apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  annotations:
    argocd.argoproj.io/client-side-apply-migration-manager: argocd-controller
    argocd.argoproj.io/sync-wave: "3"
  name: kube-prometheus-stack
  namespace: argocd
spec:
  destination:
    namespace: monitoring
    server: https://kubernetes.default.svc
  project: default
  sources:
    - chart: kube-prometheus-stack
      helm:
        values: |
          alertmanager:
            enabled: false
          # Only node-exporter and cAdvisor are scraped.
          defaultRules:
            create: false
          kubelet:
            serviceMonitor:
              interval: 60s
              kubelet: false
              probes: false
              cAdvisorMetricRelabelings:
                - action: keep
                  sourceLabels: [__name__]
                  regex: container_(cpu_usage_seconds_total|memory_working_set_bytes)
                - action: drop
                  sourceLabels: [id, pod]
                  regex: .+;
          kubeApiServer:
            enabled: false
          kubeControllerManager:
            enabled: false
          kubeScheduler:
            enabled: false
          kubeProxy:
            enabled: false
          kubeEtcd:
            enabled: false
          coreDns:
            enabled: false
          kubeStateMetrics:
            enabled: false
          prometheusOperator:
            # The chart's policy only limits ingress to the webhook; egress stays open
            networkPolicy:
              enabled: true
            admissionWebhooks:
              certManager:
                enabled: true
            resources:
              limits:
                cpu: 200m
                memory: 256Mi
              requests:
                cpu: 20m
                memory: 64Mi
            prometheusConfigReloader:
              resources:
                limits:
                  cpu: 50m
                  memory: 64Mi
                requests:
                  cpu: 10m
                  memory: 32Mi
            serviceMonitor:
              selfMonitor: false
          prometheus-node-exporter:
            # CPU, memory, disks, network and temperature.
            extraArgs:
              - --collector.disable-defaults
              - --collector.cpu
              - --collector.meminfo
              - --collector.filesystem
              - --collector.netdev
              - --collector.hwmon
              - --web.disable-exporter-metrics
              # The chart's defaults, as lists are replaced.
              - --collector.filesystem.mount-points-exclude=^/(dev|proc|sys|run/containerd/.+|var/lib/docker/.+|var/lib/kubelet/.+)($|/)
              - --collector.filesystem.fs-types-exclude=^(autofs|binfmt_misc|bpf|cgroup2?|configfs|debugfs|devpts|devtmpfs|fusectl|hugetlbfs|iso9660|mqueue|nsfs|overlay|proc|procfs|pstore|rpc_pipefs|securityfs|selinuxfs|squashfs|sysfs|tracefs|erofs)$
              - --collector.netdev.device-exclude=^(veth.*|br-.*|docker0|cni0|lo)$
            prometheus:
              monitor:
                # Collectors report more than these, like per-chip sensor labels.
                metricRelabelings:
                  - action: keep
                    sourceLabels: [__name__]
                    regex: node_(cpu_seconds_total|memory_(MemAvailable|MemTotal)_bytes|filesystem_(avail|size)_bytes|network_(receive|transmit)_bytes_total|hwmon_temp_celsius)
            resources:
              limits:
                cpu: 200m
                memory: 128Mi
              requests:
                cpu: 20m
                memory: 32Mi
          prometheus:
            # Only Grafana queries it; it scrapes the kubelet and node-exporter on the
            # node, matched by port so no node IP is needed
            networkPolicy:
              enabled: true
              ingress:
                - from:
                    - podSelector:
                        matchLabels:
                          app.kubernetes.io/name: grafana
                  ports:
                    - port: 9090
                      protocol: TCP
              egress:
                - ports:
                    - port: 53
                      protocol: UDP
                    - port: 53
                      protocol: TCP
                  to:
                    - namespaceSelector:
                        matchLabels:
                          kubernetes.io/metadata.name: kube-system
                      podSelector:
                        matchLabels:
                          k8s-app: kube-dns
                - ports:
                    - port: 6443
                      protocol: TCP
                    - port: 9100
                      protocol: TCP
                    - port: 10250
                      protocol: TCP
            serviceMonitor:
              selfMonitor: false
            prometheusSpec:
              scrapeInterval: 60s
              retention: 90d
              retentionSize: 45GB
              # Pick up monitors and rules from every namespace, not just this release.
              podMonitorSelectorNilUsesHelmValues: false
              probeSelectorNilUsesHelmValues: false
              ruleSelectorNilUsesHelmValues: false
              scrapeConfigSelectorNilUsesHelmValues: false
              serviceMonitorSelectorNilUsesHelmValues: false
              resources:
                limits:
                  cpu: "1"
                  memory: 3Gi
                requests:
                  cpu: 200m
                  memory: 1Gi
              storageSpec:
                volumeClaimTemplate:
                  spec:
                    accessModes:
                      - ReadWriteOnce
                    resources:
                      requests:
                        storage: 50Gi
          grafana:
            # The chart takes one list of egress ports for every destination: OIDC
            # on 443, Loki, Postgres, the API for the sidecars, and Prometheus
            networkPolicy:
              enabled: true
              allowExternal: false
              explicitNamespacesSelector:
                matchLabels:
                  kubernetes.io/metadata.name: traefik
              egress:
                enabled: true
                ports:
                  - port: 443
                    protocol: TCP
                  - port: 3100
                    protocol: TCP
                  - port: 5432
                    protocol: TCP
                  - port: 6443
                    protocol: TCP
                  - port: 9090
                    protocol: TCP
            admin:
              existingSecret: grafana-admin
            additionalDataSources:
              - name: Loki
                type: loki
                uid: loki
                url: http://loki.monitoring.svc.cluster.local:3100
                isDefault: true
            defaultDashboardsEnabled: false
            envValueFrom:
              GF_AUTH_GENERIC_OAUTH_CLIENT_SECRET:
                secretKeyRef:
                  name: grafana-oidc
                  key: client-secret
              GF_DATABASE_PASSWORD:
                secretKeyRef:
                  name: grafana-db
                  key: password
            grafana.ini:
              database:
                type: postgres
                host: postgres-rw.postgres.svc.cluster.local:5432
                name: grafana
                user: grafana
                ssl_mode: require
              server:
                root_url: https://grafana.whyredfire.dev
              auth:
                # Break-glass admin login stays reachable at /login?disableAutoLogin=true
                oauth_auto_login: true
                signout_redirect_url: https://auth.whyredfire.dev/application/o/grafana/end-session/
              auth.generic_oauth:
                enabled: true
                name: Authentik
                client_id: grafana
                scopes: openid profile email
                auth_url: https://auth.whyredfire.dev/application/o/authorize/
                token_url: https://auth.whyredfire.dev/application/o/token/
                api_url: https://auth.whyredfire.dev/application/o/userinfo/
                use_pkce: true
                login_attribute_path: preferred_username
                role_attribute_path: contains(groups, 'admins') && 'Admin'
                role_attribute_strict: true
            resources:
              limits:
                cpu: 500m
                memory: 768Mi
              requests:
                cpu: 50m
                memory: 256Mi
            serviceMonitor:
              enabled: false
            sidecar:
              datasources:
                alertmanager:
                  enabled: false
                isDefaultDatasource: false
              dashboards:
                searchNamespace: ALL
              resources:
                limits:
                  cpu: 100m
                  memory: 256Mi
                requests:
                  cpu: 10m
                  memory: 64Mi
            testFramework:
              enabled: false
      repoURL: https://prometheus-community.github.io/helm-charts
      targetRevision: 92.3.0
    - path: add-ons/kube-prometheus-stack
      repoURL: https://gitea.whyredfire.dev/whyredfire/gitops.git
      targetRevision: main
  syncPolicy:
    automated:
      prune: true
      selfHeal: true
    syncOptions:
      - CreateNamespace=true
      - ServerSideApply=true