc/thanos/config/thanos-ruler-config
+          name: thanos-ruler-config
+          readOnly: true
+        - mountPath: /etc/thanos/config/thanos-stateless-ruler-config
+          name: thanos-stateless-ruler-config
+          readOnly: true
       - args:
         - -webhook-url=http://localhost:10902/-/reload
         - -volume-dir=/etc/thanos/rules/test
+        - -volume-dir=/etc/thanos/config/thanos-ruler-config
+        - -volume-dir=/etc/thanos/config/thanos-stateless-ruler-config
         image: jimmidyson/configmap-reload:v0.5.0
+        imagePullPolicy: IfNotPresent
         name: configmap-reloader
         volumeMounts:
         - mountPath: /etc/thanos/rules/test
           name: test
+        - mountPath: /etc/thanos/config/thanos-ruler-config
+          name: thanos-ruler-config
+        - mountPath: /etc/thanos/config/thanos-stateless-ruler-config
+          name: thanos-stateless-ruler-config
       nodeSelector:
-        beta.kubernetes.io/os: linux
+        kubernetes.io/os: linux
       securityContext:
         fsGroup: 65534
+        runAsGroup: 65532
+        runAsNonRoot: true
         runAsUser: 65534
+        seccompProfile:
+          type: RuntimeDefault
       serviceAccountName: thanos-rule
       volumes:
       - configMap:
           name: test
         name: test
+      - configMap:
+          name: thanos-ruler-config
+        name: thanos-ruler-config
+      - configMap:
+          name: thanos-stateless-ruler-config
+        name: thanos-stateless-ruler-config
   volumeClaimTemplates:
   - metadata:
       labels:

examples/all/manifests/thanos-sidecar-service.yaml

@@ -5,7 +5,7 @@ metadata:
     app.kubernetes.io/component: prometheus-sidecar
     app.kubernetes.io/instance: thanos-sidecar
     app.kubernetes.io/name: thanos-sidecar
-    app.kubernetes.io/version: v0.19.0
+    app.kubernetes.io/version: v0.30.2
   name: thanos-sidecar
   namespace: thanos
 spec:

examples/all/manifests/thanos-sidecar-serviceMonitor.yaml

@@ -5,14 +5,15 @@ metadata:
     app.kubernetes.io/component: prometheus-sidecar
     app.kubernetes.io/instance: thanos-sidecar
     app.kubernetes.io/name: thanos-sidecar
-    app.kubernetes.io/version: v0.19.0
+    app.kubernetes.io/version: v0.30.2
   name: thanos-sidecar
   namespace: thanos
 spec:
   endpoints:
   - port: http
     relabelings:
-    - separator: /
+    - action: replace
+      separator: /
       sourceLabels:
       - namespace
       - pod

examples/all/manifests/thanos-store-service.yaml

@@ -5,7 +5,7 @@ metadata:
     app.kubernetes.io/component: object-store-gateway
     app.kubernetes.io/instance: thanos-store
     app.kubernetes.io/name: thanos-store
-    app.kubernetes.io/version: v0.19.0
+    app.kubernetes.io/version: v0.30.2
   name: thanos-store
   namespace: thanos
 spec:

examples/all/manifests/thanos-store-serviceAccount.yaml

@@ -1,10 +1,11 @@
 apiVersion: v1
 kind: ServiceAccount
 metadata:
+  annotations: {}
   labels:
     app.kubernetes.io/component: object-store-gateway
     app.kubernetes.io/instance: thanos-store
     app.kubernetes.io/name: thanos-store
-    app.kubernetes.io/version: v0.19.0
+    app.kubernetes.io/version: v0.30.2
   name: thanos-store
   namespace: thanos

examples/all/manifests/thanos-store-serviceMonitor.yaml

@@ -5,14 +5,15 @@ metadata:
     app.kubernetes.io/component: object-store-gateway
     app.kubernetes.io/instance: thanos-store
     app.kubernetes.io/name: thanos-store
-    app.kubernetes.io/version: v0.19.0
+    app.kubernetes.io/version: v0.30.2
   name: thanos-store
   namespace: thanos
 spec:
   endpoints:
   - port: http
     relabelings:
-    - separator: /
+    - action: replace
+      separator: /
       sourceLabels:
       - namespace
       - pod

examples/all/manifests/thanos-store-shard0-service.yaml

@@ -5,7 +5,7 @@ metadata:
     app.kubernetes.io/component: object-store-gateway
     app.kubernetes.io/instance: thanos-store-0
     app.kubernetes.io/name: thanos-store
-    app.kubernetes.io/version: v0.19.0
+    app.kubernetes.io/version: v0.30.2
     store.thanos.io/shard: shard-0
   name: thanos-store-0
   namespace: thanos

examples/all/manifests/thanos-store-shard0-statefulSet.yaml

@@ -5,7 +5,7 @@ metadata:
     app.kubernetes.io/component: object-store-gateway
     app.kubernetes.io/instance: thanos-store-0
     app.kubernetes.io/name: thanos-store
-    app.kubernetes.io/version: v0.19.0
+    app.kubernetes.io/version: v0.30.2
     store.thanos.io/shard: shard-0
   name: thanos-store-0
   namespace: thanos
@@ -24,7 +24,7 @@ spec:
         app.kubernetes.io/component: object-store-gateway
         app.kubernetes.io/instance: thanos-store-0
         app.kubernetes.io/name: thanos-store
-        app.kubernetes.io/version: v0.19.0
+        app.kubernetes.io/version: v0.30.2
         store.thanos.io/shard: shard-0
     spec:
       affinity:
@@ -115,7 +115,8 @@ spec:
           valueFrom:
             fieldRef:
               fieldPath: status.hostIP
-        image: quay.io/thanos/thanos:v0.19.0
+        image: quay.io/thanos/thanos:v0.30.2
+        imagePullPolicy: IfNotPresent
         livenessProbe:
           failureThreshold: 8
           httpGet:
@@ -123,6 +124,7 @@ spec:
             port: 10902
             scheme: HTTP
           periodSeconds: 30
+          timeoutSeconds: 1
         name: thanos-store
         ports:
         - containerPort: 10901
@@ -143,16 +145,31 @@ spec:
           requests:
             cpu: 0.123
             memory: 123Mi
+        securityContext:
+          allowPrivilegeEscalation: false
+          capabilities:
+            drop:
+            - ALL
+          readOnlyRootFilesystem: true
+          runAsGroup: 65532
+          runAsNonRoot: true
+          runAsUser: 65534
+          seccompProfile:
+            type: RuntimeDefault
         terminationMessagePolicy: FallbackToLogsOnError
         volumeMounts:
         - mountPath: /var/thanos/store
           name: data
           readOnly: false
       nodeSelector:
-        beta.kubernetes.io/os: linux
+        kubernetes.io/os: linux
       securityContext:
         fsGroup: 65534
+        runAsGroup: 65532
+        runAsNonRoot: true
         runAsUser: 65534
+        seccompProfile:
+          type: RuntimeDefault
       serviceAccountName: thanos-store
       terminationGracePeriodSeconds: 120
       volumes: []

examples/all/manifests/thanos-store-shard1-service.yaml

@@ -5,7 +5,7 @@ metadata:
     app.kubernetes.io/component: object-store-gateway
     app.kubernetes.io/instance: thanos-store-1
     app.kubernetes.io/name: thanos-store
-    app.kubernetes.io/version: v0.19.0
+    app.kubernetes.io/version: v0.30.2
     store.thanos.io/shard: shard-1
   name: thanos-store-1
   namespace: thanos

examples/all/manifests/thanos-store-shard1-statefulSet.yaml

@@ -5,7 +5,7 @@ metadata:
     app.kubernetes.io/component: object-store-gateway
     app.kubernetes.io/instance: thanos-store-1
     app.kubernetes.io/name: thanos-store
-    app.kubernetes.io/version: v0.19.0
+    app.kubernetes.io/version: v0.30.2
     store.thanos.io/shard: shard-1
   name: thanos-store-1
   namespace: thanos
@@ -24,7 +24,7 @@ spec:
         app.kubernetes.io/component: object-store-gateway
         app.kubernetes.io/instance: thanos-store-1
         app.kubernetes.io/name: thanos-store
-        app.kubernetes.io/version: v0.19.0
+        app.kubernetes.io/version: v0.30.2
         store.thanos.io/shard: shard-1
     spec:
       affinity:
@@ -115,7 +115,8 @@ spec:
           valueFrom:
             fieldRef:
               fieldPath: status.hostIP
-        image: quay.io/thanos/thanos:v0.19.0
+        image: quay.io/thanos/thanos:v0.30.2
+        imagePullPolicy: IfNotPresent
         livenessProbe:
           failureThreshold: 8
           httpGet:
@@ -123,6 +124,7 @@ spec:
             port: 10902
             scheme: HTTP
           periodSeconds: 30
+          timeoutSeconds: 1
         name: thanos-store
         ports:
         - containerPort: 10901
@@ -143,16 +145,31 @@ spec:
           requests:
             cpu: 0.123
             memory: 123Mi
+        securityContext:
+          allowPrivilegeEscalation: false
+          capabilities:
+            drop:
+            - ALL
+          readOnlyRootFilesystem: true
+          runAsGroup: 65532
+          runAsNonRoot: true
+          runAsUser: 65534
+          seccompProfile:
+            type: RuntimeDefault
         terminationMessagePolicy: FallbackToLogsOnError
         volumeMounts:
         - mountPath: /var/thanos/store
           name: data
           readOnly: false
       nodeSelector:
-        beta.kubernetes.io/os: linux
+        kubernetes.io/os: linux
       securityContext:
         fsGroup: 65534
+        runAsGroup: 65532
+        runAsNonRoot: true
         runAsUser: 65534
+        seccompProfile:
+          type: RuntimeDefault
       serviceAccountName: thanos-store
       terminationGracePeriodSeconds: 120
       volumes: []

examples/all/manifests/thanos-store-shard2-service.yaml

@@ -5,7 +5,7 @@ metadata:
     app.kubernetes.io/component: object-store-gateway
     app.kubernetes.io/instance: thanos-store-2
     app.kubernetes.io/name: thanos-store
-    app.kubernetes.io/version: v0.19.0
+    app.kubernetes.io/version: v0.30.2
     store.thanos.io/shard: shard-2
   name: thanos-store-2
   namespace: thanos

