feat(mon/victoria-metrics): add metrics, alerting and Grafana stack

2026-06-19 14:50:01 +03:00
parent bec94d64a4
commit 74b85e0f42
7 changed files with 143 additions and 0 deletions
@@ -0,0 +1,82 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: victoria-metrics-k8s-stack
+  namespace: flux-system
+spec:
+  chart:
+    spec:
+      chart: victoria-metrics-k8s-stack
+      version: 0.84.0
+      reconcileStrategy: ChartVersion
+      sourceRef:
+        kind: HelmRepository
+        name: victoria-metrics
+        namespace: flux-system
+  targetNamespace: monitoring
+  interval: 30m
+  install:
+    remediation:
+      retries: 3
+  upgrade:
+    remediation:
+      retries: 3
+  values:
+    # Operator bundles the VictoriaMetrics CRDs (plain manifests, applied by Flux SSA).
+    victoria-metrics-operator:
+      enabled: true
+      crds:
+        plain: true
+
+    # Single-node TSDB. NodePort so the in-cluster Talos vmagent can remote_write
+    # and we can reach it by IP even when DNS (pihole on Talos) is down.
+    vmsingle:
+      enabled: true
+      spec:
+        retentionPeriod: "12"        # months — VM is very space-efficient
+        storage:
+          accessModes:
+            - ReadWriteOnce
+          storageClassName: local-path
+          resources:
+            requests:
+              storage: 30Gi
+        serviceSpec:
+          useAsDefault: true
+          spec:
+            type: NodePort
+            ports:
+              - name: http
+                port: 8428
+                targetPort: 8428
+                protocol: TCP
+                nodePort: 30428
+
+    # Local scrape of the Pi/k3s itself (node-exporter, kube-state-metrics, kubelet).
+    vmagent:
+      enabled: true
+
+    vmalert:
+      enabled: true
+
+    # Telegram + email wired later (see monitoring-rpi5-setup.md step 11).
+    # Default config uses a blackhole receiver until then.
+    alertmanager:
+      enabled: true
+
+    grafana:
+      enabled: true
+      # Native Grafana login — independent of Authelia (which lives in Talos).
+      admin:
+        existingSecret: grafana-admin
+        userKey: admin-user
+        passwordKey: admin-password
+      persistence:
+        enabled: true
+        type: pvc
+        storageClassName: local-path
+        size: 5Gi
+      # NodePort so Grafana is reachable by IP without depending on DNS.
+      service:
+        type: NodePort
+        nodePort: 30300