refactor(mon): rename victoria-metrics app dir to monitoring

2026-06-19 15:18:53 +03:00
parent 82b3c68597
commit 4dcdcd0017
6 changed files with 0 additions and 0 deletions
@@ -0,0 +1,95 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: victoria-metrics-k8s-stack
+  namespace: flux-system
+spec:
+  chart:
+    spec:
+      chart: victoria-metrics-k8s-stack
+      version: 0.84.0
+      reconcileStrategy: ChartVersion
+      sourceRef:
+        kind: HelmRepository
+        name: victoria-metrics
+        namespace: flux-system
+  targetNamespace: monitoring
+  interval: 30m
+  install:
+    remediation:
+      retries: 3
+  upgrade:
+    remediation:
+      retries: 3
+  values:
+    # Operator bundles the VictoriaMetrics CRDs (plain manifests, applied by Flux SSA).
+    victoria-metrics-operator:
+      enabled: true
+      crds:
+        plain: true
+
+    # Single-node TSDB. NodePort so the in-cluster Talos vmagent can remote_write
+    # and we can reach it by IP even when DNS (pihole on Talos) is down.
+    vmsingle:
+      enabled: true
+      spec:
+        retentionPeriod: "12"        # months — VM is very space-efficient
+        storage:
+          accessModes:
+            - ReadWriteOnce
+          storageClassName: local-path
+          resources:
+            requests:
+              storage: 30Gi
+        serviceSpec:
+          useAsDefault: true
+          spec:
+            type: NodePort
+            ports:
+              - name: http
+                port: 8428
+                targetPort: 8428
+                protocol: TCP
+                nodePort: 30428
+
+    # Local scrape of the Pi/k3s itself (node-exporter, kube-state-metrics, kubelet).
+    vmagent:
+      enabled: true
+
+    vmalert:
+      enabled: true
+
+    # Telegram + email wired later (see monitoring-rpi5-setup.md step 11).
+    # Default config uses a blackhole receiver until then.
+    alertmanager:
+      enabled: true
+
+    grafana:
+      enabled: true
+      # SQLite DB on an RWO local-path volume — never run two pods at once.
+      deploymentStrategy:
+        type: Recreate
+      # The volume already carries fsGroup: 472 and 472-owned data; the chown
+      # init container drops DAC_OVERRIDE and can't traverse Grafana's 0700
+      # render dirs, so it's both redundant and breaks rollouts here.
+      initChownData:
+        enabled: false
+      # VictoriaLogs datasource plugin (signed, from Grafana catalog).
+      # The datasource itself is provisioned via a sidecar-labelled ConfigMap
+      # (configmap-logs-datasource.yaml).
+      plugins:
+        - victoriametrics-logs-datasource
+      # Native Grafana login — independent of Authelia (which lives in Talos).
+      admin:
+        existingSecret: grafana-admin
+        userKey: admin-user
+        passwordKey: admin-password
+      persistence:
+        enabled: true
+        type: pvc
+        storageClassName: local-path
+        size: 5Gi
+      # NodePort so Grafana is reachable by IP without depending on DNS.
+      service:
+        type: NodePort
+        nodePort: 30300