8000 Feat: add validation for Alertmanager HTTPConfig in Global Config by nutmos · Pull Request #7910 · prometheus-operator/prometheus-operator · GitHub
[go: up one dir, main page]
Skip to content

Feat: add validation for Alertmanager HTTPConfig in Global Config #7910

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Open
wants to merge 11 commits into
base: main
Choose a base branch
from
Open

Feat: add validation for Alertmanager HTTPConfig in Global Config #7910

wants to merge 11 commits into from

Conversation

nutmos
Copy link
Contributor
@nutmos nutmos commented Sep 13, 2025 •
edited
Loading

Description

This PR adds admission for the Alertmanager HTTPConfig in global configuration.

Type of change

What type of changes does your code introduce to the Prometheus operator? Put an x in the box that apply.

  • CHANGE (fix or feature that would cause existing functionality to not work as expected)
  • FEATURE (non-breaking change which adds functionality)
  • BUGFIX (non-breaking change which fixes an issue)
  • ENHANCEMENT (non-breaking change which improves existing functionality)
  • NONE (if none of the other choices apply. Example, tooling, build system, CI, docs, etc.)

Verification

Please check the Prometheus-Operator testing guidelines for recommendations about automated tests.

Changelog entry

Please put a one-line changelog entry below. This will be copied to the changelog file during the release process.

- Add Alertmanager HTTPConfig Global Config admission webhook validation

@nutmos nutmos changed the title Feat: add validation for Alertmanager Global Config Feat: add validation for Alertmanager HTTPConfig in Global Config Sep 15, 2025
@pull-request-size pull-request-size bot added size/M and removed size/L labels Sep 15, 2025
@nutmos nutmos marked this pull request as ready for review September 15, 2025 12:38
@nutmos nutmos requested a review from a team as a code owner September 15, 2025 12:38
@pull-request-size pull-request-size bot added size/L and removed size/M labels Sep 15, 2025
@simonpasquier
Copy link
Contributor

Thanks for the PR! Before implementing the validation of Alertmanager resources in the webhook service, I'd recommend that we address potential gaps that we have in the operator's logic. For instance the following Alertmanager resource would result in a crashlooping pod (provided that a foo secret with a bar key exists).

apiVersion: monitoring.coreos.com/v1
kind: Alertmanager
metadata:         
  name: example
spec:
  alertmanagerConfiguration:
    global:
      httpConfig:
        authorization:
          credentials:
            key: bar
            name: foo
        bearerTokenSecret:
          key: bar
          name: foo
    name: config-example
$ kc logs alertmanager-example-0 -c alertmanager
time=2025-09-15T14:06:16.793Z level=INFO source=main.go:191 msg="Starting Alertmanager" version="(version=0.28.1, branch=HEAD, revision=b2099eaa2c9ebc25edb26517cb9c732738e93910)"
time=2025-09-15T14:06:16.793Z level=INFO source=main.go:192 msg="Build context" build_context="(go=go1.23.7, platform=linux/amd64, user=root@fa3ca569dfe4, date=20250307-15:05:18, tags=netgo)"
time=2025-09-15T14:06:16.847Z level=INFO source=coordinator.go:112 msg="Loading configuration file" component=configuration file=/etc/alertmanager/config_out/alertmanager.env.yaml
time=2025-09-15T14:06:16.848Z level=ERROR source=coordinator.go:117 msg="Loading configuration file failed" component=configuration file=/etc/alertmanager/config_out/alertmanager.env.yaml err="authorization is not compatible with bearer_token & bearer_token_file"

@nutmos
Copy link
Contributor Author
nutmos commented Sep 16, 2025

@simonpasquier I'll review it later today.

@nutmos
Copy link
Contributor Author
nutmos commented Sep 24, 2025

@simonpasquier May I understand what is the expected result? If both are specified (authorization.credentials and bearerTokenSecret), which one should be the highest precedence?

@nutmos nutmos mentioned this pull request Sep 30, 2025
Merged
5 tasks
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
size/L
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
2 participants
@nutmos @simonpasquier
0