207 lines
7.2 KiB
YAML
207 lines
7.2 KiB
YAML
apiVersion: argoproj.io/v1alpha1
|
|
kind: Application
|
|
metadata:
|
|
annotations:
|
|
argocd.argoproj.io/client-side-apply-migration-manager: argocd-controller
|
|
argocd.argoproj.io/sync-wave: "3"
|
|
name: kube-prometheus-stack
|
|
namespace: argocd
|
|
spec:
|
|
destination:
|
|
namespace: monitoring
|
|
server: https://kubernetes.default.svc
|
|
project: default
|
|
sources:
|
|
- chart: kube-prometheus-stack
|
|
helm:
|
|
values: |
|
|
alertmanager:
|
|
enabled: false
|
|
# Only node-exporter and cAdvisor are scraped.
|
|
defaultRules:
|
|
create: false
|
|
kubelet:
|
|
serviceMonitor:
|
|
interval: 60s
|
|
kubelet: false
|
|
probes: false
|
|
cAdvisorMetricRelabelings:
|
|
- action: keep
|
|
sourceLabels: [__name__]
|
|
regex: container_(cpu_usage_seconds_total|memory_working_set_bytes)
|
|
- action: drop
|
|
sourceLabels: [id, pod]
|
|
regex: .+;
|
|
kubeApiServer:
|
|
enabled: false
|
|
kubeControllerManager:
|
|
enabled: false
|
|
kubeScheduler:
|
|
enabled: false
|
|
kubeProxy:
|
|
enabled: false
|
|
kubeEtcd:
|
|
enabled: false
|
|
coreDns:
|
|
enabled: false
|
|
kubeStateMetrics:
|
|
enabled: false
|
|
prometheusOperator:
|
|
admissionWebhooks:
|
|
certManager:
|
|
enabled: true
|
|
resources:
|
|
limits:
|
|
cpu: 200m
|
|
memory: 256Mi
|
|
requests:
|
|
cpu: 20m
|
|
memory: 64Mi
|
|
prometheusConfigReloader:
|
|
resources:
|
|
limits:
|
|
cpu: 50m
|
|
memory: 64Mi
|
|
requests:
|
|
cpu: 10m
|
|
memory: 32Mi
|
|
serviceMonitor:
|
|
selfMonitor: false
|
|
prometheus-node-exporter:
|
|
# CPU, memory, disks, network and temperature.
|
|
extraArgs:
|
|
- --collector.disable-defaults
|
|
- --collector.cpu
|
|
- --collector.meminfo
|
|
- --collector.filesystem
|
|
- --collector.netdev
|
|
- --collector.hwmon
|
|
- --web.disable-exporter-metrics
|
|
# The chart's defaults, as lists are replaced.
|
|
- --collector.filesystem.mount-points-exclude=^/(dev|proc|sys|run/containerd/.+|var/lib/docker/.+|var/lib/kubelet/.+)($|/)
|
|
- --collector.filesystem.fs-types-exclude=^(autofs|binfmt_misc|bpf|cgroup2?|configfs|debugfs|devpts|devtmpfs|fusectl|hugetlbfs|iso9660|mqueue|nsfs|overlay|proc|procfs|pstore|rpc_pipefs|securityfs|selinuxfs|squashfs|sysfs|tracefs|erofs)$
|
|
- --collector.netdev.device-exclude=^(veth.*|br-.*|docker0|cni0|lo)$
|
|
prometheus:
|
|
monitor:
|
|
# Collectors report more than these, like per-chip sensor labels.
|
|
metricRelabelings:
|
|
- action: keep
|
|
sourceLabels: [__name__]
|
|
regex: node_(cpu_seconds_total|memory_(MemAvailable|MemTotal)_bytes|filesystem_(avail|size)_bytes|network_(receive|transmit)_bytes_total|hwmon_temp_celsius)
|
|
resources:
|
|
limits:
|
|
cpu: 200m
|
|
memory: 128Mi
|
|
requests:
|
|
cpu: 20m
|
|
memory: 32Mi
|
|
prometheus:
|
|
serviceMonitor:
|
|
selfMonitor: false
|
|
prometheusSpec:
