commit fefc536fc3af5dadd7b55248375fe358ef7b3a65
parent fdfb1e6bcfa18ed9ce74378ee7a093ad32a0fdc2
Author: MTRNord <mtrnord1@gmail.com>
Date: Sun, 19 Mar 2023 19:21:39 +0100
Migrate monitoring
Diffstat:
9 files changed, 235 insertions(+), 0 deletions(-)
diff --git a/apps/base/kube-prometheus-stack/kustomization.yaml b/apps/base/kube-prometheus-stack/kustomization.yaml
@@ -0,0 +1,7 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: monitoring
+resources:
+ - namespace.yaml
+ - repository.yaml
+ - release.yaml
diff --git a/apps/base/kube-prometheus-stack/namespace.yaml b/apps/base/kube-prometheus-stack/namespace.yaml
@@ -0,0 +1,7 @@
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+ name: monitoring
+ labels:
+ app.kubernetes.io/component: monitoring
diff --git a/apps/base/kube-prometheus-stack/release.yaml b/apps/base/kube-prometheus-stack/release.yaml
@@ -0,0 +1,134 @@
+apiVersion: helm.toolkit.fluxcd.io/v2beta1
+kind: HelmRelease
+metadata:
+ name: kube-prometheus-stack
+ namespace: monitoring
+spec:
+ interval: 5m
+ chart:
+ spec:
+ version: "45.x"
+ chart: kube-prometheus-stack
+ sourceRef:
+ kind: HelmRepository
+ name: prometheus-community
+ interval: 60m
+ install:
+ crds: Create
+ upgrade:
+ crds: CreateReplace
+ # https://github.com/prometheus-community/helm-charts/blob/main/charts/kube-prometheus-stack/values.yaml
+ values:
+ alertmanager:
+ alertmanagerSpec:
+ useExistingSecret: true
+ namespaceOverride: monitoring
+ grafana:
+ extraSecretMounts:
+ - name: auth-generic-oauth-secret-mount
+ secretName: auth-generic-oauth-secret
+ defaultMode: 0440
+ mountPath: /etc/secrets/auth_generic_oauth
+ readOnly: true
+ defaultDashboardsTimezone: Europe/Berlin
+ dashboardProviders:
+ dashboardproviders.yaml:
+ apiVersion: 1
+ providers:
+ - name: "monitoring"
+ orgId: 1
+ folder: "Monitoring"
+ type: file
+ disableDeletion: true
+ editable: false
+ updateIntervalSeconds: 10
+ allowUiUpdates: false
+ options:
+ path: /var/lib/grafana/dashboards/monitoring
+ - name: "matrix"
+ orgId: 1
+ folder: "Matrix"
+ type: file
+ disableDeletion: true
+ editable: false
+ updateIntervalSeconds: 10
+ allowUiUpdates: false
+ options:
+ path: /var/lib/grafana/dashboards/matrix
+ - name: "nats"
+ orgId: 1
+ folder: "Nats"
+ type: file
+ disableDeletion: true
+ editable: false
+ updateIntervalSeconds: 10
+ allowUiUpdates: false
+ options:
+ path: /var/lib/grafana/dashboards/nats
+ dashboards:
+ monitoring:
+ prometheus-blackbox-exporter:
+ # Ref: https://grafana.com/dashboards/7587
+ gnetId: 7587
+ revision: 3
+ datasource: Prometheus
+ cilium-dashboard:
+ url: https://raw.githubusercontent.com/cilium/cilium/v1.13.1/examples/kubernetes/addons/prometheus/files/grafana-dashboards/cilium-dashboard.json
+ cilium-operator-dashboard:
+ url: https://raw.githubusercontent.com/cilium/cilium/v1.13.1/examples/kubernetes/addons/prometheus/files/grafana-dashboards/cilium-operator-dashboard.json
+ hubble-dashboard:
+ url: https://raw.githubusercontent.com/cilium/cilium/v1.13.1/examples/kubernetes/addons/prometheus/files/grafana-dashboards/hubble-dashboard.json
+ nats:
+ nats-jetstream:
+ url: https://gitlab.nordgedanken.dev/grafana/dashboards/-/raw/main/nats.json
+ matrix:
+ synapse-dashboard:
+ url: https://raw.githubusercontent.com/matrix-org/synapse/master/contrib/grafana/synapse.json
