# kube-prometheus-stack via Argo, child of the App-of-Apps root.
# Grafana on an INTERNAL ALB (VPN-only via Tailscale). Prometheus + Alertmanager
# stay cluster-internal (no ingress); reach them by port-forward.
apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  name: monitoring
  namespace: argocd
  finalizers:
    - resources-finalizer.argocd.argoproj.io
spec:
  project: default
  source:
    repoURL: https://prometheus-community.github.io/helm-charts
    chart: kube-prometheus-stack
    targetRevision: 65.*   # pinned major; a current stable line
    helm:
      values: |
        grafana:
          # admin creds come from the pre-created secret (not stored in Git)
          admin:
            existingSecret: grafana-admin
            userKey: admin-user
            passwordKey: admin-password
          grafana.ini:
            server:
              root_url: https://fakhri-grafana.sandbox.devopsinstitute.id
            auth.anonymous:
              enabled: false
          ingress:
            enabled: true
            ingressClassName: alb
            annotations:
              alb.ingress.kubernetes.io/scheme: internal
              alb.ingress.kubernetes.io/target-type: ip
              alb.ingress.kubernetes.io/backend-protocol: HTTP
              alb.ingress.kubernetes.io/listen-ports: '[{"HTTP":80},{"HTTPS":443}]'
              alb.ingress.kubernetes.io/ssl-redirect: '443'
              alb.ingress.kubernetes.io/certificate-arn: arn:aws:acm:ap-southeast-3:134604498185:certificate/bf0e14cb-57a3-48e9-95f2-ed16f17f1b8e
              alb.ingress.kubernetes.io/healthcheck-path: /api/health
              alb.ingress.kubernetes.io/group.name: planpal-internal
            hosts:
              - fakhri-grafana.sandbox.devopsinstitute.id
        # Prometheus: full defaults, kept internal. gp3 PVC, default retention.
        prometheus:
          prometheusSpec:
            retention: 10d
            storageSpec:
              volumeClaimTemplate:
                spec:
                  storageClassName: gp3
                  accessModes: [ReadWriteOnce]
                  resources:
                    requests:
                      storage: 50Gi
        # Alertmanager stays on (full stack) but internal only, no ingress.
        alertmanager:
          alertmanagerSpec:
            storage:
              volumeClaimTemplate:
                spec:
                  storageClassName: gp3
                  accessModes: [ReadWriteOnce]
                  resources:
                    requests:
                      storage: 2Gi
  destination:
    server: https://kubernetes.default.svc
    namespace: monitoring
  syncPolicy:
    automated:
      prune: true
      selfHeal: true
    syncOptions:
      - CreateNamespace=true
      # CRDs in this chart are large; ServerSideApply avoids the
      # "metadata.annotations too long" client-side apply error.
      - ServerSideApply=true