goatlas-io / atlas

Secure Distributed Thanos Deployment using an Observability Cluster

Atlas

Status: BETA - I don't expect breaking changes, but still possible.

Atlas, forced by Zeus to support the heavens and the skies on his shoulders.

See Full Documentation

Overview

Atlas provides the ability to easily run a secure distributed Thanos deployment. Atlas at it's core is a small set of kubernetes operators that uses services and secrets resources as the underlying source of truth to populate a customized Envoy Aggreggated Service Discovery server which the Envoy proxies connect to and obtain their configurations to create the secure distributed envoy network that Thanos then traverses for connectivity.

Atlas provides Thanos Query the ability to connect to Thanos Sidecars securely over HTTP/2 authenticated via Mutual TLS. Additionally when an ingress on the observability cluster (where Atlas is installed) is configured properly, you can access every downstream cluster's individual Prometheus and Alert Manager web interfaces.

Finally Atlas provides the ability for EVERY downstream cluster's Prometheus instances to securely send alerts back to the observability alert managers over the HTTP/2 protected by Mutual TLS. This means that you can protect access to the alertmanager with something like an oauth2 proxy and not worry about how to allow the Prometheus instances to authenticate to it for sending alerts.

Atlas does not deploy Thanos or configure Thanos for you. Please see Atlas documentation on how to configure Thanos to use Atlas.

How It Works

Atlas leverages kubernetes services, label selectors, and annotations to configurable all the necessary components. By default Atlas is configured to work seamlessly with kube-prometheus-stack helm chart.

Atlas uses services defined with external IPs to represent a downstream cluster, when properly annotated it will configure the system for accessing the downstream cluster securely. Once Atlas discovers a properly configured service, it will create a helm-values secret for properly deploying an envoy proxy on the downstream cluster.

atlas's Issues

Feature: Support Multiple Thanos Queries

One feature of Thanos is to point on Thanos Query at other Thanos Queries. By adding an additional annotation to the service resource that represents a downstream cluster, Atlas can separate out downstream clusters into separate DNS queries allowing multiple thanos query components to be used with Atlas.

Question

Hello,

I want to take a look at this, because we have an issue with getting the ingress working on grpc without envoy. However, the
Thanos part of Atlas is not clear to me. You do recommend to use the kube-prometheus-stack, but I am missing the Thanos server part. The kube-prometheus-stack doesn't have the Thanos server.

Can you clearify this for me? Which Thanos should I install and with options are mandatory?

Thanks!

Dependency Dashboard

This issue lists Renovate updates and detected dependencies. Read the Dependency Dashboard docs to learn more.

Rate-Limited

These updates are currently rate-limited. Click on a checkbox below to force their creation now.

• fix(deps): update module github.com/gorilla/mux to v1.8.1
• chore(deps): update actions/checkout action to v4
• chore(deps): update actions/setup-go action to v5
• chore(deps): update actions/setup-python action to v5
• chore(deps): update actions/upload-artifact action to v4
• chore(deps): update crazy-max/ghaction-github-pages action to v4
• chore(deps): update docker/login-action action to v3
• chore(deps): update goreleaser/goreleaser-action action to v6
• fix(deps): update module github.com/rancher/wrangler to v3
• 🔐 Create all rate-limited PRs at once 🔐

Edited/Blocked

These updates have been manually edited so Renovate will no longer make changes. To discard all commits and start over, click on a checkbox.

• chore(deps): update envoyproxy/envoy docker tag to v1.31.0
• chore(deps): update golang docker tag to v1.22.6
• fix(deps): update kubernetes deps to v0.30.3 (k8s.io/api, k8s.io/apimachinery, k8s.io/client-go)
• fix(deps): update module google.golang.org/grpc to v1.65.0

Open

These updates have all been created already. Click a checkbox below to force a retry/rebase of any.

• fix(deps): update module github.com/golang/protobuf to v1.5.4
• fix(deps): update module github.com/rancher/wrangler to v0.8.11
• fix(deps): update module github.com/envoyproxy/go-control-plane to v0.12.0
• fix(deps): update module github.com/prometheus/client_golang to v1.19.1
• fix(deps): update module github.com/sirupsen/logrus to v1.9.3
• fix(deps): update module github.com/urfave/cli/v2 to v2.27.3
• fix(deps): update module google.golang.org/protobuf to v1.34.2
• Click on this checkbox to rebase all open PRs at once

Detected dependencies

dockerfile

Dockerfile

• golang 1.16.6

Dockerfile.gorelease

github-actions

.github/workflows/release-charts.yml

• actions/checkout v2

.github/workflows/release-docs.yml

• actions/checkout v2
• actions/setup-python v2
• crazy-max/ghaction-github-pages v2

.github/workflows/release.yml

• actions/checkout v2
• actions/checkout v2
• actions/setup-go v2
• docker/login-action v1
• goreleaser/goreleaser-action v2
• goreleaser/goreleaser-action v2
• actions/upload-artifact v2

.github/workflows/tests.yml

• actions/setup-go v2
• actions/checkout v2
• actions/setup-go v2
• actions/checkout v2

gomod

go.mod

• go 1.16
• github.com/Masterminds/sprig v2.22.0+incompatible
• github.com/bwmarrin/snowflake v0.3.0
• github.com/envoyproxy/go-control-plane v0.9.9
• github.com/golang/protobuf v1.5.0
• github.com/gorilla/mux v1.8.0
• github.com/mitchellh/hashstructure/v2 v2.0.2
• github.com/prometheus/client_golang v1.11.0
• github.com/rancher/wrangler v0.8.7
• github.com/sirupsen/logrus v1.8.1
• github.com/urfave/cli/v2 v2.3.0
• google.golang.org/grpc v1.36.0
• google.golang.org/protobuf v1.27.1
• k8s.io/api v0.20.5
• k8s.io/apimachinery v0.20.5
• k8s.io/client-go v0.20.5
• k8s.io/client-go v0.20.5

helm-values

charts/atlas/values.yaml

• ghcr.io/goatlas-io/atlas v0.3.1

charts/envoy/values.yaml

• envoyproxy/envoy v1.18.3

helmv3

charts/atlas/Chart.yaml

• envoy 1.2.1

regex

pkg/commands/templates/helm-release.tmpl

• envoy 1.2.1

---

• Check this box to trigger a request for Renovate to run again on this repository

Action Required: Fix Renovate Configuration

There is an error with this repository's Renovate configuration that needs to be fixed. As a precaution, Renovate will stop PRs until it is resolved.

Error type: Cannot find preset's package (github>whitesource/merge-confidence:beta)