scrapeconfig: support more discovery mechanisms by AndrewChubatiuk · Pull Request #1838 · VictoriaMetrics/operator

AndrewChubatiuk · 2026-02-21T14:15:24Z

fixes #899
fixes #1951

Summary by cubic

Expands service discovery and unifies HTTP/TLS/auth/proxy handling across vmagent, vmsingle, and vmalertmanager for simpler, safer configs. Adds filesystem access enforcement across all scrapes and VMAlertmanagerConfig receivers, configurable via VMAlertmanager.spec.arbitraryFSAccessThroughSMs, and introduces Mattermost support.

New Features
- SD configs: Kuma, OVHCloud, PuppetDB, Vultr.
- Shared HTTPSDOptions across HTTPSDConfig, ConsulSDConfig, AzureSDConfig, EurekaSDConfig.
- HTTPConfig: adds follow_redirects and ProxyConfig; applied to vmalertmanager HTTP clients.
- FS access enforcement: deny token/password/TLS file paths across scrape objects and VMAlertmanagerConfig receivers via VMAlertmanager.spec.arbitraryFSAccessThroughSMs.
- ScrapeClass: centralized type with attachMetadata.
- VMAlertmanagerConfig: adds Mattermost receiver.
Migration
- HTTP fields moved under HTTPSDOptions; proxyURL replaced with ProxyConfig; AzureSDConfig.port is now int32.
- Rename ProxyAuth to ProxyClientConfig under VMScrapeParams.
- EndpointAuth now lives under EndpointScrapeParams for Service/Pod/Node/Static/Probe/VMScrapeConfig.
- VMAlertmanagerTracingConfig: rename HTTPHeaders to Headers.
- TLSServerConfig.prefer_server_cipher_suites is now *bool.

^{Written for commit 59784ba. Summary will update on new commits.}

cubic-dev-ai

2 issues found across 9 files

Prompt for AI agents (all issues)


Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="docs/CHANGELOG.md">

<violation number="1" location="docs/CHANGELOG.md:31">
P3: Fix the typo in the changelog entry: `eureka_sd_confiig` should be `eureka_sd_config` so the documented discovery config name is accurate.</violation>

<violation number="2" location="docs/CHANGELOG.md:31">
P1: Custom agent: **Changelog Review Agent**

Changelog entries must include a user-centric before/after explanation and link relevant issues/PRs (Required structure §§3–4). This entry only lists added configs and provides no references, so it does not meet the mandated changelog format.</violation>
</file>

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.}

cubic-dev-ai

1 issue found across 1 file (changes from recent commits).

Prompt for AI agents (all issues)


Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="docs/CHANGELOG.md">

<violation number="1" location="docs/CHANGELOG.md:31">
P1: Custom agent: **Changelog Review Agent**

Changelog entry does not follow the required structure (missing before/after user-centric explanation and references), which violates the Changelog Review Agent rule’s mandatory format.</violation>
</file>

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.}

cubic-dev-ai

9 issues found across 11 files (changes from recent commits).

Prompt for AI agents (unresolved issues)


Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="docs/api.md">

<violation number="1" location="docs/api.md:2339">
P3: `MattermostConfig` description is incorrect and references Teams “adaptive cards/flows,” which misdocuments the Mattermost integration.</violation>
</file>

<file name="api/operator/v1beta1/vmalertmanagerconfig_types.go">

<violation number="1" location="api/operator/v1beta1/vmalertmanagerconfig_types.go:435">
P1: Mattermost receivers bypass arbitrary filesystem access enforcement because they are not included in `ValidateArbitraryFSAccess()`.</violation>

<violation number="2" location="api/operator/v1beta1/vmalertmanagerconfig_types.go:507">
P2: Webex validation dropped the required `http_config.authorization` check, allowing invalid receiver configs to pass CR validation.</violation>

<violation number="3" location="api/operator/v1beta1/vmalertmanagerconfig_types.go:1637">
P2: `MattermostConfig.validate()` does not reject configurations where both `url` and `url_secret` are set.</violation>
</file>

<file name="config/crd/overlay/crd.descriptionless.yaml">

<violation number="1">
P1: Mattermost CRD schema uses wrong secret field name and invalidly requires it, breaking receiver configuration.</violation>
</file>

<file name="internal/controller/operator/factory/vmalertmanager/config.go">

<violation number="1" location="internal/controller/operator/factory/vmalertmanager/config.go:150">
P1: Nil pointer dereference when `baseCfg.Global` is nil. When the base alertmanager config has no `global:` section, `baseCfg.Global` will be nil, and passing it to `buildOpsGenie`, `buildSlack`, `buildEmail`, etc. will panic on the first field access (e.g., `gc.OpsGenieAPIKey`). Initialize a zero-value `globalConfig` before passing it to `buildReceiver`.</violation>

