From cc700b40abe26fd1acbe4eda8962997a6e1d53e3 Mon Sep 17 00:00:00 2001
From: planpal <planpal@local>
Date: Wed, 2 Sep 2026 14:39:03 +0700
Subject: [PATCH] monitoring: kube-prometheus-stack, Grafana on internal ALB
 (VPN-only)

---
 planpalto-helm/argocd/apps/monitoring.yaml | 78 ++++++++++++++++++++++
 1 file changed, 78 insertions(+)
 create mode 100644 planpalto-helm/argocd/apps/monitoring.yaml

diff --git a/planpalto-helm/argocd/apps/monitoring.yaml b/planpalto-helm/argocd/apps/monitoring.yaml
new file mode 100644
index 0000000..b0e820c
--- /dev/null
+++ b/planpalto-helm/argocd/apps/monitoring.yaml
@@ -0,0 +1,78 @@
+# kube-prometheus-stack via Argo, child of the App-of-Apps root.
+# Grafana on an INTERNAL ALB (VPN-only via Tailscale). Prometheus + Alertmanager
+# stay cluster-internal (no ingress); reach them by port-forward.
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: monitoring
+  namespace: argocd
+  finalizers:
+    - resources-finalizer.argocd.argoproj.io
+spec:
+  project: default
+  source:
+    repoURL: https://prometheus-community.github.io/helm-charts
+    chart: kube-prometheus-stack
+    targetRevision: 65.*   # pinned major; a current stable line
+    helm:
+      values: |
+        grafana:
+          # admin creds come from the pre-created secret (not stored in Git)
+          admin:
+            existingSecret: grafana-admin
+            userKey: admin-user
+            passwordKey: admin-password
+          grafana.ini:
+            server:
+              root_url: https://fakhri-grafana.sandbox.devopsinstitute.id
+            auth.anonymous:
+              enabled: false
+          ingress:
+            enabled: true
+            ingressClassName: alb
+            annotations:
+              alb.ingress.kubernetes.io/scheme: internal
+              alb.ingress.kubernetes.io/target-type: ip
+              alb.ingress.kubernetes.io/backend-protocol: HTTP
+              alb.ingress.kubernetes.io/listen-ports: '[{"HTTP":80},{"HTTPS":443}]'
+              alb.ingress.kubernetes.io/ssl-redirect: '443'
+              alb.ingress.kubernetes.io/certificate-arn: arn:aws:acm:ap-southeast-3:134604498185:certificate/bf0e14cb-57a3-48e9-95f2-ed16f17f1b8e
+              alb.ingress.kubernetes.io/healthcheck-path: /api/health
+              alb.ingress.kubernetes.io/group.name: planpal-internal
+            hosts:
+              - fakhri-grafana.sandbox.devopsinstitute.id
+        # Prometheus: full defaults, kept internal. gp3 PVC, default retention.
+        prometheus:
+          prometheusSpec:
+            retention: 10d
+            storageSpec:
+              volumeClaimTemplate:
+                spec:
+                  storageClassName: gp3
+                  accessModes: [ReadWriteOnce]
+                  resources:
+                    requests:
+                      storage: 50Gi
+        # Alertmanager stays on (full stack) but internal only, no ingress.
+        alertmanager:
+          alertmanagerSpec:
+            storage:
+              volumeClaimTemplate:
+                spec:
+                  storageClassName: gp3
+                  accessModes: [ReadWriteOnce]
+                  resources:
+                    requests:
+                      storage: 2Gi
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: monitoring
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+    syncOptions:
+      - CreateNamespace=true
+      # CRDs in this chart are large; ServerSideApply avoids the
+      # "metadata.annotations too long" client-side apply error.
+      - ServerSideApply=true