|
|
scrapeInterval: 60s
|
|
retention: 90d
|
|
retentionSize: 45GB
|
|
# Pick up monitors and rules from every namespace, not just this release.
|
|
podMonitorSelectorNilUsesHelmValues: false
|
|
probeSelectorNilUsesHelmValues: false
|
|
ruleSelectorNilUsesHelmValues: false
|
|
scrapeConfigSelectorNilUsesHelmValues: false
|
|
serviceMonitorSelectorNilUsesHelmValues: false
|
|
resources:
|
|
limits:
|
|
cpu: "1"
|
|
memory: 3Gi
|
|
requests:
|
|
cpu: 200m
|
|
memory: 1Gi
|
|
storageSpec:
|
|
volumeClaimTemplate:
|
|
spec:
|
|
accessModes:
|
|
- ReadWriteOnce
|
|
resources:
|
|
requests:
|
|
storage: 50Gi
|
|
grafana:
|
|
admin:
|
|
existingSecret: grafana-admin
|
|
additionalDataSources:
|
|
- name: Loki
|
|
type: loki
|
|
uid: loki
|
|
url: http://loki.monitoring.svc.cluster.local:3100
|
|
isDefault: true
|
|
defaultDashboardsEnabled: false
|
|
envValueFrom:
|
|
GF_AUTH_GENERIC_OAUTH_CLIENT_SECRET:
|
|
secretKeyRef:
|
|
name: grafana-oidc
|
|
key: client-secret
|
|
GF_DATABASE_PASSWORD:
|
|
secretKeyRef:
|
|
name: grafana-db
|
|
key: password
|
|
grafana.ini:
|
|
database:
|
|
type: postgres
|
|
host: postgres-rw.postgres.svc.cluster.local:5432
|
|
name: grafana
|
|
user: grafana
|
|
ssl_mode: require
|
|
server:
|
|
root_url: https://grafana.whyredfire.dev
|
|
auth:
|
|
# Break-glass admin login stays reachable at /login?disableAutoLogin=true
|
|
oauth_auto_login: true
|
|
signout_redirect_url: https://auth.whyredfire.dev/application/o/grafana/end-session/
|
|
auth.generic_oauth:
|
|
enabled: true
|
|
name: Authentik
|
|
client_id: grafana
|
|
scopes: openid profile email
|
|
auth_url: https://auth.whyredfire.dev/application/o/authorize/
|
|
token_url: https://auth.whyredfire.dev/application/o/token/
|
|
api_url: https://auth.whyredfire.dev/application/o/userinfo/
|
|
use_pkce: true
|
|
login_attribute_path: preferred_username
|
|
role_attribute_path: contains(groups, 'admins') && 'Admin'
|
|
role_attribute_strict: true
|
|
resources:
|
|
limits:
|
|
cpu: 500m
|
|
memory: 768Mi
|
|
requests:
|
|
cpu: 50m
|
|
memory: 256Mi
|
|
serviceMonitor:
|
|
enabled: false
|
|
sidecar:
|
|
datasources:
|
|
alertmanager:
|
|
enabled: false
|
|
isDefaultDatasource: false
|
|
dashboards:
|
|
searchNamespace: ALL
|
|
resources:
|
|
limits:
|
|
cpu: 100m
|
|
memory: 256Mi
|
|
requests:
|
|
cpu: 10m
|
|
memory: 64Mi
|
|
testFramework:
|
|
enabled: false
|
|
repoURL: https://prometheus-community.github.io/helm-charts
|
|
targetRevision: 92.3.0
|
|
- path: add-ons/kube-prometheus-stack
|
|
repoURL: https://gitea.whyredfire.dev/whyredfire/gitops.git
|
|
targetRevision: main
|
|
syncPolicy:
|
|
automated:
|
|
prune: true
|
|
selfHeal: true
|
|
syncOptions:
|
|
- CreateNamespace=true
|
|
- ServerSideApply=true
|