feat(container)!: Update image thanos to v15

[obocaman]

This PR contains the following updates:

Package	Update	Change
thanos (source)	major	12.23.1 -> 15.4.4

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Configuration

📅 Schedule: Branch creation - "on saturday" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Renovate Bot.

[github-actions]

--- kubernetes/apps/observability/thanos/app Kustomization: flux-system/cluster-apps-thanos HelmRelease: observability/thanos

+++ kubernetes/apps/observability/thanos/app Kustomization: flux-system/cluster-apps-thanos HelmRelease: observability/thanos

@@ -10,13 +10,13 @@

       chart: thanos
       interval: 5m
       sourceRef:
         kind: HelmRepository
         name: bitnami
         namespace: flux-system
-      version: 12.23.1
+      version: 15.0.4
   dependsOn:
   - name: kube-prometheus-stack
     namespace: observability
   - name: local-path-provisioner
     namespace: kube-system
   - name: rook-ceph-cluster

[github-actions]

--- kubernetes HelmRelease: observability/thanos NetworkPolicy: observability/thanos-compactor

+++ kubernetes HelmRelease: observability/thanos NetworkPolicy: observability/thanos-compactor

@@ -0,0 +1,27 @@

+---
+kind: NetworkPolicy
+apiVersion: networking.k8s.io/v1
+metadata:
+  name: thanos-compactor
+  namespace: observability
+  labels:
+    app.kubernetes.io/instance: thanos
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
+    app.kubernetes.io/component: compactor
+spec:
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/instance: thanos
+      app.kubernetes.io/name: thanos
+      app.kubernetes.io/component: compactor
+  policyTypes:
+  - Ingress
+  - Egress
+  egress:
+  - {}
+  ingress:
+  - ports:
+    - port: 10902
+    - port: 9090
+
--- kubernetes HelmRelease: observability/thanos Deployment: observability/thanos-query-frontend

+++ kubernetes HelmRelease: observability/thanos Deployment: observability/thanos-query-frontend

@@ -55,22 +55,23 @@

           allowPrivilegeEscalation: false
           capabilities:
             drop:
             - ALL
           privileged: false
           readOnlyRootFilesystem: true
+          runAsGroup: 1001
           runAsNonRoot: true
           runAsUser: 1001
-          seLinuxOptions: null
+          seLinuxOptions: {}
           seccompProfile:
             type: RuntimeDefault
         args:
         - query-frontend
         - --log.level=info
         - --log.format=logfmt
-        - --http-address=0.0.0.0:10902
+        - --http-address=0.0.0.0:9090
         - --query-frontend.downstream-url=http://thanos-query:9090
         - |-
           --query-range.response-cache-config="config":
             "addr": "redis-headless.datahub.svc.cluster.local:26379"
             "username": ""
             "password": ""
@@ -104,13 +105,13 @@

             "cache_size": 0
             "expiration": "24h0m0s"
             "master_name": "redis-master"
           "type": "redis"
         ports:
         - name: http
-          containerPort: 10902
+          containerPort: 9090
           protocol: TCP
         livenessProbe:
           failureThreshold: 6
           initialDelaySeconds: 30
           periodSeconds: 10
           successThreshold: 1
@@ -127,11 +128,17 @@

           timeoutSeconds: 30
           httpGet:
             path: /-/ready
             port: http
             scheme: HTTP
         resources:
-          limits: {}
-          requests: {}
+          limits:
+            cpu: 150m
+            ephemeral-storage: 1024Mi
+            memory: 192Mi
+          requests:
+            cpu: 100m
+            ephemeral-storage: 50Mi
+            memory: 128Mi
         volumeMounts: null
       volumes: null
 
--- kubernetes HelmRelease: observability/thanos NetworkPolicy: observability/thanos-query-frontend

+++ kubernetes HelmRelease: observability/thanos NetworkPolicy: observability/thanos-query-frontend

