gitops/argocd-apps/add-ons/kube-prometheus-stack.yaml

apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  annotations:
    argocd.argoproj.io/sync-wave: "3"
  name: kube-prometheus-stack
  namespace: argocd
spec:
  destination:
    namespace: monitoring
    server: https://kubernetes.default.svc
  project: default
  sources:
    - chart: kube-prometheus-stack
      helm:
        values: |
          alertmanager:
            enabled: false
          # k3s embeds every control-plane component in one process with a shared
          # metrics registry, so each endpoint also serves the apiserver's series.
          # Keep those on the apiserver job only.
          kubelet:
            serviceMonitor:
              metricRelabelings:
                - action: drop
                  sourceLabels: [__name__, le]
                  regex: (csi_operations|storage_operation_duration)_seconds_bucket;(0.25|2.5|15|25|120|600)(\.0)?
                - action: drop
                  sourceLabels: [__name__]
                  regex: (apiserver|etcd|kine)_.*
          # Bound to 0.0.0.0 through /etc/rancher/k3s/config.yaml on the node.
          kubeControllerManager:
            endpoints:
              - 192.168.2.5
            serviceMonitor:
              metricRelabelings:
                - action: drop
                  sourceLabels: [__name__]
                  regex: (apiserver|etcd|kine)_.*
          kubeScheduler:
            endpoints:
              - 192.168.2.5
            serviceMonitor:
              metricRelabelings:
                - action: drop
                  sourceLabels: [__name__]
                  regex: (apiserver|etcd|kine)_.*
          kubeProxy:
            endpoints:
              - 192.168.2.5
            serviceMonitor:
              metricRelabelings:
                - action: drop
                  sourceLabels: [__name__]
                  regex: (apiserver|etcd|kine)_.*
          # k3s runs on SQLite (kine), there is no etcd to scrape.
          kubeEtcd:
            enabled: false
          prometheusOperator:
            admissionWebhooks:
              certManager:
                enabled: true
            resources:
              limits:
                cpu: 200m
                memory: 256Mi
              requests:
                cpu: 20m
                memory: 64Mi
            prometheusConfigReloader:
              resources:
                limits:
                  cpu: 50m
                  memory: 64Mi
                requests:
                  cpu: 10m
                  memory: 32Mi
          kube-state-metrics:
            resources:
              limits:
                cpu: 200m
                memory: 256Mi
              requests:
                cpu: 20m
                memory: 64Mi
          prometheus-node-exporter:
            resources:
              limits:
                cpu: 200m
                memory: 128Mi
              requests:
                cpu: 20m
                memory: 32Mi
          prometheus:
            prometheusSpec:
              retention: 90d
              retentionSize: 45GB
              # Pick up monitors and rules from every namespace, not just this release.
              podMonitorSelectorNilUsesHelmValues: false
              probeSelectorNilUsesHelmValues: false
              ruleSelectorNilUsesHelmValues: false
              scrapeConfigSelectorNilUsesHelmValues: false
              serviceMonitorSelectorNilUsesHelmValues: false
              # Generous CPU ceiling: WAL replay and compaction burst well above steady state.
              resources:
                limits:
                  cpu: "1"
                  memory: 3Gi
                requests:
                  cpu: 200m
                  memory: 1Gi
              storageSpec:
                volumeClaimTemplate:
                  spec:
                    accessModes:
                      - ReadWriteOnce
                    resources:
                      requests:
                        storage: 50Gi
          grafana:
            admin:
              existingSecret: grafana-admin
            additionalDataSources:
              - name: Loki
                type: loki
                uid: loki
                url: http://loki.monitoring.svc.cluster.local:3100
            envValueFrom:
              GF_AUTH_GENERIC_OAUTH_CLIENT_SECRET:
                secretKeyRef:
                  name: grafana-oidc
                  key: client-secret
              GF_DATABASE_PASSWORD:
                secretKeyRef:
                  name: grafana-db
                  key: password
            grafana.ini:
              database:
                type: postgres
                host: postgres-rw.postgres.svc.cluster.local:5432
                name: grafana
                user: grafana
                ssl_mode: require
              server:
                root_url: https://grafana.whyredfire.dev
              auth:
                # Break-glass admin login stays reachable at /login?disableAutoLogin=true
                oauth_auto_login: true
                signout_redirect_url: https://auth.whyredfire.dev/application/o/grafana/end-session/
              auth.generic_oauth:
                enabled: true
                name: Authentik
                client_id: grafana
                scopes: openid profile email
                auth_url: https://auth.whyredfire.dev/application/o/authorize/
                token_url: https://auth.whyredfire.dev/application/o/token/
                api_url: https://auth.whyredfire.dev/application/o/userinfo/
                use_pkce: true
                login_attribute_path: preferred_username
                role_attribute_path: contains(groups, 'admins') && 'Admin'
                role_attribute_strict: true
            # State lives in Postgres; the pod itself is disposable.
            persistence:
              enabled: false
            resources:
              limits:
                cpu: 500m
                memory: 512Mi
              requests:
                cpu: 50m
                memory: 256Mi
            sidecar:
              dashboards:
                searchNamespace: ALL
              resources:
                limits:
                  cpu: 100m
                  memory: 256Mi
                requests:
                  cpu: 10m
                  memory: 64Mi
            testFramework:
              enabled: false
      repoURL: https://prometheus-community.github.io/helm-charts
      targetRevision: 91.8.2
    - path: add-ons/kube-prometheus-stack
      repoURL: https://gitea.whyredfire.dev/whyredfire/gitops.git
      targetRevision: main
  syncPolicy:
    automated:
      prune: true
      selfHeal: true
    syncOptions:
      - CreateNamespace=true
      - ServerSideApply=true