apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  annotations:
    argocd.argoproj.io/client-side-apply-migration-manager: argocd-controller
    argocd.argoproj.io/sync-wave: "3"
  name: kube-prometheus-stack
  namespace: argocd
spec:
  destination:
    namespace: monitoring
    server: https://kubernetes.default.svc
  project: default
  sources:
    - chart: kube-prometheus-stack
      helm:
        values: |
          alertmanager:
            enabled: false
          # Only node-exporter and cAdvisor are scraped.
          defaultRules:
            create: false
          kubelet:
            serviceMonitor:
              interval: 60s
              kubelet: false
              probes: false
              cAdvisorMetricRelabelings:
                - action: keep
                  sourceLabels: [__name__]
                  regex: container_(cpu_usage_seconds_total|memory_working_set_bytes|fs_(reads|writes)_bytes_total|network_(receive|transmit)_bytes_total)
                - action: drop
                  sourceLabels: [__name__, interface]
                  regex: container_network_.+;(br-|cni|docker|flannel|lo|tailscale|tun|veth|wg|wlan).*
                - action: drop
                  sourceLabels: [id, pod]
                  regex: .+;
          kubeApiServer:
            enabled: false
          kubeControllerManager:
            enabled: false
          kubeScheduler:
            enabled: false
          kubeProxy:
            enabled: false
          kubeEtcd:
            enabled: false
          coreDns:
            enabled: false
          kubeStateMetrics:
            enabled: false
          prometheusOperator:
            admissionWebhooks:
              certManager:
                enabled: true
            resources:
              limits:
                cpu: 200m
                memory: 256Mi
              requests:
                cpu: 20m
                memory: 64Mi
            prometheusConfigReloader:
              resources:
                limits:
                  cpu: 50m
                  memory: 64Mi
                requests:
                  cpu: 10m
                  memory: 32Mi
            serviceMonitor:
              selfMonitor: false
          prometheus-node-exporter:
            # The first two are the chart's defaults, as lists are replaced.
            extraArgs:
              - --collector.filesystem.mount-points-exclude=^/(dev|proc|sys|run/containerd/.+|var/lib/docker/.+|var/lib/kubelet/.+)($|/)
              - --collector.filesystem.fs-types-exclude=^(autofs|binfmt_misc|bpf|cgroup2?|configfs|debugfs|devpts|devtmpfs|fusectl|hugetlbfs|iso9660|mqueue|nsfs|overlay|proc|procfs|pstore|rpc_pipefs|securityfs|selinuxfs|squashfs|sysfs|tracefs|erofs)$
              - --collector.netclass.ignored-devices=^(veth.*|br-.*|docker0|cni0|lo)$
              - --collector.netdev.device-exclude=^(veth.*|br-.*|docker0|cni0|lo)$
            resources:
              limits:
                cpu: 200m
                memory: 128Mi
              requests:
                cpu: 20m
                memory: 32Mi
          prometheus:
            serviceMonitor:
              selfMonitor: false
            prometheusSpec:
              scrapeInterval: 60s
              retention: 90d
              retentionSize: 45GB
              # Pick up monitors and rules from every namespace, not just this release.
              podMonitorSelectorNilUsesHelmValues: false
              probeSelectorNilUsesHelmValues: false
              ruleSelectorNilUsesHelmValues: false
              scrapeConfigSelectorNilUsesHelmValues: false
              serviceMonitorSelectorNilUsesHelmValues: false
              resources:
                limits:
                  cpu: "1"
                  memory: 3Gi
                requests:
                  cpu: 200m
                  memory: 1Gi
              storageSpec:
                volumeClaimTemplate:
                  spec:
                    accessModes:
                      - ReadWriteOnce
                    resources:
                      requests:
                        storage: 50Gi
          grafana:
            admin:
              existingSecret: grafana-admin
            additionalDataSources:
              - name: Loki
                type: loki
                uid: loki
                url: http://loki.monitoring.svc.cluster.local:3100
                isDefault: true
            defaultDashboardsEnabled: false
            envValueFrom:
              GF_AUTH_GENERIC_OAUTH_CLIENT_SECRET:
                secretKeyRef:
                  name: grafana-oidc
                  key: client-secret
              GF_DATABASE_PASSWORD:
                secretKeyRef:
                  name: grafana-db
                  key: password
            grafana.ini:
              database:
                type: postgres
                host: postgres-rw.postgres.svc.cluster.local:5432
                name: grafana
                user: grafana
                ssl_mode: require
              server:
                root_url: https://grafana.whyredfire.dev
              auth:
                # Break-glass admin login stays reachable at /login?disableAutoLogin=true
                oauth_auto_login: true
                signout_redirect_url: https://auth.whyredfire.dev/application/o/grafana/end-session/
              auth.generic_oauth:
                enabled: true
                name: Authentik
                client_id: grafana
                scopes: openid profile email
                auth_url: https://auth.whyredfire.dev/application/o/authorize/
                token_url: https://auth.whyredfire.dev/application/o/token/
                api_url: https://auth.whyredfire.dev/application/o/userinfo/
                use_pkce: true
                login_attribute_path: preferred_username
                role_attribute_path: contains(groups, 'admins') && 'Admin'
                role_attribute_strict: true
            resources:
              limits:
                cpu: 500m
                memory: 512Mi
              requests:
                cpu: 50m
                memory: 256Mi
            serviceMonitor:
              enabled: false
            sidecar:
              datasources:
                alertmanager:
                  enabled: false
                isDefaultDatasource: false
              dashboards:
                searchNamespace: ALL
              resources:
                limits:
                  cpu: 100m
                  memory: 256Mi
                requests:
                  cpu: 10m
                  memory: 64Mi
            testFramework:
              enabled: false
      repoURL: https://prometheus-community.github.io/helm-charts
      targetRevision: 92.3.0
    - path: add-ons/kube-prometheus-stack
      repoURL: https://gitea.whyredfire.dev/whyredfire/gitops.git
      targetRevision: main
  syncPolicy:
    automated:
      prune: true
      selfHeal: true
    syncOptions:
      - CreateNamespace=true
      - ServerSideApply=true