Aleksandr Bogomiakov
ba1fcae807
Update Kubernetes Services Wiki / Generate and Update K8s Wiki (push) Successful in 12s
296 lines
8.0 KiB
YAML
296 lines
8.0 KiB
YAML
defaultRules:
|
|
create: true
|
|
# Default rule descriptions reference $labels.cluster. Prometheus external
|
|
# labels are added only when alerts leave Prometheus, so attach the label to
|
|
# the rules as well to avoid messages ending with "on cluster .".
|
|
additionalRuleLabels:
|
|
cluster: hexor-ng
|
|
rules:
|
|
# k3s embeds these control-plane components and does not expose their
|
|
# conventional metrics Services. Disabling the groups prevents false pages.
|
|
etcd: false
|
|
kubeControllerManager: false
|
|
kubeProxy: false
|
|
kubeSchedulerAlerting: false
|
|
kubeSchedulerRecording: false
|
|
runbookUrl: https://runbooks.prometheus-operator.dev/runbooks
|
|
|
|
kubeControllerManager:
|
|
enabled: false
|
|
kubeScheduler:
|
|
enabled: false
|
|
kubeProxy:
|
|
enabled: false
|
|
kubeEtcd:
|
|
enabled: false
|
|
|
|
alertmanager:
|
|
enabled: true
|
|
config:
|
|
global:
|
|
resolve_timeout: 5m
|
|
route:
|
|
group_by: [namespace, alertname]
|
|
group_wait: 30s
|
|
group_interval: 5m
|
|
repeat_interval: 12h
|
|
receiver: "null"
|
|
receivers:
|
|
- name: "null"
|
|
alertmanagerSpec:
|
|
replicas: 1
|
|
retention: 120h
|
|
nodeSelector:
|
|
homelab.hexor.cy/pool: core
|
|
homelab.hexor.cy/exposure: external
|
|
kubernetes.io/hostname: music
|
|
priorityClassName: monitoring-critical
|
|
alertmanagerConfigSelector:
|
|
matchLabels:
|
|
alertmanager: main
|
|
# The single global routing object must be allowed to receive alerts from
|
|
# every namespace, rather than only alerts labelled namespace=prometheus.
|
|
alertmanagerConfigMatcherStrategy:
|
|
type: None
|
|
resources:
|
|
requests:
|
|
cpu: 100m
|
|
memory: 256Mi
|
|
limits:
|
|
cpu: 500m
|
|
memory: 1Gi
|
|
storage:
|
|
volumeClaimTemplate:
|
|
spec:
|
|
storageClassName: monitoring-local
|
|
accessModes: [ReadWriteOnce]
|
|
selector:
|
|
matchLabels:
|
|
monitoring.hexor.cy/volume: alertmanager
|
|
resources:
|
|
requests:
|
|
storage: 5Gi
|
|
|
|
prometheus:
|
|
prometheusSpec:
|
|
replicas: 1
|
|
nodeSelector:
|
|
homelab.hexor.cy/pool: core
|
|
homelab.hexor.cy/exposure: external
|
|
kubernetes.io/hostname: music
|
|
priorityClassName: monitoring-critical
|
|
scrapeInterval: 30s
|
|
scrapeTimeout: 10s
|
|
evaluationInterval: 30s
|
|
externalUrl: https://prom.hexor.cy
|
|
externalLabels:
|
|
cluster: hexor-ng
|
|
enableRemoteWriteReceiver: true
|
|
walCompression: true
|
|
retention: 365d
|
|
# Time and size retention are both applied; whichever is reached first
|
|
# wins, leaving headroom for compaction and WAL spikes on the 500 Gi PV.
|
|
retentionSize: 425GB
|
|
resources:
|
|
requests:
|
|
cpu: "1"
|
|
memory: 4Gi
|
|
limits:
|
|
cpu: "4"
|
|
memory: 12Gi
|
|
storageSpec:
|
|
volumeClaimTemplate:
|
|
spec:
|
|
storageClassName: monitoring-local
|
|
accessModes: [ReadWriteOnce]
|
|
selector:
|
|
matchLabels:
|
|
monitoring.hexor.cy/volume: prometheus
|
|
resources:
|
|
requests:
|
|
storage: 500Gi
|
|
|
|
# Discover monitoring resources in every namespace without requiring the
|
|
# kube-prometheus-stack release label on application-owned monitors.
|
|
ruleSelectorNilUsesHelmValues: false
|
|
ruleSelector: {}
|
|
ruleNamespaceSelector: {}
|
|
serviceMonitorSelectorNilUsesHelmValues: false
|
|
serviceMonitorSelector: {}
|
|
serviceMonitorNamespaceSelector: {}
|
|
podMonitorSelectorNilUsesHelmValues: false
|
|
podMonitorSelector: {}
|
|
podMonitorNamespaceSelector: {}
|
|
probeSelectorNilUsesHelmValues: false
|
|
probeSelector: {}
|
|
probeNamespaceSelector: {}
|
|
scrapeConfigSelectorNilUsesHelmValues: false
|
|
scrapeConfigSelector: {}
|
|
scrapeConfigNamespaceSelector: {}
|
|
|
|
#additionalScrapeConfigs:
|
|
# - job_name: xray-vpn
|
|
# metrics_path: /scrape
|
|
# static_configs:
|
|
# - targets: [cy.tail2fe2d.ts.net:9550]
|
|
# labels: {site: cy}
|
|
# - targets: [x86.tail2fe2d.ts.net:9550]
|
|
# labels: {site: am}
|
|
# - targets: [jp.tail2fe2d.ts.net:9550]
|
|
# labels: {site: jp}
|
|
# - job_name: macos-node-exporter
|
|
# static_configs:
|
|
# - targets: [macbook-pro.tail2fe2d.ts.net:9100]
|
|
# labels: {instance: ultrabook-pro}
|
|
|
|
grafana:
|
|
enabled: true
|
|
replicas: 1
|
|
testFramework:
|
|
enabled: false
|
|
annotations:
|
|
reloader.stakater.com/auto: "true"
|
|
nodeSelector:
|
|
homelab.hexor.cy/pool: core
|
|
homelab.hexor.cy/exposure: external
|
|
priorityClassName: monitoring-critical
|
|
resources:
|
|
requests:
|
|
cpu: 250m
|
|
memory: 512Mi
|
|
limits:
|
|
cpu: "2"
|
|
memory: 2Gi
|
|
admin:
|
|
existingSecret: grafana-admin
|
|
userKey: admin-user
|
|
passwordKey: admin-password
|
|
envFromSecret: grafana-env
|
|
grafana.ini:
|
|
server:
|
|
root_url: https://gf.hexor.cy
|
|
auth:
|
|
signout_redirect_url: https://auth.hexor.cy/auth/realms/hexor/protocol/openid-connect/logout?post_logout_redirect_uri=https%3A%2F%2Fgf.hexor.cy%2Flogin&client_id=Grafana
|
|
oauth_allow_insecure_email_lookup: true
|
|
auth.generic_oauth:
|
|
name: Keycloak
|
|
enabled: true
|
|
scopes: openid profile email
|
|
allow_sign_up: true
|
|
auth_url: https://auth.hexor.cy/auth/realms/hexor/protocol/openid-connect/auth
|
|
token_url: https://auth.hexor.cy/auth/realms/hexor/protocol/openid-connect/token
|
|
api_url: https://auth.hexor.cy/auth/realms/hexor/protocol/openid-connect/userinfo
|
|
email_attribute_path: email
|
|
login_attribute_path: preferred_username
|
|
name_attribute_path: name
|
|
role_attribute_path: >-
|
|
contains(groups[*], 'hexor-admin') && 'Admin' ||
|
|
contains(groups[*], 'hexor-guest') && 'Viewer' ||
|
|
'Viewer'
|
|
role_attribute_strict: false
|
|
database:
|
|
type: postgres
|
|
host: main-rw.psql.svc:5432
|
|
name: grafana
|
|
ssl_mode: disable
|
|
log:
|
|
level: info
|
|
sidecar:
|
|
resources:
|
|
requests:
|
|
cpu: 100m
|
|
memory: 128Mi
|
|
limits:
|
|
cpu: "1"
|
|
memory: 512Mi
|
|
dashboards:
|
|
enabled: true
|
|
searchNamespace: ALL
|
|
datasources:
|
|
uid: prometheus
|
|
alertmanager:
|
|
uid: alertmanager
|
|
handleGrafanaManagedAlerts: false
|
|
additionalDataSources:
|
|
- name: Loki
|
|
uid: loki
|
|
type: loki
|
|
url: http://loki-gateway.prometheus.svc:80
|
|
access: proxy
|
|
orgId: 1
|
|
jsonData:
|
|
maxLines: 2000
|
|
ingress:
|
|
enabled: true
|
|
ingressClassName: traefik
|
|
annotations:
|
|
cert-manager.io/cluster-issuer: letsencrypt
|
|
traefik.ingress.kubernetes.io/router.entrypoints: websecure
|
|
hosts:
|
|
- gf.hexor.cy
|
|
tls:
|
|
- secretName: grafana-tls
|
|
hosts:
|
|
- gf.hexor.cy
|
|
|
|
prometheusOperator:
|
|
admissionWebhooks:
|
|
patch:
|
|
nodeSelector:
|
|
homelab.hexor.cy/pool: core
|
|
homelab.hexor.cy/exposure: external
|
|
nodeSelector:
|
|
homelab.hexor.cy/pool: core
|
|
homelab.hexor.cy/exposure: external
|
|
priorityClassName: monitoring-critical
|
|
resources:
|
|
requests:
|
|
cpu: 100m
|
|
memory: 128Mi
|
|
limits:
|
|
cpu: 500m
|
|
memory: 512Mi
|
|
prometheusConfigReloader:
|
|
resources:
|
|
requests:
|
|
cpu: 20m
|
|
memory: 64Mi
|
|
limits:
|
|
cpu: 200m
|
|
memory: 256Mi
|
|
|
|
kube-state-metrics:
|
|
nodeSelector:
|
|
homelab.hexor.cy/pool: core
|
|
homelab.hexor.cy/exposure: external
|
|
priorityClassName: monitoring-critical
|
|
resources:
|
|
requests:
|
|
cpu: 50m
|
|
memory: 128Mi
|
|
limits:
|
|
cpu: 500m
|
|
memory: 512Mi
|
|
|
|
prometheus-node-exporter:
|
|
priorityClassName: monitoring-critical
|
|
tolerations:
|
|
- operator: Exists
|
|
prometheus:
|
|
monitor:
|
|
# Keep dashboard variables and alerts stable when a node IP changes.
|
|
# The scrape address remains the discovered node IP; only the public
|
|
# instance label is rewritten to the Kubernetes node hostname.
|
|
relabelings:
|
|
- action: replace
|
|
sourceLabels: [__meta_kubernetes_endpoint_node_name]
|
|
targetLabel: instance
|
|
replacement: "${1}:9100"
|
|
resources:
|
|
requests:
|
|
cpu: 50m
|
|
memory: 64Mi
|
|
limits:
|
|
cpu: 500m
|
|
memory: 256Mi
|