helmrelease.yaml

apiVersion: helm.toolkit.fluxcd.io/v2
kind: HelmRelease
metadata:
  name: kube-prometheus-stack
  namespace: prometheus
spec:
  chart:
    spec:
      chart: kube-prometheus-stack
      version: 87.21.0
      reconcileStrategy: ChartVersion
      sourceRef:
        kind: HelmRepository
        namespace: flux-system
        name: prometheus-community
  install:
    crds: Create
  upgrade:
    crds: CreateReplace
  interval: 1h
  driftDetection:
    mode: enabled
    ignore:
      # Ignore "validated" annotation which is not inserted during install
      - target:
          kind: PrometheusRule
        paths:
          - /metadata/annotations/prometheus-operator-validated
  values:
    grafana:
      adminPassword: ${grafana_admin_password}
      podLabels:
        policy.gabe565.com/egress-envoy-public: "true"
        policy.gabe565.com/egress-kubeapi: "true"
        policy.gabe565.com/egress-namespace: "true"
        policy.gabe565.com/egress-world: "true"
        policy.gabe565.com/ingress-envoy-public: "true"
        policy.gabe565.com/ingress-namespace: "true"
      hostAliases:
        - ip: 10.43.0.20
          hostnames:
            - ${oauth_host}
      deploymentStrategy:
        type: Recreate
      defaultDashboardsTimezone: browser
      grafana.ini:
        server:
          root_url: https://${grafana_url}
        auth:
          signout_redirect_url: https://${oauth_host}/application/o/grafana/end-session/
          oauth_auto_login: true
        auth.generic_oauth:
          name: Authentik
          enabled: true
          scopes: openid email profile offline_access
          auth_url: https://${oauth_host}/application/o/authorize/
          token_url: https://${oauth_host}/application/o/token/
          api_url: https://${oauth_host}/application/o/userinfo/
          token_rotation_interval_minutes: "5"
          role_attribute_path: contains(groups[*], 'Grafana Admins') && 'Admin' || contains(groups[*], 'Grafana Editors') && 'Editor' || 'Viewer'
      env:
        GF_AUTH_GENERIC_OAUTH_CLIENT_ID: ${grafana_oauth_client_id}
        GF_AUTH_GENERIC_OAUTH_CLIENT_SECRET: ${grafana_oauth_client_secret}
      route:
        main:
          enabled: true
          parentRefs:
            - namespace: envoy-gateway-system
              name: public
          hostnames:
            - ${grafana_url}
      additionalDataSources:
        - name: Loki
          type: loki
          uid: loki
          access: proxy
          url: http://loki:3100
          jsonData:
            timeout: 300
            maxLines: 1000
      persistence:
        type: pvc
        enabled: true
        accessModes: [ReadWriteOnce]
        size: 10Gi
    defaultRules:
      disabled:
        KubeControllerManagerDown: true
        KubeProxyDown: true
        KubeSchedulerDown: true
        NodeRAIDDegraded: true
    additionalPrometheusRulesMap:
      node-exporter-custom:
        groups:
          - name: node-exporter-custom
            rules:
              - alert: NodeRAIDDegraded
                annotations:
                  description: RAID array '{{ $labels.device }}' at {{ $labels.instance }} is
                    in degraded state due to one or more disks failures. Number of spare drives
                    is insufficient to fix issue automatically.
                  runbook_url: https://runbooks.prometheus-operator.dev/runbooks/node/noderaiddegraded
                  summary: RAID Array is degraded.
                expr: 4 - node_md_disks{state="active",job="node-exporter",device=~"(/dev/)?(mmcblk.p.+|nvme.+|rbd.+|sd.+|vd.+|xvd.+|dm-.+|md.+|dasd.+)"} > 0
                for: 15m
                labels:
                  severity: critical
    alertmanager:
      alertmanagerSpec:
        podMetadata:
          labels:
            policy.gabe565.com/egress-namespace: "true"
            policy.gabe565.com/egress-world: "true"
            policy.gabe565.com/ingress-namespace: "true"
        storage:
          volumeClaimTemplate:
            spec:
              accessModes: [ReadWriteOnce]
              resources:
                requests:
                  storage: 10Gi
      config:
        route:
          receiver: telegram
        receivers:
          - name: "null"
          - name: telegram
            telegram_configs:
              - bot_token: ${telegram_bot_token}
                chat_id: ${telegram_chat_id}
                send_resolved: false
    prometheus:
      prometheusSpec:
        podMetadata:
          labels:
            policy.gabe565.com/egress-headscale: "true"
            policy.gabe565.com/egress-nodes: "true"
            policy.gabe565.com/egress-namespace: "true"
            policy.gabe565.com/egress-world: "true"
            policy.gabe565.com/ingress-envoy-public: "true"
            policy.gabe565.com/ingress-namespace: "true"
        enableRemoteWriteReceiver: true
        podMonitorSelectorNilUsesHelmValues: false
        serviceMonitorSelectorNilUsesHelmValues: false
        scrapeConfigSelectorNilUsesHelmValues: false
        scrapeInterval: 1m
        evaluationInterval: 1m
        resources:
          requests:
            memory: 2Gi
          limits:
            memory: 5Gi
        containers:
          - name: vpn
            image: ghcr.io/tailscale/tailscale:v1.98.10
            env:
              - name: POD_NAME
                valueFrom:
                  fieldRef:
                    fieldPath: metadata.name
              - name: POD_UID
                valueFrom:
                  fieldRef:
                    fieldPath: metadata.uid
              - name: TS_HOSTNAME
                value: prometheus
              - name: TS_KUBE_SECRET
                value: tailscale-state
              - name: TS_AUTHKEY
                value: ${vpn_auth_key}
              - name: TS_AUTH_ONCE
                value: "true"
            livenessProbe: &probe
              exec:
                command: [tailscale, --socket=/tmp/tailscaled.sock, status]
              periodSeconds: 60
            startupProbe:
              <<: *probe
              failureThreshold: 60
              periodSeconds: 5
        storageSpec:
          volumeClaimTemplate:
            spec:
              accessModes: [ReadWriteOnce]
              resources:
                requests:
                  storage: 50Gi
      route:
        main:
          enabled: true
          parentRefs:
            - namespace: envoy-gateway-system
              name: public
          hostnames:
            - ${prometheus_url}
    prometheusOperator:
      networkPolicy:
        enabled: true
        flavor: cilium
      podLabels:
        policy.gabe565.com/egress-kubeapi: "true"
        policy.gabe565.com/egress-namespace: "true"
        policy.gabe565.com/ingress-namespace: "true"
    kube-state-metrics:
      customLabels:
        policy.gabe565.com/egress-kubeapi: "true"