feat(jsonnet): Add queryUrl support (#330)

Signed-off-by: adinhodovic <hodovicadin@gmail.com>

.bingo/.gitignore

@@ -5,6 +5,7 @@
 # But not these files:
 !.gitignore
 !*.mod
+!*.sum
 !README.md
 !Variables.mk
 !variables.env

.bingo/README.md

@@ -5,7 +5,8 @@ This is directory which stores Go modules with pinned buildable package that is
 * Run `bingo get` to install all tools having each own module file in this directory.
 * Run `bingo get <tool>` to install <tool> that have own module file in this directory.
 * For Makefile: Make sure to put `include .bingo/Variables.mk` in your Makefile, then use $(<upper case tool name>) variable where <tool> is the .bingo/<tool>.mod.
-* For shell: Run `source .bingo/variables.env` to source all environment variable for each tool
+* For shell: Run `source .bingo/variables.env` to source all environment variable for each tool.
+* For go: Import `.bingo/variables.go` to for variable names.
 * See https://github.com/bwplotka/bingo or -h on how to add, remove or change binaries dependencies.
 
 ## Requirements

.bingo/Variables.mk

@@ -1,10 +1,11 @@
-# Auto generated binary variables helper managed by https://github.com/bwplotka/bingo v0.2.3. DO NOT EDIT.
+# Auto generated binary variables helper managed by https://github.com/bwplotka/bingo v0.8. DO NOT EDIT.
 # All tools are designed to be build inside $GOBIN.
+BINGO_DIR := $(dir $(lastword $(MAKEFILE_LIST)))
 GOPATH ?= $(shell go env GOPATH)
 GOBIN  ?= $(firstword $(subst :, ,${GOPATH}))/bin
 GO     ?= $(shell which go)
 
-# Bellow generated variables ensure that every time a tool under each variable is invoked, the correct version
+# Below generated variables ensure that every time a tool under each variable is invoked, the correct version
 # will be used; reinstalling only if needed.
 # For example for embedmd variable:
 #
@@ -17,44 +18,44 @@ GO     ?= $(shell which go)
 #	@$(EMBEDMD) <flags/args..>
 #
 EMBEDMD := $(GOBIN)/embedmd-v1.0.0
-$(EMBEDMD): .bingo/embedmd.mod
+$(EMBEDMD): $(BINGO_DIR)/embedmd.mod
 	@# Install binary/ries using Go 1.14+ build command. This is using bwplotka/bingo-controlled, separate go module with pinned dependencies.
 	@echo "(re)installing $(GOBIN)/embedmd-v1.0.0"
-	@cd .bingo && $(GO) build -mod=mod -modfile=embedmd.mod -o=$(GOBIN)/embedmd-v1.0.0 "github.com/campoy/embedmd"
+	@cd $(BINGO_DIR) && GOWORK=off $(GO) build -mod=mod -modfile=embedmd.mod -o=$(GOBIN)/embedmd-v1.0.0 "github.com/campoy/embedmd"
 
 GOJSONTOYAML := $(GOBIN)/gojsontoyaml-v0.0.0-20200602132005-3697ded27e8c
-$(GOJSONTOYAML): .bingo/gojsontoyaml.mod
+$(GOJSONTOYAML): $(BINGO_DIR)/gojsontoyaml.mod
 	@# Install binary/ries using Go 1.14+ build command. This is using bwplotka/bingo-controlled, separate go module with pinned dependencies.
 	@echo "(re)installing $(GOBIN)/gojsontoyaml-v0.0.0-20200602132005-3697ded27e8c"
-	@cd .bingo && $(GO) build -mod=mod -modfile=gojsontoyaml.mod -o=$(GOBIN)/gojsontoyaml-v0.0.0-20200602132005-3697ded27e8c "github.com/brancz/gojsontoyaml"
+	@cd $(BINGO_DIR) && GOWORK=off $(GO) build -mod=mod -modfile=gojsontoyaml.mod -o=$(GOBIN)/gojsontoyaml-v0.0.0-20200602132005-3697ded27e8c "github.com/brancz/gojsontoyaml"
 
 JB := $(GOBIN)/jb-v0.4.0
-$(JB): .bingo/jb.mod
+$(JB): $(BINGO_DIR)/jb.mod
 	@# Install binary/ries using Go 1.14+ build command. This is using bwplotka/bingo-controlled, separate go module with pinned dependencies.
 	@echo "(re)installing $(GOBIN)/jb-v0.4.0"
-	@cd .bingo && $(GO) build -mod=mod -modfile=jb.mod -o=$(GOBIN)/jb-v0.4.0 "github.com/jsonnet-bundler/jsonnet-bundler/cmd/jb"
+	@cd $(BINGO_DIR) && GOWORK=off $(GO) build -mod=mod -modfile=jb.mod -o=$(GOBIN)/jb-v0.4.0 "github.com/jsonnet-bundler/jsonnet-bundler/cmd/jb"
 
-JSONNET_LINT := $(GOBIN)/jsonnet-lint-v0.17.1-0.20210101181740-31d71aaccda6
-$(JSONNET_LINT): .bingo/jsonnet-lint.mod
+JSONNET_LINT := $(GOBIN)/jsonnet-lint-v0.20.0
+$(JSONNET_LINT): $(BINGO_DIR)/jsonnet-lint.mod
 	@# Install binary/ries using Go 1.14+ build command. This is using bwplotka/bingo-controlled, separate go module with pinned dependencies.
-	@echo "(re)installing $(GOBIN)/jsonnet-lint-v0.17.1-0.20210101181740-31d71aaccda6"
-	@cd .bingo && $(GO) build -mod=mod -modfile=jsonnet-lint.mod -o=$(GOBIN)/jsonnet-lint-v0.17.1-0.20210101181740-31d71aaccda6 "github.com/google/go-jsonnet/cmd/jsonnet-lint"
+	@echo "(re)installing $(GOBIN)/jsonnet-lint-v0.20.0"
+	@cd $(BINGO_DIR) && GOWORK=off $(GO) build -mod=mod -modfile=jsonnet-lint.mod -o=$(GOBIN)/jsonnet-lint-v0.20.0 "github.com/google/go-jsonnet/cmd/jsonnet-lint"
 
-JSONNET := $(GOBIN)/jsonnet-v0.17.1-0.20210101181740-31d71aaccda6
-$(JSONNET): .bingo/jsonnet.mod
+JSONNET := $(GOBIN)/jsonnet-v0.20.0
+$(JSONNET): $(BINGO_DIR)/jsonnet.mod
 	@# Install binary/ries using Go 1.14+ build command. This is using bwplotka/bingo-controlled, separate go module with pinned dependencies.
-	@echo "(re)installing $(GOBIN)/jsonnet-v0.17.1-0.20210101181740-31d71aaccda6"
-	@cd .bingo && $(GO) build -mod=mod -modfile=jsonnet.mod -o=$(GOBIN)/jsonnet-v0.17.1-0.20210101181740-31d71aaccda6 "github.com/google/go-jsonnet/cmd/jsonnet"
+	@echo "(re)installing $(GOBIN)/jsonnet-v0.20.0"
+	@cd $(BINGO_DIR) && GOWORK=off $(GO) build -mod=mod -modfile=jsonnet.mod -o=$(GOBIN)/jsonnet-v0.20.0 "github.com/google/go-jsonnet/cmd/jsonnet"
 
-JSONNETFMT := $(GOBIN)/jsonnetfmt-v0.17.1-0.20210101181740-31d71aaccda6
-$(JSONNETFMT): .bingo/jsonnetfmt.mod
+JSONNETFMT := $(GOBIN)/jsonnetfmt-v0.20.0
+$(JSONNETFMT): $(BINGO_DIR)/jsonnetfmt.mod
 	@# Install binary/ries using Go 1.14+ build command. This is using bwplotka/bingo-controlled, separate go module with pinned dependencies.
-	@echo "(re)installing $(GOBIN)/jsonnetfmt-v0.17.1-0.20210101181740-31d71aaccda6"
-	@cd .bingo && $(GO) build -mod=mod -modfile=jsonnetfmt.mod -o=$(GOBIN)/jsonnetfmt-v0.17.1-0.20210101181740-31d71aaccda6 "github.com/google/go-jsonnet/cmd/jsonnetfmt"
+	@echo "(re)installing $(GOBIN)/jsonnetfmt-v0.20.0"
+	@cd $(BINGO_DIR) && GOWORK=off $(GO) build -mod=mod -modfile=jsonnetfmt.mod -o=$(GOBIN)/jsonnetfmt-v0.20.0 "github.com/google/go-jsonnet/cmd/jsonnetfmt"
 
-KUBECONFORM := $(GOBIN)/kubeconform-v0.4.4
-$(KUBECONFORM): .bingo/kubeconform.mod
+KUBECONFORM := $(GOBIN)/kubeconform-v0.6.3
+$(KUBECONFORM): $(BINGO_DIR)/kubeconform.mod
 	@# Install binary/ries using Go 1.14+ build command. This is using bwplotka/bingo-controlled, separate go module with pinned dependencies.
-	@echo "(re)installing $(GOBIN)/kubeconform-v0.4.4"
-	@cd .bingo && $(GO) build -mod=mod -modfile=kubeconform.mod -o=$(GOBIN)/kubeconform-v0.4.4 "github.com/yannh/kubeconform/cmd/kubeconform"
+	@echo "(re)installing $(GOBIN)/kubeconform-v0.6.3"
+	@cd $(BINGO_DIR) && GOWORK=off $(GO) build -mod=mod -modfile=kubeconform.mod -o=$(GOBIN)/kubeconform-v0.6.3 "github.com/yannh/kubeconform/cmd/kubeconform"
 

.bingo/embedmd.sum

@@ -0,0 +1,4 @@
+github.com/campoy/embedmd v1.0.0 h1:V4kI2qTJJLf4J29RzI/MAt2c3Bl4dQSYPuflzwFH2hY=
+github.com/campoy/embedmd v1.0.0/go.mod h1:oxyr9RCiSXg0M3VJ3ks0UGfp98BpSSGr0kpiX3MzVl8=
+github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
+github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=

.bingo/gojsontoyaml.sum

@@ -0,0 +1,7 @@
+github.com/brancz/gojsontoyaml v0.0.0-20200602132005-3697ded27e8c h1:hb6WqfcKQZlNx/vahy51SaIvKnoXD5609Nm0PC4msEM=
+github.com/brancz/gojsontoyaml v0.0.0-20200602132005-3697ded27e8c/go.mod h1:+00lOjYXPgMfxHVPvg9GDtc3BX5Xh5aFpB4gMB8gfMo=
+github.com/ghodss/yaml v1.0.0 h1:wQHKEahhL6wmXdzwWG11gIVCkOv05bNOh+Rxn0yngAk=
+github.com/ghodss/yaml v1.0.0/go.mod h1:4dBDuWmgqj2HViK6kFavaiC9ZROes6MMH2rRYeMEF04=
+gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
+gopkg.in/yaml.v2 v2.3.0 h1:clyUAQHOM3G0M3f5vQj7LuJrETvjVot3Z5el9nffUtU=
+gopkg.in/yaml.v2 v2.3.0/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=

.bingo/jb.sum

@@ -0,0 +1,24 @@
+github.com/alecthomas/template v0.0.0-20160405071501-a0175ee3bccc h1:cAKDfWh5VpdgMhJosfJnn5/FoN2SRZ4p7fJNX58YPaU=
+github.com/alecthomas/template v0.0.0-20160405071501-a0175ee3bccc/go.mod h1:LOuyumcjzFXgccqObfd/Ljyb9UuFJ6TxHnclSeseNhc=
+github.com/alecthomas/units v0.0.0-20151022065526-2efee857e7cf h1:qet1QNfXsQxTZqLG4oE62mJzwPIB8+Tee4RNCL9ulrY=
+github.com/alecthomas/units v0.0.0-20151022065526-2efee857e7cf/go.mod h1:ybxpYRFXyAe+OPACYpWeL0wqObRcbAqCMya13uyzqw0=
+github.com/campoy/embedmd v1.0.0/go.mod h1:oxyr9RCiSXg0M3VJ3ks0UGfp98BpSSGr0kpiX3MzVl8=
+github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/fatih/color v1.7.0 h1:DkWD4oS2D8LGGgTQ6IvwJJXSL5Vp2ffcQg58nFV38Ys=
+github.com/fatih/color v1.7.0/go.mod h1:Zm6kSWBoL9eyXnKyktHP6abPY2pDugNf5KwzbycvMj4=
+github.com/jsonnet-bundler/jsonnet-bundler v0.4.0 h1:4BKZ6LDqPc2wJDmaKnmYD/vDjUptJtnUpai802MibFc=
+github.com/jsonnet-bundler/jsonnet-bundler v0.4.0/go.mod h1:/by7P/OoohkI3q4CgSFqcoFsVY+IaNbzOVDknEsKDeU=
+github.com/mattn/go-colorable v0.0.9 h1:UVL0vNpWh04HeJXV0KLcaT7r06gOH2l4OW6ddYRUIY4=
+github.com/mattn/go-colorable v0.0.9/go.mod h1:9vuHe8Xs5qXnSaW/c/ABM9alt+Vo+STaOChaDxuIBZU=
+github.com/mattn/go-isatty v0.0.6 h1:SrwhHcpV4nWrMGdNcC2kXpMfcBVYGDuTArqyhocJgvA=
+github.com/mattn/go-isatty v0.0.6/go.mod h1:Iq45c/XA43vh69/j3iqttzPXn0bhXyGjM0Hdxcsrc5s=
+github.com/pkg/errors v0.8.0 h1:WdK/asTD0HN+q6hsWO3/vpuAkAr+tw6aNJNDFFf0+qw=
+github.com/pkg/errors v0.8.0/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
+github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
+github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
+github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
+golang.org/x/sys v0.0.0-20190222072716-a9d3bda3a223/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
+golang.org/x/sys v0.0.0-20190310054646-10058d7d4faa h1:lqti/xP+yD/6zH5TqEwx2MilNIJY5Vbc6Qr8J3qyPIQ=
+golang.org/x/sys v0.0.0-20190310054646-10058d7d4faa/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+gopkg.in/alecthomas/kingpin.v2 v2.2.6 h1:jMFz6MfLP0/4fUyZle81rXUoxOBFi19VUFKVDOQfozc=
+gopkg.in/alecthomas/kingpin.v2 v2.2.6/go.mod h1:FMv+mEhP44yOT+4EoQTLFTRgOQ1FBLkstjWtayDeSgw=

.bingo/jsonnet-lint.mod

@@ -2,8 +2,4 @@ module _ // Auto generated by https://github.com/bwplotka/bingo. DO NOT EDIT
 
 go 1.15
 
-require (
-	github.com/fatih/color v1.10.0 // indirect
-	github.com/google/go-jsonnet v0.17.1-0.20210101181740-31d71aaccda6 // cmd/jsonnet-lint
-	golang.org/x/sys v0.0.0-20210112091331-59c308dcf3cc // indirect
-)
+require github.com/google/go-jsonnet v0.20.0 // cmd/jsonnet-lint

.bingo/jsonnet-lint.sum

@@ -0,0 +1,41 @@
+github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/fatih/color v1.9.0/go.mod h1:eQcE1qtQxscV5RaZvpXrrb8Drkc3/DdQ+uUYCNjL+zU=
+github.com/fatih/color v1.10.0 h1:s36xzo75JdqLaaWoiEHk767eHiwo0598uUxyfiPkDsg=
+github.com/fatih/color v1.10.0/go.mod h1:ELkj/draVOlAH/xkhN6mQ50Qd0MPOk5AAr3maGEBuJM=
+github.com/fatih/color v1.12.0 h1:mRhaKNwANqRgUBGKmnI5ZxEk7QXmjQeCcuYFMX2bfcc=
+github.com/fatih/color v1.12.0/go.mod h1:ELkj/draVOlAH/xkhN6mQ50Qd0MPOk5AAr3maGEBuJM=
+github.com/google/go-jsonnet v0.17.1-0.20210101181740-31d71aaccda6 h1:91EupyycmO5ctzKuWEZ9nX0Cal1NveMiWcXxmRtLyLQ=
+github.com/google/go-jsonnet v0.17.1-0.20210101181740-31d71aaccda6/go.mod h1:sOcuej3UW1vpPTZOr8L7RQimqai1a57bt5j22LzGZCw=
+github.com/google/go-jsonnet v0.20.0 h1:WG4TTSARuV7bSm4PMB4ohjxe33IHT5WVTrJSU33uT4g=
+github.com/google/go-jsonnet v0.20.0/go.mod h1:VbgWF9JX7ztlv770x/TolZNGGFfiHEVx9G6ca2eUmeA=
+github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORNo=
+github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ=
+github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI=
+github.com/mattn/go-colorable v0.1.4/go.mod h1:U0ppj6V5qS13XJ6of8GYAs25YV2eR4EVcfRqFIhoBtE=
+github.com/mattn/go-colorable v0.1.8 h1:c1ghPdyEDarC70ftn0y+A/Ee++9zz8ljHG1b13eJ0s8=
+github.com/mattn/go-colorable v0.1.8/go.mod h1:u6P/XSegPjTcexA+o6vUJrdnUu04hMope9wVRipJSqc=
+github.com/mattn/go-isatty v0.0.8/go.mod h1:Iq45c/XA43vh69/j3iqttzPXn0bhXyGjM0Hdxcsrc5s=
+github.com/mattn/go-isatty v0.0.11/go.mod h1:PhnuNfih5lzO57/f3n+odYbM4JtupLOxQOAqxQCu2WE=
+github.com/mattn/go-isatty v0.0.12 h1:wuysRhFDzyxgEmMf5xjvJ2M9dZoWAXNNr5LSBS7uHXY=
+github.com/mattn/go-isatty v0.0.12/go.mod h1:cbi8OIDigv2wuxKPP5vlRcQ1OAZbq2CE4Kysco4FUpU=
+github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
+github.com/sergi/go-diff v1.1.0/go.mod h1:STckp+ISIX8hZLjrqAeVduY0gWCT9IjLuqbuNXdaHfM=
+github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
+github.com/stretchr/testify v1.4.0/go.mod h1:j7eGeouHqKxXV5pUuKE4zz7dFj8WfuZ+81PSLYec5m4=
+golang.org/x/sys v0.0.0-20190222072716-a9d3bda3a223/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
+golang.org/x/sys v0.0.0-20191026070338-33540a1f6037/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20200116001909-b77594299b42/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20200223170610-d5e6a3e2c0ae/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20210112091331-59c308dcf3cc h1:y0Og6AYdwus7SIAnKnDxjc4gJetRiYEWOx4AKbOeyEI=
+golang.org/x/sys v0.0.0-20210112091331-59c308dcf3cc/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.1.0 h1:kunALQeHf1/185U1i0GOB/fy1IPRDDpuoOOqRReG57U=
+golang.org/x/sys v0.1.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
+gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
+gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
+gopkg.in/yaml.v2 v2.2.4/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
+gopkg.in/yaml.v2 v2.2.7 h1:VUgggvou5XRW9mHwD/yXxIYSMtY0zoKQf/v226p2nyo=
+gopkg.in/yaml.v2 v2.2.7/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
+sigs.k8s.io/yaml v1.1.0 h1:4A07+ZFc2wgJwo8YNlQpr1rVlgUDlxXHhPJciaPY5gs=
+sigs.k8s.io/yaml v1.1.0/go.mod h1:UJmg0vDUVViEyp3mgSv9WPwZCDxu4rQW1olrI1uml+o=

.bingo/jsonnet.mod

@@ -2,8 +2,4 @@ module _ // Auto generated by https://github.com/bwplotka/bingo. DO NOT EDIT
 
 go 1.15
 
-require (
-	github.com/fatih/color v1.10.0 // indirect
-	github.com/google/go-jsonnet v0.17.1-0.20210101181740-31d71aaccda6 // cmd/jsonnet
-	golang.org/x/sys v0.0.0-20210112091331-59c308dcf3cc // indirect
-)
+require github.com/google/go-jsonnet v0.20.0 // cmd/jsonnet

.bingo/jsonnet.sum

@@ -0,0 +1,41 @@
+github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/fatih/color v1.9.0/go.mod h1:eQcE1qtQxscV5RaZvpXrrb8Drkc3/DdQ+uUYCNjL+zU=
+github.com/fatih/color v1.10.0 h1:s36xzo75JdqLaaWoiEHk767eHiwo0598uUxyfiPkDsg=
+github.com/fatih/color v1.10.0/go.mod h1:ELkj/draVOlAH/xkhN6mQ50Qd0MPOk5AAr3maGEBuJM=
+github.com/fatih/color v1.12.0 h1:mRhaKNwANqRgUBGKmnI5ZxEk7QXmjQeCcuYFMX2bfcc=
+github.com/fatih/color v1.12.0/go.mod h1:ELkj/draVOlAH/xkhN6mQ50Qd0MPOk5AAr3maGEBuJM=
+github.com/google/go-jsonnet v0.17.1-0.20210101181740-31d71aaccda6 h1:91EupyycmO5ctzKuWEZ9nX0Cal1NveMiWcXxmRtLyLQ=
+github.com/google/go-jsonnet v0.17.1-0.20210101181740-31d71aaccda6/go.mod h1:sOcuej3UW1vpPTZOr8L7RQimqai1a57bt5j22LzGZCw=
+github.com/google/go-jsonnet v0.20.0 h1:WG4TTSARuV7bSm4PMB4ohjxe33IHT5WVTrJSU33uT4g=
+github.com/google/go-jsonnet v0.20.0/go.mod h1:VbgWF9JX7ztlv770x/TolZNGGFfiHEVx9G6ca2eUmeA=
+github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORNo=
+github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ=
+github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI=
+github.com/mattn/go-colorable v0.1.4/go.mod h1:U0ppj6V5qS13XJ6of8GYAs25YV2eR4EVcfRqFIhoBtE=
+github.com/mattn/go-colorable v0.1.8 h1:c1ghPdyEDarC70ftn0y+A/Ee++9zz8ljHG1b13eJ0s8=
+github.com/mattn/go-colorable v0.1.8/go.mod h1:u6P/XSegPjTcexA+o6vUJrdnUu04hMope9wVRipJSqc=
+github.com/mattn/go-isatty v0.0.8/go.mod h1:Iq45c/XA43vh69/j3iqttzPXn0bhXyGjM0Hdxcsrc5s=
+github.com/mattn/go-isatty v0.0.11/go.mod h1:PhnuNfih5lzO57/f3n+odYbM4JtupLOxQOAqxQCu2WE=
+github.com/mattn/go-isatty v0.0.12 h1:wuysRhFDzyxgEmMf5xjvJ2M9dZoWAXNNr5LSBS7uHXY=
+github.com/mattn/go-isatty v0.0.12/go.mod h1:cbi8OIDigv2wuxKPP5vlRcQ1OAZbq2CE4Kysco4FUpU=
+github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
+github.com/sergi/go-diff v1.1.0/go.mod h1:STckp+ISIX8hZLjrqAeVduY0gWCT9IjLuqbuNXdaHfM=
+github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
+github.com/stretchr/testify v1.4.0/go.mod h1:j7eGeouHqKxXV5pUuKE4zz7dFj8WfuZ+81PSLYec5m4=
+golang.org/x/sys v0.0.0-20190222072716-a9d3bda3a223/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
+golang.org/x/sys v0.0.0-20191026070338-33540a1f6037/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20200116001909-b77594299b42/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20200223170610-d5e6a3e2c0ae/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20210112091331-59c308dcf3cc h1:y0Og6AYdwus7SIAnKnDxjc4gJetRiYEWOx4AKbOeyEI=
+golang.org/x/sys v0.0.0-20210112091331-59c308dcf3cc/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.1.0 h1:kunALQeHf1/185U1i0GOB/fy1IPRDDpuoOOqRReG57U=
+golang.org/x/sys v0.1.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
+gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
+gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
+gopkg.in/yaml.v2 v2.2.4/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
+gopkg.in/yaml.v2 v2.2.7 h1:VUgggvou5XRW9mHwD/yXxIYSMtY0zoKQf/v226p2nyo=
+gopkg.in/yaml.v2 v2.2.7/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
+sigs.k8s.io/yaml v1.1.0 h1:4A07+ZFc2wgJwo8YNlQpr1rVlgUDlxXHhPJciaPY5gs=
+sigs.k8s.io/yaml v1.1.0/go.mod h1:UJmg0vDUVViEyp3mgSv9WPwZCDxu4rQW1olrI1uml+o=

.bingo/jsonnetfmt.mod

@@ -2,8 +2,4 @@ module _ // Auto generated by https://github.com/bwplotka/bingo. DO NOT EDIT
 
 go 1.15
 
-require (
-	github.com/fatih/color v1.10.0 // indirect
-	github.com/google/go-jsonnet v0.17.1-0.20210101181740-31d71aaccda6 // cmd/jsonnetfmt
-	golang.org/x/sys v0.0.0-20210112091331-59c308dcf3cc // indirect
-)
+require github.com/google/go-jsonnet v0.20.0 // cmd/jsonnetfmt

.bingo/jsonnetfmt.sum

@@ -0,0 +1,41 @@
+github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/fatih/color v1.9.0/go.mod h1:eQcE1qtQxscV5RaZvpXrrb8Drkc3/DdQ+uUYCNjL+zU=
+github.com/fatih/color v1.10.0 h1:s36xzo75JdqLaaWoiEHk767eHiwo0598uUxyfiPkDsg=
+github.com/fatih/color v1.10.0/go.mod h1:ELkj/draVOlAH/xkhN6mQ50Qd0MPOk5AAr3maGEBuJM=
+github.com/fatih/color v1.12.0 h1:mRhaKNwANqRgUBGKmnI5ZxEk7QXmjQeCcuYFMX2bfcc=
+github.com/fatih/color v1.12.0/go.mod h1:ELkj/draVOlAH/xkhN6mQ50Qd0MPOk5AAr3maGEBuJM=
+github.com/google/go-jsonnet v0.17.1-0.20210101181740-31d71aaccda6 h1:91EupyycmO5ctzKuWEZ9nX0Cal1NveMiWcXxmRtLyLQ=
+github.com/google/go-jsonnet v0.17.1-0.20210101181740-31d71aaccda6/go.mod h1:sOcuej3UW1vpPTZOr8L7RQimqai1a57bt5j22LzGZCw=
+github.com/google/go-jsonnet v0.20.0 h1:WG4TTSARuV7bSm4PMB4ohjxe33IHT5WVTrJSU33uT4g=
+github.com/google/go-jsonnet v0.20.0/go.mod h1:VbgWF9JX7ztlv770x/TolZNGGFfiHEVx9G6ca2eUmeA=
+github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORNo=
+github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ=
+github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI=
+github.com/mattn/go-colorable v0.1.4/go.mod h1:U0ppj6V5qS13XJ6of8GYAs25YV2eR4EVcfRqFIhoBtE=
+github.com/mattn/go-colorable v0.1.8 h1:c1ghPdyEDarC70ftn0y+A/Ee++9zz8ljHG1b13eJ0s8=
+github.com/mattn/go-colorable v0.1.8/go.mod h1:u6P/XSegPjTcexA+o6vUJrdnUu04hMope9wVRipJSqc=
+github.com/mattn/go-isatty v0.0.8/go.mod h1:Iq45c/XA43vh69/j3iqttzPXn0bhXyGjM0Hdxcsrc5s=
+github.com/mattn/go-isatty v0.0.11/go.mod h1:PhnuNfih5lzO57/f3n+odYbM4JtupLOxQOAqxQCu2WE=
+github.com/mattn/go-isatty v0.0.12 h1:wuysRhFDzyxgEmMf5xjvJ2M9dZoWAXNNr5LSBS7uHXY=
+github.com/mattn/go-isatty v0.0.12/go.mod h1:cbi8OIDigv2wuxKPP5vlRcQ1OAZbq2CE4Kysco4FUpU=
+github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
+github.com/sergi/go-diff v1.1.0/go.mod h1:STckp+ISIX8hZLjrqAeVduY0gWCT9IjLuqbuNXdaHfM=
+github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
+github.com/stretchr/testify v1.4.0/go.mod h1:j7eGeouHqKxXV5pUuKE4zz7dFj8WfuZ+81PSLYec5m4=
+golang.org/x/sys v0.0.0-20190222072716-a9d3bda3a223/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
+golang.org/x/sys v0.0.0-20191026070338-33540a1f6037/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20200116001909-b77594299b42/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20200223170610-d5e6a3e2c0ae/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20210112091331-59c308dcf3cc h1:y0Og6AYdwus7SIAnKnDxjc4gJetRiYEWOx4AKbOeyEI=
+golang.org/x/sys v0.0.0-20210112091331-59c308dcf3cc/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.1.0 h1:kunALQeHf1/185U1i0GOB/fy1IPRDDpuoOOqRReG57U=
+golang.org/x/sys v0.1.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
+gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
+gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
+gopkg.in/yaml.v2 v2.2.4/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
+gopkg.in/yaml.v2 v2.2.7 h1:VUgggvou5XRW9mHwD/yXxIYSMtY0zoKQf/v226p2nyo=
+gopkg.in/yaml.v2 v2.2.7/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
+sigs.k8s.io/yaml v1.1.0 h1:4A07+ZFc2wgJwo8YNlQpr1rVlgUDlxXHhPJciaPY5gs=
+sigs.k8s.io/yaml v1.1.0/go.mod h1:UJmg0vDUVViEyp3mgSv9WPwZCDxu4rQW1olrI1uml+o=

.bingo/kubeconform.mod

@@ -1,5 +1,5 @@
 module _ // Auto generated by https://github.com/bwplotka/bingo. DO NOT EDIT
 
-go 1.15
+go 1.21
 
-require github.com/yannh/kubeconform v0.4.4 // cmd/kubeconform
+require github.com/yannh/kubeconform v0.6.3 // cmd/kubeconform

.bingo/kubeconform.sum

@@ -0,0 +1,25 @@
+github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
+github.com/santhosh-tekuri/jsonschema/v5 v5.1.1 h1:lEOLY2vyGIqKWUI9nzsOJRV3mb3WC9dXYORsLEUcoeY=
+github.com/santhosh-tekuri/jsonschema/v5 v5.1.1/go.mod h1:FKdcjfQW6rpZSnxxUvEA5H/cDPdvJ/SZJQLWWXWGrZ0=
+github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
+github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
+github.com/xeipuuv/gojsonpointer v0.0.0-20180127040702-4e3ac2762d5f h1:J9EGpcZtP0E/raorCMxlFGSTBrsSlaDGf3jU/qvAE2c=
+github.com/xeipuuv/gojsonpointer v0.0.0-20180127040702-4e3ac2762d5f/go.mod h1:N2zxlSyiKSe5eX1tZViRH5QA0qijqEDrYZiPEAiq3wU=
+github.com/xeipuuv/gojsonreference v0.0.0-20180127040603-bd5ef7bd5415 h1:EzJWgHovont7NscjpAxXsDA8S8BMYve8Y5+7cuRE7R0=
+github.com/xeipuuv/gojsonreference v0.0.0-20180127040603-bd5ef7bd5415/go.mod h1:GwrjFmJcFw6At/Gs6z4yjiIwzuJ1/+UwLxMQDVQXShQ=
+github.com/xeipuuv/gojsonschema v1.2.0 h1:LhYJRs+L4fBtjZUfuSZIKGeVu0QRy8e5Xi7D17UxZ74=
+github.com/xeipuuv/gojsonschema v1.2.0/go.mod h1:anYRn/JVcOK2ZgGU+IjEV4nwlhoK5sQluxsYJ78Id3Y=
+github.com/yannh/kubeconform v0.4.4 h1:1+Wmd2QnZFaHd5hrNXWxwvPbE/pVTDNNWWXRaoN1Zbs=
+github.com/yannh/kubeconform v0.4.4/go.mod h1:Ysf3RSreh2rX8IJsVt/uT3Um/U3e3ykx6Fcz8nCdskM=
+github.com/yannh/kubeconform v0.6.3 h1:lNmb/kphyzitA+GBsOxjBsagCEpjLvt3+qo3XMiEOUA=
+github.com/yannh/kubeconform v0.6.3/go.mod h1:4E6oaL+lh7KgCG2SaOabeeAFBkyKu5D9ab0OEekGcbs=
+gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
+gopkg.in/yaml.v2 v2.2.8/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
+gopkg.in/yaml.v2 v2.3.0 h1:clyUAQHOM3G0M3f5vQj7LuJrETvjVot3Z5el9nffUtU=
+gopkg.in/yaml.v2 v2.3.0/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
+gopkg.in/yaml.v2 v2.4.0 h1:D8xgwECY7CYvx+Y2n4sBz93Jn9JRvxdiyyo8CTfuKaY=
+gopkg.in/yaml.v2 v2.4.0/go.mod h1:RDklbk79AGWmwhnvt/jBztapEOGDOx6ZbXqjP6csGnQ=
+sigs.k8s.io/yaml v1.2.0 h1:kr/MCeFWJWTwyaHoR9c8EjH9OumOmoF9YGiZd7lFm/Q=
+sigs.k8s.io/yaml v1.2.0/go.mod h1:yfXDCHCao9+ENCvLSE62v9VSji2MKu5jeNfTrofGhJc=

.bingo/kubeval.sum

@@ -0,0 +1,57 @@
+github.com/BurntSushi/toml v0.3.1/go.mod h1:xHWCNGjB5oqiDr8zfno3MHue2Ht5sIBksp03qcyfWMU=
+github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/fatih/color v1.7.0 h1:DkWD4oS2D8LGGgTQ6IvwJJXSL5Vp2ffcQg58nFV38Ys=
+github.com/fatih/color v1.7.0/go.mod h1:Zm6kSWBoL9eyXnKyktHP6abPY2pDugNf5KwzbycvMj4=
+github.com/fsnotify/fsnotify v1.4.7 h1:IXs+QLmnXW2CcXuY+8Mzv/fWEsPGWxqefPtCP5CnV9I=
+github.com/fsnotify/fsnotify v1.4.7/go.mod h1:jwhsz4b93w/PPRr/qN1Yymfu8t87LnFCMoQvtojpjFo=
+github.com/hashicorp/errwrap v0.0.0-20180715044906-d6c0cd880357 h1:Rem2+U35z1QtPQc6r+WolF7yXiefXqDKyk+lN2pE164=
+github.com/hashicorp/errwrap v0.0.0-20180715044906-d6c0cd880357/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
+github.com/hashicorp/go-multierror v0.0.0-20180717150148-3d5d8f294aa0 h1:j30noezaCfvNLcdMYSvHLv81DxYRSt1grlpseG67vhU=
+github.com/hashicorp/go-multierror v0.0.0-20180717150148-3d5d8f294aa0/go.mod h1:JMRHfdO9jKNzS/+BTlxCjKNQHg/jZAft8U7LloJvN7I=
+github.com/hashicorp/hcl v0.0.0-20180404174102-ef8a98b0bbce h1:xdsDDbiBDQTKASoGEZ+pEmF1OnWuu8AQ9I8iNbHNeno=
+github.com/hashicorp/hcl v0.0.0-20180404174102-ef8a98b0bbce/go.mod h1:oZtUIOe8dh44I2q6ScRibXws4Ajl+d+nod3AaR9vL5w=
+github.com/inconshreveable/mousetrap v1.0.0/go.mod h1:PxqpIevigyE2G7u3NXJIT2ANytuPF1OarO4DADm73n8=
+github.com/instrumenta/kubeval v0.0.0-20201005082916-38668c6c5b23 h1:M1Ms+wV9kd4g65MWhdyoMmaVIZj4U18t5bFRPs/zJUs=
+github.com/instrumenta/kubeval v0.0.0-20201005082916-38668c6c5b23/go.mod h1:cD+P/oZrBwOnaIHXrqvKPuN353KPxGomnsXSXf8pFJs=
+github.com/magiconair/properties v1.8.0 h1:LLgXmsheXeRoUOBOjtwPQCWIYqM/LU1ayDtDePerRcY=
+github.com/magiconair/properties v1.8.0/go.mod h1:PppfXfuXeibc/6YijjN8zIbojt8czPbwD3XqdrwzmxQ=
+github.com/mattn/go-colorable v0.1.0 h1:v2XXALHHh6zHfYTJ+cSkwtyffnaOyR1MXaA91mTrb8o=
+github.com/mattn/go-colorable v0.1.0/go.mod h1:9vuHe8Xs5qXnSaW/c/ABM9alt+Vo+STaOChaDxuIBZU=
+github.com/mattn/go-isatty v0.0.4 h1:bnP0vzxcAdeI1zdubAl5PjU6zsERjGZb7raWodagDYs=
+github.com/mattn/go-isatty v0.0.4/go.mod h1:M+lRXTBqGeGNdLjl/ufCoiOlB5xdOkqRJdNxMWT7Zi4=
+github.com/mitchellh/mapstructure v0.0.0-20180715050151-f15292f7a699 h1:KXZJFdun9knAVAR8tg/aHJEr5DgtcbqyvzacK+CDCaI=
+github.com/mitchellh/mapstructure v0.0.0-20180715050151-f15292f7a699/go.mod h1:FVVH3fgwuzCH5S8UJGiWEs2h04kUh9fWfEaFds41c1Y=
+github.com/pelletier/go-toml v0.0.0-20180724185102-c2dbbc24a979 h1:Uh8pTMDzw+nuDTW7lyxcpmYqQJFE8SnO93F3lyY4XzY=
+github.com/pelletier/go-toml v0.0.0-20180724185102-c2dbbc24a979/go.mod h1:5z9KED0ma1S8pY6P1sdut58dfprrGBbd/94hg7ilaic=
+github.com/pkg/errors v0.8.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
+github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
+github.com/spf13/afero v1.1.1 h1:Lt3ihYMlE+lreX1GS4Qw4ZsNpYQLxIXKBTEOXm3nt6I=
+github.com/spf13/afero v1.1.1/go.mod h1:j4pytiNVoe2o6bmDsKpLACNPDBIoEAkihy7loJ1B0CQ=
+github.com/spf13/cast v1.2.0 h1:HHl1DSRbEQN2i8tJmtS6ViPyHx35+p51amrdsiTCrkg=
+github.com/spf13/cast v1.2.0/go.mod h1:r2rcYCSwa1IExKTDiTfzaxqT2FNHs8hODu4LnUfgKEg=
+github.com/spf13/cobra v0.0.0-20180820174524-ff0d02e85550 h1:LB9SHuuXO8gnsHtexOQSpsJrrAHYA35lvHUaE74kznU=
+github.com/spf13/cobra v0.0.0-20180820174524-ff0d02e85550/go.mod h1:1l0Ry5zgKvJasoi3XT1TypsSe7PqH0Sj9dhYf7v3XqQ=
+github.com/spf13/jwalterweatherman v0.0.0-20180814060501-14d3d4c51834 h1:kJI9pPzfsULT/72wy7mxkRQZPtKWgFdCA2RTGZ4v8/E=
+github.com/spf13/jwalterweatherman v0.0.0-20180814060501-14d3d4c51834/go.mod h1:cQK4TGJAtQXfYWX+Ddv3mKDzgVb68N+wFjFa4jdeBTo=
+github.com/spf13/pflag v0.0.0-20180821114517-d929dcbb1086 h1:iU+nPfqRqK8ShQqnpZLv8cZ9oklo6NFUcmX1JT5Rudg=
+github.com/spf13/pflag v0.0.0-20180821114517-d929dcbb1086/go.mod h1:DYY7MBk1bdzusC3SYhjObp+wFpr4gzcvqqNjLnInEg4=
+github.com/spf13/viper v1.1.0 h1:V7OZpY8i3C1x/pDmU0zNNlfVoDz112fSYvtWMjjS3f4=
+github.com/spf13/viper v1.1.0/go.mod h1:A8kyI5cUJhb8N+3pkfONlcEcZbueH6nhAm0Fq7SrnBM=
+github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
+github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
+github.com/xeipuuv/gojsonpointer v0.0.0-20180127040702-4e3ac2762d5f h1:J9EGpcZtP0E/raorCMxlFGSTBrsSlaDGf3jU/qvAE2c=
+github.com/xeipuuv/gojsonpointer v0.0.0-20180127040702-4e3ac2762d5f/go.mod h1:N2zxlSyiKSe5eX1tZViRH5QA0qijqEDrYZiPEAiq3wU=
+github.com/xeipuuv/gojsonreference v0.0.0-20180127040603-bd5ef7bd5415 h1:EzJWgHovont7NscjpAxXsDA8S8BMYve8Y5+7cuRE7R0=
+github.com/xeipuuv/gojsonreference v0.0.0-20180127040603-bd5ef7bd5415/go.mod h1:GwrjFmJcFw6At/Gs6z4yjiIwzuJ1/+UwLxMQDVQXShQ=
+github.com/xeipuuv/gojsonschema v0.0.0-20180816142147-da425ebb7609 h1:BcMExZAULPkihVZ7UJXK7t8rwGqisXFw75tILnafhBY=
+github.com/xeipuuv/gojsonschema v0.0.0-20180816142147-da425ebb7609/go.mod h1:5yf86TLmAcydyeJq5YvxkGPE2fm/u4myDekKRoLuqhs=
+golang.org/x/sys v0.0.0-20180821044426-4ea2f632f6e9 h1:0RHCP7KEw0rDuVXXaT2gfV77uu6lTKa5aItB+EoFbQk=
+golang.org/x/sys v0.0.0-20180821044426-4ea2f632f6e9/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
+golang.org/x/text v0.0.0-20180810153555-6e3c4e7365dd h1:e/dojZNNKqwK3xq7UQTKTQJim18r/FxvQk7PFXULeZg=
+golang.org/x/text v0.0.0-20180810153555-6e3c4e7365dd/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
+gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
+gopkg.in/yaml.v2 v2.2.1 h1:mUhvW9EsL+naU5Q3cakzfE91YhliOondGd6ZrsDBHQE=
+gopkg.in/yaml.v2 v2.2.1/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
+sigs.k8s.io/yaml v1.1.0 h1:4A07+ZFc2wgJwo8YNlQpr1rVlgUDlxXHhPJciaPY5gs=
+sigs.k8s.io/yaml v1.1.0/go.mod h1:UJmg0vDUVViEyp3mgSv9WPwZCDxu4rQW1olrI1uml+o=

.bingo/variables.env

@@ -1,4 +1,4 @@
-# Auto generated binary variables helper managed by https://github.com/bwplotka/bingo v0.2.3. DO NOT EDIT.
+# Auto generated binary variables helper managed by https://github.com/bwplotka/bingo v0.8. DO NOT EDIT.
 # All tools are designed to be build inside $GOBIN.
 # Those variables will work only until 'bingo get' was invoked, or if tools were installed via Makefile's Variables.mk.
 GOBIN=${GOBIN:=$(go env GOBIN)}
@@ -8,17 +8,17 @@ if [ -z "$GOBIN" ]; then
 fi
 
 
-EMBEDMD="$GOBIN/embedmd-v1.0.0"
+EMBEDMD="${GOBIN}/embedmd-v1.0.0"
 
-GOJSONTOYAML="$GOBIN/gojsontoyaml-v0.0.0-20200602132005-3697ded27e8c"
+GOJSONTOYAML="${GOBIN}/gojsontoyaml-v0.0.0-20200602132005-3697ded27e8c"
 
-JB="$GOBIN/jb-v0.4.0"
+JB="${GOBIN}/jb-v0.4.0"
 
-JSONNET_LINT="$GOBIN/jsonnet-lint-v0.17.1-0.20210101181740-31d71aaccda6"
+JSONNET_LINT="${GOBIN}/jsonnet-lint-v0.20.0"
 
-JSONNET="$GOBIN/jsonnet-v0.17.1-0.20210101181740-31d71aaccda6"
+JSONNET="${GOBIN}/jsonnet-v0.20.0"
 
-JSONNETFMT="$GOBIN/jsonnetfmt-v0.17.1-0.20210101181740-31d71aaccda6"
+JSONNETFMT="${GOBIN}/jsonnetfmt-v0.20.0"
 
-KUBECONFORM="$GOBIN/kubeconform-v0.4.4"
+KUBECONFORM="${GOBIN}/kubeconform-v0.4.4"
 

.circleci/config.yml

@@ -1,25 +0,0 @@
-jobs:
-  lint:
-    working_directory: /go/src/github.com/{{ORG_NAME}}/{{REPO_NAME}}
-    docker:
-      - image: circleci/golang:1.15
-    steps:
-      - checkout
-      - run: make vendor
-      - run: git diff --exit-code
-      - run: make --always-make fmt lint
-      - run: git diff --exit-code
-  build:
-    working_directory: /go/src/github.com/{{ORG_NAME}}/{{REPO_NAME}}
-    docker:
-      - image: circleci/golang:1.15
-    steps:
-      - checkout
-      - run: make --always-make vendor generate validate
-      - run: git diff --exit-code
-workflows:
-  version: 2
-  build_and_test:
-    jobs:
-      - lint
-      - build

.github/workflows/ci.yml

@@ -0,0 +1,38 @@
+name: CI
+
+on:
+  push:
+    branches: [ main ]
+  pull_request:
+    branches: [ main ]
+  workflow_dispatch:
+
+jobs:
+  lint:
+    runs-on: ubuntu-latest
+    steps:
+    - uses: actions/checkout@v2
+    - name: Set up Go
+      uses: actions/setup-go@v2
+      with:
+        go-version: 1.17
+    - name: Vendor
+      run: make vendor
+    - name: Vendor Diff
+      run: git diff --exit-code
+    - name: Format
+      run: make --always-make fmt lint
+    - name: Format Diff
+      run: git diff --exit-code
+  build:
+    runs-on: ubuntu-latest
+    steps:
+    - uses: actions/checkout@v2
+    - name: Set up Go
+      uses: actions/setup-go@v2
+      with:
+        go-version: 1.17
+    - name: Generate
+      run: make --always-make vendor generate validate
+    - name: Generate Diff
+      run: git diff --exit-code

CHANGELOG.md

@@ -15,21 +15,59 @@ We use *breaking* word for marking changes that are not backward compatible (rel
 
 ### Breaking Changes
 
--
+### Changed
+
+- [#279](https://github.com/thanos-io/kube-thanos/pull/279) Change `hashringConfigmapName` to `hashringConfigMapName` in Receive configuration.
+- [#284](https://github.com/thanos-io/kube-thanos/pull/284) Change Receive `PodDisruptionBudget` api version to `policy/v1`
+- [#293](https://github.com/thanos-io/kube-thanos/pull/293) Upgrade to Thanos v0.30.2
+
+### Added
+
+- [#263](https://github.com/thanos-io/kube-thanos/pull/263) Add support for stateless Rulers.
+- [#271](https://github.com/thanos-io/kube-thanos/pull/271) Add annotation support for ServiceAccount.
+- [#286](https://github.com/thanos-io/kube-thanos/pull/286) Store: make the liveness probe timeout configurable.
+- [#292](https://github.com/thanos-io/kube-thanos/pull/292) Store: allow configuration of series, series sample, and downloaded bytes limits.
+- [#299](https://github.com/thanos-io/kube-thanos/pull/299) Query: allow configuration of telemetry.request options
+- [#301](https://github.com/thanos-io/kube-thanos/pull/301) Receive: allow configuration of `minReadySeconds` for StatefulSet
+- [#305](https://github.com/thanos-io/kube-thanos/pull/305) Receive: allow configuration of limits-config-file
+- [#308](https://github.com/thanos-io/kube-thanos/pull/308) Recive: add store limits flags
+- [#310](https://github.com/thanos-io/kube-thanos/pull/310) Ruler: Add host anti-affinity to ruler
+- [#313](https://github.com/thanos-io/kube-thanos/pull/313) Add per-container SecurityContext
+- [#330](https://github.com/thanos-io/kube-thanos/pull/330) Query: Add query url support to jsonnet library
+
+### Fixed
+
+- [#298](https://github.com/thanos-io/kube-thanos/pull/298) Use `kubernetes.io/os` instead of `beta.kubernetes.io/os` which has been deprecated since Kubernetes v1.14.
+
+
+## [v0.27.0](https://github.com/thanos-io/kube-thanos/tree/v0.27.0) (2022-07-07)
+- (no changes from `v0.26.0`)
+
+## [v0.26.0](https://github.com/thanos-io/kube-thanos/tree/v0.26.0) (2022-06-13)
+
+### Added
+
+- [#263](https://github.com/thanos-io/kube-thanos/pull/263) Add support for stateless Rulers.
+
+
+## [v0.24.0](https://github.com/thanos-io/kube-thanos/tree/v0.24.0) (2021-12-17)
 
 ### Changed
 
+- [#254](https://github.com/thanos-io/kube-thanos/pull/254) Add support for tenant header configuration to receiver.
 - [#247](https://github.com/thanos-io/kube-thanos/pull/247) Make Compact service headless.
 
 ### Added
 
+- [#265](https://github.com/thanos-io/kube-thanos/pull/265) Added support for multithreaded thanos compact.
 - [#237](https://github.com/thanos-io/kube-thanos/pull/237) Add new bucket replicate component.
 - [#245](https://github.com/thanos-io/kube-thanos/pull/245) Support scraping config reloader sidecar for ruler.
 - [#251](https://github.com/thanos-io/kube-thanos/pull/251) Add support for extraEnv (custom environment variables) to all components.
+- [#260](https://github.com/thanos-io/kube-thanos/pull/260) Add support custom certificate for the object store by configuring `tlsSecretName` and `tlsSecretMountPath` in `objectStorageConfig`.
+- [#261](https://github.com/thanos-io/kube-thanos/pull/261) Add support for imagePullPolicy to all components.
 
-### Fixed
+[Full Changelog](https://github.com/thanos-io/kube-thanos/compare/v0.22.0...v0.24.0)
 
--
 
 ## [v0.22.0](https://github.com/thanos-io/kube-thanos/tree/v0.22.0) (2021-08-17)
 
@@ -75,6 +113,7 @@ We use *breaking* word for marking changes that are not backward compatible (rel
 - [#213](https://github.com/thanos-io/kube-thanos/pull/213) Allow configuring `--min-time` and `--max-time` of store.
 - [#218](https://github.com/thanos-io/kube-thanos/pull/218) Enable `--query.auto-downsampling` for query by default.
 - [#221](https://github.com/thanos-io/kube-thanos/pull/221) Allow configuring `--tsdb.retention` and `--tsdb.block-duration` for rule.
+- [#225](https://github.com/thanos-io/kube-thanos/pull/225) Add support for alertmanager configuration and extra volumes for rule.
 
 [Full Changelog](https://github.com/thanos-io/kube-thanos/compare/v0.18.0...v0.19.0)
 

Makefile

@@ -9,7 +9,7 @@ MANIFESTS := manifests
 CRDSCHEMAS := .crdschemas
 TMP := tmp
 
-K8S_VERSION := 1.20.4
+K8S_VERSION := 1.27.0
 PROM_OPERATOR_VERSION := 0.46.0
 
 PIP  := pip3
@@ -42,6 +42,21 @@ lint: $(JSONNET_LINT) vendor
 vendor: | $(JB) jsonnetfile.json jsonnetfile.lock.json
 	$(JB) install
 
+.PHONY: deploy
+deploy:
+	kubectl create ns thanos
+	kubectl create ns minio
+	kubectl apply -f https://raw.githubusercontent.com/prometheus-operator/prometheus-operator/v$(PROM_OPERATOR_VERSION)/example/prometheus-operator-crd/monitoring.coreos.com_servicemonitors.yaml
+	kubectl create -f examples/development-minio/
+	kubectl create -f manifests/
+
+.PHONY: teardown
+teardown:
+	kubectl delete -f examples/development-minio/
+	kubectl delete -f manifests/
+	kubectl delete ns thanos
+	kubectl delete ns minio
+
 .PHONY: clean
 clean:
 	-rm -rf tmp/bin

README.md

@@ -23,12 +23,12 @@ This project is intended to be used as a library (i.e. the intent is not for you
 Though for a quickstart a compiled version of the Kubernetes [manifests](manifests) generated with this library (specifically with `example.jsonnet`) is checked into this repository in order to try the content out quickly. To try out the stack un-customized run:
  * Simply create the stack:
 ```shell
-$ kubectl create -f manifests/
+$ make deploy
 ```
 
  * And to teardown the stack:
 ```shell
-$ kubectl delete -f manifests/
+$ make teardown
 ```
 
 ## Customizing kube-thanos
@@ -76,8 +76,9 @@ local commonConfig = {
   config+:: {
     local cfg = self,
     namespace: 'thanos',
-    version: 'v0.22.0',
+    version: 'v0.31.0',
     image: 'quay.io/thanos/thanos:' + cfg.version,
+    imagePullPolicy: 'IfNotPresent',
     objectStorageConfig: {
       name: 'thanos-objectstorage',
       key: 'thanos.yaml',
@@ -102,6 +103,7 @@ local i = t.receiveIngestor(commonConfig.config {
   replicationFactor: 1,
   // Disable shipping to object storage for the purposes of this example
   objectStorageConfig: null,
+  serviceMonitor: true,
 });
 
 local r = t.receiveRouter(commonConfig.config {
@@ -164,10 +166,15 @@ find manifests -type f ! -name '*.yaml' -delete
 # The following script generates all components, mostly used for testing
 
 rm -rf examples/all/manifests
+rm -rf examples/development-minio
 mkdir examples/all/manifests
+mkdir examples/development-minio
 
 ${JSONNET} -J vendor -m examples/all/manifests "${1-all.jsonnet}" | xargs -I{} sh -c "cat {} | ${GOJSONTOYAML} > {}.yaml; rm -f {}" -- {}
 find examples/all/manifests -type f ! -name '*.yaml' -delete
+
+${JSONNET} -J vendor -m examples/development-minio "${1-minio.jsonnet}" | xargs -I{} sh -c "cat {} | ${GOJSONTOYAML} > {}.yaml; rm -f {}" -- {}
+find examples/development-minio -type f ! -name '*.yaml' -delete
 ```
 
 > Note you need `jsonnet` (`go get github.com/google/go-jsonnet/cmd/jsonnet`) and `gojsontoyaml` (`go get github.com/brancz/gojsontoyaml`) installed to run `build.sh`. If you just want json output, not yaml, then you can skip the pipe and everything afterwards.

all.jsonnet

@@ -6,12 +6,14 @@ local t = import 'kube-thanos/thanos.libsonnet';
 local commonConfig = {
   local cfg = self,
   namespace: 'thanos',
-  version: 'v0.22.0',
+  version: 'v0.30.2',
   image: 'quay.io/thanos/thanos:' + cfg.version,
   replicaLabels: ['prometheus_replica', 'rule_replica'],
   objectStorageConfig: {
     name: 'thanos-objectstorage',
     key: 'thanos.yaml',
+    tlsSecretName: '',
+    tlsSecretMountPath: '',
   },
   resources: {
     requests: { cpu: 0.123, memory: '123Mi' },
@@ -87,6 +89,14 @@ local ru = t.rule(commonConfig {
   replicas: 1,
   rulesConfig: [{ name: 'test', key: 'test' }],
   alertmanagersURLs: ['alertmanager:9093'],
+  alertmanagerConfigFile: {
+    name: 'thanos-ruler-config',
+    key: 'config.yaml',
+  },
+  remoteWriteConfigFile: {
+    name: 'thanos-stateless-ruler-config',
+    key: 'rw-config.yaml',
+  },
   reloaderImage: 'jimmidyson/configmap-reload:v0.5.0',
   serviceMonitor: true,
 });

build.sh

@@ -21,7 +21,12 @@ find manifests -type f ! -name '*.yaml' -delete
 # The following script generates all components, mostly used for testing
 
 rm -rf examples/all/manifests
+rm -rf examples/development-minio
 mkdir examples/all/manifests
+mkdir examples/development-minio
 
 ${JSONNET} -J vendor -m examples/all/manifests "${1-all.jsonnet}" | xargs -I{} sh -c "cat {} | ${GOJSONTOYAML} > {}.yaml; rm -f {}" -- {}
 find examples/all/manifests -type f ! -name '*.yaml' -delete
+
+${JSONNET} -J vendor -m examples/development-minio "${1-minio.jsonnet}" | xargs -I{} sh -c "cat {} | ${GOJSONTOYAML} > {}.yaml; rm -f {}" -- {}
+find examples/development-minio -type f ! -name '*.yaml' -delete

example.jsonnet

@@ -6,8 +6,9 @@ local commonConfig = {
   config+:: {
     local cfg = self,
     namespace: 'thanos',
-    version: 'v0.22.0',
+    version: 'v0.31.0',
     image: 'quay.io/thanos/thanos:' + cfg.version,
+    imagePullPolicy: 'IfNotPresent',
     objectStorageConfig: {
       name: 'thanos-objectstorage',
       key: 'thanos.yaml',
@@ -32,6 +33,7 @@ local i = t.receiveIngestor(commonConfig.config {
   replicationFactor: 1,
   // Disable shipping to object storage for the purposes of this example
   objectStorageConfig: null,
+  serviceMonitor: true,
 });
 
 local r = t.receiveRouter(commonConfig.config {

examples/all/manifests/thanos-bucket-deployment.yaml

@@ -5,7 +5,7 @@ metadata:
     app.kubernetes.io/component: object-store-bucket-debugging
     app.kubernetes.io/instance: thanos-bucket
     app.kubernetes.io/name: thanos-bucket
-    app.kubernetes.io/version: v0.22.0
+    app.kubernetes.io/version: v0.30.2
   name: thanos-bucket
   namespace: thanos
 spec:
@@ -21,7 +21,7 @@ spec:
         app.kubernetes.io/component: object-store-bucket-debugging
         app.kubernetes.io/instance: thanos-bucket
         app.kubernetes.io/name: thanos-bucket
-        app.kubernetes.io/version: v0.22.0
+        app.kubernetes.io/version: v0.30.2
     spec:
       containers:
       - args:
@@ -49,7 +49,8 @@ spec:
           valueFrom:
             fieldRef:
               fieldPath: status.hostIP
-        image: quay.io/thanos/thanos:v0.22.0
+        image: quay.io/thanos/thanos:v0.30.2
+        imagePullPolicy: IfNotPresent
         livenessProbe:
           failureThreshold: 4
           httpGet:
@@ -75,11 +76,28 @@ spec:
           requests:
             cpu: 0.123
             memory: 123Mi
+        securityContext:
+          allowPrivilegeEscalation: false
+          capabilities:
+            drop:
+            - ALL
+          readOnlyRootFilesystem: true
+          runAsGroup: 65532
+          runAsNonRoot: true
+          runAsUser: 65534
+          seccompProfile:
+            type: RuntimeDefault
         terminationMessagePolicy: FallbackToLogsOnError
+        volumeMounts: []
       nodeSelector:
         kubernetes.io/os: linux
       securityContext:
         fsGroup: 65534
+        runAsGroup: 65532
+        runAsNonRoot: true
         runAsUser: 65534
+        seccompProfile:
+          type: RuntimeDefault
       serviceAccountName: thanos-bucket
       terminationGracePeriodSeconds: 120
+      volumes: []

examples/all/manifests/thanos-bucket-replicate-deployment.yaml

@@ -5,7 +5,7 @@ metadata:
     app.kubernetes.io/component: object-store-bucket-replicate
     app.kubernetes.io/instance: thanos-bucket-replicate
     app.kubernetes.io/name: thanos-bucket-replicate
-    app.kubernetes.io/version: v0.22.0
+    app.kubernetes.io/version: v0.30.2
   name: thanos-bucket-replicate
   namespace: thanos
 spec:
@@ -21,7 +21,7 @@ spec:
         app.kubernetes.io/component: object-store-bucket-replicate
         app.kubernetes.io/instance: thanos-bucket-replicate
         app.kubernetes.io/name: thanos-bucket-replicate
-        app.kubernetes.io/version: v0.22.0
+        app.kubernetes.io/version: v0.30.2
     spec:
       containers:
       - args:
@@ -57,7 +57,8 @@ spec:
           valueFrom:
             fieldRef:
               fieldPath: status.hostIP
-        image: quay.io/thanos/thanos:v0.22.0
+        image: quay.io/thanos/thanos:v0.30.2
+        imagePullPolicy: IfNotPresent
         livenessProbe:
           failureThreshold: 4
           httpGet:
@@ -84,10 +85,16 @@ spec:
             cpu: 0.123
             memory: 123Mi
         terminationMessagePolicy: FallbackToLogsOnError
+        volumeMounts: []
       nodeSelector:
-        beta.kubernetes.io/os: linux
+        kubernetes.io/os: linux
       securityContext:
         fsGroup: 65534
+        runAsGroup: 65532
+        runAsNonRoot: true
         runAsUser: 65534
+        seccompProfile:
+          type: RuntimeDefault
       serviceAccountName: thanos-bucket-replicate
       terminationGracePeriodSeconds: 120
+      volumes: []

examples/all/manifests/thanos-bucket-replicate-service.yaml

@@ -5,7 +5,7 @@ metadata:
     app.kubernetes.io/component: object-store-bucket-replicate
     app.kubernetes.io/instance: thanos-bucket-replicate
     app.kubernetes.io/name: thanos-bucket-replicate
-    app.kubernetes.io/version: v0.22.0
+    app.kubernetes.io/version: v0.30.2
   name: thanos-bucket-replicate
   namespace: thanos
 spec:

examples/all/manifests/thanos-bucket-replicate-serviceAccount.yaml

@@ -1,10 +1,11 @@
 apiVersion: v1
 kind: ServiceAccount
 metadata:
+  annotations: {}
   labels:
     app.kubernetes.io/component: object-store-bucket-replicate
     app.kubernetes.io/instance: thanos-bucket-replicate
     app.kubernetes.io/name: thanos-bucket-replicate
-    app.kubernetes.io/version: v0.22.0
+    app.kubernetes.io/version: v0.30.2
   name: thanos-bucket-replicate
   namespace: thanos

examples/all/manifests/thanos-bucket-service.yaml

@@ -5,7 +5,7 @@ metadata:
     app.kubernetes.io/component: object-store-bucket-debugging
     app.kubernetes.io/instance: thanos-bucket
     app.kubernetes.io/name: thanos-bucket
-    app.kubernetes.io/version: v0.22.0
+    app.kubernetes.io/version: v0.30.2
   name: thanos-bucket
   namespace: thanos
 spec:

examples/all/manifests/thanos-bucket-serviceAccount.yaml

@@ -1,10 +1,11 @@
 apiVersion: v1
 kind: ServiceAccount
 metadata:
+  annotations: {}
   labels:
     app.kubernetes.io/component: object-store-bucket-debugging
     app.kubernetes.io/instance: thanos-bucket
     app.kubernetes.io/name: thanos-bucket
-    app.kubernetes.io/version: v0.22.0
+    app.kubernetes.io/version: v0.30.2
   name: thanos-bucket
   namespace: thanos

examples/all/manifests/thanos-compact-service.yaml

@@ -5,7 +5,7 @@ metadata:
     app.kubernetes.io/component: database-compactor
     app.kubernetes.io/instance: thanos-compact
     app.kubernetes.io/name: thanos-compact
-    app.kubernetes.io/version: v0.22.0
+    app.kubernetes.io/version: v0.30.2
   name: thanos-compact
   namespace: thanos
 spec:

examples/all/manifests/thanos-compact-serviceAccount.yaml

@@ -1,10 +1,11 @@
 apiVersion: v1
 kind: ServiceAccount
 metadata:
+  annotations: {}
   labels:
     app.kubernetes.io/component: database-compactor
     app.kubernetes.io/instance: thanos-compact
     app.kubernetes.io/name: thanos-compact
-    app.kubernetes.io/version: v0.22.0
+    app.kubernetes.io/version: v0.30.2
   name: thanos-compact
   namespace: thanos

examples/all/manifests/thanos-compact-serviceMonitor.yaml

@@ -5,14 +5,15 @@ metadata:
     app.kubernetes.io/component: database-compactor
     app.kubernetes.io/instance: thanos-compact
     app.kubernetes.io/name: thanos-compact
-    app.kubernetes.io/version: v0.22.0
+    app.kubernetes.io/version: v0.30.2
   name: thanos-compact
   namespace: thanos
 spec:
   endpoints:
   - port: http
     relabelings:
-    - separator: /
+    - action: replace
+      separator: /
       sourceLabels:
       - namespace
       - pod

examples/all/manifests/thanos-compact-shard0-service.yaml

@@ -5,7 +5,7 @@ metadata:
     app.kubernetes.io/component: database-compactor
     app.kubernetes.io/instance: thanos-compact-0
     app.kubernetes.io/name: thanos-compact
-    app.kubernetes.io/version: v0.22.0
+    app.kubernetes.io/version: v0.30.2
     compact.thanos.io/shard: shard-0
   name: thanos-compact-0
   namespace: thanos

examples/all/manifests/thanos-compact-shard0-statefulSet.yaml

@@ -5,7 +5,7 @@ metadata:
     app.kubernetes.io/component: database-compactor
     app.kubernetes.io/instance: thanos-compact-0
     app.kubernetes.io/name: thanos-compact
-    app.kubernetes.io/version: v0.22.0
+    app.kubernetes.io/version: v0.30.2
     compact.thanos.io/shard: shard-0
   name: thanos-compact-0
   namespace: thanos
@@ -24,7 +24,7 @@ spec:
         app.kubernetes.io/component: database-compactor
         app.kubernetes.io/instance: thanos-compact-0
         app.kubernetes.io/name: thanos-compact
-        app.kubernetes.io/version: v0.22.0
+        app.kubernetes.io/version: v0.30.2
         compact.thanos.io/shard: shard-0
     spec:
       affinity:
@@ -58,6 +58,8 @@ spec:
         - --retention.resolution-5m=0d
         - --retention.resolution-1h=0d
         - --delete-delay=48h
+        - --compact.concurrency=1
+        - --downsample.concurrency=1
         - --downsampling.disable
         - |-
           --tracing.config="config":
@@ -84,7 +86,8 @@ spec:
           valueFrom:
             fieldRef:
               fieldPath: status.hostIP
-        image: quay.io/thanos/thanos:v0.22.0
+        image: quay.io/thanos/thanos:v0.30.2
+        imagePullPolicy: IfNotPresent
         livenessProbe:
           failureThreshold: 4
           httpGet:
@@ -119,7 +122,11 @@ spec:
         kubernetes.io/os: linux
       securityContext:
         fsGroup: 65534
+        runAsGroup: 65532
+        runAsNonRoot: true
         runAsUser: 65534
+        seccompProfile:
+          type: RuntimeDefault
       serviceAccountName: thanos-compact
       terminationGracePeriodSeconds: 120
       volumes: []

examples/all/manifests/thanos-compact-shard1-service.yaml

@@ -5,7 +5,7 @@ metadata:
     app.kubernetes.io/component: database-compactor
     app.kubernetes.io/instance: thanos-compact-1
     app.kubernetes.io/name: thanos-compact
-    app.kubernetes.io/version: v0.22.0
+    app.kubernetes.io/version: v0.30.2
     compact.thanos.io/shard: shard-1
   name: thanos-compact-1
   namespace: thanos

examples/all/manifests/thanos-compact-shard1-statefulSet.yaml

@@ -5,7 +5,7 @@ metadata:
     app.kubernetes.io/component: database-compactor
     app.kubernetes.io/instance: thanos-compact-1
     app.kubernetes.io/name: thanos-compact
-    app.kubernetes.io/version: v0.22.0
+    app.kubernetes.io/version: v0.30.2
     compact.thanos.io/shard: shard-1
   name: thanos-compact-1
   namespace: thanos
@@ -24,7 +24,7 @@ spec:
         app.kubernetes.io/component: database-compactor
         app.kubernetes.io/instance: thanos-compact-1
         app.kubernetes.io/name: thanos-compact
-        app.kubernetes.io/version: v0.22.0
+        app.kubernetes.io/version: v0.30.2
         compact.thanos.io/shard: shard-1
     spec:
       affinity:
@@ -58,6 +58,8 @@ spec:
         - --retention.resolution-5m=0d
         - --retention.resolution-1h=0d
         - --delete-delay=48h
+        - --compact.concurrency=1
+        - --downsample.concurrency=1
         - --downsampling.disable
         - |-
           --tracing.config="config":
@@ -84,7 +86,8 @@ spec:
           valueFrom:
             fieldRef:
               fieldPath: status.hostIP
-        image: quay.io/thanos/thanos:v0.22.0
+        image: quay.io/thanos/thanos:v0.30.2
+        imagePullPolicy: IfNotPresent
         livenessProbe:
           failureThreshold: 4
           httpGet:
@@ -119,7 +122,11 @@ spec:
         kubernetes.io/os: linux
       securityContext:
         fsGroup: 65534
+        runAsGroup: 65532
+        runAsNonRoot: true
         runAsUser: 65534
+        seccompProfile:
+          type: RuntimeDefault
       serviceAccountName: thanos-compact
       terminationGracePeriodSeconds: 120
       volumes: []

examples/all/manifests/thanos-compact-shard2-service.yaml

@@ -5,7 +5,7 @@ metadata:
     app.kubernetes.io/component: database-compactor
     app.kubernetes.io/instance: thanos-compact-2
     app.kubernetes.io/name: thanos-compact
-    app.kubernetes.io/version: v0.22.0
+    app.kubernetes.io/version: v0.30.2
     compact.thanos.io/shard: shard-2
   name: thanos-compact-2
   namespace: thanos

examples/all/manifests/thanos-compact-shard2-statefulSet.yaml

@@ -5,7 +5,7 @@ metadata:
     app.kubernetes.io/component: database-compactor
     app.kubernetes.io/instance: thanos-compact-2
     app.kubernetes.io/name: thanos-compact
-    app.kubernetes.io/version: v0.22.0
+    app.kubernetes.io/version: v0.30.2
     compact.thanos.io/shard: shard-2
   name: thanos-compact-2
   namespace: thanos
@@ -24,7 +24,7 @@ spec:
         app.kubernetes.io/component: database-compactor
         app.kubernetes.io/instance: thanos-compact-2
         app.kubernetes.io/name: thanos-compact
-        app.kubernetes.io/version: v0.22.0
+        app.kubernetes.io/version: v0.30.2
         compact.thanos.io/shard: shard-2
     spec:
       affinity:
@@ -58,6 +58,8 @@ spec:
         - --retention.resolution-5m=0d
         - --retention.resolution-1h=0d
         - --delete-delay=48h
+        - --compact.concurrency=1
+        - --downsample.concurrency=1
         - --downsampling.disable
         - |-
           --tracing.config="config":
@@ -84,7 +86,8 @@ spec:
           valueFrom:
             fieldRef:
               fieldPath: status.hostIP
-        image: quay.io/thanos/thanos:v0.22.0
+        image: quay.io/thanos/thanos:v0.30.2
+        imagePullPolicy: IfNotPresent
         livenessProbe:
           failureThreshold: 4
           httpGet:
@@ -119,7 +122,11 @@ spec:
         kubernetes.io/os: linux
       securityContext:
         fsGroup: 65534
+        runAsGroup: 65532
+        runAsNonRoot: true
         runAsUser: 65534
+        seccompProfile:
+          type: RuntimeDefault
       serviceAccountName: thanos-compact
       terminationGracePeriodSeconds: 120
       volumes: []

examples/all/manifests/thanos-compact-shards-serviceAccount.yaml

@@ -1,10 +1,11 @@
 apiVersion: v1
 kind: ServiceAccount
 metadata:
+  annotations: {}
   labels:
     app.kubernetes.io/component: database-compactor
     app.kubernetes.io/instance: thanos-compact
     app.kubernetes.io/name: thanos-compact
-    app.kubernetes.io/version: v0.22.0
+    app.kubernetes.io/version: v0.30.2
   name: thanos-compact
   namespace: thanos

examples/all/manifests/thanos-compact-shards-serviceMonitor.yaml

@@ -5,19 +5,21 @@ metadata:
     app.kubernetes.io/component: database-compactor
     app.kubernetes.io/instance: thanos-compact
     app.kubernetes.io/name: thanos-compact
-    app.kubernetes.io/version: v0.22.0
+    app.kubernetes.io/version: v0.30.2
   name: thanos-compact
   namespace: thanos
 spec:
   endpoints:
   - port: http
     relabelings:
-    - separator: /
+    - action: replace
+      separator: /
       sourceLabels:
       - namespace
       - pod
       targetLabel: instance
-    - regex: shard\-(\d+)
+    - action: replace
+      regex: shard\-(\d+)
       replacement: $1
       sourceLabels:
       - __meta_kubernetes_service_label_compact_thanos_io_shard

examples/all/manifests/thanos-compact-statefulSet.yaml

@@ -5,7 +5,7 @@ metadata:
     app.kubernetes.io/component: database-compactor
     app.kubernetes.io/instance: thanos-compact
     app.kubernetes.io/name: thanos-compact
-    app.kubernetes.io/version: v0.22.0
+    app.kubernetes.io/version: v0.30.2
   name: thanos-compact
   namespace: thanos
 spec:
@@ -22,7 +22,7 @@ spec:
         app.kubernetes.io/component: database-compactor
         app.kubernetes.io/instance: thanos-compact
         app.kubernetes.io/name: thanos-compact
-        app.kubernetes.io/version: v0.22.0
+        app.kubernetes.io/version: v0.30.2
     spec:
       affinity:
         podAntiAffinity:
@@ -55,6 +55,8 @@ spec:
         - --retention.resolution-5m=0d
         - --retention.resolution-1h=0d
         - --delete-delay=48h
+        - --compact.concurrency=1
+        - --downsample.concurrency=1
         - --downsampling.disable
         - --deduplication.replica-label=prometheus_replica
         - --deduplication.replica-label=rule_replica
@@ -74,7 +76,8 @@ spec:
           valueFrom:
             fieldRef:
               fieldPath: status.hostIP
-        image: quay.io/thanos/thanos:v0.22.0
+        image: quay.io/thanos/thanos:v0.30.2
+        imagePullPolicy: IfNotPresent
         livenessProbe:
           failureThreshold: 4
           httpGet:
@@ -109,7 +112,11 @@ spec:
         kubernetes.io/os: linux
       securityContext:
         fsGroup: 65534
+        runAsGroup: 65532
+        runAsNonRoot: true
         runAsUser: 65534
+        seccompProfile:
+          type: RuntimeDefault
       serviceAccountName: thanos-compact
       terminationGracePeriodSeconds: 120
       volumes: []

examples/all/manifests/thanos-query-deployment.yaml

@@ -5,7 +5,7 @@ metadata:
     app.kubernetes.io/component: query-layer
     app.kubernetes.io/instance: thanos-query
     app.kubernetes.io/name: thanos-query
-    app.kubernetes.io/version: v0.22.0
+    app.kubernetes.io/version: v0.30.2
   name: thanos-query
   namespace: thanos
 spec:
@@ -21,7 +21,7 @@ spec:
         app.kubernetes.io/component: query-layer
         app.kubernetes.io/instance: thanos-query
         app.kubernetes.io/name: thanos-query
-        app.kubernetes.io/version: v0.22.0
+        app.kubernetes.io/version: v0.30.2
     spec:
       affinity:
         podAntiAffinity:
@@ -46,15 +46,15 @@ spec:
         - --log.format=logfmt
         - --query.replica-label=prometheus_replica
         - --query.replica-label=rule_replica
-        - --store=dnssrv+_grpc._tcp.thanos-receive.thanos.svc.cluster.local
-        - --store=dnssrv+_grpc._tcp.thanos-rule.thanos.svc.cluster.local
-        - --store=dnssrv+_grpc._tcp.thanos-sidecar.thanos.svc.cluster.local