+ dendrite-dashboard:
+ url: https://gitlab.nordgedanken.dev/grafana/dashboards/-/raw/main/dendrite.json
+ grafana.ini:
+ paths:
+ data: /var/lib/grafana/
+ logs: /var/log/grafana
+ plugins: /var/lib/grafana/plugins
+ provisioning: /etc/grafana/provisioning
+ analytics:
+ check_for_updates: true
+ log:
+ mode: console
+ grafana_net:
+ url: https://grafana.net
+ auth.generic_oauth:
+ enabled: true
+ scopes: openid email profile roles
+ name: OAuth
+ allow_sign_up: true
+ client_id: $__file{/etc/secrets/auth_generic_oauth/client_id}
+ client_secret: $__file{/etc/secrets/auth_generic_oauth/client_secret}
+ auth_url: "https://keycloak.midnightthoughts.space/realms/master/protocol/openid-connect/auth"
+ token_url: "https://keycloak.midnightthoughts.space/realms/master/protocol/openid-connect/token"
+ api_url: "https://keycloak.midnightthoughts.space/realms/master/protocol/openid-connect/userinfo"
+ role_attribute_path: contains(resource_access.grafana.roles[*], 'admin') && 'Admin' || contains(resource_access.grafana.roles[*], 'editor') && 'Editor' || 'Viewer'
+ imageRenderer:
+ enabled: true
+ kubeProxy:
+ enabled: false
+
+ postRenderers:
+ - kustomize:
+ patches:
+ - target:
+ # Ignore these objects from Flux diff as they are mutated from chart hooks
+ kind: (ValidatingWebhookConfiguration|MutatingWebhookConfiguration)
+ name: kube-prometheus-stack-admission
+ patch: |
+ - op: add
+ path: /metadata/annotations/helm.toolkit.fluxcd.io~1driftDetection
+ value: disabled
+ - target:
+ # Ignore these objects from Flux diff as they are mutated at apply time but not at dry-run time
+ kind: PrometheusRule
+ patch: |
+ - op: add
+ path: /metadata/annotations/helm.toolkit.fluxcd.io~1driftDetection
+ value: disabled
diff --git a/apps/base/kube-prometheus-stack/repository.yaml b/apps/base/kube-prometheus-stack/repository.yaml
@@ -0,0 +1,10 @@
+apiVersion: source.toolkit.fluxcd.io/v1beta2
+kind: HelmRepository
+metadata:
+ name: prometheus-community
+ namespace: monitoring
+spec:
+ interval: 120m
+ # OCI builds for kube-prometheus-stack have been temporarily disabled (see https://github.com/prometheus-community/helm-charts/issues/2940).
+ type: default
+ url: https://prometheus-community.github.io/helm-charts
diff --git a/apps/production/kube-prometheus-stack-values.yaml b/apps/production/kube-prometheus-stack-values.yaml
@@ -0,0 +1,19 @@
+apiVersion: helm.toolkit.fluxcd.io/v2beta1
+kind: HelmRelease
+metadata:
+ name: kube-prometheus-stack
+ namespace: monitoring
+spec:
+ values:
+ grafana:
+ ingress:
+ enabled: true
+ hosts:
+ - grafana.midnightthoughts.space
+ tls:
+ - secretName: grafana-general-tls
+ hosts:
+ - grafana.midnightthoughts.space
+ grafana.ini:
+ server:
+ root_url: https://grafana.midnightthoughts.space
diff --git a/apps/production/kustomization.yaml b/apps/production/kustomization.yaml
@@ -4,7 +4,9 @@ resources:
- ../base/vaultwarden
- ../base/cosign
- ../base/woodpecker
+ - ../base/kube-prometheus-stack
patchesStrategicMerge:
- cosign-values.yaml
- vaultwarden-values.yaml
- woodpecker-values.yaml
+ - kube-prometheus-stack-values.yaml
diff --git a/apps/production/secrets/alertmanager-secret.yaml b/apps/production/secrets/alertmanager-secret.yaml
@@ -0,0 +1,26 @@
+apiVersion: v1
+kind: Secret
+metadata:
+ name: kube-prometheus-kube-prome-alertmanager
+stringData:
+ alertmanager.yaml: ENC[AES256_GCM,data:qidWtGKc5DBYNwx8h3Ca1pcdJ8LbcKBs6ZeP4eZeANSPlSWtCer0O0ClyAeE1iiJTBoYg4T1USFJlLAx4S3eddTNxryiXVLm1mqfVEVnNYYbr4A9Tyz3GFV+jQ3+xBw3ETvi0+3tzymimsyLVlpMRH+JCxwz4h695GGhEVhFm9qTagfmrbsMUAJ/ZEcneJq/4tiQyxUCXA5iYTbNdQCAU4+9cUeIwtiuc+5ZFPxh8o6ZN1tN0KN9UhYpAiwGVNX8XitbyjJbs6dM+ADZ87aILMc/8oFT4S5e4a9zUY68B55UnYKNBa4gfS52wgR4yk5KlVpWdDKkt4zC96dkPqSFkE9N1zJLCLZRuYoumeaKHxx5kAtX8zkyqjGHVD7Ux0goPLDT/EFYwQ3Oh9L1HhSym45jUCJW7pmgKwmNO3iEEkf1ehyoTGuOwfA=,iv:9LvtAtfkILH53PmNSaFSC0GwLzyJeT7ICvAFm8sEht0=,tag:BUfb9g99EQgaXGrhdpEvhw==,type:str]
+sops:
+ kms: []
+ gcp_kms: []
+ azure_kv: []
+ hc_vault: []
+ age:
+ - recipient: age1esjyg2qfy49awv0ptkzvpk425adczjr38m37w2mmcahzc4p8n54sll2nzh
+ enc: |
+ -----BEGIN AGE ENCRYPTED FILE-----
+ YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBEc0k5Nk8xS05SQjNTZ0RQ
+ TmxCd0pXbzNBWkg4M1k3TGFsdmNrNkRVSG1ZCndhaTFQNUJmMFg0Q0NEUDI1SzRQ
+ cDlPaTZzMVFaanlmUHM0SCtiOE5Xa00KLS0tIGR5VzZTaHpQU1FkaUZ5cGhqZ1lD
+ YUVKL1BsL2htNUFDdUlQZGlQZVN0T2cKmIQCisQFn06Vp9VLzFowHWq8pS2cuBRz
+ JqvZOZlqXyF2rCZ+epYZ1CVKOu0Gz+wXUQ1Jg48qfLRFfNfsLiDl/A==
+ -----END AGE ENCRYPTED FILE-----
+ lastmodified: "2023-03-19T18:13:32Z"
+ mac: ENC[AES256_GCM,data:sGCm9h8G/9ARQFtyOjoENCeZGEueYerZFVdWjkvQNOc8GH+u5mJPGQ/r675BjDrVrQpRqKOhVBeRjqyMlLI5ufFWzkqfekylhEPCsQcIx1KDzEV1ueMxBMa+q3lHcBEu0Sn+CyPRt4GBhHwbg2e/wZvm4DurFv1cuEsxI5xnLvU=,iv:VWePAxAb5tuABe9ak8eY83FeYFKD5eZ1VD8w9FALvn0=,tag:XNy0M6hDTvJOT+1GiLtG/A==,type:str]
+ pgp: []
+ encrypted_regex: ^(data|stringData)$
+ version: 3.7.3
diff --git a/apps/production/secrets/grafana-secret.yaml b/apps/production/secrets/grafana-secret.yaml
@@ -0,0 +1,28 @@
+apiVersion: v1
+kind: Secret
+metadata:
+ name: auth-generic-oauth-secret
+type: Opaque
+stringData:
+ client_id: ENC[AES256_GCM,data:5lGEa+putQ==,iv:01LRwHHswDBCWu1mxNP0vnMjTZJAGgrgaA9VQfbZpWw=,tag:4clgbZHSJNdltKchymx7bA==,type:str]
+ client_secret: ENC[AES256_GCM,data:X7XJ83ob5pD0LHWPwbfv1i983js4OrIBu07TZONP4O8=,iv:bJOPE79V9V5hwTo1Y5Eio8jxmh3fY3fCUE3u7ExZXG4=,tag:Ezxz7GxuduAnLrHtS4rRdQ==,type:str]
+sops:
+ kms: []
+ gcp_kms: []
+ azure_kv: []
+ hc_vault: []
+ age:
+ - recipient: age1esjyg2qfy49awv0ptkzvpk425adczjr38m37w2mmcahzc4p8n54sll2nzh
+ enc: |
+ -----BEGIN AGE ENCRYPTED FILE-----
+ YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBLQlUyZGtaZi9ydzRTc0VI
+ UnJqYVo0YUxrSW1vUTdpcjZITjR5cHAvMUFRCkFidVIxbHVNczAyR25hcEtsM083
+ WVJQRVl4bmR2aWN1QnFuVGdHUktOV2sKLS0tIFc5cGFNZ0VRMko3Q0I4Zyt0dGVB
+ VDhmVmY3YkJpNzRLeXJFQTlHMkNqbDgK9x8Y0DeFteg7JMzTR/8InGDkbm5qiDLH
+ nvXmFKk7W2vxW9klGn3gLh064zzB8FrJlG9UjRLl0jvUy8+xRdjG7Q==
+ -----END AGE ENCRYPTED FILE-----
+ lastmodified: "2023-03-19T18:21:14Z"
+ mac: ENC[AES256_GCM,data:5wCc3IqZDR7xPdMugV6nXPzZDEL2fpMd+zDAeHWxpKLI9OsnI++fuRQhFh6wbPXtuBk8ea9QxWDR361Az8a/HHptPq5kwvIKgTUFJWehExcNp0ddlwgC2TBDV9GLj1CXYlsGsW3DTolQWFvJfYJZP9ED4L20l8RS0XBQrdCGloo=,iv:GnhctN/KkztU3J+uFjt/XonBP+M0yenzLZD48XUffOs=,tag:et6OhtKHfSWil985mYHHhg==,type:str]
+ pgp: []
+ encrypted_regex: ^(data|stringData)$
+ version: 3.7.3
diff --git a/apps/production/secrets/kustomization.yaml b/apps/production/secrets/kustomization.yaml
@@ -4,3 +4,5 @@ resources:
- vaultwarden-secret.yaml
- cosign-secret.yaml
- woodpecker-secret.yaml
+ - alertmanager-secret.yaml
+ - grafana-secret.yaml
