Let a TerdutServer turn on metrics from the alerts' Prometheus

terdut-server v0.49.0 graphs the metric behind each alert on the incident
page, but only queries hosts listed in TERDUT_PROMETHEUS_ALLOWED_HOSTS,
because the URL comes out of a webhook payload. An install this operator
creates had no way to set it short of spec.pod.extraEnv.

spec.prometheus takes allowedHosts, preroll and timeout and maps them to
TERDUT_PROMETHEUS_ALLOWED_HOSTS, _PREROLL and _TIMEOUT. Nothing is emitted
unless allowedHosts is non-empty, so existing TerdutServers get the same
Deployment as before, and unset durations are left to the server's defaults.
There is no CRD default for the host: which Prometheus to trust is the
deployer's call, not something this operator should assume.

The CRD in config/ is regenerated and the chart's copy carries the same
schema; the chart's optional TerdutServer passes the block through.

Claude-Session: https://claude.ai/code/session_016mBLURvJoMuUEr9cB2RpUN

api/v1alpha1/terdutserver_types.go

@@ -118,6 +118,32 @@ type NotifySpec struct {
 	TokenSecretRef *SecretKeyRef `json:"tokenSecretRef,omitempty"`
 }
 
+// PrometheusSpec controls the metrics terdut-server shows on an incident,
+// fetched from the Prometheus named in each alert's generatorURL
+// (terdut-server v0.49.0+). Off unless allowedHosts is set: the URL comes
+// out of a webhook payload, so the server queries only hosts listed here.
+type PrometheusSpec struct {
+	// allowedHosts are the Prometheus servers terdut-server may query,
+	// passed as TERDUT_PROMETHEUS_ALLOWED_HOSTS. Entries are host names
+	// (with "*" as one DNS label and a leading "**" as one or more), IPs or
+	// CIDR ranges, each with an optional ":port", e.g.
+	// "kube-prometheus-stack-prometheus.kube-prometheus-stack:9090" or
+	// "*.monitoring.svc". Empty turns the feature off. The server refuses to
+	// start on a malformed entry or a bare "*".
+	// +optional
+	AllowedHosts []string `json:"allowedHosts,omitempty"`
+
+	// preroll is how far before an alert started its graph begins (a Go
+	// duration, e.g. "1h"). Unset uses terdut-server's default.
+	// +optional
+	Preroll string `json:"preroll,omitempty"`
+
+	// timeout bounds one request to a Prometheus (a Go duration, e.g.
+	// "10s"). Unset uses terdut-server's default.
+	// +optional
+	Timeout string `json:"timeout,omitempty"`
+}
+
 // OIDCSpec controls single sign-on.
 type OIDCSpec struct {
 	// +optional
@@ -325,6 +351,11 @@ type TerdutServerSpec struct {
 	// +optional
 	OIDC OIDCSpec `json:"oidc,omitempty"`
 
+	// prometheus enables the metrics on an incident (terdut-server
+	// v0.49.0+; an older image ignores the env vars it produces).
+	// +optional
+	Prometheus PrometheusSpec `json:"prometheus,omitempty"`
+
 	// passwordLogin: whether a user may sign in, or sign up, with a
 	// password.
 	// +kubebuilder:default=true

api/v1alpha1/zz_generated.deepcopy.go

@@ -391,6 +391,26 @@ func (in *PostgresClusterRef) DeepCopy() *PostgresClusterRef {
 	return out
 }
 
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *PrometheusSpec) DeepCopyInto(out *PrometheusSpec) {
+	*out = *in
+	if in.AllowedHosts != nil {
+		in, out := &in.AllowedHosts, &out.AllowedHosts
+		*out = make([]string, len(*in))
+		copy(*out, *in)
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new PrometheusSpec.
+func (in *PrometheusSpec) DeepCopy() *PrometheusSpec {
+	if in == nil {
+		return nil
+	}
+	out := new(PrometheusSpec)
+	in.DeepCopyInto(out)
+	return out
+}
+
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *SecretKeyRef) DeepCopyInto(out *SecretKeyRef) {
 	*out = *in
@@ -606,6 +626,7 @@ func (in *TerdutServerSpec) DeepCopyInto(out *TerdutServerSpec) {
 	out.Sweeper = in.Sweeper
 	in.Notify.DeepCopyInto(&out.Notify)
 	in.OIDC.DeepCopyInto(&out.OIDC)
+	in.Prometheus.DeepCopyInto(&out.Prometheus)
 	in.AllowedTeams.DeepCopyInto(&out.AllowedTeams)
 	in.Pod.DeepCopyInto(&out.Pod)
 }