-        - --store=dnssrv+_grpc._tcp.thanos-store.thanos.svc.cluster.local
-        - --store=dnssrv+_grpc._tcp.thanos-receive-default.thanos.svc.cluster.local
-        - --store=dnssrv+_grpc._tcp.thanos-receive-region-1.thanos.svc.cluster.local
-        - --store=dnssrv+_grpc._tcp.thanos-store-0.thanos.svc.cluster.local
-        - --store=dnssrv+_grpc._tcp.thanos-store-1.thanos.svc.cluster.local
-        - --store=dnssrv+_grpc._tcp.thanos-store-2.thanos.svc.cluster.local
+        - --endpoint=dnssrv+_grpc._tcp.thanos-receive.thanos.svc.cluster.local
+        - --endpoint=dnssrv+_grpc._tcp.thanos-rule.thanos.svc.cluster.local
+        - --endpoint=dnssrv+_grpc._tcp.thanos-sidecar.thanos.svc.cluster.local
+        - --endpoint=dnssrv+_grpc._tcp.thanos-store.thanos.svc.cluster.local
+        - --endpoint=dnssrv+_grpc._tcp.thanos-receive-default.thanos.svc.cluster.local
+        - --endpoint=dnssrv+_grpc._tcp.thanos-receive-region-1.thanos.svc.cluster.local
+        - --endpoint=dnssrv+_grpc._tcp.thanos-store-0.thanos.svc.cluster.local
+        - --endpoint=dnssrv+_grpc._tcp.thanos-store-1.thanos.svc.cluster.local
+        - --endpoint=dnssrv+_grpc._tcp.thanos-store-2.thanos.svc.cluster.local
         - --query.timeout=5m
         - --query.lookback-delta=15m
         - |-
@@ -69,7 +69,8 @@ spec:
           valueFrom:
             fieldRef:
               fieldPath: status.hostIP
-        image: quay.io/thanos/thanos:v0.22.0
+        image: quay.io/thanos/thanos:v0.30.2
+        imagePullPolicy: IfNotPresent
         livenessProbe:
           failureThreshold: 4
           httpGet:
@@ -91,11 +92,26 @@ spec:
             scheme: HTTP
           periodSeconds: 5
         resources: {}
+        securityContext:
+          allowPrivilegeEscalation: false
+          capabilities:
+            drop:
+            - ALL
+          readOnlyRootFilesystem: true
+          runAsGroup: 65532
+          runAsNonRoot: true
+          runAsUser: 65534
+          seccompProfile:
+            type: RuntimeDefault
         terminationMessagePolicy: FallbackToLogsOnError
       nodeSelector:
         kubernetes.io/os: linux
       securityContext:
         fsGroup: 65534
+        runAsGroup: 65532
+        runAsNonRoot: true
         runAsUser: 65534
+        seccompProfile:
+          type: RuntimeDefault
       serviceAccountName: thanos-query
       terminationGracePeriodSeconds: 120

examples/all/manifests/thanos-query-frontend-deployment.yaml

@@ -5,7 +5,7 @@ metadata:
     app.kubernetes.io/component: query-cache
     app.kubernetes.io/instance: thanos-query-frontend
     app.kubernetes.io/name: thanos-query-frontend
-    app.kubernetes.io/version: v0.22.0
+    app.kubernetes.io/version: v0.30.2
   name: thanos-query-frontend
   namespace: thanos
 spec:
@@ -21,7 +21,7 @@ spec:
         app.kubernetes.io/component: query-cache
         app.kubernetes.io/instance: thanos-query-frontend
         app.kubernetes.io/name: thanos-query-frontend
-        app.kubernetes.io/version: v0.22.0
+        app.kubernetes.io/version: v0.30.2
     spec:
       affinity:
         podAntiAffinity:
@@ -85,7 +85,8 @@ spec:
           valueFrom:
             fieldRef:
               fieldPath: status.hostIP
-        image: quay.io/thanos/thanos:v0.22.0
+        image: quay.io/thanos/thanos:v0.30.2
+        imagePullPolicy: IfNotPresent
         livenessProbe:
           failureThreshold: 4
           httpGet:
@@ -111,11 +112,26 @@ spec:
           requests:
             cpu: 0.123
             memory: 123Mi
+        securityContext:
+          allowPrivilegeEscalation: false
+          capabilities:
+            drop:
+            - ALL
+          readOnlyRootFilesystem: true
+          runAsGroup: 65532
+          runAsNonRoot: true
+          runAsUser: 65534
+          seccompProfile:
+            type: RuntimeDefault
         terminationMessagePolicy: FallbackToLogsOnError
       nodeSelector:
         kubernetes.io/os: linux
       securityContext:
         fsGroup: 65534
+        runAsGroup: 65532
+        runAsNonRoot: true
         runAsUser: 65534
+        seccompProfile:
+          type: RuntimeDefault
       serviceAccountName: thanos-query-frontend
       terminationGracePeriodSeconds: 120

examples/all/manifests/thanos-query-frontend-service.yaml

@@ -5,7 +5,7 @@ metadata:
     app.kubernetes.io/component: query-cache
     app.kubernetes.io/instance: thanos-query-frontend
     app.kubernetes.io/name: thanos-query-frontend
-    app.kubernetes.io/version: v0.22.0
+    app.kubernetes.io/version: v0.30.2
   name: thanos-query-frontend
   namespace: thanos
 spec:

examples/all/manifests/thanos-query-frontend-serviceAccount.yaml

@@ -1,10 +1,11 @@
 apiVersion: v1
 kind: ServiceAccount
 metadata:
+  annotations: {}
   labels:
     app.kubernetes.io/component: query-cache
     app.kubernetes.io/instance: thanos-query-frontend
     app.kubernetes.io/name: thanos-query-frontend
-    app.kubernetes.io/version: v0.22.0
+    app.kubernetes.io/version: v0.30.2
   name: thanos-query-frontend
   namespace: thanos

examples/all/manifests/thanos-query-frontend-serviceMonitor.yaml

@@ -5,14 +5,15 @@ metadata:
     app.kubernetes.io/component: query-cache
     app.kubernetes.io/instance: thanos-query-frontend
     app.kubernetes.io/name: thanos-query-frontend
-    app.kubernetes.io/version: v0.22.0
+    app.kubernetes.io/version: v0.30.2
   name: thanos-query-frontend
   namespace: thanos
 spec:
   endpoints:
   - port: http
     relabelings:
-    - separator: /
+    - action: replace
+      separator: /
       sourceLabels:
       - namespace
       - pod

examples/all/manifests/thanos-query-service.yaml

@@ -5,7 +5,7 @@ metadata:
     app.kubernetes.io/component: query-layer
     app.kubernetes.io/instance: thanos-query
     app.kubernetes.io/name: thanos-query
-    app.kubernetes.io/version: v0.22.0
+    app.kubernetes.io/version: v0.30.2
   name: thanos-query
   namespace: thanos
 spec:

examples/all/manifests/thanos-query-serviceAccount.yaml

@@ -1,10 +1,11 @@
 apiVersion: v1
 kind: ServiceAccount
 metadata:
+  annotations: {}
   labels:
     app.kubernetes.io/component: query-layer
     app.kubernetes.io/instance: thanos-query
     app.kubernetes.io/name: thanos-query
-    app.kubernetes.io/version: v0.22.0
+    app.kubernetes.io/version: v0.30.2
   name: thanos-query
   namespace: thanos

examples/all/manifests/thanos-query-serviceMonitor.yaml

@@ -5,14 +5,15 @@ metadata:
     app.kubernetes.io/component: query-layer
     app.kubernetes.io/instance: thanos-query
     app.kubernetes.io/name: thanos-query
-    app.kubernetes.io/version: v0.22.0
+    app.kubernetes.io/version: v0.30.2
   name: thanos-query
   namespace: thanos
 spec:
   endpoints:
   - port: http
     relabelings:
-    - separator: /
+    - action: replace
+      separator: /
       sourceLabels:
       - namespace
       - pod

examples/all/manifests/thanos-receive-default-podDisruptionBudget.yaml

@@ -1,4 +1,4 @@
-apiVersion: policy/v1beta1
+apiVersion: policy/v1
 kind: PodDisruptionBudget
 metadata:
   name: thanos-receive-default

examples/all/manifests/thanos-receive-default-service.yaml

@@ -5,7 +5,7 @@ metadata:
     app.kubernetes.io/component: database-write-hashring
     app.kubernetes.io/instance: thanos-receive-default
     app.kubernetes.io/name: thanos-receive
-    app.kubernetes.io/version: v0.22.0
+    app.kubernetes.io/version: v0.30.2
     controller.receive.thanos.io/hashring: default
   name: thanos-receive-default
   namespace: thanos

examples/all/manifests/thanos-receive-default-statefulSet.yaml

@@ -5,12 +5,13 @@ metadata:
     app.kubernetes.io/component: database-write-hashring
     app.kubernetes.io/instance: thanos-receive-default
     app.kubernetes.io/name: thanos-receive
-    app.kubernetes.io/version: v0.22.0
+    app.kubernetes.io/version: v0.30.2
     controller.receive.thanos.io: thanos-receive-controller
     controller.receive.thanos.io/hashring: default
   name: thanos-receive-default
   namespace: thanos
 spec:
+  minReadySeconds: 0
   replicas: 3
   selector:
     matchLabels:
@@ -25,7 +26,7 @@ spec:
         app.kubernetes.io/component: database-write-hashring
         app.kubernetes.io/instance: thanos-receive-default
         app.kubernetes.io/name: thanos-receive
-        app.kubernetes.io/version: v0.22.0
+        app.kubernetes.io/version: v0.30.2
         controller.receive.thanos.io/hashring: default
     spec:
       affinity:
@@ -101,7 +102,8 @@ spec:
             secretKeyRef:
               key: thanos.yaml
               name: thanos-objectstorage
-        image: quay.io/thanos/thanos:v0.22.0
+        image: quay.io/thanos/thanos:v0.30.2
+        imagePullPolicy: IfNotPresent
         livenessProbe:
           failureThreshold: 8
           httpGet:
@@ -142,7 +144,11 @@ spec:
         kubernetes.io/os: linux
       securityContext:
         fsGroup: 65534
+        runAsGroup: 65532
+        runAsNonRoot: true
         runAsUser: 65534
+        seccompProfile:
+          type: RuntimeDefault
       serviceAccountName: thanos-receive
       terminationGracePeriodSeconds: 900
       volumes:

examples/all/manifests/thanos-receive-hashrings-serviceAccount.yaml

@@ -1,10 +1,11 @@
 apiVersion: v1
 kind: ServiceAccount
 metadata:
+  annotations: {}
   labels:
     app.kubernetes.io/component: database-write-hashring
     app.kubernetes.io/instance: thanos-receive
     app.kubernetes.io/name: thanos-receive
-    app.kubernetes.io/version: v0.22.0
+    app.kubernetes.io/version: v0.30.2
   name: thanos-receive
   namespace: thanos

examples/all/manifests/thanos-receive-hashrings-serviceMonitor.yaml

@@ -5,19 +5,21 @@ metadata:
     app.kubernetes.io/component: database-write-hashring
     app.kubernetes.io/instance: thanos-receive
     app.kubernetes.io/name: thanos-receive
-    app.kubernetes.io/version: v0.22.0
+    app.kubernetes.io/version: v0.30.2
   name: thanos-receive
   namespace: thanos
 spec:
   endpoints:
   - port: http
     relabelings:
-    - separator: /
+    - action: replace
+      separator: /
       sourceLabels:
       - namespace
       - pod
       targetLabel: instance
-    - sourceLabels:
+    - action: replace
+      sourceLabels:
       - __meta_kubernetes_service_label_controller_receive_thanos_io_shard
       targetLabel: hashring
   selector:

examples/all/manifests/thanos-receive-region-1-podDisruptionBudget.yaml

@@ -1,4 +1,4 @@
-apiVersion: policy/v1beta1
+apiVersion: policy/v1
 kind: PodDisruptionBudget
 metadata:
   name: thanos-receive-region-1

examples/all/manifests/thanos-receive-region-1-service.yaml

@@ -5,7 +5,7 @@ metadata:
     app.kubernetes.io/component: database-write-hashring
     app.kubernetes.io/instance: thanos-receive-region-1
     app.kubernetes.io/name: thanos-receive
-    app.kubernetes.io/version: v0.22.0
+    app.kubernetes.io/version: v0.30.2
     controller.receive.thanos.io/hashring: region-1
   name: thanos-receive-region-1
   namespace: thanos

examples/all/manifests/thanos-receive-region-1-statefulSet.yaml

@@ -5,12 +5,13 @@ metadata:
     app.kubernetes.io/component: database-write-hashring
     app.kubernetes.io/instance: thanos-receive-region-1
     app.kubernetes.io/name: thanos-receive
-    app.kubernetes.io/version: v0.22.0
+    app.kubernetes.io/version: v0.30.2
     controller.receive.thanos.io: thanos-receive-controller
     controller.receive.thanos.io/hashring: region-1
   name: thanos-receive-region-1
   namespace: thanos
 spec:
+  minReadySeconds: 0
   replicas: 3
   selector:
     matchLabels:
@@ -25,7 +26,7 @@ spec:
         app.kubernetes.io/component: database-write-hashring
         app.kubernetes.io/instance: thanos-receive-region-1
         app.kubernetes.io/name: thanos-receive
-        app.kubernetes.io/version: v0.22.0
+        app.kubernetes.io/version: v0.30.2
         controller.receive.thanos.io/hashring: region-1
     spec:
       affinity:
@@ -101,7 +102,8 @@ spec:
             secretKeyRef:
               key: thanos.yaml
               name: thanos-objectstorage
-        image: quay.io/thanos/thanos:v0.22.0
+        image: quay.io/thanos/thanos:v0.30.2
+        imagePullPolicy: IfNotPresent
         livenessProbe:
           failureThreshold: 8
           httpGet:
@@ -142,7 +144,11 @@ spec:
         kubernetes.io/os: linux
       securityContext:
         fsGroup: 65534
+        runAsGroup: 65532
+        runAsNonRoot: true
         runAsUser: 65534
+        seccompProfile:
+          type: RuntimeDefault
       serviceAccountName: thanos-receive
       terminationGracePeriodSeconds: 900
       volumes:

examples/all/manifests/thanos-receive-service.yaml

@@ -5,7 +5,7 @@ metadata:
     app.kubernetes.io/component: database-write-hashring
     app.kubernetes.io/instance: thanos-receive
     app.kubernetes.io/name: thanos-receive
-    app.kubernetes.io/version: v0.22.0
+    app.kubernetes.io/version: v0.30.2
   name: thanos-receive
   namespace: thanos
 spec:

examples/all/manifests/thanos-receive-serviceAccount.yaml

@@ -1,10 +1,11 @@
 apiVersion: v1
 kind: ServiceAccount
 metadata:
+  annotations: {}
   labels:
     app.kubernetes.io/component: database-write-hashring
     app.kubernetes.io/instance: thanos-receive
     app.kubernetes.io/name: thanos-receive
-    app.kubernetes.io/version: v0.22.0
+    app.kubernetes.io/version: v0.30.2
   name: thanos-receive
   namespace: thanos

examples/all/manifests/thanos-receive-serviceMonitor.yaml

@@ -5,14 +5,15 @@ metadata:
     app.kubernetes.io/component: database-write-hashring
     app.kubernetes.io/instance: thanos-receive
     app.kubernetes.io/name: thanos-receive
-    app.kubernetes.io/version: v0.22.0
+    app.kubernetes.io/version: v0.30.2
   name: thanos-receive
   namespace: thanos
 spec:
   endpoints:
   - port: http
     relabelings:
-    - separator: /
+    - action: replace
+      separator: /
       sourceLabels:
       - namespace
       - pod

examples/all/manifests/thanos-receive-statefulSet.yaml

@@ -5,10 +5,11 @@ metadata:
     app.kubernetes.io/component: database-write-hashring
     app.kubernetes.io/instance: thanos-receive
     app.kubernetes.io/name: thanos-receive
-    app.kubernetes.io/version: v0.22.0
+    app.kubernetes.io/version: v0.30.2
   name: thanos-receive
   namespace: thanos
 spec:
+  minReadySeconds: 0
   replicas: 1
   selector:
     matchLabels:
@@ -22,7 +23,7 @@ spec:
         app.kubernetes.io/component: database-write-hashring
         app.kubernetes.io/instance: thanos-receive
         app.kubernetes.io/name: thanos-receive
-        app.kubernetes.io/version: v0.22.0
+        app.kubernetes.io/version: v0.30.2
     spec:
       affinity:
         podAntiAffinity:
@@ -97,7 +98,8 @@ spec:
             secretKeyRef:
               key: thanos.yaml
               name: thanos-objectstorage
-        image: quay.io/thanos/thanos:v0.22.0
+        image: quay.io/thanos/thanos:v0.30.2
+        imagePullPolicy: IfNotPresent
         livenessProbe:
           failureThreshold: 8
           httpGet:
@@ -138,7 +140,11 @@ spec:
         kubernetes.io/os: linux
       securityContext:
         fsGroup: 65534
+        runAsGroup: 65532
+        runAsNonRoot: true
         runAsUser: 65534
+        seccompProfile:
+          type: RuntimeDefault
       serviceAccountName: thanos-receive
       terminationGracePeriodSeconds: 900
       volumes:

examples/all/manifests/thanos-rule-service.yaml

@@ -5,7 +5,7 @@ metadata:
     app.kubernetes.io/component: rule-evaluation-engine
     app.kubernetes.io/instance: thanos-rule
     app.kubernetes.io/name: thanos-rule
-    app.kubernetes.io/version: v0.22.0
+    app.kubernetes.io/version: v0.30.2
   name: thanos-rule
   namespace: thanos
 spec:

examples/all/manifests/thanos-rule-serviceAccount.yaml

@@ -1,10 +1,11 @@
 apiVersion: v1
 kind: ServiceAccount
 metadata:
+  annotations: {}
   labels:
     app.kubernetes.io/component: rule-evaluation-engine
     app.kubernetes.io/instance: thanos-rule
     app.kubernetes.io/name: thanos-rule
-    app.kubernetes.io/version: v0.22.0
+    app.kubernetes.io/version: v0.30.2
   name: thanos-rule
   namespace: thanos

examples/all/manifests/thanos-rule-serviceMonitor.yaml

@@ -5,14 +5,15 @@ metadata:
     app.kubernetes.io/component: rule-evaluation-engine
     app.kubernetes.io/instance: thanos-rule
     app.kubernetes.io/name: thanos-rule
-    app.kubernetes.io/version: v0.22.0
+    app.kubernetes.io/version: v0.30.2
   name: thanos-rule
   namespace: thanos
 spec:
   endpoints:
   - port: http
     relabelings:
-    - separator: /
+    - action: replace
+      separator: /
       sourceLabels:
       - namespace
       - pod

examples/all/manifests/thanos-rule-statefulSet.yaml

@@ -5,7 +5,7 @@ metadata:
     app.kubernetes.io/component: rule-evaluation-engine
     app.kubernetes.io/instance: thanos-rule
     app.kubernetes.io/name: thanos-rule
-    app.kubernetes.io/version: v0.22.0
+    app.kubernetes.io/version: v0.30.2
   name: thanos-rule
   namespace: thanos
 spec:
@@ -22,8 +22,26 @@ spec:
         app.kubernetes.io/component: rule-evaluation-engine
         app.kubernetes.io/instance: thanos-rule
         app.kubernetes.io/name: thanos-rule
-        app.kubernetes.io/version: v0.22.0
+        app.kubernetes.io/version: v0.30.2
     spec:
+      affinity:
+        podAntiAffinity:
+          preferredDuringSchedulingIgnoredDuringExecution:
+          - podAffinityTerm:
+              labelSelector:
+                matchExpressions:
+                - key: app.kubernetes.io/name
+                  operator: In
+                  values:
+                  - thanos-rule
+                - key: app.kubernetes.io/instance
+                  operator: In
+                  values:
+                  - thanos-rule
+              namespaces:
+              - thanos
+              topologyKey: kubernetes.io/hostname
+            weight: 100
       containers:
       - args:
         - rule
@@ -39,6 +57,7 @@ spec:
         - --tsdb.block-duration=2h
         - --query=dnssrv+_http._tcp.thanos-query.thanos.svc.cluster.local
         - --alertmanagers.url=alertmanager:9093
+        - --alertmanagers.config-file=/etc/thanos/config/thanos-ruler-config/config.yaml
         - --rule-file=/etc/thanos/rules/test/test
         - |-
           --tracing.config="config":
@@ -46,6 +65,7 @@ spec:
             "sampler_type": "ratelimiting"
             "service_name": "thanos-rule"
           "type": "JAEGER"
+        - --remote-write.config-file=/etc/thanos/config/thanos-stateless-ruler-config/rw-config.yaml
         env:
         - name: NAME
           valueFrom:
@@ -60,7 +80,8 @@ spec:
           valueFrom:
             fieldRef:
               fieldPath: status.hostIP
-        image: quay.io/thanos/thanos:v0.22.0
+        image: quay.io/thanos/thanos:v0.30.2
+        imagePullPolicy: IfNotPresent
         livenessProbe:
           failureThreshold: 24
           httpGet:
@@ -91,6 +112,17 @@ spec:
           requests:
             cpu: 0.123
             memory: 123Mi
+        securityContext:
+          allowPrivilegeEscalation: false
+          capabilities:
+            drop:
+            - ALL
+          readOnlyRootFilesystem: true
+          runAsGroup: 65532
+          runAsNonRoot: true
+          runAsUser: 65534
+          seccompProfile:
+            type: RuntimeDefault
         terminationMessagePolicy: FallbackToLogsOnError
         volumeMounts:
         - mountPath: /var/thanos/rule
@@ -98,24 +130,47 @@ spec:
           readOnly: false
         - mountPath: /etc/thanos/rules/test
           name: test
+        - mountPath: /etc/thanos/config/thanos-ruler-config
+          name: thanos-ruler-config
