apiVersion: helm.toolkit.fluxcd.io/v2
kind: HelmRelease
metadata:
  name: victoria-metrics-k8s-stack
  namespace: flux-system
spec:
  chart:
    spec:
      chart: victoria-metrics-k8s-stack
      version: 0.84.0
      reconcileStrategy: ChartVersion
      sourceRef:
        kind: HelmRepository
        name: victoria-metrics
        namespace: flux-system
  targetNamespace: monitoring
  interval: 30m
  install:
    remediation:
      retries: 3
  upgrade:
    remediation:
      retries: 3
  values:
    # Operator bundles the VictoriaMetrics CRDs (plain manifests, applied by Flux SSA).
    victoria-metrics-operator:
      enabled: true
      crds:
        plain: true

    # Single-node TSDB. NodePort so the in-cluster Talos vmagent can remote_write
    # and we can reach it by IP even when DNS (pihole on Talos) is down.
    vmsingle:
      enabled: true
      spec:
        retentionPeriod: "12"        # months — VM is very space-efficient
        storage:
          accessModes:
            - ReadWriteOnce
          storageClassName: local-path
          resources:
            requests:
              storage: 30Gi
        serviceSpec:
          useAsDefault: true
          spec:
            type: NodePort
            ports:
              - name: http
                port: 8428
                targetPort: 8428
                protocol: TCP
                nodePort: 30428

    # Local scrape of the Pi/k3s itself (node-exporter, kube-state-metrics, kubelet).
    vmagent:
      enabled: true

    vmalert:
      enabled: true

    # k3s runs scheduler/controller-manager in one binary with no separate
    # scrape endpoints, and uses kine instead of etcd — disabling these drops
    # the empty scrape pools and their always-firing rules.
    kubeScheduler:
      enabled: false
    kubeControllerManager:
      enabled: false
    kubeEtcd:
      enabled: false

    alertmanager:
      enabled: true
      spec:
        # Mounted at /etc/vm/secrets/alertmanager-telegram/ (bot_token, chat_id).
        secrets:
          - alertmanager-telegram
      config:
        route:
          receiver: telegram
          group_by: ["alertname", "job"]
          group_wait: 30s
          group_interval: 5m
          repeat_interval: 12h
          routes:
            - receiver: blackhole
              matchers:
                - alertname=~"Watchdog|InfoInhibitor"
            - receiver: blackhole
              matchers:
                - severity="info"
        inhibit_rules:
          - source_matchers:
              - severity="critical"
            target_matchers:
              - severity="warning"
            equal: ["alertname", "job"]
        receivers:
          - name: blackhole
          - name: telegram
            telegram_configs:
              - bot_token_file: /etc/vm/secrets/alertmanager-telegram/bot_token
                chat_id_file: /etc/vm/secrets/alertmanager-telegram/chat_id
                send_resolved: true

    grafana:
      enabled: true
      # SQLite DB on an RWO local-path volume — never run two pods at once.
      deploymentStrategy:
        type: Recreate
      # The volume already carries fsGroup: 472 and 472-owned data; the chown
      # init container drops DAC_OVERRIDE and can't traverse Grafana's 0700
      # render dirs, so it's both redundant and breaks rollouts here.
      initChownData:
        enabled: false
      # Native VictoriaMetrics datasource plugins (signed, from Grafana catalog).
      # - metrics: backs the "VictoriaMetrics (DS)" datasource the chart
      #   provisions by default (defaultDatasources.victoriametrics) — MetricsQL.
      # - logs: backs our VictoriaLogs datasource (configmap-logs-datasource.yaml).
      plugins:
        - victoriametrics-metrics-datasource
        - victoriametrics-logs-datasource
      # Native Grafana login — independent of Authelia (which lives in Talos).
      admin:
        existingSecret: grafana-admin
        userKey: admin-user
        passwordKey: admin-password
      persistence:
        enabled: true
        type: pvc
        storageClassName: local-path
        size: 5Gi
      # NodePort so Grafana is reachable by IP without depending on DNS.
      service:
        type: NodePort
        nodePort: 30300