@@ -0,0 +1,27 @@

+---
+kind: NetworkPolicy
+apiVersion: networking.k8s.io/v1
+metadata:
+  name: thanos-query-frontend
+  namespace: observability
+  labels:
+    app.kubernetes.io/instance: thanos
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
+    app.kubernetes.io/component: query-frontend
+spec:
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/instance: thanos
+      app.kubernetes.io/name: thanos
+      app.kubernetes.io/component: query-frontend
+  policyTypes:
+  - Ingress
+  - Egress
+  egress:
+  - {}
+  ingress:
+  - ports:
+    - port: 9090
+    - port: 9090
+
--- kubernetes HelmRelease: observability/thanos ServiceAccount: observability/thanos

+++ kubernetes HelmRelease: observability/thanos ServiceAccount: observability/thanos

@@ -1,13 +0,0 @@

----
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: thanos
-  namespace: observability
-  labels:
-    app.kubernetes.io/instance: thanos
-    app.kubernetes.io/managed-by: Helm
-    app.kubernetes.io/name: thanos
-    app.kubernetes.io/component: storegateway
-automountServiceAccountToken: false
-
--- kubernetes HelmRelease: observability/thanos NetworkPolicy: observability/thanos-bucketweb

+++ kubernetes HelmRelease: observability/thanos NetworkPolicy: observability/thanos-bucketweb

@@ -0,0 +1,27 @@

+---
+kind: NetworkPolicy
+apiVersion: networking.k8s.io/v1
+metadata:
+  name: thanos-bucketweb
+  namespace: observability
+  labels:
+    app.kubernetes.io/instance: thanos
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
+    app.kubernetes.io/component: bucketweb
+spec:
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/instance: thanos
+      app.kubernetes.io/name: thanos
+      app.kubernetes.io/component: bucketweb
+  policyTypes:
+  - Ingress
+  - Egress
+  egress:
+  - {}
+  ingress:
+  - ports:
+    - port: 8080
+    - port: 8080
+
--- kubernetes HelmRelease: observability/thanos Deployment: observability/thanos-bucketweb

+++ kubernetes HelmRelease: observability/thanos Deployment: observability/thanos-bucketweb

@@ -24,13 +24,13 @@

       labels:
         app.kubernetes.io/instance: thanos
         app.kubernetes.io/managed-by: Helm
         app.kubernetes.io/name: thanos
         app.kubernetes.io/component: bucketweb
       annotations:
-        checksum/objstore-configuration: 256268cc9c223b01f705f71bd06a9645c74b2ad46ab22b46b31d68e3f34e61a5
+        checksum/objstore-configuration: ad0fe7703e3971c0a9fef7ac45a3321986468cf50c70c094cff319483f4a559d
     spec:
       serviceAccountName: thanos-bucketweb
       automountServiceAccountToken: true
       affinity:
         podAffinity: null
         podAntiAffinity:
@@ -57,15 +57,16 @@

           allowPrivilegeEscalation: false
           capabilities:
             drop:
             - ALL
           privileged: false
           readOnlyRootFilesystem: true
+          runAsGroup: 1001
           runAsNonRoot: true
           runAsUser: 1001
-          seLinuxOptions: null
+          seLinuxOptions: {}
           seccompProfile:
             type: RuntimeDefault
         args:
         - tools
         - bucket
         - web
@@ -97,14 +98,20 @@

           timeoutSeconds: 30
           httpGet:
             path: /-/ready
             port: http
             scheme: HTTP
         resources:
-          limits: {}
-          requests: {}
+          limits:
+            cpu: 150m
+            ephemeral-storage: 1024Mi
+            memory: 192Mi
+          requests:
+            cpu: 100m
+            ephemeral-storage: 50Mi
+            memory: 128Mi
         volumeMounts:
         - name: objstore-config
           mountPath: /conf
       volumes:
       - name: objstore-config
         secret:
--- kubernetes HelmRelease: observability/thanos NetworkPolicy: observability/thanos-ruler

+++ kubernetes HelmRelease: observability/thanos NetworkPolicy: observability/thanos-ruler

@@ -0,0 +1,29 @@

+---
+kind: NetworkPolicy
+apiVersion: networking.k8s.io/v1
+metadata:
+  name: thanos-ruler
+  namespace: observability
+  labels:
+    app.kubernetes.io/instance: thanos
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
+    app.kubernetes.io/component: ruler
+spec:
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/instance: thanos
+      app.kubernetes.io/name: thanos
+      app.kubernetes.io/component: ruler
+  policyTypes:
+  - Ingress
+  - Egress
+  egress:
+  - {}
+  ingress:
+  - ports:
+    - port: 10902
+    - port: 9090
+    - port: 10901
+    - port: 10901
+
--- kubernetes HelmRelease: observability/thanos NetworkPolicy: observability/thanos-receive

