The module lifecycle stage: General Availability

The module has requirements for installation

v1.0.24

Changes

  • External Alertmanagers are no longer discovered through a Service labeled prometheus.deckhouse.io/alertmanager: main. This deprecated method has been removed; declare such an Alertmanager with a CustomAlertmanager resource using spec.external.service.

Security

  • Client certificate for scraping custom targets. Prometheus now authenticates itself to user-defined HTTPS targets with a client TLS certificate issued by the platform kube-rbac-proxy CA. The CA is delivered automatically as the prometheus-custom-scraper-ca.crt ConfigMap to every namespace that has an HTTPS custom target, so kube-rbac-proxy in front of an application can verify the certificate with --client-ca-file. The bearer token is still sent during the transition period, so existing setups keep working; the FAQ describes how to switch to the certificate.
  • The spec.external.address and spec.external.service.path fields of CustomAlertmanager are now validated: only http and https addresses without credentials or control characters are accepted, and the path may contain only plain URL path characters. A resource that fails validation or points to a missing Service is skipped with a warning and no longer blocks the module.
  • Credentials in the CustomAlertmanager, PrometheusRemoteWrite, GrafanaAlertsChannel and GrafanaAdditionalDatasource resources (passwords, tokens, TLS keys) are now masked for users who are not allowed to read sensitive data.
  • Fixed vulnerabilities in the module component images (Alertmanager, Grafana, Mimir, Promxy, Memcached) and in the module hooks: CVE-2026-46595, CVE-2026-56854, CVE-2026-56855, CVE-2026-78662, CVE-2026-84304, CVE-2026-84445, CVE-2026-81870, CVE-2026-76905, CVE-2026-73502, CVE-2025-30153, CVE-2024-8986.

v1.0.23

Bug fixes

  • Fixed incorrect links to Prometheus and Alertmanager from Grafana.

v1.0.22

Security

  • The prompptool init container of the Prometheus pods now runs with a read-only root filesystem, as required by the Restricted Pod Security Standard.

v1.0.21

Bug fixes

  • Fixed an error in rendering the module templates in the CustomCertificate HTTPS mode when the custom certificate data was not yet available. The TLS Secret is now created only after the certificate has been provided.

v1.0.20

Bug fixes

  • Fixed switching Prometheus to the prompp engine.

v1.0.19

Security

  • Improved the security of the module templates.
  • Prometheus and Alertmanager workloads are now compliant with the Restricted Pod Security Standard.

Features

  • Made the startup, readiness and liveness probes of the main and longterm Prometheus instances explicit, with a timeout on the health check command.

Changes

  • Added the d8_source="dkp" label to the metrics collected from the module components (Prometheus, Grafana, Memcached, Trickster, aggregating proxy).

Bug fixes

  • Fixed the retentionSize calculation description in the module documentation: the actual formula is max(pvc_size * 0.85, pvc_size - 50 GiB), and the value used for the calculation is taken from the .spec.resources.requests.storage field of the PersistentVolumeClaim.