feat: add bot_token_file in TelegramConfig

jsonnet/prometheus-operator/alertmanagerconfigs-crd.json

@@ -3331,7 +3331,7 @@
                                 "type": "string"
                               },
                               "botToken": {
-                                "description": "Telegram bot token The secret needs to be in the same namespace as the AlertmanagerConfig object and accessible by the Prometheus Operator.",
+                                "description": "Telegram bot token. It is mutually exclusive with `botTokenFile`. The secret needs to be in the same namespace as the AlertmanagerConfig object and accessible by the Prometheus Operator. \n Either `botToken` or `botTokenFile` is required.",
                                 "properties": {
                                   "key": {
                                     "description": "The key of the secret to select from.  Must be a valid secret key.",
@@ -3351,6 +3351,10 @@
                                 ],
                                 "type": "object"
                               },
+                              "botTokenFile": {
+                                "description": "File to read the Telegram bot token from. It is mutually exclusive with `botToken`. Either `botToken` or `botTokenFile` is required. \n It requires Alertmanager >= v0.26.0.",
+                                "type": "string"
+                              },
                               "chatID": {
                                 "description": "The Telegram chat ID.",
                                 "format": "int64",

jsonnet/prometheus-operator/alertmanagerconfigs-v1beta1-crd.libsonnet

@@ -3186,7 +3186,7 @@
                             type: 'string',
                           },
                           botToken: {
-                            description: 'Telegram bot token The secret needs to be in the same namespace as the AlertmanagerConfig object and accessible by the Prometheus Operator.',
+                            description: 'Telegram bot token. It is mutually exclusive with `botTokenFile`. The secret needs to be in the same namespace as the AlertmanagerConfig object and accessible by the Prometheus Operator. \n Either `botToken` or `botTokenFile` is required.',
                             properties: {
                               key: {
                                 description: 'The key of the secret to select from.  Must be a valid secret key.',
@@ -3205,6 +3205,10 @@
                             ],
                             type: 'object',
                           },
+                          botTokenFile: {
+                            description: 'File to read the Telegram bot token from. It is mutually exclusive with `botToken`. Either `botToken` or `botTokenFile` is required. \n It requires Alertmanager >= v0.26.0.',
+                            type: 'string',
+                          },
                           chatID: {
                             description: 'The Telegram chat ID.',
                             format: 'int64',

pkg/alertmanager/amcfg.go

@@ -1979,7 +1979,9 @@ func (sc *snsConfig) sanitize(amVersion semver.Version, logger log.Logger) error
 }
 
 func (tc *telegramConfig) sanitize(amVersion semver.Version, logger log.Logger) error {
+	lessThanV0_26 := amVersion.LT(semver.MustParse("0.26.0"))
 	telegramAllowed := amVersion.GTE(semver.MustParse("0.24.0"))
+
 	if !telegramAllowed {
 		return fmt.Errorf(`invalid syntax in receivers config; telegram integration is available in Alertmanager >= 0.24.0`)
 	}
@@ -1988,8 +1990,20 @@ func (tc *telegramConfig) sanitize(amVersion semver.Version, logger log.Logger)
 		return errors.Errorf("mandatory field %q is empty", "chatID")
 	}
 
-	if tc.BotToken == "" {
-		return fmt.Errorf("mandatory field %q is empty", "botToken")
+	if tc.BotTokenFile != "" && lessThanV0_26 {
+		msg := "'bot_token_file' supported in Alertmanager >= 0.26.0 only - dropping field from provided config"
+		level.Warn(logger).Log("msg", msg, "current_version", amVersion.String())
+		tc.BotTokenFile = ""
+	}
+
+	if tc.BotToken == "" && tc.BotTokenFile == "" {
+		return fmt.Errorf("missing mandatory field botToken or botTokenFile")
+	}
+
+	if tc.BotToken != "" && tc.BotTokenFile != "" {
+		msg := "'bot_token' and 'bot_token_file' are mutually exclusive for telegram receiver config - 'bot_token' has taken precedence"
+		level.Warn(logger).Log("msg", msg)
+		tc.BotTokenFile = ""
 	}
 
 	return tc.HTTPConfig.sanitize(amVersion, logger)

pkg/alertmanager/amcfg_test.go

@@ -1964,6 +1964,9 @@ func TestSanitizeConfig(t *testing.T) {
 	versionWebexAllowed := semver.Version{Major: 0, Minor: 25}
 	versionWebexNotAllowed := semver.Version{Major: 0, Minor: 24}
 
+	versionTelegramBotTokenFileAllowed := semver.Version{Major: 0, Minor: 26}
+	versionTelegramBotTokenFileNotAllowed := semver.Version{Major: 0, Minor: 25}
+
 	for _, tc := range []struct {
 		name           string
 		againstVersion semver.Version
@@ -2364,6 +2367,129 @@ func TestSanitizeConfig(t *testing.T) {
 			},
 			expectErr: true,
 		},
+		{
+			name:           "bot_token_file field for Telegram config",
+			againstVersion: versionTelegramBotTokenFileAllowed,
+			in: &alertmanagerConfig{
+				Receivers: []*receiver{
+					{
+						Name: "telegram",
+						TelegramConfigs: []*telegramConfig{
+							{
+								ChatID:       12345,
+								BotTokenFile: "/test",
+							},
+						},
+					},
+				},
+			},
+			expect: alertmanagerConfig{
+				Receivers: []*receiver{
+					{
+						Name: "telegram",
+						TelegramConfigs: []*telegramConfig{
+							{
+								ChatID:       12345,
+								BotTokenFile: "/test",
+							},
+						},
+					},
+				},
+			},
+		},
+		{
+			name:           "bot_token_file and bot_token fields for Telegram config",
+			againstVersion: versionTelegramBotTokenFileAllowed,
+			in: &alertmanagerConfig{
+				Receivers: []*receiver{
+					{
+						Name: "telegram",
+						TelegramConfigs: []*telegramConfig{
+							{
+								ChatID:       12345,
+								BotToken:     "test",
+								BotTokenFile: "/test",
+							},
+						},
+					},
+				},
+			},
+			expect: alertmanagerConfig{
+				Receivers: []*receiver{
+					{
+						Name: "telegram",
+						TelegramConfigs: []*telegramConfig{{
+							ChatID:   12345,
+							BotToken: "test",
+						}},
+					},
+				},
+			},
+		},
+		{
+			name:           "bot_token not specified and bot_token_file is dropped for unsupported versions",
+			againstVersion: versionTelegramBotTokenFileNotAllowed,
+			in: &alertmanagerConfig{
+				Receivers: []*receiver{
+					{
+						Name: "telegram",
+						TelegramConfigs: []*telegramConfig{
+							{
+								ChatID:       12345,
+								BotTokenFile: "/test",
+							},
+						},
+					},
+				},
+			},
+			expectErr: true,
+		},
+		{
+			name:           "bot_token specified and bot_token_file is dropped for unsupported versions",
+			againstVersion: versionTelegramBotTokenFileNotAllowed,
+			in: &alertmanagerConfig{
+				Receivers: []*receiver{
+					{
+						Name: "telegram",
+						TelegramConfigs: []*telegramConfig{
+							{
+								ChatID:       12345,
+								BotToken:     "test",
+								BotTokenFile: "/test",
+							},
+						},
+					},
+				},
+			},
+			expect: alertmanagerConfig{
+				Receivers: []*receiver{
+					{
+						Name: "telegram",
+						TelegramConfigs: []*telegramConfig{{
+							ChatID:   12345,
+							BotToken: "test",
+						}},
+					},
+				},
+			},
+		},
+		{
+			name:           "bot_token and bot_token_file empty",
+			againstVersion: versionTelegramBotTokenFileAllowed,
+			in: &alertmanagerConfig{
+				Receivers: []*receiver{
+					{
+						Name: "telegram",
+						TelegramConfigs: []*telegramConfig{
+							{
+								ChatID: 12345,
+							},
+						},
+					},
+				},
+			},
+			expectErr: true,
+		},
 	} {
 		t.Run(tc.name, func(t *testing.T) {
 			err := tc.in.sanitize(tc.againstVersion, logger)

pkg/alertmanager/types.go

@@ -337,6 +337,7 @@ type telegramConfig struct {
 	VSendResolved        *bool             `yaml:"send_resolved,omitempty" json:"send_resolved,omitempty"`
 	APIUrl               string            `yaml:"api_url,omitempty" json:"api_url,omitempty"`
 	BotToken             string            `yaml:"bot_token,omitempty" json:"bot_token,omitempty"`
+	BotTokenFile         string            `yaml:"bot_token_file,omitempty" json:"bot_token_file,omitempty"`
 	ChatID               int64             `yaml:"chat_id,omitempty" json:"chat_id,omitempty"`
 	Message              string            `yaml:"message,omitempty" json:"message,omitempty"`
 	DisableNotifications bool              `yaml:"disable_notifications,omitempty" json:"disable_notifications,omitempty"`

pkg/alertmanager/validation/v1alpha1/validation.go

@@ -300,8 +300,8 @@ func validateSnsConfigs(configs []monitoringv1alpha1.SNSConfig) error {
 func validateTelegramConfigs(configs []monitoringv1alpha1.TelegramConfig) error {
 	for _, config := range configs {
 
-		if config.BotToken == nil {
-			return fmt.Errorf("mandatory field %q is empty", "botToken")
+		if config.BotToken == nil && config.BotTokenFile == nil {
+			return fmt.Errorf("mandatory field botToken or botTokenfile is empty")
 		}
 
 		if config.ChatID == 0 {