examples/all/manifests/thanos-store-shard2-statefulSet.yaml

@@ -5,7 +5,7 @@ metadata:
     app.kubernetes.io/component: object-store-gateway
     app.kubernetes.io/instance: thanos-store-2
     app.kubernetes.io/name: thanos-store
-    app.kubernetes.io/version: v0.19.0
+    app.kubernetes.io/version: v0.30.2
     store.thanos.io/shard: shard-2
   name: thanos-store-2
   namespace: thanos
@@ -24,7 +24,7 @@ spec:
         app.kubernetes.io/component: object-store-gateway
         app.kubernetes.io/instance: thanos-store-2
         app.kubernetes.io/name: thanos-store
-        app.kubernetes.io/version: v0.19.0
+        app.kubernetes.io/version: v0.30.2
         store.thanos.io/shard: shard-2
     spec:
       affinity:
@@ -115,7 +115,8 @@ spec:
           valueFrom:
             fieldRef:
               fieldPath: status.hostIP
-        image: quay.io/thanos/thanos:v0.19.0
+        image: quay.io/thanos/thanos:v0.30.2
+        imagePullPolicy: IfNotPresent
         livenessProbe:
           failureThreshold: 8
           httpGet:
@@ -123,6 +124,7 @@ spec:
             port: 10902
             scheme: HTTP
           periodSeconds: 30
+          timeoutSeconds: 1
         name: thanos-store
         ports:
         - containerPort: 10901
@@ -143,16 +145,31 @@ spec:
           requests:
             cpu: 0.123
             memory: 123Mi
+        securityContext:
+          allowPrivilegeEscalation: false
+          capabilities:
+            drop:
+            - ALL
+          readOnlyRootFilesystem: true
+          runAsGroup: 65532
+          runAsNonRoot: true
+          runAsUser: 65534
+          seccompProfile:
+            type: RuntimeDefault
         terminationMessagePolicy: FallbackToLogsOnError
         volumeMounts:
         - mountPath: /var/thanos/store
           name: data
           readOnly: false
       nodeSelector:
-        beta.kubernetes.io/os: linux
+        kubernetes.io/os: linux
       securityContext:
         fsGroup: 65534
+        runAsGroup: 65532
+        runAsNonRoot: true
         runAsUser: 65534
+        seccompProfile:
+          type: RuntimeDefault
       serviceAccountName: thanos-store
       terminationGracePeriodSeconds: 120
       volumes: []

examples/all/manifests/thanos-store-shards-serviceAccount.yaml

@@ -0,0 +1,11 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  annotations: {}
+  labels:
+    app.kubernetes.io/component: object-store-gateway
+    app.kubernetes.io/instance: thanos-store
+    app.kubernetes.io/name: thanos-store
+    app.kubernetes.io/version: v0.30.2
+  name: thanos-store
+  namespace: thanos

examples/all/manifests/thanos-store-shards-serviceMonitor.yaml

@@ -5,19 +5,21 @@ metadata:
     app.kubernetes.io/component: object-store-gateway
     app.kubernetes.io/instance: thanos-store
     app.kubernetes.io/name: thanos-store
-    app.kubernetes.io/version: v0.19.0
+    app.kubernetes.io/version: v0.30.2
   name: thanos-store
   namespace: thanos
 spec:
   endpoints:
   - port: http
     relabelings:
-    - separator: /
+    - action: replace
+      separator: /
       sourceLabels:
       - namespace
       - pod
       targetLabel: instance
-    - regex: shard\-(\d+)
+    - action: replace
+      regex: shard\-(\d+)
       replacement: $1
       sourceLabels:
       - __meta_kubernetes_service_label_store_thanos_io_shard

examples/all/manifests/thanos-store-statefulSet.yaml

@@ -5,7 +5,7 @@ metadata:
     app.kubernetes.io/component: object-store-gateway
     app.kubernetes.io/instance: thanos-store
     app.kubernetes.io/name: thanos-store
-    app.kubernetes.io/version: v0.19.0
+    app.kubernetes.io/version: v0.30.2
   name: thanos-store
   namespace: thanos
 spec:
@@ -22,7 +22,7 @@ spec:
         app.kubernetes.io/component: object-store-gateway
         app.kubernetes.io/instance: thanos-store
         app.kubernetes.io/name: thanos-store
-        app.kubernetes.io/version: v0.19.0
+        app.kubernetes.io/version: v0.30.2
     spec:
       affinity:
         podAntiAffinity:
@@ -103,7 +103,8 @@ spec:
           valueFrom:
             fieldRef:
               fieldPath: status.hostIP
-        image: quay.io/thanos/thanos:v0.19.0
+        image: quay.io/thanos/thanos:v0.30.2
+        imagePullPolicy: IfNotPresent
         livenessProbe:
           failureThreshold: 8
           httpGet:
@@ -111,6 +112,7 @@ spec:
             port: 10902
             scheme: HTTP
           periodSeconds: 30
+          timeoutSeconds: 1
         name: thanos-store
         ports:
         - containerPort: 10901
@@ -131,16 +133,31 @@ spec:
           requests:
             cpu: 0.123
             memory: 123Mi
+        securityContext:
+          allowPrivilegeEscalation: false
+          capabilities:
+            drop:
+            - ALL
+          readOnlyRootFilesystem: true
+          runAsGroup: 65532
+          runAsNonRoot: true
+          runAsUser: 65534
+          seccompProfile:
+            type: RuntimeDefault
         terminationMessagePolicy: FallbackToLogsOnError
         volumeMounts:
         - mountPath: /var/thanos/store
           name: data
           readOnly: false
       nodeSelector:
-        beta.kubernetes.io/os: linux
+        kubernetes.io/os: linux
       securityContext:
         fsGroup: 65534
+        runAsGroup: 65532
+        runAsNonRoot: true
         runAsUser: 65534
+        seccompProfile:
+          type: RuntimeDefault
       serviceAccountName: thanos-store
       terminationGracePeriodSeconds: 120
       volumes: []

examples/development-minio/minio-deployment.yaml

@@ -2,6 +2,7 @@ apiVersion: apps/v1
 kind: Deployment
 metadata:
   name: minio
+  namespace: thanos
 spec:
   selector:
     matchLabels:
@@ -14,22 +15,25 @@ spec:
         app.kubernetes.io/name: minio
     spec:
       containers:
-      - name: minio
-        image: minio/minio
-        command:
+      - command:
         - /bin/sh
         - -c
-        - "mkdir -p /storage/thanos && /usr/bin/minio server /storage"
+        - |
+          mkdir -p /storage/thanos && \
+          /usr/bin/docker-entrypoint.sh minio server /storage
         env:
-        - name: MINIO_ACCESS_KEY
-          value: "minio"
-        - name: MINIO_SECRET_KEY
-          value: "minio123"
+        - name: MINIO_ROOT_USER
+          value: minio
+        - name: MINIO_ROOT_PASSWORD
+          value: minio123
+        image: minio/minio:RELEASE.2023-05-27T05-56-19Z
+        imagePullPolicy: IfNotPresent
+        name: minio
         ports:
         - containerPort: 9000
         volumeMounts:
-        - name: storage
-          mountPath: "/storage"
+        - mountPath: /storage
+          name: storage
       volumes:
       - name: storage
         persistentVolumeClaim:

examples/development-minio/minio-pvc.yaml

@@ -1,13 +1,13 @@
 apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
-  name: minio
-  namespace: thanos
   labels:
     app.kubernetes.io/name: minio
+  name: minio
+  namespace: thanos
 spec:
   accessModes:
-    - ReadWriteOnce
+  - ReadWriteOnce
   resources:
     requests:
-      storage: 10Gi
+      storage: 5Gi

examples/development-minio/minio-secret-thanos.yaml

@@ -2,13 +2,14 @@ apiVersion: v1
 kind: Secret
 metadata:
   name: thanos-objectstorage
-type: Opaque
+  namespace: thanos
 stringData:
-  thanos.yaml: |-
+  thanos.yaml: |
     type: s3
     config:
       bucket: thanos
-      endpoint: minio:9000
+      endpoint: minio.thanos.svc.cluster.local:9000
       insecure: true
       access_key: minio
       secret_key: minio123
+type: Opaque

examples/development-minio/minio-service.yaml

@@ -2,11 +2,12 @@ apiVersion: v1
 kind: Service
 metadata:
   name: minio
+  namespace: thanos
 spec:
-  type: ClusterIP
   ports:
-    - port: 9000
-      targetPort: 9000
-      protocol: TCP
+  - port: 9000
+    protocol: TCP
+    targetPort: 9000
   selector:
     app.kubernetes.io/name: minio
+  type: ClusterIP

examples/thanos-receive.jsonnet

@@ -4,7 +4,7 @@ receive({
   local tr = self,
   name:: 'thanos-receive',
   namespace:: 'observability',
-  version:: 'v0.19.0',
+  version:: 'v0.24.0',
   image:: 'quay.io/thanos/thanos:v' + tr.version,
   replicas:: 3,
   replicationFactor:: 3,

jsonnet/kube-thanos/kube-thanos-bucket-replicate.libsonnet

@@ -0,0 +1,212 @@
+// These are the defaults for this components configuration.
+// When calling the function to generate the component's manifest,
+// you can pass an object structured like the default to overwrite default values.
+local defaults = {
+  local defaults = self,
+  name: 'thanos-bucket-replicate',
+  namespace: error 'must provide namespace',
+  version: error 'must provide version',
+  image: error 'must provide image',
+  imagePullPolicy: 'IfNotPresent',
+  objectStorageConfig: error 'must provide objectStorageConfig',
+  objectStorageToConfig: error 'must provide objectStorageToConfig',  // Destination object store configuration.
+  resources: {},
+  logLevel: 'info',
+  logFormat: 'logfmt',
+  ports: {
+    http: 10902,
+  },
+  tracing: {},
+  minTime: '',
+  maxTime: '',
+  compactionLevels: [],
+  resolutions: [],
+  extraEnv: [],
+
+  commonLabels:: {
+    'app.kubernetes.io/name': 'thanos-bucket-replicate',
+    'app.kubernetes.io/instance': defaults.name,
+    'app.kubernetes.io/version': defaults.version,
+    'app.kubernetes.io/component': 'object-store-bucket-replicate',
+  },
+
+  podLabelSelector:: {
+    [labelName]: defaults.commonLabels[labelName]
+    for labelName in std.objectFields(defaults.commonLabels)
+    if labelName != 'app.kubernetes.io/version'
+  },
+
+  securityContext:: {
+    fsGroup: 65534,
+    runAsUser: 65534,
+    runAsGroup: 65532,
+    runAsNonRoot: true,
+    seccompProfile: { type: 'RuntimeDefault' },
+  },
+  securityContextContainer:: {
+    runAsUser: defaults.securityContext.runAsUser,
+    runAsGroup: defaults.securityContext.runAsGroup,
+    runAsNonRoot: defaults.securityContext.runAsNonRoot,
+    seccompProfile: defaults.securityContext.seccompProfile,
+    allowPrivilegeEscalation: false,
+    readOnlyRootFilesystem: true,
+    capabilities: { drop: ['ALL'] },
+  },
+
+  serviceAccountAnnotations:: {},
+};
+
+function(params) {
+  local tbr = self,
+
+  // Combine the defaults and the passed params to make the component's config.
+  config:: defaults + params,
+  // Safety checks for combined config of defaults and params
+  assert std.isNumber(tbr.config.replicas) && tbr.config.replicas >= 0 : 'thanos bucket replicate replicas has to be number >= 0',
+  assert std.isObject(tbr.config.resources),
+
+  service: {
+    apiVersion: 'v1',
+    kind: 'Service',
+    metadata: {
+      name: tbr.config.name,
+      namespace: tbr.config.namespace,
+      labels: tbr.config.commonLabels,
+    },
+    spec: {
+      ports: [
+        {
+          assert std.isString(name),
+          assert std.isNumber(tbr.config.ports[name]),
+
+          name: name,
+          port: tbr.config.ports[name],
+          targetPort: tbr.config.ports[name],
+        }
+        for name in std.objectFields(tbr.config.ports)
+      ],
+      selector: tbr.config.podLabelSelector,
+    },
+  },
+
+  serviceAccount: {
+    apiVersion: 'v1',
+    kind: 'ServiceAccount',
+    metadata: {
+      name: tbr.config.name,
+      namespace: tbr.config.namespace,
+      labels: tbr.config.commonLabels,
+      annotations: tbr.config.serviceAccountAnnotations,
+    },
+  },
+
+  deployment:
+    local container = {
+      name: 'thanos-bucket-replicate',
+      image: tbr.config.image,
+      imagePullPolicy: tbr.config.imagePullPolicy,
+      args: [
+        'tools',
+        'bucket',
+        'replicate',
+        '--log.level=' + tbr.config.logLevel,
+        '--log.format=' + tbr.config.logFormat,
+        '--objstore.config=$(OBJSTORE_CONFIG)',
+        '--objstore-to.config=$(OBJSTORE_TO_CONFIG)',
+      ] + (
+        if std.length(tbr.config.tracing) > 0 then [
+          '--tracing.config=' + std.manifestYamlDoc(
+            { config+: { service_name: defaults.name } } + tbr.config.tracing
+          ),
+        ] else []
+      ) + (
+        if std.length(tbr.config.minTime) > 0 then [
+          '--min-time=' + tbr.config.minTime,
+        ] else []
+      ) + (
+        if std.length(tbr.config.maxTime) > 0 then [
+          '--max-time=' + tbr.config.maxTime,
+        ] else []
+      ) + (
+        if std.length(tbr.config.compactionLevels) > 0 then [
+          '--compaction=%d' % compactionLevel
+          for compactionLevel in tbr.config.compactionLevels
+        ] else []
+      ) + (
+        if std.length(tbr.config.resolutions) > 0 then [
+          '--resolution=%s' % resolution
+          for resolution in tbr.config.resolutions
+        ] else []
+      ),
+      env: [
+        { name: 'OBJSTORE_CONFIG', valueFrom: { secretKeyRef: {
+          key: tbr.config.objectStorageConfig.key,
+          name: tbr.config.objectStorageConfig.name,
+        } } },
+        { name: 'OBJSTORE_TO_CONFIG', valueFrom: { secretKeyRef: {
+          key: tbr.config.objectStorageToConfig.key,
+          name: tbr.config.objectStorageToConfig.name,
+        } } },
+        {
+          // Inject the host IP to make configuring tracing convenient.
+          name: 'HOST_IP_ADDRESS',
+          valueFrom: {
+            fieldRef: {
+              fieldPath: 'status.hostIP',
+            },
+          },
+        },
+      ] + (
+        if std.length(tbr.config.extraEnv) > 0 then tbr.config.extraEnv else []
+      ),
+      ports: [
+        { name: name, containerPort: tbr.config.ports[name] }
+        for name in std.objectFields(tbr.config.ports)
+      ],
+      livenessProbe: { failureThreshold: 4, periodSeconds: 30, httpGet: {
+        scheme: 'HTTP',
+        port: tbr.config.ports.http,
+        path: '/-/healthy',
+      } },
+      readinessProbe: { failureThreshold: 20, periodSeconds: 5, httpGet: {
+        scheme: 'HTTP',
+        port: tbr.config.ports.http,
+        path: '/-/ready',
+      } },
+      resources: if tbr.config.resources != {} then tbr.config.resources else {},
+      terminationMessagePolicy: 'FallbackToLogsOnError',
+      volumeMounts: if std.objectHas(tbr.config.objectStorageConfig, 'tlsSecretName') && std.length(tbr.config.objectStorageConfig.tlsSecretName) > 0 then [
+        { name: 'tls-secret', mountPath: tbr.config.objectStorageConfig.tlsSecretMountPath },
+      ] else [],
+    };
+
+    {
+      apiVersion: 'apps/v1',
+      kind: 'Deployment',
+      metadata: {
+        name: tbr.config.name,
+        namespace: tbr.config.namespace,
+        labels: tbr.config.commonLabels,
+      },
+      spec: {
+        replicas: 1,
+        selector: { matchLabels: tbr.config.podLabelSelector },
+        template: {
+          metadata: { labels: tbr.config.commonLabels },
+          spec: {
+            serviceAccountName: tbr.serviceAccount.metadata.name,
+            securityContext: tbr.config.securityContext,
+            containers: [container],
+            volumes: if std.objectHas(tbr.config.objectStorageConfig, 'tlsSecretName') && std.length(tbr.config.objectStorageConfig.tlsSecretName) > 0 then [{
+              name: 'tls-secret',
+              secret: { secretName: tbr.config.objectStorageConfig.tlsSecretName },
+            }] else [],
+            terminationGracePeriodSeconds: 120,
+            nodeSelector: {
+              'kubernetes.io/os': 'linux',
+            },
+          },
+        },
+      },
+    },
+}

jsonnet/kube-thanos/kube-thanos-bucket.libsonnet

@@ -7,6 +7,7 @@ local defaults = {
   namespace: error 'must provide namespace',
   version: error 'must provide version',
   image: error 'must provide image',
+  imagePullPolicy: 'IfNotPresent',
   objectStorageConfig: error 'must provide objectStorageConfig',
   resources: {},
   logLevel: 'info',
@@ -15,6 +16,7 @@ local defaults = {
     http: 10902,
   },
   tracing: {},
+  extraEnv: [],
 
   commonLabels:: {
     'app.kubernetes.io/name': 'thanos-bucket',
@@ -32,7 +34,21 @@ local defaults = {
   securityContext:: {
     fsGroup: 65534,
     runAsUser: 65534,
+    runAsGroup: 65532,
+    runAsNonRoot: true,
+    seccompProfile: { type: 'RuntimeDefault' },
   },
+  securityContextContainer:: {
+    runAsUser: defaults.securityContext.runAsUser,
+    runAsGroup: defaults.securityContext.runAsGroup,
+    runAsNonRoot: defaults.securityContext.runAsNonRoot,
+    seccompProfile: defaults.securityContext.seccompProfile,
+    allowPrivilegeEscalation: false,
+    readOnlyRootFilesystem: true,
+    capabilities: { drop: ['ALL'] },
+  },
+
+  serviceAccountAnnotations:: {},
 };
 
 function(params) {
@@ -75,6 +91,7 @@ function(params) {
       name: tb.config.name,
       namespace: tb.config.namespace,
       labels: tb.config.commonLabels,
+      annotations: tb.config.serviceAccountAnnotations,
     },
   },
 
@@ -82,6 +99,7 @@ function(params) {
     local container = {
       name: 'thanos-bucket',
       image: tb.config.image,
+      imagePullPolicy: tb.config.imagePullPolicy,
       args: [
         'tools',
         'bucket',
@@ -118,7 +136,9 @@ function(params) {
             },
           },
         },
-      ],
+      ] + (
+        if std.length(tb.config.extraEnv) > 0 then tb.config.extraEnv else []
+      ),
       ports: [
         { name: name, containerPort: tb.config.ports[name] }
         for name in std.objectFields(tb.config.ports)
@@ -134,7 +154,11 @@ function(params) {
         path: '/-/ready',
       } },
       resources: if tb.config.resources != {} then tb.config.resources else {},
+      securityContext: tb.config.securityContextContainer,
       terminationMessagePolicy: 'FallbackToLogsOnError',
+      volumeMounts: if std.objectHas(tb.config.objectStorageConfig, 'tlsSecretName') && std.length(tb.config.objectStorageConfig.tlsSecretName) > 0 then [
+        { name: 'tls-secret', mountPath: tb.config.objectStorageConfig.tlsSecretMountPath },
+      ] else [],
     };
 
