Skip to content

Monitoring

The Big Bang Monitoring package wraps the version-pinned kube-prometheus-stack chart with Big Bang image, security, networking, mesh, route, rule, and test integration. It deploys Prometheus and Alertmanager in the monitoring namespace. The Prometheus Operator CRDs package must be installed first.

Configure the umbrella package with the canonical packages.monitoring key. The legacy monitoring key remains supported for compatibility. Package values are passed beneath packages.monitoring.values; general kube-prometheus-stack values belong beneath that package’s upstream parent. See the version-matched upstream values for the full upstream configuration surface.

packages:
  monitoring:
    values:
      upstream:
        prometheus:
          prometheusSpec:
            retention: 15d

Big Bang integration

  • The umbrella release depends on Prometheus Operator CRDs and conditionally on cert-manager, Istio, Gatekeeper, Kyverno policies, and Vault. The umbrella owns source selection, release ordering, credentials, and cross-package backend configuration.
  • Prometheus and Alertmanager routes, network policies, authorization policies, and service-monitor integration are package-owned. In sidecar mode, the umbrella applies a post-renderer for the operator ServiceMonitor; ambient mode omits that sidecar-specific behavior.
  • Prometheus uses ServiceMonitor and PodMonitor resources for discovery. The bundled stack supplies its enabled component monitors; workload packages own monitors for their own services. Review selector, target-count, label, memory, and retention effects before broadening scrape discovery.
  • The optional SNMP and blackbox exporters are disabled by default. Configure their exporter-specific top-level values and necessary egress policy only when they are enabled. See the SNMP exporter guide and blackbox exporter upstream documentation.

Storage and availability

Prometheus and Alertmanager persistence and replica configuration are upstream values under upstream. Plan storage class, capacity, backup, recovery, and rollback before changing them. For replica and Thanos patterns, use the upstream high-availability guidance and coordinate long-term storage or remote-write backends through umbrella-owned package integration.

Access and security

When the umbrella enables Monitoring SSO, it supplies Prometheus and Alertmanager OIDC client credentials and Authservice integration. Configure those credentials through the umbrella rather than committing them to package values. See Keycloak/SSO configuration for the package behavior.

NetworkPolicy and Istio defaults restrict traffic to the Kubernetes API, scrape targets, ingress gateway, and enabled integrations. Strict sidecar mTLS requires shared workload certificates and HTTPS scrape configuration; ambient mode must not use sidecar-only wiring. See Istio mTLS metrics for that package-specific operational contract.

Grafana has a separate Big Bang package and owner. This package does not own Grafana persistence, scaling, authentication, dashboards, or its upstream configuration. Prometheus Operator CRD installation and lifecycle are likewise owned by the separate Prometheus Operator CRDs package.

Operations

The package adds Flux and Istio monitors and rules. Validate targets, queries, Watchdog alert delivery, storage durability, and authenticated routes in an appropriate integration environment; chart lint and unit tests cannot provide that evidence. The optional cleanUpgrade.enabled job deletes prior kube-state-metrics Deployments or StatefulSets with orphan cascading and is only appropriate for a documented upstream immutable-field migration.

See the development and maintenance guide for maintainer procedures and these package guides for focused topics: