From ac8e5e127c49733b2f0f09a9636a6742b3b9f8b3 Mon Sep 17 00:00:00 2001
From: Aleksandr Bogomiakov <git@hexor.cy>
Date: Wed, 7 Oct 2026 18:52:06 +0100
Subject: [PATCH] NG: Fixed prom-stak

---
 k8s-ng/core/prom-stack/README.md              |  4 +-
 .../core/prom-stack/alertmanager-config.yaml  |  2 +
 k8s-ng/core/prom-stack/external-secrets.yaml  | 45 ++++++++++++++-----
 k8s-ng/core/prom-stack/loki-values.yaml       |  7 +--
 4 files changed, 41 insertions(+), 17 deletions(-)

diff --git a/k8s-ng/core/prom-stack/README.md b/k8s-ng/core/prom-stack/README.md
index b12767d..b63e1e8 100644
--- a/k8s-ng/core/prom-stack/README.md
+++ b/k8s-ng/core/prom-stack/README.md
@@ -32,8 +32,8 @@ them. This protects data from a manifest rename, but it is not a backup. Back up
 
 - node `music` must exist and `/data` must be the intended large filesystem;
 - `main-rw.psql.svc` and the generated `grafana-db` Secret must be ready;
-- `vaultwarden-login` must resolve the existing Grafana OIDC and Telegram item
-  UUIDs used in `external-secrets.yaml`;
+- `vaultwarden-fields` must resolve `k8s/prometheus/grafana-secrets` with the
+  custom fields `IDM Client ID`, `IDM Client Secret`, `TG Token`, and `TG ID`;
 - DNS for `gf.hexor.cy` and `prom.hexor.cy` must point to the new cluster.
 
 After Argo CD reports the application healthy, verify targets, rules and log
diff --git a/k8s-ng/core/prom-stack/alertmanager-config.yaml b/k8s-ng/core/prom-stack/alertmanager-config.yaml
index f63ca12..e51d52f 100644
--- a/k8s-ng/core/prom-stack/alertmanager-config.yaml
+++ b/k8s-ng/core/prom-stack/alertmanager-config.yaml
@@ -4,6 +4,8 @@ metadata:
   name: telegram
   labels:
     alertmanager: main
+  annotations:
+    argocd.argoproj.io/sync-wave: "1"
 spec:
   route:
     groupBy: [namespace, alertname]
diff --git a/k8s-ng/core/prom-stack/external-secrets.yaml b/k8s-ng/core/prom-stack/external-secrets.yaml
index cb7a763..b754851 100644
--- a/k8s-ng/core/prom-stack/external-secrets.yaml
+++ b/k8s-ng/core/prom-stack/external-secrets.yaml
@@ -3,11 +3,15 @@ apiVersion: v1
 kind: ServiceAccount
 metadata:
   name: db-credentials-reader
+  annotations:
+    argocd.argoproj.io/sync-wave: "-3"
 ---
 apiVersion: external-secrets.io/v1
 kind: SecretStore
 metadata:
   name: psql-credentials
+  annotations:
+    argocd.argoproj.io/sync-wave: "-2"
 spec:
   provider:
     kubernetes:
@@ -26,6 +30,8 @@ apiVersion: generators.external-secrets.io/v1alpha1
 kind: Password
 metadata:
   name: grafana-admin
+  annotations:
+    argocd.argoproj.io/sync-wave: "-2"
 spec:
   length: 40
   digits: 10
@@ -37,6 +43,8 @@ apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
   name: grafana-admin
+  annotations:
+    argocd.argoproj.io/sync-wave: "-1"
 spec:
   refreshPolicy: CreatedOnce
   target:
@@ -53,13 +61,15 @@ spec:
           kind: Password
           name: grafana-admin
 ---
-# Grafana's database credentials come from CNPG. The existing Grafana Keycloak
-# client remains in Vaultwarden; item UUIDs are retained so no secret migration
-# or rename is required.
+# Grafana's database credentials come from CNPG. OIDC credentials are read by
+# stable Vaultwarden item and custom-field names, so imports and field ordering
+# do not invalidate the references.
 apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
   name: grafana-env
+  annotations:
+    argocd.argoproj.io/sync-wave: "-1"
 spec:
   refreshInterval: 1h
   target:
@@ -84,19 +94,19 @@ spec:
     - secretKey: client_id
       sourceRef:
         storeRef:
-          name: vaultwarden-login
+          name: vaultwarden-fields
           kind: ClusterSecretStore
       remoteRef:
-        key: 6a03357b-616e-4973-897a-93ccd675ddcb
-        property: fields[0].value
+        key: k8s/prometheus/grafana-secrets
+        property: IDM Client ID
     - secretKey: client_secret
       sourceRef:
         storeRef:
-          name: vaultwarden-login
+          name: vaultwarden-fields
           kind: ClusterSecretStore
       remoteRef:
-        key: 6a03357b-616e-4973-897a-93ccd675ddcb
-        property: fields[1].value
+        key: k8s/prometheus/grafana-secrets
+        property: IDM Client Secret
   secretStoreRef:
     kind: SecretStore
     name: psql-credentials
@@ -105,6 +115,8 @@ apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
   name: alertmanager-telegram
+  annotations:
+    argocd.argoproj.io/sync-wave: "-1"
 spec:
   refreshInterval: 1h
   target:
@@ -114,12 +126,21 @@ spec:
       type: Opaque
       data:
         bot-token: "{{ .bot_token }}"
+        chat-id: "{{ .chat_id }}"
   data:
     - secretKey: bot_token
       sourceRef:
         storeRef:
-          name: vaultwarden-login
+          name: vaultwarden-fields
           kind: ClusterSecretStore
       remoteRef:
-        key: eca0fb0b-3939-40a8-890a-6294863e5a65
-        property: fields[0].value
+        key: k8s/prometheus/grafana-secrets
+        property: TG Token
+    - secretKey: chat_id
+      sourceRef:
+        storeRef:
+          name: vaultwarden-fields
+          kind: ClusterSecretStore
+      remoteRef:
+        key: k8s/prometheus/grafana-secrets
+        property: TG ID
diff --git a/k8s-ng/core/prom-stack/loki-values.yaml b/k8s-ng/core/prom-stack/loki-values.yaml
index d98b3b1..7abac64 100644
--- a/k8s-ng/core/prom-stack/loki-values.yaml
+++ b/k8s-ng/core/prom-stack/loki-values.yaml
@@ -78,7 +78,9 @@ sidecar:
 
 gateway:
   enabled: true
-  replicas: 2
+  # A second replica cannot improve availability while both replicas are pinned
+  # to the only storage node, and the chart's anti-affinity prevents scheduling.
+  replicas: 1
   nodeSelector:
     kubernetes.io/hostname: music
   priorityClassName: monitoring-critical
@@ -91,8 +93,7 @@ gateway:
       cpu: 500m
       memory: 256Mi
   podDisruptionBudget:
-    enabled: true
-    maxUnavailable: 1
+    enabled: false
 
 test:
   enabled: false