+++ kubernetes HelmRelease: observability/thanos NetworkPolicy: observability/thanos-receive

@@ -0,0 +1,31 @@

+---
+kind: NetworkPolicy
+apiVersion: networking.k8s.io/v1
+metadata:
+  name: thanos-receive
+  namespace: observability
+  labels:
+    app.kubernetes.io/instance: thanos
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
+    app.kubernetes.io/component: receive
+spec:
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/instance: thanos
+      app.kubernetes.io/name: thanos
+      app.kubernetes.io/component: receive
+  policyTypes:
+  - Ingress
+  - Egress
+  egress:
+  - {}
+  ingress:
+  - ports:
+    - port: 10902
+    - port: 10902
+    - port: 10901
+    - port: 10901
+    - port: 19291
+    - port: 19291
+
--- kubernetes HelmRelease: observability/thanos StatefulSet: observability/thanos-storegateway

+++ kubernetes HelmRelease: observability/thanos StatefulSet: observability/thanos-storegateway

@@ -26,13 +26,13 @@

       labels:
         app.kubernetes.io/instance: thanos
         app.kubernetes.io/managed-by: Helm
         app.kubernetes.io/name: thanos
         app.kubernetes.io/component: storegateway
       annotations:
-        checksum/objstore-configuration: 256268cc9c223b01f705f71bd06a9645c74b2ad46ab22b46b31d68e3f34e61a5
+        checksum/objstore-configuration: ad0fe7703e3971c0a9fef7ac45a3321986468cf50c70c094cff319483f4a559d
     spec:
       serviceAccountName: thanos-storegateway
       automountServiceAccountToken: true
       affinity:
         podAffinity: null
         podAntiAffinity:
@@ -57,15 +57,16 @@

           allowPrivilegeEscalation: false
           capabilities:
             drop:
             - ALL
           privileged: false
           readOnlyRootFilesystem: true
+          runAsGroup: 1001
           runAsNonRoot: true
           runAsUser: 1001
-          seLinuxOptions: null
+          seLinuxOptions: {}
           seccompProfile:
             type: RuntimeDefault
         args:
         - store
         - --log.level=info
         - --log.format=logfmt
@@ -116,14 +117,20 @@

           timeoutSeconds: 30
           httpGet:
             path: /-/ready
             port: http
             scheme: HTTP
         resources:
-          limits: {}
-          requests: {}
+          limits:
+            cpu: 150m
+            ephemeral-storage: 1024Mi
+            memory: 192Mi
+          requests:
+            cpu: 100m
+            ephemeral-storage: 50Mi
+            memory: 128Mi
         volumeMounts:
         - name: objstore-config
           mountPath: /conf
         - name: data
           mountPath: /data
       volumes:
--- kubernetes HelmRelease: observability/thanos NetworkPolicy: observability/thanos-query

+++ kubernetes HelmRelease: observability/thanos NetworkPolicy: observability/thanos-query

@@ -0,0 +1,29 @@

+---
+kind: NetworkPolicy
+apiVersion: networking.k8s.io/v1
+metadata:
+  name: thanos-query
+  namespace: observability
+  labels:
+    app.kubernetes.io/instance: thanos
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
+    app.kubernetes.io/component: query
+spec:
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/instance: thanos
+      app.kubernetes.io/name: thanos
+      app.kubernetes.io/component: query
+  policyTypes:
+  - Ingress
+  - Egress
+  egress:
+  - {}
+  ingress:
+  - ports:
+    - port: 10902
+    - port: 10901
+    - port: 9090
+    - port: 10901
+
--- kubernetes HelmRelease: observability/thanos Deployment: observability/thanos-query

+++ kubernetes HelmRelease: observability/thanos Deployment: observability/thanos-query

@@ -55,26 +55,27 @@

           allowPrivilegeEscalation: false
           capabilities:
             drop:
             - ALL
           privileged: false
           readOnlyRootFilesystem: true
+          runAsGroup: 1001
           runAsNonRoot: true
           runAsUser: 1001
-          seLinuxOptions: null
+          seLinuxOptions: {}
           seccompProfile:
             type: RuntimeDefault
         args:
         - query
         - --log.level=debug
         - --log.format=logfmt
         - --grpc-address=0.0.0.0:10901
         - --http-address=0.0.0.0:10902
         - --query.replica-label=__replica__
         - --endpoint=dnssrv+_grpc._tcp.thanos-storegateway.observability.svc.cluster.local
-        - --alert.query-url=http://thanos-query-frontend.${SECRET_DOMAIN}
+        - --alert.query-url=https://thanos-query-frontend.${SECRET_DOMAIN}
         ports:
         - name: http
           containerPort: 10902
           protocol: TCP
         - name: grpc
           containerPort: 10901
@@ -97,11 +98,17 @@

           timeoutSeconds: 30
           httpGet:
             path: /-/ready
             port: http
             scheme: HTTP
         resources:
-          limits: {}
-          requests: {}
+          limits:
+            cpu: 150m
+            ephemeral-storage: 1024Mi
+            memory: 192Mi
+          requests:
+            cpu: 100m
+            ephemeral-storage: 50Mi
+            memory: 128Mi
         volumeMounts: null
       volumes: null
 
--- kubernetes HelmRelease: observability/thanos NetworkPolicy: observability/thanos-storegateway

+++ kubernetes HelmRelease: observability/thanos NetworkPolicy: observability/thanos-storegateway

@@ -0,0 +1,29 @@

+---
+kind: NetworkPolicy
+apiVersion: networking.k8s.io/v1
+metadata:
+  name: thanos-storegateway
+  namespace: observability
+  labels:
+    app.kubernetes.io/instance: thanos
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: thanos
+    app.kubernetes.io/component: storegateway
+spec:
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/instance: thanos
+      app.kubernetes.io/name: thanos
+      app.kubernetes.io/component: storegateway
+  policyTypes:
+  - Ingress
+  - Egress
+  egress:
+  - {}
+  ingress:
+  - ports:
+    - port: 10902
+    - port: 9090
+    - port: 10901
+    - port: 10901
+
--- kubernetes HelmRelease: observability/thanos Deployment: observability/thanos-compactor

+++ kubernetes HelmRelease: observability/thanos Deployment: observability/thanos-compactor

@@ -24,13 +24,13 @@

       labels:
         app.kubernetes.io/instance: thanos
         app.kubernetes.io/managed-by: Helm
         app.kubernetes.io/name: thanos
         app.kubernetes.io/component: compactor
       annotations:
-        checksum/objstore-configuration: 256268cc9c223b01f705f71bd06a9645c74b2ad46ab22b46b31d68e3f34e61a5
+        checksum/objstore-configuration: ad0fe7703e3971c0a9fef7ac45a3321986468cf50c70c094cff319483f4a559d
     spec:
       serviceAccountName: thanos-compactor
       automountServiceAccountToken: true
       affinity:
         podAffinity: null
         podAntiAffinity:
@@ -57,15 +57,16 @@

           allowPrivilegeEscalation: false
           capabilities:
             drop:
             - ALL
           privileged: false
           readOnlyRootFilesystem: true
+          runAsGroup: 1001
           runAsNonRoot: true
           runAsUser: 1001
-          seLinuxOptions: null
+          seLinuxOptions: {}
           seccompProfile:
             type: RuntimeDefault
         args:
         - compact
         - --log.level=info
         - --log.format=logfmt
@@ -101,14 +102,20 @@

           timeoutSeconds: 30
           httpGet:
             path: /-/ready
             port: http
             scheme: HTTP
         resources:
-          limits: {}
-          requests: {}
+          limits:
+            cpu: 150m
+            ephemeral-storage: 1024Mi
+            memory: 192Mi
+          requests:
+            cpu: 100m
+            ephemeral-storage: 50Mi
+            memory: 128Mi
         volumeMounts:
         - name: objstore-config
           mountPath: /conf
         - name: data
           mountPath: /data
       volumes: