kube-state-metrics
Helm chart
Request a free trial
Contact our team to test out this Helm chart and related images for free. Please also indicate any other images you would like to evaluate.
Tag:
1
# Default values for kube-state-metrics.
2
prometheusScrape: true
3
image:
4
registry: chainreg.biz
5
repository: scratch-images/test-tmp/kube-state-metrics
6
# If unset use v + .Charts.appVersion
7
tag: 2.19.1-r7
8
sha: sha256:da556cfdd22c65d511382524447e64087afa39da223105f0a6c30df65103994e
9
pullPolicy: IfNotPresent
10
imagePullSecrets: []
11
# - name: "image-pull-secret"
12
13
global:
14
# To help compatibility with other charts which use global.imagePullSecrets.
15
# Allow either an array of {name: pullSecret} maps (k8s-style), or an array of strings (more common helm-style).
16
# global:
17
# imagePullSecrets:
18
# - name: pullSecret1
19
# - name: pullSecret2
20
# or
21
# global:
22
# imagePullSecrets:
23
# - pullSecret1
24
# - pullSecret2
25
imagePullSecrets: []
26
#
27
# Allow parent charts to override registry hostname
28
imageRegistry: ""
29
# Provide a name in place of kube-state-metrics for `app.kubernetes.io/name` labels.
30
nameOverride: ""
31
# Provide a name to substitute for the full names of resources.
32
fullnameOverride: ""
33
# If set to true, this will deploy kube-state-metrics as a StatefulSet and the data
34
# will be automatically sharded across <.Values.replicas> pods using the built-in
35
# autodiscovery feature: https://github.com/kubernetes/kube-state-metrics#automated-sharding
36
# This is an experimental feature and there are no stability guarantees.
37
autosharding:
38
enabled: false
39
replicas: 1
40
# Change the deployment strategy when autosharding is disabled.
41
# ref: https://kubernetes.io/docs/concepts/workloads/controllers/deployment/#strategy
42
# The default is "RollingUpdate" as per Kubernetes defaults.
43
# During a release, 'RollingUpdate' can lead to two running instances for a short period of time while 'Recreate' can create a small gap in data.
44
# updateStrategy: Recreate
45
46
# Number of old history to retain to allow rollback
47
# Default Kubernetes value is set to 10
48
revisionHistoryLimit: 10
49
# List of additional cli arguments to configure kube-state-metrics
50
# for example: --enable-gzip-encoding, --log-file, etc.
51
# all the possible args can be found here: https://github.com/kubernetes/kube-state-metrics/blob/main/docs/developer/cli-arguments.md
52
extraArgs: []
53
# If false then the user will opt out of automounting API credentials.
54
automountServiceAccountToken: true
55
service:
56
port: 8080
57
# Default to clusterIP for backward compatibility
58
type: ClusterIP
59
ipDualStack:
60
enabled: false
61
ipFamilies: ["IPv6", "IPv4"]
62
ipFamilyPolicy: "PreferDualStack"
63
nodePort: 0
64
loadBalancerIP: ""
65
# Only allow access to the loadBalancerIP from these IPs
66
loadBalancerSourceRanges: []
67
clusterIP: ""
68
annotations: {}
69
## Additional labels to add to all resources
70
customLabels: {}
71
# app: kube-state-metrics
72
73
## Override selector labels
74
selectorOverride: {}
75
## set to true to add the release label so scraping of the servicemonitor with kube-prometheus-stack works out of the box
76
releaseLabel: false
77
hostNetwork: false
78
## Use the host's user namespace for deployment.
79
## ref: https://kubernetes.io/docs/tasks/configure-pod-container/user-namespaces/
80
hostUsers: ~
81
rbac:
82
# If true, create & use RBAC resources
83
create: true
84
# Set to a rolename to use existing role - skipping role creating - but still doing serviceaccount and rolebinding to it, rolename set here.
85
# useExistingRole: your-existing-role
86
87
# If set to false - Run without Cluteradmin privs needed - ONLY works if namespace is also set (if useExistingRole is set this name is used as ClusterRole or Role to bind to)
88
useClusterRole: true
89
# Add permissions for CustomResources' apiGroups in Role/ClusterRole. Should be used in conjunction with Custom Resource State Metrics configuration
90
# Example:
91
# - apiGroups: ["monitoring.coreos.com"]
92
# resources: ["prometheuses"]
93
# verbs: ["list", "watch"]
94
extraRules: []
95
# Enable kube-state-metrics native request authn/authz on the metrics endpoints
96
# via the `--auth-filter` flag, as an alternative to running kube-rbac-proxy.
97
# When enabled, the `create` permissions on `tokenreviews` and
98
# `subjectaccessreviews` required by the filter are added to the (Cluster)Role
99
# automatically. Scrapers must authenticate; see the chart README and the
100
# kube-state-metrics docs on protecting metrics endpoints.
101
authFilter:
102
enabled: false
103
# Configure kube-rbac-proxy. When enabled, creates one kube-rbac-proxy container per exposed HTTP endpoint (metrics and telemetry if enabled).
104
# The requests are served through the same service but requests are then HTTPS.
105
kubeRBACProxy:
106
enabled: false
107
image:
108
registry: chainreg.biz
109
repository: scratch-images/test-tmp/kube-rbac-proxy
110
tag: 0.22.1-r4
111
sha: sha256:9af5d2f545df3117e1a7450206dde6625bb18349cb4b129b15779a345bfed8bf
112
pullPolicy: IfNotPresent
113
# This set --ignore-paths=/livez,/readyz to kubeRBACProxy container args
114
# to allow the pod probes working properly with kubeRBACProxy enabled.
115
ignoreProbePaths: true
116
# List of additional cli arguments to configure kube-rbac-prxy
117
# for example: --tls-cipher-suites, --log-file, etc.
118
# all the possible args can be found here: https://github.com/brancz/kube-rbac-proxy#usage
119
extraArgs: []
120
## Specify security settings for a Container
121
## Allows overrides and additional options compared to (Pod) securityContext
122
## Ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-container
123
containerSecurityContext:
124
readOnlyRootFilesystem: true
125
allowPrivilegeEscalation: false
126
capabilities:
127
drop:
128
- ALL
129
# Configure specific upstream port for kube-state-metrics container
130
port: 9090
131
# Configure specific proxy endpoints port
132
# This port is for healthz on readinessProbe kube-rbac-proxy-http container
133
proxyEndpointsPort: 8888
134
resources: {}
135
# We usually recommend not to specify default resources and to leave this as a conscious
136
# choice for the user. This also increases chances charts run on environments with little
137
# resources, such as Minikube. If you do want to specify resources, uncomment the following
138
# lines, adjust them as necessary, and remove the curly braces after 'resources:'.
139
# limits:
140
# cpu: 100m
141
# memory: 64Mi
142
# requests:
143
# cpu: 10m
144
# memory: 32Mi
145
146
## volumeMounts enables mounting custom volumes in rbac-proxy containers
147
## Useful for TLS certificates and keys
148
volumeMounts: []
149
# - mountPath: /etc/tls
150
# name: kube-rbac-proxy-tls
151
# readOnly: true
152
serviceAccount:
153
# Specifies whether a ServiceAccount should be created, require rbac true
154
create: true
155
# The name of the ServiceAccount to use.
156
# If not set and create is true, a name is generated using the fullname template
157
name:
158
# Reference to one or more secrets to be used when pulling images
159
# ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/
160
imagePullSecrets: []
161
# ServiceAccount annotations.
162
# Use case: AWS EKS IAM roles for service accounts
163
# ref: https://docs.aws.amazon.com/eks/latest/userguide/specify-service-account-role.html
164
annotations: {}
165
# If false then the user will opt out of automounting API credentials.
166
automountServiceAccountToken: true
167
# Additional Environment variables
168
env: []
169
# - name: GOMAXPROCS
170
# valueFrom:
171
# resourceFieldRef:
172
# resource: limits.cpu
173
174
prometheus:
175
monitor:
176
enabled: false
177
annotations: {}
178
additionalLabels: {}
179
namespace: ""
180
namespaceSelector: []
181
jobLabel: ""
182
targetLabels: []
183
podTargetLabels: []
184
## SampleLimit defines per-scrape limit on number of scraped samples that will be accepted.
185
##
186
sampleLimit: 0
187
## TargetLimit defines a limit on the number of scraped targets that will be accepted.
188
##
189
targetLimit: 0
190
## Per-scrape limit on number of labels that will be accepted for a sample. Only valid in Prometheus versions 2.27.0 and newer.
191
##
192
labelLimit: 0
193
## Per-scrape limit on length of labels name that will be accepted for a sample. Only valid in Prometheus versions 2.27.0 and newer.
194
##
195
labelNameLengthLimit: 0
196
## Per-scrape limit on length of labels value that will be accepted for a sample. Only valid in Prometheus versions 2.27.0 and newer.
197
##
198
labelValueLengthLimit: 0
199
selectorOverride: {}
200
## kube-state-metrics endpoint
201
http:
202
interval: ""
203
scrapeTimeout: ""
204
proxyUrl: ""
205
## Whether to enable HTTP2 for servicemonitor
206
enableHttp2: false
207
honorLabels: false
208
metricRelabelings: []
209
relabelings: []
210
scheme: ""
211
## File to read bearer token for scraping targets
212
bearerTokenFile: ""
213
## Secret to mount to read bearer token for scraping targets. The secret needs
214
## to be in the same namespace as the service monitor and accessible by the
215
## Prometheus Operator
216
bearerTokenSecret: {}
217
# name: secret-name
218
# key: key-name
219
tlsConfig: {}
220
## selfMonitor endpoint
221
metrics:
222
interval: ""
223
scrapeTimeout: ""
224
proxyUrl: ""
225
## Whether to enable HTTP2 for servicemonitor
226
enableHttp2: false
227
honorLabels: false
228
metricRelabelings: []
229
relabelings: []
230
scheme: ""
231
## File to read bearer token for scraping targets
232
bearerTokenFile: ""
233
## Secret to mount to read bearer token for scraping targets. The secret needs
234
## to be in the same namespace as the service monitor and accessible by the
235
## Prometheus Operator
236
bearerTokenSecret: {}
237
# name: secret-name
238
# key: key-name
239
tlsConfig: {}
240
## Create a scrapeConfig resource for scraping the kube-state-metrics service. Use this instead of serviceMonitor
241
## to have more instances of kube-state-metrics safety.
242
scrapeconfig:
243
## To avoid duplicate metrics, first disable the serviceMonitor creation via prometheus.monitor.enabled=false
244
enabled: false
245
annotations: {}
246
additionalLabels: {}
247
jobName: kube-state-metrics
248
## SampleLimit defines per-scrape limit on number of scraped samples that will be accepted.
249
##
250
sampleLimit: 0
251
## TargetLimit defines a limit on the number of scraped targets that will be accepted.
252
##
253
targetLimit: 0
254
## Per-scrape limit on number of labels that will be accepted for a sample. Only valid in Prometheus versions 2.27.0 and newer.
255
##
256
labelLimit: 0
257
## Per-scrape limit on length of labels name that will be accepted for a sample. Only valid in Prometheus versions 2.27.0 and newer.
258
##
259
labelNameLengthLimit: 0
260
## Per-scrape limit on length of labels value that will be accepted for a sample. Only valid in Prometheus versions 2.27.0 and newer.
261
##
262
labelValueLengthLimit: 0
263
## StaticConfigLabels defines the labels to be used in the Prometheus static configuration for scraping.
264
staticConfigLabels: {}
265
scrapeInterval: ""
266
scrapeTimeout: ""
267
proxyUrl: ""
268
## Whether to enable HTTP2 for scrapeconfig
269
enableHttp2: false
270
honorLabels: true
271
metricRelabelings: []
272
relabelings: []
273
scheme: ""
274
tlsConfig: {}
275
## Configure network policy for kube-state-metrics
276
networkPolicy:
277
enabled: false
278
# egress:
279
# - {}
280
# ingress:
281
# - {}
282
# podSelector:
283
# matchLabels:
284
# app.kubernetes.io/name: kube-state-metrics
285
securityContext:
286
enabled: true
287
runAsGroup: 65534
288
runAsUser: 65534
289
fsGroup: 65534
290
runAsNonRoot: true
291
seccompProfile:
292
type: RuntimeDefault
293
## Specify security settings for a Container
294
## Allows overrides and additional options compared to (Pod) securityContext
295
## Ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-container
296
containerSecurityContext:
297
readOnlyRootFilesystem: true
298
allowPrivilegeEscalation: false
299
capabilities:
300
drop:
301
- ALL
302
## Node labels for pod assignment
303
## Ref: https://kubernetes.io/docs/user-guide/node-selection/
304
nodeSelector: {}
305
## Affinity settings for pod assignment
306
## Can be defined as either a dict or string. String is useful for `tpl` templating.
307
## Ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/
308
affinity: {}
309
# affinity: |
310
# podAntiAffinity:
311
# requiredDuringSchedulingIgnoredDuringExecution:
312
# - labelSelector:
313
# matchLabels:
314
# {{- include "kube-state-metrics.selectorLabels" . | indent 10 }}
315
# topologyKey: kubernetes.io/hostname
316
317
## Tolerations for pod assignment
318
## Ref: https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/
319
tolerations: []
320
## Topology spread constraints for pod assignment
321
## Ref: https://kubernetes.io/docs/concepts/workloads/pods/pod-topology-spread-constraints/
322
topologySpreadConstraints: []
323
# Annotations to be added to the deployment/statefulset
324
annotations: {}
325
# Labels to be added to the deployment/statefulset
326
labels: {}
327
# Annotations to be added to the pod
328
podAnnotations: {}
329
# Labels to be added to the pod
330
podLabels: {}
331
## Assign a PriorityClassName to pods if set
332
# priorityClassName: ""
333
334
# Ref: https://kubernetes.io/docs/tasks/run-application/configure-pdb/
335
podDisruptionBudget: {}
336
# Comma-separated list of metrics to be exposed.
337
# This list comprises of exact metric names and/or regex patterns.
338
# The allowlist and denylist are mutually exclusive.
339
metricAllowlist: []
340
# Comma-separated list of metrics not to be enabled.
341
# This list comprises of exact metric names and/or regex patterns.
342
# The allowlist and denylist are mutually exclusive.
343
metricDenylist: []
344
# Comma-separated list of additional Kubernetes label keys that will be used in the resource's
345
# labels metric. By default the metric contains only name and namespace labels.
346
# To include additional labels, provide a list of resource names in their plural form and Kubernetes
347
# label keys you would like to allow for them (Example: '=namespaces=[k8s-label-1,k8s-label-n,...],pods=[app],...)'.
348
# A single '*' can be provided per resource instead to allow any labels, but that has
349
# severe performance implications (Example: '=pods=[*]').
350
metricLabelsAllowlist: []
351
# - namespaces=[k8s-label-1,k8s-label-n]
352
353
# Comma-separated list of Kubernetes annotations keys that will be used in the resource'
354
# labels metric. By default the metric contains only name and namespace labels.
355
# To include additional annotations provide a list of resource names in their plural form and Kubernetes
356
# annotation keys you would like to allow for them (Example: '=namespaces=[kubernetes.io/team,...],pods=[kubernetes.io/team],...)'.
357
# A single '*' can be provided per resource instead to allow any annotations, but that has
358
# severe performance implications (Example: '=pods=[*]').
359
metricAnnotationsAllowList: []
360
# - pods=[k8s-annotation-1,k8s-annotation-n]
361
362
# Available collectors for kube-state-metrics.
363
# By default, all available resources are enabled, comment out to disable.
364
collectors:
365
- certificatesigningrequests
366
- configmaps
367
- cronjobs
368
- daemonsets
369
- deployments
370
- endpointslices
371
- horizontalpodautoscalers
372
- ingresses
373
- jobs
374
- leases
375
- limitranges
376
- mutatingwebhookconfigurations
377
- namespaces
378
- networkpolicies
379
- nodes
380
- persistentvolumeclaims
381
- persistentvolumes
382
- poddisruptionbudgets
383
- pods
384
- replicasets
385
- replicationcontrollers
386
- resourcequotas
387
- secrets
388
- services
389
- statefulsets
390
- storageclasses
391
- validatingwebhookconfigurations
392
- volumeattachments
393
# - ingressclasses
394
# - clusterrolebindings
395
# - clusterroles
396
# - roles
397
# - rolebindings
398
# - serviceaccounts
399
# collectorsExclude / collectorsExtra tweak the default `collectors` list above
400
# without redefining it. Both operate on `.Values.collectors` (not on KSM's
401
# built-in defaults): with `collectors: []` there is nothing to layer onto and
402
# `collectorsExtra` becomes the entire --resources list.
403
# collectorsExclude removes entries from the list:
404
collectorsExclude: []
405
# - pods
406
# collectorsExtra appends entries after exclusion (deduplicated):
407
collectorsExtra: []
408
# - rolebindings
409
410
# Enabling kubeconfig will pass the --kubeconfig argument to the container
411
kubeconfig:
412
enabled: false
413
# base64 encoded kube-config file
414
secret:
415
# Enabling support for customResourceState, will create a configMap including your config that will be read from kube-state-metrics
416
customResourceState:
417
# Whether to enable support for CustomResourceStateMetrics.
418
enabled: false
419
# Whether to create the ConfigMap that holds the config.
420
create: true
421
# Name of the ConfigMap that holds the config. If empty, name will be generated based on the release name.
422
name: ""
423
# ConfigMap key that holds the config.
424
key: config.yaml
425
# Definition of the CustomResourceStateMetrics. Add (Cluster)Role permissions to list/watch the resources defined in the config to rbac.extraRules.
426
config: {}
427
# Enable only the release namespace for collecting resources. By default all namespaces are collected.
428
# If releaseNamespace and namespaces are both set a merged list will be collected.
429
releaseNamespace: false
430
# Comma-separated list(string) or yaml list of namespaces to be enabled for collecting resources. By default all namespaces are collected.
431
namespaces: ""
432
# Comma-separated list of namespaces not to be enabled. If namespaces and namespaces-denylist are both set,
433
# only namespaces that are excluded in namespaces-denylist will be used.
434
namespacesDenylist: ""
435
## Override the deployment namespace
436
##
437
namespaceOverride: ""
438
resources: {}
439
# We usually recommend not to specify default resources and to leave this as a conscious
440
# choice for the user. This also increases chances charts run on environments with little
441
# resources, such as Minikube. If you do want to specify resources, uncomment the following
442
# lines, adjust them as necessary, and remove the curly braces after 'resources:'.
443
# limits:
444
# cpu: 100m
445
# memory: 64Mi
446
# requests:
447
# cpu: 10m
448
# memory: 32Mi
449
450
# Enable self metrics configuration for service and Service Monitor
451
# Default values for telemetry configuration can be overridden
452
# If you set telemetryNodePort, you must also set service.type to NodePort
453
selfMonitor:
454
enabled: false
455
# telemetryHost: 0.0.0.0
456
# telemetryPort: 8081
457
# telemetryNodePort: 0
458
# Enable vertical pod autoscaler support for kube-state-metrics
459
verticalPodAutoscaler:
460
enabled: false
461
# Recommender responsible for generating recommendation for the object.
462
# List should be empty (then the default recommender will generate the recommendation)
463
# or contain exactly one recommender.
464
# recommenders: []
465
# - name: custom-recommender-performance
466
467
# List of resources that the vertical pod autoscaler can control. Defaults to cpu and memory
468
controlledResources: []
469
# Specifies which resource values should be controlled: RequestsOnly or RequestsAndLimits.
470
# controlledValues: RequestsAndLimits
471
472
# Define the max allowed resources for the pod
473
maxAllowed: {}
474
# cpu: 200m
475
# memory: 100Mi
476
# Define the min allowed resources for the pod
477
minAllowed: {}
478
# cpu: 200m
479
# memory: 100Mi
480
# updatePolicy:
481
# Specifies minimal number of replicas which need to be alive for VPA Updater to attempt pod eviction
482
# minReplicas: 1
483
# Specifies whether recommended updates are applied when a Pod is started and whether recommended updates
484
# are applied during the life of a Pod. Possible values are "Off", "Initial", "Recreate", and "Auto".
485
# updateMode: Auto
486
487
# volumeMounts are used to add custom volume mounts to deployment.
488
# See example below
489
volumeMounts: []
490
# - mountPath: /etc/config
491
# name: config-volume
492
493
# volumes are used to add custom volumes to deployment
494
# See example below
495
volumes: []
496
# - configMap:
497
# name: cm-for-volume
498
# name: config-volume
499
500
# Extra manifests to deploy as an array
501
extraManifests: []
502
# - apiVersion: v1
503
# kind: ConfigMap
504
# metadata:
505
# labels:
506
# name: prometheus-extra
507
# data:
508
# extra-data: "value"
509
510
## Containers allows injecting additional containers.
511
containers: []
512
# - name: crd-init
513
# image: kiwigrid/k8s-sidecar:latest
514
515
## InitContainers allows injecting additional initContainers.
516
initContainers: []
517
# - name: crd-sidecar
518
# image: kiwigrid/k8s-sidecar:latest
519
520
## dnsPolicy allows to change the default DNS configuration for the pod
521
## Ref: https://kubernetes.io/docs/concepts/services-networking/dns-pod-service/#pod-s-dns-policy
522
dnsPolicy: ClusterFirst
523
## dnsConfig allows setting up specific DNS configuration for the pod
524
## Ref: https://kubernetes.io/docs/concepts/services-networking/dns-pod-service/#pod-dns-config
525
dnsConfig: {}
526
## Settings for startup, liveness and readiness probes
527
## Ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/
528
##
529
530
## Startup probe can optionally be enabled.
531
##
532
startupProbe:
533
enabled: false
534
failureThreshold: 3
535
httpGet:
536
httpHeaders: []
537
scheme: http
538
initialDelaySeconds: 0
539
periodSeconds: 10
540
successThreshold: 1
541
timeoutSeconds: 5
542
## Liveness probe
543
##
544
livenessProbe:
545
failureThreshold: 3
546
httpGet:
547
httpHeaders: []
548
scheme: http
549
initialDelaySeconds: 5
550
periodSeconds: 10
551
successThreshold: 1
552
timeoutSeconds: 5
553
## Readiness probe
554
##
555
readinessProbe:
556
failureThreshold: 3
557
httpGet:
558
httpHeaders: []
559
scheme: http
560
initialDelaySeconds: 5
561
periodSeconds: 10
562
successThreshold: 1
563
timeoutSeconds: 5
564
The trusted source for open source
Talk to an expertProduct
Customers
© 2026 Chainguard, Inc. All Rights Reserved.
Chainguard® and the Chainguard logo are registered trademarks of Chainguard, Inc. in the United States and/or other countries.
The other respective trademarks mentioned on this page are owned by the respective companies and use of them does not imply any affiliation or endorsement.
Chainguard® and the Chainguard logo are registered trademarks of Chainguard, Inc. in the United States and/or other countries.
The other respective trademarks mentioned on this page are owned by the respective companies and use of them does not imply any affiliation or endorsement.