feat(add-ons): Add observability stack with kube-prometheus-stack, loki and alloy
This commit is contained in:
@@ -0,0 +1,195 @@
|
||||
apiVersion: argoproj.io/v1alpha1
|
||||
kind: Application
|
||||
metadata:
|
||||
annotations:
|
||||
argocd.argoproj.io/sync-wave: "3"
|
||||
name: kube-prometheus-stack
|
||||
namespace: argocd
|
||||
spec:
|
||||
destination:
|
||||
namespace: monitoring
|
||||
server: https://kubernetes.default.svc
|
||||
project: default
|
||||
sources:
|
||||
- chart: kube-prometheus-stack
|
||||
helm:
|
||||
values: |
|
||||
alertmanager:
|
||||
enabled: false
|
||||
# k3s embeds every control-plane component in one process with a shared
|
||||
# metrics registry, so each endpoint also serves the apiserver's series.
|
||||
# Keep those on the apiserver job only.
|
||||
kubelet:
|
||||
serviceMonitor:
|
||||
metricRelabelings:
|
||||
- action: drop
|
||||
sourceLabels: [__name__, le]
|
||||
regex: (csi_operations|storage_operation_duration)_seconds_bucket;(0.25|2.5|15|25|120|600)(\.0)?
|
||||
- action: drop
|
||||
sourceLabels: [__name__]
|
||||
regex: (apiserver|etcd|kine)_.*
|
||||
# Bound to 0.0.0.0 through /etc/rancher/k3s/config.yaml on the node.
|
||||
kubeControllerManager:
|
||||
endpoints:
|
||||
- 192.168.2.5
|
||||
serviceMonitor:
|
||||
metricRelabelings:
|
||||
- action: drop
|
||||
sourceLabels: [__name__]
|
||||
regex: (apiserver|etcd|kine)_.*
|
||||
kubeScheduler:
|
||||
endpoints:
|
||||
- 192.168.2.5
|
||||
serviceMonitor:
|
||||
metricRelabelings:
|
||||
- action: drop
|
||||
sourceLabels: [__name__]
|
||||
regex: (apiserver|etcd|kine)_.*
|
||||
kubeProxy:
|
||||
endpoints:
|
||||
- 192.168.2.5
|
||||
serviceMonitor:
|
||||
metricRelabelings:
|
||||
- action: drop
|
||||
sourceLabels: [__name__]
|
||||
regex: (apiserver|etcd|kine)_.*
|
||||
# k3s runs on SQLite (kine), there is no etcd to scrape.
|
||||
kubeEtcd:
|
||||
enabled: false
|
||||
prometheusOperator:
|
||||
admissionWebhooks:
|
||||
certManager:
|
||||
enabled: true
|
||||
resources:
|
||||
limits:
|
||||
cpu: 200m
|
||||
memory: 256Mi
|
||||
requests:
|
||||
cpu: 20m
|
||||
memory: 64Mi
|
||||
prometheusConfigReloader:
|
||||
resources:
|
||||
limits:
|
||||
cpu: 50m
|
||||
memory: 64Mi
|
||||
requests:
|
||||
cpu: 10m
|
||||
memory: 32Mi
|
||||
kube-state-metrics:
|
||||
resources:
|
||||
limits:
|
||||
cpu: 200m
|
||||
memory: 256Mi
|
||||
requests:
|
||||
cpu: 20m
|
||||
memory: 64Mi
|
||||
prometheus-node-exporter:
|
||||
resources:
|
||||
limits:
|
||||
cpu: 200m
|
||||
memory: 128Mi
|
||||
requests:
|
||||
cpu: 20m
|
||||
memory: 32Mi
|
||||
prometheus:
|
||||
prometheusSpec:
|
||||
retention: 90d
|
||||
retentionSize: 45GB
|
||||
# Pick up monitors and rules from every namespace, not just this release.
|
||||
podMonitorSelectorNilUsesHelmValues: false
|
||||
probeSelectorNilUsesHelmValues: false
|
||||
ruleSelectorNilUsesHelmValues: false
|
||||
scrapeConfigSelectorNilUsesHelmValues: false
|
||||
serviceMonitorSelectorNilUsesHelmValues: false
|
||||
# Generous CPU ceiling: WAL replay and compaction burst well above steady state.
|
||||
resources:
|
||||
limits:
|
||||
cpu: "1"
|
||||
memory: 3Gi
|
||||
requests:
|
||||
cpu: 200m
|
||||
memory: 1Gi
|
||||
storageSpec:
|
||||
volumeClaimTemplate:
|
||||
spec:
|
||||
accessModes:
|
||||
- ReadWriteOnce
|
||||
resources:
|
||||
requests:
|
||||
storage: 50Gi
|
||||
grafana:
|
||||
admin:
|
||||
existingSecret: grafana-admin
|
||||
additionalDataSources:
|
||||
- name: Loki
|
||||
type: loki
|
||||
uid: loki
|
||||
url: http://loki.monitoring.svc.cluster.local:3100
|
||||
envValueFrom:
|
||||
GF_AUTH_GENERIC_OAUTH_CLIENT_SECRET:
|
||||
secretKeyRef:
|
||||
name: grafana-oidc
|
||||
key: client-secret
|
||||
GF_DATABASE_PASSWORD:
|
||||
secretKeyRef:
|
||||
name: grafana-db
|
||||
key: password
|
||||
grafana.ini:
|
||||
database:
|
||||
type: postgres
|
||||
host: postgres-rw.postgres.svc.cluster.local:5432
|
||||
name: grafana
|
||||
user: grafana
|
||||
ssl_mode: require
|
||||
server:
|
||||
root_url: https://grafana.whyredfire.dev
|
||||
auth:
|
||||
# Break-glass admin login stays reachable at /login?disableAutoLogin=true
|
||||
oauth_auto_login: true
|
||||
signout_redirect_url: https://auth.whyredfire.dev/application/o/grafana/end-session/
|
||||
auth.generic_oauth:
|
||||
enabled: true
|
||||
name: Authentik
|
||||
client_id: grafana
|
||||
scopes: openid profile email
|
||||
auth_url: https://auth.whyredfire.dev/application/o/authorize/
|
||||
token_url: https://auth.whyredfire.dev/application/o/token/
|
||||
api_url: https://auth.whyredfire.dev/application/o/userinfo/
|
||||
use_pkce: true
|
||||
login_attribute_path: preferred_username
|
||||
role_attribute_path: contains(groups, 'admins') && 'Admin'
|
||||
role_attribute_strict: true
|
||||
# State lives in Postgres; the pod itself is disposable.
|
||||
persistence:
|
||||
enabled: false
|
||||
resources:
|
||||
limits:
|
||||
cpu: 500m
|
||||
memory: 512Mi
|
||||
requests:
|
||||
cpu: 50m
|
||||
memory: 256Mi
|
||||
sidecar:
|
||||
dashboards:
|
||||
searchNamespace: ALL
|
||||
resources:
|
||||
limits:
|
||||
cpu: 100m
|
||||
memory: 256Mi
|
||||
requests:
|
||||
cpu: 10m
|
||||
memory: 64Mi
|
||||
testFramework:
|
||||
enabled: false
|
||||
repoURL: https://prometheus-community.github.io/helm-charts
|
||||
targetRevision: 91.8.2
|
||||
- path: add-ons/kube-prometheus-stack
|
||||
repoURL: https://gitea.whyredfire.dev/whyredfire/gitops.git
|
||||
targetRevision: main
|
||||
syncPolicy:
|
||||
automated:
|
||||
prune: true
|
||||
selfHeal: true
|
||||
syncOptions:
|
||||
- CreateNamespace=true
|
||||
- ServerSideApply=true
|
||||
Reference in New Issue
Block a user