The upmeter module: configuration

Schema version: 2

• auth

  object

  Required value

  Configuration of authentication for Upmeter frontends.

  • auth.status

    object

    Required value

    Authentication configuration.

    • auth.status.allowedUserGroups

      array of strings

      An array of user groups that can access Grafana & Prometheus.

      This parameter is used if the user-authn module is enabled or the externalAuthentication parameter is set.

      Caution! Note that you must add those groups to the appropriate field in the DexProvider config if this module is used together with the user-authn one.

    • auth.status.externalAuthentication

      object

      Parameters to enable external authentication based on the NGINX Ingress external-auth mechanism that uses the NGINX auth_request module.

      External authentication is enabled automatically if the user-authn module is enabled.

      • auth.status.externalAuthentication.authSignInURL

        string

        URL to redirect the user for authentication (if the authentication service returned a non-200 HTTP response code).

      • auth.status.externalAuthentication.authURL

        string

        URL of the authentication service. If the user is authenticated, the service should return an HTTP 200 response code.

    • auth.status.whitelistSourceRanges

      array of strings

      An array if CIDRs that are allowed to authenticate.

      Example:

      whitelistSourceRanges:
      - 1.1.1.1/32
      

  • auth.webui

    object

    Required value

    Authentication configuration.

    • auth.webui.allowedUserGroups

      array of strings

      An array of user groups that can access Grafana & Prometheus.

      This parameter is used if the user-authn module is enabled or the externalAuthentication parameter is set.

      Caution! Note that you must add those groups to the appropriate field in the DexProvider config if this module is used together with the user-authn one.

    • auth.webui.externalAuthentication

      object

      Parameters to enable external authentication. Uses NGINX Ingress external-auth mechanism which is based on the the NGINX auth_request module.

      • auth.webui.externalAuthentication.authSignInURL

        string

        URL to redirect the user for authentication (if the authentication service returned a non-200 HTTP response code).

      • auth.webui.externalAuthentication.authURL

        string

        URL of the authentication service. If the user is authenticated, the service should return an HTTP 200 response code.

    • auth.webui.password

      string

      Password for http authorization of the admin user. It is generated automatically, but you can change it.

      This parameter is used if the externalAuthentication is not enabled.

    • auth.webui.whitelistSourceRanges

      array of strings

      An array if CIDRs that are allowed to authenticate.

      Example:

      whitelistSourceRanges:
      - 1.1.1.1/32
      

• disabledProbes

  array of strings

  Group names or specific probes from a group. You can view the names in the web UI.

  For example:

  disabledProbes:
    - "synthetic/api" # disable a specific probe
    - "synthetic/"    # disable a group of probes
    - control-plane   # / can be omitted
  

  Default: []

• https

  object

  What certificate type to use with webui and status apps.

  This parameter completely overrides the global.modules.https settings.

  Examples:

  https:
    mode: CustomCertificate
    customCertificate:
      secretName: foobar
  

  https:
    mode: CertManager
    certManager:
      clusterIssuerName: letsencrypt
  

  • https.certManager

    object
    • https.certManager.clusterIssuerName

      string

      What ClusterIssuer to use for webui/status.

      Currently, letsencrypt, letsencrypt-staging, selfsigned are available. Also, you can define your own.

      Default: "letsencrypt"

  • https.customCertificate

    object
    • https.customCertificate.secretName

      string

      The name of the secret in the d8-system namespace to use with webui/status.

      This secret must have the kubernetes.io/tls format.

      Default: "false"

  • https.mode

    string

    The HTTPS usage mode:

    • Disabled — webui/status will work over HTTP only;
    • CertManager — webui/status will use HTTPS and get a certificate from the clusterissuer defined in the certManager.clusterIssuerName parameter.
    • CustomCertificate — webui/status will use HTTPS using the certificate from the d8-system namespace.
    • OnlyInURI — webui/status will work over HTTP (thinking that there is an external HTTPS load balancer in front that terminates HTTPS traffic). All the links in the user-authn will be generated using the HTTPS scheme. Load balancer should provide a redirect from HTTP to HTTPS.

    Default: "Disabled"

    Allowed values: Disabled, CertManager, CustomCertificate, OnlyInURI

• nodeSelector

  object

  Node selector for Upmeter server. The same as in the Pods’ spec.nodeSelector parameter in Kubernetes.

  If the parameter is omitted or false, it will be determined automatically.

  Example:

  nodeSelector:
    disktype: ssd
  

• smokeMini

  object

  Configuration of authentication for smoke-mini.

  • smokeMini.auth

    object

    Required value

    Authentication configuration.

    • smokeMini.auth.allowedUserGroups

      array of strings

      An array of user groups that can access Grafana & Prometheus.

