NG: Fixed prom-stak

k8s-ng/core/prom-stack/README.md

@@ -32,8 +32,8 @@ them. This protects data from a manifest rename, but it is not a backup. Back up
 
 - node `music` must exist and `/data` must be the intended large filesystem;
 - `main-rw.psql.svc` and the generated `grafana-db` Secret must be ready;
-- `vaultwarden-login` must resolve the existing Grafana OIDC and Telegram item
-  UUIDs used in `external-secrets.yaml`;
+- `vaultwarden-fields` must resolve `k8s/prometheus/grafana-secrets` with the
+  custom fields `IDM Client ID`, `IDM Client Secret`, `TG Token`, and `TG ID`;
 - DNS for `gf.hexor.cy` and `prom.hexor.cy` must point to the new cluster.
 
 After Argo CD reports the application healthy, verify targets, rules and log

k8s-ng/core/prom-stack/alertmanager-config.yaml

@@ -4,6 +4,8 @@ metadata:
   name: telegram
   labels:
     alertmanager: main
+  annotations:
+    argocd.argoproj.io/sync-wave: "1"
 spec:
   route:
     groupBy: [namespace, alertname]

k8s-ng/core/prom-stack/external-secrets.yaml

@@ -3,11 +3,15 @@ apiVersion: v1
 kind: ServiceAccount
 metadata:
   name: db-credentials-reader
+  annotations:
+    argocd.argoproj.io/sync-wave: "-3"
 ---
 apiVersion: external-secrets.io/v1
 kind: SecretStore
 metadata:
   name: psql-credentials
+  annotations:
+    argocd.argoproj.io/sync-wave: "-2"
 spec:
   provider:
     kubernetes:
@@ -26,6 +30,8 @@ apiVersion: generators.external-secrets.io/v1alpha1
 kind: Password
 metadata:
   name: grafana-admin
+  annotations:
+    argocd.argoproj.io/sync-wave: "-2"
 spec:
   length: 40
   digits: 10
@@ -37,6 +43,8 @@ apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
   name: grafana-admin
+  annotations:
+    argocd.argoproj.io/sync-wave: "-1"
 spec:
   refreshPolicy: CreatedOnce
   target:
@@ -53,13 +61,15 @@ spec:
           kind: Password
           name: grafana-admin
 ---
-# Grafana's database credentials come from CNPG. The existing Grafana Keycloak
-# client remains in Vaultwarden; item UUIDs are retained so no secret migration
-# or rename is required.
+# Grafana's database credentials come from CNPG. OIDC credentials are read by
+# stable Vaultwarden item and custom-field names, so imports and field ordering
+# do not invalidate the references.
 apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
   name: grafana-env
+  annotations:
+    argocd.argoproj.io/sync-wave: "-1"
 spec:
   refreshInterval: 1h
   target:
@@ -84,19 +94,19 @@ spec:
     - secretKey: client_id
       sourceRef:
         storeRef:
-          name: vaultwarden-login
+          name: vaultwarden-fields
           kind: ClusterSecretStore
       remoteRef:
-        key: 6a03357b-616e-4973-897a-93ccd675ddcb
-        property: fields[0].value
+        key: k8s/prometheus/grafana-secrets
+        property: IDM Client ID
     - secretKey: client_secret
       sourceRef:
         storeRef:
-          name: vaultwarden-login
+          name: vaultwarden-fields
           kind: ClusterSecretStore
       remoteRef:
-        key: 6a03357b-616e-4973-897a-93ccd675ddcb
-        property: fields[1].value
+        key: k8s/prometheus/grafana-secrets
+        property: IDM Client Secret
   secretStoreRef:
     kind: SecretStore
     name: psql-credentials
@@ -105,6 +115,8 @@ apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
   name: alertmanager-telegram
+  annotations:
+    argocd.argoproj.io/sync-wave: "-1"
 spec:
   refreshInterval: 1h
   target:
@@ -114,12 +126,21 @@ spec:
       type: Opaque
       data:
         bot-token: "{{ .bot_token }}"
+        chat-id: "{{ .chat_id }}"
   data:
     - secretKey: bot_token
       sourceRef:
         storeRef:
-          name: vaultwarden-login
+          name: vaultwarden-fields
           kind: ClusterSecretStore
       remoteRef:
-        key: eca0fb0b-3939-40a8-890a-6294863e5a65
-        property: fields[0].value
+        key: k8s/prometheus/grafana-secrets
+        property: TG Token
+    - secretKey: chat_id
+      sourceRef:
+        storeRef:
+          name: vaultwarden-fields
+          kind: ClusterSecretStore
+      remoteRef:
+        key: k8s/prometheus/grafana-secrets
+        property: TG ID

k8s-ng/core/prom-stack/loki-values.yaml

@@ -78,7 +78,9 @@ sidecar:
 
 gateway:
   enabled: true
-  replicas: 2
+  # A second replica cannot improve availability while both replicas are pinned
+  # to the only storage node, and the chart's anti-affinity prevents scheduling.
+  replicas: 1
   nodeSelector:
     kubernetes.io/hostname: music
   priorityClassName: monitoring-critical
@@ -91,8 +93,7 @@ gateway:
       cpu: 500m
       memory: 256Mi
   podDisruptionBudget:
-    enabled: true
-    maxUnavailable: 1
+    enabled: false
 
 test:
   enabled: false