trying stuff

Signed-off-by: Valentin Daviot <[email protected]>

Author: vdaviot

charts/kube-prometheus-stack/values.yaml

@@ -1172,15 +1172,15 @@ alertmanager:
     clusterAdvertiseAddress: false
 
     ## clusterGossipInterval determines interval between gossip attempts.
-    ## Needs to be specified as GoDuration, a time duration that can be parsed by Go’s time.ParseDuration() (e.g. 45ms, 30s, 1m, 1h20m15s)
+    ## Needs to be specified as GoDuration, a time duration that can be parsed by Go's time.ParseDuration() (e.g. 45ms, 30s, 1m, 1h20m15s)
     clusterGossipInterval: ""
 
     ## clusterPeerTimeout determines timeout for cluster peering.
-    ## Needs to be specified as GoDuration, a time duration that can be parsed by Go’s time.ParseDuration() (e.g. 45ms, 30s, 1m, 1h20m15s)
+    ## Needs to be specified as GoDuration, a time duration that can be parsed by Go's time.ParseDuration() (e.g. 45ms, 30s, 1m, 1h20m15s)
     clusterPeerTimeout: ""
 
     ## clusterPushpullInterval determines interval between pushpull attempts.
-    ## Needs to be specified as GoDuration, a time duration that can be parsed by Go’s time.ParseDuration() (e.g. 45ms, 30s, 1m, 1h20m15s)
+    ## Needs to be specified as GoDuration, a time duration that can be parsed by Go's time.ParseDuration() (e.g. 45ms, 30s, 1m, 1h20m15s)
     clusterPushpullInterval: ""
 
     ## clusterLabel defines the identifier that uniquely identifies the Alertmanager cluster.
@@ -2911,7 +2911,7 @@ prometheusOperator:
 
     # Use certmanager to generate webhook certs
     certManager:
-      enabled: false
+      enabled: true
       # self-signed root certificate
       rootCert:
         duration: ""  # default to be 5y
@@ -3859,9 +3859,9 @@ prometheus:
     disableCompaction: false
 
     ## AutomountServiceAccountToken indicates whether a service account token should be automatically mounted in the pod,
-    ## If the field isn’t set, the operator mounts the service account token by default.
+    ## If the field isn't set, the operator mounts the service account token by default.
     ## Warning: be aware that by default, Prometheus requires the service account token for Kubernetes service discovery,
-    ## It is possible to use strategic merge patch to project the service account token into the ‘prometheus’ container.
+    ## It is possible to use strategic merge patch to project the service account token into the 'prometheus' container.
     automountServiceAccountToken: true
 
     ## APIServerConfig
@@ -4567,7 +4567,7 @@ prometheus:
     hostNetwork: false
 
     # HostAlias holds the mapping between IP and hostnames that will be injected
-    # as an entry in the pod’s hosts file.
+    # as an entry in the pod's hosts file.
     hostAliases: []
     #  - ip: 10.10.0.100
     #    hostnames:
@@ -4579,7 +4579,7 @@ prometheus:
     tracingConfig: {}
 
     ## Defines the service discovery role used to discover targets from ServiceMonitor objects and Alertmanager endpoints.
-    ## If set, the value should be either “Endpoints” or “EndpointSlice”. If unset, the operator assumes the “Endpoints” role.
+    ## If set, the value should be either "Endpoints" or "EndpointSlice". If unset, the operator assumes the "Endpoints" role.
     serviceDiscoveryRole: ""
 
     ## Additional configuration which is not covered by the properties above. (passed through tpl)

salt/metalk8s/addons/prometheus-operator/deployed/chart.sls

@@ -75365,6 +75365,50 @@ spec:
     operator: Exists
   version: v0.28.1
 ---
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: prometheus-operator-root-cert
+  namespace: metalk8s-monitoring
+spec:
+  commonName: ca.webhook.kube-prometheus-stack
+  duration: 43800h0m0s
+  isCA: true
+  issuerRef:
+    name: prometheus-operator-self-signed-issuer
+  secretName: prometheus-operator-root-cert
+---
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: prometheus-operator-admission
+  namespace: metalk8s-monitoring
+spec:
+  dnsNames:
+  - prometheus-operator-operator
+  - prometheus-operator-operator.metalk8s-monitoring.svc
+  duration: 8760h0m0s
+  issuerRef:
+    name: prometheus-operator-root-issuer
+  secretName: prometheus-operator-admission
+---
+apiVersion: cert-manager.io/v1
+kind: Issuer
+metadata:
+  name: prometheus-operator-self-signed-issuer
+  namespace: metalk8s-monitoring
+spec:
+  selfSigned: {}
+---
+apiVersion: cert-manager.io/v1
+kind: Issuer
+metadata:
+  name: prometheus-operator-root-issuer
+  namespace: metalk8s-monitoring
+spec:
+  ca:
+    secretName: prometheus-operator-root-cert
+---
 apiVersion: monitoring.coreos.com/v1
 kind: Prometheus
 metadata: