Collects the metrics of every managed component through the manager service discovery and evaluates the platform alert rules.
Generated from catalog/services/prometheus.yaml: do not edit by hand.
Summary
| |
|---|
| Version | 3.5.5 |
| Use | install and configure, configure and connect |
| Layer | functional (AI catalog) |
| Category | Observability |
| Installation methods | binary |
| External connection | no |
| Sandbox only | no |
Licence
| |
|---|
| SPDX identifier | Apache-2.0 |
| Licence policy | core licence (MIT or Apache-2.0) |
| Licence exception | - |
| Platform component | prometheus |
Packages and artifacts
A package the project of the service publishes (its image, its binary archive, its Python or OS package) carries the licence of the service; a third-party package carries the licence written on its row, read from the official upstream metadata.
Supported systems and architectures
| Method | Operating systems | Architectures |
|---|
binary | RHEL family (dnf), Debian family (apt), Arch Linux (pacman) | x86_64 (architecture of the artifacts of the descriptor) |
Certified host systems: RHEL 8/9/10, Rocky Linux 8/9/10, AlmaLinux 8/9/10, Oracle Linux 8/9, CentOS Stream 9/10, Ubuntu 22.04/24.04, Debian 12, Arch Linux (rolling). The host preflight accepts these systems (other releases of a known family give a warning, end of life releases are refused) and the x86_64 and aarch64 architectures.
Prerequisites
Host
- at least 2048 MB of memory (warning,
memory).
- at least 20480 MB free for
/var/lib/navin (warning, disk).
Programs the commands and checks of the service start on the host, outside the managed roots: add them to allowed_commands of the agent (see Security of the Navin agent), else the agent refuses them with command_not_allowed: /usr/bin/curl.
Network and ports
| Component | Port name | Port | Opened in the host firewall |
|---|
prometheus | http | 9090/tcp | yes |
Services and connections needed
Details and resolution: see Dependencies.
Installation methods and modes
| Method | Default | What the method uses |
|---|
binary | yes | the binary archives of the descriptor, unpacked under the service directory |
Components
| Component | Kind | Installation methods | Ports |
|---|
Prometheus server (prometheus) | master | binary | 9090/tcp |
Single (single) (default)
One Prometheus server.
What the mode deploys:
| Component | Placement |
|---|
prometheus | min 1, max 1 |
High availability (ha)
Two identical replicas distinguished by the replica external label.
What the mode deploys:
| Component | Placement |
|---|
prometheus | min 2, max 2, recommended 2 |
Install this service
The install wizard of the Navin Manager plans, validates and runs the installation; you need the services:install permission on the cluster.
-
Open the wizard. In Clusters, choose the row action Install services of the target cluster. The wizard opens on its first step, Service.
-
Choose the service. On the Service step, select Prometheus. The card shows the licence Apache-2.0 and the dependencies the installation needs.
-
Choose the hosts and the mode. On the Hosts step, tick the hosts, then choose the Mode: single (default), ha. Each mode deploys the components listed in Installation methods and modes.
-
Bind the dependencies. On the Bindings step, choose for each dependency (alertmanager, blackbox) Install with the platform or Use an existing connection; an optional dependency can stay on No binding.
-
Configure. On the Configure step, review the parameters (see Configuration parameters); the required ones are manager_token. Passwords left empty with a generated default are generated and sealed by the Manager.
-
Review and install. On the Install step the Manager validates the plan and shows the installation order; when it says "The plan is valid. Ready to install.", choose Install. A highly available mode is installed only when its HA checks pass.
-
Verify. The operation ends when the health checks of every instance pass (see Health checks); the service then shows as running in Services.
Connect an existing service
| |
|---|
| Schemes | https, http |
| Default port | 9090 |
| Authentication | optional |
| Health check | /-/ready |
| Authentication method | Fields | Description |
|---|
basic | username, password | Users of the web configuration file (--web.config.file, basic_auth_users hashed with bcrypt). |
client_certificate | client_cert, client_key | Client certificate required by tls_server_config (client_auth_type RequireAndVerifyClientCert). |
none | - | Default of Prometheus: no authentication, keep it on a filtered network. |
Official documentation: https://prometheus.io/docs/prometheus/latest/configuration/https/
High availability
| |
|---|
| Cluster | replicas (replication) |
| High availability | redundancy (redundancy) |
| Failover | client side (client) |
| Replication | none (none) |
| Quorum | none (none) |
| Discovery | static (static) |
| Entry point | any node (any-node) |
| Official documentation | https://prometheus.io/docs/introduction/faq/ |
Prerequisites
| Prerequisite | Must be highly available | Modes | Description |
|---|
alertmanager | yes | ha | Alertmanager cluster deduplicating the alerts of both replicas. |
Topology per mode
| Modes | Highest catalog level | Distribution | Quorum component | Fault domains | Description |
|---|
single | standalone (standalone) | single (single) | - | 1 | One Prometheus server. |
ha | ha (ha) | active-active (active-active) | - | 2 | Two identical replicas scraping the same targets, distinguished by the replica external label. |
Notes
- Redundancy, not a unified storage: each replica keeps its own local data (small gaps may differ); Thanos or a similar layer is optional for a global deduplicated view.
Configuration parameters
Network
| Parameter | Type | Default | Allowed values | Required | Secret | Restart | Description |
|---|
HTTP port (port) | port | 9090 | - | no | no | no | Port of the API and user interface. |
TLS (tls_enabled) | bool | false | - | no | no | no | Serve the API and the interface over HTTPS (--web.config.file) with a certificate issued by the manager CA; the self scrape and the remote write clients then verify it with that CA. |
Storage
| Parameter | Type | Default | Allowed values | Required | Secret | Restart | Description |
|---|
Retention (retention) | duration | 15d | - | no | no | no | How long samples are kept. |
Disk alert threshold (disk_alert_percent) | int | 85 | min 50, max 99 | no | no | no | Used disk percentage raising an alert. |
Discovery
| Parameter | Type | Default | Allowed values | Required | Secret | Restart | Description |
|---|
Scrape interval (scrape_interval) | duration | 30s | - | no | no | no | Interval between two scrapes of a target. |
Manager API token (manager_token) | password | - | - | yes | yes | no | Read only token of the manager API used by the service discovery; written to a file readable by Prometheus only. |
Dependencies
For each active dependency the Manager takes the first of: the binding chosen in the wizard; a service of the same installation that provides it; a service already installed in the cluster; the only connection of the expected type. Otherwise an optional dependency stays unbound, and a required one is added to the installation in its default mode (the column below names the catalog service added).
| Binding | Provided by | Connection type | Endpoint | Optional | When nothing is bound | Description |
|---|
alertmanager | alertmanager | - | http | yes | stays unbound (optional) | Alertmanager receiving the platform alerts. |
blackbox | blackbox-exporter | - | http | yes | stays unbound (optional) | Blackbox exporter whose probes (manager health and the probes parameter) Prometheus runs through /probe: availability, latency and certificate expiry of the endpoints (rule NavinCertificateExpiry). |
Endpoints
| Endpoint | Scheme | Component | Port | Path | TLS parameter | Binding parameters | Binding secrets | Provisioning command |
|---|
http | http | prometheus | 9090 (port) | - | tls_enabled | - | - | - |
Commands
| Command | Component | Target | Description |
|---|
Reload (reload) | prometheus | every host | Reloads the configuration and the rules without restart. |
Show targets (targets) | prometheus | first host | Lists the active targets and their health. |
Health checks
Liveness (per instance)
| Component | Check | Details |
|---|
prometheus | HTTP {{ 'https' if config.tls_enabled else 'http' }}://{{ host.fqdn if config.tls_enabled else (host.ip or '127.0.0.1') }}:{{ config.port }}/-/ready | Expected 200; 60 retries; interval 2 s; timeout 3 s |
Preflight checks
| Check | Type | Meaning | Severity | Components |
|---|
memory | memory_mb {"min": 2048} | at least 2048 MB of memory | warning | every component |
disk | disk_free_mb {"min": 20480} | at least 20480 MB free for /var/lib/navin | warning | every component |
port_free | port_free {"param": "port"} | port 9090 free on the host | blocking | every component |
Uninstall
Paths removed when the data is purged: {{ paths.data }}, {{ paths.log }}.
Quick links
- Prometheus interface:
{{ 'https' if config.tls_enabled else 'http' }}://{{ host.fqdn }}:{{ config.port }}/
Upstream documentation