#

Victoria Metrics Gateway - Auth & Rate-Limitting proxy for Victoria Metrics

Table of Content #

Prerequisites #

Install the follow packages: git, kubectl, helm, helm-docs. See this tutorial.
PV support on underlying infrastructure

Chart Details #

This chart will do the following:

Rollout victoria metrics gateway

How to install #

Access a Kubernetes cluster.

Setup chart repository (can be omitted for OCI repositories) #

Add a chart helm repository with follow commands:

      helm repo add vm https://victoriametrics.github.io/helm-charts/

helm repo update

List versions of vm/victoria-metrics-gateway chart available to installation:

      helm search repo vm/victoria-metrics-gateway -l

Install `victoria-metrics-gateway` chart #

Export default values of victoria-metrics-gateway chart to file values.yaml:

For HTTPS repository

      helm show values vm/victoria-metrics-gateway > values.yaml

For OCI repository

      helm show values oci://ghcr.io/victoriametrics/helm-charts/victoria-metrics-gateway > values.yaml

Change the values according to the need of the environment in values.yaml file.

Test the installation with command:

For HTTPS repository

      helm install vmg vm/victoria-metrics-gateway -f values.yaml -n NAMESPACE --debug --dry-run

For OCI repository

      helm install vmg oci://ghcr.io/victoriametrics/helm-charts/victoria-metrics-gateway -f values.yaml -n NAMESPACE --debug --dry-run

Install chart with command:

For HTTPS repository

      helm install vmg vm/victoria-metrics-gateway -f values.yaml -n NAMESPACE

For OCI repository

      helm install vmg oci://ghcr.io/victoriametrics/helm-charts/victoria-metrics-gateway -f values.yaml -n NAMESPACE

Get the pods lists by running this commands:

      kubectl get pods -A | grep 'vmg'

Get the application by running this command:

      helm list -f vmg -n NAMESPACE

See the history of versions of vmg application with command.

      helm history vmg -n NAMESPACE

How to use JWT signature verification #

Kubernetes best-practice is to store sensitive configuration parts in secrets. For example, 2 keys will be stored as:

      apiVersion: v1
data:
  key: "<<KEY_DATA>>"
kind: Secret
metadata:
  name: key1
---
apiVersion: v1
data:
  key: "<<KEY_DATA>>"
kind: Secret
metadata:
  name: key2
    

In order to use those secrets it is needed to:

mount secrets into pod
provide flag pointing to secret on disk

Here is an example values.yml file configuration to achieve this:

      auth:
  enable: true

extraVolumes:
  - name: key1
    secret:
      secretName: key1
  - name: key2
    secret:
      secretName: key2

extraVolumeMounts:
  - name: key1
    mountPath: /key1
  - name: key2
    mountPath: /key2

extraArgs:
  envflag.enable: "true"
  envflag.prefix: VM_
  loggerFormat: json
  auth.publicKeyFiles: "/key1/key,/key2/key"
    

Note that in this configuration all secret keys will be mounted and accessible to pod. Please, refer to this doc to see all available secret source options.

How to uninstall #

Remove application with command.

      helm uninstall vmg -n NAMESPACE

Documentation of Helm Chart #

Install helm-docs following the instructions on this tutorial.

Generate docs with helm-docs command.

      cd charts/victoria-metrics-gateway

helm-docs

The markdown generation is entirely go template driven. The tool parses metadata from charts and generates a number of sub-templates that can be referenced in a template file (by default README.md.gotmpl). If no template file is provided, the tool has a default internal template that will generate a reasonably formatted README.

Parameters #

The following tables lists the configurable parameters of the chart and their default values.

Change the values according to the need of the environment in victoria-metrics-gateway/values.yaml file.

Key	Description
`affinity: {}`	`(object)` Affinity configurations
`annotations: {}`	`(object)` Annotations to be added to the deployment
`auth: enabled: false`	`(object)` Access Control configuration. Check here for details
`auth.enabled: false`	`(bool)` Enable/Disable access-control
`clusterMode: false`	`(bool)` Specify to True if the source for rate-limiting, reading and writing as a VictoriaMetrics Cluster. Must be true for rate limiting
`configMap: ""`	`(string)` Use existing configmap if specified otherwise .config values will be used. Check here for details
`containerWorkingDir: /`	`(string)` Container working directory
`env: []`	`(list)` Additional environment variables (ex.: secret tokens, flags). Check here for details.
`envFrom: []`	`(list)` Specify alternative source for env variables
`extraArgs: envflag.enable: true envflag.prefix: VM_ httpListenAddr: :8431 loggerFormat: json`	`(object)` Extra command line arguments for container of component
`extraContainers: []`	`(list)` Extra containers to run in a pod with vmgateway
`extraHostPathMounts: []`	`(list)` Additional hostPath mounts
`extraLabels: {}`	`(object)` Labels to be added to Deployment
`extraObjects: []`	`(list)` Add extra specs dynamically to this chart
`extraVolumeMounts: []`	`(list)` Extra Volume Mounts for the container
`extraVolumes: []`	`(list)` Extra Volumes for the pod
`fullnameOverride: ""`	`(string)` Override resources fullname
`global.cluster.dnsDomain: cluster.local.`	`(string)` K8s cluster domain suffix, uses for building storage pods’ FQDN. Details are here
`global.compatibility: openshift: adaptSecurityContext: auto`	`(object)` Openshift security context compatibility configuration
`global.image.registry: ""`	`(string)` Image registry, that can be shared across multiple helm charts
`global.imagePullSecrets: []`	`(list)` Image pull secrets, that can be shared across multiple helm charts
`image.pullPolicy: IfNotPresent`	`(string)` Pull policy of Docker image
`image.registry: ""`	`(string)` Victoria Metrics gateway Docker registry
`image.repository: victoriametrics/vmgateway`	`(string)` Victoria Metrics gateway Docker repository and image name
`image.tag: ""`	`(string)` Tag of Docker image override Chart.AppVersion
`image.variant: ""`	`(string)` Variant of the image to use. e.g. enterprise, enterprise-scratch
`imagePullSecrets: []`	`(list)` Image pull secrets
`ingress.annotations: {}`	`(object)` Ingress annotations
`ingress.enabled: false`	`(bool)` Enable deployment of ingress for server component
`ingress.extraLabels: {}`	`(object)` Ingress extra labels
`ingress.hosts: - name: vmgateway.local path: - / port: http`	`(list)` Array of host objects
`ingress.ingressClassName: ""`	`(string)` Ingress controller class name
`ingress.pathType: Prefix`	`(string)` Ingress path type
`ingress.tls: []`	`(list)` Array of TLS objects
`initContainers: []`	`(list)` Init containers for vmgateway
`license: key: "" secret: key: "" name: ""`	`(object)` Enterprise license key configuration for VictoriaMetrics enterprise. Required only for VictoriaMetrics enterprise. Check docs here, for more information, visit site. Request a trial license here Supported starting from VictoriaMetrics v1.94.0
`license.key: ""`	`(string)` License key
`license.secret: key: "" name: ""`	`(object)` Use existing secret with license key
`license.secret.key: ""`	`(string)` Key in secret with license key
`license.secret.name: ""`	`(string)` Existing secret name
`nameOverride: ""`	`(string)` Override chart name
`nodeSelector: {}`	`(object)` NodeSelector configurations. Check here for details
`podAnnotations: {}`	`(object)` Annotations to be added to pod
`podDisruptionBudget: enabled: false labels: {}`	`(object)` See `kubectl explain poddisruptionbudget.spec` for more. Check here for details
`podLabels: {}`	`(object)` Labels to be added to pod
`podSecurityContext: enabled: true`	`(object)` Pod’s security context. Details are here
`probe.liveness: initialDelaySeconds: 5 periodSeconds: 15 tcpSocket: {} timeoutSeconds: 5`	`(object)` Liveness probe
`probe.readiness: httpGet: {} initialDelaySeconds: 5 periodSeconds: 15`	`(object)` Readiness probe
`probe.startup: {}`	`(object)` Startup probe
`rateLimiter: config: {} datasource: url: "" enabled: false`	`(object)` Rate limiter configuration. Docs are here
`rateLimiter.datasource.url: ""`	`(string)` Datasource VictoriaMetrics or vmselects. Required. Example http://victoroametrics:8428 or http://vmselect:8481/select/0/prometheus
`rateLimiter.enabled: false`	`(bool)` Enable/Disable rate-limiting
`read.url: ""`	`(string)` Read endpoint without suffixes, victoriametrics or vmselect. Example http://victoroametrics:8428 or http://vmselect:8481
`replicaCount: 1`	`(int)` Number of replicas of vmgateway
`resources: {}`	`(object)` We usually recommend not to specify default resources and to leave this as a conscious choice for the user. This also increases chances charts run on environments with little resources, such as Minikube. If you do want to specify resources, uncomment the following lines, adjust them as necessary, and remove the curly braces after ‘resources:’.
`securityContext: enabled: true runAsGroup: 1000 runAsNonRoot: true runAsUser: 1000`	`(object)` Pod security context. Check here for details
`service.annotations: {}`	`(object)` Service annotations
`service.clusterIP: ""`	`(string)` Service ClusterIP
`service.enabled: true`	`(bool)` Enabled vmgateway service
`service.externalIPs: []`	`(list)` Service external IPs. Check here for details
`service.externalTrafficPolicy: ""`	`(string)` Service external traffic policy. Check here for details
`service.extraLabels: {}`	`(object)` Service labels
`service.healthCheckNodePort: ""`	`(string)` Health check node port for a service. Check here for details
`service.ipFamilies: []`	`(list)` List of service IP families. Check here for details.
`service.ipFamilyPolicy: ""`	`(string)` Service IP family policy. Check here for details.
`service.loadBalancerIP: ""`	`(string)` Service load balancer IP
`service.loadBalancerSourceRanges: []`	`(list)` Load balancer source range
`service.servicePort: 8431`	`(int)` Service port
`service.type: ClusterIP`	`(string)` Service type
`serviceAccount.annotations: {}`	`(object)` Annotations to add to the service account
`serviceAccount.create: true`	`(bool)` Specifies whether a service account should be created
`serviceAccount.name: null`	`(string)` The name of the service account to use. If not set and create is true, a name is generated using the fullname template
`serviceMonitor.annotations: {}`	`(object)` Service Monitor annotations
`serviceMonitor.basicAuth: {}`	`(object)` Basic auth params for Service Monitor
`serviceMonitor.enabled: false`	`(bool)` Enable deployment of Service Monitor for server component. This is Prometheus operator object
`serviceMonitor.extraLabels: {}`	`(object)` Service Monitor labels
`serviceMonitor.metricRelabelings: []`	`(list)` Service Monitor metricRelabelings
`serviceMonitor.relabelings: []`	`(list)` Service Monitor relabelings
`tolerations: []`	`(list)` Tolerations configurations. Check here for details
`write.url: ""`	`(string)` Write endpoint without suffixes, victoriametrics or vminsert. Example http://victoroametrics:8428 or http://vminsert:8480

#

Table of Content #

Prerequisites #

Chart Details #

How to install #

Setup chart repository (can be omitted for OCI repositories) #

Install victoria-metrics-gateway chart #

How to use JWT signature verification #

How to uninstall #

Documentation of Helm Chart #

Parameters #

Install `victoria-metrics-gateway` chart #