Staging 0.49.1 (#2873)

Co-authored-by: Viktor Forsberg <[email protected]>

Author: elastisys-staffan

changelog/0.49.md

@@ -101,3 +101,13 @@ Released 2025-09-18
 - [#2746](https://github.com/elastisys/compliantkubernetes-apps/pull/2746) - fix: Split network policies tests between Calico & Cilium [@rarescosma](https://github.com/rarescosma)
 - [#2763](https://github.com/elastisys/compliantkubernetes-apps/pull/2763) - bug: apps: remove doubled "spec" field [@rarescosma](https://github.com/rarescosma)
 - [#2764](https://github.com/elastisys/compliantkubernetes-apps/pull/2764) - fix: Cilium test fixes [@rarescosma](https://github.com/rarescosma)
+
+## v0.49.1
+
+Released 2025-11-20
+
+## Changes by kind
+
+### Other(s)
+
+- [#2858](https://github.com/elastisys/compliantkubernetes-apps/pull/2858) - bug: apps wc: move user alertmanager secret to created with install hook [@viktor-f](https://github.com/viktor-f)

helmfile.d/hooks/alertmanager/dev-secret.yaml

@@ -0,0 +1,27 @@
+apiVersion: v1
+kind: Secret
+metadata:
+  name: alertmanager-kube-prometheus-stack-alertmanager
+  namespace: alertmanager
+  labels:
+    app: kube-prometheus-stack-alertmanager
+stringData:
+  alertmanager.yaml: |-
+    global:
+      resolve_timeout: 5m
+    inhibit_rules: []
+    receivers:
+    - name: "null"
+    route:
+      group_by:
+      - alertname
+      group_interval: 5m
+      group_wait: 30s
+      receiver: "null"
+      repeat_interval: 12h
+      routes:
+      - matchers:
+        - alertname = "Watchdog"
+        receiver: "null"
+    templates:
+    - /etc/alertmanager/config/*.tmpl

helmfile.d/stacks/monitoring-prometheus.yaml.gotmpl

@@ -27,6 +27,13 @@ templates:
       - values/kube-prometheus-stack-sc.yaml.gotmpl
       {{- else if .Values | get "ck8sWorkloadCluster.enabled" false }}
       - values/kube-prometheus-stack-wc.yaml.gotmpl
+    hooks:
+      - events: [ presync ]
+        showlogs: true
+        command: hooks/create-from-manifest.sh
+        args:
+          - "{{ .Environment.Name }}"
+          - alertmanager/dev-secret.yaml
       {{- end }}
     wait: true
     timeout: 600

helmfile.d/values/kube-prometheus-stack-wc.yaml.gotmpl

@@ -41,6 +41,10 @@ alertmanager:
     route:
       group_by: {{ toYaml .Values.prometheus.alertmanagerSpec.groupBy | nindent 8 }}
   alertmanagerSpec:
+    automountServiceAccountToken: false
+    useExistingSecret: true
+    secrets:
+     - alertmanager-kube-prometheus-stack-alertmanager
     replicas: {{ .Values.prometheus.alertmanagerSpec.replicas }}
     retention: {{ .Values.prometheus.retention.alertmanager }}
     resources: {{- toYaml .Values.prometheus.alertmanagerSpec.resources | nindent 6 }}

migration/v0.49/apply/30-kube-prometheus-stack.sh

@@ -0,0 +1,49 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+ROOT="$(readlink -f "$(dirname "${0}")/../../../")"
+
+source "${ROOT}/scripts/migration/lib.sh"
+
+run() {
+  case "${1:-}" in
+  execute)
+    chart_version=$(yq '.version' "${ROOT}/helmfile.d/upstream/prometheus-community/kube-prometheus-stack/Chart.yaml")
+    clusters=("${CK8S_CLUSTER}")
+    if [[ "${CK8S_CLUSTER}" == "both" ]]; then
+      clusters=("wc" "sc")
+    fi
+
+    for cluster in "${clusters[@]}"; do
+
+      if [[ "${cluster}" == "wc" ]]; then
+        kubectl_do "${cluster}" annotate secret -n alertmanager alertmanager-kube-prometheus-stack-alertmanager helm.sh/resource-policy=keep
+      fi
+
+      current_version=$(helm_do "${cluster}" get metadata -n monitoring kube-prometheus-stack -ojson | jq -r '.version')
+
+      log_info "Upgrading kube-prometheus-stack on ${cluster}: ${current_version} -> ${chart_version}"
+
+      log_info "  - Checking if kube-prometheus-stack CRDs need to be upgraded on ${cluster}"
+      if [[ "${current_version}" != "${chart_version}" ]]; then
+        log_info "  - Replace kube-prometheus-stack CRDs on ${cluster}"
+        kubectl_do "${cluster}" apply --server-side --force-conflicts -f "${ROOT}/helmfile.d/upstream/prometheus-community/kube-prometheus-stack/charts/crds/crds"
+      else
+        log_info "  - CRDs up-to-date on ${cluster}, skipping"
+      fi
+
+      log_info "  - Upgrade kube-prometheus-stack on ${cluster}"
+      helmfile_upgrade "${cluster}" app=prometheus
+    done
+    ;;
+  rollback)
+    log_warn "rollback not implemented"
+    ;;
+  *)
+    log_fatal "usage: \"${0}\" <execute|rollback>"
+    ;;
+  esac
+}
+
+run "${@}"