+          readOnly: true
+        - mountPath: /etc/thanos/config/thanos-stateless-ruler-config
+          name: thanos-stateless-ruler-config
+          readOnly: true
       - args:
         - -webhook-url=http://localhost:10902/-/reload
         - -volume-dir=/etc/thanos/rules/test
+        - -volume-dir=/etc/thanos/config/thanos-ruler-config
+        - -volume-dir=/etc/thanos/config/thanos-stateless-ruler-config
         image: jimmidyson/configmap-reload:v0.5.0
+        imagePullPolicy: IfNotPresent
         name: configmap-reloader
         volumeMounts:
         - mountPath: /etc/thanos/rules/test
           name: test
+        - mountPath: /etc/thanos/config/thanos-ruler-config
+          name: thanos-ruler-config
+        - mountPath: /etc/thanos/config/thanos-stateless-ruler-config
+          name: thanos-stateless-ruler-config
       nodeSelector:
         kubernetes.io/os: linux
       securityContext:
         fsGroup: 65534
+        runAsGroup: 65532
+        runAsNonRoot: true
         runAsUser: 65534
+        seccompProfile:
+          type: RuntimeDefault
       serviceAccountName: thanos-rule
       volumes:
       - configMap:
           name: test
         name: test
+      - configMap:
+          name: thanos-ruler-config
+        name: thanos-ruler-config
+      - configMap:
+          name: thanos-stateless-ruler-config
+        name: thanos-stateless-ruler-config
   volumeClaimTemplates:
   - metadata:
       labels:

examples/all/manifests/thanos-sidecar-service.yaml

@@ -5,7 +5,7 @@ metadata:
     app.kubernetes.io/component: prometheus-sidecar
     app.kubernetes.io/instance: thanos-sidecar
     app.kubernetes.io/name: thanos-sidecar
-    app.kubernetes.io/version: v0.22.0
+    app.kubernetes.io/version: v0.30.2
   name: thanos-sidecar
   namespace: thanos
 spec:

examples/all/manifests/thanos-sidecar-serviceMonitor.yaml

@@ -5,14 +5,15 @@ metadata:
     app.kubernetes.io/component: prometheus-sidecar
     app.kubernetes.io/instance: thanos-sidecar
     app.kubernetes.io/name: thanos-sidecar
-    app.kubernetes.io/version: v0.22.0
+    app.kubernetes.io/version: v0.30.2
   name: thanos-sidecar
   namespace: thanos
 spec:
   endpoints:
   - port: http
     relabelings:
-    - separator: /
+    - action: replace
+      separator: /
       sourceLabels:
       - namespace
       - pod

examples/all/manifests/thanos-store-service.yaml

@@ -5,7 +5,7 @@ metadata:
     app.kubernetes.io/component: object-store-gateway
     app.kubernetes.io/instance: thanos-store
     app.kubernetes.io/name: thanos-store
-    app.kubernetes.io/version: v0.22.0
+    app.kubernetes.io/version: v0.30.2
   name: thanos-store
   namespace: thanos
 spec:

examples/all/manifests/thanos-store-serviceAccount.yaml

@@ -1,10 +1,11 @@
 apiVersion: v1
 kind: ServiceAccount
 metadata:
+  annotations: {}
   labels:
     app.kubernetes.io/component: object-store-gateway
     app.kubernetes.io/instance: thanos-store
     app.kubernetes.io/name: thanos-store
-    app.kubernetes.io/version: v0.22.0
+    app.kubernetes.io/version: v0.30.2
   name: thanos-store
   namespace: thanos

examples/all/manifests/thanos-store-serviceMonitor.yaml

@@ -5,14 +5,15 @@ metadata:
     app.kubernetes.io/component: object-store-gateway
     app.kubernetes.io/instance: thanos-store
     app.kubernetes.io/name: thanos-store
-    app.kubernetes.io/version: v0.22.0
+    app.kubernetes.io/version: v0.30.2
   name: thanos-store
   namespace: thanos
 spec:
   endpoints:
   - port: http
     relabelings:
-    - separator: /
+    - action: replace
+      separator: /
       sourceLabels:
       - namespace
       - pod

examples/all/manifests/thanos-store-shard0-service.yaml

@@ -5,7 +5,7 @@ metadata:
     app.kubernetes.io/component: object-store-gateway
     app.kubernetes.io/instance: thanos-store-0
     app.kubernetes.io/name: thanos-store
-    app.kubernetes.io/version: v0.22.0
+    app.kubernetes.io/version: v0.30.2
     store.thanos.io/shard: shard-0
   name: thanos-store-0
   namespace: thanos

examples/all/manifests/thanos-store-shard0-statefulSet.yaml

@@ -5,7 +5,7 @@ metadata:
     app.kubernetes.io/component: object-store-gateway
     app.kubernetes.io/instance: thanos-store-0
     app.kubernetes.io/name: thanos-store
-    app.kubernetes.io/version: v0.22.0
+    app.kubernetes.io/version: v0.30.2
     store.thanos.io/shard: shard-0
   name: thanos-store-0
   namespace: thanos
@@ -24,7 +24,7 @@ spec:
         app.kubernetes.io/component: object-store-gateway
         app.kubernetes.io/instance: thanos-store-0
         app.kubernetes.io/name: thanos-store
-        app.kubernetes.io/version: v0.22.0
+        app.kubernetes.io/version: v0.30.2
         store.thanos.io/shard: shard-0
     spec:
       affinity:
@@ -115,7 +115,8 @@ spec:
           valueFrom:
             fieldRef:
               fieldPath: status.hostIP
-        image: quay.io/thanos/thanos:v0.22.0
+        image: quay.io/thanos/thanos:v0.30.2
+        imagePullPolicy: IfNotPresent
         livenessProbe:
           failureThreshold: 8
           httpGet:
@@ -123,6 +124,7 @@ spec:
             port: 10902
             scheme: HTTP
           periodSeconds: 30
+          timeoutSeconds: 1
         name: thanos-store
         ports:
         - containerPort: 10901
@@ -143,6 +145,17 @@ spec:
           requests:
             cpu: 0.123
             memory: 123Mi
+        securityContext:
+          allowPrivilegeEscalation: false
+          capabilities:
+            drop:
+            - ALL
+          readOnlyRootFilesystem: true
+          runAsGroup: 65532
+          runAsNonRoot: true
+          runAsUser: 65534
+          seccompProfile:
+            type: RuntimeDefault
         terminationMessagePolicy: FallbackToLogsOnError
         volumeMounts:
         - mountPath: /var/thanos/store
@@ -152,7 +165,11 @@ spec:
         kubernetes.io/os: linux
       securityContext:
         fsGroup: 65534
+        runAsGroup: 65532
+        runAsNonRoot: true
         runAsUser: 65534
+        seccompProfile:
+          type: RuntimeDefault
       serviceAccountName: thanos-store
       terminationGracePeriodSeconds: 120
       volumes: []

examples/all/manifests/thanos-store-shard1-service.yaml

@@ -5,7 +5,7 @@ metadata:
     app.kubernetes.io/component: object-store-gateway
     app.kubernetes.io/instance: thanos-store-1
     app.kubernetes.io/name: thanos-store
-    app.kubernetes.io/version: v0.22.0
+    app.kubernetes.io/version: v0.30.2
     store.thanos.io/shard: shard-1
   name: thanos-store-1
   namespace: thanos

examples/all/manifests/thanos-store-shard1-statefulSet.yaml

@@ -5,7 +5,7 @@ metadata:
     app.kubernetes.io/component: object-store-gateway
     app.kubernetes.io/instance: thanos-store-1
     app.kubernetes.io/name: thanos-store
-    app.kubernetes.io/version: v0.22.0
+    app.kubernetes.io/version: v0.30.2
     store.thanos.io/shard: shard-1
   name: thanos-store-1
   namespace: thanos
@@ -24,7 +24,7 @@ spec:
         app.kubernetes.io/component: object-store-gateway
         app.kubernetes.io/instance: thanos-store-1
         app.kubernetes.io/name: thanos-store
-        app.kubernetes.io/version: v0.22.0
+        app.kubernetes.io/version: v0.30.2
         store.thanos.io/shard: shard-1
     spec:
       affinity:
@@ -115,7 +115,8 @@ spec:
           valueFrom:
             fieldRef:
               fieldPath: status.hostIP
-        image: quay.io/thanos/thanos:v0.22.0
+        image: quay.io/thanos/thanos:v0.30.2
+        imagePullPolicy: IfNotPresent
         livenessProbe:
           failureThreshold: 8
           httpGet:
@@ -123,6 +124,7 @@ spec:
             port: 10902
             scheme: HTTP
           periodSeconds: 30
+          timeoutSeconds: 1
         name: thanos-store
         ports:
         - containerPort: 10901
@@ -143,6 +145,17 @@ spec:
           requests:
             cpu: 0.123
             memory: 123Mi
+        securityContext:
+          allowPrivilegeEscalation: false
+          capabilities:
+            drop:
+            - ALL
+          readOnlyRootFilesystem: true
+          runAsGroup: 65532
+          runAsNonRoot: true
+          runAsUser: 65534
+          seccompProfile:
+            type: RuntimeDefault
         terminationMessagePolicy: FallbackToLogsOnError
         volumeMounts:
         - mountPath: /var/thanos/store
@@ -152,7 +165,11 @@ spec:
         kubernetes.io/os: linux
       securityContext:
         fsGroup: 65534
+        runAsGroup: 65532
+        runAsNonRoot: true
         runAsUser: 65534
+        seccompProfile:
+          type: RuntimeDefault
       serviceAccountName: thanos-store
       terminationGracePeriodSeconds: 120
       volumes: []

examples/all/manifests/thanos-store-shard2-service.yaml

@@ -5,7 +5,7 @@ metadata:
     app.kubernetes.io/component: object-store-gateway
     app.kubernetes.io/instance: thanos-store-2
     app.kubernetes.io/name: thanos-store
-    app.kubernetes.io/version: v0.22.0
+    app.kubernetes.io/version: v0.30.2
     store.thanos.io/shard: shard-2
   name: thanos-store-2
   namespace: thanos

examples/all/manifests/thanos-store-shard2-statefulSet.yaml

@@ -5,7 +5,7 @@ metadata:
     app.kubernetes.io/component: object-store-gateway
     app.kubernetes.io/instance: thanos-store-2
     app.kubernetes.io/name: thanos-store
-    app.kubernetes.io/version: v0.22.0
+    app.kubernetes.io/version: v0.30.2
     store.thanos.io/shard: shard-2
   name: thanos-store-2
   namespace: thanos
@@ -24,7 +24,7 @@ spec:
         app.kubernetes.io/component: object-store-gateway
         app.kubernetes.io/instance: thanos-store-2
         app.kubernetes.io/name: thanos-store
-        app.kubernetes.io/version: v0.22.0
+        app.kubernetes.io/version: v0.30.2
         store.thanos.io/shard: shard-2
     spec:
       affinity:
@@ -115,7 +115,8 @@ spec:
           valueFrom:
             fieldRef:
               fieldPath: status.hostIP
-        image: quay.io/thanos/thanos:v0.22.0
+        image: quay.io/thanos/thanos:v0.30.2
+        imagePullPolicy: IfNotPresent
         livenessProbe:
           failureThreshold: 8
           httpGet:
@@ -123,6 +124,7 @@ spec:
             port: 10902
             scheme: HTTP
           periodSeconds: 30
+          timeoutSeconds: 1
         name: thanos-store
         ports:
         - containerPort: 10901
@@ -143,6 +145,17 @@ spec:
           requests:
             cpu: 0.123
             memory: 123Mi
+        securityContext:
+          allowPrivilegeEscalation: false
+          capabilities:
+            drop:
+            - ALL
+          readOnlyRootFilesystem: true
+          runAsGroup: 65532
+          runAsNonRoot: true
+          runAsUser: 65534
+          seccompProfile:
+            type: RuntimeDefault
         terminationMessagePolicy: FallbackToLogsOnError
         volumeMounts:
         - mountPath: /var/thanos/store
@@ -152,7 +165,11 @@ spec:
         kubernetes.io/os: linux
       securityContext:
         fsGroup: 65534
+        runAsGroup: 65532
+        runAsNonRoot: true
         runAsUser: 65534
+        seccompProfile:
+          type: RuntimeDefault
       serviceAccountName: thanos-store
       terminationGracePeriodSeconds: 120
       volumes: []

examples/all/manifests/thanos-store-shards-serviceAccount.yaml

@@ -1,10 +1,11 @@
 apiVersion: v1
 kind: ServiceAccount
 metadata:
+  annotations: {}
   labels:
     app.kubernetes.io/component: object-store-gateway
     app.kubernetes.io/instance: thanos-store
     app.kubernetes.io/name: thanos-store
-    app.kubernetes.io/version: v0.22.0
+    app.kubernetes.io/version: v0.30.2
   name: thanos-store
   namespace: thanos

examples/all/manifests/thanos-store-shards-serviceMonitor.yaml

@@ -5,19 +5,21 @@ metadata:
     app.kubernetes.io/component: object-store-gateway
     app.kubernetes.io/instance: thanos-store
     app.kubernetes.io/name: thanos-store
-    app.kubernetes.io/version: v0.22.0
+    app.kubernetes.io/version: v0.30.2
   name: thanos-store
   namespace: thanos
 spec:
   endpoints:
   - port: http
     relabelings:
-    - separator: /
+    - action: replace
+      separator: /
       sourceLabels:
       - namespace
       - pod
       targetLabel: instance
-    - regex: shard\-(\d+)
+    - action: replace
+      regex: shard\-(\d+)
       replacement: $1
       sourceLabels:
       - __meta_kubernetes_service_label_store_thanos_io_shard

examples/all/manifests/thanos-store-statefulSet.yaml

@@ -5,7 +5,7 @@ metadata:
     app.kubernetes.io/component: object-store-gateway
     app.kubernetes.io/instance: thanos-store
     app.kubernetes.io/name: thanos-store
-    app.kubernetes.io/version: v0.22.0
+    app.kubernetes.io/version: v0.30.2
   name: thanos-store
   namespace: thanos
 spec:
@@ -22,7 +22,7 @@ spec:
         app.kubernetes.io/component: object-store-gateway
         app.kubernetes.io/instance: thanos-store
         app.kubernetes.io/name: thanos-store
-        app.kubernetes.io/version: v0.22.0
+        app.kubernetes.io/version: v0.30.2
     spec:
       affinity:
         podAntiAffinity:
@@ -103,7 +103,8 @@ spec:
           valueFrom:
             fieldRef:
               fieldPath: status.hostIP
-        image: quay.io/thanos/thanos:v0.22.0
+        image: quay.io/thanos/thanos:v0.30.2
+        imagePullPolicy: IfNotPresent
         livenessProbe:
           failureThreshold: 8
           httpGet:
@@ -111,6 +112,7 @@ spec:
             port: 10902
             scheme: HTTP
           periodSeconds: 30
+          timeoutSeconds: 1
         name: thanos-store
         ports:
         - containerPort: 10901
@@ -131,6 +133,17 @@ spec:
           requests:
             cpu: 0.123
             memory: 123Mi
+        securityContext:
+          allowPrivilegeEscalation: false
+          capabilities:
+            drop:
+            - ALL
+          readOnlyRootFilesystem: true
+          runAsGroup: 65532
+          runAsNonRoot: true
+          runAsUser: 65534
+          seccompProfile:
+            type: RuntimeDefault
         terminationMessagePolicy: FallbackToLogsOnError
         volumeMounts:
         - mountPath: /var/thanos/store
@@ -140,7 +153,11 @@ spec:
         kubernetes.io/os: linux
       securityContext:
         fsGroup: 65534
+        runAsGroup: 65532
+        runAsNonRoot: true
         runAsUser: 65534
+        seccompProfile:
+          type: RuntimeDefault
       serviceAccountName: thanos-store
       terminationGracePeriodSeconds: 120
       volumes: []

examples/development-minio/minio-deployment.yaml

@@ -2,6 +2,7 @@ apiVersion: apps/v1
 kind: Deployment
 metadata:
   name: minio
+  namespace: thanos
 spec:
   selector:
     matchLabels:
@@ -14,22 +15,25 @@ spec:
         app.kubernetes.io/name: minio
     spec:
       containers:
-      - name: minio
-        image: minio/minio
-        command:
+      - command:
         - /bin/sh
         - -c
-        - "mkdir -p /storage/thanos && /usr/bin/minio server /storage"
+        - |
+          mkdir -p /storage/thanos && \
+          /usr/bin/docker-entrypoint.sh minio server /storage
         env:
-        - name: MINIO_ACCESS_KEY
-          value: "minio"
-        - name: MINIO_SECRET_KEY
-          value: "minio123"
+        - name: MINIO_ROOT_USER
+          value: minio
+        - name: MINIO_ROOT_PASSWORD
+          value: minio123
+        image: minio/minio:RELEASE.2023-05-27T05-56-19Z
+        imagePullPolicy: IfNotPresent
+        name: minio
         ports:
         - containerPort: 9000
         volumeMounts:
-        - name: storage
-          mountPath: "/storage"
+        - mountPath: /storage
+          name: storage
       volumes:
       - name: storage
         persistentVolumeClaim:

examples/development-minio/minio-pvc.yaml

@@ -1,12 +1,13 @@
 apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
-  name: minio
   labels:
     app.kubernetes.io/name: minio
+  name: minio
+  namespace: thanos
 spec:
   accessModes:
-    - ReadWriteOnce
+  - ReadWriteOnce
   resources:
     requests:
-      storage: 10Gi
+      storage: 5Gi

examples/development-minio/minio-secret-thanos.yaml

@@ -2,13 +2,14 @@ apiVersion: v1
 kind: Secret
 metadata:
   name: thanos-objectstorage
-type: Opaque
+  namespace: thanos
 stringData:
-  thanos.yaml: |-
+  thanos.yaml: |
     type: s3
     config:
       bucket: thanos
-      endpoint: minio:9000
+      endpoint: minio.thanos.svc.cluster.local:9000
       insecure: true
       access_key: minio
       secret_key: minio123
+type: Opaque

examples/development-minio/minio-service.yaml

@@ -2,11 +2,12 @@ apiVersion: v1
 kind: Service
 metadata:
   name: minio
+  namespace: thanos
 spec:
-  type: ClusterIP
   ports:
-    - port: 9000
-      targetPort: 9000
-      protocol: TCP
+  - port: 9000
+    protocol: TCP
+    targetPort: 9000
   selector:
     app.kubernetes.io/name: minio
+  type: ClusterIP

examples/thanos-receive.jsonnet

@@ -4,7 +4,7 @@ receive({
   local tr = self,
   name:: 'thanos-receive',
   namespace:: 'observability',
-  version:: 'v0.22.0',
+  version:: 'v0.24.0',
   image:: 'quay.io/thanos/thanos:v' + tr.version,
   replicas:: 3,
   replicationFactor:: 3,

jsonnet/kube-thanos/kube-thanos-bucket-replicate.libsonnet

@@ -7,6 +7,7 @@ local defaults = {
   namespace: error 'must provide namespace',
   version: error 'must provide version',
   image: error 'must provide image',
+  imagePullPolicy: 'IfNotPresent',
   objectStorageConfig: error 'must provide objectStorageConfig',
   objectStorageToConfig: error 'must provide objectStorageToConfig',  // Destination object store configuration.
   resources: {},
@@ -38,7 +39,21 @@ local defaults = {
   securityContext:: {
     fsGroup: 65534,
     runAsUser: 65534,
+    runAsGroup: 65532,
+    runAsNonRoot: true,
+    seccompProfile: { type: 'RuntimeDefault' },
   },
+  securityContextContainer:: {
+    runAsUser: defaults.securityContext.runAsUser,
+    runAsGroup: defaults.securityContext.runAsGroup,
+    runAsNonRoot: defaults.securityContext.runAsNonRoot,
+    seccompProfile: defaults.securityContext.seccompProfile,
+    allowPrivilegeEscalation: false,
+    readOnlyRootFilesystem: true,
+    capabilities: { drop: ['ALL'] },
+  },
+
+  serviceAccountAnnotations:: {},
 };
 
 function(params) {
@@ -81,6 +96,7 @@ function(params) {
       name: tbr.config.name,
       namespace: tbr.config.namespace,
       labels: tbr.config.commonLabels,
+      annotations: tbr.config.serviceAccountAnnotations,
     },
   },
 
@@ -88,6 +104,7 @@ function(params) {
     local container = {
       name: 'thanos-bucket-replicate',
       image: tbr.config.image,
+      imagePullPolicy: tbr.config.imagePullPolicy,
       args: [
         'tools',
         'bucket',
@@ -158,6 +175,9 @@ function(params) {
       } },
       resources: if tbr.config.resources != {} then tbr.config.resources else {},
       terminationMessagePolicy: 'FallbackToLogsOnError',
+      volumeMounts: if std.objectHas(tbr.config.objectStorageConfig, 'tlsSecretName') && std.length(tbr.config.objectStorageConfig.tlsSecretName) > 0 then [
+        { name: 'tls-secret', mountPath: tbr.config.objectStorageConfig.tlsSecretMountPath },
+      ] else [],
     };
 
     {
@@ -177,9 +197,13 @@ function(params) {
             serviceAccountName: tbr.serviceAccount.metadata.name,
             securityContext: tbr.config.securityContext,
             containers: [container],
+            volumes: if std.objectHas(tbr.config.objectStorageConfig, 'tlsSecretName') && std.length(tbr.config.objectStorageConfig.tlsSecretName) > 0 then [{
+              name: 'tls-secret',
