feat: add parameter enableAdminAPI to prometheus configuration

Signed-off-by: morenod <[email protected]>

Author: morenod

bundle/manifests/monitoring.rhobs_monitoringstacks.yaml

@@ -199,6 +199,11 @@ spec:
                   replicas: 2
                 description: Define prometheus config
                 properties:
+                  enableAdminAPI:
+                    description: |-
+                      Enable Prometheus Admin API
+                      Default to the value of `false`.
+                    type: boolean
                   enableOtlpHttpReceiver:
                     description: |-
                       Enable Prometheus to accept OpenTelemetry Metrics via the otlp/http protocol.

bundle/manifests/observability-operator.clusterserviceversion.yaml

@@ -42,7 +42,7 @@ metadata:
     categories: Monitoring
     certified: "false"
     containerImage: observability-operator:1.2.0
-    createdAt: "2025-10-02T08:35:53Z"
+    createdAt: "2025-10-21T15:48:01Z"
     description: A Go based Kubernetes operator to setup and manage highly available
       Monitoring Stack using Prometheus, Alertmanager and Thanos Querier.
     operatorframework.io/cluster-monitoring: "true"

deploy/crds/common/monitoring.rhobs_monitoringstacks.yaml

@@ -131,6 +131,15 @@ spec:
                 - CreateClusterRoleBindings
                 - NoClusterRoleBindings
                 type: string
+              enableAdminAPI:
+                description: |-
+                  Enable Prometheus Admin API.
+                  Defaults to the value of `false`.
+                  WARNING: Enabling the admin APIs enables mutating endpoints, to delete data,
+                  shutdown Prometheus, and more. Enabling this should be done with care and the
+                  user is advised to add additional authentication authorization via a proxy to
+                  ensure only clients authorized to perform these actions can do so.
+                type: boolean
               logLevel:
                 default: info
                 description: Loglevel set log levels of configured components

docs/api.md

@@ -116,6 +116,18 @@ so that endpoint discovery works as expected.<br/>
             <i>Default</i>: CreateClusterRoleBindings<br/>
         </td>
         <td>false</td>
+      </tr><tr>
+        <td><b>enableAdminAPI</b></td>
+        <td>boolean</td>
+        <td>
+          Enable Prometheus Admin API.
+Defaults to the value of `false`.
+WARNING: Enabling the admin APIs enables mutating endpoints, to delete data,
+shutdown Prometheus, and more. Enabling this should be done with care and the
+user is advised to add additional authentication authorization via a proxy to
+ensure only clients authorized to perform these actions can do so.<br/>
+        </td>
+        <td>false</td>
       </tr><tr>
         <td><b>logLevel</b></td>
         <td>enum</td>

pkg/apis/monitoring/v1alpha1/types.go

@@ -108,6 +108,15 @@ type MonitoringStackSpec struct {
 	// +kubebuilder:default="120h"
 	Retention monv1.Duration `json:"retention,omitempty"`
 
+	// Enable Prometheus Admin API.
+	// Defaults to the value of `false`.
+	// WARNING: Enabling the admin APIs enables mutating endpoints, to delete data,
+	// shutdown Prometheus, and more. Enabling this should be done with care and the
+	// user is advised to add additional authentication authorization via a proxy to
+	// ensure only clients authorized to perform these actions can do so.
+	// +optional
+	EnableAdminAPI bool `json:"enableAdminAPI,omitempty"`
+
 	// Define resources requests and limits for Monitoring Stack Pods.
 	// +optional
 	// +kubebuilder:default={requests:{cpu: "100m", memory: "256Mi"}, limits:{memory: "512Mi", cpu: "500m"}}

pkg/controllers/monitoring/monitoring-stack/components.go

@@ -209,6 +209,7 @@ func newPrometheus(
 					return []monv1.EnableFeature{}
 				}(),
 			},
+			EnableAdminAPI:        ms.Spec.EnableAdminAPI,
 			Retention:             ms.Spec.Retention,
 			RuleSelector:          prometheusSelector,
 			RuleNamespaceSelector: ms.Spec.NamespaceSelector,

test/e2e/monitoring_stack_controller_test.go

@@ -758,6 +758,7 @@ func assertPrometheusManagedFields(t *testing.T) {
 			},
 		},
 	}
+	ms.Spec.EnableAdminAPI = true
 	ms.Spec.NamespaceSelector = &metav1.LabelSelector{
 		MatchLabels: map[string]string{
 			"label": "label-value",
@@ -947,6 +948,7 @@ const oboManagedFieldsJson = `
     "f:alertmanagers": {}
   },
   "f:arbitraryFSAccessThroughSMs": {},
+  "f:enableAdminAPI": {},
   "f:enableRemoteWriteReceiver": {},
   "f:externalLabels": {
     "f:key": {}