From ea483da6455320d6cb849736769a6a3df7cd18c6 Mon Sep 17 00:00:00 2001 From: mr-forust Date: Tue, 16 Jun 2026 00:29:16 +0200 Subject: [PATCH] feat: kube-prometeus-stack --- prometheus-stack/.env.example | 2 + prometheus-stack/alertmanager.yaml | 5 ++ prometheus-stack/compose.yaml | 66 +++++++++++++++++++++++ prometheus-stack/k8s/grafana-values.yaml | 52 ++++++++++++++++++ prometheus-stack/k8s/ingress.yaml | 36 +++++++++++++ prometheus-stack/k8s/namespace.yaml | 4 ++ prometheus-stack/k8s/secrets.yaml.example | 9 ++++ prometheus-stack/k8s/traefik-metrics.yaml | 16 ++++++ prometheus-stack/prometheus.yaml | 8 +++ 9 files changed, 198 insertions(+) create mode 100644 prometheus-stack/.env.example create mode 100644 prometheus-stack/alertmanager.yaml create mode 100644 prometheus-stack/compose.yaml create mode 100644 prometheus-stack/k8s/grafana-values.yaml create mode 100644 prometheus-stack/k8s/ingress.yaml create mode 100644 prometheus-stack/k8s/namespace.yaml create mode 100644 prometheus-stack/k8s/secrets.yaml.example create mode 100644 prometheus-stack/k8s/traefik-metrics.yaml create mode 100644 prometheus-stack/prometheus.yaml diff --git a/prometheus-stack/.env.example b/prometheus-stack/.env.example new file mode 100644 index 0000000..de563c9 --- /dev/null +++ b/prometheus-stack/.env.example @@ -0,0 +1,2 @@ +GRAFANA_ADMIN_USER=admin +GRAFANA_ADMIN_PASSWORD=changeme diff --git a/prometheus-stack/alertmanager.yaml b/prometheus-stack/alertmanager.yaml new file mode 100644 index 0000000..04c071b --- /dev/null +++ b/prometheus-stack/alertmanager.yaml @@ -0,0 +1,5 @@ +route: + receiver: default + +receivers: + - name: default diff --git a/prometheus-stack/compose.yaml b/prometheus-stack/compose.yaml new file mode 100644 index 0000000..dcd13b2 --- /dev/null +++ b/prometheus-stack/compose.yaml @@ -0,0 +1,66 @@ +services: + grafana: + image: grafana/grafana:11.6.0 + container_name: prometheus-grafana + restart: unless-stopped + env_file: + - .env + environment: + GF_SECURITY_ADMIN_USER: ${GRAFANA_ADMIN_USER:-admin} + GF_SECURITY_ADMIN_PASSWORD: ${GRAFANA_ADMIN_PASSWORD:?grafana admin password required} + volumes: + - grafana-data:/var/lib/grafana + labels: + - "traefik.enable=true" + - "traefik.http.services.prometheus-grafana.loadbalancer.server.port=3000" + + # Prod Router + - "traefik.http.routers.grafana.rule=Host(`grafana.forust.xyz`)" + - "traefik.http.routers.grafana.entrypoints=websecure" + - "traefik.http.routers.grafana.tls=true" + # Local Router + - "traefik.http.routers.grafana-local.rule=Host(`grafana.workstation.internal`)" + - "traefik.http.routers.grafana-local.entrypoints=websecure" + - "traefik.http.routers.grafana-local.tls=true" + # Dev Router + - "traefik.http.routers.grafana-dev.rule=Host(`grafana.gigaforust.internal`)" + - "traefik.http.routers.grafana-dev.entrypoints=websecure" + - "traefik.http.routers.grafana-dev.tls=true" + networks: + - proxy + + prometheus: + image: prom/prometheus:v3.2.1 + container_name: prometheus-prometheus + restart: unless-stopped + command: + - "--config.file=/etc/prometheus/prometheus.yaml" + - "--storage.tsdb.path=/prometheus" + - "--storage.tsdb.retention.time=90d" + volumes: + - prometheus-data:/prometheus + - ./prometheus.yaml:/etc/prometheus/prometheus.yaml:ro + networks: + - proxy + + alertmanager: + image: prom/alertmanager:v0.28.1 + container_name: prometheus-alertmanager + restart: unless-stopped + command: + - "--config.file=/etc/alertmanager/alertmanager.yaml" + - "--storage.path=/alertmanager" + volumes: + - alertmanager-data:/alertmanager + - ./alertmanager.yaml:/etc/alertmanager/alertmanager.yaml:ro + networks: + - proxy + +volumes: + grafana-data: + prometheus-data: + alertmanager-data: + +networks: + proxy: + external: true diff --git a/prometheus-stack/k8s/grafana-values.yaml b/prometheus-stack/k8s/grafana-values.yaml new file mode 100644 index 0000000..6e7c8e1 --- /dev/null +++ b/prometheus-stack/k8s/grafana-values.yaml @@ -0,0 +1,52 @@ +grafana: + grafana.ini: + server: + domain: grafana.forust.xyz + root_url: https://grafana.forust.xyz + auth.anonymous: + enabled: false + users: + allow_sign_up: false + admin: + existingSecret: grafana-admin + userKey: admin-user + passwordKey: admin-password + + persistence: + enabled: true + size: 10Gi + + ingress: + enabled: false + + service: + port: 80 + +prometheus: + prometheusSpec: + storageSpec: + volumeClaimTemplate: + spec: + storageClassName: "local-path" + accessModes: + - ReadWriteOnce + resources: + requests: + storage: 40Gi + resources: + requests: + memory: "700Mi" + cpu: 200m + limits: + memory: "2Gi" +alertmanager: + alertmanagerSpec: + storage: + volumeClaimTemplate: + spec: + accessModes: + - ReadWriteOnce + + resources: + requests: + storage: 20Gi diff --git a/prometheus-stack/k8s/ingress.yaml b/prometheus-stack/k8s/ingress.yaml new file mode 100644 index 0000000..83893db --- /dev/null +++ b/prometheus-stack/k8s/ingress.yaml @@ -0,0 +1,36 @@ +apiVersion: traefik.io/v1alpha1 +kind: IngressRoute +metadata: + name: grafana-prod + namespace: prometheus +spec: + entryPoints: + - websecure + routes: + - match: Host(`grafana.forust.xyz`) + kind: Rule + middlewares: + - name: "crowdsec-crowdsec-bouncer@kubernetescrd" + - name: "security-chain@file" + services: + - name: prometheus-stack-grafana + port: 80 + tls: + certResolver: letsencrypt + domains: + - main: grafana.forust.xyz +--- +apiVersion: traefik.io/v1alpha1 +kind: IngressRoute +metadata: + name: grafana-local + namespace: prometheus +spec: + entryPoints: + - websecure + routes: + - match: HostRegexp(`^grafana\.(workstation|gigaforust)\.internal$`) + kind: Rule + services: + - name: prometheus-stack-grafana + port: 80 diff --git a/prometheus-stack/k8s/namespace.yaml b/prometheus-stack/k8s/namespace.yaml new file mode 100644 index 0000000..ea5d16f --- /dev/null +++ b/prometheus-stack/k8s/namespace.yaml @@ -0,0 +1,4 @@ +apiVersion: v1 +kind: Namespace +metadata: + name: prometheus diff --git a/prometheus-stack/k8s/secrets.yaml.example b/prometheus-stack/k8s/secrets.yaml.example new file mode 100644 index 0000000..931408f --- /dev/null +++ b/prometheus-stack/k8s/secrets.yaml.example @@ -0,0 +1,9 @@ +apiVersion: v1 +kind: Secret +metadata: + name: grafana-admin + namespace: prometheus +type: Opaque +stringData: + admin-user: "admin" + admin-password: "" diff --git a/prometheus-stack/k8s/traefik-metrics.yaml b/prometheus-stack/k8s/traefik-metrics.yaml new file mode 100644 index 0000000..3067701 --- /dev/null +++ b/prometheus-stack/k8s/traefik-metrics.yaml @@ -0,0 +1,16 @@ +apiVersion: monitoring.coreos.com/v1 +kind: ServiceMonitor +metadata: + name: traefik-monitor + namespace: prometheus + labels: + release: prometheus-stack +spec: + namespaceSelector: + any: true + selector: + matchLabels: + app.kubernetes.io/name: traefik + endpoints: + - port: metrics + interval: 15s diff --git a/prometheus-stack/prometheus.yaml b/prometheus-stack/prometheus.yaml new file mode 100644 index 0000000..88ce109 --- /dev/null +++ b/prometheus-stack/prometheus.yaml @@ -0,0 +1,8 @@ +global: + scrape_interval: 15s + evaluation_interval: 15s + +scrape_configs: + - job_name: prometheus + static_configs: + - targets: ["localhost:9090"]