      This parameter is used if the user-authn module is enabled or the externalAuthentication parameter is set.

      Caution! Note that you must add those groups to the appropriate field in the DexProvider config if this module is used together with the user-authn one.

    • smokeMini.auth.externalAuthentication

      object

      Parameters to enable external authentication. Uses NGINX Ingress external-auth mechanism which is based on the the NGINX auth_request module.

      • smokeMini.auth.externalAuthentication.authSignInURL

        string

        URL to redirect the user for authentication (if the authentication service returned a non-200 HTTP response code).

      • smokeMini.auth.externalAuthentication.authURL

        string

        URL of the authentication service. If the user is authenticated, the service should return an HTTP 200 response code.

    • smokeMini.auth.password

      string

      Password for http authorization of the admin user. It is generated automatically, but you can change it.

      This parameter is used if the externalAuthentication is not enabled.

    • smokeMini.auth.whitelistSourceRanges

      array of strings

      An array if CIDRs that are allowed to authenticate.

      Example:

      whitelistSourceRanges:
      - 1.1.1.1/32
      

  • smokeMini.https

    object

    What certificate type to use with smoke-mini.

    This parameter completely overrides the global.modules.https settings.

    Examples:

    https:
      mode: CustomCertificate
      customCertificate:
        secretName: foobar
    

    https:
      mode: CertManager
      certManager:
        clusterIssuerName: letsencrypt
    

    • smokeMini.https.certManager

      object
      • smokeMini.https.certManager.clusterIssuerName

        string

        What ClusterIssuer to use for smoke-mini.

        Currently, letsencrypt, letsencrypt-staging, selfsigned are available. Also, you can define your own.

        Default: "letsencrypt"

    • smokeMini.https.customCertificate

      object
      • smokeMini.https.customCertificate.secretName

        string

        The name of the secret in the d8-system namespace to use with smoke-mini.

        This secret must have the kubernetes.io/tls format.

        Default: "false"

    • smokeMini.https.mode

      string

      The HTTPS usage mode:

      • Disabled — smoke-mini will work over HTTP only;
      • CertManager — smoke-mini will use HTTPS and get a certificate from the clusterissuer defined in the certManager.clusterIssuerName parameter.
      • CustomCertificate — smoke-mini will use HTTPS using the certificate from the d8-system namespace.
      • OnlyInURI — smoke-mini will work over HTTP (thinking that there is an external HTTPS load balancer in front that terminates HTTPS traffic). All the links in the user-authn will be generated using the HTTPS scheme. Load balancer should provide a redirect from HTTP to HTTPS.

      Default: "Disabled"

      Allowed values: Disabled, CertManager, CustomCertificate, OnlyInURI

  • smokeMini.ingressClass

    string

    The class of the Ingress controller used for the smoke-mini.

    Optional. By default, the modules.ingressClass global value is used

    Pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$

  • smokeMini.storageClass

    A StorageClass to use when checking the health of disks.

    If omitted, the StorageClass of the existing PVC is used. If there is no PVC yet, either the global StorageClass or global.discovery.defaultStorageClass is used, and if those are undefined, the emptyDir volume is used to store the data.

    global.discovery.defaultStorageClass is applied during module activation, changing default StorageClass in cluster won’t result in disk re-provisioning.

    Setting it to false forces the use of an emptyDir volume.

    Default: false

    Examples:

    storageClass: false
    

    storageClass: default
    

• smokeMiniDisabled

  boolean

  Disables smokeMini.

  Disables “synthetic” probe group in Upmeter as well.

  Default: false

• statusPageAuthDisabled

  boolean

  Disables authorization for the status domain.

  Default: false

• storageClass

  The name of the StorageClass to use. If omitted, the StorageClass of the existing PVC is used. If there is no PVC yet, either the global StorageClass or global.discovery.defaultStorageClass is used, and if those are undefined, the emptyDir volume is used to store the data.

  global.discovery.defaultStorageClass is applied during module activation, changing default StorageClass in cluster won’t result in disk re-provisioning.

  CAUTION! Setting this value to one that differs from the current one (in the existing PVC) will result in disk re-provisioning and data loss.

  Setting it to false forces the use of an emptyDir volume.

  Examples:

  storageClass: false
  

  storageClass: default
  

• tolerations

  array of objects

  Node tolerations for Upmeter server. The same as in the Pods’ spec.tolerations parameter in Kubernetes;

  If the parameter is omitted or false, it will be determined automatically.

  Example:

  tolerations:
  - key: key1
    operator: Equal
    value: value1
    effect: NoSchedule
  

  • tolerations.effect

    string
  • tolerations.key

    string
  • tolerations.operator

    string
  • tolerations.tolerationSeconds

    integer
  • tolerations.value

    string