kube-state-metrics
Helm chart
Request a free trial
Contact our team to test out this Helm chart and related images for free. Please also indicate any other images you would like to evaluate.
Tag:
Compare:
1
# Default values for kube-state-metrics.
2
prometheusScrape: true
3
image:
4
registry: cgr.dev
5
repository: scratch-images/test-tmp/kube-state-metrics
6
# If unset use v + .Charts.appVersion
7
tag: 2.20.0-r3
8
sha: sha256:132f755f22a96d13b2e7f8f0d7747e4423d8ef77dbb6d9e23a5c5e2ba0cf5af9
9
pullPolicy: IfNotPresent
10
imagePullSecrets: []
11
# - name: "image-pull-secret"
12
13
global:
14
# To help compatibility with other charts which use global.imagePullSecrets.
15
# Allow either an array of {name: pullSecret} maps (k8s-style), or an array of strings (more common helm-style).
16
# global:
17
# imagePullSecrets:
18
# - name: pullSecret1
19
# - name: pullSecret2
20
# or
21
# global:
22
# imagePullSecrets:
23
# - pullSecret1
24
# - pullSecret2
25
imagePullSecrets: []
26
#
27
# Allow parent charts to override registry hostname
28
imageRegistry: ""
29
# Provide a name in place of kube-state-metrics for `app.kubernetes.io/name` labels.
30
nameOverride: ""
31
# Provide a name to substitute for the full names of resources.
32
fullnameOverride: ""
33
# If set to true, this will deploy kube-state-metrics as a StatefulSet and the data
34
# will be automatically sharded across <.Values.replicas> pods using the built-in
35
# autodiscovery feature: https://github.com/kubernetes/kube-state-metrics#automated-sharding
36
# This is an experimental feature and there are no stability guarantees.
37
autosharding:
38
enabled: false
39
replicas: 1
40
# Change the deployment strategy when autosharding is disabled.
41
# ref: https://kubernetes.io/docs/concepts/workloads/controllers/deployment/#strategy
42
# The default is "RollingUpdate" as per Kubernetes defaults.
43
# During a release, 'RollingUpdate' can lead to two running instances for a short period of time while 'Recreate' can create a small gap in data.
44
# updateStrategy: Recreate
45
46
# Number of old history to retain to allow rollback
47
# Default Kubernetes value is set to 10
48
revisionHistoryLimit: 10
49
# List of additional cli arguments to configure kube-state-metrics
50
# for example: --enable-gzip-encoding, --log-file, etc.
51
# all the possible args can be found here: https://github.com/kubernetes/kube-state-metrics/blob/main/docs/developer/cli-arguments.md
52
extraArgs: []
53
# If false then the user will opt out of automounting API credentials.
54
automountServiceAccountToken: true
55
service:
56
port: 8080
57
# Default to clusterIP for backward compatibility
58
type: ClusterIP
59
ipDualStack:
60
enabled: false
61
ipFamilies: ["IPv6", "IPv4"]
62
ipFamilyPolicy: "PreferDualStack"
63
nodePort: 0
64
loadBalancerIP: ""
65
# Only allow access to the loadBalancerIP from these IPs
66
loadBalancerSourceRanges: []
67
clusterIP: ""
68
annotations: {}
69
## Additional labels to add to all resources
70
customLabels: {}
71
# app: kube-state-metrics
72
73
## Override selector labels
74
selectorOverride: {}
75
## set to true to add the release label so scraping of the servicemonitor with kube-prometheus-stack works out of the box
76
releaseLabel: false
77
hostNetwork: false
78
## Use the host's user namespace for deployment.
79
## ref: https://kubernetes.io/docs/tasks/configure-pod-container/user-namespaces/
80
hostUsers: ~
81
rbac:
82
# If true, create & use RBAC resources
83
create: true
84
# Set to false only when the customresourcedefinitions list/watch permission is
85
# granted to the ServiceAccount by other means (e.g. a cluster-scoped ClusterRole
86
# managed outside this chart). kube-state-metrics always needs it for
87
# customResourceState; this only controls whether the chart creates the rule.
88
customResourceState:
89
createClusterRoleRules: true
90
# Set to a rolename to use existing role - skipping role creating - but still doing serviceaccount and rolebinding to it, rolename set here.
91
# useExistingRole: your-existing-role
92
93
# If set to false - Run without Cluteradmin privs needed - ONLY works if namespace is also set (if useExistingRole is set this name is used as ClusterRole or Role to bind to)
94
useClusterRole: true
95
# Add permissions for CustomResources' apiGroups in Role/ClusterRole. Should be used in conjunction with Custom Resource State Metrics configuration
96
# Example:
97
# - apiGroups: ["monitoring.coreos.com"]
98
# resources: ["prometheuses"]
99
# verbs: ["list", "watch"]
100
extraRules: []
101
# Aggregate ClusterRoles using label selectors (only applies when useClusterRole: true).
102
# When set, this ClusterRole aggregates matching ClusterRoles instead of defining rules
103
# directly, so the built-in collector rules above are NOT included. Make sure the
104
# aggregated ClusterRoles grant the permissions kube-state-metrics needs.
105
# ref: https://kubernetes.io/docs/reference/access-authn-authz/rbac/#aggregated-clusterroles
106
# Example:
107
# clusterRoleSelectors:
108
# - matchLabels:
109
# rbac.example.com/aggregate-to-monitoring: "true"
110
clusterRoleSelectors: []
111
# Enable kube-state-metrics native request authn/authz on the metrics endpoints
112
# via the `--auth-filter` flag, as an alternative to running kube-rbac-proxy.
113
# When enabled, the `create` permissions on `tokenreviews` and
114
# `subjectaccessreviews` required by the filter are added to the (Cluster)Role
115
# automatically. Scrapers must authenticate; see the chart README and the
116
# kube-state-metrics docs on protecting metrics endpoints.
117
authFilter:
118
enabled: false
119
# Configure kube-rbac-proxy. When enabled, creates one kube-rbac-proxy container per exposed HTTP endpoint (metrics and telemetry if enabled).
120
# The requests are served through the same service but requests are then HTTPS.
121
kubeRBACProxy:
122
enabled: false
123
image:
124
registry: cgr.dev
125
repository: scratch-images/test-tmp/kube-rbac-proxy
126
tag: 0.22.1-r10
127
sha: sha256:95092d3f845583b6570c29f37c4b08d207a24ab89171e54e885494d79bf05b3b
128
pullPolicy: IfNotPresent
129
# This set --ignore-paths=/livez,/readyz to kubeRBACProxy container args
130
# to allow the pod probes working properly with kubeRBACProxy enabled.
131
ignoreProbePaths: true
132
# List of additional cli arguments to configure kube-rbac-prxy
133
# for example: --tls-cipher-suites, --log-file, etc.
134
# all the possible args can be found here: https://github.com/brancz/kube-rbac-proxy#usage
135
extraArgs: []
136
## Specify security settings for a Container
137
## Allows overrides and additional options compared to (Pod) securityContext
138
## Ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-container
139
containerSecurityContext:
140
readOnlyRootFilesystem: true
141
allowPrivilegeEscalation: false
142
capabilities:
143
drop:
144
- ALL
145
# Configure specific upstream port for kube-state-metrics container
146
port: 9090
147
# Configure specific proxy endpoints port
148
# This port is for healthz on readinessProbe kube-rbac-proxy-http container
149
proxyEndpointsPort: 8888
150
resources: {}
151
# We usually recommend not to specify default resources and to leave this as a conscious
152
# choice for the user. This also increases chances charts run on environments with little
153
# resources, such as Minikube. If you do want to specify resources, uncomment the following
154
# lines, adjust them as necessary, and remove the curly braces after 'resources:'.
155
# limits:
156
# cpu: 100m
157
# memory: 64Mi
158
# requests:
159
# cpu: 10m
160
# memory: 32Mi
161
162
## volumeMounts enables mounting custom volumes in rbac-proxy containers
163
## Useful for TLS certificates and keys
164
volumeMounts: []
165
# - mountPath: /etc/tls
166
# name: kube-rbac-proxy-tls
167
# readOnly: true
168
serviceAccount:
169
# Specifies whether a ServiceAccount should be created, require rbac true
170
create: true
171
# The name of the ServiceAccount to use.
172
# If not set and create is true, a name is generated using the fullname template
173
name:
174
# Reference to one or more secrets to be used when pulling images
175
# ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/
176
imagePullSecrets: []
177
# ServiceAccount annotations.
178
# Use case: AWS EKS IAM roles for service accounts
179
# ref: https://docs.aws.amazon.com/eks/latest/userguide/specify-service-account-role.html
180
annotations: {}
181
# If false then the user will opt out of automounting API credentials.
182
automountServiceAccountToken: true
183
# Additional Environment variables
184
env: []
185
# - name: GOMAXPROCS
186
# valueFrom:
187
# resourceFieldRef:
188
# resource: limits.cpu
189
190
prometheus:
191
monitor:
192
enabled: false
193
annotations: {}
194
additionalLabels: {}
195
namespace: ""
196
namespaceSelector: []
197
jobLabel: ""
198
targetLabels: []
199
podTargetLabels: []
200
## SampleLimit defines per-scrape limit on number of scraped samples that will be accepted.
201
##
202
sampleLimit: 0
203
## TargetLimit defines a limit on the number of scraped targets that will be accepted.
204
##
205
targetLimit: 0
206
## Per-scrape limit on number of labels that will be accepted for a sample. Only valid in Prometheus versions 2.27.0 and newer.
207
##
208
labelLimit: 0
209
## Per-scrape limit on length of labels name that will be accepted for a sample. Only valid in Prometheus versions 2.27.0 and newer.
210
##
211
labelNameLengthLimit: 0
212
## Per-scrape limit on length of labels value that will be accepted for a sample. Only valid in Prometheus versions 2.27.0 and newer.
213
##
214
labelValueLengthLimit: 0
215
selectorOverride: {}
216
## kube-state-metrics endpoint
217
http:
218
interval: ""
219
scrapeTimeout: ""
220
proxyUrl: ""
221
## Whether to enable HTTP2 for servicemonitor
222
enableHttp2: false
223
honorLabels: false
224
metricRelabelings: []
225
relabelings: []
226
scheme: ""
227
## File to read bearer token for scraping targets
228
bearerTokenFile: ""
229
## Secret to mount to read bearer token for scraping targets. The secret needs
230
## to be in the same namespace as the service monitor and accessible by the
231
## Prometheus Operator
232
bearerTokenSecret: {}
233
# name: secret-name
234
# key: key-name
235
tlsConfig: {}
236
## selfMonitor endpoint
237
metrics:
238
interval: ""
239
scrapeTimeout: ""
240
proxyUrl: ""
241
## Whether to enable HTTP2 for servicemonitor
242
enableHttp2: false
243
honorLabels: false
244
metricRelabelings: []
245
relabelings: []
246
scheme: ""
247
## File to read bearer token for scraping targets
248
bearerTokenFile: ""
249
## Secret to mount to read bearer token for scraping targets. The secret needs
250
## to be in the same namespace as the service monitor and accessible by the
251
## Prometheus Operator
252
bearerTokenSecret: {}
253
# name: secret-name
254
# key: key-name
255
tlsConfig: {}
256
## Create a scrapeConfig resource for scraping the kube-state-metrics service. Use this instead of serviceMonitor
257
## to have more instances of kube-state-metrics safety.
258
scrapeconfig:
259
## To avoid duplicate metrics, first disable the serviceMonitor creation via prometheus.monitor.enabled=false
260
enabled: false
261
annotations: {}
262
additionalLabels: {}
263
jobName: kube-state-metrics
264
## SampleLimit defines per-scrape limit on number of scraped samples that will be accepted.
265
##
266
sampleLimit: 0
267
## TargetLimit defines a limit on the number of scraped targets that will be accepted.
268
##
269
targetLimit: 0
270
## Per-scrape limit on number of labels that will be accepted for a sample. Only valid in Prometheus versions 2.27.0 and newer.
271
##
272
labelLimit: 0
273
## Per-scrape limit on length of labels name that will be accepted for a sample. Only valid in Prometheus versions 2.27.0 and newer.
274
##
275
labelNameLengthLimit: 0
276
## Per-scrape limit on length of labels value that will be accepted for a sample. Only valid in Prometheus versions 2.27.0 and newer.
277
##
278
labelValueLengthLimit: 0
279
## StaticConfigLabels defines the labels to be used in the Prometheus static configuration for scraping.
280
staticConfigLabels: {}
281
scrapeInterval: ""
282
scrapeTimeout: ""
283
proxyUrl: ""
284
## Whether to enable HTTP2 for scrapeconfig
285
enableHttp2: false
286
honorLabels: true
287
metricRelabelings: []
288
relabelings: []
289
scheme: ""
290
tlsConfig: {}
291
## Configure network policy for kube-state-metrics
292
networkPolicy:
293
enabled: false
294
# egress:
295
# - {}
296
# ingress:
297
# - {}
298
# podSelector:
299
# matchLabels:
300
# app.kubernetes.io/name: kube-state-metrics
301
securityContext:
302
enabled: true
303
runAsGroup: 65534
304
runAsUser: 65534
305
fsGroup: 65534
306
runAsNonRoot: true
307
seccompProfile:
308
type: RuntimeDefault
309
## Specify security settings for a Container
310
## Allows overrides and additional options compared to (Pod) securityContext
311
## Ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-container
312
containerSecurityContext:
313
readOnlyRootFilesystem: true
314
allowPrivilegeEscalation: false
315
capabilities:
316
drop:
317
- ALL
318
## Node labels for pod assignment
319
## Ref: https://kubernetes.io/docs/user-guide/node-selection/
320
nodeSelector: {}
321
## Affinity settings for pod assignment
322
## Can be defined as either a dict or string. String is useful for `tpl` templating.
323
## Ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/
324
affinity: {}
325
# affinity: |
326
# podAntiAffinity:
327
# requiredDuringSchedulingIgnoredDuringExecution:
328
# - labelSelector:
329
# matchLabels:
330
# {{- include "kube-state-metrics.selectorLabels" . | indent 10 }}
331
# topologyKey: kubernetes.io/hostname
332
333
## Tolerations for pod assignment
334
## Ref: https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/
335
tolerations: []
336
## Topology spread constraints for pod assignment
337
## Ref: https://kubernetes.io/docs/concepts/workloads/pods/pod-topology-spread-constraints/
338
topologySpreadConstraints: []
339
# Annotations to be added to the deployment/statefulset
340
annotations: {}
341
# Labels to be added to the deployment/statefulset
342
labels: {}
343
# Annotations to be added to the pod
344
podAnnotations: {}
345
# Labels to be added to the pod
346
podLabels: {}
347
## Assign a PriorityClassName to pods if set
348
# priorityClassName: ""
349
350
# Ref: https://kubernetes.io/docs/tasks/run-application/configure-pdb/
351
podDisruptionBudget: {}
352
# Comma-separated list of metrics to be exposed.
353
# This list comprises of exact metric names and/or regex patterns.
354
# The allowlist and denylist are mutually exclusive.
355
metricAllowlist: []
356
# Comma-separated list of metrics not to be enabled.
357
# This list comprises of exact metric names and/or regex patterns.
358
# The allowlist and denylist are mutually exclusive.
359
metricDenylist: []
360
# Comma-separated list of additional Kubernetes label keys that will be used in the resource's
361
# labels metric. By default the metric contains only name and namespace labels.
362
# To include additional labels, provide a list of resource names in their plural form and Kubernetes
363
# label keys you would like to allow for them (Example: '=namespaces=[k8s-label-1,k8s-label-n,...],pods=[app],...)'.
364
# A single '*' can be provided per resource instead to allow any labels, but that has
365
# severe performance implications (Example: '=pods=[*]').
366
metricLabelsAllowlist: []
367
# - namespaces=[k8s-label-1,k8s-label-n]
368
369
# Comma-separated list of Kubernetes annotations keys that will be used in the resource'
370
# labels metric. By default the metric contains only name and namespace labels.
371
# To include additional annotations provide a list of resource names in their plural form and Kubernetes
372
# annotation keys you would like to allow for them (Example: '=namespaces=[kubernetes.io/team,...],pods=[kubernetes.io/team],...)'.
373
# A single '*' can be provided per resource instead to allow any annotations, but that has
374
# severe performance implications (Example: '=pods=[*]').
375
metricAnnotationsAllowList: []
376
# - pods=[k8s-annotation-1,k8s-annotation-n]
377
378
# Collectors enabled by default. Comment out entries to disable them.
379
# Additional opt-in collectors are listed below.
380
collectors:
381
- certificatesigningrequests
382
- configmaps
383
- cronjobs
384
- daemonsets
385
- deployments
386
- endpointslices
387
- horizontalpodautoscalers
388
- ingresses
389
- jobs
390
- leases
391
- limitranges
392
- mutatingwebhookconfigurations
393
- namespaces
394
- networkpolicies
395
- nodes
396
- persistentvolumeclaims
397
- persistentvolumes
398
- poddisruptionbudgets
399
- pods
400
- replicasets
401
- replicationcontrollers
402
- resourcequotas
403
- secrets
404
- services
405
- statefulsets
406
- storageclasses
407
- validatingwebhookconfigurations
408
- volumeattachments
409
# - ingressclasses
410
# - clusterrolebindings
411
# - clusterroles
412
# - roles
413
# - rolebindings
414
# - serviceaccounts
415
# Admission policy collectors require kube-state-metrics v2.20.0 or later.
416
# These validating admission policy collectors require Kubernetes v1.30+.
417
# - validatingadmissionpolicies
418
# - validatingadmissionpolicybindings
419
# These mutating admission policy collectors require Kubernetes v1.36+.
420
# - mutatingadmissionpolicies
421
# - mutatingadmissionpolicybindings
422
# collectorsExclude / collectorsExtra tweak the default `collectors` list above
423
# without redefining it. Both operate on `.Values.collectors` (not on KSM's
424
# built-in defaults): with `collectors: []` there is nothing to layer onto and
425
# `collectorsExtra` becomes the entire --resources list.
426
# collectorsExclude removes entries from the list:
427
collectorsExclude: []
428
# - pods
429
# collectorsExtra appends entries after exclusion (deduplicated):
430
collectorsExtra: []
431
# - rolebindings
432
433
# Enabling kubeconfig will pass the --kubeconfig argument to the container
434
kubeconfig:
435
enabled: false
436
# base64 encoded kube-config file
437
secret:
438
# Enabling support for customResourceState, will create a configMap including your config that will be read from kube-state-metrics
439
customResourceState:
440
# Whether to enable support for CustomResourceStateMetrics.
441
enabled: false
442
# Whether to create the ConfigMap that holds the config.
443
create: true
444
# Name of the ConfigMap that holds the config. If empty, name will be generated based on the release name.
445
name: ""
446
# ConfigMap key that holds the config.
447
key: config.yaml
448
# Definition of the CustomResourceStateMetrics. Add (Cluster)Role permissions to list/watch the resources defined in the config to rbac.extraRules.
449
config: {}
450
# Enable only the release namespace for collecting resources. By default all namespaces are collected.
451
# If releaseNamespace and namespaces are both set a merged list will be collected.
452
releaseNamespace: false
453
# Comma-separated list(string) or yaml list of namespaces to be enabled for collecting resources. By default all namespaces are collected.
454
namespaces: ""
455
# Comma-separated list of namespaces not to be enabled. If namespaces and namespaces-denylist are both set,
456
# only namespaces that are excluded in namespaces-denylist will be used.
457
namespacesDenylist: ""
458
## Override the deployment namespace
459
##
460
namespaceOverride: ""
461
resources: {}
462
# We usually recommend not to specify default resources and to leave this as a conscious
463
# choice for the user. This also increases chances charts run on environments with little
464
# resources, such as Minikube. If you do want to specify resources, uncomment the following
465
# lines, adjust them as necessary, and remove the curly braces after 'resources:'.
466
# limits:
467
# cpu: 100m
468
# memory: 64Mi
469
# requests:
470
# cpu: 10m
471
# memory: 32Mi
472
473
# Enable self metrics configuration for service and Service Monitor
474
# Default values for telemetry configuration can be overridden
475
# If you set telemetryNodePort, you must also set service.type to NodePort
476
selfMonitor:
477
enabled: false
478
# telemetryHost: 0.0.0.0
479
# telemetryPort: 8081
480
# telemetryNodePort: 0
481
# Enable vertical pod autoscaler support for kube-state-metrics
482
verticalPodAutoscaler:
483
enabled: false
484
# Recommender responsible for generating recommendation for the object.
485
# List should be empty (then the default recommender will generate the recommendation)
486
# or contain exactly one recommender.
487
# recommenders: []
488
# - name: custom-recommender-performance
489
490
# List of resources that the vertical pod autoscaler can control. Defaults to cpu and memory
491
controlledResources: []
492
# Specifies which resource values should be controlled: RequestsOnly or RequestsAndLimits.
493
# controlledValues: RequestsAndLimits
494
495
# Define the max allowed resources for the pod
496
maxAllowed: {}
497
# cpu: 200m
498
# memory: 100Mi
499
# Define the min allowed resources for the pod
500
minAllowed: {}
501
# cpu: 200m
502
# memory: 100Mi
503
# updatePolicy:
504
# Specifies minimal number of replicas which need to be alive for VPA Updater to attempt pod eviction
505
# minReplicas: 1
506
# Specifies whether recommended updates are applied when a Pod is started and whether recommended updates
507
# are applied during the life of a Pod. Possible values are "Off", "Initial", "Recreate", and "Auto".
508
# updateMode: Auto
509
510
# volumeMounts are used to add custom volume mounts to deployment.
511
# See example below
512
volumeMounts: []
513
# - mountPath: /etc/config
514
# name: config-volume
515
516
# volumes are used to add custom volumes to deployment
517
# See example below
518
volumes: []
519
# - configMap:
520
# name: cm-for-volume
521
# name: config-volume
522
523
# Extra manifests to deploy as an array
524
extraManifests: []
525
# - apiVersion: v1
526
# kind: ConfigMap
527
# metadata:
528
# labels:
529
# name: prometheus-extra
530
# data:
531
# extra-data: "value"
532
533
## Containers allows injecting additional containers.
534
containers: []
535
# - name: crd-init
536
# image: kiwigrid/k8s-sidecar:latest
537
538
## InitContainers allows injecting additional initContainers.
539
initContainers: []
540
# - name: crd-sidecar
541
# image: kiwigrid/k8s-sidecar:latest
542
543
## dnsPolicy allows to change the default DNS configuration for the pod
544
## Ref: https://kubernetes.io/docs/concepts/services-networking/dns-pod-service/#pod-s-dns-policy
545
dnsPolicy: ClusterFirst
546
## dnsConfig allows setting up specific DNS configuration for the pod
547
## Ref: https://kubernetes.io/docs/concepts/services-networking/dns-pod-service/#pod-dns-config
548
dnsConfig: {}
549
## Settings for startup, liveness and readiness probes
550
## Ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/
551
##
552
553
## Startup probe can optionally be enabled.
554
##
555
startupProbe:
556
enabled: false
557
failureThreshold: 3
558
httpGet:
559
httpHeaders: []
560
scheme: http
561
initialDelaySeconds: 0
562
periodSeconds: 10
563
successThreshold: 1
564
timeoutSeconds: 5
565
## Liveness probe
566
##
567
livenessProbe:
568
failureThreshold: 3
569
httpGet:
570
httpHeaders: []
571
scheme: http
572
initialDelaySeconds: 5
573
periodSeconds: 10
574
successThreshold: 1
575
timeoutSeconds: 5
576
## Readiness probe
577
##
578
readinessProbe:
579
failureThreshold: 3
580
httpGet:
581
httpHeaders: []
582
scheme: http
583
initialDelaySeconds: 5
584
periodSeconds: 10
585
successThreshold: 1
586
timeoutSeconds: 5
587
The trusted source for open source
Talk to an expertProduct
Customers
© 2026 Chainguard, Inc. All Rights Reserved.
Chainguard® and the Chainguard logo are registered trademarks of Chainguard, Inc. in the United States and/or other countries.
The other respective trademarks mentioned on this page are owned by the respective companies and use of them does not imply any affiliation or endorsement.
Chainguard® and the Chainguard logo are registered trademarks of Chainguard, Inc. in the United States and/or other countries.
The other respective trademarks mentioned on this page are owned by the respective companies and use of them does not imply any affiliation or endorsement.