<violation number="2" location="internal/controller/operator/factory/vmalertmanager/config.go:1353">
P1: Missing `description` field in OpsGenie config output. The old `buildOpsGenie` included `toYamlString("description", og.Description)`, but it was dropped in this refactor. OpsGenie alerts will silently lose their incident description.</violation>
</file>

<file name="config/crd/overlay/crd.yaml">

<violation number="1">
P3: The Mattermost schema description is incorrect (mentions adaptive cards/flows), which will mislead generated CRD documentation.</violation>

<violation number="2">
P1: Renaming `http_headers` to `headers` in the CRD without keeping a compatibility alias introduces a breaking API change for existing manifests.</violation>
</file>

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review, or fix all with cubic.}

vrutkovs · 2026-04-20T11:32:50Z

+type ScrapeClass struct {
+	// name of the scrape class.
+	//
+	// +kubebuilder:validation:MinLength=1


Wouldn't that be covered by required already?

don't know, moved this struct as is from vmagent_types.go

vrutkovs · 2026-04-20T11:33:24Z

+	// default defines that the scrape applies to all scrape objects that
+	// don't configure an explicit scrape class name.
+	//
+	// Only one scrape class can be set as the default.


Do we have checks to ensure this?

vrutkovs · 2026-04-20T16:39:11Z

+			return fmt.Errorf("responders[%d]: one of id, name or username is required", idx)
+		}
+		switch {
+		case strings.Contains(responder.Type, "{{"):


Does it support {% templates similar to Jinja?

it doesn't AFAIK. JFYI moved this section as is from validation function, that did validation for all receivers together

AndrewChubatiuk requested a review from vrutkovs as a code owner February 21, 2026 14:15

cubic-dev-ai Bot reviewed Feb 21, 2026

View reviewed changes

Comment thread docs/CHANGELOG.md

Comment thread docs/CHANGELOG.md

AndrewChubatiuk force-pushed the support-more-sd-configs branch from 5da4352 to 5de88be Compare February 21, 2026 14:19

cubic-dev-ai Bot reviewed Feb 21, 2026

View reviewed changes

Comment thread docs/CHANGELOG.md Outdated

AndrewChubatiuk force-pushed the support-more-sd-configs branch 5 times, most recently from d15e1b6 to 3f9ea3c Compare February 26, 2026 08:21

AndrewChubatiuk assigned vrutkovs Feb 26, 2026

AndrewChubatiuk force-pushed the support-more-sd-configs branch 2 times, most recently from f8a67d1 to 02f937e Compare March 6, 2026 15:16

AndrewChubatiuk force-pushed the support-more-sd-configs branch 4 times, most recently from 10c04f6 to d86bbfc Compare March 31, 2026 13:47

cubic-dev-ai Bot reviewed Apr 1, 2026

View reviewed changes

AndrewChubatiuk force-pushed the support-more-sd-configs branch 5 times, most recently from 73adb50 to b9eee7d Compare April 8, 2026 09:39

AndrewChubatiuk force-pushed the support-more-sd-configs branch 2 times, most recently from fd0570f to 45ba8e6 Compare April 16, 2026 11:19

vrutkovs reviewed Apr 21, 2026

View reviewed changes

AndrewChubatiuk added 3 commits April 21, 2026 18:04

scrapeconfig: support more discovery mechanisms

7ae22db

vmagent and vmalertmanager: arbitrary fs access for all params

d937c09

added mattermost support

59784ba

AndrewChubatiuk force-pushed the support-more-sd-configs branch from 2bbdf52 to 59784ba Compare April 21, 2026 15:13

Conversation

AndrewChubatiuk commented Feb 21, 2026 • edited by cubic-dev-ai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary by cubic

Uh oh!

cubic-dev-ai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

cubic-dev-ai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

cubic-dev-ai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

vrutkovs Apr 20, 2026

Choose a reason for hiding this comment

Uh oh!

AndrewChubatiuk Apr 21, 2026

Choose a reason for hiding this comment

Uh oh!

vrutkovs Apr 20, 2026

Choose a reason for hiding this comment

Uh oh!

vrutkovs Apr 20, 2026

Choose a reason for hiding this comment

Uh oh!

AndrewChubatiuk Apr 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

AndrewChubatiuk commented Feb 21, 2026 •

edited by cubic-dev-ai Bot

Loading

AndrewChubatiuk Apr 21, 2026 •

edited

Loading