niklas/terdut-server
1
0
Fork 0
Code Issues 10 Pull Requests Actions Packages Projects Releases 67 Wiki Activity

Default the allowed Prometheus host to kube-prometheus-stack's

Browse Source 
v0.49.0 shipped the metrics feature with an empty allowlist, so nothing
showed on an incident until someone set prometheus.allowedHosts. The chart
now defaults it to kube-prometheus-stack-prometheus.kube-prometheus-stack:9090,
the Prometheus that stack installs. An empty list still turns the feature
off.

Chart default only: the server's own default (TERDUT_PROMETHEUS_ALLOWED_HOSTS
empty) is unchanged, and no Go code, API or schema changed.

Claude-Session: https://claude.ai/code/session_016mBLURvJoMuUEr9cB2RpUN
This commit is contained in:
Niklas Ye
2026-10-22 17:16:19 +02:00
parent c242058f6c
commit 83837421e7
2 changed files with 5 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
charts/terdut-server/values.yaml
+4 -1
View File
@@ -120,8 +120,11 @@ operatorMode: false
# empty turns the feature off. Entries are host names, with "*" as one DNS label
# and a leading "**" as one or more (e.g. "*.monitoring.svc.cluster.local",
# "prometheus-*.monitoring"), IPs or CIDR ranges, each with an optional ":port".
# The default is the Prometheus that kube-prometheus-stack installs; set it to
# [] to turn the feature off.
prometheus:
allowedHosts: []
allowedHosts:
- kube-prometheus-stack-prometheus.kube-prometheus-stack:9090
# How far before an alert started its graph begins.
preroll: 1h
timeout: 10s
docs/configuration.md
+1 -1
View File
@@ -30,7 +30,7 @@ over an administrator's edit.
| `TERDUT_TRUSTED_PROXIES` | `1` | How many reverse proxies in front of the server append to `X-Forwarded-For`; the per-address rate limits use the entry that many hops from the right. `0` ignores the header |
| `TERDUT_OPERATOR_KEY` | — | At least 32 characters. When set, the instance-scoped service account `terdut-operator` is created if missing and its `seed` key replaced with this value at every start — how terdut-operator authenticates without a bootstrap handshake. An instance-scoped account acts as owner of every team (team configuration) but is not a member of any, so it reads no incidents |
| `TERDUT_OPERATOR_MODE` | `false` | Declares this install gitops-managed: a session's or a user's own API key's writes to teams, escalation policies, dead man's switches and integrations are refused (`403 reason:"operator_managed"`); a [service account](./api.md#service-accounts)'s are not. Team membership and the schedule stay editable regardless |
| `TERDUT_PROMETHEUS_ALLOWED_HOSTS` | — | Comma-separated Prometheus servers the [metrics on an incident](./metrics.md) may be fetched from, matched against the host in each alert's `generatorURL`. Host names (`prometheus.monitoring.svc`), wildcards (`*` is one DNS label, so `*.example.com` or `prom-*.monitoring.svc`; a leading `**` is one or more labels), IPs or CIDR ranges, each with an optional `:port`. Empty turns the feature off. A bare `*` is refused at startup |
| `TERDUT_PROMETHEUS_ALLOWED_HOSTS` | — (the Helm chart defaults to `kube-prometheus-stack-prometheus.kube-prometheus-stack:9090`) | Comma-separated Prometheus servers the [metrics on an incident](./metrics.md) may be fetched from, matched against the host in each alert's `generatorURL`. Host names (`prometheus.monitoring.svc`), wildcards (`*` is one DNS label, so `*.example.com` or `prom-*.monitoring.svc`; a leading `**` is one or more labels), IPs or CIDR ranges, each with an optional `:port`. Empty turns the feature off. A bare `*` is refused at startup |
| `TERDUT_PROMETHEUS_PREROLL` | `1h` | How far before an alert started its metrics graph begins |
| `TERDUT_PROMETHEUS_TIMEOUT` | `10s` | Per-request timeout for a Prometheus query |
| `TERDUT_OIDC_ISSUER` | — | Turns single sign-on on. The provider's issuer URL; discovery is read from `<issuer>/.well-known/openid-configuration`. See [Single sign-on](./single-sign-on.md#single-sign-on-oidc) |