+              secret: { secretName: tbr.config.objectStorageConfig.tlsSecretName },
+            }] else [],
             terminationGracePeriodSeconds: 120,
             nodeSelector: {
-              'beta.kubernetes.io/os': 'linux',
+              'kubernetes.io/os': 'linux',
             },
           },
         },

jsonnet/kube-thanos/kube-thanos-bucket.libsonnet

@@ -7,6 +7,7 @@ local defaults = {
   namespace: error 'must provide namespace',
   version: error 'must provide version',
   image: error 'must provide image',
+  imagePullPolicy: 'IfNotPresent',
   objectStorageConfig: error 'must provide objectStorageConfig',
   resources: {},
   logLevel: 'info',
@@ -33,7 +34,21 @@ local defaults = {
   securityContext:: {
     fsGroup: 65534,
     runAsUser: 65534,
+    runAsGroup: 65532,
+    runAsNonRoot: true,
+    seccompProfile: { type: 'RuntimeDefault' },
   },
+  securityContextContainer:: {
+    runAsUser: defaults.securityContext.runAsUser,
+    runAsGroup: defaults.securityContext.runAsGroup,
+    runAsNonRoot: defaults.securityContext.runAsNonRoot,
+    seccompProfile: defaults.securityContext.seccompProfile,
+    allowPrivilegeEscalation: false,
+    readOnlyRootFilesystem: true,
+    capabilities: { drop: ['ALL'] },
+  },
+
+  serviceAccountAnnotations:: {},
 };
 
 function(params) {
@@ -76,6 +91,7 @@ function(params) {
       name: tb.config.name,
       namespace: tb.config.namespace,
       labels: tb.config.commonLabels,
+      annotations: tb.config.serviceAccountAnnotations,
     },
   },
 
@@ -83,6 +99,7 @@ function(params) {
     local container = {
       name: 'thanos-bucket',
       image: tb.config.image,
+      imagePullPolicy: tb.config.imagePullPolicy,
       args: [
         'tools',
         'bucket',
@@ -137,7 +154,11 @@ function(params) {
         path: '/-/ready',
       } },
       resources: if tb.config.resources != {} then tb.config.resources else {},
+      securityContext: tb.config.securityContextContainer,
       terminationMessagePolicy: 'FallbackToLogsOnError',
+      volumeMounts: if std.objectHas(tb.config.objectStorageConfig, 'tlsSecretName') && std.length(tb.config.objectStorageConfig.tlsSecretName) > 0 then [
+        { name: 'tls-secret', mountPath: tb.config.objectStorageConfig.tlsSecretMountPath },
+      ] else [],
     };
 
     {
@@ -157,6 +178,10 @@ function(params) {
             serviceAccountName: tb.serviceAccount.metadata.name,
             securityContext: tb.config.securityContext,
             containers: [container],
+            volumes: if std.objectHas(tb.config.objectStorageConfig, 'tlsSecretName') && std.length(tb.config.objectStorageConfig.tlsSecretName) > 0 then [{
+              name: 'tls-secret',
+              secret: { secretName: tb.config.objectStorageConfig.tlsSecretName },
+            }] else [],
             terminationGracePeriodSeconds: 120,
             nodeSelector: {
               'kubernetes.io/os': 'linux',

jsonnet/kube-thanos/kube-thanos-compact-default-params.libsonnet

@@ -7,6 +7,7 @@
   namespace: error 'must provide namespace',
   version: error 'must provide version',
   image: error 'must provide image',
+  imagePullPolicy: 'IfNotPresent',
   objectStorageConfig: error 'must provide objectStorageConfig',
   resources: {},
   logLevel: 'info',
@@ -16,9 +17,11 @@
   retentionResolutionRaw: '0d',
   retentionResolution5m: '0d',
   retentionResolution1h: '0d',
+  compactConcurrency: 1,
+  deduplicationReplicaLabels: [],
   deleteDelay: '48h',
   disableDownsampling: false,
-  deduplicationReplicaLabels: [],
+  downsampleConcurrency: 1,
   ports: {
     http: 10902,
   },
@@ -41,5 +44,20 @@
   securityContext:: {
     fsGroup: 65534,
     runAsUser: 65534,
+    runAsGroup: 65532,
+    runAsNonRoot: true,
+    seccompProfile: { type: 'RuntimeDefault' },
   },
+
+  securityContextContainer:: {
+    runAsUser: defaults.securityContext.runAsUser,
+    runAsGroup: defaults.securityContext.runAsGroup,
+    runAsNonRoot: defaults.securityContext.runAsNonRoot,
+    seccompProfile: defaults.securityContext.seccompProfile,
+    allowPrivilegeEscalation: false,
+    readOnlyRootFilesystem: true,
+    capabilities: { drop: ['ALL'] },
+  },
+
+  serviceAccountAnnotations:: {},
 }

jsonnet/kube-thanos/kube-thanos-compact-shards.libsonnet

@@ -26,6 +26,7 @@ function(params)
         name: config.name,
         namespace: config.namespace,
         labels: config.commonLabels,
+        annotations: config.serviceAccountAnnotations,
       },
     },
 
@@ -88,11 +89,13 @@ function(params)
             port: 'http',
             relabelings: [
               {
+                action: 'replace',
                 sourceLabels: ['namespace', 'pod'],
                 separator: '/',
                 targetLabel: 'instance',
               },
               {
+                action: 'replace',
                 sourceLabels: ['__meta_kubernetes_service_label_compact_thanos_io_shard'],
                 regex: 'shard\\-(\\d+)',
                 replacement: '$1',

jsonnet/kube-thanos/kube-thanos-compact.libsonnet

@@ -6,6 +6,8 @@ function(params) {
   // Combine the defaults and the passed params to make the component's config.
   config:: defaults + params,
   // Safety checks for combined config of defaults and params
+  assert std.isNumber(tc.config.compactConcurrency),
+  assert std.isNumber(tc.config.downsampleConcurrency),
   assert std.isNumber(tc.config.replicas) && (tc.config.replicas == 0 || tc.config.replicas == 1) : 'thanos compact replicas can only be 0 or 1',
   assert std.isObject(tc.config.resources),
   assert std.isObject(tc.config.volumeClaimTemplate),
@@ -45,6 +47,7 @@ function(params) {
       name: tc.config.name,
       namespace: tc.config.namespace,
       labels: tc.config.commonLabels,
+      annotations: tc.config.serviceAccountAnnotations,
     },
   },
 
@@ -52,6 +55,7 @@ function(params) {
     local c = {
       name: 'thanos-compact',
       image: tc.config.image,
+      imagePullPolicy: tc.config.imagePullPolicy,
       args: [
         'compact',
         '--wait',
@@ -64,6 +68,8 @@ function(params) {
         '--retention.resolution-5m=' + tc.config.retentionResolution5m,
         '--retention.resolution-1h=' + tc.config.retentionResolution1h,
         '--delete-delay=' + tc.config.deleteDelay,
+        '--compact.concurrency=' + tc.config.compactConcurrency,
+        '--downsample.concurrency=' + tc.config.downsampleConcurrency,
       ] + (
         if tc.config.disableDownsampling then ['--downsampling.disable'] else []
       ) + (
@@ -114,7 +120,11 @@ function(params) {
         name: 'data',
         mountPath: '/var/thanos/compact',
         readOnly: false,
-      }],
+      }] + (
+        if std.objectHas(tc.config.objectStorageConfig, 'tlsSecretName') && std.length(tc.config.objectStorageConfig.tlsSecretName) > 0 then [
+          { name: 'tls-secret', mountPath: tc.config.objectStorageConfig.tlsSecretMountPath },
+        ] else []
+      ),
       resources: if tc.config.resources != {} then tc.config.resources else {},
       terminationMessagePolicy: 'FallbackToLogsOnError',
     };
@@ -139,7 +149,10 @@ function(params) {
             serviceAccountName: tc.serviceAccount.metadata.name,
             securityContext: tc.config.securityContext,
             containers: [c],
-            volumes: [],
+            volumes: if std.objectHas(tc.config.objectStorageConfig, 'tlsSecretName') && std.length(tc.config.objectStorageConfig.tlsSecretName) > 0 then [{
+              name: 'tls-secret',
+              secret: { secretName: tc.config.objectStorageConfig.tlsSecretName },
+            }] else [],
             terminationGracePeriodSeconds: 120,
             nodeSelector: {
               'kubernetes.io/os': 'linux',
@@ -189,6 +202,7 @@ function(params) {
         {
           port: 'http',
           relabelings: [{
+            action: 'replace',
             sourceLabels: ['namespace', 'pod'],
             separator: '/',
             targetLabel: 'instance',

jsonnet/kube-thanos/kube-thanos-query-frontend.libsonnet

@@ -7,6 +7,7 @@ local defaults = {
   namespace: error 'must provide namespace',
   version: error 'must provide version',
   image: error 'must provide image',
+  imagePullPolicy: 'IfNotPresent',
   replicas: error 'must provide replicas',
   downstreamURL: error 'must provide downstreamURL',
   splitInterval: '24h',
@@ -20,6 +21,7 @@ local defaults = {
     },
   },
   queryRangeCache: {},
+  queryUrl: '',
   labelsCache: {},
   logLevel: 'info',
   logFormat: 'logfmt',
@@ -62,7 +64,22 @@ local defaults = {
   securityContext:: {
     fsGroup: 65534,
     runAsUser: 65534,
+    runAsGroup: 65532,
+    runAsNonRoot: true,
+    seccompProfile: { type: 'RuntimeDefault' },
   },
+
+  securityContextContainer:: {
+    runAsUser: defaults.securityContext.runAsUser,
+    runAsGroup: defaults.securityContext.runAsGroup,
+    runAsNonRoot: defaults.securityContext.runAsNonRoot,
+    seccompProfile: defaults.securityContext.seccompProfile,
+    allowPrivilegeEscalation: false,
+    readOnlyRootFilesystem: true,
+    capabilities: { drop: ['ALL'] },
+  },
+
+  serviceAccountAnnotations:: {},
 };
 
 function(params) {
@@ -132,6 +149,7 @@ function(params) {
       name: tqf.config.name,
       namespace: tqf.config.namespace,
       labels: tqf.config.commonLabels,
+      annotations: tqf.config.serviceAccountAnnotations,
     },
   },
 
@@ -139,6 +157,7 @@ function(params) {
     local c = {
       name: 'thanos-query-frontend',
       image: tqf.config.image,
+      imagePullPolicy: tqf.config.imagePullPolicy,
       args: [
         'query-frontend',
         '--log.level=' + tqf.config.logLevel,
@@ -169,6 +188,10 @@ function(params) {
             { config+: { service_name: defaults.name } } + tqf.config.tracing
           ),
         ] else []
+      ) + (
+        if tqf.config.queryUrl != '' then [
+          '--alert.query-url=' + tqf.config.queryUrl,
+        ] else []
       ),
       env: [
         {
@@ -198,6 +221,7 @@ function(params) {
         path: '/-/ready',
       } },
       resources: if tqf.config.resources != {} then tqf.config.resources else {},
+      securityContext: tqf.config.securityContextContainer,
       terminationMessagePolicy: 'FallbackToLogsOnError',
     };
 
@@ -257,6 +281,7 @@ function(params) {
         {
           port: 'http',
           relabelings: [{
+            action: 'replace',
             sourceLabels: ['namespace', 'pod'],
             separator: '/',
             targetLabel: 'instance',

jsonnet/kube-thanos/kube-thanos-query.libsonnet

@@ -7,12 +7,16 @@ local defaults = {
   namespace: error 'must provide namespace',
   version: error 'must provide version',
   image: error 'must provide image',
+  imagePullPolicy: 'IfNotPresent',
   replicas: error 'must provide replicas',
   replicaLabels: error 'must provide replicaLabels',
   stores: ['dnssrv+_grpc._tcp.thanos-store.%s.svc.cluster.local' % defaults.namespace],
+  rules: [],  // TODO(bwplotka): This is deprecated, switch to endpoints while ready.
   externalPrefix: '',
+  queryUrl: '',
   prefixHeader: '',
   autoDownsampling: true,
+  useThanosEngine: false,
   resources: {},
   queryTimeout: '',
   lookbackDelta: '',
@@ -25,6 +29,9 @@ local defaults = {
   logFormat: 'logfmt',
   tracing: {},
   extraEnv: [],
+  telemetryDurationQuantiles: '',
+  telemetrySamplesQuantiles: '',
+  telemetrySeriesQuantiles: '',
 
   commonLabels:: {
     'app.kubernetes.io/name': 'thanos-query',
@@ -42,7 +49,22 @@ local defaults = {
   securityContext:: {
     fsGroup: 65534,
     runAsUser: 65534,
+    runAsGroup: 65532,
+    runAsNonRoot: true,
+    seccompProfile: { type: 'RuntimeDefault' },
   },
+
+  securityContextContainer:: {
+    runAsUser: defaults.securityContext.runAsUser,
+    runAsGroup: defaults.securityContext.runAsGroup,
+    runAsNonRoot: defaults.securityContext.runAsNonRoot,
+    seccompProfile: defaults.securityContext.seccompProfile,
+    allowPrivilegeEscalation: false,
+    readOnlyRootFilesystem: true,
+    capabilities: { drop: ['ALL'] },
+  },
+
+  serviceAccountAnnotations:: {},
 };
 
 function(params) {
@@ -58,6 +80,7 @@ function(params) {
   assert std.isString(tq.config.queryTimeout),
   assert std.isBoolean(tq.config.serviceMonitor),
   assert std.isBoolean(tq.config.autoDownsampling),
+  assert std.isBoolean(tq.config.useThanosEngine),
 
   service: {
     apiVersion: 'v1',
@@ -90,6 +113,7 @@ function(params) {
       name: tq.config.name,
       namespace: tq.config.namespace,
       labels: tq.config.commonLabels,
+      annotations: tq.config.serviceAccountAnnotations,
     },
   },
 
@@ -97,6 +121,7 @@ function(params) {
     local c = {
       name: 'thanos-query',
       image: tq.config.image,
+      imagePullPolicy: tq.config.imagePullPolicy,
       args:
         [
           'query',
@@ -108,8 +133,11 @@ function(params) {
           '--query.replica-label=%s' % labelName
           for labelName in tq.config.replicaLabels
         ] + [
-          '--store=%s' % store
+          '--endpoint=%s' % store
           for store in tq.config.stores
+        ] + [
+          '--rule=%s' % store
+          for store in tq.config.rules
         ] +
         (
           if tq.config.externalPrefix != '' then [
@@ -140,6 +168,29 @@ function(params) {
           if tq.config.autoDownsampling then [
             '--query.auto-downsampling',
           ] else []
+        ) + (
+          if tq.config.useThanosEngine then [
+            '--query.promql-engine=thanos',
+          ] else []
+        ) + (
+          if tq.config.telemetryDurationQuantiles != '' then [
+            '--query.telemetry.request-duration-seconds-quantiles=' + std.stripChars(quantile, ' ')
+            for quantile in std.split(tq.config.telemetryDurationQuantiles, ',')
+          ] else []
+        ) + (
+          if tq.config.telemetrySamplesQuantiles != '' then [
+            '--query.telemetry.request-samples-quantiles=' + std.stripChars(quantile, ' ')
+            for quantile in std.split(tq.config.telemetrySamplesQuantiles, ',')
+          ] else []
+        ) + (
+          if tq.config.telemetrySeriesQuantiles != '' then [
+            '--query.telemetry.request-series-seconds-quantiles=' + std.stripChars(quantile, ' ')
+            for quantile in std.split(tq.config.telemetrySeriesQuantiles, ',')
+          ] else []
+        ) + (
+          if tq.config.queryUrl != '' then [
+            '--alert.query-url=' + tq.config.queryUrl,
+          ] else []
         ),
       env: [
         {
@@ -169,6 +220,7 @@ function(params) {
         path: '/-/ready',
       } },
       resources: if tq.config.resources != {} then tq.config.resources else {},
+      securityContext: tq.config.securityContextContainer,
       terminationMessagePolicy: 'FallbackToLogsOnError',
     };
 
@@ -230,6 +282,7 @@ function(params) {
         {
           port: 'http',
           relabelings: [{
+            action: 'replace',
             sourceLabels: ['namespace', 'pod'],
             separator: '/',
             targetLabel: 'instance',

jsonnet/kube-thanos/kube-thanos-receive-default-params.libsonnet

@@ -7,7 +7,9 @@
   namespace: error 'must provide namespace',
   version: error 'must provide version',
   image: error 'must provide image',
+  imagePullPolicy: 'IfNotPresent',
   replicas: error 'must provide replicas',
+  minReadySeconds: 0,
   replicationFactor: error 'must provide replication factor',
   objectStorageConfig: error 'must provide objectStorageConfig',
   podDisruptionBudgetMaxUnavailable: (std.floor(defaults.replicationFactor / 2)),
@@ -30,7 +32,11 @@
     'receive="true"',
   ],
   tenantLabelName: null,
+  tenantHeader: null,
+  clusterDomain: 'cluster.local',
   extraEnv: [],
+  receiveLimitsConfigFile: {},
+  storeLimits: {},
 
   commonLabels:: {
     'app.kubernetes.io/name': 'thanos-receive',
@@ -48,5 +54,20 @@
   securityContext:: {
     fsGroup: 65534,
     runAsUser: 65534,
+    runAsGroup: 65532,
+    runAsNonRoot: true,
+    seccompProfile: { type: 'RuntimeDefault' },
   },
+
+  securityContextContainer:: {
+    runAsUser: defaults.securityContext.runAsUser,
+    runAsGroup: defaults.securityContext.runAsGroup,
+    runAsNonRoot: defaults.securityContext.runAsNonRoot,
+    seccompProfile: defaults.securityContext.seccompProfile,
+    allowPrivilegeEscalation: false,
+    readOnlyRootFilesystem: true,
+    capabilities: { drop: ['ALL'] },
+  },
+
+  serviceAccountAnnotations:: {},
 }

jsonnet/kube-thanos/kube-thanos-receive-hashrings.libsonnet

@@ -28,6 +28,7 @@ function(params)
         name: config.name,
         namespace: config.namespace,
         labels: config.commonLabels,
+        annotations: config.serviceAccountAnnotations,
       },
     },
     hashrings: {
@@ -90,11 +91,13 @@ function(params)
             port: 'http',
             relabelings: [
               {
+                action: 'replace',
                 sourceLabels: ['namespace', 'pod'],
                 separator: '/',
                 targetLabel: 'instance',
               },
               {
+                action: 'replace',
                 sourceLabels: ['__meta_kubernetes_service_label_controller_receive_thanos_io_shard'],
                 targetLabel: 'hashring',
               },

jsonnet/kube-thanos/kube-thanos-receive-ingestor.libsonnet

@@ -6,7 +6,7 @@ local defaults = receiveConfigDefaults {
     hashring: 'default',
     tenants: [],
   }],
-  hashringConfigmapName: 'hashring-config',
+  hashringConfigMapName: 'hashring-config',
   routerReplicas: 1,
 };
 
@@ -42,4 +42,5 @@ function(params) {
     for name in tr.config.hashrings
   },
   serviceAccount: ingestors.serviceAccount,
+  serviceMonitor: if tr.config.serviceMonitor then ingestors.serviceMonitor,
 }

jsonnet/kube-thanos/kube-thanos-receive-router.libsonnet

@@ -5,7 +5,7 @@ local defaults = receiveConfigDefaults {
     hashring: 'default',
     tenants: [],
   }],
-  hashringConfigmapName: 'hashring-config',
+  hashringConfigMapName: 'hashring-config',
   routerReplicas: 1,
   endpoints: error 'must provide ingestor endpoints object',
 };
@@ -19,15 +19,32 @@ function(params) {
     'app.kubernetes.io/component': tr.config.name + '-router',
   },
 
+  podLabelSelector:: {
+    [labelName]: tr.routerLabels[labelName]
+    for labelName in std.objectFields(tr.routerLabels)
+    if labelName != 'app.kubernetes.io/version'
+  },
+
   service: {
     apiVersion: 'v1',
     kind: 'Service',
     metadata: {
       name: tr.config.name + '-router',
       namespace: tr.config.namespace,
+      labels: tr.routerLabels,
     },
     spec: {
-      ports: [{ name: name, port: tr.config.ports[name] } for name in std.objectFields(tr.config.ports)],
+      ports: [
+        {
+          assert std.isString(name),
+          assert std.isNumber(tr.config.ports[name]),
+
+          name: name,
+          port: tr.config.ports[name],
+          targetPort: tr.config.ports[name],
+        }
+        for name in std.objectFields(tr.config.ports)
+      ],
       selector: tr.routerLabels,
     },
   },
@@ -39,6 +56,7 @@ function(params) {
       name: tr.config.name + '-router',
       namespace: tr.config.namespace,
       labels: tr.routerLabels,
+      annotations: tr.config.serviceAccountAnnotations,
     },
   },
 
@@ -46,7 +64,7 @@ function(params) {
     apiVersion: 'v1',
     kind: 'ConfigMap',
     metadata: {
-      name: tr.config.hashringConfigmapName,
+      name: tr.config.hashringConfigMapName,
       namespace: tr.config.namespace,
     },
     data: {
@@ -65,7 +83,7 @@ function(params) {
     },
     spec: {
       replicas: tr.config.routerReplicas,
-      selector: { matchLabels: tr.routerLabels },
+      selector: { matchLabels: tr.podLabelSelector },
       template: {
         metadata: {
           labels: tr.routerLabels,
@@ -76,6 +94,7 @@ function(params) {
           containers: [{
             name: 'thanos-receive',
             image: tr.config.image,
+            imagePullPolicy: tr.config.imagePullPolicy,
             args: [
               'receive',
               '--log.level=' + tr.config.logLevel,
@@ -127,6 +146,7 @@ function(params) {
               path: '/-/ready',
             } },
             resources: if tr.config.resources != {} then tr.config.resources else {},
+            securityContext: tr.config.securityContextContainer,
             terminationMessagePolicy: 'FallbackToLogsOnError',
           }],
           volumes: [{
@@ -135,7 +155,7 @@ function(params) {
           }],
           terminationGracePeriodSeconds: 30,
           nodeSelector: {
-            'beta.kubernetes.io/os': 'linux',
+            'kubernetes.io/os': 'linux',
           },
         },
       },

jsonnet/kube-thanos/kube-thanos-receive.libsonnet

@@ -12,6 +12,9 @@ function(params) {
   assert std.isBoolean(tr.config.serviceMonitor),
   assert std.isObject(tr.config.volumeClaimTemplate),
   assert !std.objectHas(tr.config.volumeClaimTemplate, 'spec') || std.assertEqual(tr.config.volumeClaimTemplate.spec.accessModes, ['ReadWriteOnce']) : 'thanos receive PVC accessMode can only be ReadWriteOnce',
+  assert std.isNumber(tr.config.minReadySeconds),
+  assert std.isObject(tr.config.receiveLimitsConfigFile),
+  assert std.isObject(tr.config.storeLimits),
 
   service: {
     apiVersion: 'v1',
@@ -45,18 +48,21 @@ function(params) {
       name: tr.config.name,
       namespace: tr.config.namespace,
       labels: tr.config.commonLabels,
+      annotations: tr.config.serviceAccountAnnotations,
     },
   },
 
   statefulSet:
-    local localEndpointFlag = '--receive.local-endpoint=$(NAME).%s.$(NAMESPACE).svc.cluster.local:%d' % [
+    local localEndpointFlag = '--receive.local-endpoint=$(NAME).%s.$(NAMESPACE).svc.%s:%d' % [
       tr.config.name,
+      tr.config.clusterDomain,
       tr.config.ports.grpc,
     ];
 
     local c = {
       name: 'thanos-receive',
       image: tr.config.image,
+      imagePullPolicy: tr.config.imagePullPolicy,
       args: [
         'receive',
         '--log.level=' + tr.config.logLevel,
@@ -82,16 +88,33 @@ function(params) {
         if tr.config.tenantLabelName != null then [
           '--receive.tenant-label-name=%s' % tr.config.tenantLabelName,
         ] else []
+      ) + (
+        if tr.config.tenantHeader != null then [
+          '--receive.tenant-header=%s' % tr.config.tenantHeader,
+        ] else []
       ) + (
         if tr.config.hashringConfigMapName != '' then [
           '--receive.hashrings-file=/var/lib/thanos-receive/hashrings.json',
         ] else []
+      ) + (
+        if std.objectHas(tr.config.storeLimits, 'requestSamples') then [
+          '--store.limits.request-samples=%s' % tr.config.storeLimits.requestSamples,
+        ] else []
+      ) + (
+        if std.objectHas(tr.config.storeLimits, 'requestSeries') then [
+          '--store.limits.request-series=%s' % tr.config.storeLimits.requestSeries,
+        ] else []
       ) + (
         if std.length(tr.config.tracing) > 0 then [
           '--tracing.config=' + std.manifestYamlDoc(
             { config+: { service_name: defaults.name } } + tr.config.tracing
           ),
         ] else []
+      ) + (
+        if tr.config.receiveLimitsConfigFile != {} then [
+          '--receive.limits-config-file=/etc/thanos/config/' + tr.config.receiveLimitsConfigFile.name + '/' + tr.config.receiveLimitsConfigFile.key,
+        ]
+        else []
       ),
       env: [
         { name: 'NAME', valueFrom: { fieldRef: { fieldPath: 'metadata.name' } } },
@@ -128,6 +151,14 @@ function(params) {
         if tr.config.hashringConfigMapName != '' then [
           { name: 'hashring-config', mountPath: '/var/lib/thanos-receive' },
         ] else []
+      ) + (
+        if tr.config.objectStorageConfig != null && std.objectHas(tr.config.objectStorageConfig, 'tlsSecretName') && std.length(tr.config.objectStorageConfig.tlsSecretName) > 0 then [
+          { name: 'tls-secret', mountPath: tr.config.objectStorageConfig.tlsSecretMountPath },
+        ] else []
+      ) + (
+        if tr.config.receiveLimitsConfigFile != {} then [
+          { name: tr.config.receiveLimitsConfigFile.name, mountPath: '/etc/thanos/config/' + tr.config.receiveLimitsConfigFile.name, readOnly: true },
+        ] else []
       ),
       livenessProbe: { failureThreshold: 8, periodSeconds: 30, httpGet: {
         scheme: 'HTTP',
@@ -153,6 +184,7 @@ function(params) {
       },
       spec: {
         replicas: tr.config.replicas,
+        minReadySeconds: tr.config.minReadySeconds,
         selector: { matchLabels: tr.config.podLabelSelector },
         serviceName: tr.service.metadata.name,
         template: {
@@ -163,10 +195,22 @@ function(params) {
             serviceAccountName: tr.serviceAccount.metadata.name,
             securityContext: tr.config.securityContext,
             containers: [c],
-            volumes: if tr.config.hashringConfigMapName != '' then [{
-              name: 'hashring-config',
-              configMap: { name: tr.config.hashringConfigMapName },
-            }] else [],
+            volumes: (
+              if tr.config.hashringConfigMapName != '' then [{
+                name: 'hashring-config',
+                configMap: { name: tr.config.hashringConfigMapName },
+              }] else []
+            ) + (
+              if tr.config.objectStorageConfig != null && std.objectHas(tr.config.objectStorageConfig, 'tlsSecretName') && std.length(tr.config.objectStorageConfig.tlsSecretName) > 0 then [{
+                name: 'tls-secret',
+                secret: { secretName: tr.config.objectStorageConfig.tlsSecretName },
+              }] else []
+            ) + (
+              if tr.config.receiveLimitsConfigFile != {} then [{
+                name: tr.config.receiveLimitsConfigFile.name,
+                configMap: { name: tr.config.receiveLimitsConfigFile.name },
+              }] else []
+            ),
             terminationGracePeriodSeconds: 900,
             nodeSelector: {
               'kubernetes.io/os': 'linux',
@@ -227,6 +271,7 @@ function(params) {
         {
           port: 'http',
           relabelings: [{
+            action: 'replace',
             sourceLabels: ['namespace', 'pod'],
             separator: '/',
             targetLabel: 'instance',
@@ -237,7 +282,7 @@ function(params) {
   },
 
   podDisruptionBudget: if tr.config.podDisruptionBudgetMaxUnavailable >= 1 then {
-    apiVersion: 'policy/v1beta1',
+    apiVersion: 'policy/v1',
     kind: 'PodDisruptionBudget',
     metadata: {
       name: tr.config.name,

jsonnet/kube-thanos/kube-thanos-rule.libsonnet

@@ -7,12 +7,17 @@ local defaults = {
   namespace: error 'must provide namespace',
   version: error 'must provide version',
   image: error 'must provide image',
+  imagePullPolicy: 'IfNotPresent',
   replicas: error 'must provide replicas',
   reloaderImage: error 'must provide reloader image',
+  reloaderImagePullPolicy: 'IfNotPresent',
   objectStorageConfig: error 'must provide objectStorageConfig',
   ruleFiles: [],
   rulesConfig: [],
+  remoteWriteConfigFile: {},
   alertmanagersURLs: [],
+  alertmanagerConfigFile: {},
+  extraVolumeMounts: [],
   queriers: [],
   logLevel: 'info',
   logFormat: 'logfmt',
@@ -44,7 +49,22 @@ local defaults = {
   securityContext:: {
     fsGroup: 65534,
     runAsUser: 65534,
+    runAsGroup: 65532,
+    runAsNonRoot: true,
+    seccompProfile: { type: 'RuntimeDefault' },
   },
+
+  securityContextContainer:: {
+    runAsUser: defaults.securityContext.runAsUser,
+    runAsGroup: defaults.securityContext.runAsGroup,
+    runAsNonRoot: defaults.securityContext.runAsNonRoot,
+    seccompProfile: defaults.securityContext.seccompProfile,
+    allowPrivilegeEscalation: false,
+    readOnlyRootFilesystem: true,
+    capabilities: { drop: ['ALL'] },
+  },
+
+  serviceAccountAnnotations:: {},
 };
 
 function(params) {
@@ -56,7 +76,10 @@ function(params) {
   assert std.isNumber(tr.config.replicas) && tr.config.replicas >= 0 : 'thanos rule replicas has to be number >= 0',
   assert std.isArray(tr.config.ruleFiles),
   assert std.isArray(tr.config.rulesConfig),
+  assert std.isObject(tr.config.remoteWriteConfigFile),
   assert std.isArray(tr.config.alertmanagersURLs),
+  assert std.isObject(tr.config.alertmanagerConfigFile),
+  assert std.isArray(tr.config.extraVolumeMounts),
   assert std.isObject(tr.config.resources),
   assert std.isBoolean(tr.config.serviceMonitor),
   assert std.isObject(tr.config.volumeClaimTemplate),
@@ -95,6 +118,7 @@ function(params) {
       name: tr.config.name,
       namespace: tr.config.namespace,
       labels: tr.config.commonLabels,
+      annotations: tr.config.serviceAccountAnnotations,
     },
   },
 
@@ -102,6 +126,7 @@ function(params) {
     local c = {
       name: 'thanos-rule',
       image: tr.config.image,
+      imagePullPolicy: tr.config.imagePullPolicy,
       args:
         [
           'rule',
@@ -120,6 +145,11 @@ function(params) {
         (['--rule-file=%s' % path for path in tr.config.ruleFiles]) +
         (['--alertmanagers.url=%s' % url for url in tr.config.alertmanagersURLs]) +
         (
+          if tr.config.alertmanagerConfigFile != {} then [
+            '--alertmanagers.config-file=/etc/thanos/config/' + tr.config.alertmanagerConfigFile.name + '/' + tr.config.alertmanagerConfigFile.key,
+          ]
+          else []
+        ) + (
           if std.length(tr.config.rulesConfig) > 0 then [
             '--rule-file=/etc/thanos/rules/' + ruleConfig.name + '/' + ruleConfig.key
             for ruleConfig in tr.config.rulesConfig
@@ -131,6 +161,11 @@ function(params) {
               { config+: { service_name: defaults.name } } + tr.config.tracing
             ),
           ] else []
+        ) + (
+          if tr.config.remoteWriteConfigFile != {} then [
+            '--remote-write.config-file=/etc/thanos/config/' + tr.config.remoteWriteConfigFile.name + '/' + tr.config.remoteWriteConfigFile.key,
+          ]
+          else []
         ),
       env: [
         { name: 'NAME', valueFrom: { fieldRef: { fieldPath: 'metadata.name' } } },
@@ -163,6 +198,23 @@ function(params) {
           { name: ruleConfig.name, mountPath: '/etc/thanos/rules/' + ruleConfig.name }
           for ruleConfig in tr.config.rulesConfig
         ] else []
+      ) + (
+        if tr.config.alertmanagerConfigFile != {} then [
+          { name: tr.config.alertmanagerConfigFile.name, mountPath: '/etc/thanos/config/' + tr.config.alertmanagerConfigFile.name, readOnly: true },
+        ] else []
+      ) + (
+        if std.length(tr.config.extraVolumeMounts) > 0 then [
+          { name: volumeMount.name, mountPath: volumeMount.mountPath }
+          for volumeMount in tr.config.extraVolumeMounts
+        ] else []
+      ) + (
+        if tr.config.objectStorageConfig != null && std.objectHas(tr.config.objectStorageConfig, 'tlsSecretName') && std.length(tr.config.objectStorageConfig.tlsSecretName) > 0 then [
+          { name: 'tls-secret', mountPath: tr.config.objectStorageConfig.tlsSecretMountPath },
+        ] else []
+      ) + (
+        if tr.config.remoteWriteConfigFile != {} then [
+          { name: tr.config.remoteWriteConfigFile.name, mountPath: '/etc/thanos/config/' + tr.config.remoteWriteConfigFile.name, readOnly: true },
+        ] else []
       ),
       livenessProbe: { failureThreshold: 24, periodSeconds: 5, httpGet: {
         scheme: 'HTTP',
@@ -176,21 +228,54 @@ function(params) {
 
       } },
       resources: if tr.config.resources != {} then tr.config.resources else {},
+      securityContext: tr.config.securityContextContainer,
       terminationMessagePolicy: 'FallbackToLogsOnError',
     };
 
     local reloadContainer = {
       name: 'configmap-reloader',
       image: tr.config.reloaderImage,
+      imagePullPolicy: tr.config.reloaderImagePullPolicy,
       args:
         [
           '-webhook-url=http://localhost:' + tr.service.spec.ports[1].port + '/-/reload',
         ] +
-        (['-volume-dir=/etc/thanos/rules/' + ruleConfig.name for ruleConfig in tr.config.rulesConfig]),
+        (
+          if std.length(tr.config.rulesConfig) > 0 then [
+            '-volume-dir=/etc/thanos/rules/' + ruleConfig.name
+            for ruleConfig in tr.config.rulesConfig
+          ] else []
+        ) + (
+          if tr.config.alertmanagerConfigFile != {} then [
+            '-volume-dir=/etc/thanos/config/' + tr.config.alertmanagerConfigFile.name,
+          ] else []
+        ) + (
+          if std.length(tr.config.extraVolumeMounts) > 0 then [
+            '-volume-dir=' + volumeMount.mountPath
+            for volumeMount in tr.config.extraVolumeMounts
+          ] else []
+        ) + (
+          if tr.config.remoteWriteConfigFile != {} then [
+            '-volume-dir=/etc/thanos/config/' + tr.config.remoteWriteConfigFile.name,
+          ] else []
+        ),
       volumeMounts: [
         { name: ruleConfig.name, mountPath: '/etc/thanos/rules/' + ruleConfig.name }
         for ruleConfig in tr.config.rulesConfig
-      ],
+      ] + (
+        if tr.config.alertmanagerConfigFile != {} then [
+          { name: tr.config.alertmanagerConfigFile.name, mountPath: '/etc/thanos/config/' + tr.config.alertmanagerConfigFile.name },
+        ] else []
+      ) + (
+        if std.length(tr.config.extraVolumeMounts) > 0 then [
+          { name: volumeMount.name, mountPath: volumeMount.mountPath }
+          for volumeMount in tr.config.extraVolumeMounts
+        ] else []
+      ) + (
+        if tr.config.remoteWriteConfigFile != {} then [
+          { name: tr.config.remoteWriteConfigFile.name, mountPath: '/etc/thanos/config/' + tr.config.remoteWriteConfigFile.name },
+        ] else []
+      ),
     };
 
     {
@@ -213,14 +298,71 @@ function(params) {
             serviceAccountName: tr.serviceAccount.metadata.name,
             securityContext: tr.config.securityContext,
             containers: [c] +
-                        (if std.length(tr.config.rulesConfig) > 0 then [reloadContainer] else []),
-            volumes: [
-              { name: ruleConfig.name, configMap: { name: ruleConfig.name } }
-              for ruleConfig in tr.config.rulesConfig
-            ],
+                        (
+                          if std.length(tr.config.rulesConfig) > 0 || std.length(tr.config.extraVolumeMounts) > 0 || tr.config.alertmanagerConfigFile != {} || tr.config.remoteWriteConfigFile != {} then [
+                            reloadContainer,
+                          ] else []
+                        ),
+            volumes:
+              [] +
+              (
+                if std.length(tr.config.rulesConfig) > 0 then [
+                  { name: ruleConfig.name, configMap: { name: ruleConfig.name } }
+                  for ruleConfig in tr.config.rulesConfig
+                ] else []
+              ) + (
+                if tr.config.alertmanagerConfigFile != {} then [{
+                  name: tr.config.alertmanagerConfigFile.name,
+                  configMap: { name: tr.config.alertmanagerConfigFile.name },
+                }] else []
+              ) + (
+                if tr.config.remoteWriteConfigFile != {} then [{
+                  name: tr.config.remoteWriteConfigFile.name,
+                  configMap: { name: tr.config.remoteWriteConfigFile.name },
+                }] else []
+              ) + (
+                if std.length(tr.config.extraVolumeMounts) > 0 then [
+                  { name: volumeMount.name } +
+                  (
+                    if volumeMount.type == 'configMap' then {
+                      configMap: { name: volumeMount.name },
+                    }
+                    else {
+                      secret: { name: volumeMount.name },
+                    }
+                  )
+                  for volumeMount in tr.config.extraVolumeMounts
+                ] else []
+              ) + (
+                if tr.config.objectStorageConfig != null && std.objectHas(tr.config.objectStorageConfig, 'tlsSecretName') && std.length(tr.config.objectStorageConfig.tlsSecretName) > 0 then [{
+                  name: 'tls-secret',
+                  secret: { secretName: tr.config.objectStorageConfig.tlsSecretName },
+                }] else []
+              ),
             nodeSelector: {
               'kubernetes.io/os': 'linux',
             },
+            affinity: { podAntiAffinity: {
+              local labelSelector = { matchExpressions: [{
+                key: 'app.kubernetes.io/name',
+                operator: 'In',
+                values: [tr.statefulSet.metadata.labels['app.kubernetes.io/name']],
+              }, {
+                key: 'app.kubernetes.io/instance',
+                operator: 'In',
+                values: [tr.statefulSet.metadata.labels['app.kubernetes.io/instance']],
+              }] },
+              preferredDuringSchedulingIgnoredDuringExecution: [
+                {
+                  podAffinityTerm: {
+                    namespaces: [tr.config.namespace],
+                    topologyKey: 'kubernetes.io/hostname',
+                    labelSelector: labelSelector,
+                  },
+                  weight: 100,
+                },
+              ],
+            } },
           },
         },
         volumeClaimTemplates: if std.length(tr.config.volumeClaimTemplate) > 0 then [tr.config.volumeClaimTemplate {
@@ -248,6 +390,7 @@ function(params) {
         {
           port: 'http',
           relabelings: [{
+            action: 'replace',
             sourceLabels: ['namespace', 'pod'],
             separator: '/',
             targetLabel: 'instance',

jsonnet/kube-thanos/kube-thanos-sidecar.libsonnet

@@ -72,6 +72,7 @@ function(params) {
       endpoints: [{
         port: 'http',
         relabelings: [{
+          action: 'replace',
           sourceLabels: ['namespace', 'pod'],
           separator: '/',
           targetLabel: 'instance',

jsonnet/kube-thanos/kube-thanos-store-default-params.libsonnet

@@ -7,7 +7,13 @@
   namespace: error 'must provide namespace',
   version: error 'must provide version',
   image: error 'must provide image',
+  imagePullPolicy: 'IfNotPresent',
   replicas: error 'must provide replicas',
+  limits: {
+    seriesTouched: 0,
+    seriesSample: 0,
+    downloadedBytes: 0,
+  },
   objectStorageConfig: error 'must provide objectStorageConfig',
   ignoreDeletionMarksDelay: '24h',
   logLevel: 'info',
@@ -21,6 +27,11 @@
     grpc: 10901,
     http: 10902,
   },
+  livenessProbe: {
+    timeoutSeconds: 1,
+    failureThreshold: 8,
+    periodSeconds: 30,
+  },
   tracing: {},
   minTime: '',
   maxTime: '',
@@ -72,5 +83,19 @@
   securityContext:: {
     fsGroup: 65534,
     runAsUser: 65534,
+    runAsGroup: 65532,
+    runAsNonRoot: true,
+    seccompProfile: { type: 'RuntimeDefault' },
   },
+  securityContextContainer:: {
+    runAsUser: defaults.securityContext.runAsUser,
+    runAsGroup: defaults.securityContext.runAsGroup,
+    runAsNonRoot: defaults.securityContext.runAsNonRoot,
+    seccompProfile: defaults.securityContext.seccompProfile,
+    allowPrivilegeEscalation: false,
+    readOnlyRootFilesystem: true,
+    capabilities: { drop: ['ALL'] },
+  },
+
+  serviceAccountAnnotations:: {},
 }