Configure Grafana Mimir Helm chart on Grafana Labs

Configure Grafana Enterprise Metrics

Tue, 15 Oct 2024 13:19:10 +0000

Configure Grafana Enterprise Metrics

From the Grafana Helm chart point of view, the main differences between Grafana Mimir and Grafana Enterprise Metrics (GEM) are:

GEM requires a valid license.
Instead of using NGINX as the router of requests to internal components, GEM deploys its own enterprise gateway component that authenticates and routes requests.
More mandatory and optional components are available, such as the admin API and various proxies.

Before you begin

Follow the instructions and Choose a name for your GEM cluster.

It is recommended, but not required to use the same name as the Helm release. For example if the cluster name is mygem, you’d install the chart with helm install mygem grafana/mimir-distributed.
Follow the instruction in Get a GEM license to acquire a license.

Handling the license file

There are two options:

Provide the license as a value for the license.contents Helm value.

Either on the command line for the helm command as --set-file 'license.contents=./license.jwt' or by writing the contents into your custom values:
YAML
```
license:
  contents: "iyJhbGci..."
```
Store the license in a Kubernetes Secret.

In this case use the following custom values:
YAML
```
license:
  external: true
  secretName: <name-of-your-secret>
```

Enable GEM in the configuration

Add the following value to your custom values:

enterprise:
  enabled: true

If you want to use a different cluster name for the license and a different Helm release name on the command line, also set:

mimir:
  structuredConfig:
    cluster_name: <cluster-name-in-license>

Configure Grafana Mimir to allow Vault Agent to inject certificates and keys into Pods

Tue, 15 Oct 2024 13:19:10 +0000

Configure Grafana Mimir to allow Vault Agent to inject certificates and keys into Pods

When you enable this feature, Helm updates the annotations on all Pods that have TLS (transport layer security) configurable components. When you deploy Mimir or GEM, Vault Agent fetches the relevant secrets from Vault according to the annotations and mounts them to the Pod.

Note: Vault and Vault Agent must to be running already.

Example values.yaml file:

vaultAgent:
  enabled: true
  roleName: "test-role"
  clientCertPath: "client/cert/path"
  clientKeyPath: "client/key/path"
  serverCertPath: "server/cert/path"
  serverKeyPath: "server/key/path"
  caCertPath: "ca/cert/path"

Generated Kubernetes Deployment YAML file based on the preceding example:

apiVersion: apps/v1
kind: Deployment
metadata:
  name: release-name
  labels:
    helm.sh/chart: mimir-release-1.2.3
    app.kubernetes.io/name: mimir
    app.kubernetes.io/instance: release-name
    app.kubernetes.io/component: comonent-name
    app.kubernetes.io/version: "123"
    app.kubernetes.io/managed-by: Helm
  annotations: {}
  namespace: "default"
spec:
  replicas: 1
  selector:
    matchLabels:
      app.kubernetes.io/name: mimir
      app.kubernetes.io/instance: release-name
      app.kubernetes.io/component: component-name
  strategy:
    type: RollingUpdate
  template:
    metadata:
      annotations:
        vault.hashicorp.com/agent-inject: "true"
        vault.hashicorp.com/role: "test-role"
        vault.hashicorp.com/agent-inject-secret-client.crt: "client/cert/path"
        vault.hashicorp.com/agent-inject-secret-client.key: "client/key/path"
        vault.hashicorp.com/agent-inject-secret-server.crt: "server/cert/path"
        vault.hashicorp.com/agent-inject-secret-server.key: "server/key/path"
        vault.hashicorp.com/agent-inject-secret-root.crt: "ca/cert/path"

vault.hashicorp.com/agent-inject-secret-<FILENAME>: '<PATH>' tells Vault Agent where to find the secret, and the name of the file to write the secret to. For example: vault.hashicorp.com/agent-inject-secret-client.crt: 'client/cert/path' will look for the secret at the path client/cert/path within Vault, and mount this secret to the pod as client.crt in the /vault/secrets/ directory.

For more information about Vault and Vault Agent, see Injecting Vault Secrets Into Kubernetes Pods via a Sidecar.

To configure TLS in Mimir, refer to Securing Grafana Mimir communications with TLS.

Configure native histograms

Tue, 15 Oct 2024 13:19:10 +0000

Configure native histograms

To enable support for ingesting Prometheus native histograms over the remote write API endpoint, set the configuration parameter native_histograms_ingestion_enabled to true.

To enable support for querying native histograms together with Grafana Mimir query sharding, set the configuration parameter query_result_response_format to protobuf.

Example values file:

mimir:
  structuredConfig:
    frontend:
      query_result_response_format: protobuf
    limits:
      native_histograms_ingestion_enabled: true

Note
Native histograms is an experimental feature of Grafana Mimir.

To configure bucket limits for native histograms, refer to Configure native histograms.

To configure Grafana Agent or Prometheus to write native histograms to Grafana Mimir, refer to Send native histograms to Mimir.

To visualize native histograms in Mimir, refer to Visualize native histograms.

Configure Redis cache

Mon, 21 Oct 2024 23:08:03 +0000

Configure Redis cache

Caution
Starting with Mimir version 2.14, the experimental support for Redis caching is deprecated. It will be removed in a future release. You are encouraged to switch to Memcached.

Besides support for Memcached, Mimir also supports Redis for the chunks-cache, index-cache, results-cache and metadata-cache. To use Redis, deploy Redis instances, disable the built-in Memcached configuration flag in values.yaml of mimir-distributed Helm chart, and then configure Mimir to use Redis.

To disable Memcached, remove any chunks-cache, index-cache, metadata-cache and results-cache configuration from your Helm values.yaml file. Alternatively, explicitly disable each of the Memcached instances by setting enabled to false:

chunks-cache:
  enabled: false
index-cache:
  enabled: false
metadata-cache:
  enabled: false
results-cache:
  enabled: false

Next, configure Mimir to connect to Redis using structuredConfig. Refer to the configuration parameters reference for Redis connection configuration options. For example:

mimir:
  structuredConfig:
    blocks_storage:
      bucket_store:
        chunks_cache:
          backend: redis
          redis:
            endpoint: <redis-url>:6379
        index_cache:
          backend: redis
          redis:
            endpoint: <redis-url>:6379
        metadata_cache:
          backend: redis
          redis:
            endpoint: <redis-url>:6379
    frontend:
      cache_results: true
      results_cache:
        backend: redis
        redis:
          endpoint: <redis-url>:6379