mimirtool

Mimir ruler sidecar

Mimir ruler sidecar to monitor a mounted rules file and syncing the rules to a configured Mimir instance.

How it works

This container runs as a sidecar to monitor rule and alertmanager configuration files. When changes are detected by inotify, it validates and syncs the rules to a configured Mimir instance.

Kubernetes

I'm using the official distributed helm chart for Mimir. Add required extra containers to the mimir-ruler pod:

spec:
  [...]
  ruler:
    [...]
    extraContainers:
      - name: sidecar
        image: quay.io/kiwigrid/k8s-sidecar:latest
        env:
          - name: LABEL
            value: "app.kubernetes.io/managed-by"
          - name: LABEL_VALUE
            value: "k8s-sidecar"
          - name: RESOURCE
            value: both
          - name: FOLDER
            value: /mimirtool/
        volumeMounts:
          - name: mimirtool-data
            mountPath: /mimirtool
      - name: mimirtool
        image: quay.io/thegeeklab/mimirtool:latest
        command:
          - "/usr/local/bin/entrypoint"
          - "watch"
        env:
          - name: MIMIRTOOL_CONF
            value: /mimirtool
          - name: MIMIRTOOL_RULES_PREFIX
            value: mimir-rules
        envFrom:
          - secretRef:
              name: mimir-ruler-secret
        volumeMounts:
          - name: mimirtool-data
            mountPath: /mimirtool
      extraVolumes:
        - name: mimirtool-data
          emptyDir:
            sizeLimit: 10Mi

Create a dedicated service account for the mimir ruler:

spec:
  [...]
  values:
    [...]
    ruler:
      enabled: True
      serviceAccount:
      create: True
      name: mimir-ruler

Create a role with the required permissions for kiwigrid/k8s-sidecar to watch secrets and config maps:

---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: mimir-ruler
rules:
  - apiGroups:
      - ""
    resources:
      - configmaps
      - secrets
    verbs:
      - get
      - list
      - watch
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: mimir-ruler
subjects:
  - kind: ServiceAccount
    name: mimir-ruler
roleRef:
  kind: Role
  name: mimir-ruler
  apiGroup: rbac.authorization.k8s.io

Create config maps and/or secrets for your mimir rules and alertmanager config and ensure to add the configured k8s-sidecar label, in the example above app.kubernetes.io/managed-by: "k8s-sidecar".

Environment Variables

The following environment variables can be used to configure the mimirtool:

• MIMIRTOOL_CONF: Path to configuration directory (default: /tmp/mimir)
• MIMIRTOOL_DRYRUN: Run in dry-run mode without making changes (default: false)
• MIMIRTOOL_RULES_PREFIX: Prefix for rule files in the configuration directory (default: none, uses rules.yaml)

License

This project is licensed under the MIT License - see the LICENSE file for details.