From 83837421e7cc2a8d10899bdd378a73069faa3b1d Mon Sep 17 00:00:00 2001 From: Niklas Ye Date: Thu, 22 Oct 2026 17:16:19 +0200 Subject: [PATCH] Default the allowed Prometheus host to kube-prometheus-stack's v0.49.0 shipped the metrics feature with an empty allowlist, so nothing showed on an incident until someone set prometheus.allowedHosts. The chart now defaults it to kube-prometheus-stack-prometheus.kube-prometheus-stack:9090, the Prometheus that stack installs. An empty list still turns the feature off. Chart default only: the server's own default (TERDUT_PROMETHEUS_ALLOWED_HOSTS empty) is unchanged, and no Go code, API or schema changed. Claude-Session: https://claude.ai/code/session_016mBLURvJoMuUEr9cB2RpUN --- charts/terdut-server/values.yaml | 5 ++++- docs/configuration.md | 2 +- 2 files changed, 5 insertions(+), 2 deletions(-) diff --git a/charts/terdut-server/values.yaml b/charts/terdut-server/values.yaml index 732b82d..618794e 100644 --- a/charts/terdut-server/values.yaml +++ b/charts/terdut-server/values.yaml @@ -120,8 +120,11 @@ operatorMode: false # empty turns the feature off. Entries are host names, with "*" as one DNS label # and a leading "**" as one or more (e.g. "*.monitoring.svc.cluster.local", # "prometheus-*.monitoring"), IPs or CIDR ranges, each with an optional ":port". +# The default is the Prometheus that kube-prometheus-stack installs; set it to +# [] to turn the feature off. prometheus: - allowedHosts: [] + allowedHosts: + - kube-prometheus-stack-prometheus.kube-prometheus-stack:9090 # How far before an alert started its graph begins. preroll: 1h timeout: 10s diff --git a/docs/configuration.md b/docs/configuration.md index 0a02bc6..5ea9841 100644 --- a/docs/configuration.md +++ b/docs/configuration.md @@ -30,7 +30,7 @@ over an administrator's edit. | `TERDUT_TRUSTED_PROXIES` | `1` | How many reverse proxies in front of the server append to `X-Forwarded-For`; the per-address rate limits use the entry that many hops from the right. `0` ignores the header | | `TERDUT_OPERATOR_KEY` | — | At least 32 characters. When set, the instance-scoped service account `terdut-operator` is created if missing and its `seed` key replaced with this value at every start — how terdut-operator authenticates without a bootstrap handshake. An instance-scoped account acts as owner of every team (team configuration) but is not a member of any, so it reads no incidents | | `TERDUT_OPERATOR_MODE` | `false` | Declares this install gitops-managed: a session's or a user's own API key's writes to teams, escalation policies, dead man's switches and integrations are refused (`403 reason:"operator_managed"`); a [service account](./api.md#service-accounts)'s are not. Team membership and the schedule stay editable regardless | -| `TERDUT_PROMETHEUS_ALLOWED_HOSTS` | — | Comma-separated Prometheus servers the [metrics on an incident](./metrics.md) may be fetched from, matched against the host in each alert's `generatorURL`. Host names (`prometheus.monitoring.svc`), wildcards (`*` is one DNS label, so `*.example.com` or `prom-*.monitoring.svc`; a leading `**` is one or more labels), IPs or CIDR ranges, each with an optional `:port`. Empty turns the feature off. A bare `*` is refused at startup | +| `TERDUT_PROMETHEUS_ALLOWED_HOSTS` | — (the Helm chart defaults to `kube-prometheus-stack-prometheus.kube-prometheus-stack:9090`) | Comma-separated Prometheus servers the [metrics on an incident](./metrics.md) may be fetched from, matched against the host in each alert's `generatorURL`. Host names (`prometheus.monitoring.svc`), wildcards (`*` is one DNS label, so `*.example.com` or `prom-*.monitoring.svc`; a leading `**` is one or more labels), IPs or CIDR ranges, each with an optional `:port`. Empty turns the feature off. A bare `*` is refused at startup | | `TERDUT_PROMETHEUS_PREROLL` | `1h` | How far before an alert started its metrics graph begins | | `TERDUT_PROMETHEUS_TIMEOUT` | `10s` | Per-request timeout for a Prometheus query | | `TERDUT_OIDC_ISSUER` | — | Turns single sign-on on. The provider's issuer URL; discovery is read from `/.well-known/openid-configuration`. See [Single sign-on](./single-sign-on.md#single-sign-on-oidc) |