feat(container): update kube-prometheus-stack ( 70.3.0 → 70.4.0 )

[layla-bot]

This PR contains the following updates:

Package	Update	Change
kube-prometheus-stack (source)	minor	70.3.0 -> 70.4.0

---

Release Notes

prometheus-community/helm-charts (kube-prometheus-stack)

v70.4.0

Compare Source

kube-prometheus-stack collects Kubernetes manifests, Grafana dashboards, and Prometheus rules combined with documentation and scripts to provide easy to operate end-to-end Kubernetes cluster monitoring with Prometheus using the Prometheus Operator.

What's Changed

• [CI] Update github-workflow dependency updates by @​renovate in https://github.com/prometheus-community/helm-charts/pull/5494
• [ci] renovate post upgrade hooks: use local files instead shell variables by @​jkroepke in https://github.com/prometheus-community/helm-charts/pull/5496
• [kube-prometheus-stack] Update kube-prometheus-stack dependency non-major updates by @​renovate in https://github.com/prometheus-community/helm-charts/pull/5495

Full Changelog: prometheus-community/helm-charts@prometheus-elasticsearch-exporter-6.7.1...kube-prometheus-stack-70.4.0

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Renovate Bot.

[layla-bot]

--- kubernetes/apps/observability/kube-prometheus-stack/app Kustomization: observability/kube-prometheus-stack HelmRelease: observability/kube-prometheus-stack

+++ kubernetes/apps/observability/kube-prometheus-stack/app Kustomization: observability/kube-prometheus-stack HelmRelease: observability/kube-prometheus-stack

@@ -13,13 +13,13 @@

     spec:
       chart: kube-prometheus-stack
       sourceRef:
         kind: HelmRepository
         name: prometheus-community
         namespace: flux-system
-      version: 70.3.0
+      version: 70.4.0
   dependsOn:
   - name: kube-prometheus-stack-crds
     namespace: observability
   - name: openebs
     namespace: openebs-system
   install:

[layla-bot]

--- HelmRelease: observability/kube-prometheus-stack PrometheusRule: observability/kube-prometheus-stack-alertmanager.rules

+++ HelmRelease: observability/kube-prometheus-stack PrometheusRule: observability/kube-prometheus-stack-alertmanager.rules

@@ -50,15 +50,15 @@

           to send {{ $value | humanizePercentage }} of notifications to {{ $labels.integration
           }}.
         runbook_url: https://runbooks.prometheus-operator.dev/runbooks/alertmanager/alertmanagerfailedtosendalerts
         summary: An Alertmanager instance failed to send notifications.
       expr: |-
         (
-          rate(alertmanager_notifications_failed_total{job="kube-prometheus-stack-alertmanager",namespace="observability"}[5m])
+          rate(alertmanager_notifications_failed_total{job="kube-prometheus-stack-alertmanager",namespace="observability"}[15m])
         /
-          ignoring (reason) group_left rate(alertmanager_notifications_total{job="kube-prometheus-stack-alertmanager",namespace="observability"}[5m])
+          ignoring (reason) group_left rate(alertmanager_notifications_total{job="kube-prometheus-stack-alertmanager",namespace="observability"}[15m])
         )
         > 0.01
       for: 5m
       labels:
         severity: warning
     - alert: AlertmanagerClusterFailedToSendAlerts
@@ -68,15 +68,15 @@

           humanizePercentage }}.
         runbook_url: https://runbooks.prometheus-operator.dev/runbooks/alertmanager/alertmanagerclusterfailedtosendalerts
         summary: All Alertmanager instances in a cluster failed to send notifications
           to a critical integration.
       expr: |-
         min by (namespace,service, integration) (
-          rate(alertmanager_notifications_failed_total{job="kube-prometheus-stack-alertmanager",namespace="observability", integration=~`.*`}[5m])
+          rate(alertmanager_notifications_failed_total{job="kube-prometheus-stack-alertmanager",namespace="observability", integration=~`.*`}[15m])
         /
-          ignoring (reason) group_left rate(alertmanager_notifications_total{job="kube-prometheus-stack-alertmanager",namespace="observability", integration=~`.*`}[5m])
+          ignoring (reason) group_left rate(alertmanager_notifications_total{job="kube-prometheus-stack-alertmanager",namespace="observability", integration=~`.*`}[15m])
         )
         > 0.01
       for: 5m
       labels:
         severity: critical
     - alert: AlertmanagerClusterFailedToSendAlerts
@@ -86,15 +86,15 @@

           humanizePercentage }}.
         runbook_url: https://runbooks.prometheus-operator.dev/runbooks/alertmanager/alertmanagerclusterfailedtosendalerts
         summary: All Alertmanager instances in a cluster failed to send notifications
           to a non-critical integration.
       expr: |-
         min by (namespace,service, integration) (
-          rate(alertmanager_notifications_failed_total{job="kube-prometheus-stack-alertmanager",namespace="observability", integration!~`.*`}[5m])
+          rate(alertmanager_notifications_failed_total{job="kube-prometheus-stack-alertmanager",namespace="observability", integration!~`.*`}[15m])
         /
-          ignoring (reason) group_left rate(alertmanager_notifications_total{job="kube-prometheus-stack-alertmanager",namespace="observability", integration!~`.*`}[5m])
+          ignoring (reason) group_left rate(alertmanager_notifications_total{job="kube-prometheus-stack-alertmanager",namespace="observability", integration!~`.*`}[15m])
         )
         > 0.01
       for: 5m
       labels:
         severity: warning
     - alert: AlertmanagerConfigInconsistent
--- HelmRelease: observability/kube-prometheus-stack PrometheusRule: observability/kube-prometheus-stack-kubernetes-resources

+++ HelmRelease: observability/kube-prometheus-stack PrometheusRule: observability/kube-prometheus-stack-kubernetes-resources

@@ -118,13 +118,13 @@

           {{ $labels.namespace }} for container {{ $labels.container }} in pod {{
           $labels.pod }} on cluster {{ $labels.cluster }}.'
         runbook_url: https://runbooks.prometheus-operator.dev/runbooks/kubernetes/cputhrottlinghigh
         summary: Processes experience elevated CPU throttling.
       expr: |-
         sum(increase(container_cpu_cfs_throttled_periods_total{container!="", job="kubelet", metrics_path="/metrics/cadvisor", }[5m])) without (id, metrics_path, name, image, endpoint, job, node)
-          /
+          / on (cluster, namespace, pod, container, instance) group_left
         sum(increase(container_cpu_cfs_periods_total{job="kubelet", metrics_path="/metrics/cadvisor", }[5m])) without (id, metrics_path, name, image, endpoint, job, node)
           > ( 25 / 100 )
       for: 15m
       labels:
         severity: info
 
--- HelmRelease: observability/kube-prometheus-stack PrometheusRule: observability/kube-prometheus-stack-kubernetes-system-kubelet

+++ HelmRelease: observability/kube-prometheus-stack PrometheusRule: observability/kube-prometheus-stack-kubernetes-system-kubelet

@@ -25,12 +25,26 @@

         kube_node_status_condition{job="kube-state-metrics",condition="Ready",status="true"} == 0
         and on (cluster, node)
         kube_node_spec_unschedulable{job="kube-state-metrics"} == 0
       for: 15m
       labels:
         severity: warning
+    - alert: KubeNodePressure
+      annotations:
+        description: '{{ $labels.node }} on cluster {{ $labels.cluster }} has active
+          Condition {{ $labels.condition }}. This is caused by resource usage exceeding
+          eviction thresholds.'
+        runbook_url: https://runbooks.prometheus-operator.dev/runbooks/kubernetes/kubenodepressure
+        summary: Node has as active Condition.
+      expr: |-
+        kube_node_status_condition{job="kube-state-metrics",condition=~"(MemoryPressure|DiskPressure|PIDPressure)",status="true"} == 1
+        and on (cluster, node)
+        kube_node_spec_unschedulable{job="kube-state-metrics"} == 0
+      for: 10m
+      labels:
+        severity: info
     - alert: KubeNodeUnreachable
       annotations:
         description: '{{ $labels.node }} is unreachable and some workloads may be
           rescheduled on cluster {{ $labels.cluster }}.'
         runbook_url: https://runbooks.prometheus-operator.dev/runbooks/kubernetes/kubenodeunreachable
         summary: Node is unreachable.
@@ -73,12 +87,30 @@

         sum(changes(kube_node_status_condition{job="kube-state-metrics",status="true",condition="Ready"}[15m])) by (cluster, node) > 2
         and on (cluster, node)
         kube_node_spec_unschedulable{job="kube-state-metrics"} == 0
       for: 15m
       labels:
         severity: warning
+    - alert: KubeNodeEviction
+      annotations:
+        description: Node {{ $labels.node }} on {{ $labels.cluster }} is evicting
+          Pods due to {{ $labels.eviction_signal }}.  Eviction occurs when eviction
+          thresholds are crossed, typically caused by Pods exceeding RAM/ephemeral-storage
+          limits.
+        runbook_url: https://runbooks.prometheus-operator.dev/runbooks/kubernetes/kubenodeeviction
+        summary: Node is evicting pods.
+      expr: |-
+        sum(rate(kubelet_evictions{job="kubelet", metrics_path="/metrics"}[15m])) by (cluster, eviction_signal, instance)
+        * on (cluster, instance) group_left(node)
+        max by (cluster, instance, node) (
+          kubelet_node_name{job="kubelet", metrics_path="/metrics"}
+        )
+        > 0
+      for: 0s
+      labels:
+        severity: info
     - alert: KubeletPlegDurationHigh
       annotations:
         description: The Kubelet Pod Lifecycle Event Generator has a 99th percentile
           duration of {{ $value }} seconds on node {{ $labels.node }} on cluster {{
           $labels.cluster }}.
         runbook_url: https://runbooks.prometheus-operator.dev/runbooks/kubernetes/kubeletplegdurationhigh
--- HelmRelease: observability/kube-prometheus-stack Job: observability/kube-prometheus-stack-admission-create

+++ HelmRelease: observability/kube-prometheus-stack Job: observability/kube-prometheus-stack-admission-create

@@ -30,13 +30,13 @@

         heritage: Helm
         app.kubernetes.io/name: kube-prometheus-stack-prometheus-operator
         app.kubernetes.io/component: prometheus-operator-webhook
     spec:
       containers:
       - name: create
-        image: registry.k8s.io/ingress-nginx/kube-webhook-certgen:v1.5.1
+        image: registry.k8s.io/ingress-nginx/kube-webhook-certgen:v1.5.2
         imagePullPolicy: IfNotPresent
         args:
         - create
         - --host=kube-prometheus-stack-operator,kube-prometheus-stack-operator.observability.svc
         - --namespace=observability
         - --secret-name=kube-prometheus-stack-admission
--- HelmRelease: observability/kube-prometheus-stack Job: observability/kube-prometheus-stack-admission-patch

+++ HelmRelease: observability/kube-prometheus-stack Job: observability/kube-prometheus-stack-admission-patch

@@ -30,13 +30,13 @@

         heritage: Helm
         app.kubernetes.io/name: kube-prometheus-stack-prometheus-operator
         app.kubernetes.io/component: prometheus-operator-webhook
     spec:
       containers:
       - name: patch
-        image: registry.k8s.io/ingress-nginx/kube-webhook-certgen:v1.5.1
+        image: registry.k8s.io/ingress-nginx/kube-webhook-certgen:v1.5.2
         imagePullPolicy: IfNotPresent
         args:
         - patch
         - --webhook-name=kube-prometheus-stack-admission
         - --namespace=observability
         - --secret-name=kube-prometheus-stack-admission