     {
@@ -154,9 +178,13 @@ function(params) {
             serviceAccountName: tb.serviceAccount.metadata.name,
             securityContext: tb.config.securityContext,
             containers: [container],
+            volumes: if std.objectHas(tb.config.objectStorageConfig, 'tlsSecretName') && std.length(tb.config.objectStorageConfig.tlsSecretName) > 0 then [{
+              name: 'tls-secret',
+              secret: { secretName: tb.config.objectStorageConfig.tlsSecretName },
+            }] else [],
             terminationGracePeriodSeconds: 120,
             nodeSelector: {
-              'beta.kubernetes.io/os': 'linux',
+              'kubernetes.io/os': 'linux',
             },
           },
         },

jsonnet/kube-thanos/kube-thanos-compact-default-params.libsonnet

@@ -0,0 +1,63 @@
+// These are the defaults for this components configuration.
+// When calling the function to generate the component's manifest,
+// you can pass an object structured like the default to overwrite default values.
+{
+  local defaults = self,
+  name: 'thanos-compact',
+  namespace: error 'must provide namespace',
+  version: error 'must provide version',
+  image: error 'must provide image',
+  imagePullPolicy: 'IfNotPresent',
+  objectStorageConfig: error 'must provide objectStorageConfig',
+  resources: {},
+  logLevel: 'info',
+  logFormat: 'logfmt',
+  serviceMonitor: false,
+  volumeClaimTemplate: {},
+  retentionResolutionRaw: '0d',
+  retentionResolution5m: '0d',
+  retentionResolution1h: '0d',
+  compactConcurrency: 1,
+  deduplicationReplicaLabels: [],
+  deleteDelay: '48h',
+  disableDownsampling: false,
+  downsampleConcurrency: 1,
+  ports: {
+    http: 10902,
+  },
+  tracing: {},
+  extraEnv: [],
+
+  commonLabels:: {
+    'app.kubernetes.io/name': 'thanos-compact',
+    'app.kubernetes.io/instance': defaults.name,
+    'app.kubernetes.io/version': defaults.version,
+    'app.kubernetes.io/component': 'database-compactor',
+  },
+
+  podLabelSelector:: {
+    [labelName]: defaults.commonLabels[labelName]
+    for labelName in std.objectFields(defaults.commonLabels)
+    if labelName != 'app.kubernetes.io/version'
+  },
+
+  securityContext:: {
+    fsGroup: 65534,
+    runAsUser: 65534,
+    runAsGroup: 65532,
+    runAsNonRoot: true,
+    seccompProfile: { type: 'RuntimeDefault' },
+  },
+
+  securityContextContainer:: {
+    runAsUser: defaults.securityContext.runAsUser,
+    runAsGroup: defaults.securityContext.runAsGroup,
+    runAsNonRoot: defaults.securityContext.runAsNonRoot,
+    seccompProfile: defaults.securityContext.seccompProfile,
+    allowPrivilegeEscalation: false,
+    readOnlyRootFilesystem: true,
+    capabilities: { drop: ['ALL'] },
+  },
+
+  serviceAccountAnnotations:: {},
+}

jsonnet/kube-thanos/kube-thanos-compact-shards.libsonnet

@@ -0,0 +1,109 @@
+local compactConfigDefaults = import 'kube-thanos/kube-thanos-compact-default-params.libsonnet';
+local compact = import 'kube-thanos/kube-thanos-compact.libsonnet';
+
+// These are the defaults for this components configuration.
+// When calling the function to generate the component's manifest,
+// you can pass an object structured like the default to overwrite default values.
+local defaults = compactConfigDefaults {
+  shards: 1,
+};
+
+function(params)
+  // Combine the defaults and the passed params to make the component's config.
+  local config = defaults + params;
+
+  // Safety checks for combined config of defaults and params
+  assert std.isNumber(config.shards) && config.shards >= 0 : 'thanos compact shards has to be number >= 0';
+  assert std.isArray(config.sourceLabels) && std.length(config.sourceLabels) > 0;
+
+  { config:: config } + {
+    local allShards = self,
+
+    serviceAccount: {
+      apiVersion: 'v1',
+      kind: 'ServiceAccount',
+      metadata: {
+        name: config.name,
+        namespace: config.namespace,
+        labels: config.commonLabels,
+        annotations: config.serviceAccountAnnotations,
+      },
+    },
+
+    shards: {
+      ['shard' + i]: compact(config {
+        name+: '-%d' % i,
+        commonLabels+:: { 'compact.thanos.io/shard': 'shard-' + i },
+      }) {
+        serviceAccount: null,  // one service account for all compactors
+        serviceMonitor: null,  // one service monitor for all compactors
+
+        statefulSet+: {
+          spec+: {
+            template+: {
+              spec+: {
+                serviceAccountName: allShards.serviceAccount.metadata.name,
+                containers: [
+                  if c.name == 'thanos-compact' then c {
+                    args+: [
+                      |||
+                        --selector.relabel-config=
+                          - action: hashmod
+                            source_labels: %s
+                            target_label: shard
+                            modulus: %d
+                          - action: keep
+                            source_labels: ["shard"]
+                            regex: %d
+                      ||| % [config.sourceLabels, config.shards, i],
+                    ],
+                  } else c
+                  for c in super.containers
+                ],
+              },
+            },
+          },
+        },
+      }
+      for i in std.range(0, config.shards - 1)
+    },
+  } + {
+    serviceMonitor: if config.serviceMonitor == true then {
+      apiVersion: 'monitoring.coreos.com/v1',
+      kind: 'ServiceMonitor',
+      metadata+: {
+        name: config.name,
+        namespace: config.namespace,
+        labels: config.commonLabels,
+      },
+      spec: {
+        selector: {
+          matchLabels: {
+            [key]: config.podLabelSelector[key]
+            for key in std.objectFields(config.podLabelSelector)
+            if key != 'app.kubernetes.io/instance'
+          },
+        },
+        endpoints: [
+          {
+            port: 'http',
+            relabelings: [
+              {
+                action: 'replace',
+                sourceLabels: ['namespace', 'pod'],
+                separator: '/',
+                targetLabel: 'instance',
+              },
+              {
+                action: 'replace',
+                sourceLabels: ['__meta_kubernetes_service_label_compact_thanos_io_shard'],
+                regex: 'shard\\-(\\d+)',
+                replacement: '$1',
+                targetLabel: 'shard',
+              },
+            ],
+          },
+        ],
+      },
+    },
+  }

jsonnet/kube-thanos/kube-thanos-compact.libsonnet

@@ -1,47 +1,4 @@
-// These are the defaults for this components configuration.
-// When calling the function to generate the component's manifest,
-// you can pass an object structured like the default to overwrite default values.
-local defaults = {
-  local defaults = self,
-  name: 'thanos-compact',
-  namespace: error 'must provide namespace',
-  version: error 'must provide version',
-  image: error 'must provide image',
-  objectStorageConfig: error 'must provide objectStorageConfig',
-  resources: {},
-  logLevel: 'info',
-  logFormat: 'logfmt',
-  serviceMonitor: false,
-  volumeClaimTemplate: {},
-  retentionResolutionRaw: '0d',
-  retentionResolution5m: '0d',
-  retentionResolution1h: '0d',
-  deleteDelay: '48h',
-  disableDownsampling: false,
-  deduplicationReplicaLabels: [],
-  ports: {
-    http: 10902,
-  },
-  tracing: {},
-
-  commonLabels:: {
-    'app.kubernetes.io/name': 'thanos-compact',
-    'app.kubernetes.io/instance': defaults.name,
-    'app.kubernetes.io/version': defaults.version,
-    'app.kubernetes.io/component': 'database-compactor',
-  },
-
-  podLabelSelector:: {
-    [labelName]: defaults.commonLabels[labelName]
-    for labelName in std.objectFields(defaults.commonLabels)
-    if labelName != 'app.kubernetes.io/version'
-  },
-
-  securityContext:: {
-    fsGroup: 65534,
-    runAsUser: 65534,
-  },
-};
+local defaults = import 'kube-thanos/kube-thanos-compact-default-params.libsonnet';
 
 function(params) {
   local tc = self,
@@ -49,6 +6,8 @@ function(params) {
   // Combine the defaults and the passed params to make the component's config.
   config:: defaults + params,
   // Safety checks for combined config of defaults and params
+  assert std.isNumber(tc.config.compactConcurrency),
+  assert std.isNumber(tc.config.downsampleConcurrency),
   assert std.isNumber(tc.config.replicas) && (tc.config.replicas == 0 || tc.config.replicas == 1) : 'thanos compact replicas can only be 0 or 1',
   assert std.isObject(tc.config.resources),
   assert std.isObject(tc.config.volumeClaimTemplate),
@@ -65,6 +24,7 @@ function(params) {
       labels: tc.config.commonLabels,
     },
     spec: {
+      clusterIP: 'None',
       selector: tc.config.podLabelSelector,
       ports: [
         {
@@ -87,6 +47,7 @@ function(params) {
       name: tc.config.name,
       namespace: tc.config.namespace,
       labels: tc.config.commonLabels,
+      annotations: tc.config.serviceAccountAnnotations,
     },
   },
 
@@ -94,6 +55,7 @@ function(params) {
     local c = {
       name: 'thanos-compact',
       image: tc.config.image,
+      imagePullPolicy: tc.config.imagePullPolicy,
       args: [
         'compact',
         '--wait',
@@ -106,6 +68,8 @@ function(params) {
         '--retention.resolution-5m=' + tc.config.retentionResolution5m,
         '--retention.resolution-1h=' + tc.config.retentionResolution1h,
         '--delete-delay=' + tc.config.deleteDelay,
+        '--compact.concurrency=' + tc.config.compactConcurrency,
+        '--downsample.concurrency=' + tc.config.downsampleConcurrency,
       ] + (
         if tc.config.disableDownsampling then ['--downsampling.disable'] else []
       ) + (
@@ -135,7 +99,9 @@ function(params) {
             },
           },
         },
-      ],
+      ] + (
+        if std.length(tc.config.extraEnv) > 0 then tc.config.extraEnv else []
+      ),
       ports: [
         { name: name, containerPort: tc.config.ports[name] }
         for name in std.objectFields(tc.config.ports)
@@ -154,7 +120,11 @@ function(params) {
         name: 'data',
         mountPath: '/var/thanos/compact',
         readOnly: false,
-      }],
+      }] + (
+        if std.objectHas(tc.config.objectStorageConfig, 'tlsSecretName') && std.length(tc.config.objectStorageConfig.tlsSecretName) > 0 then [
+          { name: 'tls-secret', mountPath: tc.config.objectStorageConfig.tlsSecretMountPath },
+        ] else []
+      ),
       resources: if tc.config.resources != {} then tc.config.resources else {},
       terminationMessagePolicy: 'FallbackToLogsOnError',
     };
@@ -179,11 +149,32 @@ function(params) {
             serviceAccountName: tc.serviceAccount.metadata.name,
             securityContext: tc.config.securityContext,
             containers: [c],
-            volumes: [],
+            volumes: if std.objectHas(tc.config.objectStorageConfig, 'tlsSecretName') && std.length(tc.config.objectStorageConfig.tlsSecretName) > 0 then [{
+              name: 'tls-secret',
+              secret: { secretName: tc.config.objectStorageConfig.tlsSecretName },
+            }] else [],
             terminationGracePeriodSeconds: 120,
             nodeSelector: {
-              'beta.kubernetes.io/os': 'linux',
+              'kubernetes.io/os': 'linux',
             },
+            affinity: { podAntiAffinity: {
+              preferredDuringSchedulingIgnoredDuringExecution: [{
+                podAffinityTerm: {
+                  namespaces: [tc.config.namespace],
+                  topologyKey: 'kubernetes.io/hostname',
+                  labelSelector: { matchExpressions: [{
+                    key: 'app.kubernetes.io/name',
+                    operator: 'In',
+                    values: [tc.statefulSet.metadata.labels['app.kubernetes.io/name']],
+                  }, {
+                    key: 'app.kubernetes.io/instance',
+                    operator: 'In',
+                    values: [tc.statefulSet.metadata.labels['app.kubernetes.io/instance']],
+                  }] },
+                },
+                weight: 100,
+              }],
+            } },
           },
         },
         volumeClaimTemplates: if std.length(tc.config.volumeClaimTemplate) > 0 then [tc.config.volumeClaimTemplate {
@@ -211,6 +202,7 @@ function(params) {
         {
           port: 'http',
           relabelings: [{
+            action: 'replace',
             sourceLabels: ['namespace', 'pod'],
             separator: '/',
             targetLabel: 'instance',

jsonnet/kube-thanos/kube-thanos-query-frontend.libsonnet

@@ -7,6 +7,7 @@ local defaults = {
   namespace: error 'must provide namespace',
   version: error 'must provide version',
   image: error 'must provide image',
+  imagePullPolicy: 'IfNotPresent',
   replicas: error 'must provide replicas',
   downstreamURL: error 'must provide downstreamURL',
   splitInterval: '24h',
@@ -20,6 +21,7 @@ local defaults = {
     },
   },
   queryRangeCache: {},
+  queryUrl: '',
   labelsCache: {},
   logLevel: 'info',
   logFormat: 'logfmt',
@@ -29,6 +31,7 @@ local defaults = {
     http: 9090,
   },
   tracing: {},
+  extraEnv: [],
 
   memcachedDefaults+:: {
     config+: {
@@ -61,7 +64,22 @@ local defaults = {
   securityContext:: {
     fsGroup: 65534,
     runAsUser: 65534,
+    runAsGroup: 65532,
+    runAsNonRoot: true,
+    seccompProfile: { type: 'RuntimeDefault' },
   },
+
+  securityContextContainer:: {
+    runAsUser: defaults.securityContext.runAsUser,
+    runAsGroup: defaults.securityContext.runAsGroup,
+    runAsNonRoot: defaults.securityContext.runAsNonRoot,
+    seccompProfile: defaults.securityContext.seccompProfile,
+    allowPrivilegeEscalation: false,
+    readOnlyRootFilesystem: true,
+    capabilities: { drop: ['ALL'] },
+  },
+
+  serviceAccountAnnotations:: {},
 };
 
 function(params) {
@@ -131,6 +149,7 @@ function(params) {
       name: tqf.config.name,
       namespace: tqf.config.namespace,
       labels: tqf.config.commonLabels,
+      annotations: tqf.config.serviceAccountAnnotations,
     },
   },
 
@@ -138,6 +157,7 @@ function(params) {
     local c = {
       name: 'thanos-query-frontend',
       image: tqf.config.image,
+      imagePullPolicy: tqf.config.imagePullPolicy,
       args: [
         'query-frontend',
         '--log.level=' + tqf.config.logLevel,
@@ -168,6 +188,10 @@ function(params) {
             { config+: { service_name: defaults.name } } + tqf.config.tracing
           ),
         ] else []
+      ) + (
+        if tqf.config.queryUrl != '' then [
+          '--alert.query-url=' + tqf.config.queryUrl,
+        ] else []
       ),
       env: [
         {
@@ -179,7 +203,9 @@ function(params) {
             },
           },
         },
-      ],
+      ] + (
+        if std.length(tqf.config.extraEnv) > 0 then tqf.config.extraEnv else []
+      ),
       ports: [
         { name: name, containerPort: tqf.config.ports[name] }
         for name in std.objectFields(tqf.config.ports)
@@ -195,6 +221,7 @@ function(params) {
         path: '/-/ready',
       } },
       resources: if tqf.config.resources != {} then tqf.config.resources else {},
+      securityContext: tqf.config.securityContextContainer,
       terminationMessagePolicy: 'FallbackToLogsOnError',
     };
 
@@ -217,7 +244,7 @@ function(params) {
             securityContext: tqf.config.securityContext,
             terminationGracePeriodSeconds: 120,
             nodeSelector: {
-              'beta.kubernetes.io/os': 'linux',
+              'kubernetes.io/os': 'linux',
             },
             affinity: { podAntiAffinity: {
               preferredDuringSchedulingIgnoredDuringExecution: [{
@@ -254,6 +281,7 @@ function(params) {
         {
           port: 'http',
           relabelings: [{
+            action: 'replace',
             sourceLabels: ['namespace', 'pod'],
             separator: '/',
             targetLabel: 'instance',

jsonnet/kube-thanos/kube-thanos-query.libsonnet

@@ -7,12 +7,16 @@ local defaults = {
   namespace: error 'must provide namespace',
   version: error 'must provide version',
   image: error 'must provide image',
+  imagePullPolicy: 'IfNotPresent',
   replicas: error 'must provide replicas',
   replicaLabels: error 'must provide replicaLabels',
   stores: ['dnssrv+_grpc._tcp.thanos-store.%s.svc.cluster.local' % defaults.namespace],
+  rules: [],  // TODO(bwplotka): This is deprecated, switch to endpoints while ready.
   externalPrefix: '',
+  queryUrl: '',
   prefixHeader: '',
   autoDownsampling: true,
+  useThanosEngine: false,
   resources: {},
   queryTimeout: '',
   lookbackDelta: '',
@@ -24,6 +28,10 @@ local defaults = {
   logLevel: 'info',
   logFormat: 'logfmt',
   tracing: {},
+  extraEnv: [],
+  telemetryDurationQuantiles: '',
+  telemetrySamplesQuantiles: '',
+  telemetrySeriesQuantiles: '',
 
   commonLabels:: {
     'app.kubernetes.io/name': 'thanos-query',
@@ -41,7 +49,22 @@ local defaults = {
   securityContext:: {
     fsGroup: 65534,
     runAsUser: 65534,
+    runAsGroup: 65532,
+    runAsNonRoot: true,
+    seccompProfile: { type: 'RuntimeDefault' },
   },
+
+  securityContextContainer:: {
+    runAsUser: defaults.securityContext.runAsUser,
+    runAsGroup: defaults.securityContext.runAsGroup,
+    runAsNonRoot: defaults.securityContext.runAsNonRoot,
+    seccompProfile: defaults.securityContext.seccompProfile,
+    allowPrivilegeEscalation: false,
+    readOnlyRootFilesystem: true,
+    capabilities: { drop: ['ALL'] },
+  },
+
+  serviceAccountAnnotations:: {},
 };
 
 function(params) {
@@ -57,6 +80,7 @@ function(params) {
   assert std.isString(tq.config.queryTimeout),
   assert std.isBoolean(tq.config.serviceMonitor),
   assert std.isBoolean(tq.config.autoDownsampling),
+  assert std.isBoolean(tq.config.useThanosEngine),
 
   service: {
     apiVersion: 'v1',
@@ -89,6 +113,7 @@ function(params) {
       name: tq.config.name,
       namespace: tq.config.namespace,
       labels: tq.config.commonLabels,
+      annotations: tq.config.serviceAccountAnnotations,
     },
   },
 
@@ -96,6 +121,7 @@ function(params) {
     local c = {
       name: 'thanos-query',
       image: tq.config.image,
+      imagePullPolicy: tq.config.imagePullPolicy,
       args:
         [
           'query',
@@ -107,8 +133,11 @@ function(params) {
           '--query.replica-label=%s' % labelName
           for labelName in tq.config.replicaLabels
         ] + [
-          '--store=%s' % store
+          '--endpoint=%s' % store
           for store in tq.config.stores
+        ] + [
+          '--rule=%s' % store
+          for store in tq.config.rules
         ] +
         (
           if tq.config.externalPrefix != '' then [
@@ -139,6 +168,29 @@ function(params) {
           if tq.config.autoDownsampling then [
             '--query.auto-downsampling',
           ] else []
+        ) + (
+          if tq.config.useThanosEngine then [
+            '--query.promql-engine=thanos',
+          ] else []
+        ) + (
+          if tq.config.telemetryDurationQuantiles != '' then [
+            '--query.telemetry.request-duration-seconds-quantiles=' + std.stripChars(quantile, ' ')
+            for quantile in std.split(tq.config.telemetryDurationQuantiles, ',')
+          ] else []
+        ) + (
+          if tq.config.telemetrySamplesQuantiles != '' then [
+            '--query.telemetry.request-samples-quantiles=' + std.stripChars(quantile, ' ')
+            for quantile in std.split(tq.config.telemetrySamplesQuantiles, ',')
+          ] else []
+        ) + (
+          if tq.config.telemetrySeriesQuantiles != '' then [
+            '--query.telemetry.request-series-seconds-quantiles=' + std.stripChars(quantile, ' ')
+            for quantile in std.split(tq.config.telemetrySeriesQuantiles, ',')
+          ] else []
+        ) + (
+          if tq.config.queryUrl != '' then [
+            '--alert.query-url=' + tq.config.queryUrl,
+          ] else []
         ),
       env: [
         {
@@ -150,7 +202,9 @@ function(params) {
             },
           },
         },
-      ],
+      ] + (
+        if std.length(tq.config.extraEnv) > 0 then tq.config.extraEnv else []
+      ),
       ports: [
         { name: port.name, containerPort: port.port }
         for port in tq.service.spec.ports
@@ -166,6 +220,7 @@ function(params) {
         path: '/-/ready',
       } },
       resources: if tq.config.resources != {} then tq.config.resources else {},
+      securityContext: tq.config.securityContextContainer,
       terminationMessagePolicy: 'FallbackToLogsOnError',
     };
 
@@ -190,7 +245,7 @@ function(params) {
             serviceAccountName: tq.serviceAccount.metadata.name,
             terminationGracePeriodSeconds: 120,
             nodeSelector: {
-              'beta.kubernetes.io/os': 'linux',
+              'kubernetes.io/os': 'linux',
             },
             affinity: { podAntiAffinity: {
               preferredDuringSchedulingIgnoredDuringExecution: [{
@@ -227,6 +282,7 @@ function(params) {
         {
           port: 'http',
           relabelings: [{
+            action: 'replace',
             sourceLabels: ['namespace', 'pod'],
             separator: '/',
             targetLabel: 'instance',

jsonnet/kube-thanos/kube-thanos-receive-default-params.libsonnet

@@ -7,11 +7,14 @@
   namespace: error 'must provide namespace',
   version: error 'must provide version',
   image: error 'must provide image',
+  imagePullPolicy: 'IfNotPresent',
   replicas: error 'must provide replicas',
+  minReadySeconds: 0,
   replicationFactor: error 'must provide replication factor',
   objectStorageConfig: error 'must provide objectStorageConfig',
   podDisruptionBudgetMaxUnavailable: (std.floor(defaults.replicationFactor / 2)),
   hashringConfigMapName: '',
+  enableLocalEndpoint: true,
   volumeClaimTemplate: {},
   retention: '15d',
   logLevel: 'info',
@@ -29,6 +32,11 @@
     'receive="true"',
   ],
   tenantLabelName: null,
+  tenantHeader: null,
+  clusterDomain: 'cluster.local',
+  extraEnv: [],
+  receiveLimitsConfigFile: {},
+  storeLimits: {},
 
   commonLabels:: {
     'app.kubernetes.io/name': 'thanos-receive',
@@ -46,5 +54,20 @@
   securityContext:: {
     fsGroup: 65534,
     runAsUser: 65534,
+    runAsGroup: 65532,
+    runAsNonRoot: true,
+    seccompProfile: { type: 'RuntimeDefault' },
   },
+
+  securityContextContainer:: {
+    runAsUser: defaults.securityContext.runAsUser,
+    runAsGroup: defaults.securityContext.runAsGroup,
+    runAsNonRoot: defaults.securityContext.runAsNonRoot,
+    seccompProfile: defaults.securityContext.seccompProfile,
+    allowPrivilegeEscalation: false,
+    readOnlyRootFilesystem: true,
+    capabilities: { drop: ['ALL'] },
+  },
+
+  serviceAccountAnnotations:: {},
 }

jsonnet/kube-thanos/kube-thanos-receive-hashrings.libsonnet

@@ -28,6 +28,7 @@ function(params)
         name: config.name,
         namespace: config.namespace,
         labels: config.commonLabels,
+        annotations: config.serviceAccountAnnotations,
       },
     },
     hashrings: {
@@ -90,11 +91,13 @@ function(params)
             port: 'http',
             relabelings: [
               {
+                action: 'replace',
                 sourceLabels: ['namespace', 'pod'],
                 separator: '/',
                 targetLabel: 'instance',
               },
               {
+                action: 'replace',
                 sourceLabels: ['__meta_kubernetes_service_label_controller_receive_thanos_io_shard'],
                 targetLabel: 'hashring',
               },

jsonnet/kube-thanos/kube-thanos-receive-ingestor.libsonnet

@@ -0,0 +1,46 @@
+local receiveConfigDefaults = import 'kube-thanos/kube-thanos-receive-default-params.libsonnet';
+local receiveHashring = import 'kube-thanos/kube-thanos-receive-hashrings.libsonnet';
+
+local defaults = receiveConfigDefaults {
+  hashrings: [{
+    hashring: 'default',
+    tenants: [],
+  }],
+  hashringConfigMapName: 'hashring-config',
+  routerReplicas: 1,
+};
+
+function(params) {
+  local tr = self,
+  // Combine the defaults and the passed params to make the component's config.
+  config:: defaults + params,
+
+  local ingestors = receiveHashring(tr.config { name: tr.config.name + '-ingestor' }),
+
+  ingestors: {
+    [name]: ingestors.hashrings[name]
+    for name in std.objectFields(ingestors.hashrings)
+  },
+
+  storeEndpoints:: [
+    'dnssrv+_grpc._tcp.%s.%s.svc.cluster.local:%d' % [ingestors.hashrings[name.hashring].service.metadata.name, tr.config.namespace, tr.config.ports.grpc]
+    for name in tr.config.hashrings
+  ],
+
+  endpoints:: {
+    [name.hashring]: [
+      '%s-%d.%s.%s.svc.cluster.local:%d' % [
+        ingestors.hashrings[name.hashring].service.metadata.name,
+        i,
+        ingestors.hashrings[name.hashring].service.metadata.name,
+        tr.config.namespace,
+        tr.config.ports.grpc,
+      ]
+      // Replica specification is 1-based, but statefulSets are named 0-based.
+      for i in std.range(0, tr.config.replicas - 1)
+    ]
+    for name in tr.config.hashrings
+  },
+  serviceAccount: ingestors.serviceAccount,
+  serviceMonitor: if tr.config.serviceMonitor then ingestors.serviceMonitor,
+}

jsonnet/kube-thanos/kube-thanos-receive-router.libsonnet

@@ -0,0 +1,164 @@
+local receiveConfigDefaults = import 'kube-thanos/kube-thanos-receive-default-params.libsonnet';
+
+local defaults = receiveConfigDefaults {
+  hashrings: [{
+    hashring: 'default',
+    tenants: [],
+  }],
+  hashringConfigMapName: 'hashring-config',
+  routerReplicas: 1,
+  endpoints: error 'must provide ingestor endpoints object',
+};
+
+function(params) {
+  local tr = self,
+  // Combine the defaults and the passed params to make the component's config.
+  config:: defaults + params,
+
+  routerLabels:: tr.config.commonLabels {
+    'app.kubernetes.io/component': tr.config.name + '-router',
+  },
+
+  podLabelSelector:: {
+    [labelName]: tr.routerLabels[labelName]
+    for labelName in std.objectFields(tr.routerLabels)
+    if labelName != 'app.kubernetes.io/version'
+  },
+
+  service: {
+    apiVersion: 'v1',
+    kind: 'Service',
+    metadata: {
+      name: tr.config.name + '-router',
+      namespace: tr.config.namespace,
+      labels: tr.routerLabels,
+    },
+    spec: {
+      ports: [
+        {
+          assert std.isString(name),
+          assert std.isNumber(tr.config.ports[name]),
+
+          name: name,
+          port: tr.config.ports[name],
+          targetPort: tr.config.ports[name],
+        }
+        for name in std.objectFields(tr.config.ports)
+      ],
+      selector: tr.routerLabels,
+    },
+  },
+
+  serviceAccount: {
+    apiVersion: 'v1',
+    kind: 'ServiceAccount',
+    metadata: {
+      name: tr.config.name + '-router',
+      namespace: tr.config.namespace,
+      labels: tr.routerLabels,
+      annotations: tr.config.serviceAccountAnnotations,
+    },
+  },
+
+  configmap: {
+    apiVersion: 'v1',
+    kind: 'ConfigMap',
+    metadata: {
+      name: tr.config.hashringConfigMapName,
+      namespace: tr.config.namespace,
+    },
+    data: {
+      'hashrings.json': std.toString([hashring { endpoints: tr.config.endpoints[hashring.hashring] } for hashring in tr.config.hashrings]),
+    },
+  },
+
+  // Create the deployment that acts as a router to the ingestor backends
+  deployment: {
+    apiVersion: 'apps/v1',
+    kind: 'Deployment',
+    metadata: {
+      name: tr.config.name + '-router',
+      namespace: tr.config.namespace,
+      labels: tr.routerLabels,
+    },
+    spec: {
+      replicas: tr.config.routerReplicas,
+      selector: { matchLabels: tr.podLabelSelector },
+      template: {
+        metadata: {
+          labels: tr.routerLabels,
+        },
+        spec: {
+          serviceAccountName: tr.serviceAccount.metadata.name,
+          securityContext: tr.config.securityContext,
+          containers: [{
+            name: 'thanos-receive',
+            image: tr.config.image,
+            imagePullPolicy: tr.config.imagePullPolicy,
+            args: [
+              'receive',
+              '--log.level=' + tr.config.logLevel,
+              '--log.format=' + tr.config.logFormat,
+              '--grpc-address=0.0.0.0:%d' % tr.config.ports.grpc,
+              '--http-address=0.0.0.0:%d' % tr.config.ports.http,
+              '--remote-write.address=0.0.0.0:%d' % tr.config.ports['remote-write'],
+              '--receive.replication-factor=%d' % tr.config.replicationFactor,
+              '--receive.hashrings-file=/var/lib/thanos-receive/hashrings.json',
+            ] + [
+              '--label=%s' % label
+              for label in tr.config.labels
+            ] + (
+              if tr.config.tenantLabelName != null then [
+                '--receive.tenant-label-name=%s' % tr.config.tenantLabelName,
+              ] else []
+            ) + (
+              if std.length(tr.config.tracing) > 0 then [
+                '--tracing.config=' + std.manifestYamlDoc(
+                  { config+: { service_name: defaults.name } } + tr.config.tracing
+                ),
+              ] else []
+            ),
+            env: [
+              { name: 'NAME', valueFrom: { fieldRef: { fieldPath: 'metadata.name' } } },
+              { name: 'NAMESPACE', valueFrom: { fieldRef: { fieldPath: 'metadata.namespace' } } },
+              {
+                // Inject the host IP to make configuring tracing convenient.
+                name: 'HOST_IP_ADDRESS',
+                valueFrom: {
+                  fieldRef: {
+                    fieldPath: 'status.hostIP',
+                  },
+                },
+              },
+            ] + (
+              if std.length(tr.config.extraEnv) > 0 then tr.config.extraEnv else []
+            ),
+            ports: [{ name: name, containerPort: tr.config.ports[name] } for name in std.objectFields(tr.config.ports)],
+            volumeMounts: [{ name: 'hashring-config', mountPath: '/var/lib/thanos-receive' }],
+            livenessProbe: { failureThreshold: 8, periodSeconds: 30, httpGet: {
+              scheme: 'HTTP',
+              port: tr.config.ports.http,
+              path: '/-/healthy',
+            } },
+            readinessProbe: { failureThreshold: 20, periodSeconds: 5, httpGet: {
+              scheme: 'HTTP',
+              port: tr.config.ports.http,
+              path: '/-/ready',
+            } },
+            resources: if tr.config.resources != {} then tr.config.resources else {},
+            securityContext: tr.config.securityContextContainer,
+            terminationMessagePolicy: 'FallbackToLogsOnError',
+          }],
+          volumes: [{
+            name: 'hashring-config',
+            configMap: { name: tr.config.hashringConfigMapName },
+          }],
+          terminationGracePeriodSeconds: 30,
+          nodeSelector: {
+            'kubernetes.io/os': 'linux',
+          },
+        },
+      },
+    },
+  },
+}

jsonnet/kube-thanos/kube-thanos-receive.libsonnet

@@ -12,6 +12,9 @@ function(params) {
   assert std.isBoolean(tr.config.serviceMonitor),
   assert std.isObject(tr.config.volumeClaimTemplate),
   assert !std.objectHas(tr.config.volumeClaimTemplate, 'spec') || std.assertEqual(tr.config.volumeClaimTemplate.spec.accessModes, ['ReadWriteOnce']) : 'thanos receive PVC accessMode can only be ReadWriteOnce',
+  assert std.isNumber(tr.config.minReadySeconds),
+  assert std.isObject(tr.config.receiveLimitsConfigFile),
+  assert std.isObject(tr.config.storeLimits),
 
   service: {
     apiVersion: 'v1',
@@ -45,18 +48,21 @@ function(params) {
       name: tr.config.name,
       namespace: tr.config.namespace,
       labels: tr.config.commonLabels,
+      annotations: tr.config.serviceAccountAnnotations,
     },
   },
 
   statefulSet:
-    local localEndpointFlag = '--receive.local-endpoint=$(NAME).%s.$(NAMESPACE).svc.cluster.local:%d' % [
+    local localEndpointFlag = '--receive.local-endpoint=$(NAME).%s.$(NAMESPACE).svc.%s:%d' % [
       tr.config.name,
+      tr.config.clusterDomain,
       tr.config.ports.grpc,
     ];
 
     local c = {
       name: 'thanos-receive',
       image: tr.config.image,
+      imagePullPolicy: tr.config.imagePullPolicy,
       args: [
         'receive',
         '--log.level=' + tr.config.logLevel,
@@ -65,35 +71,54 @@ function(params) {
         '--http-address=0.0.0.0:%d' % tr.config.ports.http,
         '--remote-write.address=0.0.0.0:%d' % tr.config.ports['remote-write'],
         '--receive.replication-factor=%d' % tr.config.replicationFactor,
-        '--objstore.config=$(OBJSTORE_CONFIG)',
         '--tsdb.path=/var/thanos/receive',
         '--tsdb.retention=' + tr.config.retention,
-        localEndpointFlag,
       ] + [
         '--label=%s' % label
         for label in tr.config.labels
       ] + (
+        if tr.config.objectStorageConfig != null then [
+          '--objstore.config=$(OBJSTORE_CONFIG)',
+        ] else []
+      ) + (
+        if tr.config.enableLocalEndpoint then [
+          localEndpointFlag,
+        ] else []
+      ) + (
         if tr.config.tenantLabelName != null then [
           '--receive.tenant-label-name=%s' % tr.config.tenantLabelName,
         ] else []
+      ) + (
+        if tr.config.tenantHeader != null then [
+          '--receive.tenant-header=%s' % tr.config.tenantHeader,
+        ] else []
       ) + (
         if tr.config.hashringConfigMapName != '' then [
           '--receive.hashrings-file=/var/lib/thanos-receive/hashrings.json',
         ] else []
+      ) + (
+        if std.objectHas(tr.config.storeLimits, 'requestSamples') then [
+          '--store.limits.request-samples=%s' % tr.config.storeLimits.requestSamples,
+        ] else []
+      ) + (
+        if std.objectHas(tr.config.storeLimits, 'requestSeries') then [
+          '--store.limits.request-series=%s' % tr.config.storeLimits.requestSeries,
+        ] else []
       ) + (
         if std.length(tr.config.tracing) > 0 then [
           '--tracing.config=' + std.manifestYamlDoc(
             { config+: { service_name: defaults.name } } + tr.config.tracing
           ),
         ] else []
+      ) + (
+        if tr.config.receiveLimitsConfigFile != {} then [
+          '--receive.limits-config-file=/etc/thanos/config/' + tr.config.receiveLimitsConfigFile.name + '/' + tr.config.receiveLimitsConfigFile.key,
+        ]
+        else []
       ),
       env: [
         { name: 'NAME', valueFrom: { fieldRef: { fieldPath: 'metadata.name' } } },
         { name: 'NAMESPACE', valueFrom: { fieldRef: { fieldPath: 'metadata.namespace' } } },
-        { name: 'OBJSTORE_CONFIG', valueFrom: { secretKeyRef: {
-          key: tr.config.objectStorageConfig.key,
-          name: tr.config.objectStorageConfig.name,
-        } } },
         {
           // Inject the host IP to make configuring tracing convenient.
           name: 'HOST_IP_ADDRESS',
@@ -103,7 +128,17 @@ function(params) {
             },
           },
         },
-      ],
+      ] + (
+        if tr.config.objectStorageConfig != null then [{
+          name: 'OBJSTORE_CONFIG',
+          valueFrom: { secretKeyRef: {
+            key: tr.config.objectStorageConfig.key,
+            name: tr.config.objectStorageConfig.name,
+          } },
+        }] else []
+      ) + (
+        if std.length(tr.config.extraEnv) > 0 then tr.config.extraEnv else []
+      ),
       ports: [
         { name: name, containerPort: tr.config.ports[name] }
         for name in std.objectFields(tr.config.ports)
@@ -116,6 +151,14 @@ function(params) {
         if tr.config.hashringConfigMapName != '' then [
           { name: 'hashring-config', mountPath: '/var/lib/thanos-receive' },
         ] else []
+      ) + (
+        if tr.config.objectStorageConfig != null && std.objectHas(tr.config.objectStorageConfig, 'tlsSecretName') && std.length(tr.config.objectStorageConfig.tlsSecretName) > 0 then [
+          { name: 'tls-secret', mountPath: tr.config.objectStorageConfig.tlsSecretMountPath },
+        ] else []
+      ) + (
+        if tr.config.receiveLimitsConfigFile != {} then [
+          { name: tr.config.receiveLimitsConfigFile.name, mountPath: '/etc/thanos/config/' + tr.config.receiveLimitsConfigFile.name, readOnly: true },
+        ] else []
       ),
       livenessProbe: { failureThreshold: 8, periodSeconds: 30, httpGet: {
         scheme: 'HTTP',
@@ -141,6 +184,7 @@ function(params) {
       },
       spec: {
         replicas: tr.config.replicas,
+        minReadySeconds: tr.config.minReadySeconds,
         selector: { matchLabels: tr.config.podLabelSelector },
         serviceName: tr.service.metadata.name,
         template: {
@@ -151,13 +195,25 @@ function(params) {
             serviceAccountName: tr.serviceAccount.metadata.name,
             securityContext: tr.config.securityContext,
             containers: [c],
-            volumes: if tr.config.hashringConfigMapName != '' then [{
-              name: 'hashring-config',
-              configMap: { name: tr.config.hashringConfigMapName },
-            }] else [],
+            volumes: (
+              if tr.config.hashringConfigMapName != '' then [{
+                name: 'hashring-config',
+                configMap: { name: tr.config.hashringConfigMapName },
+              }] else []
+            ) + (
+              if tr.config.objectStorageConfig != null && std.objectHas(tr.config.objectStorageConfig, 'tlsSecretName') && std.length(tr.config.objectStorageConfig.tlsSecretName) > 0 then [{
+                name: 'tls-secret',
+                secret: { secretName: tr.config.objectStorageConfig.tlsSecretName },
+              }] else []
+            ) + (
+              if tr.config.receiveLimitsConfigFile != {} then [{
+                name: tr.config.receiveLimitsConfigFile.name,
+                configMap: { name: tr.config.receiveLimitsConfigFile.name },
+              }] else []
+            ),
             terminationGracePeriodSeconds: 900,
             nodeSelector: {
-              'beta.kubernetes.io/os': 'linux',
+              'kubernetes.io/os': 'linux',
             },
             affinity: { podAntiAffinity: {
               local labelSelector = { matchExpressions: [{
@@ -215,6 +271,7 @@ function(params) {
         {
           port: 'http',
           relabelings: [{
+            action: 'replace',
             sourceLabels: ['namespace', 'pod'],
             separator: '/',
             targetLabel: 'instance',
@@ -225,7 +282,7 @@ function(params) {
   },
 
   podDisruptionBudget: if tr.config.podDisruptionBudgetMaxUnavailable >= 1 then {
-    apiVersion: 'policy/v1beta1',
+    apiVersion: 'policy/v1',
     kind: 'PodDisruptionBudget',
     metadata: {
       name: tr.config.name,

jsonnet/kube-thanos/kube-thanos-rule.libsonnet

@@ -7,12 +7,17 @@ local defaults = {
   namespace: error 'must provide namespace',
   version: error 'must provide version',
   image: error 'must provide image',
+  imagePullPolicy: 'IfNotPresent',
   replicas: error 'must provide replicas',
   reloaderImage: error 'must provide reloader image',
+  reloaderImagePullPolicy: 'IfNotPresent',
   objectStorageConfig: error 'must provide objectStorageConfig',
   ruleFiles: [],
   rulesConfig: [],
+  remoteWriteConfigFile: {},
   alertmanagersURLs: [],
+  alertmanagerConfigFile: {},
+  extraVolumeMounts: [],
   queriers: [],
   logLevel: 'info',
   logFormat: 'logfmt',
@@ -23,8 +28,10 @@ local defaults = {
   ports: {
     grpc: 10901,
     http: 10902,
+    reloader: 9533,
   },
   tracing: {},
+  extraEnv: [],
 
   commonLabels:: {
     'app.kubernetes.io/name': 'thanos-rule',
@@ -42,7 +49,22 @@ local defaults = {
   securityContext:: {
     fsGroup: 65534,
     runAsUser: 65534,
+    runAsGroup: 65532,
+    runAsNonRoot: true,
+    seccompProfile: { type: 'RuntimeDefault' },
   },
+
+  securityContextContainer:: {
+    runAsUser: defaults.securityContext.runAsUser,
+    runAsGroup: defaults.securityContext.runAsGroup,
+    runAsNonRoot: defaults.securityContext.runAsNonRoot,
+    seccompProfile: defaults.securityContext.seccompProfile,
+    allowPrivilegeEscalation: false,
+    readOnlyRootFilesystem: true,
+    capabilities: { drop: ['ALL'] },
+  },
+
+  serviceAccountAnnotations:: {},
 };
 
 function(params) {
@@ -54,7 +76,10 @@ function(params) {
   assert std.isNumber(tr.config.replicas) && tr.config.replicas >= 0 : 'thanos rule replicas has to be number >= 0',
   assert std.isArray(tr.config.ruleFiles),
   assert std.isArray(tr.config.rulesConfig),
+  assert std.isObject(tr.config.remoteWriteConfigFile),
   assert std.isArray(tr.config.alertmanagersURLs),
+  assert std.isObject(tr.config.alertmanagerConfigFile),
+  assert std.isArray(tr.config.extraVolumeMounts),
   assert std.isObject(tr.config.resources),
   assert std.isBoolean(tr.config.serviceMonitor),
   assert std.isObject(tr.config.volumeClaimTemplate),
@@ -93,6 +118,7 @@ function(params) {
       name: tr.config.name,
       namespace: tr.config.namespace,
       labels: tr.config.commonLabels,
+      annotations: tr.config.serviceAccountAnnotations,
     },
   },
 
