apiVersion: helm.toolkit.fluxcd.io/v2
kind: HelmRelease
metadata:
  name: victoria-metrics-k8s-stack
  namespace: flux-system
spec:
  chart:
    spec:
      chart: victoria-metrics-k8s-stack
      version: 0.84.0
      reconcileStrategy: ChartVersion
      sourceRef:
        kind: HelmRepository
        name: victoria-metrics
        namespace: flux-system
  targetNamespace: monitoring
  interval: 30m
  install:
    remediation:
      retries: 3
  upgrade:
    remediation:
      retries: 3
  values:
    # Operator bundles the VictoriaMetrics CRDs (plain manifests, applied by Flux SSA).
    victoria-metrics-operator:
      enabled: true
      crds:
        plain: true

    # Single-node TSDB. NodePort so the in-cluster Talos vmagent can remote_write
    # and we can reach it by IP even when DNS (pihole on Talos) is down.
    vmsingle:
      enabled: true
      spec:
        retentionPeriod: "12"        # months — VM is very space-efficient
        storage:
          accessModes:
            - ReadWriteOnce
          storageClassName: local-path
          resources:
            requests:
              storage: 30Gi
        serviceSpec:
          useAsDefault: true
          spec:
            type: NodePort
            ports:
              - name: http
                port: 8428
                targetPort: 8428
                protocol: TCP
                nodePort: 30428

    # Local scrape of the Pi/k3s itself (node-exporter, kube-state-metrics, kubelet).
    vmagent:
      enabled: true

    vmalert:
      enabled: true

    # Telegram + email wired later (see monitoring-rpi5-setup.md step 11).
    # Default config uses a blackhole receiver until then.
    alertmanager:
      enabled: true

    grafana:
      enabled: true
      # SQLite DB on an RWO local-path volume — never run two pods at once.
      deploymentStrategy:
        type: Recreate
      # The volume already carries fsGroup: 472 and 472-owned data; the chown
      # init container drops DAC_OVERRIDE and can't traverse Grafana's 0700
      # render dirs, so it's both redundant and breaks rollouts here.
      initChownData:
        enabled: false
      # Native VictoriaMetrics datasource plugins (signed, from Grafana catalog).
      # - metrics: backs the "VictoriaMetrics (DS)" datasource the chart
      #   provisions by default (defaultDatasources.victoriametrics) — MetricsQL.
      # - logs: backs our VictoriaLogs datasource (configmap-logs-datasource.yaml).
      plugins:
        - victoriametrics-metrics-datasource
        - victoriametrics-logs-datasource
      # Native Grafana login — independent of Authelia (which lives in Talos).
      admin:
        existingSecret: grafana-admin
        userKey: admin-user
        passwordKey: admin-password
      persistence:
        enabled: true
        type: pvc
        storageClassName: local-path
        size: 5Gi
      # NodePort so Grafana is reachable by IP without depending on DNS.
      service:
        type: NodePort
        nodePort: 30300