79 lines
2.9 KiB
YAML
79 lines
2.9 KiB
YAML
# kube-prometheus-stack via Argo, child of the App-of-Apps root.
|
|
# Grafana on an INTERNAL ALB (VPN-only via Tailscale). Prometheus + Alertmanager
|
|
# stay cluster-internal (no ingress); reach them by port-forward.
|
|
apiVersion: argoproj.io/v1alpha1
|
|
kind: Application
|
|
metadata:
|
|
name: monitoring
|
|
namespace: argocd
|
|
finalizers:
|
|
- resources-finalizer.argocd.argoproj.io
|
|
spec:
|
|
project: default
|
|
source:
|
|
repoURL: https://prometheus-community.github.io/helm-charts
|
|
chart: kube-prometheus-stack
|
|
targetRevision: 65.* # pinned major; a current stable line
|
|
helm:
|
|
values: |
|
|
grafana:
|
|
# admin creds come from the pre-created secret (not stored in Git)
|
|
admin:
|
|
existingSecret: grafana-admin
|
|
userKey: admin-user
|
|
passwordKey: admin-password
|
|
grafana.ini:
|
|
server:
|
|
root_url: https://fakhri-grafana.sandbox.devopsinstitute.id
|
|
auth.anonymous:
|
|
enabled: false
|
|
ingress:
|
|
enabled: true
|
|
ingressClassName: alb
|
|
annotations:
|
|
alb.ingress.kubernetes.io/scheme: internal
|
|
alb.ingress.kubernetes.io/target-type: ip
|
|
alb.ingress.kubernetes.io/backend-protocol: HTTP
|
|
alb.ingress.kubernetes.io/listen-ports: '[{"HTTP":80},{"HTTPS":443}]'
|
|
alb.ingress.kubernetes.io/ssl-redirect: '443'
|
|
alb.ingress.kubernetes.io/certificate-arn: arn:aws:acm:ap-southeast-3:134604498185:certificate/bf0e14cb-57a3-48e9-95f2-ed16f17f1b8e
|
|
alb.ingress.kubernetes.io/healthcheck-path: /api/health
|
|
alb.ingress.kubernetes.io/group.name: planpal-internal
|
|
hosts:
|
|
- fakhri-grafana.sandbox.devopsinstitute.id
|
|
# Prometheus: full defaults, kept internal. gp3 PVC, default retention.
|
|
prometheus:
|
|
prometheusSpec:
|
|
retention: 10d
|
|
storageSpec:
|
|
volumeClaimTemplate:
|
|
spec:
|
|
storageClassName: gp3
|
|
accessModes: [ReadWriteOnce]
|
|
resources:
|
|
requests:
|
|
storage: 50Gi
|
|
# Alertmanager stays on (full stack) but internal only, no ingress.
|
|
alertmanager:
|
|
alertmanagerSpec:
|
|
storage:
|
|
volumeClaimTemplate:
|
|
spec:
|
|
storageClassName: gp3
|
|
accessModes: [ReadWriteOnce]
|
|
resources:
|
|
requests:
|
|
storage: 2Gi
|
|
destination:
|
|
server: https://kubernetes.default.svc
|
|
namespace: monitoring
|
|
syncPolicy:
|
|
automated:
|
|
prune: true
|
|
selfHeal: true
|
|
syncOptions:
|
|
- CreateNamespace=true
|
|
# CRDs in this chart are large; ServerSideApply avoids the
|
|
# "metadata.annotations too long" client-side apply error.
|
|
- ServerSideApply=true
|