@@ -100,6 +126,7 @@ function(params) {
     local c = {
       name: 'thanos-rule',
       image: tr.config.image,
+      imagePullPolicy: tr.config.imagePullPolicy,
       args:
         [
           'rule',
@@ -118,6 +145,11 @@ function(params) {
         (['--rule-file=%s' % path for path in tr.config.ruleFiles]) +
         (['--alertmanagers.url=%s' % url for url in tr.config.alertmanagersURLs]) +
         (
+          if tr.config.alertmanagerConfigFile != {} then [
+            '--alertmanagers.config-file=/etc/thanos/config/' + tr.config.alertmanagerConfigFile.name + '/' + tr.config.alertmanagerConfigFile.key,
+          ]
+          else []
+        ) + (
           if std.length(tr.config.rulesConfig) > 0 then [
             '--rule-file=/etc/thanos/rules/' + ruleConfig.name + '/' + ruleConfig.key
             for ruleConfig in tr.config.rulesConfig
@@ -129,6 +161,11 @@ function(params) {
               { config+: { service_name: defaults.name } } + tr.config.tracing
             ),
           ] else []
+        ) + (
+          if tr.config.remoteWriteConfigFile != {} then [
+            '--remote-write.config-file=/etc/thanos/config/' + tr.config.remoteWriteConfigFile.name + '/' + tr.config.remoteWriteConfigFile.key,
+          ]
+          else []
         ),
       env: [
         { name: 'NAME', valueFrom: { fieldRef: { fieldPath: 'metadata.name' } } },
@@ -145,7 +182,9 @@ function(params) {
             },
           },
         },
-      ],
+      ] + (
+        if std.length(tr.config.extraEnv) > 0 then tr.config.extraEnv else []
+      ),
       ports: [
         { name: name, containerPort: tr.config.ports[name] }
         for name in std.objectFields(tr.config.ports)
@@ -159,6 +198,23 @@ function(params) {
           { name: ruleConfig.name, mountPath: '/etc/thanos/rules/' + ruleConfig.name }
           for ruleConfig in tr.config.rulesConfig
         ] else []
+      ) + (
+        if tr.config.alertmanagerConfigFile != {} then [
+          { name: tr.config.alertmanagerConfigFile.name, mountPath: '/etc/thanos/config/' + tr.config.alertmanagerConfigFile.name, readOnly: true },
+        ] else []
+      ) + (
+        if std.length(tr.config.extraVolumeMounts) > 0 then [
+          { name: volumeMount.name, mountPath: volumeMount.mountPath }
+          for volumeMount in tr.config.extraVolumeMounts
+        ] else []
+      ) + (
+        if tr.config.objectStorageConfig != null && std.objectHas(tr.config.objectStorageConfig, 'tlsSecretName') && std.length(tr.config.objectStorageConfig.tlsSecretName) > 0 then [
+          { name: 'tls-secret', mountPath: tr.config.objectStorageConfig.tlsSecretMountPath },
+        ] else []
+      ) + (
+        if tr.config.remoteWriteConfigFile != {} then [
+          { name: tr.config.remoteWriteConfigFile.name, mountPath: '/etc/thanos/config/' + tr.config.remoteWriteConfigFile.name, readOnly: true },
+        ] else []
       ),
       livenessProbe: { failureThreshold: 24, periodSeconds: 5, httpGet: {
         scheme: 'HTTP',
@@ -172,21 +228,54 @@ function(params) {
 
       } },
       resources: if tr.config.resources != {} then tr.config.resources else {},
+      securityContext: tr.config.securityContextContainer,
       terminationMessagePolicy: 'FallbackToLogsOnError',
     };
 
     local reloadContainer = {
       name: 'configmap-reloader',
       image: tr.config.reloaderImage,
+      imagePullPolicy: tr.config.reloaderImagePullPolicy,
       args:
         [
           '-webhook-url=http://localhost:' + tr.service.spec.ports[1].port + '/-/reload',
         ] +
-        (['-volume-dir=/etc/thanos/rules/' + ruleConfig.name for ruleConfig in tr.config.rulesConfig]),
+        (
+          if std.length(tr.config.rulesConfig) > 0 then [
+            '-volume-dir=/etc/thanos/rules/' + ruleConfig.name
+            for ruleConfig in tr.config.rulesConfig
+          ] else []
+        ) + (
+          if tr.config.alertmanagerConfigFile != {} then [
+            '-volume-dir=/etc/thanos/config/' + tr.config.alertmanagerConfigFile.name,
+          ] else []
+        ) + (
+          if std.length(tr.config.extraVolumeMounts) > 0 then [
+            '-volume-dir=' + volumeMount.mountPath
+            for volumeMount in tr.config.extraVolumeMounts
+          ] else []
+        ) + (
+          if tr.config.remoteWriteConfigFile != {} then [
+            '-volume-dir=/etc/thanos/config/' + tr.config.remoteWriteConfigFile.name,
+          ] else []
+        ),
       volumeMounts: [
         { name: ruleConfig.name, mountPath: '/etc/thanos/rules/' + ruleConfig.name }
         for ruleConfig in tr.config.rulesConfig
-      ],
+      ] + (
+        if tr.config.alertmanagerConfigFile != {} then [
+          { name: tr.config.alertmanagerConfigFile.name, mountPath: '/etc/thanos/config/' + tr.config.alertmanagerConfigFile.name },
+        ] else []
+      ) + (
+        if std.length(tr.config.extraVolumeMounts) > 0 then [
+          { name: volumeMount.name, mountPath: volumeMount.mountPath }
+          for volumeMount in tr.config.extraVolumeMounts
+        ] else []
+      ) + (
+        if tr.config.remoteWriteConfigFile != {} then [
+          { name: tr.config.remoteWriteConfigFile.name, mountPath: '/etc/thanos/config/' + tr.config.remoteWriteConfigFile.name },
+        ] else []
+      ),
     };
 
     {
@@ -209,14 +298,71 @@ function(params) {
             serviceAccountName: tr.serviceAccount.metadata.name,
             securityContext: tr.config.securityContext,
             containers: [c] +
-                        (if std.length(tr.config.rulesConfig) > 0 then [reloadContainer] else []),
-            volumes: [
-              { name: ruleConfig.name, configMap: { name: ruleConfig.name } }
-              for ruleConfig in tr.config.rulesConfig
-            ],
+                        (
+                          if std.length(tr.config.rulesConfig) > 0 || std.length(tr.config.extraVolumeMounts) > 0 || tr.config.alertmanagerConfigFile != {} || tr.config.remoteWriteConfigFile != {} then [
+                            reloadContainer,
+                          ] else []
+                        ),
+            volumes:
+              [] +
+              (
+                if std.length(tr.config.rulesConfig) > 0 then [
+                  { name: ruleConfig.name, configMap: { name: ruleConfig.name } }
+                  for ruleConfig in tr.config.rulesConfig
+                ] else []
+              ) + (
+                if tr.config.alertmanagerConfigFile != {} then [{
+                  name: tr.config.alertmanagerConfigFile.name,
+                  configMap: { name: tr.config.alertmanagerConfigFile.name },
+                }] else []
+              ) + (
+                if tr.config.remoteWriteConfigFile != {} then [{
+                  name: tr.config.remoteWriteConfigFile.name,
+                  configMap: { name: tr.config.remoteWriteConfigFile.name },
+                }] else []
+              ) + (
+                if std.length(tr.config.extraVolumeMounts) > 0 then [
+                  { name: volumeMount.name } +
+                  (
+                    if volumeMount.type == 'configMap' then {
+                      configMap: { name: volumeMount.name },
+                    }
+                    else {
+                      secret: { name: volumeMount.name },
+                    }
+                  )
+                  for volumeMount in tr.config.extraVolumeMounts
+                ] else []
+              ) + (
+                if tr.config.objectStorageConfig != null && std.objectHas(tr.config.objectStorageConfig, 'tlsSecretName') && std.length(tr.config.objectStorageConfig.tlsSecretName) > 0 then [{
+                  name: 'tls-secret',
+                  secret: { secretName: tr.config.objectStorageConfig.tlsSecretName },
+                }] else []
+              ),
             nodeSelector: {
-              'beta.kubernetes.io/os': 'linux',
+              'kubernetes.io/os': 'linux',
             },
+            affinity: { podAntiAffinity: {
+              local labelSelector = { matchExpressions: [{
+                key: 'app.kubernetes.io/name',
+                operator: 'In',
+                values: [tr.statefulSet.metadata.labels['app.kubernetes.io/name']],
+              }, {
+                key: 'app.kubernetes.io/instance',
+                operator: 'In',
+                values: [tr.statefulSet.metadata.labels['app.kubernetes.io/instance']],
+              }] },
+              preferredDuringSchedulingIgnoredDuringExecution: [
+                {
+                  podAffinityTerm: {
+                    namespaces: [tr.config.namespace],
+                    topologyKey: 'kubernetes.io/hostname',
+                    labelSelector: labelSelector,
+                  },
+                  weight: 100,
+                },
+              ],
+            } },
           },
         },
         volumeClaimTemplates: if std.length(tr.config.volumeClaimTemplate) > 0 then [tr.config.volumeClaimTemplate {
@@ -244,11 +390,13 @@ function(params) {
         {
           port: 'http',
           relabelings: [{
+            action: 'replace',
             sourceLabels: ['namespace', 'pod'],
             separator: '/',
             targetLabel: 'instance',
           }],
         },
+        { port: 'reloader' },
       ],
     },
   },

jsonnet/kube-thanos/kube-thanos-sidecar.libsonnet

@@ -72,6 +72,7 @@ function(params) {
       endpoints: [{
         port: 'http',
         relabelings: [{
+          action: 'replace',
           sourceLabels: ['namespace', 'pod'],
           separator: '/',
           targetLabel: 'instance',